[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: [PATCH] x86/vmx: Revert "x86/VMX: sanitize rIP before re-entering guest"
- To: "andrew.cooper3@xxxxxxxxxx" <andrew.cooper3@xxxxxxxxxx>, Xen-devel <xen-devel@xxxxxxxxxxxxxxxxxxxx>
- From: "Tian, Kevin" <kevin.tian@xxxxxxxxx>
- Date: Thu, 24 Aug 2023 04:26:08 +0000
- Accept-language: en-US
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=2YCQ36XlDDBYKoRH3/pEy+TulW1T9BQ+WYYvrW+KKNM=; b=C9g2hTi/DWGXlXavjKQa/uXW/tbd1AelG1j8JSUXvKBOBLzfKuM0eMFEIp2C3BG41vJcAGcFnE5mCh0N/isP+32HabAr5flwX7nBLERJ28rHyazUpzqLy3lAHw42yLHnPyup05PF2tL2sMIrwKVF+mkwUmLMttkdHbF8RBGoieotC6QiYpLXcxB0QbbxEt4b2XZ8tYj6WVDQz8HtRP2BKrI224OoxktxiFJ9WOiyOKpBLDsA2lLETD9ceh1/bMZweq25/gyx3gWMa4CJFNH9+DxPWswMCqIR0nGgA1HbIfPFhQRNPL3BcWllDP2TTFQACYjahxx0aEfQQErCdRMU+g==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jk7NENYGGapeeBQL4ylEhPScv/AL9pqPZqy+3S962VrL9AgHKNl98BXhcVbN/SV5I13Z7oN/uUPBHD7CP0bCKRV34sWjnPUS3F9/lsUeCCl8Kb0eEnEEHeIVPlYF60UwtavYibzxi233SbHoFLJBt9XyvYTMrrYoHbjyO9rlobIqBe0j8GGlfv9QBaR/qTHGL10oSITpCz/IACaTPHqQ+4isNNs7olNiGtfsZYrNg9MpFcIa9jKmcwEKI+lG0+zr5M6uVMrE7+UMCGSWJls7r/mzirDV8osVclepdWpAxf2Yu2APbILtM0NoTjoNUpEroXIq3gsoiFzcpYNDg/EN8w==
- Authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=intel.com;
- Cc: "andrew.cooper3@xxxxxxxxxx" <andrew.cooper3@xxxxxxxxxx>, "Beulich, Jan" <JBeulich@xxxxxxxx>, Pau Monné, Roger <roger.pau@xxxxxxxxxx>, Wei Liu <wl@xxxxxxx>, "Nakajima, Jun" <jun.nakajima@xxxxxxxxx>
- Delivery-date: Thu, 24 Aug 2023 04:26:32 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
- Thread-index: AQHZaAkTaZqJ/lBq3kixDzLj4TJx56/5tglw
- Thread-topic: [PATCH] x86/vmx: Revert "x86/VMX: sanitize rIP before re-entering guest"
> From: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
> Sent: Thursday, April 6, 2023 5:53 AM
>
> At the time of XSA-170, the x86 instruction emulator was genuinely broken.
> It
> would load arbitrary values into %rip and putting a check here probably was
> the best stopgap security fix. It should have been reverted following c/s
> 81d3a0b26c1 "x86emul: limit-check branch targets" which corrected the
> emulator
> behaviour.
>
> However, everyone involved in XSA-170, myself included, failed to read the
> SDM
> correctly. On the subject of %rip consistency checks, the SDM stated:
>
> If the processor supports N < 64 linear-address bits, bits 63:N must be
> identical
>
> A non-canonical %rip (and SSP more recently) is an explicitly legal state in
> x86, and the VMEntry consistency checks are intentionally off-by-one from a
> regular canonical check.
>
> The consequence of this bug is that Xen will currently take a legal x86 state
> which would successfully VMEnter, and corrupt it into having non-
> architectural
> behaviour.
>
> Furthermore, in the time this bugfix has been pending in public, I
> successfully persuaded Intel to clarify the SDM, adding the following
> clarification:
>
> The guest RIP value is not required to be canonical; the value of bit N-1
> may differ from that of bit N.
>
> Fixes: ffbbfda377 ("x86/VMX: sanitize rIP before re-entering guest")
> Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
Reviewed-by: Kevin Tian <kevin.tian@xxxxxxxxx>
|
