Skip to content

L
linux
Commit d1daa545 authored by Paolo Bonzini's avatar Paolo Bonzini Committed by Greg Kroah-Hartman
Browse files
Options

Revert "KVM: Support vCPU-based gfn->hva cache" 

commit 4e335d9e upstream.

This reverts commit bbd64115.

I've been sitting on this revert for too long and it unfortunately
missed 4.11.  It's also the reason why I haven't merged ring-based
dirty tracking for 4.12.

Using kvm_vcpu_memslots in kvm_gfn_to_hva_cache_init and
kvm_vcpu_write_guest_offset_cached means that the MSR value can
now be used to access SMRAM, simply by making it point to an SMRAM
physical address.  This is problematic because it lets the guest
OS overwrite memory that it shouldn't be able to touch.

Fixes: bbd64115Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 2d271c95
Show whitespace changes
Inline Side-by-side
Showing with 58 additions and 55 deletions
arch/x86/kvm/lapic.c
View file @ d1daa545
...@@ -529,13 +529,15 @@ int kvm_apic_set_irq(struct kvm_vcpu *vcpu, struct kvm_lapic_irq *irq, ...@@ -529,13 +529,15 @@ int kvm_apic_set_irq(struct kvm_vcpu *vcpu, struct kvm_lapic_irq *irq,
static int pv_eoi_put_user(struct kvm_vcpu *vcpu, u8 val) static int pv_eoi_put_user(struct kvm_vcpu *vcpu, u8 val)
{ {
return kvm_vcpu_write_guest_cached(vcpu, &vcpu->arch.pv_eoi.data, &val,
return kvm_write_guest_cached(vcpu->kvm, &vcpu->arch.pv_eoi.data, &val,
sizeof(val)); sizeof(val));
} }
static int pv_eoi_get_user(struct kvm_vcpu *vcpu, u8 *val) static int pv_eoi_get_user(struct kvm_vcpu *vcpu, u8 *val)
{ {
return kvm_vcpu_read_guest_cached(vcpu, &vcpu->arch.pv_eoi.data, val,
return kvm_read_guest_cached(vcpu->kvm, &vcpu->arch.pv_eoi.data, val,
sizeof(*val)); sizeof(*val));
} }
...@@ -2285,7 +2287,7 @@ void kvm_lapic_sync_from_vapic(struct kvm_vcpu *vcpu) ...@@ -2285,7 +2287,7 @@ void kvm_lapic_sync_from_vapic(struct kvm_vcpu *vcpu)
if (!test_bit(KVM_APIC_CHECK_VAPIC, &vcpu->arch.apic_attention)) if (!test_bit(KVM_APIC_CHECK_VAPIC, &vcpu->arch.apic_attention))
return; return;
if (kvm_vcpu_read_guest_cached(vcpu, &vcpu->arch.apic->vapic_cache, &data, if (kvm_read_guest_cached(vcpu->kvm, &vcpu->arch.apic->vapic_cache, &data,
sizeof(u32))) sizeof(u32)))
return; return;
...@@ -2338,14 +2340,14 @@ void kvm_lapic_sync_to_vapic(struct kvm_vcpu *vcpu) ...@@ -2338,14 +2340,14 @@ void kvm_lapic_sync_to_vapic(struct kvm_vcpu *vcpu)
max_isr = 0; max_isr = 0;
data = (tpr & 0xff) | ((max_isr & 0xf0) << 8) | (max_irr << 24); data = (tpr & 0xff) | ((max_isr & 0xf0) << 8) | (max_irr << 24);
kvm_vcpu_write_guest_cached(vcpu, &vcpu->arch.apic->vapic_cache, &data, kvm_write_guest_cached(vcpu->kvm, &vcpu->arch.apic->vapic_cache, &data,
sizeof(u32)); sizeof(u32));
} }
int kvm_lapic_set_vapic_addr(struct kvm_vcpu *vcpu, gpa_t vapic_addr) int kvm_lapic_set_vapic_addr(struct kvm_vcpu *vcpu, gpa_t vapic_addr)
{ {
if (vapic_addr) { if (vapic_addr) {
if (kvm_vcpu_gfn_to_hva_cache_init(vcpu, if (kvm_gfn_to_hva_cache_init(vcpu->kvm,
&vcpu->arch.apic->vapic_cache, &vcpu->arch.apic->vapic_cache,
vapic_addr, sizeof(u32))) vapic_addr, sizeof(u32)))
return -EINVAL; return -EINVAL;
...@@ -2439,7 +2441,7 @@ int kvm_lapic_enable_pv_eoi(struct kvm_vcpu *vcpu, u64 data) ...@@ -2439,7 +2441,7 @@ int kvm_lapic_enable_pv_eoi(struct kvm_vcpu *vcpu, u64 data)
vcpu->arch.pv_eoi.msr_val = data; vcpu->arch.pv_eoi.msr_val = data;
if (!pv_eoi_enabled(vcpu)) if (!pv_eoi_enabled(vcpu))
return 0; return 0;
return kvm_vcpu_gfn_to_hva_cache_init(vcpu, &vcpu->arch.pv_eoi.data, return kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.pv_eoi.data,
addr, sizeof(u8)); addr, sizeof(u8));
} }
......
