From nobody Thu Apr 25 20:32:10 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=none (zohomail.com: 192.237.175.120 is neither permitted nor denied by domain of lists.xenproject.org) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=fail(p=none dis=none) header.from=citrix.com ARC-Seal: i=1; a=rsa-sha256; t=1574445288; cv=none; d=zohomail.com; s=zohoarc; b=e/ib5NkndRGF+zu2+ocddtywPPpT+4HNzTt5kfsIZHUeTm7DIU0EbJmLoKZtTUhlulZv510UXqMkMxgqdq9o/DVj1gga/hSy+4FSbT9VOkijuQnny7PvlMMbna1fTUHKflbI4+tvOu7dnW/nqgwKJHG5Eix/ZrgXKbcQuRx/HFs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1574445288; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=U40qAk1beDg7IZcyTJ5JBFe2u1Gle11BnQv3iHBRPuY=; b=lEjVzpvNMqSk66r4Ub5QJ4xZtksI0n4kszYl5pQZC/BdfPraPOfxYnDkvPlBhdha/sagSxm2v7HXqk3qfQHVfhurZqrtlud3/AC8+MRvUNDT8ZUp6M8rWp/dG1p+mE5wIPtY+2sufyIERTucJGIXaAzed/StwbxepnrH9Q0NDsc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=none (zohomail.com: 192.237.175.120 is neither permitted nor denied by domain of lists.xenproject.org) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1574445288095463.64806588972726; Fri, 22 Nov 2019 09:54:48 -0800 (PST) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1iYD8A-0003C3-S3; Fri, 22 Nov 2019 17:54:06 +0000 Received: from us1-rack-iad1.inumbo.com ([172.99.69.81]) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1iYD89-0003By-Jj for xen-devel@lists.xenproject.org; Fri, 22 Nov 2019 17:54:05 +0000 Received: from esa5.hc3370-68.iphmx.com (unknown [216.71.155.168]) by us1-rack-iad1.inumbo.com (Halon) with ESMTPS id 121edbcc-0d51-11ea-9631-bc764e2007e4; Fri, 22 Nov 2019 17:54:04 +0000 (UTC) X-Inumbo-ID: 121edbcc-0d51-11ea-9631-bc764e2007e4 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1574445244; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=HXcnCB6nRDkJ+o+V3RLL9+gsBW4q019azAzA+8ecIn4=; b=g3DEE2hzKMcWiEpYDAz9HETi9w01FHd5J3A9L8EYCn8IlDIhEKTVIBzu xlCR7f/Xqunros43OX0qk/VB57WFxqr/yVHYOT53k0v0eKPvtz+94FKHK 9lyBxYZK9s5fjHNfMc6ekG8q/P7RyQwS5HfuzGx9mcMUyDaEOWWK344Qu 8=; Authentication-Results: esa5.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none; spf=None smtp.pra=andrew.cooper3@citrix.com; spf=Pass smtp.mailfrom=Andrew.Cooper3@citrix.com; spf=None smtp.helo=postmaster@mail.citrix.com Received-SPF: none (zohomail.com: 192.237.175.120 is neither permitted nor denied by domain of lists.xenproject.org) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Received-SPF: None (esa5.hc3370-68.iphmx.com: no sender authenticity information available from domain of andrew.cooper3@citrix.com) identity=pra; client-ip=162.221.158.21; receiver=esa5.hc3370-68.iphmx.com; envelope-from="Andrew.Cooper3@citrix.com"; x-sender="andrew.cooper3@citrix.com"; x-conformance=sidf_compatible Received-SPF: Pass (esa5.hc3370-68.iphmx.com: domain of Andrew.Cooper3@citrix.com designates 162.221.158.21 as permitted sender) identity=mailfrom; client-ip=162.221.158.21; receiver=esa5.hc3370-68.iphmx.com; envelope-from="Andrew.Cooper3@citrix.com"; x-sender="Andrew.Cooper3@citrix.com"; x-conformance=sidf_compatible; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:209.167.231.154 ip4:178.63.86.133 ip4:195.66.111.40/30 ip4:85.115.9.32/28 ip4:199.102.83.4 ip4:192.28.146.160 ip4:192.28.146.107 ip4:216.52.6.88 ip4:216.52.6.188 ip4:162.221.158.21 ip4:162.221.156.83 ip4:168.245.78.127 ~all" Received-SPF: None (esa5.hc3370-68.iphmx.com: no sender authenticity information available from domain of postmaster@mail.citrix.com) identity=helo; client-ip=162.221.158.21; receiver=esa5.hc3370-68.iphmx.com; envelope-from="Andrew.Cooper3@citrix.com"; x-sender="postmaster@mail.citrix.com"; x-conformance=sidf_compatible IronPort-SDR: P6pzqmnWmLpgmbaqiOUDrMXski24enc8D3hDT/Z1DBLhxco1YVrqxWMn8dxhXaM9wjMmnuxZJa vsF3DwzYhiiGDGyq6xNEUDzOU7miXQREIcqfBHolJ2oVJxrMgztZEXmtkdFiTPM5N8r1FnNq0t p7VmT8r1E3ZF5U1fvAh2CMyEWq/fkbyjOogKBDvbJJSqqNWykqijm4GyOqIprqQ9WkC81mtCH8 /TrqJivddumnwkHsanwre7nMdmNDY1ym58hT4rHFpf2IDVqPe/RJOipRm84+j08UFKCJuVqB28 adk= X-SBRS: 2.7 X-MesageID: 9084183 X-Ironport-Server: esa5.hc3370-68.iphmx.com X-Remote-IP: 162.221.158.21 X-Policy: $RELAYED X-IronPort-AV: E=Sophos;i="5.69,230,1571716800"; d="scan'208";a="9084183" From: Andrew Cooper To: Xen-devel Date: Fri, 22 Nov 2019 17:54:00 +0000 Message-ID: <20191122175400.4001-1-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 MIME-Version: 1.0 Subject: [Xen-devel] [PATCH for-4.13] x86/vvmx: Fix livelock with XSA-304 fix X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Juergen Gross , Andrew Cooper , Wei Liu , Jan Beulich , =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) It turns out that the XSA-304 / CVE-2018-12207 fix of disabling executable superpages doesn't work well with the nested p2m code. Nested virt is experimental and not security supported, but is useful for development purposes. In order to not regress the status quo, disable the XSA-304 workaround until the nested p2m code can be improved. Introduce a per-domain exec_sp control and set it based on the current opt_ept_exec_sp setting. Take the oppotunity to omit a PVH hardware domain from the performance hit, because it is already permitted to DoS the system= in such ways as issuing a reboot. When nested virt is enabled on a domain, force it to using executable superpages and rebuild the p2m. Having the setting per-domain involves rearranging the internals of parse_ept_param_runtime() but it still retains the same overall semantics - for each applicable domain whose setting needs to change, rebuild the p2m. Signed-off-by: Andrew Cooper Acked-by: George Dunlap --- CC: Jan Beulich CC: Wei Liu CC: Roger Pau Monn=C3=A9 CC: Juergen Gross --- xen/arch/x86/hvm/vmx/vmcs.c | 31 +++++++++++++++++++++++-------- xen/arch/x86/hvm/vmx/vmx.c | 6 ++++++ xen/arch/x86/hvm/vmx/vvmx.c | 13 +++++++++++++ xen/arch/x86/mm/p2m-ept.c | 2 +- xen/include/asm-x86/hvm/vmx/vmcs.h | 6 ++++++ 5 files changed, 49 insertions(+), 9 deletions(-) diff --git a/xen/arch/x86/hvm/vmx/vmcs.c b/xen/arch/x86/hvm/vmx/vmcs.c index 477c968409..f10f6b78ec 100644 --- a/xen/arch/x86/hvm/vmx/vmcs.c +++ b/xen/arch/x86/hvm/vmx/vmcs.c @@ -31,6 +31,7 @@ #include #include #include +#include #include #include #include @@ -97,6 +98,7 @@ custom_param("ept", parse_ept_param); =20 static int parse_ept_param_runtime(const char *s) { + struct domain *d; int val; =20 if ( !cpu_has_vmx_ept || !hvm_funcs.hap_supported || @@ -110,18 +112,31 @@ static int parse_ept_param_runtime(const char *s) if ( (val =3D parse_boolean("exec-sp", s, NULL)) < 0 ) return -EINVAL; =20 - if ( val !