From patchwork Wed Sep 11 15:24:41 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Jan Beulich X-Patchwork-Id: 11141359 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id CBDC11395 for ; Wed, 11 Sep 2019 15:25:59 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id B19E8207FC for ; Wed, 11 Sep 2019 15:25:59 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B19E8207FC Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=suse.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1i84UE-0002Wr-Pb; Wed, 11 Sep 2019 15:24:50 +0000 Received: from all-amaz-eas1.inumbo.com ([34.197.232.57] helo=us1-amaz-eas2.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1i84UD-0002Wj-Sm for xen-devel@lists.xenproject.org; Wed, 11 Sep 2019 15:24:49 +0000 X-Inumbo-ID: 4ab65988-d4a8-11e9-83d8-12813bfff9fa Received: from mx1.suse.de (unknown [195.135.220.15]) by us1-amaz-eas2.inumbo.com (Halon) with ESMTPS id 4ab65988-d4a8-11e9-83d8-12813bfff9fa; Wed, 11 Sep 2019 15:24:48 +0000 (UTC) X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id BBFA4B71C; Wed, 11 Sep 2019 15:24:47 +0000 (UTC) From: Jan Beulich To: "xen-devel@lists.xenproject.org" References: Message-ID: <30619001-ca6c-0450-a0bb-4d71687b281a@suse.com> Date: Wed, 11 Sep 2019 17:24:41 +0200 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 In-Reply-To: Content-Language: en-US Subject: [Xen-devel] [PATCH 5/9] x86/HVM: refuse CR3 loads with reserved (upper) bits set X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: George Dunlap , Andrew Cooper , Wei Liu , =?utf-8?q?Roger_Pau_Monn=C3=A9?= Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" While bits 11 and below are, if not used for other purposes, reserved but ignored, bits beyond physical address width are supposed to raise exceptions (at least in the non-nested case; I'm not convinced the current nested SVM/VMX behavior of raising #GP(0) here is correct, but that's not the subject of this change). Introduce currd as a local variable, and replace other v->domain instances at the same time. Signed-off-by: Jan Beulich Reviewed-by: Roger Pau Monné --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -1004,6 +1004,13 @@ static int hvm_load_cpu_ctxt(struct doma return -EINVAL; } + if ( ctxt.cr3 & ~((1UL << d->arch.cpuid->extd.maxphysaddr) - 1) ) + { + printk(XENLOG_G_ERR "HVM%d restore: bad CR3 %#" PRIx64 "\n", + d->domain_id, ctxt.cr3); + return X86EMUL_EXCEPTION; + } + if ( (ctxt.flags & ~XEN_X86_FPU_INITIALISED) != 0 ) { gprintk(XENLOG_ERR, "bad flags value in CPU context: %#x\n", @@ -2290,10 +2297,19 @@ int hvm_set_cr0(unsigned long value, boo int hvm_set_cr3(unsigned long value, bool noflush, bool may_defer) { struct vcpu *v = current; + struct domain *currd = v->domain; struct page_info *page; unsigned long old = v->arch.hvm.guest_cr[3]; - if ( may_defer && unlikely(v->domain->arch.monitor.write_ctrlreg_enabled & + if ( value & ~((1UL << currd->arch.cpuid->extd.maxphysaddr) - 1) ) + { + HVM_DBG_LOG(DBG_LEVEL_1, + "Attempt to set reserved CR3 bit(s): %lx", + value); + return X86EMUL_EXCEPTION; + } + + if ( may_defer && unlikely(currd->arch.monitor.write_ctrlreg_enabled & monitor_ctrlreg_bitmask(VM_EVENT_X86_CR3)) ) { ASSERT(v->arch.vm_event); @@ -2309,13 +2325,12 @@ int hvm_set_cr3(unsigned long value, boo } } - if ( hvm_paging_enabled(v) && !paging_mode_hap(v->domain) && + if ( hvm_paging_enabled(v) && !paging_mode_hap(currd) && (value != v->arch.hvm.guest_cr[3]) ) { /* Shadow-mode CR3 change. Check PDBR and update refcounts. */ HVM_DBG_LOG(DBG_LEVEL_VMMU, "CR3 value = %lx", value); - page = get_page_from_gfn(v->domain, value >> PAGE_SHIFT, - NULL, P2M_ALLOC); + page = get_page_from_gfn(currd, value >> PAGE_SHIFT, NULL, P2M_ALLOC); if ( !page ) goto bad_cr3; @@ -2331,7 +2346,7 @@ int hvm_set_cr3(unsigned long value, boo bad_cr3: gdprintk(XENLOG_ERR, "Invalid CR3\n"); - domain_crash(v->domain); + domain_crash(currd); return X86EMUL_UNHANDLEABLE; }