From: "tip-bot2 for Hyunwook (Wooky) Baek" <tip-bot2@linutronix.de>
To: linux-tip-commits@vger.kernel.org
Cc: "Hyunwook (Wooky) Baek" <baekhw@google.com>,
Borislav Petkov <bp@suse.de>,
David Rientjes <rientjes@google.com>,
x86@kernel.org, linux-kernel@vger.kernel.org
Subject: [tip: x86/seves] x86/sev-es: Handle string port IO to kernel memory properly
Date: Mon, 11 Jan 2021 11:47:10 -0000 [thread overview]
Message-ID: <161036563003.414.6721977220175208221.tip-bot2@tip-bot2> (raw)
In-Reply-To: <20210110071102.2576186-1-baekhw@google.com>
The following commit has been merged into the x86/seves branch of tip:
Commit-ID: 36648d64ac3420b3cfa741b12b14633fad9651e4
Gitweb: https://git.kernel.org/tip/36648d64ac3420b3cfa741b12b14633fad9651e4
Author: Hyunwook (Wooky) Baek <baekhw@google.com>
AuthorDate: Sat, 09 Jan 2021 23:11:02 -08:00
Committer: Borislav Petkov <bp@suse.de>
CommitterDate: Mon, 11 Jan 2021 12:22:10 +01:00
x86/sev-es: Handle string port IO to kernel memory properly
Don't assume dest/source buffers are userspace addresses when manually
copying data for string I/O or MOVS MMIO, as {get,put}_user() will fail
if handed a kernel address and ultimately lead to a kernel panic.
When invoking INSB/OUTSB instructions in kernel space in a
SEV-ES-enabled VM, the kernel crashes with the following message:
"SEV-ES: Unsupported exception in #VC instruction emulation - can't continue"
Handle that case properly.
[ bp: Massage commit message. ]
Signed-off-by: Hyunwook (Wooky) Baek <baekhw@google.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: David Rientjes <rientjes@google.com>
Link: https://lkml.kernel.org/r/20210110071102.2576186-1-baekhw@google.com
---
arch/x86/kernel/sev-es.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/arch/x86/kernel/sev-es.c b/arch/x86/kernel/sev-es.c
index 0bd1a0f..ab31c34 100644
--- a/arch/x86/kernel/sev-es.c
+++ b/arch/x86/kernel/sev-es.c
@@ -286,6 +286,12 @@ static enum es_result vc_write_mem(struct es_em_ctxt *ctxt,
u16 d2;
u8 d1;
+ /* If instruction ran in kernel mode and the I/O buffer is in kernel space */
+ if (!user_mode(ctxt->regs) && !access_ok(target, size)) {
+ memcpy(dst, buf, size);
+ return ES_OK;
+ }
+
switch (size) {
case 1:
memcpy(&d1, buf, 1);
@@ -335,6 +341,12 @@ static enum es_result vc_read_mem(struct es_em_ctxt *ctxt,
u16 d2;
u8 d1;
+ /* If instruction ran in kernel mode and the I/O buffer is in kernel space */
+ if (!user_mode(ctxt->regs) && !access_ok(s, size)) {
+ memcpy(buf, src, size);
+ return ES_OK;
+ }
+
switch (size) {
case 1:
if (get_user(d1, s))
next prev parent reply other threads:[~2021-01-11 11:48 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-10 7:11 [PATCH V2] x86/sev-es: Fix SEV-ES #VC handler for string port IO Hyunwook (Wooky) Baek
2021-01-11 11:47 ` tip-bot2 for Hyunwook (Wooky) Baek [this message]
2021-01-11 18:29 ` Tom Lendacky
2021-01-11 18:55 ` David Rientjes
2021-01-11 18:59 ` Borislav Petkov
2021-01-11 19:14 ` [tip: x86/urgent] x86/sev-es: Handle string port IO to kernel memory properly tip-bot2 for Hyunwook (Wooky) Baek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=161036563003.414.6721977220175208221.tip-bot2@tip-bot2 \
--to=tip-bot2@linutronix.de \
--cc=baekhw@google.com \
--cc=bp@suse.de \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-tip-commits@vger.kernel.org \
--cc=rientjes@google.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.