Skip to content

Commit 4fcc6bf

Browse files
fwsGonzofwsGonzo
committed
Prevent access to remote data, improve remote page faults
1 parent fd1cdc2 commit 4fcc6bf

File tree

3 files changed

+30
-38
lines changed

3 files changed

+30
-38
lines changed

‎lib/tinykvm/amd64/builtin/interrupts.asm‎

Lines changed: 4 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -239,17 +239,8 @@ ALIGN 0x10
239239
.vm64_remote_disconnect:
240240
out 0, eax
241241
;; RAX contains the original FSBASE of this VM
242-
stac
243242
;; Write to FSBASE MSR
244-
push rcx
245-
push rdx
246-
mov ecx, 0xC0000100 ;; FSBASE
247-
mov rdx, rax
248-
shr rdx, 32
249-
wrmsr
250-
pop rdx
251-
pop rcx
252-
clac
243+
wrfsbase rax
253244
;; Reset pagetables
254245
mov rax, cr3
255246
mov cr3, rax
@@ -268,6 +259,7 @@ ALIGN 0x10
268259
push rax
269260
push rdi
270261
mov rdi, cr2 ;; Faulting address
262+
mov eax, [rsp + 16] ;; Error code
271263
out 128 + 14, eax
272264
invlpg [rdi]
273265
pop rdi
@@ -281,24 +273,19 @@ ALIGN 0x10
281273
.vm64_remote_page_fault:
282274
;; RAX: Remote FSBASE
283275
;; Write to FSBASE MSR
276+
wrfsbase rax
284277
push rcx
285-
push rdx
286-
mov ecx, 0xC0000100 ;; FSBASE
287-
mov rdx, rax
288-
shr rdx, 32
289-
wrmsr
290278

291279
;; Make the next function call return to a custom system call location
292280
;; Get remote-disconnect syscall address
293281
mov rax, [INTR_ASM_BASE + .vm64_remote_return_addr]
294282
;; Get original stack pointer
295-
mov rcx, [rsp + 24 + 32] ;; Original RSP
283+
mov rcx, [rsp + 16 + 32] ;; Original RSP
296284
;; Overwrite the return address
297285
stac
298286
mov [rcx], rax ;; Return address
299287
clac
300288

