fix(vmm): Disable perfmon and debug capability

zulinx86 · zulinx86 · commit 2a155c288300 · 2023-05-22T09:32:22.000+01:00
We completely disabled the PMU on CPUID.0AH in 58b71f0 ("cpuid: disable performance monitor unit") to prevent an attacker from redirecting control flow to malicious code. On the other hand, Firecracker left CPUID:01H.ECX[bit 15] as it is, which indicates the processor supports the performance and debug feature indication IA32_PERF_CAPABILITIES MSR enumerating the existence of performance monitoring features. Thit bit is set to 1 on Intel CPUs + kernel 5.10 by default. And now the custom CPU template feature allows users to set to 1. To prevent users and newer kernels from enabling it, this commit disables it in CPUID normalization process. Signed-off-by: Takahiro Itazuri <itazur@amazon.com>
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -22,6 +22,7 @@
   [#3542](https://github.com/firecracker-microvm/firecracker/issues/3542).
 - A race condition that has been identified between the API thread and the VMM
   thread due to a misconfiguration of the `api_event_fd`.
+- Fixed CPUID leaf 0x1 to disable perfmon and debug feature on x86 host.
 
 ## [1.3.0]
 
diff --git a/docs/cpu_templates/cpuid-normalization.md b/docs/cpu_templates/cpuid-normalization.md
@@ -16,6 +16,7 @@ See also: [boot protocol settings](boot-protocol.md)
 | Set CLFLUSH line size                                                                | 0x1  | -       | EBX      | 15:8  |
 | Set maximum number of addressable IDs for logical processors in the physical package | 0x1  | -       | EBX      | 23:16 |
 | Set initial APIC ID                                                                  | 0x1  | -       | EBX      | 31:24 |
+| Disable PDCM (Perfmon and Debug Capability)                                          | 0x1  | -       | ECX      | 15    |
 | Enable TSC_DEADLINE                                                                  | 0x1  | -       | ECX      | 24    |
 | Enable HYPERVISOR                                                                    | 0x1  | -       | ECX      | 31    |
 | Set HTT value if the microVM's CPU count is greater than 1                           | 0x1  | -       | EDX      | 28    |
diff --git a/resources/tests/cpu_template_helper/fingerprint_AMD_MILAN_4.14host.json b/resources/tests/cpu_template_helper/fingerprint_AMD_MILAN_4.14host.json
@@ -1,6 +1,6 @@
 {
-  "firecracker_version": "1.4.0-dev",
-  "kernel_version": "4.14.311-233.529.amzn2.x86_64",
+  "firecracker_version": "1.5.0-dev",
+  "kernel_version": "4.14.313-235.533.amzn2.x86_64",
   "microcode_version": "0xa001173",
   "bios_version": "1.0",
   "bios_revision": "5.22",
diff --git a/resources/tests/cpu_template_helper/fingerprint_AMD_MILAN_5.10host.json b/resources/tests/cpu_template_helper/fingerprint_AMD_MILAN_5.10host.json
@@ -1,6 +1,6 @@
 {
-  "firecracker_version": "1.4.0-dev",
-  "kernel_version": "5.10.177-158.645.amzn2.x86_64",
+  "firecracker_version": "1.5.0-dev",
+  "kernel_version": "5.10.178-162.673.amzn2.x86_64",
   "microcode_version": "0xa001173",
   "bios_version": "1.0",
   "bios_revision": "5.22",
@@ -1421,10 +1421,6 @@
         "addr": "0x277",
         "bitmap": "0b0000000000000111000001000000011000000000000001110000010000000110"
       },
-      {
-        "addr": "0x345",
-        "bitmap": "0b0000000000000000000000000000000000000000000000000000000000000000"
-      },
       {
         "addr": "0x6e0",
         "bitmap": "0b0000000000000000000000000000000000000000000000000000000000000000"
