Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull KVM fixes from Radim Krčmář:
"MIPS:
- Fix build with KVM, DYNAMIC_DEBUG and JUMP_LABEL.

PPC:
- Fix host crashes/hangs on POWER9.
- Properly restore userspace state after KVM_RUN ioctl.

s390:
- Fix address translation in odd-ball cases (real-space designation
ASCEs).

x86:
- Fix privilege escalation in 64-bit Windows guests

All patches are for stable and the x86 also has a CVE"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: x86: fix singlestepping over syscall
KVM: s390: gaccess: fix real-space designation asce handling for gmap shadows
KVM: MIPS: Fix maybe-uninitialized build failure
KVM: PPC: Book3S HV: Ignore timebase offset on POWER9 DD1
KVM: PPC: Book3S HV: Save/restore host values of debug registers
KVM: PPC: Book3S HV: Preserve userspace HTM state properly
KVM: PPC: Book3S HV: Restore critical SPRs to host values on guest exit
KVM: PPC: Book3S HV: Context-switch EBB registers properly
KVM: PPC: Book3S HV: Cope with host using large decrementer mode

+163 -60
+5 -1
arch/mips/kvm/tlb.c
··· 166 166 int kvm_mips_host_tlb_inv(struct kvm_vcpu *vcpu, unsigned long va, 167 167 bool user, bool kernel) 168 168 { 169 - int idx_user, idx_kernel; 169 + /* 170 + * Initialize idx_user and idx_kernel to workaround bogus 171 + * maybe-initialized warning when using GCC 6. 172 + */ 173 + int idx_user = 0, idx_kernel = 0; 170 174 unsigned long flags, old_entryhi; 171 175 172 176 local_irq_save(flags);
+51
arch/powerpc/kvm/book3s_hv.c
··· 1486 1486 r = set_vpa(vcpu, &vcpu->arch.dtl, addr, len); 1487 1487 break; 1488 1488 case KVM_REG_PPC_TB_OFFSET: 1489 + /* 1490 + * POWER9 DD1 has an erratum where writing TBU40 causes 1491 + * the timebase to lose ticks. So we don't let the 1492 + * timebase offset be changed on P9 DD1. (It is 1493 + * initialized to zero.) 1494 + */ 1495 + if (cpu_has_feature(CPU_FTR_POWER9_DD1)) 1496 + break; 1489 1497 /* round up to multiple of 2^24 */ 1490 1498 vcpu->arch.vcore->tb_offset = 1491 1499 ALIGN(set_reg_val(id, *val), 1UL << 24); ··· 2915 2907 { 2916 2908 int r; 2917 2909 int srcu_idx; 2910 + unsigned long ebb_regs[3] = {}; /* shut up GCC */ 2911 + unsigned long user_tar = 0; 2912 + unsigned int user_vrsave; 2918 2913 2919 2914 if (!vcpu->arch.sane) { 2920 2915 run->exit_reason = KVM_EXIT_INTERNAL_ERROR; 2921 2916 return -EINVAL; 2922 2917 } 2918 + 2919 + /* 2920 + * Don't allow entry with a suspended transaction, because 2921 + * the guest entry/exit code will lose it. 2922 + * If the guest has TM enabled, save away their TM-related SPRs 2923 + * (they will get restored by the TM unavailable interrupt). 