lkml.org 
[lkml]   [2021]   [May]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    Subject[PATCH 03/15] KVM: SVM: Inject #UD on RDTSCP when it should be disabled in the guest
    From
    Intercept RDTSCP to inject #UD if RDTSC is disabled in the guest.

    Note, SVM does not support intercepting RDPID. Unlike VMX's
    ENABLE_RDTSCP control, RDTSCP interception does not apply to RDPID. This
    is a benign virtualization hole as the host kernel (incorrectly) sets
    MSR_TSC_AUX if RDTSCP is supported, and KVM loads the guest's MSR_TSC_AUX
    into hardware if RDTSCP is supported in the host, i.e. KVM will not leak
    the host's MSR_TSC_AUX to the guest.

    But, when the kernel bug is fixed, KVM will start leaking the host's
    MSR_TSC_AUX if RDPID is supported in hardware, but RDTSCP isn't available
    for whatever reason. This leak will be remedied in a future commit.

    Fixes: 46896c73c1a4 ("KVM: svm: add support for RDTSCP")
    Cc: stable@vger.kernel.org
    Signed-off-by: Sean Christopherson <seanjc@google.com>
    ---
    arch/x86/kvm/svm/svm.c | 17 +++++++++++++----
    1 file changed, 13 insertions(+), 4 deletions(-)

    diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
    index a7271f31df47..8f2b184270c0 100644
    --- a/arch/x86/kvm/svm/svm.c
    +++ b/arch/x86/kvm/svm/svm.c
    @@ -1100,7 +1100,9 @@ static u64 svm_write_l1_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
    return svm->vmcb->control.tsc_offset;
    }

    -static void svm_check_invpcid(struct vcpu_svm *svm)
    +/* Evaluate instruction intercepts that depend on guest CPUID features. */
    +static void svm_recalc_instruction_intercepts(struct kvm_vcpu *vcpu,
    + struct vcpu_svm *svm)
    {
    /*
    * Intercept INVPCID if shadow paging is enabled to sync/free shadow
    @@ -1113,6 +1115,13 @@ static void svm_check_invpcid(struct vcpu_svm *svm)
    else
    svm_clr_intercept(svm, INTERCEPT_INVPCID);
    }
    +
    + if (kvm_cpu_cap_has(X86_FEATURE_RDTSCP)) {
    + if (guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP))
    + svm_clr_intercept(svm, INTERCEPT_RDTSCP);
    + else
    + svm_set_intercept(svm, INTERCEPT_RDTSCP);
    + }
    }

    static void init_vmcb(struct kvm_vcpu *vcpu)
    @@ -1248,7 +1257,7 @@ static void init_vmcb(struct kvm_vcpu *vcpu)
    svm_clr_intercept(svm, INTERCEPT_PAUSE);
    }

    - svm_check_invpcid(svm);
    + svm_recalc_instruction_intercepts(vcpu, svm);

    /*
    * If the host supports V_SPEC_CTRL then disable the interception
    @@ -3084,6 +3093,7 @@ static int (*const svm_exit_handlers[])(struct kvm_vcpu *vcpu) = {
    [SVM_EXIT_STGI] = stgi_interception,
    [SVM_EXIT_CLGI] = clgi_interception,
    [SVM_EXIT_SKINIT] = skinit_interception,
    + [SVM_EXIT_RDTSCP] = kvm_handle_invalid_op,
    [SVM_EXIT_WBINVD] = kvm_emulate_wbinvd,
    [SVM_EXIT_MONITOR] = kvm_emulate_monitor,
    [SVM_EXIT_MWAIT] = kvm_emulate_mwait,
    @@ -4007,8 +4017,7 @@ static void svm_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu)
    svm->nrips_enabled = kvm_cpu_cap_has(X86_FEATURE_NRIPS) &&
    guest_cpuid_has(vcpu, X86_FEATURE_NRIPS);

    - /* Check again if INVPCID interception if required */
    - svm_check_invpcid(svm);
    + svm_recalc_instruction_intercepts(vcpu, svm);

    /* For sev guests, the memory encryption bit is not reserved in CR3. */
    if (sev_guest(vcpu->kvm)) {
    --
    2.31.1.527.g47e6f16901-goog
    \
     
     \ /
      Last update: 2021-05-04 19:18    [W:3.755 / U:0.232 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site