[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] [PATCH V3 1/3] xen/mem_access: Support for memory-content hiding
This patch adds support for memory-content hiding, by modifying the value returned by emulated instructions that read certain memory addresses that contain sensitive data. The patch only applies to cases where MEM_ACCESS_EMULATE or MEM_ACCESS_EMULATE_NOWRITE have been set to a vm_event response. Signed-off-by: Razvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx> --- Changes since V2: - Now memset()-ing all read buffers to 0 before writing the response data (don't leak HV stack contents). - Safe_bytes is now unsigned int everywhere instead of unsigned long. - Removed the custom hvmemul_rep_stos() handler. - EMUL_KIND_NORMAL became the default case in hvm_mem_access_emulate_one(). - Replaced a 'break' with a more appropriate 'continue' in vm_event_enable(). - The rep outs case now acts consistent with the read case (no longer ignoring *reps). - Removed the individual set_context static handlers in favour of a flag in struct hvmemul_ctxt. - Corrected patch title (it's mem_access and vm_event, there's no such thing as vm_access). --- tools/tests/xen-access/xen-access.c | 2 +- xen/arch/x86/domain.c | 1 + xen/arch/x86/hvm/emulate.c | 132 ++++++++++++++++++++++++++++++++++- xen/arch/x86/hvm/event.c | 50 ++++++------- xen/arch/x86/mm/p2m.c | 90 +++++++++++++----------- xen/common/vm_event.c | 23 ++++++ xen/include/asm-x86/domain.h | 2 + xen/include/asm-x86/hvm/emulate.h | 10 ++- xen/include/public/vm_event.h | 21 +++++- 9 files changed, 259 insertions(+), 72 deletions(-) diff --git a/tools/tests/xen-access/xen-access.c b/tools/tests/xen-access/xen-access.c index 12ab921..e6ca9ba 100644 --- a/tools/tests/xen-access/xen-access.c +++ b/tools/tests/xen-access/xen-access.c @@ -530,7 +530,7 @@ int main(int argc, char *argv[]) break; case VM_EVENT_REASON_SOFTWARE_BREAKPOINT: printf("Breakpoint: rip=%016"PRIx64", gfn=%"PRIx64" (vcpu %d)\n", - req.regs.x86.rip, + req.data.regs.x86.rip, req.u.software_breakpoint.gfn, req.vcpu_id); diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c index a8fe046..cbbc354 100644 --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -269,6 +269,7 @@ struct vcpu *alloc_vcpu_struct(void) void free_vcpu_struct(struct vcpu *v) { + xfree(v->arch.vm_event.emul_read_data); free_xenheap_page(v); } diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c index fe5661d..3678e29 100644 --- a/xen/arch/x86/hvm/emulate.c +++ b/xen/arch/x86/hvm/emulate.c @@ -653,6 +653,28 @@ static int hvmemul_read( unsigned int bytes, struct x86_emulate_ctxt *ctxt) { + struct hvm_emulate_ctxt *hvmemul_ctxt = + container_of(ctxt, struct hvm_emulate_ctxt, ctxt); + + if ( unlikely(hvmemul_ctxt->set_context) ) + { + struct vcpu *curr = current; + unsigned int len; + + if ( !curr->arch.vm_event.emul_read_data ) + return X86EMUL_UNHANDLEABLE; + + len = min_t(unsigned