[Xen-devel] [PATCH v5 0/4] nvmx: implement support for MSR bitmaps

[Xen-devel] [PATCH v5 0/4] nvmx: implement support for MSR bitmaps

[Roger Pau Monne]

Hello,

Current nested VMX code advertises support for the MSR bitmap feature,
yet the implementation isn't done. Previous to this series Xen just maps
the nested guest MSR bitmap (as set by L1) and that's it, the L2 guest
ends up using the L1 MSR bitmap.

This series adds handling of the L2 MSR bitmap and merging with the L1
MSR bitmap and loading it into the nested guest VMCS.

Patch #4 makes sure the x2APIC MSR range is always trapped, or else a
guest with nested virtualization enabled could manage to access some of
the x2APIC MSR registers from the host.

Thanks, Roger.Roger Pau Monne (4):
  nvmx: implement support for MSR bitmaps
  arm: rename BIT_WORD to BITOP_WORD
  bitmap: import bitmap_{set/clear} from Linux 5.5
  nvmx: always trap accesses to x2APIC MSRs

 xen/arch/arm/arm32/lib/bitops.c        |  4 +-
 xen/arch/arm/arm64/lib/bitops.c        |  4 +-
 xen/arch/arm/arm64/lib/find_next_bit.c | 10 ++--
 xen/arch/x86/hvm/vmx/vvmx.c            | 80 ++++++++++++++++++++++++--
 xen/common/bitmap.c                    | 39 +++++++++++++
 xen/include/asm-arm/bitops.h           | 10 ++--
 xen/include/asm-x86/hvm/vmx/vvmx.h     |  3 +-
 xen/include/xen/bitmap.h               | 40 +++++++++++++
 xen/include/xen/bitops.h               |  2 +
 9 files changed, 172 insertions(+), 20 deletions(-)

-- 
2.25.0


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

[Xen-devel] [PATCH v5 1/4] nvmx: implement support for MSR bitmaps

[Roger Pau Monne]

Current implementation of nested VMX has a half baked handling of MSR
bitmaps for the L1 VMM: it maps the L1 VMM provided MSR bitmap, but
doesn't actually load it into the nested vmcs, and thus the nested
guest vmcs ends up using the same MSR bitmap as the L1 VMM.

This is wrong as there's no assurance that the set of features enabled
for the L1 vmcs are the same that L1 itself is going to use in the
nested vmcs, and thus can lead to misconfigurations.

For example L1 vmcs can use x2APIC virtualization and virtual
interrupt delivery, and thus some x2APIC MSRs won't be trapped so that
they can be handled directly by the hardware using virtualization
extensions. On the other hand, the nested vmcs created by L1 VMM might
not use any of such features, so using a MSR bitmap that doesn't trap
accesses to the x2APIC MSRs will be leaking them to the underlying
hardware.

Fix this by crafting a merged MSR bitmap between the one used by L1
and the nested guest.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
---
Changes since v4:
 - Add static to vcpu_relinquish_resources.

Changes since v3:
 - Free the merged MSR bitmap page in nvmx_purge_vvmcs.

Changes since v2:
 - Pass shadow_ctrl into update_msrbitmap, and check there if
   CPU_BASED_ACTIVATE_MSR_BITMAP is set.
 - Do not enable MSR bitmap unless it's enabled in both L1 and L2.
 - Rename L1 guest to L2 in nestedvmx struct comment.

Changes since v1:
 - Split the x2APIC MSR fix into a separate patch.
 - Move setting MSR_BITMAP vmcs field into load_vvmcs_host_state for
   virtual vmexit.
 - Allocate memory with MEMF_no_owner.
 - Use tabs to align comment of the nestedvmx struct field.
---
 xen/arch/x86/hvm/vmx/vvmx.c        | 73 ++++++++++++++++++++++++++++--
 xen/include/asm-x86/hvm/vmx/vvmx.h |  3 +-
 2 files changed, 71 insertions(+), 5 deletions(-)

diff --git a/xen/arch/x86/hvm/vmx/vvmx.c b/xen/arch/x86/hvm/vmx/vvmx.c
index 47eee1e5b9..3337260d4b 100644
--- a/xen/arch/x86/hvm/vmx/vvmx.c
+++ b/xen/arch/x86/hvm/vmx/vvmx.c
@@ -128,6 +128,16 @@ int nvmx_vcpu_initialise(struct vcpu *v)
         unmap_domain_page(vw);
     }
 
+    if ( cpu_has_vmx_msr_bitmap )
+    {
+        nvmx->msr_merged = alloc_domheap_page(d, MEMF_no_owner);
+        if ( !nvmx->msr_merged )
+        {
+            gdprintk(XENLOG_ERR, "nest: allocation for MSR bitmap failed\n");
+            return -ENOMEM;
+        }
+    }
+
     nvmx->ept.enabled = 0;
     nvmx->guest_vpid = 0;
     nvmx->vmxon_region_pa = INVALID_PADDR;
@@ -183,13 +193,27 @@ void nvmx_vcpu_destroy(struct vcpu *v)
         v->arch.hvm.vmx.vmwrite_bitmap = NULL;
     }
 }
- 
+
+static void vcpu_relinquish_resources(struct vcpu *v)
+{
+    struct nestedvmx *nvmx = &vcpu_2_nvmx(v);
+
+    if ( nvmx->msr_merged )
+    {
+        free_domheap_page(nvmx->msr_merged);
+        nvmx->msr_merged = NULL;
+    }
+}
+
 void nvmx_domain_relinquish_resources(struct domain *d)
 {
     struct vcpu *v;
 
     for_each_vcpu ( d, v )
+    {
         nvmx_purge_vvmcs(v);
+        vcpu_relinquish_resources(v);
+    }
 }
 
 int nvmx_vcpu_reset(struct vcpu *v)
@@ -548,6 +572,35 @@ unsigned long *_shadow_io_bitmap(struct vcpu *v)
     return nestedhvm_vcpu_iomap_get(port80, portED);
 }
 
+static void update_msrbitmap(struct vcpu *v, uint32_t shadow_ctrl)
+{
+    struct nestedvmx *nvmx = &vcpu_2_nvmx(v);
+    struct vmx_msr_bitmap *msr_bitmap;
+
+    if ( !(shadow_ctrl & CPU_BASED_ACTIVATE_MSR_BITMAP) ||
+         !nvmx->msrbitmap )
+       return;
+
+    msr_bitmap = __map_domain_page(nvmx->msr_merged);
+
+    bitmap_or(msr_bitmap->read_low, nvmx->msrbitmap->read_low,
+              v->arch.hvm.vmx.msr_bitmap->read_low,
+              sizeof(msr_bitmap->read_low) * 8);
+    bitmap_or(msr_bitmap->read_high, nvmx->msrbitmap->read_high,
+              v->arch.hvm.vmx.msr_bitmap->read_high,
+              sizeof(msr_bitmap->read_high) * 8);
+    bitmap_or(msr_bitmap->write_low, nvmx->msrbitmap->write_low,
+              v->arch.hvm.vmx.msr_bitmap->write_low,
+              sizeof(msr_bitmap->write_low) * 8);
+    bitmap_or(msr_bitmap->write_high, nvmx->msrbitmap->write_high,
+              v->arch.hvm.vmx.msr_bitmap->write_high,
+              sizeof(msr_bitmap->write_high) * 8);
+
+    unmap_domain_page(msr_bitmap);
+
+    __vmwrite(MSR_BITMAP, page_to_maddr(nvmx->msr_merged));
+}
+
 void nvmx_update_exec_control(struct vcpu *v, u32 host_cntrl)
 {
     u32 pio_cntrl = (CPU_BASED_ACTIVATE_IO_BITMAP
@@ -558,10 +611,17 @@ void nvmx_update_exec_control(struct vcpu *v, u32 host_cntrl)
     shadow_cntrl = __n2_exec_control(v);
     pio_cntrl &= shadow_cntrl;
     /* Enforce the removed features */
-    shadow_cntrl &= ~(CPU_BASED_ACTIVATE_MSR_BITMAP
-                      | CPU_BASED_ACTIVATE_IO_BITMAP
+    shadow_cntrl &= ~(CPU_BASED_ACTIVATE_IO_BITMAP
                       | CPU_BASED_UNCOND_IO_EXITING);
-    shadow_cntrl |= host_cntrl;
+    /*
+     * Do NOT enforce the MSR bitmap currently used by L1, as certain hardware
+     * virtualization features require specific MSR bitmap settings, but
+     * without the guest also using these same features the bitmap could be
+     * leaking through unwanted MSR accesses.
+     */
+    shadow_cntrl |= host_cntrl & ~CPU_BASED_ACTIVATE_MSR_BITMAP;
+    if ( !(shadow_cntrl & host_cntrl & CPU_BASED_ACTIVATE_MSR_BITMAP) )
+      shadow_cntrl &= ~CPU_BASED_ACTIVATE_MSR_BITMAP;
     if ( pio_cntrl == CPU_BASED_UNCOND_IO_EXITING ) {
         /* L1 VMM intercepts all I/O instructions */
         shadow_cntrl |= CPU_BASED_UNCOND_IO_EXITING;
@@ -584,6 +644,8 @@ void nvmx_update_exec_control(struct vcpu *v, u32 host_cntrl)
         __vmwrite(IO_BITMAP_B, virt_to_maddr(bitmap) + PAGE_SIZE);
     }
 
