Commit d8242d22 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm 

Pull kvm fixes from Paolo Bonzini:
 "Bugfixes, many of them reported by syzkaller and mostly predating the
  merge window"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  kvm: svm: Ensure an IBPB on all affected CPUs when freeing a vmcb
  kvm: mmu: Fix race in emulated page table writes
  KVM: nVMX: vmcs12 revision_id is always VMCS12_REVISION even when copied from eVMCS
  KVM: nVMX: Verify eVMCS revision id match supported eVMCS version on eVMCS VMPTRLD
  KVM: nVMX/nSVM: Fix bug which sets vcpu->arch.tsc_offset to L1 tsc_offset
  x86/kvm/vmx: fix old-style function declaration
  KVM: x86: fix empty-body warnings
  KVM: VMX: Update shared MSRs to be saved/restored on MSR_EFER.LMA changes
  KVM: x86: Fix kernel info-leak in KVM_HC_CLOCK_PAIRING hypercall
  KVM: nVMX: Fix kernel info-leak when enabling KVM_CAP_HYPERV_ENLIGHTENED_VMCS more than once
  svm: Add mutex_lock to protect apic_access_page_done on AMD systems
  KVM: X86: Fix scan ioapic use-before-initialization
  KVM: LAPIC: Fix pv ipis use-before-initialization
  KVM: VMX: re-add ple_gap module parameter
  KVM: PPC: Book3S HV: Fix handling for interrupted H_ENTER_NESTED
parents ef78e5ec fd65d314

arch/powerpc/kvm/book3s_hv.c

+1 −0
Original line number Diff line number Diff line
@@ -983,6 +983,7 @@ int kvmppc_pseries_do_hcall(struct kvm_vcpu *vcpu) 
		ret = kvmhv_enter_nested_guest(vcpu);

		if (ret == H_INTERRUPT) {

			kvmppc_set_gpr(vcpu, 3, 0);

			vcpu->arch.hcall_needed = 0;

			return -EINTR;

		}

		break;

arch/x86/include/asm/kvm_host.h

+2 −1
Original line number Diff line number Diff line
@@ -1094,7 +1094,8 @@ struct kvm_x86_ops { 
	bool (*has_wbinvd_exit)(void);



	u64 (*read_l1_tsc_offset)(struct kvm_vcpu *vcpu);

	void (*write_tsc_offset)(struct kvm_vcpu *vcpu, u64 offset);

	/* Returns actual tsc_offset set in active VMCS */

	u64 (*write_l1_tsc_offset)(struct kvm_vcpu *vcpu, u64 offset);



	void (*get_exit_info)(struct kvm_vcpu *vcpu, u64 *info1, u64 *info2);

arch/x86/kvm/lapic.c

+6 −1
Original line number Diff line number Diff line
@@ -55,7 +55,7 @@ 
#define PRIo64 "o"



/* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */

#define apic_debug(fmt, arg...)

#define apic_debug(fmt, arg...) do {} while (0)



/* 14 is the version for Xeon and Pentium 8.4.8*/

#define APIC_VERSION			(0x14UL | ((KVM_APIC_LVT_NUM - 1) << 16))
@@ -576,6 +576,11 @@ int kvm_pv_send_ipi(struct kvm *kvm, unsigned long ipi_bitmap_low, 
	rcu_read_lock();

	map = rcu_dereference(kvm->arch.apic_map);



	if (unlikely(!map)) {

		count = -EOPNOTSUPP;

		goto out;

	}



	if (min > map->max_apic_id)

		goto out;

	/* Bits above cluster_size are masked in the caller.  */

arch/x86/kvm/mmu.c

+9 −18
Original line number Diff line number Diff line
@@ -5074,9 +5074,9 @@ static bool need_remote_flush(u64 old, u64 new) 
}



static u64 mmu_pte_write_fetch_gpte(struct kvm_vcpu *vcpu, gpa_t *gpa,

				    const u8 *new, int *bytes)

				    int *bytes)

{

	u64 gentry;

	u64 gentry = 0;

	int r;



	/*
@@ -5088,22 +5088,12 @@ static u64 mmu_pte_write_fetch_gpte(struct kvm_vcpu *vcpu, gpa_t *gpa, 
		/* Handle a 32-bit guest writing two halves of a 64-bit gpte */

		*gpa &= ~(gpa_t)7;

		*bytes = 8;

		r = kvm_vcpu_read_guest(vcpu, *gpa, &gentry, 8);

		if (r)

			gentry = 0;

		new = (const u8 *)&gentry;

