Drop pre-requisites and patches for CVE-2019-3016
This commit is contained in:
parent
f78b782f82
commit
576d33f2b5
|
@ -39,16 +39,6 @@ linux (4.19.119-1) UNRELEASED; urgency=medium
|
||||||
- scsi: smartpqi: fix call trace in device discovery
|
- scsi: smartpqi: fix call trace in device discovery
|
||||||
- PCI/ASPM: Allow re-enabling Clock PM
|
- PCI/ASPM: Allow re-enabling Clock PM
|
||||||
- KVM: VMX: Zero out *all* general purpose registers after VM-Exit
|
- KVM: VMX: Zero out *all* general purpose registers after VM-Exit
|
||||||
- KVM: nVMX: Always sync GUEST_BNDCFGS when it comes from vmcs01
|
|
||||||
- KVM: Introduce a new guest mapping API
|
|
||||||
- kvm: fix compilation on aarch64
|
|
||||||
- kvm: fix compilation on s390
|
|
||||||
- kvm: fix compile on s390 part 2
|
|
||||||
- KVM: Properly check if "page" is valid in kvm_vcpu_unmap
|
|
||||||
- x86/kvm: Introduce kvm_(un)map_gfn()
|
|
||||||
- x86/kvm: Cache gfn to pfn translation
|
|
||||||
- x86/KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed
|
|
||||||
- x86/KVM: Clean up host's steal time structure
|
|
||||||
- cxgb4: fix adapter crash due to wrong MC size
|
- cxgb4: fix adapter crash due to wrong MC size
|
||||||
- cxgb4: fix large delays in PTP synchronization
|
- cxgb4: fix large delays in PTP synchronization
|
||||||
- ipv6: fix restrict IPV6_ADDRFORM operation
|
- ipv6: fix restrict IPV6_ADDRFORM operation
|
||||||
|
|
|
@ -1,161 +0,0 @@
|
||||||
From: KarimAllah Ahmed <karahmed@amazon.de>
|
|
||||||
Date: Thu, 31 Jan 2019 21:24:34 +0100
|
|
||||||
Subject: [03/11] KVM: Introduce a new guest mapping API
|
|
||||||
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit?id=0125ed16a990014e27001f72fe75ad567da45f87
|
|
||||||
|
|
||||||
commit e45adf665a53df0db37f784ed87c6b57ddd81885 upstream.
|
|
||||||
|
|
||||||
In KVM, specially for nested guests, there is a dominant pattern of:
|
|
||||||
|
|
||||||
=> map guest memory -> do_something -> unmap guest memory
|
|
||||||
|
|
||||||
In addition to all this unnecessarily noise in the code due to boiler plate
|
|
||||||
code, most of the time the mapping function does not properly handle memory
|
|
||||||
that is not backed by "struct page". This new guest mapping API encapsulate
|
|
||||||
most of this boiler plate code and also handles guest memory that is not
|
|
||||||
backed by "struct page".
|
|
||||||
|
|
||||||
The current implementation of this API is using memremap for memory that is
|
|
||||||
not backed by a "struct page" which would lead to a huge slow-down if it
|
|
||||||
was used for high-frequency mapping operations. The API does not have any
|
|
||||||
effect on current setups where guest memory is backed by a "struct page".
|
|
||||||
Further patches are going to also introduce a pfn-cache which would
|
|
||||||
significantly improve the performance of the memremap case.
|
|
||||||
|
|
||||||
Signed-off-by: KarimAllah Ahmed <karahmed@amazon.de>
|
|
||||||
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
|
|
||||||
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
||||||
[bwh: Backported to 4.19 as dependency of commit 1eff70a9abd4
|
|
||||||
"x86/kvm: Introduce kvm_(un)map_gfn()"]
|
|
||||||
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
|
|
||||||
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
|
||||||
---
|
|
||||||
include/linux/kvm_host.h | 28 ++++++++++++++++++
|
|
||||||
virt/kvm/kvm_main.c | 64 ++++++++++++++++++++++++++++++++++++++++
|
|
||||||
2 files changed, 92 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
|
|
||||||
index 0f99ecc01bc7..bef95dba14e8 100644
|
|
||||||
--- a/include/linux/kvm_host.h
|
|
||||||
+++ b/include/linux/kvm_host.h
|
|
||||||
@@ -206,6 +206,32 @@ enum {
|
|
||||||
READING_SHADOW_PAGE_TABLES,
|
|
||||||
};
|
|
||||||
|
|
||||||
+#define KVM_UNMAPPED_PAGE ((void *) 0x500 + POISON_POINTER_DELTA)
|
|
||||||
+
|
|
||||||
+struct kvm_host_map {
|
|
||||||
+ /*
|
|
||||||
+ * Only valid if the 'pfn' is managed by the host kernel (i.e. There is
|
|
||||||
+ * a 'struct page' for it. When using mem= kernel parameter some memory
|
|
||||||
+ * can be used as guest memory but they are not managed by host
|
|
||||||
+ * kernel).
|
|
||||||
+ * If 'pfn' is not managed by the host kernel, this field is
|
|
||||||
+ * initialized to KVM_UNMAPPED_PAGE.
|
|
||||||
+ */
|
|
||||||
+ struct page *page;
|
|
||||||
+ void *hva;
|
|
||||||
+ kvm_pfn_t pfn;
|
|
||||||
+ kvm_pfn_t gfn;
|
|
||||||
+};
|
|
||||||
+
|
|
||||||
+/*
|
|
||||||
+ * Used to check if the mapping is valid or not. Never use 'kvm_host_map'
|
|
||||||
+ * directly to check for that.
|
|
||||||
+ */
|
|
||||||
+static inline bool kvm_vcpu_mapped(struct kvm_host_map *map)
|
|
||||||
+{
|
|
||||||
+ return !!map->hva;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
/*
|
|
||||||
* Sometimes a large or cross-page mmio needs to be broken up into separate
|
|
||||||
* exits for userspace servicing.
