From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AIpwx4/k7u+CSUFbVwQq8DNa1CAZUzcaDWjVLlPziqJmGnjH6F1CPLMxGxi/v4Is608yC9GUmaW8 ARC-Seal: i=1; a=rsa-sha256; t=1522168238; cv=none; d=google.com; s=arc-20160816; b=0kYx3D9iy6w816oimvLI64T9dv8ClOL8F69LbPhvCEV/MU7PH2hjwZMgNlVdIBisdV 4iai+66TrIFl5iPneZ3680Txfj7N3z/6hnDufDXrZD4QNiLcgMGrHlZZY8dqS5Pfx0X2 zn2s8MoFyVFHGV0JwvCADfJvvrjOcfhC8EfCCByi1aQ23E6V68+OI4RJ8JBUV21CVQsL vM+PqJDazSeYr7tNWYj4Q6391Q2kIMrMmB3RnUoQbBZMLZlAjV2zGJBg5llGB9uDSfam rzm6CPpGhoMTrDJoNHcXJTManIfWqzGbFPnzgwMu7HmujLT2xQxPnOHghZEAEJCr5sA/ ysGQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=J0RvS+0FGyXzWB3Wyv032ZQMjZt1shmwY9GmKxNcHls=; b=mJPDNZx2WCQSPs+nXRyLFOPr+acxpy44bFME9Qwd8W5Va2WztN3XLFxvvVR1W8/eKq LVeDWy8/AeQHzXihISCH6kVeoZZ5Pa0eFGW7uUi4OCX+DQC8zXL13D6bTgPkGQ4jUIST xjNVMS4VNSvW8p+hji76K4N//cnGx63j7m+uBsI1JeC65hEn4hqxF8XRp9k2JG6eN4eg t5lotPBy4o3Lt/TMV+FsY1bYuDhVb03SnlAhPPCJ2lFl0CH9vPc6FL4gSeu3eiwzTZDJ 1yaXyp+C3dTiGHMnDG9M+zl1kXyxeMs32JIDNpG3Y0Z80Tqkry1qs97KHuHUzMeXbxjP J9zw== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.61.202 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.61.202 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andy Lutomirski , Paolo Bonzini , Linus Torvalds Subject: [PATCH 4.4 35/43] kvm/x86: fix icebp instruction handling Date: Tue, 27 Mar 2018 18:27:39 +0200 Message-Id: <20180327162718.377784713@linuxfoundation.org> X-Mailer: git-send-email 2.16.3 In-Reply-To: <20180327162716.407986916@linuxfoundation.org> References: <20180327162716.407986916@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1596109082772350684?= X-GMAIL-MSGID: =?utf-8?q?1596109082772350684?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Linus Torvalds commit 32d43cd391bacb5f0814c2624399a5dad3501d09 upstream. The undocumented 'icebp' instruction (aka 'int1') works pretty much like 'int3' in the absense of in-circuit probing equipment (except, obviously, that it raises #DB instead of raising #BP), and is used by some validation test-suites as such. But Andy Lutomirski noticed that his test suite acted differently in kvm than on bare hardware. The reason is that kvm used an inexact test for the icebp instruction: it just assumed that an all-zero VM exit qualification value meant that the VM exit was due to icebp. That is not unlike the guess that do_debug() does for the actual exception handling case, but it's purely a heuristic, not an absolute rule. do_debug() does it because it wants to ascribe _some_ reasons to the #DB that happened, and an empty %dr6 value means that 'icebp' is the most likely casue and we have no better information. But kvm can just do it right, because unlike the do_debug() case, kvm actually sees the real reason for the #DB in the VM-exit interruption information field. So instead of relying on an inexact heuristic, just use the actual VM exit information that says "it was 'icebp'". Right now the 'icebp' instruction isn't technically documented by Intel, but that will hopefully change. The special "privileged software exception" information _is_ actually mentioned in the Intel SDM, even though the cause of it isn't enumerated. Reported-by: Andy Lutomirski Tested-by: Paolo Bonzini Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- arch/x86/include/asm/vmx.h | 1 + arch/x86/kvm/vmx.c | 9 ++++++++- 2 files changed, 9 insertions(+), 1 deletion(-) --- a/arch/x86/include/asm/vmx.h +++ b/arch/x86/include/asm/vmx.h @@ -310,6 +310,7 @@ enum vmcs_field { #define INTR_TYPE_NMI_INTR (2 << 8) /* NMI */ #define INTR_TYPE_HARD_EXCEPTION (3 << 8) /* processor exception */ #define INTR_TYPE_SOFT_INTR (4 << 8) /* software interrupt */ +#define INTR_TYPE_PRIV_SW_EXCEPTION (5 << 8) /* ICE breakpoint - undocumented */ #define INTR_TYPE_SOFT_EXCEPTION (6 << 8) /* software exception */ /* GUEST_INTERRUPTIBILITY_INFO flags. */ --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -1011,6 +1011,13 @@ static inline bool is_machine_check(u32 (INTR_TYPE_HARD_EXCEPTION | MC_VECTOR | INTR_INFO_VALID_MASK); } +/* Undocumented: icebp/int1 */ +static inline bool is_icebp(u32 intr_info) +{ + return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK)) + == (INTR_TYPE_PRIV_SW_EXCEPTION | INTR_INFO_VALID_MASK); +} + static inline bool cpu_has_vmx_msr_bitmap(void) { return vmcs_config.cpu_based_exec_ctrl & CPU_BASED_USE_MSR_BITMAPS; @@ -5333,7 +5340,7 @@ static int handle_exception(struct kvm_v (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))) { vcpu->arch.dr6 &= ~15; vcpu->arch.dr6 |= dr6 | DR6_RTM; - if (!(dr6 & ~DR6_RESERVED)) /* icebp */ + if (is_icebp(intr_info)) skip_emulated_instruction(vcpu); kvm_queue_exception(vcpu, DB_VECTOR);