Skip to content

Commit f8f6538

Browse files
torvaldstorvalds
committed
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull KVM fixes from Radim Krčmář: "ARM: - Fix a VFP corruption in 32-bit guest - Add missing cache invalidation for CoW pages - Two small cleanups s390: - Fallout from the hugetlbfs support: pfmf interpretion and locking - VSIE: fix keywrapping for nested guests PPC: - Fix a bug where pages might not get marked dirty, causing guest memory corruption on migration - Fix a bug causing reads from guest memory to use the wrong guest real address for very large HPT guests (>256G of memory), leading to failures in instruction emulation. x86: - Fix out of bound access from malicious pv ipi hypercalls (introduced in rc1) - Fix delivery of pending interrupts when entering a nested guest, preventing arbitrarily late injection - Sanitize kvm_stat output after destroying a guest - Fix infinite loop when emulating a nested guest page fault and improve the surrounding emulation code - Two minor cleanups" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (28 commits) KVM: LAPIC: Fix pv ipis out-of-bounds access KVM: nVMX: Fix loss of pending IRQ/NMI before entering L2 arm64: KVM: Remove pgd_lock KVM: Remove obsolete kvm_unmap_hva notifier backend arm64: KVM: Only force FPEXC32_EL2.EN if trapping FPSIMD KVM: arm/arm64: Clean dcache to PoC when changing PTE due to CoW KVM: s390: Properly lock mm context allow_gmap_hpage_1m setting KVM: s390: vsie: copy wrapping keys to right place KVM: s390: Fix pfmf and conditional skey emulation tools/kvm_stat: re-animate display of dead guests tools/kvm_stat: indicate dead guests as such tools/kvm_stat: handle guest removals more gracefully tools/kvm_stat: don't reset stats when setting PID filter for debugfs tools/kvm_stat: fix updates for dead guests tools/kvm_stat: fix handling of invalid paths in debugfs provider tools/kvm_stat: fix python3 issues KVM: x86: Unexport x86_emulate_instruction() KVM: x86: Rename emulate_instruction() to kvm_emulate_instruction() KVM: x86: Do not re-{try,execute} after failed emulation in L2 KVM: x86: Default to not allowing emulation retry in kvm_mmu_page_fault ...
2 parents 0f3aa48 + bdf7ffc commit f8f6538

File tree

21 files changed

+204
-134
lines changed

21 files changed

+204
-134
lines changed

‎arch/arm/include/asm/kvm_host.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,6 @@ int __kvm_arm_vcpu_set_events(struct kvm_vcpu *vcpu,
223223
struct kvm_vcpu_events *events);
224224

225225
#define KVM_ARCH_WANT_MMU_NOTIFIER
226-
int kvm_unmap_hva(struct kvm *kvm, unsigned long hva);
227226
int kvm_unmap_hva_range(struct kvm *kvm,
228227
unsigned long start, unsigned long end);
229228
void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);

‎arch/arm64/include/asm/kvm_host.h

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,7 @@ struct kvm_arch {
6161
u64 vmid_gen;
6262
u32 vmid;
6363

64-
/* 1-level 2nd stage table and lock */
65-
spinlock_t pgd_lock;
64+
/* 1-level 2nd stage table, protected by kvm->mmu_lock */
6665
pgd_t *pgd;
6766

6867
/* VTTBR value associated with above pgd and vmid */
@@ -357,7 +356,6 @@ int __kvm_arm_vcpu_set_events(struct kvm_vcpu *vcpu,
357356
struct kvm_vcpu_events *events);
358357

359358
#define KVM_ARCH_WANT_MMU_NOTIFIER
360-
int kvm_unmap_hva(struct kvm *kvm, unsigned long hva);
361359
int kvm_unmap_hva_range(struct kvm *kvm,
362360
unsigned long start, unsigned long end);
363361
void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);