|
|
||||||
@@ -711,7 +737,9 @@ struct kvm_memslots *kvm_vcpu_memslots(struct kvm_vcpu *vcpu);
|
|
||||||
struct kvm_memory_slot *kvm_vcpu_gfn_to_memslot(struct kvm_vcpu *vcpu, gfn_t gfn);
|
|
||||||
kvm_pfn_t kvm_vcpu_gfn_to_pfn_atomic(struct kvm_vcpu *vcpu, gfn_t gfn);
|
|
||||||
kvm_pfn_t kvm_vcpu_gfn_to_pfn(struct kvm_vcpu *vcpu, gfn_t gfn);
|
|
||||||
+int kvm_vcpu_map(struct kvm_vcpu *vcpu, gpa_t gpa, struct kvm_host_map *map);
|
|
||||||
struct page *kvm_vcpu_gfn_to_page(struct kvm_vcpu *vcpu, gfn_t gfn);
|
|
||||||
+void kvm_vcpu_unmap(struct kvm_vcpu *vcpu, struct kvm_host_map *map, bool dirty);
|
|
||||||
unsigned long kvm_vcpu_gfn_to_hva(struct kvm_vcpu *vcpu, gfn_t gfn);
|
|
||||||
unsigned long kvm_vcpu_gfn_to_hva_prot(struct kvm_vcpu *vcpu, gfn_t gfn, bool *writable);
|
|
||||||
int kvm_vcpu_read_guest_page(struct kvm_vcpu *vcpu, gfn_t gfn, void *data, int offset,
|
|
||||||
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
|
|
||||||
index 4e499b78569b..ec1479abb29d 100644
|
|
||||||
--- a/virt/kvm/kvm_main.c
|
|
||||||
+++ b/virt/kvm/kvm_main.c
|
|
||||||
@@ -1705,6 +1705,70 @@ struct page *gfn_to_page(struct kvm *kvm, gfn_t gfn)
|
|
||||||
}
|
|
||||||
EXPORT_SYMBOL_GPL(gfn_to_page);
|
|
||||||
|
|
||||||
+static int __kvm_map_gfn(struct kvm_memory_slot *slot, gfn_t gfn,
|
|
||||||
+ struct kvm_host_map *map)
|
|
||||||
+{
|
|
||||||
+ kvm_pfn_t pfn;
|
|
||||||
+ void *hva = NULL;
|
|
||||||
+ struct page *page = KVM_UNMAPPED_PAGE;
|
|
||||||
+
|
|
||||||
+ if (!map)
|
|
||||||
+ return -EINVAL;
|
|
||||||
+
|
|
||||||
+ pfn = gfn_to_pfn_memslot(slot, gfn);
|
|
||||||
+ if (is_error_noslot_pfn(pfn))
|
|
||||||
+ return -EINVAL;
|
|
||||||
+
|
|
||||||
+ if (pfn_valid(pfn)) {
|
|
||||||
+ page = pfn_to_page(pfn);
|
|
||||||
+ hva = kmap(page);
|
|
||||||
+ } else {
|
|
||||||
+ hva = memremap(pfn_to_hpa(pfn), PAGE_SIZE, MEMREMAP_WB);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (!hva)
|
|
||||||
+ return -EFAULT;
|
|
||||||
+
|
|
||||||
+ map->page = page;
|
|
||||||
+ map->hva = hva;
|
|
||||||
+ map->pfn = pfn;
|
|
||||||
+ map->gfn = gfn;
|
|
||||||
+
|
|
||||||
+ return 0;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+int kvm_vcpu_map(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map)
|
|
||||||
+{
|
|
||||||
+ return __kvm_map_gfn(kvm_vcpu_gfn_to_memslot(vcpu, gfn), gfn, map);
|
|
||||||
+}
|
|
||||||
+EXPORT_SYMBOL_GPL(kvm_vcpu_map);
|
|
||||||
+
|
|
||||||
+void kvm_vcpu_unmap(struct kvm_vcpu *vcpu, struct kvm_host_map *map,
|
|
||||||
+ bool dirty)
|
|
||||||
+{
|
|
||||||
+ if (!map)
|
|
||||||
+ return;
|
|
||||||
+
|
|
||||||
+ if (!map->hva)
|
|
||||||
+ return;
|
|
||||||
+
|
|
||||||
+ if (map->page)
|
|
||||||
+ kunmap(map->page);
|
|
||||||
+ else
|
|
||||||
+ memunmap(map->hva);
|
|
||||||
+
|
|
||||||
+ if (dirty) {
|
|
||||||
+ kvm_vcpu_mark_page_dirty(vcpu, map->gfn);
|
|
||||||
+ kvm_release_pfn_dirty(map->pfn);
|
|
||||||
+ } else {
|
|
||||||
+ kvm_release_pfn_clean(map->pfn);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ map->hva = NULL;
|
|
||||||
+ map->page = NULL;
|
|
||||||
+}
|
|
||||||
+EXPORT_SYMBOL_GPL(kvm_vcpu_unmap);
|
|
||||||
+
|
|
||||||
struct page *kvm_vcpu_gfn_to_page(struct kvm_vcpu *vcpu, gfn_t gfn)
|
|
||||||
{
|
|
||||||
kvm_pfn_t pfn;
|
|
||||||
--
|
|
||||||
2.27.0.rc0
|
|
||||||
|
|
|
@ -1,36 +0,0 @@
|
||||||
From: KarimAllah Ahmed <karahmed@amazon.de>
|
|
||||||
Date: Wed, 10 Jul 2019 11:13:13 +0200
|
|
||||||
Subject: [07/11] KVM: Properly check if "page" is valid in kvm_vcpu_unmap
|
|
||||||
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit?id=ec81ed2fba221b8bb92b8010e82d92e1de3b39fa
|
|
||||||
|
|
||||||
commit b614c6027896ff9ad6757122e84760d938cab15e upstream.
|
|
||||||
|
|
||||||
The field "page" is initialized to KVM_UNMAPPED_PAGE when it is not used
|
|
||||||
(i.e. when the memory lives outside kernel control). So this check will
|
|
||||||
always end up using kunmap even for memremap regions.
|
|
||||||
|
|
||||||
Fixes: e45adf665a53 ("KVM: Introduce a new guest mapping API")
|
|
||||||
Signed-off-by: KarimAllah Ahmed <karahmed@amazon.de>
|
|
||||||
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
||||||
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
|
|
||||||
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
|
||||||
---
|
|
||||||
virt/kvm/kvm_main.c | 2 +-
|
|
||||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
|
|
||||||
index 5b949aa273de..33b288469c70 100644
|
|
||||||
--- a/virt/kvm/kvm_main.c
|
|
||||||
+++ b/virt/kvm/kvm_main.c
|
|
||||||
@@ -1754,7 +1754,7 @@ void kvm_vcpu_unmap(struct kvm_vcpu *vcpu, struct kvm_host_map *map,
|
|
||||||
if (!map->hva)
|
|
||||||
return;
|
|
||||||
|
|
||||||
- if (map->page)
|
|
||||||
+ if (map->page != KVM_UNMAPPED_PAGE)
|
|
||||||
kunmap(map->page);
|
|
||||||
#ifdef CONFIG_HAS_IOMEM
|
|
||||||
else
|
|
||||||
--
|
|
||||||
2.27.0.rc0
|
|
||||||
|
|
|
@ -1,54 +0,0 @@
|
||||||
From: Paolo Bonzini <pbonzini@redhat.com>
|
|
||||||
Date: Fri, 17 May 2019 14:08:53 +0200
|
|
||||||
Subject: [04/11] kvm: fix compilation on aarch64
|
|
||||||
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit?id=94659e93c93c23dfaada78aaad45183867698f74
|
|
||||||
|
|
||||||
commit c011d23ba046826ccf8c4a4a6c1d01c9ccaa1403 upstream.
|
|
||||||
|
|
||||||
Commit e45adf665a53 ("KVM: Introduce a new guest mapping API", 2019-01-31)
|
|
||||||
introduced a build failure on aarch64 defconfig:
|
|
||||||
|
|
||||||
$ make -j$(nproc) ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- O=out defconfig \
|
|
||||||
Image.gz
|
|
||||||
...
|
|
||||||
../arch/arm64/kvm/../../../virt/kvm/kvm_main.c:
|
|
||||||
In function '__kvm_map_gfn':
|
|
||||||
../arch/arm64/kvm/../../../virt/kvm/kvm_main.c:1763:9: error:
|
|
||||||
implicit declaration of function 'memremap'; did you mean 'memset_p'?
|
|
||||||
../arch/arm64/kvm/../../../virt/kvm/kvm_main.c:1763:46: error:
|
|
||||||
'MEMREMAP_WB' undeclared (first use in this function)
|
|
||||||
../arch/arm64/kvm/../../../virt/kvm/kvm_main.c:
|
|
||||||
In function 'kvm_vcpu_unmap':
|
|
||||||
../arch/arm64/kvm/../../../virt/kvm/kvm_main.c:1795:3: error:
|
|
||||||
implicit declaration of function 'memunmap'; did you mean 'vm_munmap'?
|
|
||||||
|
|
||||||
because these functions are declared in <linux/io.h> rather than <asm/io.h>,
|
|
||||||
and the former was being pulled in already on x86 but not on aarch64.
|
|
||||||
|
|
||||||
Reported-by: Nathan Chancellor <natechancellor@gmail.com>
|
|
||||||
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
||||||
[bwh: Backported to 4.19: adjust context]
|
|
||||||
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
|
|
||||||
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
|
||||||
---
|
|
||||||
virt/kvm/kvm_main.c | 2 +-
|
|
||||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
|
|
||||||
index ec1479abb29d..4a5ea263edf6 100644
|
|
||||||
--- a/virt/kvm/kvm_main.c
|
|
||||||
+++ b/virt/kvm/kvm_main.c
|
|
||||||
@@ -52,9 +52,9 @@
|
|
||||||
#include <linux/sort.h>
|
|
||||||
#include <linux/bsearch.h>
|
|
||||||
#include <linux/kthread.h>
|
|
||||||
+#include <linux/io.h>
|
|
||||||
|
|
||||||
#include <asm/processor.h>
|
|
||||||
-#include <asm/io.h>
|
|
||||||
#include <asm/ioctl.h>
|
|
||||||
#include <linux/uaccess.h>
|
|
||||||
#include <asm/pgtable.h>
|
|
||||||
--
|
|
||||||
2.27.0.rc0
|
|
||||||
|
|
|
@ -1,35 +0,0 @@
|
||||||
From: Paolo Bonzini <pbonzini@redhat.com>
|
|
||||||
Date: Mon, 20 May 2019 12:06:36 +0200
|
|
||||||
Subject: [05/11] kvm: fix compilation on s390
|
|
||||||
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit?id=bef6507903d91be2d1a06c11d980a722b176bc09
|
|
||||||
|
|
||||||
commit d30b214d1d0addb7b2c9c78178d1501cd39a01fb upstream.
