From nobody Fri Nov 22 01:35:09 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=reject dis=none) header.from=citrix.com ARC-Seal: i=1; a=rsa-sha256; t=1729681131; cv=none; d=zohomail.com; s=zohoarc; b=Pot2tsm0J8SMa4ZXGlQZnGYRpCTkb3srPct0npou9JQ8OdzjusO+T8B7gtK+0oWeob6BSSvpZfccqoVjfcT0qlpzQ+dAV10huGHp9PL0BDqlb9cQkJv9VgAeDV0hQbi5Le2SBQA7ORZDGx8oS3hNLVYNk1z0vcQpvOpTluT6nVw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1729681131; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=a8SPZF1bqa9Lk4OYKepi92x25hB7trhEWs2vbib+stU=; b=ARauljkVb92LiEPpyJrT0CaqPxzmH71wcRsKh+b/rDLlFi2nhq7/v2VUFfcCvWKea4WlqhWfnopuCxn88sMGQYca1UV1kOmFuZ+j+XviAHfMpqVLrs0VCOYWFF8iBanbdUP7QVzLzd9iE8SiqOdvVHlyMOmMus3fBJc2Ff2RVNo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1729681131554246.2772392145115; Wed, 23 Oct 2024 03:58:51 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.824525.1238679 (Exim 4.92) (envelope-from ) id 1t3Z45-0000rb-VM; Wed, 23 Oct 2024 10:58:09 +0000 Received: by outflank-mailman (output) from mailman id 824525.1238679; Wed, 23 Oct 2024 10:58:09 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1t3Z45-0000rS-Rn; Wed, 23 Oct 2024 10:58:09 +0000 Received: by outflank-mailman (input) for mailman id 824525; Wed, 23 Oct 2024 10:58:07 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1t3Z43-0000Ow-Pw for xen-devel@lists.xenproject.org; Wed, 23 Oct 2024 10:58:07 +0000 Received: from mail-ed1-x52c.google.com (mail-ed1-x52c.google.com [2a00:1450:4864:20::52c]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id ae8928c7-912d-11ef-99a3-01e77a169b0f; Wed, 23 Oct 2024 12:58:06 +0200 (CEST) Received: by mail-ed1-x52c.google.com with SMTP id 4fb4d7f45d1cf-5c903f5bd0eso4136111a12.3 for ; Wed, 23 Oct 2024 03:58:06 -0700 (PDT) Received: from andrewcoop.eng.citrite.net ([185.25.67.249]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a9a91571e3asm462067266b.147.2024.10.23.03.58.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 23 Oct 2024 03:58:03 -0700 (PDT) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: ae8928c7-912d-11ef-99a3-01e77a169b0f DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=citrix.com; s=google; t=1729681085; x=1730285885; darn=lists.xenproject.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=a8SPZF1bqa9Lk4OYKepi92x25hB7trhEWs2vbib+stU=; b=rKzP6aNekPT1RcD7Grp+I8wlneptF9Pvpxiqk9NDhctfpOednbGGwiGdUurbYpFujC DLgYAeM7t3bDNbrIk2D2vTB+zN5vqEKU7Xz1WVqzhUuZ4EOOvISYki3Byd+w/6FtdgxZ 7RmbXkxPQKy5HujHsy8thc7dl4HBAUbWI+t4Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1729681085; x=1730285885; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=a8SPZF1bqa9Lk4OYKepi92x25hB7trhEWs2vbib+stU=; b=QThtI+/Hgs0keBL/I1VMWQ20r7bMmRRPq0FGjzf2H4WcxZBFM2/Smqu1dHJzSjUXC2 7mEJs4iAMNN3zYt67sby+C7SLYyxOIjWRzukil880JXP3UHZfdc3NvIS/EE9yLlvCp3O z7ecux8GI7ejV/iYG34gXTkNguzwZgSxWjd1h0CD09B8ZfN8AdgtvacKn/JsXhb+N4sj b0lvAQoBVVrn9Bfam5/HXpl3A6tpzowGb8QN0VV70lWTHxcCunXdjAB5soriXfqIGrcE A7VTiwdNZctn1/cM+1feqfXIcIqhMFZ1a/5DsRnzMtgJRWU6WEvwVvQYNHrA/UDlPA6X U54w== X-Gm-Message-State: AOJu0YxqmYHqJFxyCkCHCXKOTtcFJMq1e7CeOEs0zlu7WJdJsw7Vy1NS hDS+Rn+WzA+tDzT+Vuzn2e8pPPKfGBIm6jX2tULDsKPHcQg5S1/eUkWGOvgGBzC0xASmyy6bYSn G X-Google-Smtp-Source: AGHT+IHmTNn0JVHgpbYVl+Y31smPoUXgo9AyjVpRj/G14FOate2Tlhsisc8tNZ2unCNQ/s/U0173Tg== X-Received: by 2002:a17:907:3dac:b0:a99:ce2f:b0ff with SMTP id a640c23a62f3a-a9abf8a4f1dmr207886566b.33.1729681085103; Wed, 23 Oct 2024 03:58:05 -0700 (PDT) From: Andrew Cooper To: Xen-devel Cc: "Daniel P. Smith" , Andrew Cooper , Jan Beulich , =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= Subject: [PATCH 2/3] x86/boot: Fix microcode module handling during PVH boot Date: Wed, 23 Oct 2024 11:57:55 +0100 Message-Id: <20241023105756.641695-3-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241023105756.641695-1-andrew.cooper3@citrix.com> References: <20241023105756.641695-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @citrix.com) X-ZM-MESSAGEID: 1729681132591116600 From: "Daniel P. Smith" As detailed in commit 0fe607b2a144 ("x86/boot: Fix PVH boot during boot_info transition period"), the use of __va(mbi->mods_addr) constitutes a use-after-free on the PVH boot path. This pattern has been in use since before PVH support was added. Inside a = PVH VM, it will go unnoticed as long as the microcode container parser doesn't choke on the random data it finds. The use within early_microcode_init() happens to be safe because it's prior= to move_xen(). microcode_init_cache() is after move_xen(), and therefore unsa= fe. Plumb the boot_info pointer down, replacing module_map and mbi. Importantl= y, bi->mods[].mod is a safe way to access the module list during PVH boot. Note: microcode_scan_module() is still bogusly stashing a bootstrap_map()'d pointer in ucode_blob.data, which constitutes a different use-after-free, and only works in general because of a second bug. T= his is unrelated to PVH, and needs untangling differently. Signed-off-by: Daniel P. Smith Signed-off-by: Andrew Cooper Acked-by: Roger Pau Monn=C3=A9 Reviewed-by: Daniel P. Smith --- CC: Jan Beulich CC: Roger Pau Monn=C3=A9 CC: Daniel P. Smith Refectored/extracted from the hyperlaunch series. There's no good Fixes tag for this, because it can't reasonably be "introdu= ce PVH", nor can the fix as-is reasonably be backported. If we want to fix the bug in older trees, we need to plumb the mod pointer down alongside mbi. --- xen/arch/x86/cpu/microcode/core.c | 40 +++++++++++----------------- xen/arch/x86/include/asm/microcode.h | 8 +++--- xen/arch/x86/setup.c | 4 +-- 3 files changed, 22 insertions(+), 30 deletions(-) diff --git a/xen/arch/x86/cpu/microcode/core.c b/xen/arch/x86/cpu/microcode= /core.c index 8564e4d2c94c..1d58cb0f3bc1 100644 --- a/xen/arch/x86/cpu/microcode/core.c +++ b/xen/arch/x86/cpu/microcode/core.c @@ -35,6 +35,7 @@ #include =20 #include +#include #include #include #include @@ -152,11 +153,8 @@ static int __init cf_check parse_ucode(const char *s) } custom_param("ucode", parse_ucode); =20 -static void __init microcode_scan_module( - unsigned long *module_map, - const multiboot_info_t *mbi) +static void __init microcode_scan_module(struct boot_info *bi) { - module_t *mod =3D (module_t *)__va(mbi->mods_addr); uint64_t *_blob_start; unsigned long _blob_size; struct cpio_data cd; @@ -178,13 +176,13 @@ static void __init microcode_scan_module( /* * Try all modules and see whichever could be the microcode blob. */ - for ( i =3D 1 /* Ignore dom0 kernel */; i < mbi->mods_count; i++ ) + for ( i =3D 1 /* Ignore dom0 kernel */; i < bi->nr_modules; i++ ) { - if ( !test_bit(i, module_map) ) + if ( !test_bit(i, bi->module_map) ) continue; =20 - _blob_start =3D bootstrap_map(&mod[i]); - _blob_size =3D mod[i].mod_end; + _blob_start =3D bootstrap_map(bi->mods[i].mod); + _blob_size =3D bi->mods[i].mod->mod_end; if ( !_blob_start ) { printk("Could not map multiboot module #%d (size: %ld)\n", @@ -204,21 +202,17 @@ static void __init microcode_scan_module( } } =20 -static void __init microcode_grab_module( - unsigned long *module_map, - const multiboot_info_t *mbi) +static void __init microcode_grab_module(struct boot_info *bi) { - module_t *mod =3D (module_t *)__va(mbi->mods_addr); - if ( ucode_mod_idx < 0 ) - ucode_mod_idx +=3D mbi->mods_count; - if ( ucode_mod_idx <=3D 0 || ucode_mod_idx >=3D mbi->mods_count || - !__test_and_clear_bit(ucode_mod_idx, module_map) ) + ucode_mod_idx +=3D bi->nr_modules; + if ( ucode_mod_idx <=3D 0 || ucode_mod_idx >=3D bi->nr_modules || + !__test_and_clear_bit(ucode_mod_idx, bi->module_map) ) goto scan; - ucode_mod =3D mod[ucode_mod_idx]; + ucode_mod =3D *bi->mods[ucode_mod_idx].mod; scan: if ( ucode_scan ) - microcode_scan_module(module_map, mbi); + microcode_scan_module(bi); } =20 static struct microcode_ops __ro_after_init ucode_ops; @@ -822,8 +816,7 @@ static int __init early_update_cache(const void *data, = size_t len) return rc; } =20 -int __init microcode_init_cache(unsigned long *module_map, - const struct multiboot_info *mbi) +int __init microcode_init_cache(struct boot_info *bi) { int rc =3D 0; =20 @@ -832,7 +825,7 @@ int __init microcode_init_cache(unsigned long *module_m= ap, =20 if ( ucode_scan ) /* Need to rescan the modules because they might have been relocat= ed */ - microcode_scan_module(module_map, mbi); + microcode_scan_module(bi); =20 if ( ucode_mod.mod_end ) rc =3D early_update_cache(bootstrap_map(&ucode_mod), @@ -878,8 +871,7 @@ static int __init early_microcode_update_cpu(void) return microcode_update_cpu(patch, 0); } =20 -int __init early_microcode_init(unsigned long *module_map, - const struct multiboot_info *mbi) +int __init early_microcode_init(struct boot_info *bi) { const struct cpuinfo_x86 *c =3D &boot_cpu_data; int rc =3D 0; @@ -922,7 +914,7 @@ int __init early_microcode_init(unsigned long *module_m= ap, return -ENODEV; } =20 - microcode_grab_module(module_map, mbi); + microcode_grab_module(bi); =20 if ( ucode_mod.mod_end || ucode_blob.size ) rc =3D early_microcode_update_cpu(); diff --git a/xen/arch/x86/include/asm/microcode.h b/xen/arch/x86/include/as= m/microcode.h index 57c08205d475..a278773f8b5d 100644 --- a/xen/arch/x86/include/asm/microcode.h +++ b/xen/arch/x86/include/asm/microcode.h @@ -24,10 +24,10 @@ DECLARE_PER_CPU(struct cpu_signature, cpu_sig); void microcode_set_module(unsigned int idx); int microcode_update(XEN_GUEST_HANDLE(const_void) buf, unsigned long len, unsigned int flags); -int early_microcode_init(unsigned long *module_map, - const struct multiboot_info *mbi); -int microcode_init_cache(unsigned long *module_map, - const struct multiboot_info *mbi); int microcode_update_one(void); =20 +struct boot_info; +int early_microcode_init(struct boot_info *bi); +int microcode_init_cache(struct boot_info *bi); + #endif /* ASM_X86__MICROCODE_H */ diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c index d8001867c925..c75b8f15fa5d 100644 --- a/xen/arch/x86/setup.c +++ b/xen/arch/x86/setup.c @@ -1392,7 +1392,7 @@ void asmlinkage __init noreturn __start_xen(unsigned = long mbi_p) * TODO: load ucode earlier once multiboot modules become accessible * at an earlier stage. */ - early_microcode_init(module_map, mbi); + early_microcode_init(bi); =20 if ( xen_phys_start ) { @@ -1936,7 +1936,7 @@ void asmlinkage __init noreturn __start_xen(unsigned = long mbi_p) =20 timer_init(); =20 - microcode_init_cache(module_map, mbi); /* Needs xmalloc() */ + microcode_init_cache(bi); /* Needs xmalloc() */ =20 tsx_init(); /* Needs microcode. May change HLE/RTM feature bits. */ =20 --=20 2.39.5