‎arch/arm64/kvm/hyp/switch.c

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -98,8 +98,10 @@ static void activate_traps_vhe(struct kvm_vcpu *vcpu)
9898
val = read_sysreg(cpacr_el1);
9999
val |= CPACR_EL1_TTA;
100100
val &= ~CPACR_EL1_ZEN;
101-
if (!update_fp_enabled(vcpu))
101+
if (!update_fp_enabled(vcpu)) {
102102
val &= ~CPACR_EL1_FPEN;
103+
__activate_traps_fpsimd32(vcpu);
104+
}
103105

104106
write_sysreg(val, cpacr_el1);
105107

@@ -114,8 +116,10 @@ static void __hyp_text __activate_traps_nvhe(struct kvm_vcpu *vcpu)
114116

115117
val = CPTR_EL2_DEFAULT;
116118
val |= CPTR_EL2_TTA | CPTR_EL2_TZ;
117-
if (!update_fp_enabled(vcpu))
119+
if (!update_fp_enabled(vcpu)) {
118120
val |= CPTR_EL2_TFP;
121+
__activate_traps_fpsimd32(vcpu);
122+
}
119123

120124
write_sysreg(val, cptr_el2);
121125
}
@@ -129,7 +133,6 @@ static void __hyp_text __activate_traps(struct kvm_vcpu *vcpu)
129133
if (cpus_have_const_cap(ARM64_HAS_RAS_EXTN) && (hcr & HCR_VSE))
130134
write_sysreg_s(vcpu->arch.vsesr_el2, SYS_VSESR_EL2);
131135

132-
__activate_traps_fpsimd32(vcpu);
133136
if (has_vhe())
134137
activate_traps_vhe(vcpu);
135138
else

‎arch/mips/include/asm/kvm_host.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -931,7 +931,6 @@ enum kvm_mips_fault_result kvm_trap_emul_gva_fault(struct kvm_vcpu *vcpu,
931931
bool write);
932932

933933
#define KVM_ARCH_WANT_MMU_NOTIFIER
934-
int kvm_unmap_hva(struct kvm *kvm, unsigned long hva);
935934
int kvm_unmap_hva_range(struct kvm *kvm,
936935
unsigned long start, unsigned long end);
937936
void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);

‎arch/mips/kvm/mmu.c

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -512,16 +512,6 @@ static int kvm_unmap_hva_handler(struct kvm *kvm, gfn_t gfn, gfn_t gfn_end,
512512
return 1;
513513
}
514514

515-
int kvm_unmap_hva(struct kvm *kvm, unsigned long hva)
516-
{
517-
unsigned long end = hva + PAGE_SIZE;
518-
519-
handle_hva_to_gpa(kvm, hva, end, &kvm_unmap_hva_handler, NULL);
520-
521-
kvm_mips_callbacks->flush_shadow_all(kvm);
522-
return 0;
523-
}
524-
525515
int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end)
526516
{
527517
handle_hva_to_gpa(kvm, start, end, &kvm_unmap_hva_handler, NULL);

‎arch/powerpc/kvm/book3s_64_mmu_hv.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -358,7 +358,7 @@ static int kvmppc_mmu_book3s_64_hv_xlate(struct kvm_vcpu *vcpu, gva_t eaddr,
358358
unsigned long pp, key;
359359
unsigned long v, orig_v, gr;
360360
__be64 *hptep;
361-
int index;
361+
long int index;
362362
int virtmode = vcpu->arch.shregs.msr & (data ? MSR_DR : MSR_IR);
363363

364364
if (kvm_is_radix(vcpu->kvm))

‎arch/powerpc/kvm/book3s_64_mmu_radix.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -725,10 +725,10 @@ int kvm_unmap_radix(struct kvm *kvm, struct kvm_memory_slot *memslot,
725725
gpa, shift);
726726
kvmppc_radix_tlbie_page(kvm, gpa, shift);
727727
if ((old & _PAGE_DIRTY) && memslot->dirty_bitmap) {
728-
unsigned long npages = 1;
728+
unsigned long psize = PAGE_SIZE;
729729
if (shift)
730-
npages = 1ul << (shift - PAGE_SHIFT);
731-
kvmppc_update_dirty_map(memslot, gfn, npages);
730+
psize = 1ul << shift;
731+
kvmppc_update_dirty_map(memslot, gfn, psize);
732732
}
733733
}
734734
return 0;

