From patchwork Fri Oct 20 23:25:24 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Paolo Bonzini X-Patchwork-Id: 10021129 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 167FF60234 for ; Fri, 20 Oct 2017 23:25:58 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0A08328D17 for ; Fri, 20 Oct 2017 23:25:58 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id F0C2928D05; Fri, 20 Oct 2017 23:25:57 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM, T_DKIM_INVALID autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6463228D05 for ; Fri, 20 Oct 2017 23:25:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753077AbdJTXZf (ORCPT ); Fri, 20 Oct 2017 19:25:35 -0400 Received: from mail-wr0-f194.google.com ([209.85.128.194]:45071 "EHLO mail-wr0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752789AbdJTXZd (ORCPT ); Fri, 20 Oct 2017 19:25:33 -0400 Received: by mail-wr0-f194.google.com with SMTP id y9so353675wrb.2; Fri, 20 Oct 2017 16:25:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=1Qim09VBYH++9wkt7GrYEensdrazdr1F8gS16P5B7yw=; b=fvPOrIijFCWOxS0u/FAjBd6XzAQFdSwyex0UE00k8gxOhZrCgI/zwcNt4zdndjlxcc efGedo97dqfM/MkjbWOu4zAq+T7ezMtjjKa1sqQR4xBB4WdXOpOgmhvBFCMWI2shlpWL w29FPaJwmSLcj1gcLU4UBLCLYpxi6opShxKqYBC2rh24YDWA1PwJe4SFAZ0Ng+i7L53D iH2fMELineBgnBnADOEQjfJhSnZDjJjUs0ckIy870U66HNOO3t8FCVit97XjGXjH66Vo 5cCyi+yuy/b++tygu2jTSXNLGUzQVULBdpJwrspt0FtXKizhXUxOGLY3ZNUHxVZ8gY7w 0fDA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references:mime-version:content-transfer-encoding; bh=1Qim09VBYH++9wkt7GrYEensdrazdr1F8gS16P5B7yw=; b=FEPEXpF6b3Yk9yUWDTOQoi8SauLsQerQpG0bDeNC6GRLW2SknjutwNhGUZIUVQtc/I JUp8YTwzPWFuhNaueighd66TuSR/GhVVQnV5hkggyCWan7II4t96WKd/lNHC/QDrLEch gLCEVms9t/odJgzB1Qi3Qt3WO+gb2nbZ7XvxWeV+SI8ut4q/VINE6znh1JRBIKuT8GSm xCRFK2vgZ+hdhrt8IEYstEepWZZ/Th/ep9bSpXsRkRHfJNgaOmROH2m5k+s6PbnWipj2 CTMZkGnmkUyvoCwnoQRByCPN4CZDvKxu7EviVOAkBMPHvpCG0JdXYCc/ZMNV1WGx3SQC QTUg== X-Gm-Message-State: AMCzsaWw84g6JE0ZB1cKCerJ1TKKP8w2duji6Z1KTMF4eMwbdhoXofPj loXTyGMzREmh1eUYqMQhEHHKzhIz X-Google-Smtp-Source: ABhQp+T67dOxS/6ZsfLWs0/DzL1BQrULEQ6bTGgqAJ0nwts8uO/1qEV3TXhCuGEd3LAQ4L8bKRRidw== X-Received: by 10.223.186.12 with SMTP id o12mr3552180wrg.1.1508541931045; Fri, 20 Oct 2017 16:25:31 -0700 (PDT) Received: from donizetti.lan (94-39-195-153.adsl-ull.clienti.tiscali.it. [94.39.195.153]) by smtp.gmail.com with ESMTPSA id u138sm3617188wmd.17.2017.10.20.16.25.29 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Fri, 20 Oct 2017 16:25:30 -0700 (PDT) From: Paolo Bonzini To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: Thomas Gleixner , kernel-hardening@lists.openwall.com, Kees Cook , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Christoffer Dall , Marc Zyngier , Christian Borntraeger , Cornelia Huck , James Hogan , Paul Mackerras Subject: [PATCH 1/2] KVM: allow setting a usercopy region in struct kvm_vcpu Date: Sat, 21 Oct 2017 01:25:24 +0200 Message-Id: <20171020232525.7387-2-pbonzini@redhat.com> X-Mailer: git-send-email 2.14.2 In-Reply-To: <20171020232525.7387-1-pbonzini@redhat.com> References: <20171020232525.7387-1-pbonzini@redhat.com> MIME-Version: 1.0 Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On x86, struct kvm_vcpu has a usercopy region corresponding to the CPUID entries. The area is read and written by the KVM_GET/SET_CPUID2 ioctls. Without this patch, KVM is completely broken on x86 with usercopy hardening enabled. Define kvm_init in terms of a more generic function that allows setting a usercopy region. Because x86 has separate kvm_init callers for Intel and AMD, another variant called kvm_init_x86 passes the region corresponding to the cpuid_entries array. Reported-by: Thomas Gleixner Cc: kernel-hardening@lists.openwall.com Cc: Kees Cook Cc: Radim Krčmář Cc: Christoffer Dall Cc: Marc Zyngier Cc: Christian Borntraeger Cc: Cornelia Huck Cc: James Hogan Cc: Paul Mackerras Signed-off-by: Paolo Bonzini --- The patch is on top of linux-next. arch/x86/include/asm/kvm_host.h | 3 +++ arch/x86/kvm/svm.c | 4 ++-- arch/x86/kvm/vmx.c | 4 ++-- arch/x86/kvm/x86.c | 10 ++++++++++ include/linux/kvm_host.h | 13 +++++++++++-- virt/kvm/kvm_main.c | 13 ++++++++----- 6 files changed, 36 insertions(+), 11 deletions(-) diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h index 6b8f937ca398..bb8243d413d0 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -1420,6 +1420,9 @@ static inline void kvm_arch_vcpu_unblocking(struct kvm_vcpu *vcpu) static inline void kvm_arch_vcpu_block_finish(struct kvm_vcpu *vcpu) {} +int kvm_init_x86(struct kvm_x86_ops *kvm_x86_ops, unsigned vcpu_size, + unsigned vcpu_align, struct module *module); + static inline int kvm_cpu_get_apicid(int mps_cpu) { #ifdef CONFIG_X86_LOCAL_APIC diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index ff94552f85d0..457433c3a703 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -5594,8 +5594,8 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = { static int __init svm_init(void) { - return kvm_init(&svm_x86_ops, sizeof(struct vcpu_svm), - __alignof__(struct vcpu_svm), THIS_MODULE); + return kvm_init_x86(&svm_x86_ops, sizeof(struct vcpu_svm), + __alignof__(struct vcpu_svm), THIS_MODULE); } static void __exit svm_exit(void) diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index c460b0b439d3..6e78530df6a8 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -12106,8 +12106,8 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = { static int __init vmx_init(void) { - int r = kvm_init(&vmx_x86_ops, sizeof(struct vcpu_vmx), - __alignof__(struct vcpu_vmx), THIS_MODULE); + int r = kvm_init_x86(&vmx_x86_ops, sizeof(struct vcpu_vmx), + __alignof__(struct vcpu_vmx), THIS_MODULE); if (r) return r; diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 5669af09b732..415529a78c37 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -8181,6 +8181,16 @@ void kvm_arch_sync_events(struct kvm *kvm) kvm_free_pit(kvm); } +int kvm_init_x86(struct kvm_x86_ops *kvm_x86_ops, unsigned vcpu_size, + unsigned vcpu_align, struct module *module) +{ + return kvm_init_usercopy(kvm_x86_ops, vcpu_size, vcpu_align, + offsetof(struct kvm_vcpu_arch, cpuid_entries), + sizeof_field(struct kvm_vcpu_arch, cpuid_entries), + module); +} +EXPORT_SYMBOL_GPL(kvm_init_x86); + int __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size) { int i, r; diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index 6882538eda32..21e19658b086 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -561,8 +561,17 @@ static inline void kvm_irqfd_exit(void) { } #endif -int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, - struct module *module); + +int kvm_init_usercopy(void *opaque, unsigned vcpu_size, unsigned vcpu_align, + unsigned vcpu_usercopy_start, unsigned vcpu_usercopy_size, + struct module *module); + +static inline int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, + struct module *module) +{ + return kvm_init_usercopy(opaque, vcpu_size, vcpu_align, 0, 0, module); +} + void kvm_exit(void); void kvm_get_kvm(struct kvm *kvm); diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 261c782a688f..ac889b28bb54 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -3959,8 +3959,9 @@ static void kvm_sched_out(struct preempt_notifier *pn, kvm_arch_vcpu_put(vcpu); } -int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, - struct module *module) +int kvm_init_usercopy(void *opaque, unsigned vcpu_size, unsigned vcpu_align, + unsigned vcpu_arch_usercopy_start, unsigned vcpu_arch_usercopy_size, + struct module *module) { int r; int cpu; @@ -4006,8 +4007,10 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, /* A kmem cache lets us meet the alignment requirements of fx_save. */ if (!vcpu_align) vcpu_align = __alignof__(struct kvm_vcpu); - kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align, - SLAB_ACCOUNT, NULL); + kvm_vcpu_cache = kmem_cache_create_usercopy("kvm_vcpu", vcpu_size, vcpu_align, + SLAB_ACCOUNT, + offsetof(struct kvm_vcpu, arch) + vcpu_arch_usercopy_start, + vcpu_arch_usercopy_size, NULL); if (!kvm_vcpu_cache) { r = -ENOMEM; goto out_free_3; @@ -4065,7 +4068,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, out_fail: return r; } -EXPORT_SYMBOL_GPL(kvm_init); +EXPORT_SYMBOL_GPL(kvm_init_usercopy); void kvm_exit(void) {