Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752014AbbKYSGz (ORCPT ); Wed, 25 Nov 2015 13:06:55 -0500 Received: from mx1.redhat.com ([209.132.183.28]:43544 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751180AbbKYSGr (ORCPT ); Wed, 25 Nov 2015 13:06:47 -0500 Subject: Re: [PATCH 3.2 41/52] KVM: svm: unconditionally intercept #DB To: Ben Hutchings , linux-kernel@vger.kernel.org, stable@vger.kernel.org References: <56559C15.6040103@redhat.com> <1448474193.27159.19.camel@decadent.org.uk> Cc: akpm@linux-foundation.org, Jan Beulich From: Paolo Bonzini Message-ID: <5655F8B2.4080008@redhat.com> Date: Wed, 25 Nov 2015 19:06:42 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: <1448474193.27159.19.camel@decadent.org.uk> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 5105 Lines: 147 On 25/11/2015 18:56, Ben Hutchings wrote: > On Wed, 2015-11-25 at 12:31 +0100, Paolo Bonzini wrote: >> >> On 24/11/2015 23:33, Ben Hutchings wrote: >>> 3.2.74-rc1 review patch. If anyone has any objections, please let me know. >>> >>> ------------------ >>> >>> From: Paolo Bonzini >>> >>> commit cbdb967af3d54993f5814f1cee0ed311a055377d upstream. >>> >>> This is needed to avoid the possibility that the guest triggers >>> an infinite stream of #DB exceptions (CVE-2015-8104). >>> >>> VMX is not affected: because it does not save DR6 in the VMCS, >>> it already intercepts #DB unconditionally. >>> >>> Reported-by: Jan Beulich >>> Signed-off-by: Paolo Bonzini >>> [bwh: Backported to 3.2: #DB and #BP did not share a function, and there is >>> no operation pointer referring to it, so remove update_db_intercept() >>> entirely] >> >> This is wrong, you still need to check the BP intercept in the >> (incorrectly named as of 3.2) update_db_intercept function. >> >> Something like: >> >> -static void update_db_intercept(struct kvm_vcpu *vcpu) >> +static void update_bp_intercept(struct kvm_vcpu *vcpu) >> { >> > > struct vcpu_svm *svm = to_svm(vcpu); >> >> -> > clr_exception_intercept(svm, DB_VECTOR); >> > > clr_exception_intercept(svm, BP_VECTOR); >> - >> -> > if (svm->nmi_singlestep) >> -> > > set_exception_intercept(svm, DB_VECTOR); >> - >> > > if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) { >> -> > > if (vcpu->guest_debug & >> -> > > (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP)) >> -> > > > set_exception_intercept(svm, DB_VECTOR); >> > > > if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP) >> > > > > set_exception_intercept(svm, BP_VECTOR); >> > > } else >> > > vcpu->guest_debug = 0; >> } >> >> >> Then the calls in db_interception and enable_nmi_window can be removed, >> but the one in svm_guest_debug is important. > > Sorry about that. I now have with this version: > > From: Paolo Bonzini > Date: Tue, 10 Nov 2015 09:14:39 +0100 > Subject: KVM: svm: unconditionally intercept #DB > > commit cbdb967af3d54993f5814f1cee0ed311a055377d upstream. > > This is needed to avoid the possibility that the guest triggers > an infinite stream of #DB exceptions (CVE-2015-8104). > > VMX is not affected: because it does not save DR6 in the VMCS, > it already intercepts #DB unconditionally. > > Reported-by: Jan Beulich > Signed-off-by: Paolo Bonzini > [bwh: Backported to 3.2, with thanks to Paolo: > - update_db_bp_intercept() was called update_db_intercept() > - The remaining call is in svm_guest_debug() rather than through svm_x86_ops] > Signed-off-by: Ben Hutchings > --- > arch/x86/kvm/svm.c | 14 +++----------- > 1 file changed, 3 insertions(+), 11 deletions(-) > > --- a/arch/x86/kvm/svm.c > +++ b/arch/x86/kvm/svm.c > @@ -1015,6 +1015,7 @@ static void init_vmcb(struct vcpu_svm *s > set_exception_intercept(svm, UD_VECTOR); > set_exception_intercept(svm, MC_VECTOR); > set_exception_intercept(svm, AC_VECTOR); > + set_exception_intercept(svm, DB_VECTOR); > > set_intercept(svm, INTERCEPT_INTR); > set_intercept(svm, INTERCEPT_NMI); > @@ -1550,20 +1551,13 @@ static void svm_set_segment(struct kvm_v > mark_dirty(svm->vmcb, VMCB_SEG); > } > > -static void update_db_intercept(struct kvm_vcpu *vcpu) > +static void update_bp_intercept(struct kvm_vcpu *vcpu) > { > struct vcpu_svm *svm = to_svm(vcpu); > > - clr_exception_intercept(svm, DB_VECTOR); > clr_exception_intercept(svm, BP_VECTOR); > > - if (svm->nmi_singlestep) > - set_exception_intercept(svm, DB_VECTOR); > - > if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) { > - if (vcpu->guest_debug & > - (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP)) > - set_exception_intercept(svm, DB_VECTOR); > if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP) > set_exception_intercept(svm, BP_VECTOR); > } else > @@ -1581,7 +1575,7 @@ static void svm_guest_debug(struct kvm_v > > mark_dirty(svm->vmcb, VMCB_DR); > > - update_db_intercept(vcpu); > + update_bp_intercept(vcpu); > } > > static void new_asid(struct vcpu_svm *svm, struct svm_cpu_data *sd) > @@ -1655,7 +1649,6 @@ static int db_interception(struct vcpu_s > if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP)) > svm->vmcb->save.rflags &= > ~(X86_EFLAGS_TF | X86_EFLAGS_RF); > - update_db_intercept(&svm->vcpu); > } > > if (svm->vcpu.guest_debug & > @@ -3557,7 +3550,6 @@ static void enable_nmi_window(struct kvm > */ > svm->nmi_singlestep = true; > svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF); > - update_db_intercept(vcpu); > } > > static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr) > Thanks, this looks good. Paolo -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/