‎arch/s390/include/asm/mmu.h

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,13 @@ typedef struct {
1616
unsigned long asce;
1717
unsigned long asce_limit;
1818
unsigned long vdso_base;
19-
/* The mmu context allocates 4K page tables. */
19+
/*
20+
* The following bitfields need a down_write on the mm
21+
* semaphore when they are written to. As they are only
22+
* written once, they can be read without a lock.
23+
*
24+
* The mmu context allocates 4K page tables.
25+
*/
2026
unsigned int alloc_pgste:1;
2127
/* The mmu context uses extended page tables. */
2228
unsigned int has_pgste:1;

‎arch/s390/kvm/kvm-s390.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -695,7 +695,9 @@ static int kvm_vm_ioctl_enable_cap(struct kvm *kvm, struct kvm_enable_cap *cap)
695695
r = -EINVAL;
696696
else {
697697
r = 0;
698+
down_write(&kvm->mm->mmap_sem);
698699
kvm->mm->context.allow_gmap_hpage_1m = 1;
700+
up_write(&kvm->mm->mmap_sem);
699701
/*
700702
* We might have to create fake 4k page
701703
* tables. To avoid that the hardware works on

‎arch/s390/kvm/priv.c

Lines changed: 18 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -280,9 +280,11 @@ static int handle_iske(struct kvm_vcpu *vcpu)
280280
goto retry;
281281
}
282282
}
283-
if (rc)
284-
return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
285283
up_read(&current->mm->mmap_sem);
284+
if (rc == -EFAULT)
285+
return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
286+
if (rc < 0)
287+
return rc;
286288
vcpu->run->s.regs.gprs[reg1] &= ~0xff;
287289
vcpu->run->s.regs.gprs[reg1] |= key;
288290
return 0;
@@ -324,9 +326,11 @@ static int handle_rrbe(struct kvm_vcpu *vcpu)
324326
goto retry;
325327
}
326328
}
327-
if (rc < 0)
328-
return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
329329
up_read(&current->mm->mmap_sem);
330+
if (rc == -EFAULT)
331+
return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
332+
if (rc < 0)
333+
return rc;
330334
kvm_s390_set_psw_cc(vcpu, rc);
331335
return 0;
332336
}
@@ -390,12 +394,12 @@ static int handle_sske(struct kvm_vcpu *vcpu)
390394
FAULT_FLAG_WRITE, &unlocked);
391395
rc = !rc ? -EAGAIN : rc;
392396
}
397+
up_read(&current->mm->mmap_sem);
393398
if (rc == -EFAULT)
394399
return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
395-
396-
up_read(&current->mm->mmap_sem);
397-
if (rc >= 0)
398-
start += PAGE_SIZE;
400+
if (rc < 0)
401+
return rc;
402+
start += PAGE_SIZE;
399403
}
400404

401405
if (m3 & (SSKE_MC | SSKE_MR)) {
@@ -1002,13 +1006,15 @@ static int handle_pfmf(struct kvm_vcpu *vcpu)
10021006
FAULT_FLAG_WRITE, &unlocked);
10031007
rc = !rc ? -EAGAIN : rc;
10041008
}
1009+
up_read(&current->mm->mmap_sem);
10051010
if (rc == -EFAULT)
10061011
return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
1007-
1008-
up_read(&current->mm->mmap_sem);
1009-
if (rc >= 0)
1010-
start += PAGE_SIZE;
1012+
if (rc == -EAGAIN)
1013+
continue;
1014+
if (rc < 0)
1015+
return rc;
10111016
}
1017+
start += PAGE_SIZE;
10121018
}
10131019
if (vcpu->run->s.regs.gprs[reg1] & PFMF_FSC) {
10141020
if (psw_bits(vcpu->arch.sie_block->gpsw).eaba == PSW_BITS_AMODE_64BIT) {

‎arch/s390/kvm/vsie.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,8 @@ static int shadow_crycb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
173173
return set_validity_icpt(scb_s, 0x0039U);
174174