+    update_msrbitmap(v, shadow_cntrl);
+
     /* TODO: change L0 intr window to MTF or NMI window */
     __vmwrite(CPU_BASED_VM_EXEC_CONTROL, shadow_cntrl);
 }
@@ -1278,6 +1340,9 @@ static void load_vvmcs_host_state(struct vcpu *v)
     hvm_set_tsc_offset(v, v->arch.hvm.cache_tsc_offset, 0);
 
     set_vvmcs(v, VM_ENTRY_INTR_INFO, 0);
+
+    if ( v->arch.hvm.vmx.exec_control & CPU_BASED_ACTIVATE_MSR_BITMAP )
+        __vmwrite(MSR_BITMAP, virt_to_maddr(v->arch.hvm.vmx.msr_bitmap));
 }
 
 static void sync_exception_state(struct vcpu *v)
diff --git a/xen/include/asm-x86/hvm/vmx/vvmx.h b/xen/include/asm-x86/hvm/vmx/vvmx.h
index 6b9c4ae0b2..c41f089939 100644
--- a/xen/include/asm-x86/hvm/vmx/vvmx.h
+++ b/xen/include/asm-x86/hvm/vmx/vvmx.h
@@ -37,7 +37,8 @@ struct nestedvmx {
      */
     paddr_t    vmxon_region_pa;
     void       *iobitmap[2];		/* map (va) of L1 guest I/O bitmap */
-    void       *msrbitmap;		/* map (va) of L1 guest MSR bitmap */
+    struct vmx_msr_bitmap *msrbitmap;	/* map (va) of L1 guest MSR bitmap */
+    struct page_info *msr_merged;	/* merged L1 and L2 MSR bitmap */
     /* deferred nested interrupt */
     struct {
         unsigned long intr_info;
-- 
2.25.0


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

[Xen-devel] [PATCH v5 2/4] arm: rename BIT_WORD to BITOP_WORD

[Roger Pau Monne]

So BIT_WORD can be imported from Linux. The difference between current
Linux implementation of BIT_WORD is that the size of the word unit is
a long integer, while the Xen one is hardcoded to 32 bits.

Current users of BITOP_WORD on Arm (which considers a word a long
integer) are switched to use the generic BIT_WORD which also operates
on long integers.

No functional change intended.

Suggested-by: Julien Grall <julien@xen.org>
Suggested-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
---
Changes since v4:
 - New in this version.
---
 xen/arch/arm/arm32/lib/bitops.c        |  4 ++--
 xen/arch/arm/arm64/lib/bitops.c        |  4 ++--
 xen/arch/arm/arm64/lib/find_next_bit.c | 10 ++++------
 xen/include/asm-arm/bitops.h           | 10 +++++-----
 xen/include/xen/bitops.h               |  2 ++
 5 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/xen/arch/arm/arm32/lib/bitops.c b/xen/arch/arm/arm32/lib/bitops.c
index 3dca769bf0..82d935ce33 100644
--- a/xen/arch/arm/arm32/lib/bitops.c
+++ b/xen/arch/arm/arm32/lib/bitops.c
@@ -33,7 +33,7 @@
 static always_inline bool int_##name(int nr, volatile void *p, bool timeout,\
                                      unsigned int max_try)                  \
 {                                                                           \
-    volatile uint32_t *ptr = (uint32_t *)p + BIT_WORD((unsigned int)nr);    \
+    volatile uint32_t *ptr = (uint32_t *)p + BITOP_WORD((unsigned int)nr);  \
     const uint32_t mask = BIT_MASK((unsigned int)nr);                       \
     unsigned long res, tmp;                                                 \
                                                                             \
@@ -71,7 +71,7 @@ bool name##_timeout(int nr, volatile void *p, unsigned int max_try)         \
 static always_inline bool int_##name(int nr, volatile void *p, int *oldbit, \
                                      bool timeout, unsigned int max_try)    \
 {                                                                           \
-    volatile uint32_t *ptr = (uint32_t *)p + BIT_WORD((unsigned int)nr);    \
+    volatile uint32_t *ptr = (uint32_t *)p + BITOP_WORD((unsigned int)nr);  \
     unsigned int bit = (unsigned int)nr % BITS_PER_WORD;                    \
     const uint32_t mask = BIT_MASK(bit);                                    \
     unsigned long res, tmp;                                                 \
diff --git a/xen/arch/arm/arm64/lib/bitops.c b/xen/arch/arm/arm64/lib/bitops.c
index 27688e5418..f5128c58f5 100644
--- a/xen/arch/arm/arm64/lib/bitops.c
+++ b/xen/arch/arm/arm64/lib/bitops.c
@@ -32,7 +32,7 @@
 static always_inline bool int_##name(int nr, volatile void *p, bool timeout,\
                                      unsigned int max_try)                  \
 {                                                                           \
-    volatile uint32_t *ptr = (uint32_t *)p + BIT_WORD((unsigned int)nr);    \
+    volatile uint32_t *ptr = (uint32_t *)p + BITOP_WORD((unsigned int)nr);  \
     const uint32_t mask = BIT_MASK((unsigned int)nr);                       \
     unsigned long res, tmp;                                                 \
                                                                             \
@@ -67,7 +67,7 @@ bool name##_timeout(int nr, volatile void *p, unsigned int max_try)         \
 static always_inline bool int_##name(int nr, volatile void *p, int *oldbit, \
                                      bool timeout, unsigned int max_try)    \
 {                                                                           \
-    volatile uint32_t *ptr = (uint32_t *)p + BIT_WORD((unsigned int)nr);    \
+    volatile uint32_t *ptr = (uint32_t *)p + BITOP_WORD((unsigned int)nr);  \
     unsigned int bit = (unsigned int)nr % BITS_PER_WORD;                    \
     const uint32_t mask = BIT_MASK(bit);                                    \
     unsigned long res, tmp;                                                 \
diff --git a/xen/arch/arm/arm64/lib/find_next_bit.c b/xen/arch/arm/arm64/lib/find_next_bit.c
index 17cb176266..8ebf8bfe97 100644
--- a/xen/arch/arm/arm64/lib/find_next_bit.c
+++ b/xen/arch/arm/arm64/lib/find_next_bit.c
@@ -12,8 +12,6 @@
 #include <asm/types.h>
 #include <asm/byteorder.h>
 
