From: Sean Christopherson <seanjc@google.com>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: Sean Christopherson <seanjc@google.com>,
Vitaly Kuznetsov <vkuznets@redhat.com>,
Wanpeng Li <wanpengli@tencent.com>,
Jim Mattson <jmattson@google.com>, Joerg Roedel <joro@8bytes.org>,
kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
Ben Gardon <bgardon@google.com>,
Brijesh Singh <brijesh.singh@amd.com>,
Tom Lendacky <thomas.lendacky@amd.com>
Subject: [PATCH v2 00/17] KVM: x86/mmu: Lots of bug fixes
Date: Thu, 4 Mar 2021 17:10:44 -0800 [thread overview]
Message-ID: <20210305011101.3597423-1-seanjc@google.com> (raw)
Fix nested NPT (nSVM) with 32-bit L1 and SME with shadow paging, which
are completely broken. Opportunistically fix theoretical bugs related to
prematurely reloading/unloading the MMU.
If nNPT is enabled, L1 can crash the host simply by using 32-bit NPT to
trigger a null pointer dereference on pae_root.
SME with shadow paging (including nNPT) fails to set the C-bit in the
shadow pages that don't go through standard MMU flows (PDPTPRs and the
PML4 used by nNPT to shadow legacy NPT). It also failes to account for
CR3[63:32], and thus the C-bit, being ignored outside of 64-bit mode.
Patches 01 and 02 fix the null pointer bugs.
Patches 03-09 fix mostly-benign related memory leaks.
Patches 10-12 fix the SME shadow paging bugs, which are also what led me to
the nNPT null pointer bugs.
Patches 13 and 14 fix theoretical bugs with PTP_SWITCH and INVPCID that
I found when auditing flows that touch the MMU context.
Patches 14-17 do additional clean up to hopefully make it harder to
introduce bugs in the future.
On the plus side, I finally understand why KVM supports shadowing 2-level
page tables with 4-level page tables...
Based on kvm/queue, commit fe5f0041c026 ("KVM/SVM: Move vmenter.S exception
fixups out of line"). The null pointer fixes cherry-pick cleanly onto
kvm/master, haven't tried the other bug fixes (I doubt they're worth
backporting even though I tagged 'em with stable).
v2:
- Collect a review from Ben (did not include his review of patch 03
since the patch and its direct dependencies were changed).
- Move pae_root and lm_root allocation to a separate helper to avoid
sleeping via get_zeroed_page() while holding mmu_lock.
- Add a patch to grab 'mmu' in a local variable.
- Remove the BUILD_BUG_ON() in make_mmu_pages_available() since the
final check wouldn't actually guarnatee 4 pages were "available".
Instead, add a comment about the limit being soft.
v1:
- https://lkml.kernel.org/r/20210302184540.2829328-1-seanjc@google.com
Sean Christopherson (17):
KVM: nSVM: Set the shadow root level to the TDP level for nested NPT
KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with
64-bit
KVM: x86/mmu: Capture 'mmu' in a local variable when allocating roots
KVM: x86/mmu: Allocate the lm_root before allocating PAE roots
KVM: x86/mmu: Allocate pae_root and lm_root pages in dedicated helper
KVM: x86/mmu: Ensure MMU pages are available when allocating roots
KVM: x86/mmu: Check PDPTRs before allocating PAE roots
KVM: x86/mmu: Fix and unconditionally enable WARNs to detect PAE leaks
KVM: x86/mmu: Use '0' as the one and only value for an invalid PAE
root
KVM: x86/mmu: Set the C-bit in the PDPTRs and LM pseudo-PDPTRs
KVM: x86/mmu: Mark the PAE roots as decrypted for shadow paging
KVM: SVM: Don't strip the C-bit from CR2 on #PF interception
KVM: nVMX: Defer the MMU reload to the normal path on an EPTP switch
KVM: x86: Defer the MMU unload to the normal path on an global INVPCID
KVM: x86/mmu: Unexport MMU load/unload functions