diff --git a/resources/tests/cpu_template_helper/fingerprint_ARM_NEOVERSE_N1_4.14host.json b/resources/tests/cpu_template_helper/fingerprint_ARM_NEOVERSE_N1_4.14host.json
@@ -1,6 +1,6 @@
 {
-  "firecracker_version": "1.4.0-dev",
-  "kernel_version": "4.14.311-233.529.amzn2.aarch64",
+  "firecracker_version": "1.5.0-dev",
+  "kernel_version": "4.14.313-235.533.amzn2.aarch64",
   "microcode_version": "0x00000000000000ff",
   "bios_version": "1.0",
   "bios_revision": "1.0",
diff --git a/resources/tests/cpu_template_helper/fingerprint_ARM_NEOVERSE_N1_5.10host.json b/resources/tests/cpu_template_helper/fingerprint_ARM_NEOVERSE_N1_5.10host.json
@@ -1,6 +1,6 @@
 {
-  "firecracker_version": "1.4.0-dev",
-  "kernel_version": "5.10.177-158.645.amzn2.aarch64",
+  "firecracker_version": "1.5.0-dev",
+  "kernel_version": "5.10.178-162.673.amzn2.aarch64",
   "microcode_version": "0x00000000000000ff",
   "bios_version": "1.0",
   "bios_revision": "1.0",
diff --git a/resources/tests/cpu_template_helper/fingerprint_ARM_NEOVERSE_V1_4.14host.json b/resources/tests/cpu_template_helper/fingerprint_ARM_NEOVERSE_V1_4.14host.json
@@ -1,6 +1,6 @@
 {
-  "firecracker_version": "1.4.0-dev",
-  "kernel_version": "4.14.311-233.529.amzn2.aarch64",
+  "firecracker_version": "1.5.0-dev",
+  "kernel_version": "4.14.313-235.533.amzn2.aarch64",
   "microcode_version": "0x0000000000000001",
   "bios_version": "1.0",
   "bios_revision": "1.0",
diff --git a/resources/tests/cpu_template_helper/fingerprint_ARM_NEOVERSE_V1_5.10host.json b/resources/tests/cpu_template_helper/fingerprint_ARM_NEOVERSE_V1_5.10host.json
@@ -1,6 +1,6 @@
 {
-  "firecracker_version": "1.4.0-dev",
-  "kernel_version": "5.10.177-158.645.amzn2.aarch64",
+  "firecracker_version": "1.5.0-dev",
+  "kernel_version": "5.10.178-162.673.amzn2.aarch64",
   "microcode_version": "0x0000000000000001",
   "bios_version": "1.0",
   "bios_revision": "1.0",
diff --git a/resources/tests/cpu_template_helper/fingerprint_INTEL_CASCADELAKE_4.14host.json b/resources/tests/cpu_template_helper/fingerprint_INTEL_CASCADELAKE_4.14host.json
@@ -1,6 +1,6 @@
 {
-  "firecracker_version": "1.4.0-dev",
-  "kernel_version": "4.14.311-233.529.amzn2.x86_64",
+  "firecracker_version": "1.5.0-dev",
+  "kernel_version": "4.14.313-235.533.amzn2.x86_64",
   "microcode_version": "0x5003302",
   "bios_version": "1.0",
   "bios_revision": "3.65",
diff --git a/resources/tests/cpu_template_helper/fingerprint_INTEL_CASCADELAKE_5.10host.json b/resources/tests/cpu_template_helper/fingerprint_INTEL_CASCADELAKE_5.10host.json
@@ -1,6 +1,6 @@
 {
-  "firecracker_version": "1.4.0-dev",
-  "kernel_version": "5.10.177-158.645.amzn2.x86_64",
+  "firecracker_version": "1.5.0-dev",
+  "kernel_version": "5.10.178-162.673.amzn2.x86_64",
   "microcode_version": "0x5003302",
   "bios_version": "1.0",
   "bios_revision": "3.65",
@@ -44,7 +44,7 @@
           },
           {
             "register": "ecx",
-            "bitmap": "0b11110111111110101011001000100011"
+            "bitmap": "0b11110111111110100011001000100011"
           },
           {
             "register": "edx",
@@ -1153,10 +1153,6 @@
         "addr": "0x277",
         "bitmap": "0b0000000000000111000001000000011000000000000001110000010000000110"
       },
-      {
-        "addr": "0x345",
-        "bitmap": "0b0000000000000000000000000000000000000000000000000010000000000000"
-      },
       {
         "addr": "0x6e0",
         "bitmap": "0b0000000000000000000000000000000000000000000000000000000000000000"
diff --git a/resources/tests/cpu_template_helper/fingerprint_INTEL_ICELAKE_4.14host.json b/resources/tests/cpu_template_helper/fingerprint_INTEL_ICELAKE_4.14host.json
@@ -1,6 +1,6 @@
 {