|
|
||||||
|
|
||||||
s390 does not have memremap, even though in this particular case it
|
|
||||||
would be useful.
|
|
||||||
|
|
||||||
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
||||||
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
|
|
||||||
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
|
||||||
---
|
|
||||||
virt/kvm/kvm_main.c | 2 ++
|
|
||||||
1 file changed, 2 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
|
|
||||||
index 4a5ea263edf6..f99b99b77a48 100644
|
|
||||||
--- a/virt/kvm/kvm_main.c
|
|
||||||
+++ b/virt/kvm/kvm_main.c
|
|
||||||
@@ -1722,8 +1722,10 @@ static int __kvm_map_gfn(struct kvm_memory_slot *slot, gfn_t gfn,
|
|
||||||
if (pfn_valid(pfn)) {
|
|
||||||
page = pfn_to_page(pfn);
|
|
||||||
hva = kmap(page);
|
|
||||||
+#ifdef CONFIG_HAS_IOMEM
|
|
||||||
} else {
|
|
||||||
hva = memremap(pfn_to_hpa(pfn), PAGE_SIZE, MEMREMAP_WB);
|
|
||||||
+#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!hva)
|
|
||||||
--
|
|
||||||
2.27.0.rc0
|
|
||||||
|
|
|
@ -1,38 +0,0 @@
|
||||||
From: Christian Borntraeger <borntraeger@de.ibm.com>
|
|
||||||
Date: Mon, 27 May 2019 10:28:25 +0200
|
|
||||||
Subject: [06/11] kvm: fix compile on s390 part 2
|
|
||||||
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit?id=e25441275142a0d57a51025213c4b6ef17b193e6
|
|
||||||
|
|
||||||
commit eb1f2f387db8c0d084581fb26e7faffde700bc8e upstream.
|
|
||||||
|
|
||||||
We also need to fence the memunmap part.
|
|
||||||
|
|
||||||
Fixes: e45adf665a53 ("KVM: Introduce a new guest mapping API")
|
|
||||||
Fixes: d30b214d1d0a (kvm: fix compilation on s390)
|
|
||||||
Cc: Michal Kubecek <mkubecek@suse.cz>
|
|
||||||
Cc: KarimAllah Ahmed <karahmed@amazon.de>
|
|
||||||
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
|
|
||||||
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
|
|
||||||
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
|
||||||
---
|
|
||||||
virt/kvm/kvm_main.c | 2 ++
|
|
||||||
1 file changed, 2 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
|
|
||||||
index f99b99b77a48..5b949aa273de 100644
|
|
||||||
--- a/virt/kvm/kvm_main.c
|
|
||||||
+++ b/virt/kvm/kvm_main.c
|
|
||||||
@@ -1756,8 +1756,10 @@ void kvm_vcpu_unmap(struct kvm_vcpu *vcpu, struct kvm_host_map *map,
|
|
||||||
|
|
||||||
if (map->page)
|
|
||||||
kunmap(map->page);
|
|
||||||
+#ifdef CONFIG_HAS_IOMEM
|
|
||||||
else
|
|
||||||
memunmap(map->hva);
|
|
||||||
+#endif
|
|
||||||
|
|
||||||
if (dirty) {
|
|
||||||
kvm_vcpu_mark_page_dirty(vcpu, map->gfn);
|
|
||||||
--
|
|
||||||
2.27.0.rc0
|
|
||||||
|
|
|
@ -1,58 +0,0 @@
|
||||||
From: Sean Christopherson <sean.j.christopherson@intel.com>
|
|
||||||
Date: Tue, 7 May 2019 09:06:28 -0700
|
|
||||||
Subject: [02/11] KVM: nVMX: Always sync GUEST_BNDCFGS when it comes from
|
|
||||||
vmcs01
|
|
||||||
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit?id=7570af489e73c55690d3666c360d0a6d56acdc12
|
|
||||||
|
|
||||||
commit 3b013a2972d5bc344d6eaa8f24fdfe268211e45f upstream.
|
|
||||||
|
|
||||||
If L1 does not set VM_ENTRY_LOAD_BNDCFGS, then L1's BNDCFGS value must
|
|
||||||
be propagated to vmcs02 since KVM always runs with VM_ENTRY_LOAD_BNDCFGS
|
|
||||||
when MPX is supported. Because the value effectively comes from vmcs01,
|
|
||||||
vmcs02 must be updated even if vmcs12 is clean.
|
|
||||||
|
|
||||||
Fixes: 62cf9bd8118c4 ("KVM: nVMX: Fix emulation of VM_ENTRY_LOAD_BNDCFGS")
|
|
||||||
Cc: Liran Alon <liran.alon@oracle.com>
|
|
||||||
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
|
|
||||||
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
||||||
[bwh: Backported to 4.19: adjust filename, context]
|
|
||||||
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
|
|
||||||
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
|
||||||
---
|
|
||||||
arch/x86/kvm/vmx.c | 13 ++++++-------
|
|
||||||
1 file changed, 6 insertions(+), 7 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
|
|
||||||
index e4d0ad06790e..ccbddc80ad55 100644
|
|
||||||
--- a/arch/x86/kvm/vmx.c
|
|
||||||
+++ b/arch/x86/kvm/vmx.c
|
|
||||||
@@ -12137,13 +12137,9 @@ static void prepare_vmcs02_full(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
|
|
||||||
|
|
||||||
set_cr4_guest_host_mask(vmx);
|
|
||||||
|
|
||||||
- if (kvm_mpx_supported()) {
|
|
||||||
- if (vmx->nested.nested_run_pending &&
|
|
||||||
- (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS))
|
|
||||||
- vmcs_write64(GUEST_BNDCFGS, vmcs12->guest_bndcfgs);
|
|
||||||
- else
|
|
||||||
- vmcs_write64(GUEST_BNDCFGS, vmx->nested.vmcs01_guest_bndcfgs);
|
|
||||||
- }
|
|
||||||
+ if (kvm_mpx_supported() && vmx->nested.nested_run_pending &&
|
|
||||||
+ (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS))
|
|
||||||
+ vmcs_write64(GUEST_BNDCFGS, vmcs12->guest_bndcfgs);
|
|
||||||
|
|
||||||
if (enable_vpid) {
|
|
||||||
if (nested_cpu_has_vpid(vmcs12) && vmx->nested.vpid02)
|
|
||||||
@@ -12207,6 +12203,9 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
|
|
||||||
kvm_set_dr(vcpu, 7, vcpu->arch.dr7);
|
|
||||||
vmcs_write64(GUEST_IA32_DEBUGCTL, vmx->nested.vmcs01_debugctl);
|
|
||||||
}
|
|
||||||
+ if (kvm_mpx_supported() && (!vmx->nested.nested_run_pending ||
|
|
||||||
+ !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS)))
|
|
||||||
+ vmcs_write64(GUEST_BNDCFGS, vmx->nested.vmcs01_guest_bndcfgs);
|
|
||||||
if (vmx->nested.nested_run_pending) {
|
|
||||||
vmcs_write32(VM_ENTRY_INTR_INFO_FIELD,
|
|
||||||
vmcs12->vm_entry_intr_info_field);
|
|
||||||
--
|
|
||||||
2.27.0.rc0
|
|
||||||
|
|
|
@ -1,86 +0,0 @@
|
||||||
From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
|
|
||||||
Date: Fri, 6 Dec 2019 15:36:12 +0000
|
|
||||||
Subject: [11/11] x86/KVM: Clean up host's steal time structure
|
|
||||||
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit?id=c434092ef8172ed027f2bd9afcd42c0ee5002b85
|
|
||||||
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-3016
|
|
||||||
|
|
||||||
commit a6bd811f1209fe1c64c9f6fd578101d6436c6b6e upstream.
|
|
||||||
|
|
||||||
Now that we are mapping kvm_steal_time from the guest directly we
|
|
||||||
don't need keep a copy of it in kvm_vcpu_arch.st. The same is true
|
|
||||||
for the stime field.
|
|
||||||
|
|
||||||
This is part of CVE-2019-3016.
|
|
||||||
|
|
||||||
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
|
|
||||||
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
|
|
||||||
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
||||||
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
|
|
||||||
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
|
||||||
---
|
|
||||||
arch/x86/include/asm/kvm_host.h | 3 +--
|
|
||||||
arch/x86/kvm/x86.c | 11 +++--------
|
|
||||||
2 files changed, 4 insertions(+), 10 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
|
|
||||||
index ca9c7110b99d..33136395db8f 100644
|
|
||||||
--- a/arch/x86/include/asm/kvm_host.h
|
|
||||||
+++ b/arch/x86/include/asm/kvm_host.h
|
|
||||||
@@ -622,10 +622,9 @@ struct kvm_vcpu_arch {
|
|
||||||
bool pvclock_set_guest_stopped_request;
|
|
||||||
|
|
||||||
struct {
|
|
||||||
+ u8 preempted;
|
|
||||||
u64 msr_val;
|
|
||||||
u64 last_steal;
|
|
||||||
- struct gfn_to_hva_cache stime;
|
|
||||||
- struct kvm_steal_time steal;
|
|
||||||
struct gfn_to_pfn_cache cache;
|
|
||||||
} st;
|
|
||||||
|
|
||||||
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
|
|
||||||
index d77822e03ff6..6bfc9eaf8dee 100644
|
|
||||||
--- a/arch/x86/kvm/x86.c
|
|
||||||
+++ b/arch/x86/kvm/x86.c
|
|
||||||
@@ -2418,7 +2418,7 @@ static void record_steal_time(struct kvm_vcpu *vcpu)
|
|
||||||
if (xchg(&st->preempted, 0) & KVM_VCPU_FLUSH_TLB)
|
|
||||||
kvm_vcpu_flush_tlb(vcpu, false);
|
|
||||||
|
|
||||||
- vcpu->arch.st.steal.preempted = 0;
|
|
||||||
+ vcpu->arch.st.preempted = 0;
|
|
||||||
|
|
||||||
if (st->version & 1)
|
|
||||||
st->version += 1; /* first time write, random junk */
|
|
||||||
@@ -2577,11 +2577,6 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
|
|
||||||
if (data & KVM_STEAL_RESERVED_MASK)
|
|
||||||
return 1;
|
|
||||||
|
|
||||||
- if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.st.stime,
|
|
||||||
- data & KVM_STEAL_VALID_BITS,
|
|
||||||
- sizeof(struct kvm_steal_time)))
|
|
||||||
- return 1;
|
|
||||||
-
|
|
||||||
vcpu->arch.st.msr_val = data;
|
|
||||||
|
|
||||||
if (!(data & KVM_MSR_ENABLED))
|
|
||||||
@@ -3280,7 +3275,7 @@ static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu)
|
|
||||||
if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED))
|
|
||||||
return;
|
|
||||||
|
|
||||||
- if (vcpu->arch.st.steal.preempted)
|
|
||||||
+ if (vcpu->arch.st.preempted)
|
|
||||||
return;
|
|
||||||
|
|
||||||
if (kvm_map_gfn(vcpu, vcpu->arch.st.msr_val >> PAGE_SHIFT, &map,
|
|
||||||
@@ -3290,7 +3285,7 @@ static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu)
|
|
||||||
st = map.hva +
|
|
||||||
offset_in_page(vcpu->arch.st.msr_val & KVM_STEAL_VALID_BITS);
|
|
||||||
|
|
||||||
- st->preempted = vcpu->arch.st.steal.preempted = KVM_VCPU_PREEMPTED;
|
|
||||||
+ st->preempted = vcpu->arch.st.preempted = KVM_VCPU_PREEMPTED;
|
|
||||||
|
|
||||||
kvm_unmap_gfn(vcpu, &map, &vcpu->arch.st.cache, true, true);
|
|
||||||
}
|
|
||||||
--
|
|
||||||
2.27.0.rc0
|
|
||||||
|
|
|
@ -1,130 +0,0 @@
|
||||||
From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
|
|
||||||
Date: Thu, 5 Dec 2019 03:45:32 +0000
|
|
||||||
Subject: [10/11] x86/KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed
|
|
||||||
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit?id=b5b79c757e6f22f17d8ddf2979abb7bf231bb327
|
|
||||||
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-3016
|
|
||||||
|
|
||||||
commit b043138246a41064527cf019a3d51d9f015e9796 upstream.
|
|
||||||
|
|
||||||
There is a potential race in record_steal_time() between setting
|
|
||||||
host-local vcpu->arch.st.steal.preempted to zero (i.e. clearing
|
|
||||||
KVM_VCPU_PREEMPTED) and propagating this value to the guest with
|
|
||||||
kvm_write_guest_cached(). Between those two events the guest may
|
|
||||||
still see KVM_VCPU_PREEMPTED in its copy of kvm_steal_time, set
|
|
||||||
KVM_VCPU_FLUSH_TLB and assume that hypervisor will do the right
|
|
||||||
thing. Which it won't.
|
|
||||||
|
|
||||||
Instad of copying, we should map kvm_steal_time and that will
|
|
||||||
guarantee atomicity of accesses to @preempted.
|
|
||||||
|
|
||||||
This is part of CVE-2019-3016.
|
|
||||||
|
|
||||||
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
|
|
||||||
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
|
|
||||||
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
||||||
[bwh: Backported to 4.19: No tracepoint in record_steal_time().]
|
|
||||||
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
|
|
||||||
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
|
||||||
---
|
|
||||||
arch/x86/kvm/x86.c | 49 +++++++++++++++++++++++++++-------------------
|
|
||||||
1 file changed, 29 insertions(+), 20 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
|
|
||||||
index 6916f46909ab..d77822e03ff6 100644
|
|
||||||
--- a/arch/x86/kvm/x86.c
|
|
||||||
+++ b/arch/x86/kvm/x86.c
|
|
||||||
@@ -2397,43 +2397,45 @@ static void kvm_vcpu_flush_tlb(struct kvm_vcpu *vcpu, bool invalidate_gpa)
|
|
||||||
|
|
||||||
static void record_steal_time(struct kvm_vcpu *vcpu)
|
|
||||||
{
|
|
||||||
+ struct kvm_host_map map;
|
|
||||||
+ struct kvm_steal_time *st;
|
|
||||||
+
|
|
||||||
if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED))
|
|
||||||
return;
|
|
||||||
|
|
||||||
- if (unlikely(kvm_read_guest_cached(vcpu->kvm, &vcpu->arch.st.stime,
|
|
||||||
- &vcpu->arch.st.steal, sizeof(struct kvm_steal_time))))
|
|
||||||
+ /* -EAGAIN is returned in atomic context so we can just return. */
|
|
||||||
+ if (kvm_map_gfn(vcpu, vcpu->arch.st.msr_val >> PAGE_SHIFT,
|
|
||||||
+ &map, &vcpu->arch.st.cache, false))
|
|
||||||
return;
|
|
||||||
|
|
||||||
+ st = map.hva +
|
|
||||||
+ offset_in_page(vcpu->arch.st.msr_val & KVM_STEAL_VALID_BITS);
|
|
||||||
+
|
|
||||||
/*
|
|
||||||
* Doing a TLB flush here, on the guest's behalf, can avoid
|
|
||||||
* expensive IPIs.
