Commit 899b9b99 authored by Sean Christopherson's avatar Sean Christopherson Committed by Wei Li
Browse files

x86/reboot: VMCLEAR active VMCSes before emergency reboot 

mainline inclusion
from mainline-v6.6-rc1
commit b23c83ad
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B2J
CVE: CVE-2023-52514

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=b23c83ad2c638420ec0608a9de354507c41bec29

--------------------------------

VMCLEAR active VMCSes before any emergency reboot, not just if the kernel
may kexec into a new kernel after a crash.  Per Intel's SDM, the VMX
architecture doesn't require the CPU to flush the VMCS cache on INIT.  If
an emergency reboot doesn't RESET CPUs, cached VMCSes could theoretically
be kept and only be written back to memory after the new kernel is booted,
i.e. could effectively corrupt memory after reboot.

Opportunistically remove the setting of the global pointer to NULL to make
checkpatch happy.

Cc: Andrew Cooper <Andrew.Cooper3@citrix.com>
Link: https://lore.kernel.org/r/20230721201859.2307736-2-seanjc@google.com


Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
Signed-off-by: default avatarWei Li <liwei391@huawei.com>
parent 70c98c7d

arch/x86/include/asm/kexec.h

+0 −2
Original line number Diff line number Diff line
@@ -209,8 +209,6 @@ extern void arch_kexec_pre_free_pages(void *vaddr, unsigned int pages); 


#endif



typedef void crash_vmclear_fn(void);

extern crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss;

extern void kdump_nmi_shootdown_cpus(void);



#ifdef CONFIG_KEXEC_CORE

arch/x86/include/asm/reboot.h

+2 −0
Original line number Diff line number Diff line
@@ -25,6 +25,8 @@ void __noreturn machine_real_restart(unsigned int type); 
#define MRR_BIOS	0

#define MRR_APM		1



typedef void crash_vmclear_fn(void);

extern crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss;

void cpu_emergency_disable_virtualization(void);



typedef void (*nmi_shootdown_cb)(int, struct pt_regs*);

arch/x86/kernel/crash.c

+0 −31
Original line number Diff line number Diff line
@@ -48,27 +48,6 @@ struct crash_memmap_data { 
	unsigned int type;

};



/*

 * This is used to VMCLEAR all VMCSs loaded on the

 * processor. And when loading kvm_intel module, the

 * callback function pointer will be assigned.

 *

 * protected by rcu.

 */

crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss = NULL;

EXPORT_SYMBOL_GPL(crash_vmclear_loaded_vmcss);



static inline void cpu_crash_vmclear_loaded_vmcss(void)

{

	crash_vmclear_fn *do_vmclear_operation = NULL;



	rcu_read_lock();

	do_vmclear_operation = rcu_dereference(crash_vmclear_loaded_vmcss);

	if (do_vmclear_operation)

		do_vmclear_operation();

	rcu_read_unlock();

}



/*

 * When the crashkernel option is specified, only use the low

 * 1M for the real mode trampoline.
@@ -88,11 +67,6 @@ static void kdump_nmi_callback(int cpu, struct pt_regs *regs) 
{

	crash_save_cpu(regs, cpu);



	/*

	 * VMCLEAR VMCSs loaded on all cpus if needed.

	 */

	cpu_crash_vmclear_loaded_vmcss();



	/*

	 * Disable Intel PT to stop its logging

	 */
@@ -146,11 +120,6 @@ void native_machine_crash_shutdown(struct pt_regs *regs) 


	crash_smp_send_stop();



	/*

	 * VMCLEAR VMCSs loaded on this cpu if needed.

	 */

	cpu_crash_vmclear_loaded_vmcss();



	cpu_emergency_disable_virtualization();



	/*

arch/x86/kernel/reboot.c

+22 −0
Original line number Diff line number Diff line
@@ -787,6 +787,26 @@ void machine_crash_shutdown(struct pt_regs *regs) 
}

#endif



/*

 * This is used to VMCLEAR all VMCSs loaded on the

 * processor. And when loading kvm_intel module, the

 * callback function pointer will be assigned.

 *

 * protected by rcu.

 */

crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss;

EXPORT_SYMBOL_GPL(crash_vmclear_loaded_vmcss);



static inline void cpu_crash_vmclear_loaded_vmcss(void)

{

	crash_vmclear_fn *do_vmclear_operation = NULL;



	rcu_read_lock();

	do_vmclear_operation = rcu_dereference(crash_vmclear_loaded_vmcss);

	if (do_vmclear_operation)

		do_vmclear_operation();

	rcu_read_unlock();

}



/* This is the CPU performing the emergency shutdown work. */

int crashing_cpu = -1;
@@ -798,6 +818,8 @@ int crashing_cpu = -1; 
 */

void cpu_emergency_disable_virtualization(void)

{

	cpu_crash_vmclear_loaded_vmcss();



	cpu_emergency_vmxoff();

	cpu_emergency_svm_disable();

}

arch/x86/kvm/vmx/vmx.c

+2 −7
Original line number Diff line number Diff line
@@ -40,7 +40,7 @@ 
#include <asm/idtentry.h>

#include <asm/io.h>

#include <asm/irq_remapping.h>

#include <asm/kexec.h>

#include <asm/reboot.h>

#include <asm/perf_event.h>

#include <asm/mce.h>

#include <asm/mmu_context.h>
@@ -780,7 +780,6 @@ static int vmx_set_guest_uret_msr(struct vcpu_vmx *vmx, 
	return ret;

}



#ifdef CONFIG_KEXEC_CORE

static void crash_vmclear_local_loaded_vmcss(void)

{

	int cpu = raw_smp_processor_id();
@@ -790,7 +789,6 @@ static void crash_vmclear_local_loaded_vmcss(void) 
			    loaded_vmcss_on_cpu_link)

		vmcs_clear(v->vmcs);

}

#endif /* CONFIG_KEXEC_CORE */



static void __loaded_vmcs_clear(void *arg)

{
@@ -8514,10 +8512,8 @@ static void vmx_cleanup_l1d_flush(void) 


static void vmx_exit(void)

{

#ifdef CONFIG_KEXEC_CORE

	RCU_INIT_POINTER(crash_vmclear_loaded_vmcss, NULL);

	synchronize_rcu();

#endif



	kvm_exit();
@@ -8612,10 +8608,9 @@ static int __init vmx_init(void) 
		pi_init_cpu(cpu);

	}



#ifdef CONFIG_KEXEC_CORE

	rcu_assign_pointer(crash_vmclear_loaded_vmcss,

			   crash_vmclear_local_loaded_vmcss);

#endif



	vmx_check_vmcs12_offsets();



	/*