From: Oliver Upton <oupton@google.com>

Date: Tue, 4 Feb 2020 15:26:31 -0800

Subject: KVM: nVMX: Check IO instruction VM-exit conditions

Git-commit: 35a571346a94fb93b5b3b6a599675ef3384bc75c

References: CVE-2020-2732 bsc#1163971

Patch-mainline: v5.6-rc4

Consult the 'unconditional IO exiting' and 'use IO bitmaps' VM-execution

controls when checking instruction interception. If the 'use IO bitmaps'

VM-execution control is 1, check the instruction access against the IO

bitmaps to determine if the instruction causes a VM-exit.

Signed-off-by: Oliver Upton <oupton@google.com>

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Acked-by: Joerg Roedel <jroedel@suse.de>

---

 arch/x86/kvm/vmx/nested.c |  2 +-

 arch/x86/kvm/vmx/vmx.c    | 57 ++++++++++++++++++++++++++++++++++++++++++-----

 2 files changed, 52 insertions(+), 7 deletions(-)

--- a/arch/x86/kvm/vmx.c

+++ b/arch/x86/kvm/vmx.c

@@ -8570,7 +8570,7 @@ static bool nested_vmx_exit_handled_io(s

 				       struct vmcs12 *vmcs12)

 {

 	unsigned long exit_qualification;

-	unsigned int port;

+	unsigned short port;

 	int size;

 	if (!nested_cpu_has(vmcs12, CPU_BASED_USE_IO_BITMAPS))

@@ -12386,10 +12386,55 @@ static void nested_vmx_entry_failure(str

 		to_vmx(vcpu)->nested.sync_shadow_vmcs = true;

 }

+static int vmx_check_intercept_io(struct kvm_vcpu *vcpu,

+				  struct x86_instruction_info *info)

+{

+	struct vmcs12 *vmcs12 = get_vmcs12(vcpu);

+	unsigned short port;

+	bool intercept;

+	int size;

+

+	if (info->intercept == x86_intercept_in ||

+	    info->intercept == x86_intercept_ins) {

+		port = info->src_val;

+		size = info->dst_bytes;

+	} else {

+		port = info->dst_val;

+		size = info->src_bytes;

+	}

+

+	/*

+	 * If the 'use IO bitmaps' VM-execution control is 0, IO instruction

+	 * VM-exits depend on the 'unconditional IO exiting' VM-execution

+	 * control.

+	 *

+	 * Otherwise, IO instruction VM-exits are controlled by the IO bitmaps.

+	 */

+	if (!nested_cpu_has(vmcs12, CPU_BASED_USE_IO_BITMAPS))

+		intercept = nested_cpu_has(vmcs12,

+					   CPU_BASED_UNCOND_IO_EXITING);

+	else

+		intercept = nested_vmx_check_io_bitmaps(vcpu, port, size);

+

+	return intercept ? X86EMUL_UNHANDLEABLE : X86EMUL_CONTINUE;

+}

+

 static int vmx_check_intercept(struct kvm_vcpu *vcpu,

 			       struct x86_instruction_info *info,

 			       enum x86_intercept_stage stage)

 {

+	switch (info->intercept) {

+	case x86_intercept_in:

+	case x86_intercept_ins:

+	case x86_intercept_out:

+	case x86_intercept_outs:

+		return vmx_check_intercept_io(vcpu, info);

+

+	/* TODO: check more intercepts... */

+	default:

+		break;

+	}

+

 	return X86EMUL_UNHANDLEABLE;

 }