	}



	switch (*bytes) {

	case 4:

		gentry = *(const u32 *)new;

		break;

	case 8:

		gentry = *(const u64 *)new;

		break;

	default:

	if (*bytes == 4 || *bytes == 8) {

		r = kvm_vcpu_read_guest_atomic(vcpu, *gpa, &gentry, *bytes);

		if (r)

			gentry = 0;

		break;

	}



	return gentry;
@@ -5207,8 +5197,6 @@ static void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa, 


	pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);



	gentry = mmu_pte_write_fetch_gpte(vcpu, &gpa, new, &bytes);



	/*

	 * No need to care whether allocation memory is successful

	 * or not since pte prefetch is skiped if it does not have
@@ -5217,6 +5205,9 @@ static void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa, 
	mmu_topup_memory_caches(vcpu);



	spin_lock(&vcpu->kvm->mmu_lock);



	gentry = mmu_pte_write_fetch_gpte(vcpu, &gpa, &bytes);



	++vcpu->kvm->stat.mmu_pte_write;

	kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE);

arch/x86/kvm/svm.c

+29 −15
Original line number Diff line number Diff line
@@ -1446,7 +1446,7 @@ static u64 svm_read_l1_tsc_offset(struct kvm_vcpu *vcpu) 
	return vcpu->arch.tsc_offset;

}



static void svm_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)

static u64 svm_write_l1_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)

{

	struct vcpu_svm *svm = to_svm(vcpu);

	u64 g_tsc_offset = 0;
@@ -1464,6 +1464,7 @@ static void svm_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset) 
	svm->vmcb->control.tsc_offset = offset + g_tsc_offset;



	mark_dirty(svm->vmcb, VMCB_INTERCEPTS);

	return svm->vmcb->control.tsc_offset;

}



static void avic_init_vmcb(struct vcpu_svm *svm)
@@ -1664,20 +1665,23 @@ static u64 *avic_get_physical_id_entry(struct kvm_vcpu *vcpu, 
static int avic_init_access_page(struct kvm_vcpu *vcpu)

{

	struct kvm *kvm = vcpu->kvm;

	int ret;

	int ret = 0;



	mutex_lock(&kvm->slots_lock);

	if (kvm->arch.apic_access_page_done)

		return 0;

		goto out;



	ret = x86_set_memory_region(kvm,

	ret = __x86_set_memory_region(kvm,

				      APIC_ACCESS_PAGE_PRIVATE_MEMSLOT,

				      APIC_DEFAULT_PHYS_BASE,

				      PAGE_SIZE);

	if (ret)

		return ret;

		goto out;



	kvm->arch.apic_access_page_done = true;

	return 0;

out:

	mutex_unlock(&kvm->slots_lock);

	return ret;

}



static int avic_init_backing_page(struct kvm_vcpu *vcpu)
@@ -2189,21 +2193,31 @@ out: 
	return ERR_PTR(err);

}



static void svm_clear_current_vmcb(struct vmcb *vmcb)

{

	int i;



	for_each_online_cpu(i)

		cmpxchg(&per_cpu(svm_data, i)->current_vmcb, vmcb, NULL);

}



static void svm_free_vcpu(struct kvm_vcpu *vcpu)

{

	struct vcpu_svm *svm = to_svm(vcpu);



	/*

	 * The vmcb page can be recycled, causing a false negative in

	 * svm_vcpu_load(). So, ensure that no logical CPU has this

	 * vmcb page recorded as its current vmcb.

	 */

	svm_clear_current_vmcb(svm->vmcb);



	__free_page(pfn_to_page(__sme_clr(svm->vmcb_pa) >> PAGE_SHIFT));

	__free_pages(virt_to_page(svm->msrpm), MSRPM_ALLOC_ORDER);

	__free_page(virt_to_page(svm->nested.hsave));

	__free_pages(virt_to_page(svm->nested.msrpm), MSRPM_ALLOC_ORDER);

	kvm_vcpu_uninit(vcpu);

	kmem_cache_free(kvm_vcpu_cache, svm);

	/*

	 * The vmcb page can be recycled, causing a false negative in

	 * svm_vcpu_load(). So do a full IBPB now.

	 */

	indirect_branch_prediction_barrier();

}



static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
@@ -7149,7 +7163,7 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = { 
	.has_wbinvd_exit = svm_has_wbinvd_exit,



	.read_l1_tsc_offset = svm_read_l1_tsc_offset,

	.write_tsc_offset = svm_write_tsc_offset,

	.write_l1_tsc_offset = svm_write_l1_tsc_offset,



	.set_tdp_cr3 = set_tdp_cr3,

CRA Git | Maintained and supported by SUSTech CRA and CCSE