lkml.org 
[lkml]   [2015]   [Nov]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH 3.2 41/52] KVM: svm: unconditionally intercept #DB
From
Date


On 24/11/2015 23:33, Ben Hutchings wrote:
> 3.2.74-rc1 review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Paolo Bonzini <pbonzini@redhat.com>
>
> commit cbdb967af3d54993f5814f1cee0ed311a055377d upstream.
>
> This is needed to avoid the possibility that the guest triggers
> an infinite stream of #DB exceptions (CVE-2015-8104).
>
> VMX is not affected: because it does not save DR6 in the VMCS,
> it already intercepts #DB unconditionally.
>
> Reported-by: Jan Beulich <jbeulich@suse.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> [bwh: Backported to 3.2: #DB and #BP did not share a function, and there is
> no operation pointer referring to it, so remove update_db_intercept()
> entirely]

This is wrong, you still need to check the BP intercept in the
(incorrectly named as of 3.2) update_db_intercept function.

Something like:

-static void update_db_intercept(struct kvm_vcpu *vcpu)
+static void update_bp_intercept(struct kvm_vcpu *vcpu)
{
struct vcpu_svm *svm = to_svm(vcpu);

- clr_exception_intercept(svm, DB_VECTOR);
clr_exception_intercept(svm, BP_VECTOR);
-
- if (svm->nmi_singlestep)
- set_exception_intercept(svm, DB_VECTOR);
-
if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
- if (vcpu->guest_debug &
- (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
- set_exception_intercept(svm, DB_VECTOR);
if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
set_exception_intercept(svm, BP_VECTOR);
} else
vcpu->guest_debug = 0;
}


Then the calls in db_interception and enable_nmi_window can be removed,
but the one in svm_guest_debug is important.

Paolo


\
 
 \ /
  Last update: 2015-11-25 12:41    [W:0.302 / U:0.064 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site