arch/x86/kvm/x86.c
View file @ d1daa545
...@@ -1813,7 +1813,7 @@ static void kvm_setup_pvclock_page(struct kvm_vcpu *v) ...@@ -1813,7 +1813,7 @@ static void kvm_setup_pvclock_page(struct kvm_vcpu *v)
struct kvm_vcpu_arch *vcpu = &v->arch; struct kvm_vcpu_arch *vcpu = &v->arch;
struct pvclock_vcpu_time_info guest_hv_clock; struct pvclock_vcpu_time_info guest_hv_clock;
if (unlikely(kvm_vcpu_read_guest_cached(v, &vcpu->pv_time, if (unlikely(kvm_read_guest_cached(v->kvm, &vcpu->pv_time,
&guest_hv_clock, sizeof(guest_hv_clock)))) &guest_hv_clock, sizeof(guest_hv_clock))))
return; return;
...@@ -1834,7 +1834,7 @@ static void kvm_setup_pvclock_page(struct kvm_vcpu *v) ...@@ -1834,7 +1834,7 @@ static void kvm_setup_pvclock_page(struct kvm_vcpu *v)
BUILD_BUG_ON(offsetof(struct pvclock_vcpu_time_info, version) != 0); BUILD_BUG_ON(offsetof(struct pvclock_vcpu_time_info, version) != 0);
vcpu->hv_clock.version = guest_hv_clock.version + 1; vcpu->hv_clock.version = guest_hv_clock.version + 1;
kvm_vcpu_write_guest_cached(v, &vcpu->pv_time, kvm_write_guest_cached(v->kvm, &vcpu->pv_time,
&vcpu->hv_clock, &vcpu->hv_clock,
sizeof(vcpu->hv_clock.version)); sizeof(vcpu->hv_clock.version));
...@@ -1850,14 +1850,14 @@ static void kvm_setup_pvclock_page(struct kvm_vcpu *v) ...@@ -1850,14 +1850,14 @@ static void kvm_setup_pvclock_page(struct kvm_vcpu *v)
trace_kvm_pvclock_update(v->vcpu_id, &vcpu->hv_clock); trace_kvm_pvclock_update(v->vcpu_id, &vcpu->hv_clock);
kvm_vcpu_write_guest_cached(v, &vcpu->pv_time, kvm_write_guest_cached(v->kvm, &vcpu->pv_time,
&vcpu->hv_clock, &vcpu->hv_clock,
sizeof(vcpu->hv_clock)); sizeof(vcpu->hv_clock));
smp_wmb(); smp_wmb();
vcpu->hv_clock.version++; vcpu->hv_clock.version++;
kvm_vcpu_write_guest_cached(v, &vcpu->pv_time, kvm_write_guest_cached(v->kvm, &vcpu->pv_time,
&vcpu->hv_clock, &vcpu->hv_clock,
sizeof(vcpu->hv_clock.version)); sizeof(vcpu->hv_clock.version));
} }
...@@ -2092,7 +2092,7 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data) ...@@ -2092,7 +2092,7 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
return 0; return 0;
} }
if (kvm_vcpu_gfn_to_hva_cache_init(vcpu, &vcpu->arch.apf.data, gpa, if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.apf.data, gpa,
sizeof(u32))) sizeof(u32)))
return 1; return 1;
...@@ -2111,7 +2111,7 @@ static void record_steal_time(struct kvm_vcpu *vcpu) ...@@ -2111,7 +2111,7 @@ static void record_steal_time(struct kvm_vcpu *vcpu)
if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED)) if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED))
return; return;
if (unlikely(kvm_vcpu_read_guest_cached(vcpu, &vcpu->arch.st.stime, if (unlikely(kvm_read_guest_cached(vcpu->kvm, &vcpu->arch.st.stime,
&vcpu->arch.st.steal, sizeof(struct kvm_steal_time)))) &vcpu->arch.st.steal, sizeof(struct kvm_steal_time))))
return; return;
...@@ -2122,7 +2122,7 @@ static void record_steal_time(struct kvm_vcpu *vcpu) ...@@ -2122,7 +2122,7 @@ static void record_steal_time(struct kvm_vcpu *vcpu)
vcpu->arch.st.steal.version += 1; vcpu->arch.st.steal.version += 1;
kvm_vcpu_write_guest_cached(vcpu, &vcpu->arch.st.stime, kvm_write_guest_cached(vcpu->kvm, &vcpu->arch.st.stime,
