[Devel,RHEL7,COMMIT] ms/kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF)

Submitted by Konstantin Khorenko on Jan. 11, 2017, 2:56 p.m.

Details

Message ID 201701111456.v0BEuGBB011763@finist_cl7.x64_64.work.ct
State New
Series "Fresh KVM CVE fixes for update 4 kernel"
Headers show

Commit Message

Konstantin Khorenko Jan. 11, 2017, 2:56 p.m.
The commit is pushed to "branch-rh7-3.10.0-514.vz7.27.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-514.vz7.27.9
------>
commit 7efd73d3548321581182145c349fadcce13ad00b
Author: Jim Mattson <jmattson@google.com>
Date:   Wed Jan 11 18:56:16 2017 +0400

    ms/kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF)
    
    When L2 exits to L0 due to "exception or NMI", software exceptions
    (#BP and #OF) for which L1 has requested an intercept should be
    handled by L1 rather than L0. Previously, only hardware exceptions
    were forwarded to L1.
    
    Signed-off-by: Jim Mattson <jmattson@google.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    
    Backport of ms commit ef85b67385436ddc1998f45f1d6a210f935b3388
    Fixes CVE-2016-9588
    https://vulners.com/cve/CVE-2016-9588
    
    https://jira.sw.ru/browse/PSBM-58194
    
    Signed-off-by: Evgeny Yakovlev <eyakovlev@virtuozzo.com>
---
 arch/x86/kvm/vmx.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

Patch hide | download patch | download mbox

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 3d39923..8dea43b9 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1243,10 +1243,10 @@  static inline bool nested_cpu_has_posted_intr(struct vmcs12 *vmcs12)
 	return vmcs12->pin_based_vm_exec_control & PIN_BASED_POSTED_INTR;
 }
 
-static inline bool is_exception(u32 intr_info)
+static inline bool is_nmi(u32 intr_info)
 {
 	return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK))
-		== (INTR_TYPE_HARD_EXCEPTION | INTR_INFO_VALID_MASK);
+		== (INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK);
 }
 
 static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
@@ -5185,7 +5185,7 @@  static int handle_exception(struct kvm_vcpu *vcpu)
 	if (is_machine_check(intr_info))
 		return handle_machine_check(vcpu);
 
-	if ((intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR)
+	if (is_nmi(intr_info))
 		return 1;  /* already handled by vmx_vcpu_run() */
 
 	if (is_no_device(intr_info)) {
@@ -7629,7 +7629,7 @@  static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
 
 	switch (exit_reason) {
 	case EXIT_REASON_EXCEPTION_NMI:
-		if (!is_exception(intr_info))
+		if (is_nmi(intr_info))
 			return false;
 		else if (is_page_fault(intr_info))
 			return enable_ept;
@@ -8226,8 +8226,7 @@  static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx)
 		kvm_machine_check();
 
 	/* We need to handle NMIs before interrupts are enabled */
-	if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR &&
-	    (exit_intr_info & INTR_INFO_VALID_MASK)) {
+	if (is_nmi(exit_intr_info)) {
 		kvm_before_handle_nmi(&vmx->vcpu);
 		asm("int $2");
 		kvm_after_handle_nmi(&vmx->vcpu);

Comments

Konstantin Khorenko Jan. 11, 2017, 3 p.m.
Please consider to create a ReadyKernel live patch for this issue.

--
Best regards,

Konstantin Khorenko,
Virtuozzo Linux Kernel Team

On 01/11/2017 05:56 PM, Konstantin Khorenko wrote:
> The commit is pushed to "branch-rh7-3.10.0-514.vz7.27.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
> after rh7-3.10.0-514.vz7.27.9
> ------>
> commit 7efd73d3548321581182145c349fadcce13ad00b
> Author: Jim Mattson <jmattson@google.com>
> Date:   Wed Jan 11 18:56:16 2017 +0400
>
>     ms/kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF)
>
>     When L2 exits to L0 due to "exception or NMI", software exceptions
>     (#BP and #OF) for which L1 has requested an intercept should be
>     handled by L1 rather than L0. Previously, only hardware exceptions
>     were forwarded to L1.
>
>     Signed-off-by: Jim Mattson <jmattson@google.com>
>     Cc: stable@vger.kernel.org
>     Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
>
>     Backport of ms commit ef85b67385436ddc1998f45f1d6a210f935b3388
>     Fixes CVE-2016-9588
>     https://vulners.com/cve/CVE-2016-9588
>
>     https://jira.sw.ru/browse/PSBM-58194
>
>     Signed-off-by: Evgeny Yakovlev <eyakovlev@virtuozzo.com>
> ---
>  arch/x86/kvm/vmx.c | 11 +++++------
>  1 file changed, 5 insertions(+), 6 deletions(-)
>
> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
> index 3d39923..8dea43b9 100644
> --- a/arch/x86/kvm/vmx.c
> +++ b/arch/x86/kvm/vmx.c
> @@ -1243,10 +1243,10 @@ static inline bool nested_cpu_has_posted_intr(struct vmcs12 *vmcs12)
>  	return vmcs12->pin_based_vm_exec_control & PIN_BASED_POSTED_INTR;
>  }
>
> -static inline bool is_exception(u32 intr_info)
> +static inline bool is_nmi(u32 intr_info)
>  {
>  	return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK))
> -		== (INTR_TYPE_HARD_EXCEPTION | INTR_INFO_VALID_MASK);
> +		== (INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK);
>  }
>
>  static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
> @@ -5185,7 +5185,7 @@ static int handle_exception(struct kvm_vcpu *vcpu)
>  	if (is_machine_check(intr_info))
>  		return handle_machine_check(vcpu);
>
> -	if ((intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR)
> +	if (is_nmi(intr_info))
>  		return 1;  /* already handled by vmx_vcpu_run() */
>
>  	if (is_no_device(intr_info)) {
> @@ -7629,7 +7629,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
>
>  	switch (exit_reason) {
>  	case EXIT_REASON_EXCEPTION_NMI:
> -		if (!is_exception(intr_info))
> +		if (is_nmi(intr_info))
>  			return false;
>  		else if (is_page_fault(intr_info))
>  			return enable_ept;
> @@ -8226,8 +8226,7 @@ static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx)
>  		kvm_machine_check();
>
>  	/* We need to handle NMIs before interrupts are enabled */
> -	if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR &&
> -	    (exit_intr_info & INTR_INFO_VALID_MASK)) {
> +	if (is_nmi(exit_intr_info)) {
>  		kvm_before_handle_nmi(&vmx->vcpu);
>  		asm("int $2");
>  		kvm_after_handle_nmi(&vmx->vcpu);
> .
>
Vasily Averin Jan. 11, 2017, 3:26 p.m.
it requires ebnabled nested virtualization.
it is not supported yet, so there are no sense to fix it in ReadyKernel

