76 lines
2.5 KiB
Diff
76 lines
2.5 KiB
Diff
From: Paolo Bonzini <pbonzini@redhat.com>
|
|
Date: Tue, 10 Nov 2015 09:14:39 +0100
|
|
Subject: KVM: svm: unconditionally intercept #DB
|
|
Origin: https://git.kernel.org/linus/cbdb967af3d54993f5814f1cee0ed311a055377d
|
|
|
|
This is needed to avoid the possibility that the guest triggers
|
|
an infinite stream of #DB exceptions (CVE-2015-8104).
|
|
|
|
VMX is not affected: because it does not save DR6 in the VMCS,
|
|
it already intercepts #DB unconditionally.
|
|
|
|
Reported-by: Jan Beulich <jbeulich@suse.com>
|
|
Cc: stable@vger.kernel.org
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
---
|
|
arch/x86/kvm/svm.c | 14 +++-----------
|
|
1 file changed, 3 insertions(+), 11 deletions(-)
|
|
|
|
--- a/arch/x86/kvm/svm.c
|
|
+++ b/arch/x86/kvm/svm.c
|
|
@@ -1107,6 +1107,7 @@ static void init_vmcb(struct vcpu_svm *s
|
|
set_exception_intercept(svm, UD_VECTOR);
|
|
set_exception_intercept(svm, MC_VECTOR);
|
|
set_exception_intercept(svm, AC_VECTOR);
|
|
+ set_exception_intercept(svm, DB_VECTOR);
|
|
|
|
set_intercept(svm, INTERCEPT_INTR);
|
|
set_intercept(svm, INTERCEPT_NMI);
|
|
@@ -1642,20 +1643,13 @@ static void svm_set_segment(struct kvm_v
|
|
mark_dirty(svm->vmcb, VMCB_SEG);
|
|
}
|
|
|
|
-static void update_db_bp_intercept(struct kvm_vcpu *vcpu)
|
|
+static void update_bp_intercept(struct kvm_vcpu *vcpu)
|
|
{
|
|
struct vcpu_svm *svm = to_svm(vcpu);
|
|
|
|
- clr_exception_intercept(svm, DB_VECTOR);
|
|
clr_exception_intercept(svm, BP_VECTOR);
|
|
|
|
- if (svm->nmi_singlestep)
|
|
- set_exception_intercept(svm, DB_VECTOR);
|
|
-
|
|
if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
|
|
- if (vcpu->guest_debug &
|
|
- (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
|
|
- set_exception_intercept(svm, DB_VECTOR);
|
|
if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
|
|
set_exception_intercept(svm, BP_VECTOR);
|
|
} else
|
|
@@ -1761,7 +1755,6 @@ static int db_interception(struct vcpu_s
|
|
if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP))
|
|
svm->vmcb->save.rflags &=
|
|
~(X86_EFLAGS_TF | X86_EFLAGS_RF);
|
|
- update_db_bp_intercept(&svm->vcpu);
|
|
}
|
|
|
|
if (svm->vcpu.guest_debug &
|
|
@@ -3760,7 +3753,6 @@ static void enable_nmi_window(struct kvm
|
|
*/
|
|
svm->nmi_singlestep = true;
|
|
svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF);
|
|
- update_db_bp_intercept(vcpu);
|
|
}
|
|
|
|
static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr)
|
|
@@ -4382,7 +4374,7 @@ static struct kvm_x86_ops svm_x86_ops =
|
|
.vcpu_load = svm_vcpu_load,
|
|
.vcpu_put = svm_vcpu_put,
|
|
|
|
- .update_db_bp_intercept = update_db_bp_intercept,
|
|
+ .update_db_bp_intercept = update_bp_intercept,
|
|
.get_msr = svm_get_msr,
|
|
.set_msr = svm_set_msr,
|
|
.get_segment_base = svm_get_segment_base,
|