From patchwork Fri Oct 20 23:25:24 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Paolo Bonzini X-Patchwork-Id: 10021125 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id CBC7260234 for ; Fri, 20 Oct 2017 23:25:52 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BFC3C28D05 for ; Fri, 20 Oct 2017 23:25:52 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B427828D1E; Fri, 20 Oct 2017 23:25:52 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 4595828D05 for ; Fri, 20 Oct 2017 23:25:51 +0000 (UTC) Received: (qmail 3305 invoked by uid 550); 20 Oct 2017 23:25:44 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 3266 invoked from network); 20 Oct 2017 23:25:42 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=1Qim09VBYH++9wkt7GrYEensdrazdr1F8gS16P5B7yw=; b=fvPOrIijFCWOxS0u/FAjBd6XzAQFdSwyex0UE00k8gxOhZrCgI/zwcNt4zdndjlxcc efGedo97dqfM/MkjbWOu4zAq+T7ezMtjjKa1sqQR4xBB4WdXOpOgmhvBFCMWI2shlpWL w29FPaJwmSLcj1gcLU4UBLCLYpxi6opShxKqYBC2rh24YDWA1PwJe4SFAZ0Ng+i7L53D iH2fMELineBgnBnADOEQjfJhSnZDjJjUs0ckIy870U66HNOO3t8FCVit97XjGXjH66Vo 5cCyi+yuy/b++tygu2jTSXNLGUzQVULBdpJwrspt0FtXKizhXUxOGLY3ZNUHxVZ8gY7w 0fDA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references:mime-version:content-transfer-encoding; bh=1Qim09VBYH++9wkt7GrYEensdrazdr1F8gS16P5B7yw=; b=KprC0soDhgs9jvVU7xIU9dHWigv0/zF5ar9FkH3O5vFKwT5Y3xI3fb0KJmLv7I/sHm dvUN4iYDmzoXo0GWy5j/uPK+uaO3OfAYobTp0T+GsZudBZzMtomfgf0zhQrt0GFDVyNr oXItAZBryadCxnxUAXIYnclI7DIh+BYpbqA21gZUwRS8YWSlEhWgT20S4qVWe4mYJ9UJ FaOkalkS7H0doMZF9pGag95JmN+j+MRlribWDinaj7bCG/0cPTAklxH9zI0ioyG5RK1j XvQqIK2x5LO81TXw7Jb43WmshdDCT8PRke0X5HY6R77QSW5rX9qVvAisAXqIi1uqO5Wg 1w0Q== X-Gm-Message-State: AMCzsaXlwtFgN8peIAmGsugvySpttAG7JuMH+fGy0rjphdW+RGchqpnk 2oiLh/9wCK8OayKTlpVSezE= X-Google-Smtp-Source: ABhQp+T67dOxS/6ZsfLWs0/DzL1BQrULEQ6bTGgqAJ0nwts8uO/1qEV3TXhCuGEd3LAQ4L8bKRRidw== X-Received: by 10.223.186.12 with SMTP id o12mr3552180wrg.1.1508541931045; Fri, 20 Oct 2017 16:25:31 -0700 (PDT) Sender: Paolo Bonzini From: Paolo Bonzini To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: Thomas Gleixner , kernel-hardening@lists.openwall.com, Kees Cook , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Christoffer Dall , Marc Zyngier , Christian Borntraeger , Cornelia Huck , James Hogan , Paul Mackerras Date: Sat, 21 Oct 2017 01:25:24 +0200 Message-Id: <20171020232525.7387-2-pbonzini@redhat.com> X-Mailer: git-send-email 2.14.2 In-Reply-To: <20171020232525.7387-1-pbonzini@redhat.com> References: <20171020232525.7387-1-pbonzini@redhat.com> MIME-Version: 1.0 Subject: [kernel-hardening] [PATCH 1/2] KVM: allow setting a usercopy region in struct kvm_vcpu X-Virus-Scanned: ClamAV using ClamSMTP On x86, struct kvm_vcpu has a usercopy region corresponding to the CPUID entries. The area is read and written by the KVM_GET/SET_CPUID2 ioctls. Without this patch, KVM is completely broken on x86 with usercopy hardening enabled. Define kvm_init in terms of a more generic function that allows setting a usercopy region. Because x86 has separate kvm_init callers for Intel and AMD, another variant called kvm_init_x86 passes the region corresponding to the cpuid_entries array. Reported-by: Thomas Gleixner Cc: kernel-hardening@lists.openwall.com Cc: Kees Cook Cc: Radim Krčmář Cc: Christoffer Dall Cc: Marc Zyngier Cc: Christian Borntraeger Cc: Cornelia Huck Cc: James Hogan Cc: Paul Mackerras Signed-off-by: Paolo Bonzini --- The patch is on top of linux-next. arch/x86/include/asm/kvm_host.h | 3 +++ arch/x86/kvm/svm.c | 4 ++-- arch/x86/kvm/vmx.c | 4 ++-- arch/x86/kvm/x86.c | 10 ++++++++++ include/linux/kvm_host.h | 13 +++++++++++-- virt/kvm/kvm_main.c | 13 ++++++++----- 6 files changed, 36 insertions(+), 11 deletions(-) diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h index 6b8f937ca398..bb8243d413d0 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -1420,6 +1420,9 @@ static