From patchwork Fri Dec 1 13:15:58 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Magali Lemes X-Patchwork-Id: 1870623 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4ShYVg3P9xz23nT for ; Sat, 2 Dec 2023 00:16:43 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1r93NY-00086P-I0; Fri, 01 Dec 2023 13:16:24 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1r93NP-00082t-SI for kernel-team@lists.ubuntu.com; Fri, 01 Dec 2023 13:16:15 +0000 Received: from mail-pf1-f199.google.com (mail-pf1-f199.google.com [209.85.210.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id F1DD640185 for ; Fri, 1 Dec 2023 13:16:14 +0000 (UTC) Received: by mail-pf1-f199.google.com with SMTP id d2e1a72fcca58-6c415e09b2cso2459543b3a.2 for ; Fri, 01 Dec 2023 05:16:14 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701436573; x=1702041373; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=mywqJQgcfIT09AAA3CzllsBE8jtDkjRk0V2ShdNaxM0=; b=Xl3pvFUBxiFCax1hcZDfp6lTd3V9lYVnoNgcliQsNBcQreaUBrAEP8GU/gIHfDxv+a s9wSRkCbaj/ZxjZrbzMJloEFw4ZSnd/COGQvAAHAWtSSNxD1zBNOMriX+jX6Lzg6MIaO XMnMgF4GqbYvY0zzff6Jik7Y68ybtJV3TPze2vWo9jpK3pnzSuaWOTKS0NpMMYXVGODK 9obU7NBux22XwB8x73DDu57ZDZvOr9LdrcCMsD1XiN9givi0/Oq8Hw+WTVD7Lv6U82bV lMoOTh9drGEFtuTOFOfcQZTjRPCDvoF8uTQisf7UjAKRvtblT/dHurnH/xyJ1aOxek2A Y/ZQ== X-Gm-Message-State: AOJu0YwGEZC+NtvFgGcWD5zm98klpDWFZ2NAELGCL847V8JrITMNloJ4 vS+wiQ2L4b1lpjdOOYp+e9lxFXqCLVFzYDtYyvowhDSosj2/X1TgH+xex5lGeTAiQsN1asQB5ef 9Ih17ddfOYjXT/WT5HPuN4zwOAFdUi2laiJ7z3/lBimgVKKEB3A== X-Received: by 2002:a05:6a00:391f:b0:6c3:3213:2d17 with SMTP id fh31-20020a056a00391f00b006c332132d17mr27279643pfb.29.1701436572857; Fri, 01 Dec 2023 05:16:12 -0800 (PST) X-Google-Smtp-Source: AGHT+IHO/wSko90d7VTD3NZJ18gERa6Zl9huFERpRrF+rnq4x/K8gyXQl0KGjpqmk1oAaE7AWH8ueg== X-Received: by 2002:a05:6a00:391f:b0:6c3:3213:2d17 with SMTP id fh31-20020a056a00391f00b006c332132d17mr27279622pfb.29.1701436572434; Fri, 01 Dec 2023 05:16:12 -0800 (PST) Received: from magali.. ([2804:7f0:b442:2377:dd30:3fac:53f2:e6fd]) by smtp.gmail.com with ESMTPSA id fb3-20020a056a002d8300b006bde2480806sm2978028pfb.47.2023.12.01.05.16.11 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 01 Dec 2023 05:16:12 -0800 (PST) From: Magali Lemes To: kernel-team@lists.ubuntu.com Subject: [SRU][Mantic/OEM-6.5][PATCH 2/3] x86/sev: Check IOBM for IOIO exceptions from user-space Date: Fri, 1 Dec 2023 10:15:58 -0300 Message-Id: <20231201131601.1146971-5-magali.lemes@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20231201131601.1146971-1-magali.lemes@canonical.com> References: <20231201131601.1146971-1-magali.lemes@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Joerg Roedel Check the IO permission bitmap (if present) before emulating IOIO #VC exceptions for user-space. These permissions are checked by hardware already before the #VC is raised, but due to the VC-handler decoding race it needs to be checked again in software. Fixes: 25189d08e516 ("x86/sev-es: Add support for handling IOIO exceptions") Reported-by: Tom Dohrmann Signed-off-by: Joerg Roedel Signed-off-by: Borislav Petkov (AMD) Tested-by: Tom Dohrmann Cc: (cherry picked from commit b9cb9c45583b911e0db71d09caa6b56469eb2bdf) CVE-2023-46813 Signed-off-by: Magali Lemes --- arch/x86/boot/compressed/sev.c | 5 +++++ arch/x86/kernel/sev-shared.c | 22 +++++++++++++++------- arch/x86/kernel/sev.c | 27 +++++++++++++++++++++++++++ 3 files changed, 47 insertions(+), 7 deletions(-) diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c index c3e343bd4760..f9e1e865b4e4 100644 --- a/arch/x86/boot/compressed/sev.c +++ b/arch/x86/boot/compressed/sev.c @@ -103,6 +103,11 @@ static enum es_result vc_read_mem(struct es_em_ctxt *ctxt, return ES_OK; } +static enum es_result vc_ioio_check(struct es_em_ctxt *ctxt, u16 port, size_t size) +{ + return ES_OK; +} + #undef __init #define __init diff --git a/arch/x86/kernel/sev-shared.c b/arch/x86/kernel/sev-shared.c index 2eabccde94fb..bcd77c48be0a 100644 --- a/arch/x86/kernel/sev-shared.c +++ b/arch/x86/kernel/sev-shared.c @@ -656,6 +656,9 @@ static enum es_result vc_insn_string_write(struct es_em_ctxt *ctxt, static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo) { struct insn *insn = &ctxt->insn; + size_t size; + u64 port; + *exitinfo = 0; switch (insn->opcode.bytes[0]) { @@ -664,7 +667,7 @@ static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo) case 0x6d: *exitinfo |= IOIO_TYPE_INS; *exitinfo |= IOIO_SEG_ES; - *exitinfo |= (ctxt->regs->dx & 0xffff) << 16; + port = ctxt->regs->dx & 0xffff; break; /* OUTS opcodes */ @@ -672,41 +675,43 @@ static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo) case 0x6f: *exitinfo |= IOIO_TYPE_OUTS; *exitinfo |= IOIO_SEG_DS; - *exitinfo |= (ctxt->regs->dx & 0xffff) << 16; + port = ctxt->regs->dx & 0xffff; break; /* IN immediate opcodes */ case 0xe4: case 0xe5: *exitinfo |= IOIO_TYPE_IN; - *exitinfo |= (u8)insn->immediate.value << 16; + port = (u8)insn->immediate.value & 0xffff; break; /* OUT immediate opcodes */ case 0xe6: case 0xe7: *exitinfo |= IOIO_TYPE_OUT; - *exitinfo |= (u8)insn->immediate.value << 16; + port = (u8)insn->immediate.value & 0xffff; break; /* IN register opcodes */ case 0xec: case 0xed: *exitinfo |= IOIO_TYPE_IN; - *exitinfo |= (ctxt->regs->dx & 0xffff) << 16; + port = ctxt->regs->dx & 0xffff; break; /* OUT register opcodes */ case 0xee: case 0xef: *exitinfo |= IOIO_TYPE_OUT; - *exitinfo |= (ctxt->regs->dx & 0xffff) << 16; + port = ctxt->regs->dx & 0xffff; break; default: return ES_DECODE_FAILED; } + *exitinfo |= port << 16; + switch (insn->opcode.bytes[0]) { case 0x6c: case 0x6e: @@ -716,12 +721,15 @@ static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo) case 0xee: /* Single byte opcodes */ *exitinfo |= IOIO_DATA_8; + size = 1; break; default: /* Length determined by instruction parsing */ *exitinfo |= (insn->opnd_bytes == 2) ? IOIO_DATA_16 : IOIO_DATA_32; + size = (insn->opnd_bytes == 2) ? 2 : 4; } + switch (insn->addr_bytes) { case 2: *exitinfo |= IOIO_ADDR_16; @@ -737,7 +745,7 @@ static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo) if (insn_has_rep_prefix(insn)) *exitinfo |= IOIO_REP; - return ES_OK; + return vc_ioio_check(ctxt, (u16)port, size); } static enum es_result vc_handle_ioio(struct ghcb *ghcb, struct es_em_ctxt *ctxt) diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c index 0711f0ef0d64..aa2b2b778238 100644 --- a/arch/x86/kernel/sev.c +++ b/arch/x86/kernel/sev.c @@ -524,6 +524,33 @@ static enum es_result vc_slow_virt_to_phys(struct ghcb *ghcb, struct es_em_ctxt return ES_OK; } +static enum es_result vc_ioio_check(struct es_em_ctxt *ctxt, u16 port, size_t size) +{ + BUG_ON(size > 4); + + if (user_mode(ctxt->regs)) { + struct thread_struct *t = ¤t->thread; + struct io_bitmap *iobm = t->io_bitmap; + size_t idx; + + if (!iobm) + goto fault; + + for (idx = port; idx < port + size; ++idx) { + if (test_bit(idx, iobm->bitmap)) + goto fault; + } + } + + return ES_OK; + +fault: + ctxt->fi.vector = X86_TRAP_GP; + ctxt->fi.error_code = 0; + + return ES_EXCEPTION; +} + /* Include code shared with pre-decompression boot stage */ #include "sev-shared.c"