int, + bytes, curr->arch.vm_event.emul_read_data->size); + + if ( len ) { + memset(p_data, 0, bytes); + memcpy(p_data, curr->arch.vm_event.emul_read_data->data, len); + } + + return X86EMUL_OKAY; + } + return __hvmemul_read( seg, offset, p_data, bytes, hvm_access_read, container_of(ctxt, struct hvm_emulate_ctxt, ctxt)); @@ -893,6 +915,24 @@ static int hvmemul_cmpxchg( unsigned int bytes, struct x86_emulate_ctxt *ctxt) { + struct hvm_emulate_ctxt *hvmemul_ctxt = + container_of(ctxt, struct hvm_emulate_ctxt, ctxt); + + if ( unlikely(hvmemul_ctxt->set_context) ) + { + struct vcpu *curr = current; + + if ( curr->arch.vm_event.emul_read_data ) + { + unsigned int safe_bytes = min_t(unsigned int, bytes, + curr->arch.vm_event.emul_read_data->size); + + memset(p_new, 0, bytes); + memcpy(p_new, curr->arch.vm_event.emul_read_data->data, + safe_bytes); + } + } + /* Fix this in case the guest is really relying on r-m-w atomicity. */ return hvmemul_write(seg, offset, p_new, bytes, ctxt); } @@ -935,6 +975,41 @@ static int hvmemul_rep_ins( !!(ctxt->regs->eflags & X86_EFLAGS_DF), gpa); } +static int hvmemul_rep_outs_set_context( + enum x86_segment src_seg, + unsigned long src_offset, + uint16_t dst_port, + unsigned int bytes_per_rep, + unsigned long *reps, + struct x86_emulate_ctxt *ctxt) +{ + unsigned int bytes = *reps * bytes_per_rep; + struct vcpu *curr = current; + unsigned int safe_bytes; + char *buf = NULL; + int rc; + + if ( !curr->arch.vm_event.emul_read_data ) + return X86EMUL_UNHANDLEABLE; + + buf = xmalloc_bytes(bytes); + + if ( buf == NULL ) + return X86EMUL_UNHANDLEABLE; + + memset(buf, 0, bytes); + + safe_bytes = min_t(unsigned int, bytes, + curr->arch.vm_event.emul_read_data->size); + + memcpy(buf, curr->arch.vm_event.emul_read_data->data, safe_bytes); + rc = hvmemul_do_pio_buffer(dst_port, bytes, IOREQ_WRITE, buf); + + xfree(buf); + + return rc; +} + static int hvmemul_rep_outs( enum x86_segment src_seg, unsigned long src_offset, @@ -951,6 +1026,10 @@ static int hvmemul_rep_outs( p2m_type_t p2mt; int rc; + if ( unlikely(hvmemul_ctxt->set_context) ) + return hvmemul_rep_outs_set_context(src_seg, src_offset, dst_port, + bytes_per_rep, reps, ctxt); + rc = hvmemul_virtual_to_linear( src_seg, src_offset, bytes_per_rep, reps, hvm_access_read, hvmemul_ctxt, &addr); @@ -1063,7 +1142,20 @@ static int hvmemul_rep_movs( */ rc = hvm_copy_from_guest_phys(buf, sgpa, bytes); if ( rc == HVMCOPY_okay ) + { + struct vcpu *curr = current; + + if ( unlikely(hvmemul_ctxt->set_context) && + curr->arch.vm_event.emul_read_data ) + { + unsigned int safe_bytes = min_t(unsigned int, bytes, + curr->arch.vm_event.emul_read_data->size); + + memcpy(buf, curr->arch.vm_event.emul_read_data->data, safe_bytes); + } + rc = hvm_copy_to_guest_phys(dgpa, buf, bytes); + } xfree(buf); @@ -1222,7 +1314,27 @@ static int hvmemul_read_io( unsigned long *val, struct x86_emulate_ctxt *ctxt) { + struct hvm_emulate_ctxt *hvmemul_ctxt = + container_of(ctxt, struct hvm_emulate_ctxt, ctxt); + *val = 0; + + if ( unlikely(hvmemul_ctxt->set_context) ) + { + struct vcpu *curr = current; + unsigned int safe_bytes; + + if ( !curr->arch.vm_event.emul_read_data ) + return X86EMUL_UNHANDLEABLE; + + safe_bytes = min_t(unsigned int, bytes, + curr->arch.vm_event.emul_read_data->size); + + memcpy(val, curr->arch.vm_event.emul_read_data->data, safe_bytes); + + return X86EMUL_OKAY; + } + return hvmemul_do_pio_buffer(port, bytes, IOREQ_READ, val); } @@ -1599,6 +1711,7 @@ static int _hvm_emulate_one(struct hvm_emulate_ctxt *hvmemul_ctxt, int hvm_emulate_one( struct hvm_emulate_ctxt *hvmemul_ctxt) { + hvmemul_ctxt->set_context = 0; return _hvm_emulate_one(hvmemul_ctxt, &hvm_emulate_ops); } @@ -1608,7 +1721,14 @@ int hvm_emulate_one_no_write( return _hvm_emulate_one(hvmemul_ctxt, &hvm_emulate_ops_no_write); } -void hvm_mem_access_emulate_one(bool_t nowrite, unsigned int trapnr, +static int hvm_emulate_one_set_context( + struct hvm_emulate_ctxt *hvmemul_ctxt) +{ + hvmemul_ctxt->set_context = 1; + return _hvm_emulate_one(hvmemul_ctxt, &hvm_emulate_ops_no_write); +} + +void hvm_mem_access_emulate_one(enum emul_kind kind, unsigned int trapnr, unsigned int errcode) { struct hvm_emulate_ctxt ctx = {{ 0 }}; @@ -1616,10 +1736,16 @@ void hvm_mem_access_emulate_one(bool_t nowrite, unsigned int trapnr, hvm_emulate_prepare(&ctx, guest_cpu_user_regs()); - if ( nowrite ) + switch ( kind ) { + case EMUL_KIND_NOWRITE: rc = hvm_emulate_one_no_write(&ctx); - else + break; + case EMUL_KIND_SET_CONTEXT: + rc = hvm_emulate_one_set_context(&ctx); + break; + default: rc = hvm_emulate_one(&ctx); + } switch ( rc ) { diff --git a/xen/arch/x86/hvm/event.c b/xen/arch/x86/hvm/event.c index 53b9ca4..5341937 100644 --- a/xen/arch/x86/hvm/event.c +++ b/xen/arch/x86/hvm/event.c @@ -30,31 +30,31 @@ static void hvm_event_fill_regs(vm_event_request_t *req) const struct cpu_user_regs *regs = guest_cpu_user_regs(); const struct vcpu *curr = current; - req->regs.x86.rax = regs->eax; - req->regs.x86.rcx = regs->ecx; - req->regs.x86.rdx = regs->edx; - req->regs.x86.rbx = regs->ebx; - req->regs.x86.rsp = regs->esp; - req->regs.x86.rbp = regs->ebp; - req->regs.x86.rsi = regs->esi; - req->regs.x86.rdi = regs->edi; - - req->regs.x86.r8 = regs->r8; - req->regs.x86.r9 = regs->r9; - req->regs.x86.r10 = regs->r10; - req->regs.x86.r11 = regs->r11; - req->regs.x86.r12 = regs->r12; - req->regs.x86.r13 = regs->r13; - req->regs.x86.r14 = regs->r14; - req->regs.x86.r15 = regs->r15; - - req->regs.x86.rflags = regs->eflags; - req->regs.x86.rip = regs->eip; - - req->regs.x86.msr_efer = curr->arch.hvm_vcpu.guest_efer; - req->regs.x86.cr0 = curr->arch.hvm_vcpu.guest_cr[0]; - req->regs.x86.cr3 = curr->arch.hvm_vcpu.guest_cr[3]; - req->regs.x86.cr4 = curr->arch.hvm_vcpu.guest_cr[4]; + req->data.regs.x86.rax = regs->eax; + req->data.regs.x86.rcx = regs->ecx; + req->data.regs.x86.rdx = regs->edx; + req->data.regs.x86.rbx = regs->ebx; + req->data.regs.x86.rsp = regs->esp; + req->data.regs.x86.rbp = regs->ebp; + req->data.regs.x86.rsi = regs->esi; + req->data.regs.x86.rdi = regs->edi; + + req->data.regs.x86.r8 = regs->r8; + req->data.regs.x86.r9 = regs->r9; + req->data.regs.x86.r10 = regs->r10; + req->data.regs.x86.r11 = regs->r11; + req->data.regs.x86.r12 = regs->r12; + req->data.regs.x86.r13 = regs->r13; + req->data.regs.x86.r14 = regs->r14; + req->data.regs.x86.r15 = regs->r15; + + req->data.regs.x86.rflags = regs->eflags; + req->data.regs.x86.rip = regs->eip; + + req->data.regs.x86.msr_efer = curr->arch.hvm_vcpu.guest_efer; + req->data.regs.x86.cr0 = curr->arch.hvm_vcpu.guest_cr[0]; + req->data.regs.x86.cr3 = curr->arch.hvm_vcpu.guest_cr[3]; + req->data.regs.x86.cr4 = curr->arch.hvm_vcpu.guest_cr[4]; } static int hvm_event_traps(uint8_t sync, vm_event_request_t *req) diff --git a/xen/arch/x86/mm/p2m.c b/xen/arch/x86/mm/p2m.c index 6b39733..5d40d2c 100644 --- a/xen/arch/x86/mm/p2m.c +++ b/xen/arch/x86/mm/p2m.c @@ -1369,49 +1369,49 @@ static void p2m_vm_event_fill_regs(vm_event_request_t *req) /* Architecture-specific vmcs/vmcb bits */ hvm_funcs.save_cpu_ctxt(curr, &ctxt); - req->regs.x86.rax = regs->eax; - req->regs.x86.rcx = regs->ecx; - req->regs.x86.rdx = regs->edx; - req->regs.x86.rbx = regs->ebx; - req->regs.x86.rsp = regs->esp; - req->regs.x86.rbp = regs->ebp; - req->regs.x86.rsi = regs->esi; - req->regs.x86.rdi = regs->edi; - - req->regs.x86.r8 = regs->r8; - req->regs.x86.r9 = regs->r9; - req->regs.x86.r10 = regs->r10; - req->regs.x86.r11 = regs->r11; - req->regs.x86.r12 = regs->r12; - req->regs.x86.r13 = regs->r13; - req->regs.x86.r14 = regs->r14; - req->regs.x86.r15 = regs->r15; - - req->regs.x86.rflags = regs->eflags; - req->regs.x86.rip = regs->eip; - - req->regs.x86.dr7 = curr->arch.debugreg[7]; - req->regs.x86.cr0 = ctxt.cr0; - req->regs.x86.cr2 = ctxt.cr2; - req->regs.x86.cr3 = ctxt.cr3; - req->regs.x86.cr4 = ctxt.cr4; - - req->regs.x86.sysenter_cs = ctxt.sysenter_cs; - req->regs.x86.sysenter_esp = ctxt.sysenter_esp; - req->regs.x86.sysenter_eip = ctxt.sysenter_eip; - - req->regs.x86.msr_efer = ctxt.msr_efer; - req->regs.x86.msr_star = ctxt.msr_star; - req->regs.x86.msr_lstar = ctxt.msr_lstar; + req->data.regs.x86.rax = regs->eax; + req->data.regs.x86.rcx = regs->ecx; + req->data.regs.x86.rdx = regs->edx; + req->data.regs.x86.rbx = regs->ebx; + req->data.regs.x86.rsp = regs->esp; + req->data.regs.x86.rbp = regs->ebp; + req->data.regs.x86.rsi = regs->esi; + req->data.regs.x86.rdi = regs->edi; + + req->data.regs.x86.r8 = regs->r8; + req->data.regs.x86.r9 = regs->r9; + req->data.regs.x86.r10 = regs->r10; + req->data.regs.x86.r11 = regs->r11; + req->data.regs.x86.r12 = regs->r12; + req->data.regs.x86.r13 = regs->r13; + req->data.regs.x86.r14 = regs->r14; + req->data.regs.x86.r15 = regs->r15; + + req->data.regs.x86.rflags = regs->eflags; + req->data.regs.x86.rip = regs->eip; + + req->data.regs.x86.dr7 = curr->arch.debugreg[7]; + req->data.regs.x86.cr0 = ctxt.cr0; + req->data.regs.x86.cr2 = ctxt.cr2; + req->data.regs.x86.cr3 = ctxt.cr3; + req->data.regs.x86.cr4 = ctxt.cr4; + + req->data.regs.x86.sysenter_cs = ctxt.sysenter_cs; + req->data.regs.x86.sysenter_esp = ctxt.sysenter_esp; + req->data.regs.x86.sysenter_eip = ctxt.sysenter_eip; + + req->data.regs.x86.msr_efer = ctxt.msr_efer; + req->data.regs.x86.msr_star = ctxt.msr_star; + req->data.regs.x86.msr_lstar = ctxt.msr_lstar; hvm_get_segment_register(curr, x86_seg_fs, &seg); - req->regs.x86.fs_base = seg.base; + req->data.regs.x86.fs_base = seg.base; hvm_get_segment_register(curr, x86_seg_gs, &seg); - req->regs.x86.gs_base = seg.base; + req->data.regs.x86.gs_base = seg.base; hvm_get_segment_register(curr, x86_seg_cs, &seg); - req->regs.x86.cs_arbytes = seg.attr.bytes; + req->data.regs.x86.cs_arbytes = seg.attr.bytes; } void p2m_mem_access_emulate_check(struct vcpu *v, @@ -1466,6 +1466,10 @@ void p2m_mem_access_emulate_check(struct vcpu *v, } v->arch.vm_event.emulate_flags = violation ? rsp->flags : 0; + + if ( rsp->flags & MEM_ACCESS_SET_EMUL_READ_DATA && + v->arch.vm_event.emul_read_data ) + *v->arch.vm_event.emul_read_data = rsp->data.emul_read_data; } } @@ -1552,9 +1556,15 @@ bool_t p2m_mem_access_check(paddr_t gpa, unsigned long gla, if ( v->arch.vm_event.emulate_flags ) { - hvm_mem_access_emulate_one((v->arch.vm_event.emulate_flags & - MEM_ACCESS_EMULATE_NOWRITE) != 0, - TRAP_invalid_op, HVM_DELIVER_NO_ERROR_CODE); + enum emul_kind kind = EMUL_KIND_NORMAL; + + if ( v->arch.vm_event.emulate_flags & MEM_ACCESS_SET_EMUL_READ_DATA ) + kind = EMUL_KIND_SET_CONTEXT; + else if ( v->arch.vm_event.emulate_flags & MEM_ACCESS_EMULATE_NOWRITE ) + kind = EMUL_KIND_NOWRITE; + + hvm_mem_access_emulate_one(kind, TRAP_invalid_op, + HVM_DELIVER_NO_ERROR_CODE); v->arch.vm_event.emulate_flags = 0; return 1; diff --git a/xen/common/vm_event.c b/xen/common/vm_event.c index 120a78a..11438da 100644 --- a/xen/common/vm_event.c +++ b/xen/common/vm_event.c @@ -48,6 +48,7 @@ static int vm_event_enable( { int rc; unsigned long ring_gfn = d->arch.hvm_domain.params[param]; + struct vcpu *v; /* Only one helper at a time. If the helper crashed, * the ring is in an undefined state and so is the guest. @@ -63,6 +64,21 @@ static int vm_event_enable( vm_event_ring_lock_init(ved); vm_event_ring_lock(ved); + for_each_vcpu( d, v ) + { + if ( v->arch.vm_event.emul_read_data ) + continue; + + v->arch.vm_event.emul_read_data = + xmalloc(struct vm_event_emul_read_data); + + if ( !v->arch.vm_event.emul_read_data ) + { + rc = -ENOMEM; + goto err; + } + } + rc = prepare_ring_for_helper(d, ring_gfn, &ved->ring_pg_struct, &ved->ring_page); if ( rc < 0 ) @@ -225,6 +241,13 @@ static int vm_event_disable(struct domain *d, struct vm_event_domain *ved) destroy_ring_for_helper(&ved->ring_page, ved->ring_pg_struct); + + for_each_vcpu( d, v ) + { + xfree(v->arch.vm_event.emul_read_data); + v->arch.vm_event.emul_read_data = NULL; + } + vm_event_ring_unlock(ved); } diff --git a/xen/include/asm-x86/domain.h b/xen/include/asm-x86/domain.h index 96bde65..7908844 100644 --- a/xen/include/asm-x86/domain.h +++ b/xen/include/asm-x86/domain.h @@ -10,6 +10,7 @@ #include <asm/mce.h> #include <public/vcpu.h> #include <public/hvm/hvm_info_table.h> +#include <public/vm_event.h> #define has_32bit_shinfo(d) ((d)->arch.has_32bit_shinfo) #define is_pv_32bit_domain(d) ((d)->arch.is_32bit_pv) @@ -508,6 +509,7 @@ struct arch_vcpu uint32_t emulate_flags; unsigned long gpa; unsigned long eip; + struct vm_event_emul_read_data *emul_read_data; } vm_event; }; diff --git a/xen/include/asm-x86/hvm/emulate.h b/xen/include/asm-x86/hvm/emulate.h index 594be38..49134b5 100644 --- a/xen/include/asm-x86/hvm/emulate.h +++ b/xen/include/asm-x86/hvm/emulate.h @@ -32,13 +32,21 @@ struct hvm_emulate_ctxt { struct hvm_trap trap; uint32_t intr_shadow; + + bool_t set_context; +}; + +enum emul_kind { + EMUL_KIND_NORMAL, + EMUL_KIND_NOWRITE, + EMUL_KIND_SET_CONTEXT }; int hvm_emulate_one( struct hvm_emulate_ctxt *hvmemul_ctxt); int hvm_emulate_one_no_write( struct hvm_emulate_ctxt *hvmemul_ctxt); -void hvm_mem_access_emulate_one(bool_t nowrite, +void hvm_mem_access_emulate_one(enum emul_kind kind, unsigned int trapnr, unsigned int errcode); void hvm_emulate_prepare( diff --git a/xen/include/public/vm_event.h b/xen/include/public/vm_event.h index 577e971..3223bb4 100644 --- a/xen/include/public/vm_event.h +++ b/xen/include/public/vm_event.h @@ -149,6 +149,13 @@ struct vm_event_regs_x86 { * potentially having side effects (like memory mapped or port I/O) disabled. */ #define MEM_ACCESS_EMULATE_NOWRITE (1 << 7) +/* + * Data is being sent back to the hypervisor in the event response, to be + * returned by the read function when emulating an instruction. + * This flag is only useful when combined with MEM_ACCESS_EMULATE or + * MEM_ACCESS_EMULATE_NOWRITE. + */ +#define MEM_ACCESS_SET_EMUL_READ_DATA (1 << 8) struct vm_event_mem_access { uint64_t gfn; @@ -189,6 +196,12 @@ struct vm_event_sharing { uint32_t _pad; }; +struct vm_event_emul_read_data { + uint32_t size; + /* The struct is used in a union with vm_event_regs_x86. */ + uint8_t data[sizeof(struct vm_event_regs_x86) - sizeof(uint32_t)]; +}; + typedef struct vm_event_st { uint32_t version; /* VM_EVENT_INTERFACE_VERSION */ uint32_t flags; /* VM_EVENT_FLAG_* */ @@ -206,8 +219,12 @@ typedef struct vm_event_st { } u; union { - struct vm_event_regs_x86 x86; - } regs; + union { + struct vm_event_regs_x86 x86; + } regs; + + struct vm_event_emul_read_data emul_read_data; + } data; } vm_event_request_t, vm_event_response_t; DEFINE_RING_TYPES(vm_event, vm_event_request_t, vm_event_response_t); -- 1.7.9.5 _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx http://lists.xen.org/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |