[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] x86/vmx: Revert "x86/VMX: sanitize rIP before re-entering guest"
- To: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
- From: Roger Pau Monné <roger.pau@xxxxxxxxxx>
- Date: Wed, 23 Aug 2023 13:15:14 +0200
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=oJOSI1bfhk6CvcNHgIETlBtsvAZCk6pCYtSawyuL7E0=; b=KwvLhGGHgDYFc62zVt+cKtdJC6BEuNCalNI/D5FgFXhFPcKr3ihYXqhy+1BDNNm9CoKJSMriqNf6evBM00+qvWCkW4b1wgrDjlqUC9M+32RGxILU4nTTlEMml0dqQYH8J8HdlH0XRJjDt+iO5Se3gwuYya8GP3YMCONK7aIbZDCqD5OtYiq9vSz8CE48DJnrfIbnuGJKd1PcUnmUrpvXbjWsy0Wdzn2eerSyuLZbEVmuEJcuIoc/m5IfcIdAE/655BkAPtdPc+AZp98n0nas/UXww5UjRH3ARKzjxQcOhBswzL6vT9PVZ7GUkPK10o9gsNkeGpBzisfnc9M5aadTDQ==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ilgySVASb8+3RFCBooJ2e87XybfHw8Zl+WeADUE2XToFciodyPj7mZ0zj1dEiCeBqr6aRAsuYtU8eSa6GvybZyD9vkKtZhMLYwp2bzf8ckvuRWQHEfOeFVwlbz0DskF1Gq/odcNtZ8rgwFTVKmeOxql4KOhsnhZyDp9t2G/YUzq62ssWl5LpWJL83QDq9qNMy3IdnMA/Jo/qycD0hIbM4eUj1Mp/GJAQKwrFLIV+uzYnHJiupLE1PTCtZaxKlzVsah/canLod7eoEYeOrBPvPwTQm/z+W2chnbg2BKQTxlQqinYaThtsjQ/b6sxSQLA2/Q4uOSny1BWoEyF7r+lQZQ==
- Authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=citrix.com;
- Cc: Xen-devel <xen-devel@xxxxxxxxxxxxxxxxxxxx>, Jan Beulich <JBeulich@xxxxxxxx>, Wei Liu <wl@xxxxxxx>, Jun Nakajima <jun.nakajima@xxxxxxxxx>, Kevin Tian <kevin.tian@xxxxxxxxx>
- Delivery-date: Wed, 23 Aug 2023 11:15:44 +0000
- Ironport-data: A9a23:EBVCgKNpyDCpqK7vrR1ylsFynXyQoLVcMsEvi/4bfWQNrUp30jcOx zMcDT/Uaa2KN2f0c9F+YYXn8ktS7Z/UmNM3SAto+SlhQUwRpJueD7x1DKtS0wC6dZSfER09v 63yTvGacajYm1eF/k/F3oDJ9CU6jufQAOKnUoYoAwgpLSd8UiAtlBl/rOAwh49skLCRDhiE/ Nj/uKUzAnf8s9JPGjxSs/vrRC9H5qyo42tI5AdmPJingXeF/5UrJMNHTU2OByOQrrl8RoaSW +vFxbelyWLVlz9F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq/0Te5p0TJvsEAXq7vh3S9zxHJ HehgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/ZqAJGpfh66wGMa04AWEX0u11Pl9+9 MVHEjwQMh6gmNmExfGXZPY506zPLOGzVG8ekldJ6GmFSNMZG9XESaiM4sJE1jAtgMwIBezZe 8cSdTtoalLHfgFLPVAUTpk5mY9EhFGmK2Ee9A3T+vFxujeLpOBy+OGF3N79YNuFSN8Thk+Fj mnH4374ElcRM9n3JT+tqyj33rGWwn6hMG4UPLSa26NB3Qyf/EU8SwNKDFnqhqKL11HrDrqzL GRRoELCt5Ma5EGtC9XwQRC8iHqFpQIHHcpdFfUg7wOAwbaS5ByWbkAmZDNcbN0ttOctWCcnk FSOmrvBGjhHoLCTD3WH+d+8ry60fy4cLmYAZCoNZQoD/9Tn5oo0i3rnTdt9Eajzktz8Hxnxx SyHqG41gLB7sCIQ/6Cy/FSChi32oJHMFlIx/l+OATrj6R5lbom4YYDu8ULc8ftLMIeeSB+Go WQAnM+dqusJCPlhiRCwfQnEJ5nxj97tDdEWqQQ3d3X931xBI0KeQL0=
- Ironport-hdrordr: A9a23:8AEPZaH4qcTMm6KNpLqEHseALOsnbusQ8zAXPiBKJCC9vPb5qy nOpoV86faQslwssR4b9uxoVJPvfZqYz+8W3WBzB8bEYOCFghrKEGgK1+KLrwEIWReOk9K1vZ 0KT0EUMqyVMbEVt6fHCAnTKade/DGEmprY+9s3GR1WPHBXg6IL1XYINu6CeHcGPTWvnfACZe ehDswsnUvZRV0nKv6VK1MiROb5q9jChPvdEGI7705O0nj0sduwgoSKaSSl4g==
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
On Wed, Apr 05, 2023 at 10:52:45PM +0100, Andrew Cooper wrote:
> At the time of XSA-170, the x86 instruction emulator was genuinely broken. It
> would load arbitrary values into %rip and putting a check here probably was
> the best stopgap security fix. It should have been reverted following c/s
> 81d3a0b26c1 "x86emul: limit-check branch targets" which corrected the emulator
> behaviour.
>
> However, everyone involved in XSA-170, myself included, failed to read the SDM
> correctly. On the subject of %rip consistency checks, the SDM stated:
>
> If the processor supports N < 64 linear-address bits, bits 63:N must be
> identical
>
> A non-canonical %rip (and SSP more recently) is an explicitly legal state in
> x86, and the VMEntry consistency checks are intentionally off-by-one from a
> regular canonical check.
>
> The consequence of this bug is that Xen will currently take a legal x86 state
> which would successfully VMEnter, and corrupt it into having non-architectural
> behaviour.
>
> Furthermore, in the time this bugfix has been pending in public, I
> successfully persuaded Intel to clarify the SDM, adding the following
> clarification:
>
> The guest RIP value is not required to be canonical; the value of bit N-1
> may differ from that of bit N.
>
> Fixes: ffbbfda377 ("x86/VMX: sanitize rIP before re-entering guest")
I think the fixes tag should likely be "x86emul: limit-check branch
targets", since it's that commit that missed the revert done here?
> Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
Acked-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
Thanks, Roger.
|