&vcpu->arch.st.steal, sizeof(struct kvm_steal_time)); &vcpu->arch.st.steal, sizeof(struct kvm_steal_time));
smp_wmb(); smp_wmb();
...@@ -2131,14 +2131,14 @@ static void record_steal_time(struct kvm_vcpu *vcpu) ...@@ -2131,14 +2131,14 @@ static void record_steal_time(struct kvm_vcpu *vcpu)
vcpu->arch.st.last_steal; vcpu->arch.st.last_steal;
vcpu->arch.st.last_steal = current->sched_info.run_delay; vcpu->arch.st.last_steal = current->sched_info.run_delay;
kvm_vcpu_write_guest_cached(vcpu, &vcpu->arch.st.stime, kvm_write_guest_cached(vcpu->kvm, &vcpu->arch.st.stime,
&vcpu->arch.st.steal, sizeof(struct kvm_steal_time)); &vcpu->arch.st.steal, sizeof(struct kvm_steal_time));
smp_wmb(); smp_wmb();
vcpu->arch.st.steal.version += 1; vcpu->arch.st.steal.version += 1;
kvm_vcpu_write_guest_cached(vcpu, &vcpu->arch.st.stime, kvm_write_guest_cached(vcpu->kvm, &vcpu->arch.st.stime,
&vcpu->arch.st.steal, sizeof(struct kvm_steal_time)); &vcpu->arch.st.steal, sizeof(struct kvm_steal_time));
} }
...@@ -2243,7 +2243,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) ...@@ -2243,7 +2243,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
if (!(data & 1)) if (!(data & 1))
break; break;
if (kvm_vcpu_gfn_to_hva_cache_init(vcpu, if (kvm_gfn_to_hva_cache_init(vcpu->kvm,
&vcpu->arch.pv_time, data & ~1ULL, &vcpu->arch.pv_time, data & ~1ULL,
sizeof(struct pvclock_vcpu_time_info))) sizeof(struct pvclock_vcpu_time_info)))
vcpu->arch.pv_time_enabled = false; vcpu->arch.pv_time_enabled = false;
...@@ -2264,7 +2264,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) ...@@ -2264,7 +2264,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
if (data & KVM_STEAL_RESERVED_MASK) if (data & KVM_STEAL_RESERVED_MASK)
return 1; return 1;
if (kvm_vcpu_gfn_to_hva_cache_init(vcpu, &vcpu->arch.st.stime, if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.st.stime,
data & KVM_STEAL_VALID_BITS, data & KVM_STEAL_VALID_BITS,
sizeof(struct kvm_steal_time))) sizeof(struct kvm_steal_time)))
return 1; return 1;
...@@ -2878,7 +2878,7 @@ static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu) ...@@ -2878,7 +2878,7 @@ static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu)
vcpu->arch.st.steal.preempted = 1; vcpu->arch.st.steal.preempted = 1;
kvm_vcpu_write_guest_offset_cached(vcpu, &vcpu->arch.st.stime, kvm_write_guest_offset_cached(vcpu->kvm, &vcpu->arch.st.stime,
&vcpu->arch.st.steal.preempted, &vcpu->arch.st.steal.preempted,
offsetof(struct kvm_steal_time, preempted), offsetof(struct kvm_steal_time, preempted),
sizeof(vcpu->arch.st.steal.preempted)); sizeof(vcpu->arch.st.steal.preempted));
...@@ -8548,7 +8548,8 @@ static void kvm_del_async_pf_gfn(struct kvm_vcpu *vcpu, gfn_t gfn) ...@@ -8548,7 +8548,8 @@ static void kvm_del_async_pf_gfn(struct kvm_vcpu *vcpu, gfn_t gfn)
static int apf_put_user(struct kvm_vcpu *vcpu, u32 val) static int apf_put_user(struct kvm_vcpu *vcpu, u32 val)
{ {
return kvm_vcpu_write_guest_cached(vcpu, &vcpu->arch.apf.data, &val,
return kvm_write_guest_cached(vcpu->kvm, &vcpu->arch.apf.data, &val,
sizeof(val)); sizeof(val));
} }
......