KVM: x86/mmu: Sync roots after MMU load iff load as successful
KVM: x86/mmu: WARN on NULL pae_root or lm_root, or bad shadow root
level
arch/x86/include/asm/kvm_host.h | 3 -
arch/x86/kvm/mmu.h | 4 +
arch/x86/kvm/mmu/mmu.c | 273 ++++++++++++++++++++------------
arch/x86/kvm/mmu/tdp_mmu.c | 23 +--
arch/x86/kvm/svm/svm.c | 9 +-
arch/x86/kvm/vmx/nested.c | 9 +-
arch/x86/kvm/x86.c | 2 +-
7 files changed, 192 insertions(+), 131 deletions(-)
--
2.30.1.766.gb4fecdf3b7-goog
next reply other threads:[~2021-03-05 1:11 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-05 1:10 Sean Christopherson [this message]
2021-03-05 1:10 ` [PATCH v2 01/17] KVM: nSVM: Set the shadow root level to the TDP level for nested NPT Sean Christopherson
2021-03-05 1:10 ` [PATCH v2 02/17] KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit Sean Christopherson
2021-03-05 1:10 ` [PATCH v2 03/17] KVM: x86/mmu: Capture 'mmu' in a local variable when allocating roots Sean Christopherson
2021-03-05 1:10 ` [PATCH v2 04/17] KVM: x86/mmu: Allocate the lm_root before allocating PAE roots Sean Christopherson
2021-03-05 1:10 ` [PATCH v2 05/17] KVM: x86/mmu: Allocate pae_root and lm_root pages in dedicated helper Sean Christopherson
2021-03-05 17:34 ` Paolo Bonzini
2021-03-05 1:10 ` [PATCH v2 06/17] KVM: x86/mmu: Ensure MMU pages are available when allocating roots Sean Christopherson
2021-03-05 1:10 ` [PATCH v2 07/17] KVM: x86/mmu: Check PDPTRs before allocating PAE roots Sean Christopherson
2021-04-08 11:15 ` Wanpeng Li
2021-04-08 12:09 ` Paolo Bonzini
2021-04-08 15:48 ` Sean Christopherson
2021-04-08 15:57 ` Paolo Bonzini
2021-04-08 16:27 ` Sean Christopherson
2021-04-08 16:30 ` Paolo Bonzini
2021-03-05 1:10 ` [PATCH v2 08/17] KVM: x86/mmu: Fix and unconditionally enable WARNs to detect PAE leaks Sean Christopherson
2021-03-05 1:10 ` [PATCH v2 09/17] KVM: x86/mmu: Use '0' as the one and only value for an invalid PAE root Sean Christopherson
2021-03-05 17:52 ` Paolo Bonzini
2021-03-05 18:22 ` Sean Christopherson
2021-03-05 18:23 ` Paolo Bonzini
2021-03-05 1:10 ` [PATCH v2 10/17] KVM: x86/mmu: Set the C-bit in the PDPTRs and LM pseudo-PDPTRs Sean Christopherson
2021-03-05 1:10 ` [PATCH v2 11/17] KVM: x86/mmu: Mark the PAE roots as decrypted for shadow paging Sean Christopherson
2021-03-05 17:44 ` Paolo Bonzini
2021-03-05 18:02 ` Sean Christopherson
2021-03-05 1:10 ` [PATCH v2 12/17] KVM: SVM: Don't strip the C-bit from CR2 on #PF interception Sean Christopherson
2021-03-05 1:10 ` [PATCH v2 13/17] KVM: nVMX: Defer the MMU reload to the normal path on an EPTP switch Sean Christopherson
2021-03-05 1:10 ` [PATCH v2 14/17] KVM: x86: Defer the MMU unload to the normal path on an global INVPCID Sean Christopherson
2021-03-05 1:10 ` [PATCH v2 15/17] KVM: x86/mmu: Unexport MMU load/unload functions Sean Christopherson
2021-03-05 1:11 ` [PATCH v2 16/17] KVM: x86/mmu: Sync roots after MMU load iff load as successful Sean Christopherson
2021-03-05 1:11 ` [PATCH v2 17/17] KVM: x86/mmu: WARN on NULL pae_root or lm_root, or bad shadow root level Sean Christopherson
2021-03-05 17:53 ` [PATCH v2 00/17] KVM: x86/mmu: Lots of bug fixes Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210305011101.3597423-1-seanjc@google.com \
--to=seanjc@google.com \
--cc=bgardon@google.com \
--cc=brijesh.singh@amd.com \
--cc=jmattson@google.com \
--cc=joro@8bytes.org \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=thomas.lendacky@amd.com \
--cc=vkuznets@redhat.com \
--cc=wanpengli@tencent.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.