301-
pop rdx
302289
pop rcx
303290
pop rax
304291
add rsp, 8 ;; Skip error code

‎lib/tinykvm/amd64/builtin/kernel_assembly.h‎

Lines changed: 19 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
unsigned char interrupts[] = {
2-
0x50, 0x01, 0xc2, 0x02, 0x48, 0x03, 0x08, 0x00, 0xca, 0x02, 0x00, 0x00,
2+
0x50, 0x01, 0xc2, 0x02, 0x30, 0x03, 0x08, 0x00, 0xca, 0x02, 0x00, 0x00,
33
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
44
0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x00, 0x00, 0x00, 0x00,
55
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -29,9 +29,9 @@ unsigned char interrupts[] = {
2929
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3030
0x66, 0x3d, 0x9e, 0x00, 0x74, 0x39, 0x66, 0x3d, 0xe4, 0x00, 0x0f, 0x84,
3131
0xee, 0x00, 0x00, 0x00, 0x83, 0xf8, 0x09, 0x0f, 0x84, 0x40, 0x01, 0x00,
32-
0x00, 0x3d, 0x77, 0xf7, 0x01, 0x00, 0x0f, 0x84, 0x7f, 0x01, 0x00, 0x00,
32+
0x00, 0x3d, 0x77, 0xf7, 0x01, 0x00, 0x0f, 0x84, 0x6c, 0x01, 0x00, 0x00,
3333
0x3d, 0x78, 0xf7, 0x01, 0x00, 0x0f, 0x84, 0x51, 0x01, 0x00, 0x00, 0x3d,
34-
0x07, 0xf7, 0x01, 0x00, 0x0f, 0x84, 0x72, 0x01, 0x00, 0x00, 0xe7, 0x00,
34+
0x07, 0xf7, 0x01, 0x00, 0x0f, 0x84, 0x5f, 0x01, 0x00, 0x00, 0xe7, 0x00,
3535
0x48, 0x0f, 0x07, 0x0f, 0x01, 0xcb, 0x56, 0x51, 0x52, 0x48, 0x81, 0xff,
3636
0x02, 0x10, 0x00, 0x00, 0x75, 0x1b, 0xb9, 0x00, 0x01, 0x00, 0xc0, 0x89,
3737
0xf0, 0x48, 0xc1, 0xee, 0x20, 0x89, 0xf2, 0x0f, 0x30, 0x48, 0x31, 0xc0,
@@ -59,30 +59,28 @@ unsigned char interrupts[] = {
5959
0x83, 0xf8, 0xff, 0x74, 0x0e, 0x0f, 0x01, 0xcb, 0x50, 0x0f, 0x20, 0xd8,
6060
0x0f, 0x22, 0xd8, 0x58, 0x0f, 0x01, 0xca, 0x48, 0x0f, 0x07, 0xb8, 0x60,
6161
0x00, 0x00, 0x00, 0xe7, 0x00, 0xc3, 0xb8, 0xc2, 0x02, 0x00, 0x00, 0xc3,
62-
0xe7, 0x00, 0x0f, 0x01, 0xcb, 0x51, 0x52, 0xb9, 0x00, 0x01, 0x00, 0xc0,
63-
0x48, 0x89, 0xc2, 0x48, 0xc1, 0xea, 0x20, 0x0f, 0x30, 0x5a, 0x59, 0x0f,
64-
0x01, 0xca, 0x0f, 0x20, 0xd8, 0x0f, 0x22, 0xd8, 0x48, 0x0f, 0x07, 0x0f,
65-
0x20, 0xd8, 0x0f, 0x22, 0xd8, 0x48, 0x0f, 0x07, 0x48, 0x0f, 0x07, 0x50,
66-
0x57, 0x0f, 0x20, 0xd7, 0xe7, 0x8e, 0x0f, 0x01, 0x3f, 0x5f, 0x85, 0xc0,
67-
0x75, 0x07, 0x58, 0x48, 0x83, 0xc4, 0x08, 0x48, 0xcf, 0x51, 0x52, 0xb9,
68-
0x00, 0x01, 0x00, 0xc0, 0x48, 0x89, 0xc2, 0x48, 0xc1, 0xea, 0x20, 0x0f,
69-
0x30, 0x48, 0x8b, 0x04, 0x25, 0x0a, 0x20, 0x00, 0x00, 0x48, 0x8b, 0x4c,
70-
0x24, 0x38, 0x0f, 0x01, 0xcb, 0x48, 0x89, 0x01, 0x0f, 0x01, 0xca, 0x5a,
71-
0x59, 0x58, 0x48, 0x83, 0xc4, 0x08, 0x48, 0xcf, 0xe7, 0xa1, 0x48, 0xcf,
62+
0xe7, 0x00, 0xf3, 0x48, 0x0f, 0xae, 0xd0, 0x0f, 0x20, 0xd8, 0x0f, 0x22,
63+
0xd8, 0x48, 0x0f, 0x07, 0x0f, 0x20, 0xd8, 0x0f, 0x22, 0xd8, 0x48, 0x0f,
64+
0x07, 0x48, 0x0f, 0x07, 0x50, 0x57, 0x0f, 0x20, 0xd7, 0x8b, 0x44, 0x24,
65+
0x10, 0xe7, 0x8e, 0x0f, 0x01, 0x3f, 0x5f, 0x85, 0xc0, 0x75, 0x07, 0x58,
