Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Maxim Levitsky <mlevitsk@redhat.com>
To:     kvm@vger.kernel.org
Cc:     Paolo Bonzini <pbonzini@redhat.com>,
        "H. Peter Anvin" <hpa@zytor.com>, Shuah Khan <shuah@kernel.org>,
        Yang Zhong <yang.zhong@intel.com>,
        Wei Wang <wei.w.wang@intel.com>,
        Colton Lewis <coltonlewis@google.com>,
        Sean Christopherson <seanjc@google.com>,
        Jim Mattson <jmattson@google.com>,
        Chenyi Qiang <chenyi.qiang@intel.com>,
        Borislav Petkov <bp@alien8.de>, linux-kernel@vger.kernel.org,
        x86@kernel.org, Thomas Gleixner <tglx@linutronix.de>,
        Dave Hansen <dave.hansen@linux.intel.com>,
        Ingo Molnar <mingo@redhat.com>,
        David Matlack <dmatlack@google.com>,
        Peter Xu <peterx@redhat.com>,
        Maxim Levitsky <mlevitsk@redhat.com>,
        linux-kselftest@vger.kernel.org
Subject: [PATCH 0/9] nSVM: Security and correctness fixes
Date:   Thu,  3 Nov 2022 15:57:27 +0200
Message-Id: <20221103135736.42295-1-mlevitsk@redhat.com>
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Recently while trying to fix some unit tests I found a CVE in SVM nested co=
de.=0D
=0D
In 'shutdown_interception' vmexit handler we call kvm_vcpu_reset.=0D
=0D
However if running nested and L1 doesn't intercept shutdown, we will still =
end=0D
up running this function and trigger a bug in it.=0D
=0D
The bug is that this function resets the 'vcpu->arch.hflags' without proper=
ly=0D
leaving the nested state, which leaves the vCPU in inconsistent state, whic=
h=0D
later triggers a kernel panic in SVM code.=0D
=0D
The same bug can likely be triggered by sending INIT via local apic to a vC=
PU=0D
which runs a nested guest.=0D
=0D
On VMX we are lucky that the issue can't happen because VMX always intercep=
ts=0D
triple faults, thus triple fault in L2 will always be redirected to L1.=0D
Plus the 'handle_triple_fault' of VMX doesn't reset the vCPU.=0D
=0D
INIT IPI can't happen on VMX either because INIT events are masked while in=
=0D
VMX mode.=0D
=0D
First 4 patches in this series address the above issue, and are=0D
already posted on the list with title,=0D
('nSVM: fix L0 crash if L2 has shutdown condtion which L1 doesn't intercept=
')=0D
I addressed the review feedback and also added a unit test to hit this issu=
e.=0D
=0D
In addition to these patches I noticed that KVM doesn't honour SHUTDOWN int=
ercept bit=0D
of L1 on SVM, and I included a fix to do so - its only for correctness=0D
as a normal hypervisor should always intercept SHUTDOWN.=0D
A unit test on the other hand might want to not do so.=0D
I also extendted the triple_fault_test selftest to hit this issue.=0D
=0D
Finaly I found another security issue, I found a way to=0D
trigger a kernel non rate limited printk on SVM from the guest, and=0D
last patch in the series fixes that.=0D
=0D
A unit test I posted to kvm-unit-tests project hits this issue, so=0D
no selftest was added.=0D
=0D
Best regards,=0D
	Maxim Levitsky=0D
=0D
Maxim Levitsky (9):=0D
  KVM: x86: nSVM: leave nested mode on vCPU free=0D
  KVM: x86: nSVM: harden svm_free_nested against freeing vmcb02 while=0D
    still in use=0D
  KVM: x86: add kvm_leave_nested=0D
  KVM: x86: forcibly leave nested mode on vCPU reset=0D
  KVM: selftests: move idt_entry to header=0D
  kvm: selftests: add svm nested shutdown test=0D
  KVM: x86: allow L1 to not intercept triple fault=0D
  KVM: selftests: add svm part to triple_fault_test=0D
  KVM: x86: remove exit_int_info warning in svm_handle_exit=0D
=0D
 arch/x86/kvm/svm/nested.c                     | 12 +++-=0D
 arch/x86/kvm/svm/svm.c                        | 10 +--=0D
 arch/x86/kvm/vmx/nested.c                     |  4 +-=0D
 arch/x86/kvm/x86.c                            | 29 ++++++--=0D
 tools/testing/selftests/kvm/.gitignore        |  1 +=0D
 tools/testing/selftests/kvm/Makefile          |  1 +=0D
 .../selftests/kvm/include/x86_64/processor.h  | 13 ++++=0D
 .../selftests/kvm/lib/x86_64/processor.c      | 13 ----=0D
 .../kvm/x86_64/svm_nested_shutdown_test.c     | 71 +++++++++++++++++++=0D
 .../kvm/x86_64/triple_fault_event_test.c      | 71 ++++++++++++++-----=0D
 10 files changed, 174 insertions(+), 51 deletions(-)=0D
 create mode 100644 tools/testing/selftests/kvm/x86_64/svm_nested_shutdown_=
test.c=0D
=0D
-- =0D
2.34.3=0D
=0D