# Commit 183f354e1430087879de071f0c7122e42703916e
# Date 2019-11-23 14:06:24 +0000
# Author Andrew Cooper <andrew.cooper3@citrix.com>
# Committer Andrew Cooper <andrew.cooper3@citrix.com>
x86/vvmx: Fix livelock with XSA-304 fix

It turns out that the XSA-304 / CVE-2018-12207 fix of disabling executable
superpages doesn't work well with the nested p2m code.

Nested virt is experimental and not security supported, but is useful for
development purposes.  In order to not regress the status quo, disable the
XSA-304 workaround until the nested p2m code can be improved.

Introduce a per-domain exec_sp control and set it based on the current
opt_ept_exec_sp setting.  Take the oppotunity to omit a PVH hardware domain
from the performance hit, because it is already permitted to DoS the system in
such ways as issuing a reboot.

When nested virt is enabled on a domain, force it to using executable
superpages and rebuild the p2m.

Having the setting per-domain involves rearranging the internals of
parse_ept_param_runtime() but it still retains the same overall semantics -
for each applicable domain whose setting needs to change, rebuild the p2m.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: George Dunlap <george.dunlap@citrix.com>

--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -83,6 +83,12 @@ static int vmx_domain_initialise(struct
 {
     int rc;
 
+    /*
+     * Work around CVE-2018-12207?  The hardware domain is already permitted
+     * to reboot the system, so doesn't need mitigating against DoS's.
+     */
+    d->arch.hvm_domain.vmx.exec_sp = is_hardware_domain(d) || opt_ept_exec_sp;
+
     if ( (rc = vmx_alloc_vlapic_mapping(d)) != 0 )
         return rc;
 
--- a/xen/arch/x86/hvm/vmx/vvmx.c
+++ b/xen/arch/x86/hvm/vmx/vvmx.c
@@ -55,9 +55,22 @@ void nvmx_cpu_dead(unsigned int cpu)
 
 int nvmx_vcpu_initialise(struct vcpu *v)
 {
+    struct domain *d = v->domain;
     struct nestedvmx *nvmx = &vcpu_2_nvmx(v);
     struct nestedvcpu *nvcpu = &vcpu_nestedhvm(v);
 
+    /*
+     * Gross bodge.  The nested p2m logic can't cope with the CVE-2018-12207
+     * workaround of using NX EPT superpages, and livelocks.  Nested HVM isn't
+     * security supported, so disable the workaround until the nested p2m
+     * logic can be improved.
+     */
+    if ( !d->arch.hvm_domain.vmx.exec_sp )
+    {
+        d->arch.hvm_domain.vmx.exec_sp = 1;
+        p2m_change_entry_type_global(d, p2m_ram_rw, p2m_ram_rw);
+    }
+
     nvcpu->nv_n2vmcx = alloc_xenheap_page();
     if ( !nvcpu->nv_n2vmcx )
     {
--- a/xen/arch/x86/mm/p2m.c
+++ b/xen/arch/x86/mm/p2m.c
@@ -196,6 +196,10 @@ int p2m_init(struct domain *d)
     return rc;
 }
 
+/*
+ * May be called with ot = nt = p2m_ram_rw for its side effect of
+ * recalculating all PTEs in the p2m.
+ */
 void p2m_change_entry_type_global(struct domain *d,
                                   p2m_type_t ot, p2m_type_t nt)
 {
--- a/xen/arch/x86/mm/p2m-ept.c
+++ b/xen/arch/x86/mm/p2m-ept.c
@@ -47,7 +47,8 @@ static inline bool_t is_epte_valid(ept_e
     return (e->epte != 0 && e->sa_p2mt != p2m_invalid);
 }
 
-static void ept_p2m_type_to_flags(ept_entry_t *entry, p2m_type_t type, p2m_access_t access)
+static void ept_p2m_type_to_flags(struct p2m_domain *p2m, ept_entry_t *entry,
+                                  p2m_type_t type, p2m_access_t access)
 {
     /* First apply type permissions */
     switch(type)
@@ -120,7 +121,7 @@ static void ept_p2m_type_to_flags(ept_en
      * Don't create executable superpages if we need to shatter them to
      * protect against CVE-2018-12207.
      */
-    if ( !opt_ept_exec_sp && is_epte_superpage(entry) )
+    if ( !p2m->domain->arch.hvm_domain.vmx.exec_sp && is_epte_superpage(entry) )
         entry->x = 0;
 }
 