-#define BITOP_WORD(nr)		((nr) / BITS_PER_LONG)
-
 #ifndef find_next_bit
 /*
  * Find the next set bit in a memory region.
@@ -21,7 +19,7 @@
 unsigned long find_next_bit(const unsigned long *addr, unsigned long size,
 			    unsigned long offset)
 {
-	const unsigned long *p = addr + BITOP_WORD(offset);
+	const unsigned long *p = addr + BIT_WORD(offset);
 	unsigned long result = offset & ~(BITS_PER_LONG-1);
 	unsigned long tmp;
 
@@ -67,7 +65,7 @@ EXPORT_SYMBOL(find_next_bit);
 unsigned long find_next_zero_bit(const unsigned long *addr, unsigned long size,
 				 unsigned long offset)
 {
-	const unsigned long *p = addr + BITOP_WORD(offset);
+	const unsigned long *p = addr + BIT_WORD(offset);
 	unsigned long result = offset & ~(BITS_PER_LONG-1);
 	unsigned long tmp;
 
@@ -197,7 +195,7 @@ unsigned long find_next_zero_bit_le(const void *addr, unsigned
 
 	if (offset >= size)
 		return size;
-	p += BITOP_WORD(offset);
+	p += BIT_WORD(offset);
 	size -= result;
 	offset &= (BITS_PER_LONG - 1UL);
 	if (offset) {
@@ -243,7 +241,7 @@ unsigned long find_next_bit_le(const void *addr, unsigned
 
 	if (offset >= size)
 		return size;
-	p += BITOP_WORD(offset);
+	p += BIT_WORD(offset);
 	size -= result;
 	offset &= (BITS_PER_LONG - 1UL);
 	if (offset) {
diff --git a/xen/include/asm-arm/bitops.h b/xen/include/asm-arm/bitops.h
index fbb4b82413..fabf218e23 100644
--- a/xen/include/asm-arm/bitops.h
+++ b/xen/include/asm-arm/bitops.h
@@ -22,7 +22,7 @@
 
 #define BITS_PER_WORD           32
 #define BIT_MASK(nr)            (1UL << ((nr) % BITS_PER_WORD))
-#define BIT_WORD(nr)            ((nr) / BITS_PER_WORD)
+#define BITOP_WORD(nr)          ((nr) / BITS_PER_WORD)
 #define BITS_PER_BYTE           8
 
 #define ADDR (*(volatile int *) addr)
@@ -87,7 +87,7 @@ static inline int __test_and_set_bit(int nr, volatile void *addr)
 {
         unsigned int mask = BIT_MASK(nr);
         volatile unsigned int *p =
-                ((volatile unsigned int *)addr) + BIT_WORD(nr);
+                ((volatile unsigned int *)addr) + BITOP_WORD(nr);
         unsigned int old = *p;
 
         *p = old | mask;
@@ -107,7 +107,7 @@ static inline int __test_and_clear_bit(int nr, volatile void *addr)
 {
         unsigned int mask = BIT_MASK(nr);
         volatile unsigned int *p =
-                ((volatile unsigned int *)addr) + BIT_WORD(nr);
+                ((volatile unsigned int *)addr) + BITOP_WORD(nr);
         unsigned int old = *p;
 
         *p = old & ~mask;
@@ -120,7 +120,7 @@ static inline int __test_and_change_bit(int nr,
 {
         unsigned int mask = BIT_MASK(nr);
         volatile unsigned int *p =
-                ((volatile unsigned int *)addr) + BIT_WORD(nr);
+                ((volatile unsigned int *)addr) + BITOP_WORD(nr);
         unsigned int old = *p;
 
         *p = old ^ mask;
@@ -135,7 +135,7 @@ static inline int __test_and_change_bit(int nr,
 static inline int test_bit(int nr, const volatile void *addr)
 {
         const volatile unsigned int *p = (const volatile unsigned int *)addr;
-        return 1UL & (p[BIT_WORD(nr)] >> (nr & (BITS_PER_WORD-1)));
+        return 1UL & (p[BITOP_WORD(nr)] >> (nr & (BITS_PER_WORD-1)));
 }
 
 /*
diff --git a/xen/include/xen/bitops.h b/xen/include/xen/bitops.h
index dfb70417c2..a64595f68e 100644
--- a/xen/include/xen/bitops.h
+++ b/xen/include/xen/bitops.h
@@ -245,4 +245,6 @@ static inline __u32 ror32(__u32 word, unsigned int shift)
           (bit) < (size);                               \
           (bit) = find_next_bit(addr, size, (bit) + 1) )
 
+#define BIT_WORD(nr) ((nr) / BITS_PER_LONG)
+
 #endif
-- 
2.25.0


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

[Xen-devel] [PATCH v5 3/4] bitmap: import bitmap_{set/clear} from Linux 5.5

[Roger Pau Monne]

Import the functions and it's dependencies. Based on Linux 5.5, commit
id d5226fa6dbae0569ee43ecfc08bdcd6770fc4755.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
---
Changes since v4:
 - Introduce BIT_WORD in generic header bitops.h (instead of the x86
   one).
 - Include byteorder.h for __LITTLE_ENDIAN
 - Remove EXPORT_SYMBOL.
---
 xen/common/bitmap.c      | 39 +++++++++++++++++++++++++++++++++++++++
 xen/include/xen/bitmap.h | 40 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 79 insertions(+)

diff --git a/xen/common/bitmap.c b/xen/common/bitmap.c
index fd070bee97..88768bf8bc 100644
--- a/xen/common/bitmap.c
+++ b/xen/common/bitmap.c
@@ -212,6 +212,45 @@ int __bitmap_weight(const unsigned long *bitmap, int bits)
 #endif
 EXPORT_SYMBOL(__bitmap_weight);
 
+void __bitmap_set(unsigned long *map, unsigned int start, int len)
+{
+	unsigned long *p = map + BIT_WORD(start);
+	const unsigned int size = start + len;
+	int bits_to_set = BITS_PER_LONG - (start % BITS_PER_LONG);
+	unsigned long mask_to_set = BITMAP_FIRST_WORD_MASK(start);
+
+	while (len - bits_to_set >= 0) {
+		*p |= mask_to_set;
+		len -= bits_to_set;
+		bits_to_set = BITS_PER_LONG;
+		mask_to_set = ~0UL;
+		p++;
+	}
+	if (len) {
+		mask_to_set &= BITMAP_LAST_WORD_MASK(size);
+		*p |= mask_to_set;
+	}
+}
+
+void __bitmap_clear(unsigned long *map, unsigned int start, int len)
+{
+	unsigned long *p = map + BIT_WORD(start);
+	const unsigned int size = start + len;
+	int bits_to_clear = BITS_PER_LONG - (start % BITS_PER_LONG);
+	unsigned long mask_to_clear = BITMAP_FIRST_WORD_MASK(start);
+
+	while (len - bits_to_clear >= 0) {
+		*p &= ~mask_to_clear;
+		len -= bits_to_clear;
+		bits_to_clear = BITS_PER_LONG;
+		mask_to_clear = ~0UL;
+		p++;
+	}
+	if (len) {
+		mask_to_clear &= BITMAP_LAST_WORD_MASK(size);
+		*p &= ~mask_to_clear;
+	}
+}
 
 /**
  *	bitmap_find_free_region - find a contiguous aligned mem region
diff --git a/xen/include/xen/bitmap.h b/xen/include/xen/bitmap.h
index 4e1e690af1..c44e009f8c 100644
--- a/xen/include/xen/bitmap.h
+++ b/xen/include/xen/bitmap.h
@@ -85,6 +85,8 @@ extern int __bitmap_intersects(const unsigned long *bitmap1,
 extern int __bitmap_subset(const unsigned long *bitmap1,
 			const unsigned long *bitmap2, int bits);
 extern int __bitmap_weight(const unsigned long *bitmap, int bits);
+extern void __bitmap_set(unsigned long *map, unsigned int start, int len);
+extern void __bitmap_clear(unsigned long *map, unsigned int start, int len);
 
 extern int bitmap_find_free_region(unsigned long *bitmap, int bits, int order);
 extern void bitmap_release_region(unsigned long *bitmap, int pos, int order);
@@ -227,6 +229,44 @@ static inline int bitmap_weight(const unsigned long *src, int nbits)
 	return __bitmap_weight(src, nbits);
 }
 
+#include <asm/byteorder.h>
+
+#ifdef __LITTLE_ENDIAN
+#define BITMAP_MEM_ALIGNMENT 8
+#else
+#define BITMAP_MEM_ALIGNMENT (8 * sizeof(unsigned long))
+#endif
+#define BITMAP_MEM_MASK (BITMAP_MEM_ALIGNMENT - 1)
+#define BITMAP_FIRST_WORD_MASK(start) (~0UL << ((start) & (BITS_PER_LONG - 1)))
+
+static inline void bitmap_set(unsigned long *map, unsigned int start,
+		unsigned int nbits)
+{
+	if (__builtin_constant_p(nbits) && nbits == 1)
+		__set_bit(start, map);
+	else if (__builtin_constant_p(start & BITMAP_MEM_MASK) &&
+		 IS_ALIGNED(start, BITMAP_MEM_ALIGNMENT) &&
+		 __builtin_constant_p(nbits & BITMAP_MEM_MASK) &&
+		 IS_ALIGNED(nbits, BITMAP_MEM_ALIGNMENT))
+		memset((char *)map + start / 8, 0xff, nbits / 8);
+	else
+		__bitmap_set(map, start, nbits);
+}
+
+static inline void bitmap_clear(unsigned long *map, unsigned int start,
+		unsigned int nbits)
+{
+	if (__builtin_constant_p(nbits) && nbits == 1)
+		__clear_bit(start, map);
+	else if (__builtin_constant_p(start & BITMAP_MEM_MASK) &&
+		 IS_ALIGNED(start, BITMAP_MEM_ALIGNMENT) &&
+		 __builtin_constant_p(nbits & BITMAP_MEM_MASK) &&
+		 IS_ALIGNED(nbits, BITMAP_MEM_ALIGNMENT))
+		memset((char *)map + start / 8, 0, nbits / 8);
+	else
+		__bitmap_clear(map, start, nbits);
+}
+
 #undef bitmap_switch
 #undef bitmap_bytes
 
-- 
2.25.0


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

[Xen-devel] [PATCH v5 4/4] nvmx: always trap accesses to x2APIC MSRs

[Roger Pau Monne]

Nested VMX doesn't expose support for
SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE,
SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY or
SECONDARY_EXEC_APIC_REGISTER_VIRT, and hence the x2APIC MSRs should
always be trapped in the nested guest MSR bitmap, or else a nested
guest could access the hardware x2APIC MSRs given certain conditions.

Accessing the hardware MSRs could be achieved by forcing the L0 Xen to
use SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE and
SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY or
SECONDARY_EXEC_APIC_REGISTER_VIRT (if supported), and then creating a
L2 guest with a MSR bitmap that doesn't trap accesses to the x2APIC
MSR range. Then OR'ing both L0 and L1 MSR bitmaps would result in a
bitmap that doesn't trap certain x2APIC MSRs and a VMCS that doesn't
have SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE and
SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY or
SECONDARY_EXEC_APIC_REGISTER_VIRT set either.

Fix this by making sure x2APIC MSRs are always trapped in the nested
MSR bitmap.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
---
Changes since v4:
 - Fix size of x2APIC region to use 0x100.

Changes since v3:
 - Use bitmap_set.

Changes since v1:
 - New in this version (split from #1 patch).
 - Use non-locked set_bit.
---
 xen/arch/x86/hvm/vmx/vvmx.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/xen/arch/x86/hvm/vmx/vvmx.c b/xen/arch/x86/hvm/vmx/vvmx.c
index 3337260d4b..926a11c15f 100644
--- a/xen/arch/x86/hvm/vmx/vvmx.c
+++ b/xen/arch/x86/hvm/vmx/vvmx.c
@@ -596,6 +596,13 @@ static void update_msrbitmap(struct vcpu *v, uint32_t shadow_ctrl)
               v->arch.hvm.vmx.msr_bitmap->write_high,
               sizeof(msr_bitmap->write_high) * 8);
 
+    /*
+     * Nested VMX doesn't support any x2APIC hardware virtualization, so
+     * make sure all the x2APIC MSRs are trapped.
+     */
+    bitmap_set(msr_bitmap->read_low, MSR_X2APIC_FIRST, 0x100);
+    bitmap_set(msr_bitmap->write_low, MSR_X2APIC_FIRST, 0x100);
+
     unmap_domain_page(msr_bitmap);
 
     __vmwrite(MSR_BITMAP, page_to_maddr(nvmx->msr_merged));
-- 
2.25.0


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

Re: [Xen-devel] [PATCH v5 2/4] arm: rename BIT_WORD to BITOP_WORD

[Julien Grall]

Hi Roger,

Thank you for the renaming.