175175
/* copy only the wrapping keys */
176-
if (read_guest_real(vcpu, crycb_addr + 72, &vsie_page->crycb, 56))
176+
if (read_guest_real(vcpu, crycb_addr + 72,
177+
vsie_page->crycb.dea_wrapping_key_mask, 56))
177178
return set_validity_icpt(scb_s, 0x0035U);
178179

179180
scb_s->ecb3 |= ecb3_flags;

‎arch/x86/include/asm/kvm_host.h

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1237,19 +1237,12 @@ enum emulation_result {
12371237
#define EMULTYPE_NO_DECODE (1 << 0)
12381238
#define EMULTYPE_TRAP_UD (1 << 1)
12391239
#define EMULTYPE_SKIP (1 << 2)
1240-
#define EMULTYPE_RETRY (1 << 3)
1241-
#define EMULTYPE_NO_REEXECUTE (1 << 4)
1242-
#define EMULTYPE_NO_UD_ON_FAIL (1 << 5)
1243-
#define EMULTYPE_VMWARE (1 << 6)
1244-
int x86_emulate_instruction(struct kvm_vcpu *vcpu, unsigned long cr2,
1245-
int emulation_type, void *insn, int insn_len);
1246-
1247-
static inline int emulate_instruction(struct kvm_vcpu *vcpu,
1248-
int emulation_type)
1249-
{
1250-
return x86_emulate_instruction(vcpu, 0,
1251-
emulation_type | EMULTYPE_NO_REEXECUTE, NULL, 0);
1252-
}
1240+
#define EMULTYPE_ALLOW_RETRY (1 << 3)
1241+
#define EMULTYPE_NO_UD_ON_FAIL (1 << 4)
1242+
#define EMULTYPE_VMWARE (1 << 5)
1243+
int kvm_emulate_instruction(struct kvm_vcpu *vcpu, int emulation_type);
1244+
int kvm_emulate_instruction_from_buffer(struct kvm_vcpu *vcpu,
1245+
void *insn, int insn_len);
12531246

12541247
void kvm_enable_efer_bits(u64);
12551248
bool kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer);
@@ -1450,7 +1443,6 @@ asmlinkage void kvm_spurious_fault(void);
14501443
____kvm_handle_fault_on_reboot(insn, "")
14511444

14521445
#define KVM_ARCH_WANT_MMU_NOTIFIER
1453-
int kvm_unmap_hva(struct kvm *kvm, unsigned long hva);
14541446
int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end);
14551447
int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end);
14561448
int kvm_test_age_hva(struct kvm *kvm, unsigned long hva);
@@ -1463,7 +1455,7 @@ void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event);
14631455
void kvm_vcpu_reload_apic_access_page(struct kvm_vcpu *vcpu);
14641456

14651457
int kvm_pv_send_ipi(struct kvm *kvm, unsigned long ipi_bitmap_low,
1466-
unsigned long ipi_bitmap_high, int min,
1458+
unsigned long ipi_bitmap_high, u32 min,
14671459
unsigned long icr, int op_64_bit);
14681460

14691461
u64 kvm_get_arch_capabilities(void);

‎arch/x86/kvm/lapic.c

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -548,7 +548,7 @@ int kvm_apic_set_irq(struct kvm_vcpu *vcpu, struct kvm_lapic_irq *irq,
548548
}
549549

550550
int kvm_pv_send_ipi(struct kvm *kvm, unsigned long ipi_bitmap_low,
551-
unsigned long ipi_bitmap_high, int min,
551+
unsigned long ipi_bitmap_high, u32 min,
552552
unsigned long icr, int op_64_bit)
553553
{
554554
int i;
@@ -571,18 +571,31 @@ int kvm_pv_send_ipi(struct kvm *kvm, unsigned long ipi_bitmap_low,
571571
rcu_read_lock();
572572
map = rcu_dereference(kvm->arch.apic_map);
573573

574+
if (min > map->max_apic_id)
575+
goto out;
574576
/* Bits above cluster_size are masked in the caller. */
575-
for_each_set_bit(i, &ipi_bitmap_low, BITS_PER_LONG) {
576-
vcpu = map->phys_map[min + i]->vcpu;
577-
count += kvm_apic_set_irq(vcpu, &irq, NULL);
577+
for_each_set_bit(i, &ipi_bitmap_low,
578+
min((u32)BITS_PER_LONG, (map->max_apic_id - min + 1))) {
579+
if (map->phys_map[min + i]) {
580+
vcpu = map->phys_map[min + i]->vcpu;
581+
count += kvm_apic_set_irq(vcpu, &irq, NULL);
582+
}
578583
}
579584

580585
min += cluster_size;
581-
for_each_set_bit(i, &ipi_bitmap_high, BITS_PER_LONG) {
582-
vcpu = map->phys_map[min + i]->vcpu;
583-
count += kvm_apic_set_irq(vcpu, &irq, NULL);
586+
587+
if (min > map->max_apic_id)
588+
goto out;
589+
590+
for_each_set_bit(i, &ipi_bitmap_high,
591+
min((u32)BITS_PER_LONG, (map->max_apic_id - min + 1))) {
592+
if (map->phys_map[min + i]) {
593+
vcpu = map->phys_map[min + i]->vcpu;
594+
count += kvm_apic_set_irq(vcpu, &irq, NULL);
595+
}
584596
}
585597

598+
out:
586599
rcu_read_unlock();
587600
return count;
588601
}

‎arch/x86/kvm/mmu.c

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1853,11 +1853,6 @@ static int kvm_handle_hva(struct kvm *kvm, unsigned long hva,
18531853
return kvm_handle_hva_range(kvm, hva, hva + 1, data, handler);
18541854
}
18551855

1856-
int kvm_unmap_hva(struct kvm *kvm, unsigned long hva)
1857-
{
1858-
return kvm_handle_hva(kvm, hva, 0, kvm_unmap_rmapp);
1859-
}
1860-
18611856
int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end)
18621857
{
18631858
return kvm_handle_hva_range(kvm, start, end, 0, kvm_unmap_rmapp);
@@ -5217,7 +5212,7 @@ static int make_mmu_pages_available(struct kvm_vcpu *vcpu)
52175212
int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u64 error_code,
52185213
void *insn, int insn_len)
52195214
{
5220-
int r, emulation_type = EMULTYPE_RETRY;
5215+
int r, emulation_type = 0;
52215216
enum emulation_result er;
52225217
bool direct = vcpu->arch.mmu.direct_map;
52235218

@@ -5230,10 +5225,8 @@ int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u64 error_code,
52305225
r = RET_PF_INVALID;
52315226
if (unlikely(error_code & PFERR_RSVD_MASK)) {
52325227
r = handle_mmio_page_fault(vcpu, cr2, direct);
5233-
if (r == RET_PF_EMULATE) {
5234-
emulation_type = 0;
5228+
if (r == RET_PF_EMULATE)
52355229
goto emulate;
5236-
}
52375230
}
52385231

52395232
if (r == RET_PF_INVALID) {
@@ -5260,8 +5253,19 @@ int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u64 error_code,
52605253
return 1;
52615254
}
52625255

5263-
if (mmio_info_in_cache(vcpu, cr2, direct))
5264-
emulation_type = 0;
5256+
/*
5257+
* vcpu->arch.mmu.page_fault returned RET_PF_EMULATE, but we can still
5258+
* optimistically try to just unprotect the page and let the processor
5259+
* re-execute the instruction that caused the page fault. Do not allow
5260+
* retrying MMIO emulation, as it's not only pointless but could also
5261+
* cause us to enter an infinite loop because the processor will keep
5262+
* faulting on the non-existent MMIO address. Retrying an instruction
5263+
* from a nested guest is also pointless and dangerous as we are only
5264+
* explicitly shadowing L1's page tables, i.e. unprotecting something
5265+
* for L1 isn't going to magically fix whatever issue cause L2 to fail.
5266+
*/
5267+
if (!mmio_info_in_cache(vcpu, cr2, direct) && !is_guest_mode(vcpu))
5268+
emulation_type = EMULTYPE_ALLOW_RETRY;
52655269
emulate:
52665270
/*
52675271
* On AMD platforms, under certain conditions insn_len may be zero on #NPF.

0 commit comments

Comments
 (0)