On 2017-01-11 18:00, Konstantin Khorenko wrote:
> Please consider to create a ReadyKernel live patch for this issue.
> 
> -- 
> Best regards,
> 
> Konstantin Khorenko,
> Virtuozzo Linux Kernel Team
> 
> On 01/11/2017 05:56 PM, Konstantin Khorenko wrote:
>> The commit is pushed to "branch-rh7-3.10.0-514.vz7.27.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
>> after rh7-3.10.0-514.vz7.27.9
>> ------>
>> commit 7efd73d3548321581182145c349fadcce13ad00b
>> Author: Jim Mattson <jmattson@google.com>
>> Date:   Wed Jan 11 18:56:16 2017 +0400
>>
>>     ms/kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF)
>>
>>     When L2 exits to L0 due to "exception or NMI", software exceptions
>>     (#BP and #OF) for which L1 has requested an intercept should be
>>     handled by L1 rather than L0. Previously, only hardware exceptions
>>     were forwarded to L1.
>>
>>     Signed-off-by: Jim Mattson <jmattson@google.com>
>>     Cc: stable@vger.kernel.org
>>     Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
>>
>>     Backport of ms commit ef85b67385436ddc1998f45f1d6a210f935b3388
>>     Fixes CVE-2016-9588
>>     https://vulners.com/cve/CVE-2016-9588
>>
>>     https://jira.sw.ru/browse/PSBM-58194
>>
>>     Signed-off-by: Evgeny Yakovlev <eyakovlev@virtuozzo.com>
>> ---
>>  arch/x86/kvm/vmx.c | 11 +++++------
>>  1 file changed, 5 insertions(+), 6 deletions(-)
>>
>> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
>> index 3d39923..8dea43b9 100644
>> --- a/arch/x86/kvm/vmx.c
>> +++ b/arch/x86/kvm/vmx.c
>> @@ -1243,10 +1243,10 @@ static inline bool nested_cpu_has_posted_intr(struct vmcs12 *vmcs12)
>>      return vmcs12->pin_based_vm_exec_control & PIN_BASED_POSTED_INTR;
>>  }
>>
>> -static inline bool is_exception(u32 intr_info)
>> +static inline bool is_nmi(u32 intr_info)
>>  {
>>      return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK))
>> -        == (INTR_TYPE_HARD_EXCEPTION | INTR_INFO_VALID_MASK);
>> +        == (INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK);
>>  }
>>
>>  static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
>> @@ -5185,7 +5185,7 @@ static int handle_exception(struct kvm_vcpu *vcpu)
>>      if (is_machine_check(intr_info))
>>          return handle_machine_check(vcpu);
>>
>> -    if ((intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR)
>> +    if (is_nmi(intr_info))
>>          return 1;  /* already handled by vmx_vcpu_run() */
>>
>>      if (is_no_device(intr_info)) {
>> @@ -7629,7 +7629,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
>>
>>      switch (exit_reason) {
>>      case EXIT_REASON_EXCEPTION_NMI:
>> -        if (!is_exception(intr_info))
>> +        if (is_nmi(intr_info))
>>              return false;
>>          else if (is_page_fault(intr_info))
>>              return enable_ept;
>> @@ -8226,8 +8226,7 @@ static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx)
>>          kvm_machine_check();
>>
>>      /* We need to handle NMIs before interrupts are enabled */
>> -    if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR &&
>> -        (exit_intr_info & INTR_INFO_VALID_MASK)) {
>> +    if (is_nmi(exit_intr_info)) {
>>          kvm_before_handle_nmi(&vmx->vcpu);
>>          asm("int $2");
>>          kvm_after_handle_nmi(&vmx->vcpu);
>> .
>>
>