@@ -198,7 +199,7 @@ static int ept_split_super_page(struct p
         epte->mfn = ept_entry->mfn + i * trunk;
         epte->rsvd2_snp = ( iommu_enabled && iommu_snoop ) ? 1 : 0;
 
-        ept_p2m_type_to_flags(epte, epte->sa_p2mt, epte->access);
+        ept_p2m_type_to_flags(p2m, epte, epte->sa_p2mt, epte->access);
 
         if ( (level - 1) == target )
             continue;
@@ -380,7 +381,7 @@ ept_set_entry(struct p2m_domain *p2m, un
             if ( old_entry.mfn == new_entry.mfn )
                 need_modify_vtd_table = 0;
 
-            ept_p2m_type_to_flags(&new_entry, p2mt, p2ma);
+            ept_p2m_type_to_flags(p2m, &new_entry, p2mt, p2ma);
         }
 
         atomic_write_ept_entry(ept_entry, new_entry);
@@ -431,7 +432,7 @@ ept_set_entry(struct p2m_domain *p2m, un
         if ( ept_entry->mfn == new_entry.mfn )
              need_modify_vtd_table = 0;
 
-        ept_p2m_type_to_flags(&new_entry, p2mt, p2ma);
+        ept_p2m_type_to_flags(p2m, &new_entry, p2mt, p2ma);
 
         atomic_write_ept_entry(ept_entry, new_entry);
     }
@@ -649,7 +650,8 @@ out:
  * to the new type.  This is used in hardware-assisted paging to
  * quickly enable or diable log-dirty tracking
  */
-static void ept_change_entry_type_page(mfn_t ept_page_mfn, int ept_page_level,
+static void ept_change_entry_type_page(struct p2m_domain *p2m,
+                                       mfn_t ept_page_mfn, int ept_page_level,
                                        p2m_type_t ot, p2m_type_t nt)
 {
     ept_entry_t e, *epte = map_domain_page(mfn_x(ept_page_mfn));
@@ -660,7 +662,7 @@ static void ept_change_entry_type_page(m
             continue;
 
         if ( (ept_page_level > 0) && !is_epte_superpage(epte + i) )
-            ept_change_entry_type_page(_mfn(epte[i].mfn),
+            ept_change_entry_type_page(p2m, _mfn(epte[i].mfn),
                                        ept_page_level - 1, ot, nt);
         else
         {
@@ -669,7 +671,7 @@ static void ept_change_entry_type_page(m
                 continue;
 
             e.sa_p2mt = nt;
-            ept_p2m_type_to_flags(&e, nt, e.access);
+            ept_p2m_type_to_flags(p2m, &e, nt, e.access);
             atomic_write_ept_entry(&epte[i], e);
         }
     }
@@ -687,7 +689,7 @@ static void ept_change_entry_type_global
     BUG_ON(p2m_is_grant(ot) || p2m_is_grant(nt));
     BUG_ON(p2m_is_mmio(ot) || p2m_is_mmio(nt));
 
-    ept_change_entry_type_page(_mfn(ept_get_asr(ept)),
+    ept_change_entry_type_page(p2m, _mfn(ept_get_asr(ept)),
                                ept_get_wl(ept), ot, nt);
 
     ept_sync_domain(p2m);
--- a/xen/include/asm-x86/hvm/vmx/vmcs.h
+++ b/xen/include/asm-x86/hvm/vmx/vmcs.h
@@ -72,6 +72,12 @@ struct ept_data {
 
 struct vmx_domain {
     unsigned long apic_access_mfn;
+
+    /*
+     * Domain permitted to use Executable EPT Superpages?  Cleared to work
+     * around CVE-2018-12207 as appropriate.
+     */
+    bool_t exec_sp;
 };
 
 struct pi_desc {