|
|
||||||
*/
|
|
||||||
- if (xchg(&vcpu->arch.st.steal.preempted, 0) & KVM_VCPU_FLUSH_TLB)
|
|
||||||
+ if (xchg(&st->preempted, 0) & KVM_VCPU_FLUSH_TLB)
|
|
||||||
kvm_vcpu_flush_tlb(vcpu, false);
|
|
||||||
|
|
||||||
- if (vcpu->arch.st.steal.version & 1)
|
|
||||||
- vcpu->arch.st.steal.version += 1; /* first time write, random junk */
|
|
||||||
+ vcpu->arch.st.steal.preempted = 0;
|
|
||||||
|
|
||||||
- vcpu->arch.st.steal.version += 1;
|
|
||||||
+ if (st->version & 1)
|
|
||||||
+ st->version += 1; /* first time write, random junk */
|
|
||||||
|
|
||||||
- kvm_write_guest_cached(vcpu->kvm, &vcpu->arch.st.stime,
|
|
||||||
- &vcpu->arch.st.steal, sizeof(struct kvm_steal_time));
|
|
||||||
+ st->version += 1;
|
|
||||||
|
|
||||||
smp_wmb();
|
|
||||||
|
|
||||||
- vcpu->arch.st.steal.steal += current->sched_info.run_delay -
|
|
||||||
+ st->steal += current->sched_info.run_delay -
|
|
||||||
vcpu->arch.st.last_steal;
|
|
||||||
vcpu->arch.st.last_steal = current->sched_info.run_delay;
|
|
||||||
|
|
||||||
- kvm_write_guest_cached(vcpu->kvm, &vcpu->arch.st.stime,
|
|
||||||
- &vcpu->arch.st.steal, sizeof(struct kvm_steal_time));
|
|
||||||
-
|
|
||||||
smp_wmb();
|
|
||||||
|
|
||||||
- vcpu->arch.st.steal.version += 1;
|
|
||||||
+ st->version += 1;
|
|
||||||
|
|
||||||
- kvm_write_guest_cached(vcpu->kvm, &vcpu->arch.st.stime,
|
|
||||||
- &vcpu->arch.st.steal, sizeof(struct kvm_steal_time));
|
|
||||||
+ kvm_unmap_gfn(vcpu, &map, &vcpu->arch.st.cache, true, false);
|
|
||||||
}
|
|
||||||
|
|
||||||
int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
|
|
||||||
@@ -3272,18 +3274,25 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
|
|
||||||
|
|
||||||
static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu)
|
|
||||||
{
|
|
||||||
+ struct kvm_host_map map;
|
|
||||||
+ struct kvm_steal_time *st;
|
|
||||||
+
|
|
||||||
if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED))
|
|
||||||
return;
|
|
||||||
|
|
||||||
if (vcpu->arch.st.steal.preempted)
|
|
||||||
return;
|
|
||||||
|
|
||||||
- vcpu->arch.st.steal.preempted = KVM_VCPU_PREEMPTED;
|
|
||||||
+ if (kvm_map_gfn(vcpu, vcpu->arch.st.msr_val >> PAGE_SHIFT, &map,
|
|
||||||
+ &vcpu->arch.st.cache, true))
|
|
||||||
+ return;
|
|
||||||
+
|
|
||||||
+ st = map.hva +
|
|
||||||
+ offset_in_page(vcpu->arch.st.msr_val & KVM_STEAL_VALID_BITS);
|
|
||||||
+
|
|
||||||
+ st->preempted = vcpu->arch.st.steal.preempted = KVM_VCPU_PREEMPTED;
|
|
||||||
|
|
||||||
- kvm_write_guest_offset_cached(vcpu->kvm, &vcpu->arch.st.stime,
|
|
||||||
- &vcpu->arch.st.steal.preempted,
|
|
||||||
- offsetof(struct kvm_steal_time, preempted),
|
|
||||||
- sizeof(vcpu->arch.st.steal.preempted));
|
|
||||||
+ kvm_unmap_gfn(vcpu, &map, &vcpu->arch.st.cache, true, true);
|
|
||||||
}
|
|
||||||
|
|
||||||
void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
|
|
||||||
--
|
|
||||||
2.27.0.rc0
|
|
||||||
|
|
|
@ -1,296 +0,0 @@
|
||||||
From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
|
|
||||||
Date: Thu, 5 Dec 2019 01:30:51 +0000
|
|
||||||
Subject: [09/11] x86/kvm: Cache gfn to pfn translation
|
|
||||||
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit?id=ccfc73e56da7c8e68ab6a543c5b8cd0b83c9e9bb
|
|
||||||
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-3016
|
|
||||||
|
|
||||||
commit 917248144db5d7320655dbb41d3af0b8a0f3d589 upstream.
|
|
||||||
|
|
||||||
__kvm_map_gfn()'s call to gfn_to_pfn_memslot() is
|
|
||||||
* relatively expensive
|
|
||||||
* in certain cases (such as when done from atomic context) cannot be called
|
|
||||||
|
|
||||||
Stashing gfn-to-pfn mapping should help with both cases.
|
|
||||||
|
|
||||||
This is part of CVE-2019-3016.
|
|
||||||
|
|
||||||
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
|
|
||||||
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
|
|
||||||
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
||||||
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
|
|
||||||
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
|
||||||
---
|
|
||||||
arch/x86/include/asm/kvm_host.h | 1 +
|
|
||||||
arch/x86/kvm/x86.c | 10 ++++
|
|
||||||
include/linux/kvm_host.h | 7 ++-
|
|
||||||
include/linux/kvm_types.h | 9 ++-
|
|
||||||
virt/kvm/kvm_main.c | 98 ++++++++++++++++++++++++++-------
|
|
||||||
5 files changed, 103 insertions(+), 22 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
|
|
||||||
index 5c99b9bfce04..ca9c7110b99d 100644
|
|
||||||
--- a/arch/x86/include/asm/kvm_host.h
|
|
||||||
+++ b/arch/x86/include/asm/kvm_host.h
|
|
||||||
@@ -626,6 +626,7 @@ struct kvm_vcpu_arch {
|
|
||||||
u64 last_steal;
|
|
||||||
struct gfn_to_hva_cache stime;
|
|
||||||
struct kvm_steal_time steal;
|
|
||||||
+ struct gfn_to_pfn_cache cache;
|
|
||||||
} st;
|
|
||||||
|
|
||||||
u64 tsc_offset;
|
|
||||||
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
|
|
||||||
index 1a6e1aa2fb29..6916f46909ab 100644
|
|
||||||
--- a/arch/x86/kvm/x86.c
|
|
||||||
+++ b/arch/x86/kvm/x86.c
|
|
||||||
@@ -8634,6 +8634,9 @@ static void fx_init(struct kvm_vcpu *vcpu)
|
|
||||||
void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu)
|
|
||||||
{
|
|
||||||
void *wbinvd_dirty_mask = vcpu->arch.wbinvd_dirty_mask;
|
|
||||||
+ struct gfn_to_pfn_cache *cache = &vcpu->arch.st.cache;
|
|
||||||
+
|
|
||||||
+ kvm_release_pfn(cache->pfn, cache->dirty, cache);
|
|
||||||
|
|
||||||
kvmclock_reset(vcpu);
|
|
||||||
|
|
||||||
@@ -9298,11 +9301,18 @@ int kvm_arch_create_memslot(struct kvm *kvm, struct kvm_memory_slot *slot,
|
|
||||||
|
|
||||||
void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen)
|
|
||||||
{
|
|
||||||
+ struct kvm_vcpu *vcpu;
|
|
||||||
+ int i;
|
|
||||||
+
|
|
||||||
/*
|
|
||||||
* memslots->generation has been incremented.
|
|
||||||
* mmio generation may have reached its maximum value.
|
|
||||||
*/
|
|
||||||
kvm_mmu_invalidate_mmio_sptes(kvm, gen);
|
|
||||||
+
|
|
||||||
+ /* Force re-initialization of steal_time cache */
|
|
||||||
+ kvm_for_each_vcpu(i, vcpu, kvm)
|
|
||||||
+ kvm_vcpu_kick(vcpu);
|
|
||||||
}
|
|
||||||
|
|
||||||
int kvm_arch_prepare_memory_region(struct kvm *kvm,
|
|
||||||
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
|
|
||||||
index 303c1a6916ce..dabb60f90726 100644
|
|
||||||
--- a/include/linux/kvm_host.h
|
|
||||||
+++ b/include/linux/kvm_host.h
|
|
||||||
@@ -708,6 +708,7 @@ void kvm_set_pfn_dirty(kvm_pfn_t pfn);
|
|
||||||
void kvm_set_pfn_accessed(kvm_pfn_t pfn);
|
|
||||||
void kvm_get_pfn(kvm_pfn_t pfn);
|
|
||||||
|
|
||||||
+void kvm_release_pfn(kvm_pfn_t pfn, bool dirty, struct gfn_to_pfn_cache *cache);
|
|
||||||
int kvm_read_guest_page(struct kvm *kvm, gfn_t gfn, void *data, int offset,
|
|
||||||
int len);
|
|
||||||
int kvm_read_guest_atomic(struct kvm *kvm, gpa_t gpa, void *data,
|
|
||||||
@@ -738,10 +739,12 @@ struct kvm_memory_slot *kvm_vcpu_gfn_to_memslot(struct kvm_vcpu *vcpu, gfn_t gfn
|
|
||||||
kvm_pfn_t kvm_vcpu_gfn_to_pfn_atomic(struct kvm_vcpu *vcpu, gfn_t gfn);
|
|
||||||
kvm_pfn_t kvm_vcpu_gfn_to_pfn(struct kvm_vcpu *vcpu, gfn_t gfn);
|
|
||||||
int kvm_vcpu_map(struct kvm_vcpu *vcpu, gpa_t gpa, struct kvm_host_map *map);
|
|
||||||
-int kvm_map_gfn(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map);
|
|
||||||
+int kvm_map_gfn(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map,
|
|
||||||
+ struct gfn_to_pfn_cache *cache, bool atomic);
|
|
||||||
struct page *kvm_vcpu_gfn_to_page(struct kvm_vcpu *vcpu, gfn_t gfn);
|
|
||||||
void kvm_vcpu_unmap(struct kvm_vcpu *vcpu, struct kvm_host_map *map, bool dirty);
|
|
||||||
-int kvm_unmap_gfn(struct kvm_vcpu *vcpu, struct kvm_host_map *map, bool dirty);
|
|
||||||
+int kvm_unmap_gfn(struct kvm_vcpu *vcpu, struct kvm_host_map *map,
|
|
||||||
+ struct gfn_to_pfn_cache *cache, bool dirty, bool atomic);
|
|
||||||
unsigned long kvm_vcpu_gfn_to_hva(struct kvm_vcpu *vcpu, gfn_t gfn);
|
|
||||||
unsigned long kvm_vcpu_gfn_to_hva_prot(struct kvm_vcpu *vcpu, gfn_t gfn, bool *writable);
|
|
||||||
int kvm_vcpu_read_guest_page(struct kvm_vcpu *vcpu, gfn_t gfn, void *data, int offset,
|
|
||||||
diff --git a/include/linux/kvm_types.h b/include/linux/kvm_types.h
|
|
||||||
index 8bf259dae9f6..a38729c8296f 100644
|
|
||||||
--- a/include/linux/kvm_types.h
|
|
||||||
+++ b/include/linux/kvm_types.h
|
|
||||||
@@ -32,7 +32,7 @@ struct kvm_memslots;
|
|
||||||
|
|
||||||
enum kvm_mr_change;
|
|
||||||
|
|
||||||
-#include <asm/types.h>
|
|
||||||
+#include <linux/types.h>
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Address types:
|
|
||||||
@@ -63,4 +63,11 @@ struct gfn_to_hva_cache {
|
|
||||||
struct kvm_memory_slot *memslot;
|
|
||||||
};
|
|
||||||
|
|
||||||
+struct gfn_to_pfn_cache {
|
|
||||||
+ u64 generation;
|
|
||||||
+ gfn_t gfn;
|
|
||||||
+ kvm_pfn_t pfn;
|
|
||||||
+ bool dirty;
|
|
||||||
+};
|
|
||||||
+
|
|
||||||
#endif /* __KVM_TYPES_H__ */
|
|
||||||
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
|
|
||||||
index 8e29b2e0bf2e..aca15bd1cc4c 100644
|
|
||||||
--- a/virt/kvm/kvm_main.c
|
|
||||||
+++ b/virt/kvm/kvm_main.c
|
|
||||||
@@ -1705,27 +1705,72 @@ struct page *gfn_to_page(struct kvm *kvm, gfn_t gfn)
|
|
||||||
}
|
|
||||||
EXPORT_SYMBOL_GPL(gfn_to_page);
|
|
||||||
|
|
||||||
+void kvm_release_pfn(kvm_pfn_t pfn, bool dirty, struct gfn_to_pfn_cache *cache)
|
|
||||||
+{
|
|
||||||
+ if (pfn == 0)
|
|
||||||
+ return;
|
|
||||||
+
|
|
||||||
+ if (cache)
|
|
||||||
+ cache->pfn = cache->gfn = 0;
|
|
||||||
+
|
|
||||||
+ if (dirty)
|
|
||||||
+ kvm_release_pfn_dirty(pfn);
|
|
||||||
+ else
|
|
||||||
+ kvm_release_pfn_clean(pfn);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+static void kvm_cache_gfn_to_pfn(struct kvm_memory_slot *slot, gfn_t gfn,
|
|
||||||
+ struct gfn_to_pfn_cache *cache, u64 gen)
|
|
||||||
+{
|
|
||||||
+ kvm_release_pfn(cache->pfn, cache->dirty, cache);
|
|
||||||
+
|
|
||||||
+ cache->pfn = gfn_to_pfn_memslot(slot, gfn);
|
|
||||||
+ cache->gfn = gfn;
|
|
||||||
+ cache->dirty = false;
|
|
||||||
+ cache->generation = gen;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
static int __kvm_map_gfn(struct kvm_memslots *slots, gfn_t gfn,
|
|
||||||
- struct kvm_host_map *map)
|
|
||||||
+ struct kvm_host_map *map,
|
|
||||||
+ struct gfn_to_pfn_cache *cache,
|
|
||||||
+ bool atomic)
|
|
||||||
{
|
|
||||||
kvm_pfn_t pfn;
|
|
||||||
void *hva = NULL;
|
|
||||||
struct page *page = KVM_UNMAPPED_PAGE;
|
|
||||||
struct kvm_memory_slot *slot = __gfn_to_memslot(slots, gfn);
|
|
||||||
+ u64 gen = slots->generation;
|
|
||||||
|
|
||||||
if (!map)
|
|
||||||
return -EINVAL;
|
|
||||||
|
|
||||||
- pfn = gfn_to_pfn_memslot(slot, gfn);
|
|
||||||
+ if (cache) {
|
|
||||||
+ if (!cache->pfn || cache->gfn != gfn ||
|
|
||||||
+ cache->generation != gen) {
|
|