=3D opt_ept_exec_sp ) + opt_ept_exec_sp =3D val; + + rcu_read_lock(&domlist_read_lock); + for_each_domain ( d ) { - struct domain *d; + /* PV, or HVM Shadow domain? Not applicable. */ + if ( !paging_mode_hap(d) ) + continue; =20 - opt_ept_exec_sp =3D val; + /* Hardware domain? Not applicable. */ + if ( is_hardware_domain(d) ) + continue; =20 - rcu_read_lock(&domlist_read_lock); - for_each_domain ( d ) - if ( paging_mode_hap(d) ) - p2m_change_entry_type_global(d, p2m_ram_rw, p2m_ram_rw); - rcu_read_unlock(&domlist_read_lock); + /* Nested Virt? Broken and exec_sp forced on to avoid livelocks. = */ + if ( nestedhvm_enabled(d) ) + continue; + + /* Setting already matches? No need to rebuild the p2m. */ + if ( d->arch.hvm.vmx.exec_sp =3D=3D val ) + continue; + + d->arch.hvm.vmx.exec_sp =3D val; + p2m_change_entry_type_global(d, p2m_ram_rw, p2m_ram_rw); } + rcu_read_unlock(&domlist_read_lock); =20 printk("VMX: EPT executable superpages %sabled\n", val ? "en" : "dis"); diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c index 6a5eeb5c13..a71df71bc1 100644 --- a/xen/arch/x86/hvm/vmx/vmx.c +++ b/xen/arch/x86/hvm/vmx/vmx.c @@ -404,6 +404,12 @@ static int vmx_domain_initialise(struct domain *d) =20 d->arch.ctxt_switch =3D &csw; =20 + /* + * Work around CVE-2018-12207? The hardware domain is already permitt= ed + * to reboot the system, so doesn't need mitigating against DoS's. + */ + d->arch.hvm.vmx.exec_sp =3D is_hardware_domain(d) || opt_ept_exec_sp; + if ( !has_vlapic(d) ) return 0; =20 diff --git a/xen/arch/x86/hvm/vmx/vvmx.c b/xen/arch/x86/hvm/vmx/vvmx.c index 6696bd6240..5dd00e11b5 100644 --- a/xen/arch/x86/hvm/vmx/vvmx.c +++ b/xen/arch/x86/hvm/vmx/vvmx.c @@ -63,10 +63,23 @@ void nvmx_cpu_dead(unsigned int cpu) =20 int nvmx_vcpu_initialise(struct vcpu *v) { + struct domain *d =3D v->domain; struct nestedvmx *nvmx =3D &vcpu_2_nvmx(v); struct nestedvcpu *nvcpu =3D &vcpu_nestedhvm(v); struct page_info *pg =3D alloc_domheap_page(NULL, 0); =20 + /* + * Gross bodge. The nested p2m logic can't cope with the CVE-2018-122= 07 + * workaround of using NX EPT superpages, and livelocks. Nested HVM i= sn't + * security supported, so disable the workaround until the nested p2m + * logic can be improved. + */ + if ( !d->arch.hvm.vmx.exec_sp ) + { + d->arch.hvm.vmx.exec_sp =3D true; + p2m_change_entry_type_global(d, p2m_ram_rw, p2m_ram_rw); + } + if ( !pg ) { gdprintk(XENLOG_ERR, "nest: allocation for shadow vmcs failed\n"); diff --git a/xen/arch/x86/mm/p2m-ept.c b/xen/arch/x86/mm/p2m-ept.c index f06e51904a..b5517769c9 100644 --- a/xen/arch/x86/mm/p2m-ept.c +++ b/xen/arch/x86/mm/p2m-ept.c @@ -178,7 +178,7 @@ static void ept_p2m_type_to_flags(struct p2m_domain *p2= m, ept_entry_t *entry, * Don't create executable superpages if we need to shatter them to * protect against CVE-2018-12207. */ - if ( !opt_ept_exec_sp && is_epte_superpage(entry) ) + if ( !p2m->domain->arch.hvm.vmx.exec_sp && is_epte_superpage(entry) ) entry->x =3D 0; } =20 diff --git a/xen/include/asm-x86/hvm/vmx/vmcs.h b/xen/include/asm-x86/hvm/v= mx/vmcs.h index b3e800138e..2713da74db 100644 --- a/xen/include/asm-x86/hvm/vmx/vmcs.h +++ b/xen/include/asm-x86/hvm/vmx/vmcs.h @@ -63,6 +63,12 @@ struct vmx_domain { unsigned long apic_access_mfn; /* VMX_DOMAIN_* */ unsigned int status; + + /* + * Domain permitted to use Executable EPT Superpages? Cleared to work + * around CVE-2018-12207 as appropriate. + */ + bool exec_sp; }; =20 /* --=20 2.11.0 _______________________________________________ Xen-devel mailing list Xen-devel@lists.xenproject.org https://lists.xenproject.org/mailman/listinfo/xen-devel