include/linux/kvm_host.h
View file @ d1daa545
...@@ -641,17 +641,17 @@ int kvm_read_guest_page(struct kvm *kvm, gfn_t gfn, void *data, int offset, ...@@ -641,17 +641,17 @@ int kvm_read_guest_page(struct kvm *kvm, gfn_t gfn, void *data, int offset,
int kvm_read_guest_atomic(struct kvm *kvm, gpa_t gpa, void *data, int kvm_read_guest_atomic(struct kvm *kvm, gpa_t gpa, void *data,
unsigned long len); unsigned long len);
int kvm_read_guest(struct kvm *kvm, gpa_t gpa, void *data, unsigned long len); int kvm_read_guest(struct kvm *kvm, gpa_t gpa, void *data, unsigned long len);
int kvm_vcpu_read_guest_cached(struct kvm_vcpu *vcpu, struct gfn_to_hva_cache *ghc, int kvm_read_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
void *data, unsigned long len); void *data, unsigned long len);
int kvm_write_guest_page(struct kvm *kvm, gfn_t gfn, const void *data, int kvm_write_guest_page(struct kvm *kvm, gfn_t gfn, const void *data,
int offset, int len); int offset, int len);
int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data, int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data,
unsigned long len); unsigned long len);
int kvm_vcpu_write_guest_cached(struct kvm_vcpu *v, struct gfn_to_hva_cache *ghc, int kvm_write_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
void *data, unsigned long len); void *data, unsigned long len);
int kvm_vcpu_write_guest_offset_cached(struct kvm_vcpu *v, struct gfn_to_hva_cache *ghc, int kvm_write_guest_offset_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
void *data, int offset, unsigned long len); void *data, int offset, unsigned long len);
int kvm_vcpu_gfn_to_hva_cache_init(struct kvm_vcpu *v, struct gfn_to_hva_cache *ghc, int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
gpa_t gpa, unsigned long len); gpa_t gpa, unsigned long len);
int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len); int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len);
int kvm_clear_guest(struct kvm *kvm, gpa_t gpa, unsigned long len); int kvm_clear_guest(struct kvm *kvm, gpa_t gpa, unsigned long len);
......
virt/kvm/kvm_main.c
View file @ d1daa545
...@@ -1973,18 +1973,18 @@ static int __kvm_gfn_to_hva_cache_init(struct kvm_memslots *slots, ...@@ -1973,18 +1973,18 @@ static int __kvm_gfn_to_hva_cache_init(struct kvm_memslots *slots,
return 0; return 0;
} }
int kvm_vcpu_gfn_to_hva_cache_init(struct kvm_vcpu *vcpu, struct gfn_to_hva_cache *ghc, int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
gpa_t gpa, unsigned long len) gpa_t gpa, unsigned long len)
{ {
struct kvm_memslots *slots = kvm_vcpu_memslots(vcpu); struct kvm_memslots *slots = kvm_memslots(kvm);
return __kvm_gfn_to_hva_cache_init(slots, ghc, gpa, len); return __kvm_gfn_to_hva_cache_init(slots, ghc, gpa, len);
} }
EXPORT_SYMBOL_GPL(kvm_vcpu_gfn_to_hva_cache_init); EXPORT_SYMBOL_GPL(kvm_gfn_to_hva_cache_init);
int kvm_vcpu_write_guest_offset_cached(struct kvm_vcpu *vcpu, struct gfn_to_hva_cache *ghc, int kvm_write_guest_offset_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