inline void kvm_arch_vcpu_unblocking(struct kvm_vcpu *vcpu) static inline void kvm_arch_vcpu_block_finish(struct kvm_vcpu *vcpu) {} +int kvm_init_x86(struct kvm_x86_ops *kvm_x86_ops, unsigned vcpu_size, + unsigned vcpu_align, struct module *module); + static inline int kvm_cpu_get_apicid(int mps_cpu) { #ifdef CONFIG_X86_LOCAL_APIC diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index ff94552f85d0..457433c3a703 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -5594,8 +5594,8 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = { static int __init svm_init(void) { - return kvm_init(&svm_x86_ops, sizeof(struct vcpu_svm), - __alignof__(struct vcpu_svm), THIS_MODULE); + return kvm_init_x86(&svm_x86_ops, sizeof(struct vcpu_svm), + __alignof__(struct vcpu_svm), THIS_MODULE); } static void __exit svm_exit(void) diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index c460b0b439d3..6e78530df6a8 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -12106,8 +12106,8 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = { static int __init vmx_init(void) { - int r = kvm_init(&vmx_x86_ops, sizeof(struct vcpu_vmx), - __alignof__(struct vcpu_vmx), THIS_MODULE); + int r = kvm_init_x86(&vmx_x86_ops, sizeof(struct vcpu_vmx), + __alignof__(struct vcpu_vmx), THIS_MODULE); if (r) return r; diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 5669af09b732..415529a78c37 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -8181,6 +8181,16 @@ void kvm_arch_sync_events(struct kvm *kvm) kvm_free_pit(kvm); } +int kvm_init_x86(struct kvm_x86_ops *kvm_x86_ops, unsigned vcpu_size, + unsigned vcpu_align, struct module *module) +{ + return kvm_init_usercopy(kvm_x86_ops, vcpu_size, vcpu_align, + offsetof(struct kvm_vcpu_arch, cpuid_entries), + sizeof_field(struct kvm_vcpu_arch, cpuid_entries), + module); +} +EXPORT_SYMBOL_GPL(kvm_init_x86); + int __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size) { int i, r; diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index 6882538eda32..21e19658b086 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -561,8 +561,17 @@ static inline void kvm_irqfd_exit(void) { } #endif -int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, - struct module *module); + +int kvm_init_usercopy(void *opaque, unsigned vcpu_size, unsigned vcpu_align, + unsigned vcpu_usercopy_start, unsigned vcpu_usercopy_size, + struct module *module); + +static inline int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, + struct module *module) +{ + return kvm_init_usercopy(opaque, vcpu_size, vcpu_align, 0, 0, module); +} + void kvm_exit(void); void kvm_get_kvm(struct kvm *kvm); diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 261c782a688f..ac889b28bb54 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -3959,8 +3959,9 @@ static void kvm_sched_out(struct preempt_notifier *pn, kvm_arch_vcpu_put(vcpu); } -int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, - struct module *module) +int kvm_init_usercopy(void *opaque, unsigned vcpu_size, unsigned vcpu_align, + unsigned vcpu_arch_usercopy_start, unsigned vcpu_arch_usercopy_size, + struct module *module) { int r; int cpu; @@ -4006,8 +4007,10 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, /* A kmem cache lets us meet the alignment requirements of fx_save. */ if (!vcpu_align) vcpu_align = __alignof__(struct kvm_vcpu); - kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align, - SLAB_ACCOUNT, NULL); + kvm_vcpu_cache = kmem_cache_create_usercopy("kvm_vcpu", vcpu_size, vcpu_align, + SLAB_ACCOUNT, + offsetof(struct kvm_vcpu, arch) + vcpu_arch_usercopy_start, + vcpu_arch_usercopy_size, NULL); if (!kvm_vcpu_cache) { r = -ENOMEM; goto out_free_3; @@ -4065,7 +4068,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, out_fail: return r; } -EXPORT_SYMBOL_GPL(kvm_init); +EXPORT_SYMBOL_GPL(kvm_init_usercopy); void kvm_exit(void) {