Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Step:15
xen.15298
5dd93ce0-vVMX-fix-livelock-with-XSA-304-fix.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 5dd93ce0-vVMX-fix-livelock-with-XSA-304-fix.patch of Package xen.15298
# Commit 183f354e1430087879de071f0c7122e42703916e # Date 2019-11-23 14:06:24 +0000 # Author Andrew Cooper <andrew.cooper3@citrix.com> # Committer Andrew Cooper <andrew.cooper3@citrix.com> x86/vvmx: Fix livelock with XSA-304 fix It turns out that the XSA-304 / CVE-2018-12207 fix of disabling executable superpages doesn't work well with the nested p2m code. Nested virt is experimental and not security supported, but is useful for development purposes. In order to not regress the status quo, disable the XSA-304 workaround until the nested p2m code can be improved. Introduce a per-domain exec_sp control and set it based on the current opt_ept_exec_sp setting. Take the oppotunity to omit a PVH hardware domain from the performance hit, because it is already permitted to DoS the system in such ways as issuing a reboot. When nested virt is enabled on a domain, force it to using executable superpages and rebuild the p2m. Having the setting per-domain involves rearranging the internals of parse_ept_param_runtime() but it still retains the same overall semantics - for each applicable domain whose setting needs to change, rebuild the p2m. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: George Dunlap <george.dunlap@citrix.com> --- a/xen/arch/x86/hvm/vmx/vmcs.c +++ b/xen/arch/x86/hvm/vmx/vmcs.c @@ -31,6 +31,7 @@ #include <asm/xstate.h> #include <asm/hvm/hvm.h> #include <asm/hvm/io.h> +#include <asm/hvm/nestedhvm.h> #include <asm/hvm/support.h> #include <asm/hvm/vmx/vmx.h> #include <asm/hvm/vmx/vvmx.h> @@ -109,6 +110,7 @@ custom_param("ept", parse_ept_param); static int parse_ept_param_runtime(const char *s) { + struct domain *d; int val; if ( !cpu_has_vmx_ept || !hvm_funcs.hap_supported || @@ -122,18 +124,31 @@ static int parse_ept_param_runtime(const if ( (val = parse_boolean("exec-sp", s, NULL)) < 0 ) return -EINVAL; - if ( val != opt_ept_exec_sp ) - { - struct domain *d; + opt_ept_exec_sp = val; - opt_ept_exec_sp = val; + rcu_read_lock(&domlist_read_lock); + for_each_domain ( d ) + { + /* PV, or HVM Shadow domain? Not applicable. */ + if ( !paging_mode_hap(d) ) + continue; + + /* Hardware domain? Not applicable. */ + if ( is_hardware_domain(d) ) + continue; + + /* Nested Virt? Broken and exec_sp forced on to avoid livelocks. */ + if ( nestedhvm_enabled(d) ) + continue; + + /* Setting already matches? No need to rebuild the p2m. */ + if ( d->arch.hvm_domain.vmx.exec_sp == val ) + continue; - rcu_read_lock(&domlist_read_lock); - for_each_domain ( d ) - if ( paging_mode_hap(d) ) - p2m_change_entry_type_global(d, p2m_ram_rw, p2m_ram_rw); - rcu_read_unlock(&domlist_read_lock); + d->arch.hvm_domain.vmx.exec_sp = val; + p2m_change_entry_type_global(d, p2m_ram_rw, p2m_ram_rw); } + rcu_read_unlock(&domlist_read_lock); printk("VMX: EPT executable superpages %sabled\n", val ? "en" : "dis"); --- a/xen/arch/x86/hvm/vmx/vmx.c +++ b/xen/arch/x86/hvm/vmx/vmx.c @@ -405,6 +405,12 @@ static int vmx_domain_initialise(struct d->arch.ctxt_switch = &csw; + /* + * Work around CVE-2018-12207? The hardware domain is already permitted + * to reboot the system, so doesn't need mitigating against DoS's. + */ + d->arch.hvm_domain.vmx.exec_sp = is_hardware_domain(d) || opt_ept_exec_sp; + if ( !has_vlapic(d) ) return 0; --- a/xen/arch/x86/hvm/vmx/vvmx.c +++ b/xen/arch/x86/hvm/vmx/vvmx.c @@ -59,10 +59,23 @@ void nvmx_cpu_dead(unsigned int cpu) int nvmx_vcpu_initialise(struct vcpu *v) { + struct domain *d = v->domain; struct nestedvmx *nvmx = &vcpu_2_nvmx(v); struct nestedvcpu *nvcpu = &vcpu_nestedhvm(v); struct page_info *pg = alloc_domheap_page(NULL, 0); + /* + * Gross bodge. The nested p2m logic can't cope with the CVE-2018-12207 + * workaround of using NX EPT superpages, and livelocks. Nested HVM isn't + * security supported, so disable the workaround until the nested p2m + * logic can be improved. + */ + if ( !d->arch.hvm_domain.vmx.exec_sp ) + { + d->arch.hvm_domain.vmx.exec_sp = true; + p2m_change_entry_type_global(d, p2m_ram_rw, p2m_ram_rw); + } + if ( !pg ) { gdprintk(XENLOG_ERR, "nest: allocation for shadow vmcs failed\n"); --- a/xen/arch/x86/mm/p2m-ept.c +++ b/xen/arch/x86/mm/p2m-ept.c @@ -219,7 +219,7 @@ static void ept_p2m_type_to_flags(struct * Don't create executable superpages if we need to shatter them to * protect against CVE-2018-12207. */ - if ( !opt_ept_exec_sp && is_epte_superpage(entry) ) + if ( !p2m->domain->arch.hvm_domain.vmx.exec_sp && is_epte_superpage(entry) ) entry->x = 0; } --- a/xen/include/asm-x86/hvm/vmx/vmcs.h +++ b/xen/include/asm-x86/hvm/vmx/vmcs.h @@ -63,6 +63,12 @@ struct vmx_domain { unsigned long apic_access_mfn; /* VMX_DOMAIN_* */ unsigned int status; + + /* + * Domain permitted to use Executable EPT Superpages? Cleared to work + * around CVE-2018-12207 as appropriate. + */ + bool exec_sp; }; /*
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
