x86/vvmx: Fix livelock with XSA-304 fix

It turns out that the XSA-304 / CVE-2018-12207 fix of disabling executable
superpages doesn't work well with the nested p2m code.

Nested virt is experimental and not security supported, but is useful for
development purposes.  In order to not regress the status quo, disable the
XSA-304 workaround until the nested p2m code can be improved.

Introduce a per-domain exec_sp control and set it based on the current
opt_ept_exec_sp setting.  Take the oppotunity to omit a PVH hardware domain
from the performance hit, because it is already permitted to DoS the system in
such ways as issuing a reboot.

When nested virt is enabled on a domain, force it to using executable
superpages and rebuild the p2m.

Having the setting per-domain involves rearranging the internals of
parse_ept_param_runtime() but it still retains the same overall semantics -
for each applicable domain whose setting needs to change, rebuild the p2m.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: George Dunlap <george.dunlap@citrix.com>
master commit: 183f354e1430087879de071f0c7122e42703916e
master date: 2019-11-23 14:06:24 +0000

diff --git a/xen/arch/x86/hvm/vmx/vmcs.c b/xen/arch/x86/hvm/vmx/vmcs.c
index 15376e25ba5302296103984a9934f0aefcbd6b25..332f2d810d89ef7c98cc8d0f6b01b992c966c57e 100644 (file)
--- a/xen/arch/x86/hvm/vmx/vmcs.c
+++ b/xen/arch/x86/hvm/vmx/vmcs.c
@@ -31,6 +31,7 @@
 #include <asm/xstate.h>
 #include <asm/hvm/hvm.h>
 #include <asm/hvm/io.h>
+#include <asm/hvm/nestedhvm.h>
 #include <asm/hvm/support.h>
 #include <asm/hvm/vmx/vmx.h>
 #include <asm/hvm/vmx/vvmx.h>
@@ -109,6 +110,7 @@ custom_param("ept", parse_ept_param);
 
 static int parse_ept_param_runtime(const char *s)
 {
+    struct domain *d;
     int val;
 
     if ( !cpu_has_vmx_ept || !hvm_funcs.hap_supported ||
@@ -122,18 +124,31 @@ static int parse_ept_param_runtime(const char *s)
     if ( (val = parse_boolean("exec-sp", s, NULL)) < 0 )
         return -EINVAL;
 
-    if ( val != opt_ept_exec_sp )
+    opt_ept_exec_sp = val;
+
+    rcu_read_lock(&domlist_read_lock);
+    for_each_domain ( d )
     {
-        struct domain *d;
+        /* PV, or HVM Shadow domain?  Not applicable. */
+        if ( !paging_mode_hap(d) )
+            continue;
 
-        opt_ept_exec_sp = val;
+        /* Hardware domain? Not applicable. */
+        if ( is_hardware_domain(d) )
+            continue;
 
-        rcu_read_lock(&domlist_read_lock);
-        for_each_domain ( d )
-            if ( paging_mode_hap(d) )
-                p2m_change_entry_type_global(d, p2m_ram_rw, p2m_ram_rw);
-        rcu_read_unlock(&domlist_read_lock);
+        /* Nested Virt?  Broken and exec_sp forced on to avoid livelocks. */
+        if ( nestedhvm_enabled(d) )
+            continue;
+
+        /* Setting already matches?  No need to rebuild the p2m. */
+        if ( d->arch.hvm_domain.vmx.exec_sp == val )
+            continue;
+
+        d->arch.hvm_domain.vmx.exec_sp = val;
+        p2m_change_entry_type_global(d, p2m_ram_rw, p2m_ram_rw);
     }
+    rcu_read_unlock(&domlist_read_lock);
 
     printk("VMX: EPT executable superpages %sabled\n",
            val ? "en" : "dis");

diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
index 067dcf3ff577748239caf1921235702f162c9dd6..9d14c67059e15d5e1b7757daf582057629780fe9 100644 (file)
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -404,6 +404,12 @@ static int vmx_domain_initialise(struct domain *d)
 
     d->arch.ctxt_switch = &csw;
 
+    /*
+     * Work around CVE-2018-12207?  The hardware domain is already permitted
+     * to reboot the system, so doesn't need mitigating against DoS's.
+     */
+    d->arch.hvm_domain.vmx.exec_sp = is_hardware_domain(d) || opt_ept_exec_sp;
+
     if ( !has_vlapic(d) )
         return 0;
 

diff --git a/xen/arch/x86/hvm/vmx/vvmx.c b/xen/arch/x86/hvm/vmx/vvmx.c
index 1297dc20b8ef3b4ae5ba7d65da0ed1affeed5da1..6beceb08444678df8585c765e694385ea5759418 100644 (file)
--- a/xen/arch/x86/hvm/vmx/vvmx.c
+++ b/xen/arch/x86/hvm/vmx/vvmx.c
@@ -59,10 +59,23 @@ void nvmx_cpu_dead(unsigned int cpu)
 
 int nvmx_vcpu_initialise(struct vcpu *v)
 {
+    struct domain *d = v->domain;
     struct nestedvmx *nvmx = &vcpu_2_nvmx(v);
     struct nestedvcpu *nvcpu = &vcpu_nestedhvm(v);
     struct page_info *pg = alloc_domheap_page(NULL, 0);
 
+    /*
+     * Gross bodge.  The nested p2m logic can't cope with the CVE-2018-12207
+     * workaround of using NX EPT superpages, and livelocks.  Nested HVM isn't
+     * security supported, so disable the workaround until the nested p2m
+     * logic can be improved.
+     */
+    if ( !d->arch.hvm_domain.vmx.exec_sp )
+    {
+        d->arch.hvm_domain.vmx.exec_sp = true;
+        p2m_change_entry_type_global(d, p2m_ram_rw, p2m_ram_rw);
+    }
+
     if ( !pg )
     {
         gdprintk(XENLOG_ERR, "nest: allocation for shadow vmcs failed\n");

diff --git a/xen/arch/x86/mm/p2m-ept.c b/xen/arch/x86/mm/p2m-ept.c
index 93e08f89a2140c10f509540a5f1b92553ccd424f..ca18e4358065f18861323701e60a08e397e18dd5 100644 (file)
--- a/xen/arch/x86/mm/p2m-ept.c
+++ b/xen/arch/x86/mm/p2m-ept.c
@@ -219,7 +219,7 @@ static void ept_p2m_type_to_flags(struct p2m_domain *p2m, ept_entry_t *entry,
      * Don't create executable superpages if we need to shatter them to
      * protect against CVE-2018-12207.
      */
-    if ( !opt_ept_exec_sp && is_epte_superpage(entry) )
+    if ( !p2m->domain->arch.hvm_domain.vmx.exec_sp && is_epte_superpage(entry) )
         entry->x = 0;
 }
 

diff --git a/xen/include/asm-x86/hvm/vmx/vmcs.h b/xen/include/asm-x86/hvm/vmx/vmcs.h
index 57e5098b99fd8bc689082f8d8e49f18e6d4a3c71..0e42f960ec461b821998f5b81cfede97ca5ac200 100644 (file)
--- a/xen/include/asm-x86/hvm/vmx/vmcs.h
+++ b/xen/include/asm-x86/hvm/vmx/vmcs.h
@@ -63,6 +63,12 @@ struct vmx_domain {
     unsigned long apic_access_mfn;
     /* VMX_DOMAIN_* */
     unsigned int status;
+
+    /*
+     * Domain permitted to use Executable EPT Superpages?  Cleared to work
+     * around CVE-2018-12207 as appropriate.
+     */
+    bool exec_sp;
 };
 
 /*