66+
0x48, 0x83, 0xc4, 0x08, 0x48, 0xcf, 0xf3, 0x48, 0x0f, 0xae, 0xd0, 0x51,
67+
0x48, 0x8b, 0x04, 0x25, 0x0a, 0x20, 0x00, 0x00, 0x48, 0x8b, 0x4c, 0x24,
68+
0x30, 0x0f, 0x01, 0xcb, 0x48, 0x89, 0x01, 0x0f, 0x01, 0xca, 0x59, 0x58,
69+
0x48, 0x83, 0xc4, 0x08, 0x48, 0xcf, 0xe7, 0xa1, 0x48, 0xcf, 0x90, 0x90,
7270
0xe7, 0x80, 0x48, 0xcf, 0x90, 0x90, 0x90, 0x90, 0xe7, 0x81, 0x48, 0xcf,
7371
0x90, 0x90, 0x90, 0x90, 0xe7, 0x82, 0x48, 0xcf, 0x90, 0x90, 0x90, 0x90,
7472
0xe7, 0x83, 0x48, 0xcf, 0x90, 0x90, 0x90, 0x90, 0xe7, 0x84, 0x48, 0xcf,
7573
0x90, 0x90, 0x90, 0x90, 0xe7, 0x85, 0x48, 0xcf, 0x90, 0x90, 0x90, 0x90,
7674
0xe7, 0x86, 0x48, 0xcf, 0x90, 0x90, 0x90, 0x90, 0xe7, 0x87, 0x48, 0xcf,
77-
0x90, 0x90, 0x90, 0x90, 0xe7, 0x88, 0xeb, 0x83, 0x90, 0x90, 0x90, 0x90,
78-
0xe7, 0x89, 0x48, 0xcf, 0x90, 0x90, 0x90, 0x90, 0xe7, 0x8a, 0xe9, 0x70,
79-
0xff, 0xff, 0xff, 0x90, 0xe7, 0x8b, 0xe9, 0x68, 0xff, 0xff, 0xff, 0x90,
80-
0xe7, 0x8c, 0xe9, 0x60, 0xff, 0xff, 0xff, 0x90, 0xe7, 0x8d, 0xe9, 0x58,
81-
0xff, 0xff, 0xff, 0x90, 0xe9, 0x42, 0xff, 0xff, 0xff, 0x90, 0x90, 0x90,
75+
0x90, 0x90, 0x90, 0x90, 0xe7, 0x88, 0xeb, 0x8c, 0x90, 0x90, 0x90, 0x90,
76+
0xe7, 0x89, 0x48, 0xcf, 0x90, 0x90, 0x90, 0x90, 0xe7, 0x8a, 0xe9, 0x79,
77+
0xff, 0xff, 0xff, 0x90, 0xe7, 0x8b, 0xe9, 0x71, 0xff, 0xff, 0xff, 0x90,
78+
0xe7, 0x8c, 0xe9, 0x69, 0xff, 0xff, 0xff, 0x90, 0xe7, 0x8d, 0xe9, 0x61,
79+
0xff, 0xff, 0xff, 0x90, 0xe9, 0x47, 0xff, 0xff, 0xff, 0x90, 0x90, 0x90,
8280
0xe7, 0x8f, 0x48, 0xcf, 0x90, 0x90, 0x90, 0x90, 0xe7, 0x90, 0x48, 0xcf,
83-
0x90, 0x90, 0x90, 0x90, 0xe7, 0x91, 0xe9, 0x38, 0xff, 0xff, 0xff, 0x90,
81+
0x90, 0x90, 0x90, 0x90, 0xe7, 0x91, 0xe9, 0x41, 0xff, 0xff, 0xff, 0x90,
8482
0xe7, 0x92, 0x48, 0xcf, 0x90, 0x90, 0x90, 0x90, 0xe7, 0x93, 0x48, 0xcf,
8583
0x90, 0x90, 0x90, 0x90, 0xe7, 0x94, 0x48, 0xcf, 0x90, 0x90, 0x90, 0x90,
86-
0xe9, 0x4f, 0xff, 0xff, 0xff
84+
0xe9, 0x4d, 0xff, 0xff, 0xff
8785
};
88-
unsigned int interrupts_len = 1013;
86+
unsigned int interrupts_len = 989;

‎lib/tinykvm/vcpu_run.cpp‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -281,6 +281,13 @@ long vCPU::run_once()
281281
this->handle_exception(intr);
282282
Machine::machine_exception("Remote VM page fault while already connected", intr);
283283
}
284+
/* Check that the error code is instruction fetch failed */
285+
const uint32_t errcode = regs.rax;
286+
if ((errcode & 0x10) == 0) {
287+
// Not an instruction fetch, something is fishy
288+
this->handle_exception(intr);
289+
Machine::machine_exception("Remote VM page fault", intr);
290+
}
284291
/* Remote VM page fault */
285292
uint64_t retstack; machine().unsafe_copy_from_guest(&retstack, regs.rsp + 16 + 32, 8);
286293
uint64_t retaddr; machine().unsafe_copy_from_guest(&retaddr, retstack, 8);

0 commit comments

Comments
 (0)