linux-kernel - Re: [PATCH v3 3/4] KVM: nVMX: relax canonical checks on some x86 registers in vmx host state

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4d292a92016c65ae7521edec2cc0e9842c033e26.camel@redhat.com>
Date: Fri, 16 Aug 2024 13:40:47 +0300
From: mlevitsk@...hat.com
To: kvm@...r.kernel.org
Cc: Ingo Molnar <mingo@...hat.com>, x86@...nel.org, Paolo Bonzini
 <pbonzini@...hat.com>, Sean Christopherson <seanjc@...gle.com>, Thomas
 Gleixner <tglx@...utronix.de>, Dave Hansen <dave.hansen@...ux.intel.com>,
 Borislav Petkov <bp@...en8.de>, linux-kernel@...r.kernel.org, "H. Peter
 Anvin" <hpa@...or.com>
Subject: Re: [PATCH v3 3/4] KVM: nVMX: relax canonical checks on some x86
 registers in vmx host state

У чт, 2024-08-15 у 15:33 +0300, Maxim Levitsky пише:
> Several x86's architecture registers contain a linear base, and thus must
> contain a canonical address.
> 
> This includes segment and segment like bases (FS/GS base, GDT,IDT,LDT,TR),
> addresses used for SYSENTER and SYSCALL instructions and probably more.
> 
> As it turns out, when x86 architecture was updated to 5 level paging /
> 57 bit virtual addresses, these fields were allowed to contain a full
> 57 bit address regardless of the state of CR4.LA57.
> 
> The main reason behind this decision is that 5 level paging, and even
> paging itself can be temporarily disabled (e.g by SMM entry) leaving non
> canonical values in these fields.
> Another reason is that OS might prepare these fields before it switches to
> 5 level paging.

Hi,

Note that I haven't included a fix for HOST_RIP. I did today a bare metal check
and indeed the microcode does check CR4.LA57, the one that is stored in the vmcs
as you suspected.

I add a patch to this patch series with this mostly theoretical fix, when I send a new revision.

Second thing, I kept the canonical check on 'vmcs12->guest_bndcfgs because Intel
deprecated this feature and none of CPUs which support 5 level paging support MPX.

Also I think that since this is a guest state field, it might be possible to just
remove the check, because the value of this field is copied to vmcs02 and the
CPU's microcode should do the same check that KVM does.

Best regards,
	Maxim Levitsky


> 
> Signed-off-by: Maxim Levitsky <mlevitsk@...hat.com>
> ---
>  arch/x86/kvm/vmx/nested.c | 30 +++++++++++++++++++++++-------
>  1 file changed, 23 insertions(+), 7 deletions(-)
> 
> diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> index 2392a7ef254d..3f18edff80ac 100644
> --- a/arch/x86/kvm/vmx/nested.c
> +++ b/arch/x86/kvm/vmx/nested.c
> @@ -2969,6 +2969,22 @@ static int nested_vmx_check_address_space_size(struct kvm_vcpu *vcpu,
>         return 0;
>  }
>  
> +static bool is_l1_noncanonical_address_static(u64 la, struct kvm_vcpu *vcpu)
> +{
> +       u8 max_guest_address_bits = guest_can_use(vcpu, X86_FEATURE_LA57) ? 57 : 48;
> +       /*
> +        * Most x86 arch registers which contain linear addresses like
> +        * segment bases, addresses that are used in instructions (e.g SYSENTER),
> +        * have static canonicality checks,
> +        * size of whose depends only on CPU's support for 5-level
> +        * paging, rather than state of CR4.LA57.
> +        *
> +        * In other words the check only depends on the CPU model,
> +        * rather than on runtime state.
> +        */
> +       return !__is_canonical_address(la, max_guest_address_bits);
> +}
> +
>  static int nested_vmx_check_host_state(struct kvm_vcpu *vcpu,
>                                        struct vmcs12 *vmcs12)
>  {
> @@ -2979,8 +2995,8 @@ static int nested_vmx_check_host_state(struct kvm_vcpu *vcpu,
>             CC(!kvm_vcpu_is_legal_cr3(vcpu, vmcs12->host_cr3)))
>                 return -EINVAL;
>  
> -       if (CC(is_noncanonical_address(vmcs12->host_ia32_sysenter_esp, vcpu)) ||
> -           CC(is_noncanonical_address(vmcs12->host_ia32_sysenter_eip, vcpu)))
> +       if (CC(is_l1_noncanonical_address_static(vmcs12->host_ia32_sysenter_esp, vcpu)) ||
> +           CC(is_l1_noncanonical_address_static(vmcs12->host_ia32_sysenter_eip, vcpu)))
>                 return -EINVAL;
>  
>         if ((vmcs12->vm_exit_controls & VM_EXIT_LOAD_IA32_PAT) &&
> @@ -3014,11 +3030,11 @@ static int nested_vmx_check_host_state(struct kvm_vcpu *vcpu,
>             CC(vmcs12->host_ss_selector == 0 && !ia32e))
>                 return -EINVAL;
>  
> -       if (CC(is_noncanonical_address(vmcs12->host_fs_base, vcpu)) ||
> -           CC(is_noncanonical_address(vmcs12->host_gs_base, vcpu)) ||
> -           CC(is_noncanonical_address(vmcs12->host_gdtr_base, vcpu)) ||
> -           CC(is_noncanonical_address(vmcs12->host_idtr_base, vcpu)) ||
> -           CC(is_noncanonical_address(vmcs12->host_tr_base, vcpu)) ||
> +       if (CC(is_l1_noncanonical_address_static(vmcs12->host_fs_base, vcpu)) ||
> +           CC(is_l1_noncanonical_address_static(vmcs12->host_gs_base, vcpu)) ||
> +           CC(is_l1_noncanonical_address_static(vmcs12->host_gdtr_base, vcpu)) ||
> +           CC(is_l1_noncanonical_address_static(vmcs12->host_idtr_base, vcpu)) ||
> +           CC(is_l1_noncanonical_address_static(vmcs12->host_tr_base, vcpu)) ||
>             CC(is_noncanonical_address(vmcs12->host_rip, vcpu)))
>                 return -EINVAL;
>