linux-kernel - Re: [PATCH v4 01/32] KVM: x86: Blindly get current x2APIC reg value on "nodecode write" traps

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 08 Dec 2022 23:47:04 +0200
From:   Maxim Levitsky <mlevitsk@...hat.com>
To:     Sean Christopherson <seanjc@...gle.com>,
        Paolo Bonzini <pbonzini@...hat.com>
Cc:     kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
        Alejandro Jimenez <alejandro.j.jimenez@...cle.com>,
        Suravee Suthikulpanit <suravee.suthikulpanit@....com>,
        Li RongQing <lirongqing@...du.com>
Subject: Re: [PATCH v4 01/32] KVM: x86: Blindly get current x2APIC reg value
 on "nodecode write" traps

On Sat, 2022-10-01 at 00:58 +0000, Sean Christopherson wrote:
> When emulating a x2APIC write in response to an APICv/AVIC trap, get the
> the written value from the vAPIC page without checking that reads are
> allowed for the target register.  AVIC can generate trap-like VM-Exits on
> writes to EOI, and so KVM needs to get the written value from the backing
> page without running afoul of EOI's write-only behavior.
> 
> Alternatively, EOI could be special cased to always write '0', e.g. so
> that the sanity check could be preserved, but x2APIC on AMD is actually
> supposed to disallow non-zero writes (not emulated by KVM), and the
> sanity check was a byproduct of how the KVM code was written, i.e. wasn't
> added to guard against anything in particular.
> 
> Fixes: 70c8327c11c6 ("KVM: x86: Bug the VM if an accelerated x2APIC trap occurs on a "bad" reg")
> Fixes: 1bd9dfec9fd4 ("KVM: x86: Do not block APIC write for non ICR registers")
> Reported-by: Alejandro Jimenez <alejandro.j.jimenez@...cle.com>
> Cc: stable@...r.kernel.org
> Signed-off-by: Sean Christopherson <seanjc@...gle.com>
> ---
>  arch/x86/kvm/lapic.c | 9 ++-------
>  1 file changed, 2 insertions(+), 7 deletions(-)
> 
> diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
> index d7639d126e6c..05d079fc2c66 100644
> --- a/arch/x86/kvm/lapic.c
> +++ b/arch/x86/kvm/lapic.c
> @@ -2284,23 +2284,18 @@ void kvm_apic_write_nodecode(struct kvm_vcpu *vcpu, u32 offset)
>  	struct kvm_lapic *apic = vcpu->arch.apic;
>  	u64 val;
>  
> -	if (apic_x2apic_mode(apic)) {
> -		if (KVM_BUG_ON(kvm_lapic_msr_read(apic, offset, &val), vcpu->kvm))
> -			return;
> -	} else {
> -		val = kvm_lapic_get_reg(apic, offset);
> -	}
> -
>  	/*
>  	 * ICR is a single 64-bit register when x2APIC is enabled.  For legacy
>  	 * xAPIC, ICR writes need to go down the common (slightly slower) path
>  	 * to get the upper half from ICR2.
>  	 */
>  	if (apic_x2apic_mode(apic) && offset == APIC_ICR) {
> +		val = kvm_lapic_get_reg64(apic, APIC_ICR);
>  		kvm_apic_send_ipi(apic, (u32)val, (u32)(val >> 32));
>  		trace_kvm_apic_write(APIC_ICR, val);
>  	} else {
>  		/* TODO: optimize to just emulate side effect w/o one more write */
> +		val = kvm_lapic_get_reg(apic, offset);
>  		kvm_lapic_reg_write(apic, offset, (u32)val);
>  	}
>  }

Reviewed-by: Maxim Levitsky <mlevitsk@...hat.com>

Best regards,
	Maxim Levitsky