2924 + */ 2925 + #ifdef CONFIG_PPC_TRANSACTIONAL_MEM 2926 + if (cpu_has_feature(CPU_FTR_TM) && current->thread.regs && 2927 + (current->thread.regs->msr & MSR_TM)) { 2928 + if (MSR_TM_ACTIVE(current->thread.regs->msr)) { 2929 + run->exit_reason = KVM_EXIT_FAIL_ENTRY; 2930 + run->fail_entry.hardware_entry_failure_reason = 0; 2931 + return -EINVAL; 2932 + } 2933 + current->thread.tm_tfhar = mfspr(SPRN_TFHAR); 2934 + current->thread.tm_tfiar = mfspr(SPRN_TFIAR); 2935 + current->thread.tm_texasr = mfspr(SPRN_TEXASR); 2936 + current->thread.regs->msr &= ~MSR_TM; 2937 + } 2938 + #endif 2923 2939 2924 2940 kvmppc_core_prepare_to_enter(vcpu); 2925 2941 ··· 2965 2933 } 2966 2934 2967 2935 flush_all_to_thread(current); 2936 + 2937 + /* Save userspace EBB and other register values */ 2938 + if (cpu_has_feature(CPU_FTR_ARCH_207S)) { 2939 + ebb_regs[0] = mfspr(SPRN_EBBHR); 2940 + ebb_regs[1] = mfspr(SPRN_EBBRR); 2941 + ebb_regs[2] = mfspr(SPRN_BESCR); 2942 + user_tar = mfspr(SPRN_TAR); 2943 + } 2944 + user_vrsave = mfspr(SPRN_VRSAVE); 2968 2945 2969 2946 vcpu->arch.wqp = &vcpu->arch.vcore->wq; 2970 2947 vcpu->arch.pgdir = current->mm->pgd; ··· 3000 2959 r = kvmppc_xics_rm_complete(vcpu, 0); 3001 2960 } 3002 2961 } while (is_kvmppc_resume_guest(r)); 2962 + 2963 + /* Restore userspace EBB and other register values */ 2964 + if (cpu_has_feature(CPU_FTR_ARCH_207S)) { 2965 + mtspr(SPRN_EBBHR, ebb_regs[0]); 2966 + mtspr(SPRN_EBBRR, ebb_regs[1]); 2967 + mtspr(SPRN_BESCR, ebb_regs[2]); 2968 + mtspr(SPRN_TAR, user_tar); 2969 + mtspr(SPRN_FSCR, current->thread.fscr); 2970 + } 2971 + mtspr(SPRN_VRSAVE, user_vrsave); 3003 2972 3004 2973 out: 3005 2974 vcpu->arch.state = KVMPPC_VCPU_NOTREADY;
+11 -1
arch/powerpc/kvm/book3s_hv_interrupts.S
··· 121 121 * Put whatever is in the decrementer into the 122 122 * hypervisor decrementer. 123 123 */ 124 + BEGIN_FTR_SECTION 125 + ld r5, HSTATE_KVM_VCORE(r13) 126 + ld r6, VCORE_KVM(r5) 127 + ld r9, KVM_HOST_LPCR(r6) 128 + andis. r9, r9, LPCR_LD@h 129 + END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300) 124 130 mfspr r8,SPRN_DEC 125 131 mftb r7 126 - mtspr SPRN_HDEC,r8 132 + BEGIN_FTR_SECTION 133 + /* On POWER9, don't sign-extend if host LPCR[LD] bit is set */ 134 + bne 32f 135 + END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300) 127 136 extsw r8,r8 137 + 32: mtspr SPRN_HDEC,r8 128 138 add r8,r8,r7 129 139 std r8,HSTATE_DECEXP(r13) 130 140
+56 -19
arch/powerpc/kvm/book3s_hv_rmhandlers.S
··· 32 32 #include <asm/opal.h> 33 33 #include <asm/xive-regs.h> 34 34 35 + /* Sign-extend HDEC if not on POWER9 */ 36 + #define EXTEND_HDEC(reg) \ 37 + BEGIN_FTR_SECTION; \ 38 + extsw reg, reg; \ 39 + END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_300) 40 + 35 41 #define VCPU_GPRS_TM(reg) (((reg) * ULONG_SIZE) + VCPU_GPR_TM) 36 42 37 43 /* Values in HSTATE_NAPPING(r13) */ 38 44 #define NAPPING_CEDE 1 39 45 #define NAPPING_NOVCPU 2 46 + 47 + /* Stack frame offsets for kvmppc_hv_entry */ 48 + #define SFS 144 49 + #define STACK_SLOT_TRAP (SFS-4) 50 + #define STACK_SLOT_TID (SFS-16) 51 + #define STACK_SLOT_PSSCR (SFS-24) 52 + #define STACK_SLOT_PID (SFS-32) 53 + #define STACK_SLOT_IAMR (SFS-40) 54 + #define STACK_SLOT_CIABR (SFS-48) 55 + #define STACK_SLOT_DAWR (SFS-56) 56 + #define STACK_SLOT_DAWRX (SFS-64) 40 57 41 58 /* 42 59 * Call kvmppc_hv_entry in real mode. ··· 231 214 kvmppc_primary_no_guest: 232 215 /* We handle this much like a ceded vcpu */ 233 216 /* put the HDEC into the DEC, since HDEC interrupts don't wake us */ 217 + /* HDEC may be larger than DEC for arch >= v3.00, but since the */ 218 + /* HDEC value came from DEC in the first place, it will fit */ 234 219 mfspr r3, SPRN_HDEC 235 220 mtspr SPRN_DEC, r3 236 221 /* ··· 314 295 315 296 /* See if our timeslice has expired (HDEC is negative) */ 316 297 mfspr r0, SPRN_HDEC 298 + EXTEND_HDEC(r0) 317 299 li r12, BOOK3S_INTERRUPT_HV_DECREMENTER 318 - cmpwi r0, 0 300 + cmpdi r0, 0 319 301 blt kvm_novcpu_exit 320 302 321 303 /* Got an IPI but other vcpus aren't yet exiting, must be a latecomer */ ··· 339 319 bl kvmhv_accumulate_time 340 320 #endif 341 321 13: mr r3, r12 342 - stw r12, 112-4(r1) 322 + stw r12, STACK_SLOT_TRAP(r1) 343 323 bl kvmhv_commence_exit 344 324 nop 345 - lwz r12, 112-4(r1) 325 + lwz r12, STACK_SLOT_TRAP(r1) 346 326 b kvmhv_switch_to_host 347 327 348 328 /* ··· 410 390 lbz r4, HSTATE_PTID(r13) 411 391 cmpwi r4, 0 412 392 bne 63f 413 - lis r6, 0x7fff 414 - ori r6, r6, 0xffff 393 + LOAD_REG_ADDR(r6, decrementer_max) 394 + ld r6, 0(r6) 415 395 mtspr SPRN_HDEC, r6 416 396 /* and set per-LPAR registers, if doing dynamic micro-threading */ 417 397 ld r6, HSTATE_SPLIT_MODE(r13) ··· 565 545 * * 566 546 *****************************************************************************/ 567 547 568 - /* Stack frame offsets */ 569 - #define STACK_SLOT_TID (112-16) 570 - #define STACK_SLOT_PSSCR (112-24) 571 - #define STACK_SLOT_PID (112-32) 572 - 573 548 .global kvmppc_hv_entry 574 549 kvmppc_hv_entry: 575 550 ··· 580 565 */ 581 566 mflr r0 582 567 std r0, PPC_LR_STKOFF(r1) 583 - stdu r1, -112(r1) 568 + stdu r1, -SFS(r1) 584 569 585 570 /* Save R1 in the PACA */ 586 571 std r1, HSTATE_HOST_R1(r13) ··· 764 749 mfspr r5, SPRN_TIDR 765 750 mfspr r6, SPRN_PSSCR 766 751 mfspr r7, SPRN_PID 752 + mfspr r8, SPRN_IAMR 767 753 std r5, STACK_SLOT_TID(r1) 768 754 std r6, STACK_SLOT_PSSCR(r1) 769 755 std r7, STACK_SLOT_PID(r1) 756 + std r8, STACK_SLOT_IAMR(r1) 770 757 END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300) 758 + BEGIN_FTR_SECTION 759 + mfspr r5, SPRN_CIABR 760 + mfspr r6, SPRN_DAWR 761 + mfspr r7, SPRN_DAWRX 762 + std r5, STACK_SLOT_CIABR(r1) 763 + std r6, STACK_SLOT_DAWR(r1) 764 + std r7, STACK_SLOT_DAWRX(r1) 765 + END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S) 771 766 772 767 BEGIN_FTR_SECTION 773 768 /* Set partition DABR */ ··· 993 968 994 969 /* Check if HDEC expires soon */ 995 970 mfspr r3, SPRN_HDEC 996 - cmpwi r3, 512 /* 1 microsecond */ 971 + EXTEND_HDEC(r3) 972 + cmpdi r3, 512 /* 1 microsecond */ 997 973 blt hdec_soon 998 974 999 975 #ifdef CONFIG_KVM_XICS ··· 1531 1505 * set by the guest could disrupt the host. 1532 1506 */ 1533 1507 li r0, 0 1534 - mtspr SPRN_IAMR, r0 1535 - mtspr SPRN_CIABR, r0 1536 - mtspr SPRN_DAWRX, r0 1508 + mtspr SPRN_PSPB, r0 1537 1509 mtspr SPRN_WORT, r0 1538 1510 BEGIN_FTR_SECTION 1511 + mtspr SPRN_IAMR, r0 1539 1512 mtspr SPRN_TCSCR, r0 1540 1513 /* Set MMCRS to 1<<31 to freeze and disable the SPMC counters */ 1541 1514 li r0, 1 ··· 1550 1525 std r6,VCPU_UAMOR(r9) 1551 1526 li r6,0 1552 1527 mtspr SPRN_AMR,r6 1528 + mtspr SPRN_UAMOR, r6 1553 1529 1554 1530 /* Switch DSCR back to host value */ 1555 1531 mfspr r8, SPRN_DSCR ··· 1696 1670 1697 1671 /* Restore host values of some registers */ 1698 1672 BEGIN_FTR_SECTION 1673 + ld r5, STACK_SLOT_CIABR(r1) 1674 + ld r6, STACK_SLOT_DAWR(r1) 1675 + ld r7, STACK_SLOT_DAWRX(r1) 1676 + mtspr SPRN_CIABR, r5 1677 + mtspr SPRN_DAWR, r6 1678 + mtspr SPRN_DAWRX, r7 1679 + END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S) 1680 + BEGIN_FTR_SECTION 1699 1681 ld r5, STACK_SLOT_TID(r1) 1700 1682 ld r6, STACK_SLOT_PSSCR(r1) 1701 1683 ld r7, STACK_SLOT_PID(r1) 1684 + ld r8, STACK_SLOT_IAMR(r1) 1702 1685 mtspr SPRN_TIDR, r5 1703 1686 mtspr SPRN_PSSCR, r6 1704 1687 mtspr SPRN_PID, r7 1688 + mtspr SPRN_IAMR, r8 1705 1689 END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300) 1706 1690 BEGIN_FTR_SECTION 1707 1691 PPC_INVALIDATE_ERAT ··· 1855 1819 li r0, KVM_GUEST_MODE_NONE 1856 1820 stb r0, HSTATE_IN_GUEST(r13) 1857 1821 1858 - ld r0, 112+PPC_LR_STKOFF(r1) 1859 - addi r1, r1, 112 1822 + ld r0, SFS+PPC_LR_STKOFF(r1) 1823 + addi r1, r1, SFS 1860 1824 mtlr r0 1861 1825 blr 1862 1826 ··· 2402 2366 mfspr r3, SPRN_DEC 2403 2367 mfspr r4, SPRN_HDEC 2404 2368 mftb r5 2405 - cmpw r3, r4 2369 + extsw r3, r3 2370 + EXTEND_HDEC(r4) 2371 + cmpd r3, r4 2406 2372 ble 67f 2407 2373 mtspr SPRN_DEC, r4 2408 2374 67: 2409 2375 /* save expiry time of guest decrementer */ 2410 - extsw r3, r3 2411 2376 add r3, r3, r5 2412 2377 ld r4, HSTATE_KVM_VCPU(r13) 2413 2378 ld r5, HSTATE_KVM_VCORE(r13)
+6 -9
arch/s390/kvm/gaccess.c
··· 977 977 ptr = asce.origin * 4096; 978 978 if (asce.r) { 979 979 *fake = 1; 980 + ptr = 0; 980 981 asce.dt = ASCE_TYPE_REGION1; 981 982 } 982 983 switch (asce.dt) { 983 984 case ASCE_TYPE_REGION1: 984 - if (vaddr.rfx01 > asce.tl && !asce.r) 985 + if (vaddr.rfx01 > asce.tl && !*fake) 985 986 return PGM_REGION_FIRST_TRANS; 986 987 break; 987 988 case ASCE_TYPE_REGION2: ··· 1010 1009 union region1_table_entry rfte; 1011 1010 1012 1011 if (*fake) { 1013 - /* offset in 16EB guest memory block */ 1014 - ptr = ptr + ((unsigned long) vaddr.rsx << 53UL); 1012 + ptr += (unsigned long) vaddr.rfx << 53; 1015 1013 rfte.val = ptr; 1016 1014 goto shadow_r2t; 1017 1015 } ··· 1036 1036 union region2_table_entry rste; 1037 1037 1038 1038 if (*fake) { 1039 - /* offset in 8PB guest memory block */ 1040 - ptr = ptr + ((unsigned long) vaddr.rtx << 42UL); 1039 + ptr += (unsigned long) vaddr.rsx << 42; 1041 1040 rste.val = ptr; 1042 1041 goto shadow_r3t; 1043 1042 } ··· 1063 1064 union region3_table_entry rtte; 1064 1065 1065 1066 if (*fake) { 1066 - /* offset in 4TB guest memory block */ 1067 - ptr = ptr + ((unsigned long) vaddr.sx << 31UL); 1067 + ptr += (unsigned long) vaddr.rtx << 31; 1068 1068 rtte.val = ptr; 1069 1069 goto shadow_sgt; 1070 1070 } ··· 1099 1101 union segment_table_entry ste; 1100 1102 1101 1103 if (*fake) { 1102 - /* offset in 2G guest memory block */ 1103 - ptr = ptr + ((unsigned long) vaddr.sx << 20UL); 1104 + ptr += (unsigned long) vaddr.sx << 20; 1104 1105 ste.val = ptr; 1105 1106 goto shadow_pgt; 1106 1107 }
+1
arch/x86/include/asm/kvm_emulate.h
··· 296 296 297 297 bool perm_ok; /* do not check permissions if true */ 298 298 bool ud; /* inject an #UD if host doesn't support insn */ 299 + bool tf; /* TF value before instruction (after for syscall/sysret) */ 299 300 300 301 bool have_exception; 301 302 struct x86_exception exception;
+1
arch/x86/kvm/emulate.c
··· 2742 2742 ctxt->eflags &= ~(X86_EFLAGS_VM | X86_EFLAGS_IF); 2743 2743 } 2744 2744 2745 + ctxt->tf = (ctxt->eflags & X86_EFLAGS_TF) != 0; 2745 2746 return X86EMUL_CONTINUE; 2746 2747 } 2747 2748
+32 -30
arch/x86/kvm/x86.c
··· 5313 5313 kvm_x86_ops->get_cs_db_l_bits(vcpu, &cs_db, &cs_l); 5314 5314 5315 5315 ctxt->eflags = kvm_get_rflags(vcpu); 5316 + ctxt->tf = (ctxt->eflags & X86_EFLAGS_TF) != 0; 5317 + 5316 5318 ctxt->eip = kvm_rip_read(vcpu); 5317 5319 ctxt->mode = (!is_protmode(vcpu)) ? X86EMUL_MODE_REAL : 5318 5320 (ctxt->eflags & X86_EFLAGS_VM) ? X86EMUL_MODE_VM86 : ··· 5530 5528 return dr6; 5531 5529 } 5532 5530 5533 - static void kvm_vcpu_check_singlestep(struct kvm_vcpu *vcpu, unsigned long rflags, int *r) 5531 + static void kvm_vcpu_do_singlestep(struct kvm_vcpu *vcpu, int *r) 5534 5532 { 5535 5533 struct kvm_run *kvm_run = vcpu->run; 5536 5534 5537 - /* 5538 - * rflags is the old, "raw" value of the flags. The new value has 5539 - * not been saved yet. 5540 - * 5541 - * This is correct even for TF set by the guest, because "the 5542 - * processor will not generate this exception after the instruction 5543 - * that sets the TF flag". 5544 - */ 5545 - if (unlikely(rflags & X86_EFLAGS_TF)) { 5546 - if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) { 5547 - kvm_run->debug.arch.dr6 = DR6_BS | DR6_FIXED_1 | 5548 - DR6_RTM; 5549 - kvm_run->debug.arch.pc = vcpu->arch.singlestep_rip; 5550 - kvm_run->debug.arch.exception = DB_VECTOR; 5551 - kvm_run->exit_reason = KVM_EXIT_DEBUG; 5552 - *r = EMULATE_USER_EXIT; 5553 - } else { 5554 - /* 5555 - * "Certain debug exceptions may clear bit 0-3. The 5556 - * remaining contents of the DR6 register are never 5557 - * cleared by the processor". 5558 - */ 5559 - vcpu->arch.dr6 &= ~15; 5560 - vcpu->arch.dr6 |= DR6_BS | DR6_RTM; 5561 - kvm_queue_exception(vcpu, DB_VECTOR); 5562 - } 5535 + if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) { 5536 + kvm_run->debug.arch.dr6 = DR6_BS | DR6_FIXED_1 | DR6_RTM; 5537 + kvm_run->debug.arch.pc = vcpu->arch.singlestep_rip; 5538 + kvm_run->debug.arch.exception = DB_VECTOR; 5539 + kvm_run->exit_reason = KVM_EXIT_DEBUG; 5540 + *r = EMULATE_USER_EXIT; 5541 + } else { 5542 + /* 5543 + * "Certain debug exceptions may clear bit 0-3. The 5544 + * remaining contents of the DR6 register are never 5545 + * cleared by the processor". 5546 + */ 5547 + vcpu->arch.dr6 &= ~15; 5548 + vcpu->arch.dr6 |= DR6_BS | DR6_RTM; 5549 + kvm_queue_exception(vcpu, DB_VECTOR); 5563 5550 } 5564 5551 } 5565 5552 ··· 5558 5567 int r = EMULATE_DONE; 5559 5568 5560 5569 kvm_x86_ops->skip_emulated_instruction(vcpu); 5561 - kvm_vcpu_check_singlestep(vcpu, rflags, &r); 5570 + 5571 + /* 5572 + * rflags is the old, "raw" value of the flags. The new value has 5573 + * not been saved yet. 5574 + * 5575 + * This is correct even for TF set by the guest, because "the 5576 + * processor will not generate this exception after the instruction 5577 + * that sets the TF flag". 5578 + */ 5579 + if (unlikely(rflags & X86_EFLAGS_TF)) 5580 + kvm_vcpu_do_singlestep(vcpu, &r); 5562 5581 return r == EMULATE_DONE; 5563 5582 } 5564 5583 EXPORT_SYMBOL_GPL(kvm_skip_emulated_instruction); ··· 5727 5726 toggle_interruptibility(vcpu, ctxt->interruptibility); 5728 5727 vcpu->arch.emulate_regs_need_sync_to_vcpu = false; 5729 5728 kvm_rip_write(vcpu, ctxt->eip); 5730 - if (r == EMULATE_DONE) 5731 - kvm_vcpu_check_singlestep(vcpu, rflags, &r); 5729 + if (r == EMULATE_DONE && 5730 + (ctxt->tf || (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP))) 5731 + kvm_vcpu_do_singlestep(vcpu, &r); 5732 5732 if (!ctxt->have_exception || 5733 5733 exception_type(ctxt->exception.vector) == EXCPT_TRAP) 5734 5734 __kvm_set_rflags(vcpu, ctxt->eflags);