void *data, int offset, unsigned long len) void *data, int offset, unsigned long len)
{ {
struct kvm_memslots *slots = kvm_vcpu_memslots(vcpu); struct kvm_memslots *slots = kvm_memslots(kvm);
int r; int r;
gpa_t gpa = ghc->gpa + offset; gpa_t gpa = ghc->gpa + offset;
...@@ -1994,7 +1994,7 @@ int kvm_vcpu_write_guest_offset_cached(struct kvm_vcpu *vcpu, struct gfn_to_hva_ ...@@ -1994,7 +1994,7 @@ int kvm_vcpu_write_guest_offset_cached(struct kvm_vcpu *vcpu, struct gfn_to_hva_
__kvm_gfn_to_hva_cache_init(slots, ghc, ghc->gpa, ghc->len); __kvm_gfn_to_hva_cache_init(slots, ghc, ghc->gpa, ghc->len);
if (unlikely(!ghc->memslot)) if (unlikely(!ghc->memslot))
return kvm_vcpu_write_guest(vcpu, gpa, data, len); return kvm_write_guest(kvm, gpa, data, len);
if (kvm_is_error_hva(ghc->hva)) if (kvm_is_error_hva(ghc->hva))
return -EFAULT; return -EFAULT;
...@@ -2006,19 +2006,19 @@ int kvm_vcpu_write_guest_offset_cached(struct kvm_vcpu *vcpu, struct gfn_to_hva_ ...@@ -2006,19 +2006,19 @@ int kvm_vcpu_write_guest_offset_cached(struct kvm_vcpu *vcpu, struct gfn_to_hva_
return 0; return 0;
} }
EXPORT_SYMBOL_GPL(kvm_vcpu_write_guest_offset_cached); EXPORT_SYMBOL_GPL(kvm_write_guest_offset_cached);
int kvm_vcpu_write_guest_cached(struct kvm_vcpu *vcpu, struct gfn_to_hva_cache *ghc, int kvm_write_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
void *data, unsigned long len) void *data, unsigned long len)
{ {
return kvm_vcpu_write_guest_offset_cached(vcpu, ghc, data, 0, len); return kvm_write_guest_offset_cached(kvm, ghc, data, 0, len);
} }
EXPORT_SYMBOL_GPL(kvm_vcpu_write_guest_cached); EXPORT_SYMBOL_GPL(kvm_write_guest_cached);
int kvm_vcpu_read_guest_cached(struct kvm_vcpu *vcpu, struct gfn_to_hva_cache *ghc, int kvm_read_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
void *data, unsigned long len) void *data, unsigned long len)
{ {
struct kvm_memslots *slots = kvm_vcpu_memslots(vcpu); struct kvm_memslots *slots = kvm_memslots(kvm);
int r; int r;
BUG_ON(len > ghc->len); BUG_ON(len > ghc->len);
...@@ -2027,7 +2027,7 @@ int kvm_vcpu_read_guest_cached(struct kvm_vcpu *vcpu, struct gfn_to_hva_cache *g ...@@ -2027,7 +2027,7 @@ int kvm_vcpu_read_guest_cached(struct kvm_vcpu *vcpu, struct gfn_to_hva_cache *g
__kvm_gfn_to_hva_cache_init(slots, ghc, ghc->gpa, ghc->len); __kvm_gfn_to_hva_cache_init(slots, ghc, ghc->gpa, ghc->len);
if (unlikely(!ghc->memslot)) if (unlikely(!ghc->memslot))
return kvm_vcpu_read_guest(vcpu, ghc->gpa, data, len); return kvm_read_guest(kvm, ghc->gpa, data, len);
if (kvm_is_error_hva(ghc->hva)) if (kvm_is_error_hva(ghc->hva))
return -EFAULT; return -EFAULT;
...@@ -2038,7 +2038,7 @@ int kvm_vcpu_read_guest_cached(struct kvm_vcpu *vcpu, struct gfn_to_hva_cache *g ...@@ -2038,7 +2038,7 @@ int kvm_vcpu_read_guest_cached(struct kvm_vcpu *vcpu, struct gfn_to_hva_cache *g
return 0; return 0;
} }
EXPORT_SYMBOL_GPL(kvm_vcpu_read_guest_cached); EXPORT_SYMBOL_GPL(kvm_read_guest_cached);
int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len) int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len)
{ {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7