||||||
+ if (atomic)
|
|
||||||
+ return -EAGAIN;
|
|
||||||
+ kvm_cache_gfn_to_pfn(slot, gfn, cache, gen);
|
|
||||||
+ }
|
|
||||||
+ pfn = cache->pfn;
|
|
||||||
+ } else {
|
|
||||||
+ if (atomic)
|
|
||||||
+ return -EAGAIN;
|
|
||||||
+ pfn = gfn_to_pfn_memslot(slot, gfn);
|
|
||||||
+ }
|
|
||||||
if (is_error_noslot_pfn(pfn))
|
|
||||||
return -EINVAL;
|
|
||||||
|
|
||||||
if (pfn_valid(pfn)) {
|
|
||||||
page = pfn_to_page(pfn);
|
|
||||||
- hva = kmap(page);
|
|
||||||
+ if (atomic)
|
|
||||||
+ hva = kmap_atomic(page);
|
|
||||||
+ else
|
|
||||||
+ hva = kmap(page);
|
|
||||||
#ifdef CONFIG_HAS_IOMEM
|
|
||||||
- } else {
|
|
||||||
+ } else if (!atomic) {
|
|
||||||
hva = memremap(pfn_to_hpa(pfn), PAGE_SIZE, MEMREMAP_WB);
|
|
||||||
+ } else {
|
|
||||||
+ return -EINVAL;
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -1740,20 +1785,25 @@ static int __kvm_map_gfn(struct kvm_memslots *slots, gfn_t gfn,
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
-int kvm_map_gfn(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map)
|
|
||||||
+int kvm_map_gfn(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map,
|
|
||||||
+ struct gfn_to_pfn_cache *cache, bool atomic)
|
|
||||||
{
|
|
||||||
- return __kvm_map_gfn(kvm_memslots(vcpu->kvm), gfn, map);
|
|
||||||
+ return __kvm_map_gfn(kvm_memslots(vcpu->kvm), gfn, map,
|
|
||||||
+ cache, atomic);
|
|
||||||
}
|
|
||||||
EXPORT_SYMBOL_GPL(kvm_map_gfn);
|
|
||||||
|
|
||||||
int kvm_vcpu_map(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map)
|
|
||||||
{
|
|
||||||
- return __kvm_map_gfn(kvm_vcpu_memslots(vcpu), gfn, map);
|
|
||||||
+ return __kvm_map_gfn(kvm_vcpu_memslots(vcpu), gfn, map,
|
|
||||||
+ NULL, false);
|
|
||||||
}
|
|
||||||
EXPORT_SYMBOL_GPL(kvm_vcpu_map);
|
|
||||||
|
|
||||||
static void __kvm_unmap_gfn(struct kvm_memory_slot *memslot,
|
|
||||||
- struct kvm_host_map *map, bool dirty)
|
|
||||||
+ struct kvm_host_map *map,
|
|
||||||
+ struct gfn_to_pfn_cache *cache,
|
|
||||||
+ bool dirty, bool atomic)
|
|
||||||
{
|
|
||||||
if (!map)
|
|
||||||
return;
|
|
||||||
@@ -1761,34 +1811,44 @@ static void __kvm_unmap_gfn(struct kvm_memory_slot *memslot,
|
|
||||||
if (!map->hva)
|
|
||||||
return;
|
|
||||||
|
|
||||||
- if (map->page != KVM_UNMAPPED_PAGE)
|
|
||||||
- kunmap(map->page);
|
|
||||||
+ if (map->page != KVM_UNMAPPED_PAGE) {
|
|
||||||
+ if (atomic)
|
|
||||||
+ kunmap_atomic(map->hva);
|
|
||||||
+ else
|
|
||||||
+ kunmap(map->page);
|
|
||||||
+ }
|
|
||||||
#ifdef CONFIG_HAS_IOMEM
|
|
||||||
- else
|
|
||||||
+ else if (!atomic)
|
|
||||||
memunmap(map->hva);
|
|
||||||
+ else
|
|
||||||
+ WARN_ONCE(1, "Unexpected unmapping in atomic context");
|
|
||||||
#endif
|
|
||||||
|
|
||||||
- if (dirty) {
|
|
||||||
+ if (dirty)
|
|
||||||
mark_page_dirty_in_slot(memslot, map->gfn);
|
|
||||||
- kvm_release_pfn_dirty(map->pfn);
|
|
||||||
- } else {
|
|
||||||
- kvm_release_pfn_clean(map->pfn);
|
|
||||||
- }
|
|
||||||
+
|
|
||||||
+ if (cache)
|
|
||||||
+ cache->dirty |= dirty;
|
|
||||||
+ else
|
|
||||||
+ kvm_release_pfn(map->pfn, dirty, NULL);
|
|
||||||
|
|
||||||
map->hva = NULL;
|
|
||||||
map->page = NULL;
|
|
||||||
}
|
|
||||||
|
|
||||||
-int kvm_unmap_gfn(struct kvm_vcpu *vcpu, struct kvm_host_map *map, bool dirty)
|
|
||||||
+int kvm_unmap_gfn(struct kvm_vcpu *vcpu, struct kvm_host_map *map,
|
|
||||||
+ struct gfn_to_pfn_cache *cache, bool dirty, bool atomic)
|
|
||||||
{
|
|
||||||
- __kvm_unmap_gfn(gfn_to_memslot(vcpu->kvm, map->gfn), map, dirty);
|
|
||||||
+ __kvm_unmap_gfn(gfn_to_memslot(vcpu->kvm, map->gfn), map,
|
|
||||||
+ cache, dirty, atomic);
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
EXPORT_SYMBOL_GPL(kvm_unmap_gfn);
|
|
||||||
|
|
||||||
void kvm_vcpu_unmap(struct kvm_vcpu *vcpu, struct kvm_host_map *map, bool dirty)
|
|
||||||
{
|
|
||||||
- __kvm_unmap_gfn(kvm_vcpu_gfn_to_memslot(vcpu, map->gfn), map, dirty);
|
|
||||||
+ __kvm_unmap_gfn(kvm_vcpu_gfn_to_memslot(vcpu, map->gfn), map, NULL,
|
|
||||||
+ dirty, false);
|
|
||||||
}
|
|
||||||
EXPORT_SYMBOL_GPL(kvm_vcpu_unmap);
|
|
||||||
|
|
||||||
--
|
|
||||||
2.27.0.rc0
|
|
||||||
|
|
|
@ -1,114 +0,0 @@
|
||||||
From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
|
|
||||||
Date: Tue, 12 Nov 2019 16:35:06 +0000
|
|
||||||
Subject: [08/11] x86/kvm: Introduce kvm_(un)map_gfn()
|
|
||||||
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit?id=e36d68ec5090599058650152547d4a58ef3d79a0
|
|
||||||
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-3016
|
|
||||||
|
|
||||||
commit 1eff70a9abd46f175defafd29bc17ad456f398a7 upstream.
|
|
||||||
|
|
||||||
kvm_vcpu_(un)map operates on gfns from any current address space.
|
|
||||||
In certain cases we want to make sure we are not mapping SMRAM
|
|
||||||
and for that we can use kvm_(un)map_gfn() that we are introducing
|
|
||||||
in this patch.
|
|
||||||
|
|
||||||
This is part of CVE-2019-3016.
|
|
||||||
|
|
||||||
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
|
|
||||||
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
|
|
||||||
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
||||||
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
|
|
||||||
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
|
||||||
---
|
|
||||||
include/linux/kvm_host.h | 2 ++
|
|
||||||
virt/kvm/kvm_main.c | 29 ++++++++++++++++++++++++-----
|
|
||||||
2 files changed, 26 insertions(+), 5 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
|
|
||||||
index bef95dba14e8..303c1a6916ce 100644
|
|
||||||
--- a/include/linux/kvm_host.h
|
|
||||||
+++ b/include/linux/kvm_host.h
|
|
||||||
@@ -738,8 +738,10 @@ struct kvm_memory_slot *kvm_vcpu_gfn_to_memslot(struct kvm_vcpu *vcpu, gfn_t gfn
|
|
||||||
kvm_pfn_t kvm_vcpu_gfn_to_pfn_atomic(struct kvm_vcpu *vcpu, gfn_t gfn);
|
|
||||||
kvm_pfn_t kvm_vcpu_gfn_to_pfn(struct kvm_vcpu *vcpu, gfn_t gfn);
|
|
||||||
int kvm_vcpu_map(struct kvm_vcpu *vcpu, gpa_t gpa, struct kvm_host_map *map);
|
|
||||||
+int kvm_map_gfn(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map);
|
|
||||||
struct page *kvm_vcpu_gfn_to_page(struct kvm_vcpu *vcpu, gfn_t gfn);
|
|
||||||
void kvm_vcpu_unmap(struct kvm_vcpu *vcpu, struct kvm_host_map *map, bool dirty);
|
|
||||||
+int kvm_unmap_gfn(struct kvm_vcpu *vcpu, struct kvm_host_map *map, bool dirty);
|
|
||||||
unsigned long kvm_vcpu_gfn_to_hva(struct kvm_vcpu *vcpu, gfn_t gfn);
|
|
||||||
unsigned long kvm_vcpu_gfn_to_hva_prot(struct kvm_vcpu *vcpu, gfn_t gfn, bool *writable);
|
|
||||||
int kvm_vcpu_read_guest_page(struct kvm_vcpu *vcpu, gfn_t gfn, void *data, int offset,
|
|
||||||
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
|
|
||||||
index 33b288469c70..8e29b2e0bf2e 100644
|
|
||||||
--- a/virt/kvm/kvm_main.c
|
|
||||||
+++ b/virt/kvm/kvm_main.c
|
|
||||||
@@ -1705,12 +1705,13 @@ struct page *gfn_to_page(struct kvm *kvm, gfn_t gfn)
|
|
||||||
}
|
|
||||||
EXPORT_SYMBOL_GPL(gfn_to_page);
|
|
||||||
|
|
||||||
-static int __kvm_map_gfn(struct kvm_memory_slot *slot, gfn_t gfn,
|
|
||||||
+static int __kvm_map_gfn(struct kvm_memslots *slots, gfn_t gfn,
|
|
||||||
struct kvm_host_map *map)
|
|
||||||
{
|
|
||||||
kvm_pfn_t pfn;
|
|
||||||
void *hva = NULL;
|
|
||||||
struct page *page = KVM_UNMAPPED_PAGE;
|
|
||||||
+ struct kvm_memory_slot *slot = __gfn_to_memslot(slots, gfn);
|
|
||||||
|
|
||||||
if (!map)
|
|
||||||
return -EINVAL;
|
|
||||||
@@ -1739,14 +1740,20 @@ static int __kvm_map_gfn(struct kvm_memory_slot *slot, gfn_t gfn,
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
+int kvm_map_gfn(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map)
|
|
||||||
+{
|
|
||||||
+ return __kvm_map_gfn(kvm_memslots(vcpu->kvm), gfn, map);
|
|
||||||
+}
|
|
||||||
+EXPORT_SYMBOL_GPL(kvm_map_gfn);
|
|
||||||
+
|
|
||||||
int kvm_vcpu_map(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map)
|
|
||||||
{
|
|
||||||
- return __kvm_map_gfn(kvm_vcpu_gfn_to_memslot(vcpu, gfn), gfn, map);
|
|
||||||
+ return __kvm_map_gfn(kvm_vcpu_memslots(vcpu), gfn, map);
|
|
||||||
}
|
|
||||||
EXPORT_SYMBOL_GPL(kvm_vcpu_map);
|
|
||||||
|
|
||||||
-void kvm_vcpu_unmap(struct kvm_vcpu *vcpu, struct kvm_host_map *map,
|
|
||||||
- bool dirty)
|
|
||||||
+static void __kvm_unmap_gfn(struct kvm_memory_slot *memslot,
|
|
||||||
+ struct kvm_host_map *map, bool dirty)
|
|
||||||
{
|
|
||||||
if (!map)
|
|
||||||
return;
|
|
||||||
@@ -1762,7 +1769,7 @@ void kvm_vcpu_unmap(struct kvm_vcpu *vcpu, struct kvm_host_map *map,
|
|
||||||
#endif
|
|
||||||
|
|
||||||
if (dirty) {
|
|
||||||
- kvm_vcpu_mark_page_dirty(vcpu, map->gfn);
|
|
||||||
+ mark_page_dirty_in_slot(memslot, map->gfn);
|
|
||||||
kvm_release_pfn_dirty(map->pfn);
|
|
||||||
} else {
|
|
||||||
kvm_release_pfn_clean(map->pfn);
|
|
||||||
@@ -1771,6 +1778,18 @@ void kvm_vcpu_unmap(struct kvm_vcpu *vcpu, struct kvm_host_map *map,
|
|
||||||
map->hva = NULL;
|
|
||||||
map->page = NULL;
|
|
||||||
}
|
|
||||||
+
|
|
||||||
+int kvm_unmap_gfn(struct kvm_vcpu *vcpu, struct kvm_host_map *map, bool dirty)
|
|
||||||
+{
|
|
||||||
+ __kvm_unmap_gfn(gfn_to_memslot(vcpu->kvm, map->gfn), map, dirty);
|
|
||||||
+ return 0;
|
|
||||||
+}
|
|
||||||
+EXPORT_SYMBOL_GPL(kvm_unmap_gfn);
|
|
||||||
+
|
|
||||||
+void kvm_vcpu_unmap(struct kvm_vcpu *vcpu, struct kvm_host_map *map, bool dirty)
|
|
||||||
+{
|
|
||||||
+ __kvm_unmap_gfn(kvm_vcpu_gfn_to_memslot(vcpu, map->gfn), map, dirty);
|
|
||||||
+}
|
|
||||||
EXPORT_SYMBOL_GPL(kvm_vcpu_unmap);
|
|
||||||
|
|
||||||
struct page *kvm_vcpu_gfn_to_page(struct kvm_vcpu *vcpu, gfn_t gfn)
|
|
||||||
--
|
|
||||||
2.27.0.rc0
|
|
||||||
|
|
|
@ -307,17 +307,6 @@ bugfix/all/netlabel-cope-with-NULL-catmap.patch
|
||||||
bugfix/all/fs-binfmt_elf.c-allocate-initialized-memory-in-fill_.patch
|
bugfix/all/fs-binfmt_elf.c-allocate-initialized-memory-in-fill_.patch
|
||||||
bugfix/all/kernel-relay.c-handle-alloc_percpu-returning-NULL-in.patch
|
bugfix/all/kernel-relay.c-handle-alloc_percpu-returning-NULL-in.patch
|
||||||
bugfix/all/mm-Fix-mremap-not-considering-huge-pmd-devmap.patch
|
bugfix/all/mm-Fix-mremap-not-considering-huge-pmd-devmap.patch
|
||||||
# pre-requisites and CVE-2019-3016
|
|
||||||
bugfix/x86/KVM-nVMX-Always-sync-GUEST_BNDCFGS-when-it-comes-fro.patch
|
|
||||||
bugfix/all/KVM-Introduce-a-new-guest-mapping-API.patch
|
|
||||||
bugfix/arm64/kvm-fix-compilation-on-aarch64.patch
|
|
||||||
bugfix/s390x/kvm-fix-compilation-on-s390.patch
|
|
||||||
bugfix/s390x/kvm-fix-compile-on-s390-part-2.patch
|
|
||||||
bugfix/all/KVM-Properly-check-if-page-is-valid-in-kvm_vcpu_unma.patch
|
|
||||||
bugfix/x86/x86-kvm-Introduce-kvm_-un-map_gfn.patch
|
|
||||||
bugfix/x86/x86-kvm-Cache-gfn-to-pfn-translation.patch
|
|
||||||
bugfix/x86/x86-KVM-Make-sure-KVM_VCPU_FLUSH_TLB-flag-is-not-mis.patch
|
|
||||||
bugfix/x86/x86-KVM-Clean-up-host-s-steal-time-structure.patch
|
|
||||||
bugfix/x86/srbds/0001-x86-cpu-Add-a-steppings-field-to-struct-x86_cpu_id.patch
|
bugfix/x86/srbds/0001-x86-cpu-Add-a-steppings-field-to-struct-x86_cpu_id.patch
|
||||||
bugfix/x86/srbds/0002-x86-cpu-Add-table-argument-to-cpu_matches.patch
|
bugfix/x86/srbds/0002-x86-cpu-Add-table-argument-to-cpu_matches.patch
|
||||||
bugfix/x86/srbds/0003-x86-speculation-Add-Special-Register-Buffer-Data-Sam.patch
|
bugfix/x86/srbds/0003-x86-speculation-Add-Special-Register-Buffer-Data-Sam.patch
|
||||||
|
|
Loading…
Reference in New Issue