-  "firecracker_version": "1.4.0-dev",
-  "kernel_version": "4.14.311-233.529.amzn2.x86_64",
+  "firecracker_version": "1.5.0-dev",
+  "kernel_version": "4.14.313-235.533.amzn2.x86_64",
   "microcode_version": "0xd00037b",
   "bios_version": "1.0",
   "bios_revision": "1.25",
diff --git a/resources/tests/cpu_template_helper/fingerprint_INTEL_ICELAKE_5.10host.json b/resources/tests/cpu_template_helper/fingerprint_INTEL_ICELAKE_5.10host.json
@@ -1,6 +1,6 @@
 {
-  "firecracker_version": "1.4.0-dev",
-  "kernel_version": "5.10.177-158.645.amzn2.x86_64",
+  "firecracker_version": "1.5.0-dev",
+  "kernel_version": "5.10.178-162.673.amzn2.x86_64",
   "microcode_version": "0xd00037b",
   "bios_version": "1.0",
   "bios_revision": "1.25",
@@ -44,7 +44,7 @@
           },
           {
             "register": "ecx",
-            "bitmap": "0b11110111111110101011001000100011"
+            "bitmap": "0b11110111111110100011001000100011"
           },
           {
             "register": "edx",
@@ -1245,10 +1245,6 @@
         "addr": "0x277",
         "bitmap": "0b0000000000000111000001000000011000000000000001110000010000000110"
       },
-      {
-        "addr": "0x345",
-        "bitmap": "0b0000000000000000000000000000000000000000000000000010000000000000"
-      },
       {
         "addr": "0x6e0",
         "bitmap": "0b0000000000000000000000000000000000000000000000000000000000000000"
diff --git a/resources/tests/cpu_template_helper/fingerprint_INTEL_SKYLAKE_4.14host.json b/resources/tests/cpu_template_helper/fingerprint_INTEL_SKYLAKE_4.14host.json
@@ -1,6 +1,6 @@
 {
-  "firecracker_version": "1.4.0-dev",
-  "kernel_version": "4.14.311-233.529.amzn2.x86_64",
+  "firecracker_version": "1.5.0-dev",
+  "kernel_version": "4.14.313-235.533.amzn2.x86_64",
   "microcode_version": "0x2006e05",
   "bios_version": "1.0",
   "bios_revision": "3.65",
diff --git a/resources/tests/cpu_template_helper/fingerprint_INTEL_SKYLAKE_5.10host.json b/resources/tests/cpu_template_helper/fingerprint_INTEL_SKYLAKE_5.10host.json
@@ -1,6 +1,6 @@
 {
-  "firecracker_version": "1.4.0-dev",
-  "kernel_version": "5.10.177-158.645.amzn2.x86_64",
+  "firecracker_version": "1.5.0-dev",
+  "kernel_version": "5.10.178-162.673.amzn2.x86_64",
   "microcode_version": "0x2006e05",
   "bios_version": "1.0",
   "bios_revision": "3.65",
@@ -44,7 +44,7 @@
           },
           {
             "register": "ecx",
-            "bitmap": "0b11110111111110101011001000100011"
+            "bitmap": "0b11110111111110100011001000100011"
           },
           {
             "register": "edx",
@@ -1153,10 +1153,6 @@
         "addr": "0x277",
         "bitmap": "0b0000000000000111000001000000011000000000000001110000010000000110"
       },
-      {
-        "addr": "0x345",
-        "bitmap": "0b0000000000000000000000000000000000000000000000000010000000000000"
-      },
       {
         "addr": "0x6e0",
         "bitmap": "0b0000000000000000000000000000000000000000000000000000000000000000"
diff --git a/src/vmm/src/arch/x86_64/msr.rs b/src/vmm/src/arch/x86_64/msr.rs
@@ -321,6 +321,8 @@ static UNDUMPABLE_MSR_RANGES: &[MsrRange] = &[
     // MSR_CORE_PERF_GLOBAL_CTRL
     // MSR_CORE_PERF_GLOBAL_OVF_CTRL
     MSR_RANGE!(MSR_CORE_PERF_FIXED_CTR_CTRL, 4),
+    // MSR_IA32_PERF_CAPABILITIES
+    MSR_RANGE!(MSR_IA32_PERF_CAPABILITIES),
     // MSR_K7_EVNTSELn
     MSR_RANGE!(MSR_K7_EVNTSEL0, 4),
     // MSR_K7_PERFCTRn
diff --git a/src/vmm/src/cpu_config/x86_64/cpuid/normalize.rs b/src/vmm/src/cpu_config/x86_64/cpuid/normalize.rs
@@ -209,6 +209,9 @@ impl super::Cpuid {
         // Flush a cache line size.
         const EBX_CLFLUSH_CACHELINE: u32 = 8;
 
+        // PDCM: Perfmon and Debug Capability.
+        const ECX_PDCM_BITINDEX: u8 = 15;
+
         // TSC-Deadline.
         const ECX_TSC_DEADLINE_BITINDEX: u8 = 24;
 
@@ -219,6 +222,12 @@ impl super::Cpuid {
             .get_mut(&CpuidKey::leaf(0x1))
             .ok_or(FeatureInformationError::MissingLeaf1)?;
 
+        // A value of 1 indicates the processor supports the performance and debug feature
+        // indication MSR IA32_PERF_CAPABILITIES.
+        //
+        // pdcm: 15,
+        set_bit(&mut leaf_1.result.ecx, ECX_PDCM_BITINDEX, false);
+
         // A value of 1 indicates that the processor’s local APIC timer supports one-shot
         // operation using a TSC deadline value.
         //
diff --git a/tests/integration_tests/functional/test_cpu_template_helper.py b/tests/integration_tests/functional/test_cpu_template_helper.py
@@ -194,8 +194,6 @@ def build_cpu_config_dict(cpu_config_path):
     0x174,
     0x175,
     0x176,
-    # MSR_IA32_PERF_CAPABILITIES is not available on AMD.
-    0x345,
     # MSR_IA32_TSC_DEADLINE specifies the time at which a timer interrupt
     # should occur and depends on the elapsed time.
     0x6E0,

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`		`- "firecracker_version": "1.4.0-dev",`
`3`		`- "kernel_version": "4.14.311-233.529.amzn2.x86_64",`
	`2`	`+ "firecracker_version": "1.5.0-dev",`
	`3`	`+ "kernel_version": "4.14.313-235.533.amzn2.x86_64",`
`4`	`4`	`"microcode_version": "0xa001173",`
`5`	`5`	`"bios_version": "1.0",`
`6`	`6`	`"bios_revision": "5.22",`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`		`- "firecracker_version": "1.4.0-dev",`
`3`		`- "kernel_version": "5.10.177-158.645.amzn2.aarch64",`
	`2`	`+ "firecracker_version": "1.5.0-dev",`
	`3`	`+ "kernel_version": "5.10.178-162.673.amzn2.aarch64",`
`4`	`4`	`"microcode_version": "0x00000000000000ff",`
`5`	`5`	`"bios_version": "1.0",`
`6`	`6`	`"bios_revision": "1.0",`