[Xen-changelog] [xen stable-4.9] x86/vvmx: Fix livelock with XSA-304 fix

[patchbot@xxxxxxx]

commit 25f5530fc43b9c5d63f840be5d7be8ed4d1ed92e
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Thu Nov 28 15:37:17 2019 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Nov 28 15:37:17 2019 +0100

    x86/vvmx: Fix livelock with XSA-304 fix
    
    It turns out that the XSA-304 / CVE-2018-12207 fix of disabling executable
    superpages doesn't work well with the nested p2m code.
    
    Nested virt is experimental and not security supported, but is useful for
    development purposes.  In order to not regress the status quo, disable the
    XSA-304 workaround until the nested p2m code can be improved.
    
    Introduce a per-domain exec_sp control and set it based on the current
    opt_ept_exec_sp setting.  Take the oppotunity to omit a PVH hardware domain
    from the performance hit, because it is already permitted to DoS the system 
in
    such ways as issuing a reboot.
    
    When nested virt is enabled on a domain, force it to using executable
    superpages and rebuild the p2m.
    
    Having the setting per-domain involves rearranging the internals of
    parse_ept_param_runtime() but it still retains the same overall semantics -
    for each applicable domain whose setting needs to change, rebuild the p2m.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Acked-by: George Dunlap <george.dunlap@xxxxxxxxxx>
---
 xen/arch/x86/hvm/vmx/vmx.c         |  6 ++++++
 xen/arch/x86/hvm/vmx/vvmx.c        | 13 +++++++++++++
 xen/arch/x86/mm/p2m-ept.c          |  2 +-
 xen/include/asm-x86/hvm/vmx/vmcs.h |  6 ++++++
 4 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
index cb3be48283..a10037d681 100644
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -404,6 +404,12 @@ static int vmx_domain_initialise(struct domain *d)
 
     d->arch.ctxt_switch = &csw;
 
+    /*
+     * Work around CVE-2018-12207?  The hardware domain is already permitted
+     * to reboot the system, so doesn't need mitigating against DoS's.
+     */
+    d->arch.hvm_domain.vmx.exec_sp = is_hardware_domain(d) || opt_ept_exec_sp;
+
     if ( !has_vlapic(d) )
         return 0;
 
diff --git a/xen/arch/x86/hvm/vmx/vvmx.c b/xen/arch/x86/hvm/vmx/vvmx.c
index a3cce670d1..fc4f49f2ea 100644
--- a/xen/arch/x86/hvm/vmx/vvmx.c
+++ b/xen/arch/x86/hvm/vmx/vvmx.c
@@ -59,10 +59,23 @@ void nvmx_cpu_dead(unsigned int cpu)
 
 int nvmx_vcpu_initialise(struct vcpu *v)
 {
+    struct domain *d = v->domain;
     struct nestedvmx *nvmx = &vcpu_2_nvmx(v);
     struct nestedvcpu *nvcpu = &vcpu_nestedhvm(v);
     struct page_info *pg = alloc_domheap_page(NULL, 0);
 
+    /*
+     * Gross bodge.  The nested p2m logic can't cope with the CVE-2018-12207
+     * workaround of using NX EPT superpages, and livelocks.  Nested HVM isn't
+     * security supported, so disable the workaround until the nested p2m
+     * logic can be improved.
+     */
+    if ( !d->arch.hvm_domain.vmx.exec_sp )
+    {
+        d->arch.hvm_domain.vmx.exec_sp = true;
+        p2m_change_entry_type_global(d, p2m_ram_rw, p2m_ram_rw);
+    }
+
     if ( !pg )
     {
         gdprintk(XENLOG_ERR, "nest: allocation for shadow vmcs failed\n");
diff --git a/xen/arch/x86/mm/p2m-ept.c b/xen/arch/x86/mm/p2m-ept.c
index 3837062b2c..46f044b011 100644
--- a/xen/arch/x86/mm/p2m-ept.c
+++ b/xen/arch/x86/mm/p2m-ept.c
@@ -219,7 +219,7 @@ static void ept_p2m_type_to_flags(struct p2m_domain *p2m, 
ept_entry_t *entry,
      * Don't create executable superpages if we need to shatter them to
      * protect against CVE-2018-12207.
      */
-    if ( !opt_ept_exec_sp && is_epte_superpage(entry) )
+    if ( !p2m->domain->arch.hvm_domain.vmx.exec_sp && is_epte_superpage(entry) 
)
         entry->x = 0;
 }
 
diff --git a/xen/include/asm-x86/hvm/vmx/vmcs.h 
b/xen/include/asm-x86/hvm/vmx/vmcs.h
index 10862b5009..1cfb56bddd 100644
--- a/xen/include/asm-x86/hvm/vmx/vmcs.h
+++ b/xen/include/asm-x86/hvm/vmx/vmcs.h
@@ -62,6 +62,12 @@ struct vmx_domain {
     unsigned long apic_access_mfn;
     /* VMX_DOMAIN_* */
     unsigned int status;
+
+    /*
+     * Domain permitted to use Executable EPT Superpages?  Cleared to work
+     * around CVE-2018-12207 as appropriate.
+     */
+    bool exec_sp;
 };
 
 struct pi_desc {
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.9

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog