|
 |
11dc6a0 |
From 48bb9bb210c6c2f185d891e3e7a401d849409f84 Mon Sep 17 00:00:00 2001
|
|
|
11dc6a0 |
From: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
11dc6a0 |
Date: Tue, 10 Nov 2015 13:22:53 +0100
|
|
|
11dc6a0 |
Subject: [PATCH 2/2] KVM: svm: unconditionally intercept #DB
|
|
|
11dc6a0 |
|
|
|
11dc6a0 |
This is needed to avoid the possibility that the guest triggers
|
|
|
11dc6a0 |
an infinite stream of #DB exceptions (CVE-2015-8104).
|
|
|
11dc6a0 |
|
|
|
11dc6a0 |
VMX is not affected: because it does not save DR6 in the VMCS,
|
|
|
11dc6a0 |
it already intercepts #DB unconditionally.
|
|
|
11dc6a0 |
|
|
|
11dc6a0 |
Reported-by: Jan Beulich <jbeulich@suse.com>
|
|
|
11dc6a0 |
Cc: stable@vger.kernel.org
|
|
|
11dc6a0 |
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
11dc6a0 |
---
|
|
|
11dc6a0 |
arch/x86/kvm/svm.c | 14 +++-----------
|
|
|
11dc6a0 |
1 file changed, 3 insertions(+), 11 deletions(-)
|
|
|
11dc6a0 |
|
|
|
11dc6a0 |
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
|
|
|
11dc6a0 |
index 7203b3cc71b5..184e50b3c35a 100644
|
|
|
11dc6a0 |
--- a/arch/x86/kvm/svm.c
|
|
|
11dc6a0 |
+++ b/arch/x86/kvm/svm.c
|
|
|
11dc6a0 |
@@ -1111,6 +1111,7 @@ static void init_vmcb(struct vcpu_svm *svm)
|
|
|
11dc6a0 |
set_exception_intercept(svm, UD_VECTOR);
|
|
|
11dc6a0 |
set_exception_intercept(svm, MC_VECTOR);
|
|
|
11dc6a0 |
set_exception_intercept(svm, AC_VECTOR);
|
|
|
11dc6a0 |
+ set_exception_intercept(svm, DB_VECTOR);
|
|
|
11dc6a0 |
|
|
|
11dc6a0 |
set_intercept(svm, INTERCEPT_INTR);
|
|
|
11dc6a0 |
set_intercept(svm, INTERCEPT_NMI);
|
|
|
11dc6a0 |
@@ -1645,20 +1646,13 @@ static void svm_set_segment(struct kvm_vcpu *vcpu,
|
|
|
11dc6a0 |
mark_dirty(svm->vmcb, VMCB_SEG);
|
|
|
11dc6a0 |
}
|
|
|
11dc6a0 |
|
|
|
11dc6a0 |
-static void update_db_bp_intercept(struct kvm_vcpu *vcpu)
|
|
|
11dc6a0 |
+static void update_bp_intercept(struct kvm_vcpu *vcpu)
|
|
|
11dc6a0 |
{
|
|
|
11dc6a0 |
struct vcpu_svm *svm = to_svm(vcpu);
|
|
|
11dc6a0 |
|
|
|
11dc6a0 |
- clr_exception_intercept(svm, DB_VECTOR);
|
|
|
11dc6a0 |
clr_exception_intercept(svm, BP_VECTOR);
|
|
|
11dc6a0 |
|
|
|
11dc6a0 |
- if (svm->nmi_singlestep)
|
|
|
11dc6a0 |
- set_exception_intercept(svm, DB_VECTOR);
|
|
|
11dc6a0 |
-
|
|
|
11dc6a0 |
if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
|
|
|
11dc6a0 |
- if (vcpu->guest_debug &
|
|
|
11dc6a0 |
- (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
|
|
|
11dc6a0 |
- set_exception_intercept(svm, DB_VECTOR);
|
|
|
11dc6a0 |
if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
|
|
|
11dc6a0 |
set_exception_intercept(svm, BP_VECTOR);
|
|
|
11dc6a0 |
} else
|
|
|
11dc6a0 |
@@ -1764,7 +1758,6 @@ static int db_interception(struct vcpu_svm *svm)
|
|
|
11dc6a0 |
if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP))
|
|
|
11dc6a0 |
svm->vmcb->save.rflags &=
|
|
|
11dc6a0 |
~(X86_EFLAGS_TF | X86_EFLAGS_RF);
|
|
|
11dc6a0 |
- update_db_bp_intercept(&svm->vcpu);
|
|
|
11dc6a0 |
}
|
|
|
11dc6a0 |
|
|
|
11dc6a0 |
if (svm->vcpu.guest_debug &
|
|
|
11dc6a0 |
@@ -3753,7 +3746,6 @@ static void enable_nmi_window(struct kvm_vcpu *vcpu)
|
|
|
11dc6a0 |
*/
|
|
|
11dc6a0 |
svm->nmi_singlestep = true;
|
|
|
11dc6a0 |
svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF);
|
|
|
11dc6a0 |
- update_db_bp_intercept(vcpu);
|
|
|
11dc6a0 |
}
|
|
|
11dc6a0 |
|
|
|
11dc6a0 |
static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr)
|
|
|
11dc6a0 |
@@ -4379,7 +4371,7 @@ static struct kvm_x86_ops svm_x86_ops = {
|
|
|
11dc6a0 |
.vcpu_load = svm_vcpu_load,
|
|
|
11dc6a0 |
.vcpu_put = svm_vcpu_put,
|
|
|
11dc6a0 |
|
|
|
11dc6a0 |
- .update_db_bp_intercept = update_db_bp_intercept,
|
|
|
11dc6a0 |
+ .update_db_bp_intercept = update_bp_intercept,
|
|
|
11dc6a0 |
.get_msr = svm_get_msr,
|
|
|
11dc6a0 |
.set_msr = svm_set_msr,
|
|
|
11dc6a0 |
.get_segment_base = svm_get_segment_base,
|
|
|
11dc6a0 |
--
|
|
|
11dc6a0 |
2.4.3
|
|
|
11dc6a0 |
|