History

Merge branch 'cve-2019-3016' into kvm-next-5.6

From Boris Ostrovsky: The KVM hypervisor may provide a guest with ability to defer remote TLB flush when the remote VCPU is not running. When this feature is used, the TLB flush will happen only when the remote VPCU is scheduled to run again. This will avoid unnecessary (and expensive) IPIs. Under certain circumstances, when a guest initiates such deferred action, the hypervisor may miss the request. It is also possible that the guest may mistakenly assume that it has already marked remote VCPU as needing a flush when in fact that request had already been processed by the hypervisor. In both cases this will result in an invalid translation being present in a vCPU, potentially allowing accesses to memory locations in that guest's address space that should not be accessible. Note that only intra-guest memory is vulnerable. The five patches address both of these problems: 1. The first patch makes sure the hypervisor doesn't accidentally clear a guest's remote flush request 2. The rest of the patches prevent the race between hypervisor acknowledging a remote flush request and guest issuing a new one.

Paolo Bonzini committed 6 years ago

Commit 4cbc4182 parents 1d5920c a6bd81139 files · +338 −183Browse files

Showing the changes to include/linux (4 of 39 files). Show all

Unified · Split

4 files
  1. include/linux/kvm_host.h +5 −0
  2. include/linux/kvm_types.h +8 −1
  3. include/linux/mfd/mt6397/rtc.h +8 −0
  4. include/linux/spi/spi.h +2 −2
include/linux/kvm_host.h+5−0
@@ -720,6 +720,7 @@ void kvm_set_pfn_dirty(kvm_pfn_t pfn); · 719 unmodified lines
720void kvm_set_pfn_accessed(kvm_pfn_t pfn);720void kvm_set_pfn_accessed(kvm_pfn_t pfn);
721void kvm_get_pfn(kvm_pfn_t pfn);721void kvm_get_pfn(kvm_pfn_t pfn);
722 722
723void kvm_release_pfn(kvm_pfn_t pfn, bool dirty, struct gfn_to_pfn_cache *cache);
723int kvm_read_guest_page(struct kvm *kvm, gfn_t gfn, void *data, int offset,724int kvm_read_guest_page(struct kvm *kvm, gfn_t gfn, void *data, int offset,
724 int len);725 int len);
725int kvm_read_guest(struct kvm *kvm, gpa_t gpa, void *data, unsigned long len);726int kvm_read_guest(struct kvm *kvm, gpa_t gpa, void *data, unsigned long len);
@@ -770,8 +771,12 @@ struct kvm_memory_slot *kvm_vcpu_gfn_to_memslot(struct kvm_vcpu *vcpu, gfn_t gfn · 44 unmodified lines
770kvm_pfn_t kvm_vcpu_gfn_to_pfn_atomic(struct kvm_vcpu *vcpu, gfn_t gfn);771kvm_pfn_t kvm_vcpu_gfn_to_pfn_atomic(struct kvm_vcpu *vcpu, gfn_t gfn);
771kvm_pfn_t kvm_vcpu_gfn_to_pfn(struct kvm_vcpu *vcpu, gfn_t gfn);772kvm_pfn_t kvm_vcpu_gfn_to_pfn(struct kvm_vcpu *vcpu, gfn_t gfn);
772int kvm_vcpu_map(struct kvm_vcpu *vcpu, gpa_t gpa, struct kvm_host_map *map);773int kvm_vcpu_map(struct kvm_vcpu *vcpu, gpa_t gpa, struct kvm_host_map *map);
774int kvm_map_gfn(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map,
775 struct gfn_to_pfn_cache *cache, bool atomic);
773struct page *kvm_vcpu_gfn_to_page(struct kvm_vcpu *vcpu, gfn_t gfn);776struct page *kvm_vcpu_gfn_to_page(struct kvm_vcpu *vcpu, gfn_t gfn);
774void kvm_vcpu_unmap(struct kvm_vcpu *vcpu, struct kvm_host_map *map, bool dirty);777void kvm_vcpu_unmap(struct kvm_vcpu *vcpu, struct kvm_host_map *map, bool dirty);
778int kvm_unmap_gfn(struct kvm_vcpu *vcpu, struct kvm_host_map *map,
779 struct gfn_to_pfn_cache *cache, bool dirty, bool atomic);
775unsigned long kvm_vcpu_gfn_to_hva(struct kvm_vcpu *vcpu, gfn_t gfn);780unsigned long kvm_vcpu_gfn_to_hva(struct kvm_vcpu *vcpu, gfn_t gfn);
776unsigned long kvm_vcpu_gfn_to_hva_prot(struct kvm_vcpu *vcpu, gfn_t gfn, bool *writable);781unsigned long kvm_vcpu_gfn_to_hva_prot(struct kvm_vcpu *vcpu, gfn_t gfn, bool *writable);
777int kvm_vcpu_read_guest_page(struct kvm_vcpu *vcpu, gfn_t gfn, void *data, int offset,782int kvm_vcpu_read_guest_page(struct kvm_vcpu *vcpu, gfn_t gfn, void *data, int offset,
include/linux/kvm_types.h+8−1
@@ -18,7 +18,7 @@ struct kvm_memslots; · 17 unmodified lines
18 18
19enum kvm_mr_change;19enum kvm_mr_change;
20 20
21#include <asm/types.h>21#include <linux/types.h>
22 22
23/*23/*
24 * Address types:24 * Address types:
@@ -51,4 +51,11 @@ struct gfn_to_hva_cache { · 26 unmodified lines
51 struct kvm_memory_slot *memslot;51 struct kvm_memory_slot *memslot;
52};52};
53 53
54struct gfn_to_pfn_cache {
55 u64 generation;
56 gfn_t gfn;
57 kvm_pfn_t pfn;
58 bool dirty;
59};
60
54#endif /* __KVM_TYPES_H__ */61#endif /* __KVM_TYPES_H__ */
include/linux/mfd/mt6397/rtc.h+8−0
@@ -46,6 +46,14 @@ · 45 unmodified lines
46 46
47#define RTC_AL_SEC 0x001847#define RTC_AL_SEC 0x0018
48 48
49#define RTC_AL_SEC_MASK 0x003f
50#define RTC_AL_MIN_MASK 0x003f
51#define RTC_AL_HOU_MASK 0x001f
52#define RTC_AL_DOM_MASK 0x001f
53#define RTC_AL_DOW_MASK 0x0007
54#define RTC_AL_MTH_MASK 0x000f
55#define RTC_AL_YEA_MASK 0x007f
56
49#define RTC_PDN2 0x002e57#define RTC_PDN2 0x002e
50#define RTC_PDN2_PWRON_ALARM BIT(4)58#define RTC_PDN2_PWRON_ALARM BIT(4)
51 59
include/linux/spi/spi.h+2−2
@@ -689,10 +689,10 @@ extern void spi_finalize_current_transfer(struct spi_controller *ctlr); · 688 unmodified lines
689/* Helper calls for driver to timestamp transfer */689/* Helper calls for driver to timestamp transfer */
690void spi_take_timestamp_pre(struct spi_controller *ctlr,690void spi_take_timestamp_pre(struct spi_controller *ctlr,
691 struct spi_transfer *xfer,691 struct spi_transfer *xfer,
692 const void *tx, bool irqs_off);692 size_t progress, bool irqs_off);
693void spi_take_timestamp_post(struct spi_controller *ctlr,693void spi_take_timestamp_post(struct spi_controller *ctlr,
694 struct spi_transfer *xfer,694 struct spi_transfer *xfer,
695 const void *tx, bool irqs_off);695 size_t progress, bool irqs_off);
696 696
697/* the spi driver core manages memory for the spi_controller classdev */697/* the spi driver core manages memory for the spi_controller classdev */
698extern struct spi_controller *__spi_alloc_controller(struct device *host,698extern struct spi_controller *__spi_alloc_controller(struct device *host,