On 17/02/2020 11:45, Roger Pau Monne wrote:
> So BIT_WORD can be imported from Linux. The difference between current
> Linux implementation of BIT_WORD is that the size of the word unit is
> a long integer, while the Xen one is hardcoded to 32 bits.
> 
> Current users of BITOP_WORD on Arm (which considers a word a long
> integer) are switched to use the generic BIT_WORD which also operates
> on long integers.
> 
> No functional change intended.
> 
> Suggested-by: Julien Grall <julien@xen.org>
> Suggested-by: Jan Beulich <jbeulich@suse.com>
> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
> ---
> Changes since v4:
>   - New in this version.
> ---
>   xen/arch/arm/arm32/lib/bitops.c        |  4 ++--
>   xen/arch/arm/arm64/lib/bitops.c        |  4 ++--
>   xen/arch/arm/arm64/lib/find_next_bit.c | 10 ++++------
>   xen/include/asm-arm/bitops.h           | 10 +++++-----
>   xen/include/xen/bitops.h               |  2 ++
>   5 files changed, 15 insertions(+), 15 deletions(-)
> 
> diff --git a/xen/arch/arm/arm32/lib/bitops.c b/xen/arch/arm/arm32/lib/bitops.c
> index 3dca769bf0..82d935ce33 100644
> --- a/xen/arch/arm/arm32/lib/bitops.c
> +++ b/xen/arch/arm/arm32/lib/bitops.c
> @@ -33,7 +33,7 @@
>   static always_inline bool int_##name(int nr, volatile void *p, bool timeout,\
>                                        unsigned int max_try)                  \
>   {                                                                           \
> -    volatile uint32_t *ptr = (uint32_t *)p + BIT_WORD((unsigned int)nr);    \
> +    volatile uint32_t *ptr = (uint32_t *)p + BITOP_WORD((unsigned int)nr);  \
>       const uint32_t mask = BIT_MASK((unsigned int)nr);                       \
>       unsigned long res, tmp;                                                 \
>                                                                               \
> @@ -71,7 +71,7 @@ bool name##_timeout(int nr, volatile void *p, unsigned int max_try)         \
>   static always_inline bool int_##name(int nr, volatile void *p, int *oldbit, \
>                                        bool timeout, unsigned int max_try)    \
>   {                                                                           \
> -    volatile uint32_t *ptr = (uint32_t *)p + BIT_WORD((unsigned int)nr);    \
> +    volatile uint32_t *ptr = (uint32_t *)p + BITOP_WORD((unsigned int)nr);  \
>       unsigned int bit = (unsigned int)nr % BITS_PER_WORD;                    \
>       const uint32_t mask = BIT_MASK(bit);                                    \
>       unsigned long res, tmp;                                                 \
> diff --git a/xen/arch/arm/arm64/lib/bitops.c b/xen/arch/arm/arm64/lib/bitops.c
> index 27688e5418..f5128c58f5 100644
> --- a/xen/arch/arm/arm64/lib/bitops.c
> +++ b/xen/arch/arm/arm64/lib/bitops.c
> @@ -32,7 +32,7 @@
>   static always_inline bool int_##name(int nr, volatile void *p, bool timeout,\
>                                        unsigned int max_try)                  \
>   {                                                                           \
> -    volatile uint32_t *ptr = (uint32_t *)p + BIT_WORD((unsigned int)nr);    \
> +    volatile uint32_t *ptr = (uint32_t *)p + BITOP_WORD((unsigned int)nr);  \
>       const uint32_t mask = BIT_MASK((unsigned int)nr);                       \
>       unsigned long res, tmp;                                                 \
>                                                                               \
> @@ -67,7 +67,7 @@ bool name##_timeout(int nr, volatile void *p, unsigned int max_try)         \
>   static always_inline bool int_##name(int nr, volatile void *p, int *oldbit, \
>                                        bool timeout, unsigned int max_try)    \
>   {                                                                           \
> -    volatile uint32_t *ptr = (uint32_t *)p + BIT_WORD((unsigned int)nr);    \
> +    volatile uint32_t *ptr = (uint32_t *)p + BITOP_WORD((unsigned int)nr);  \
>       unsigned int bit = (unsigned int)nr % BITS_PER_WORD;                    \
>       const uint32_t mask = BIT_MASK(bit);                                    \
>       unsigned long res, tmp;                                                 \
> diff --git a/xen/arch/arm/arm64/lib/find_next_bit.c b/xen/arch/arm/arm64/lib/find_next_bit.c
> index 17cb176266..8ebf8bfe97 100644
> --- a/xen/arch/arm/arm64/lib/find_next_bit.c
> +++ b/xen/arch/arm/arm64/lib/find_next_bit.c
> @@ -12,8 +12,6 @@
>   #include <asm/types.h>
>   #include <asm/byteorder.h>
>   
> -#define BITOP_WORD(nr)		((nr) / BITS_PER_LONG)
> -
>   #ifndef find_next_bit
>   /*
>    * Find the next set bit in a memory region.
> @@ -21,7 +19,7 @@
>   unsigned long find_next_bit(const unsigned long *addr, unsigned long size,
>   			    unsigned long offset)
>   {
> -	const unsigned long *p = addr + BITOP_WORD(offset);
> +	const unsigned long *p = addr + BIT_WORD(offset);
>   	unsigned long result = offset & ~(BITS_PER_LONG-1);
>   	unsigned long tmp;
>   
> @@ -67,7 +65,7 @@ EXPORT_SYMBOL(find_next_bit);
>   unsigned long find_next_zero_bit(const unsigned long *addr, unsigned long size,
>   				 unsigned long offset)
>   {
> -	const unsigned long *p = addr + BITOP_WORD(offset);
> +	const unsigned long *p = addr + BIT_WORD(offset);
>   	unsigned long result = offset & ~(BITS_PER_LONG-1);
>   	unsigned long tmp;
>   
> @@ -197,7 +195,7 @@ unsigned long find_next_zero_bit_le(const void *addr, unsigned
>   
>   	if (offset >= size)
>   		return size;
> -	p += BITOP_WORD(offset);
> +	p += BIT_WORD(offset);
>   	size -= result;
>   	offset &= (BITS_PER_LONG - 1UL);
>   	if (offset) {
> @@ -243,7 +241,7 @@ unsigned long find_next_bit_le(const void *addr, unsigned
>   
>   	if (offset >= size)
>   		return size;
> -	p += BITOP_WORD(offset);
> +	p += BIT_WORD(offset);
>   	size -= result;
>   	offset &= (BITS_PER_LONG - 1UL);
>   	if (offset) {
> diff --git a/xen/include/asm-arm/bitops.h b/xen/include/asm-arm/bitops.h
> index fbb4b82413..fabf218e23 100644
> --- a/xen/include/asm-arm/bitops.h
> +++ b/xen/include/asm-arm/bitops.h
> @@ -22,7 +22,7 @@
>   
>   #define BITS_PER_WORD           32
>   #define BIT_MASK(nr)            (1UL << ((nr) % BITS_PER_WORD))

The naming for the 2 macros above seem a bit off now. Can this be 
renamed to maybe BITOP_BITS_PER_WORD and BITOP_MASK?

> -#define BIT_WORD(nr)            ((nr) / BITS_PER_WORD)
> +#define BITOP_WORD(nr)          ((nr) / BITS_PER_WORD)
>   #define BITS_PER_BYTE           8
>   
>   #define ADDR (*(volatile int *) addr)
> @@ -87,7 +87,7 @@ static inline int __test_and_set_bit(int nr, volatile void *addr)
>   {
>           unsigned int mask = BIT_MASK(nr);
>           volatile unsigned int *p =
> -                ((volatile unsigned int *)addr) + BIT_WORD(nr);
> +                ((volatile unsigned int *)addr) + BITOP_WORD(nr);
>           unsigned int old = *p;
>   
>           *p = old | mask;
> @@ -107,7 +107,7 @@ static inline int __test_and_clear_bit(int nr, volatile void *addr)
>   {
>           unsigned int mask = BIT_MASK(nr);
>           volatile unsigned int *p =
> -                ((volatile unsigned int *)addr) + BIT_WORD(nr);
> +                ((volatile unsigned int *)addr) + BITOP_WORD(nr);
>           unsigned int old = *p;
>   
>           *p = old & ~mask;
> @@ -120,7 +120,7 @@ static inline int __test_and_change_bit(int nr,
>   {
>           unsigned int mask = BIT_MASK(nr);
>           volatile unsigned int *p =
> -                ((volatile unsigned int *)addr) + BIT_WORD(nr);
> +                ((volatile unsigned int *)addr) + BITOP_WORD(nr);
>           unsigned int old = *p;
>   
>           *p = old ^ mask;
> @@ -135,7 +135,7 @@ static inline int __test_and_change_bit(int nr,
>   static inline int test_bit(int nr, const volatile void *addr)
>   {
>           const volatile unsigned int *p = (const volatile unsigned int *)addr;
> -        return 1UL & (p[BIT_WORD(nr)] >> (nr & (BITS_PER_WORD-1)));
> +        return 1UL & (p[BITOP_WORD(nr)] >> (nr & (BITS_PER_WORD-1)));
>   }
>   
>   /*
> diff --git a/xen/include/xen/bitops.h b/xen/include/xen/bitops.h
> index dfb70417c2..a64595f68e 100644
> --- a/xen/include/xen/bitops.h
> +++ b/xen/include/xen/bitops.h
> @@ -245,4 +245,6 @@ static inline __u32 ror32(__u32 word, unsigned int shift)
>             (bit) < (size);                               \
>             (bit) = find_next_bit(addr, size, (bit) + 1) )
>   
> +#define BIT_WORD(nr) ((nr) / BITS_PER_LONG)
> +
>   #endif
> 

Cheers,

-- 
Julien Grall

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

Re: [Xen-devel] [PATCH v5 1/4] nvmx: implement support for MSR bitmaps

[Tian, Kevin]

> From: Roger Pau Monne <roger.pau@citrix.com>
> Sent: Monday, February 17, 2020 7:46 PM
> 
> Current implementation of nested VMX has a half baked handling of MSR
> bitmaps for the L1 VMM: it maps the L1 VMM provided MSR bitmap, but
> doesn't actually load it into the nested vmcs, and thus the nested
> guest vmcs ends up using the same MSR bitmap as the L1 VMM.
> 
> This is wrong as there's no assurance that the set of features enabled
> for the L1 vmcs are the same that L1 itself is going to use in the
> nested vmcs, and thus can lead to misconfigurations.
> 
> For example L1 vmcs can use x2APIC virtualization and virtual
> interrupt delivery, and thus some x2APIC MSRs won't be trapped so that
> they can be handled directly by the hardware using virtualization
> extensions. On the other hand, the nested vmcs created by L1 VMM might
> not use any of such features, so using a MSR bitmap that doesn't trap
> accesses to the x2APIC MSRs will be leaking them to the underlying
> hardware.
> 
> Fix this by crafting a merged MSR bitmap between the one used by L1
> and the nested guest.
> 
> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>

Reviewed-by: Kevin Tian <kevin.tian@intel.com>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

Re: [Xen-devel] [PATCH v5 3/4] bitmap: import bitmap_{set/clear} from Linux 5.5

[Jan Beulich]

On 17.02.2020 12:45, Roger Pau Monne wrote:
> Import the functions and it's dependencies. Based on Linux 5.5, commit
> id d5226fa6dbae0569ee43ecfc08bdcd6770fc4755.
> 
> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>

Acked-by: Jan Beulich <jbeulich@suse.com>



_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel