Pull KVM fixes from Paolo Bonzini: "Three x86 fixes and one for ARM/ARM64. In particular, nested virtualization on Intel is broken in 3.13 and fixed by this pull request" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: kvm, vmx: Really fix lazy FPU on nested guest kvm: x86: fix emulator buffer overflow (CVE-2014-0049) arm/arm64: KVM: detect CPU reset on CPU_PM_EXIT KVM: MMU: drop read-only large sptes when creating lower level sptes
Unified · Split
| @@ -878,7 +878,8 @@ static int hyp_init_cpu_pm_notifier(struct notifier_block *self, · 877 unmodified lines | ||
| 878 | 878 | unsigned long cmd, |
| 879 | 879 | void *v) |
| 880 | 880 | { |
| 881 | − if (cmd == CPU_PM_EXIT) { | |
| 881 | + if (cmd == CPU_PM_EXIT && | |
| 882 | + __hyp_get_vectors() == hyp_default_vectors) { | |
| 882 | 883 | cpu_init_hyp_mode(NULL); |
| 883 | 884 | return NOTIFY_OK; |
| 884 | 885 | } |
| @@ -220,6 +220,10 @@ after_vfp_restore: · 219 unmodified lines | ||
| 220 | 220 | * in Hyp mode (see init_hyp_mode in arch/arm/kvm/arm.c). Return values are |
| 221 | 221 | * passed in r0 and r1. |
| 222 | 222 | * |
| 223 | + * A function pointer with a value of 0xffffffff has a special meaning, | |
| 224 | + * and is used to implement __hyp_get_vectors in the same way as in | |
| 225 | + * arch/arm/kernel/hyp_stub.S. | |
| 226 | + * | |
| 223 | 227 | * The calling convention follows the standard AAPCS: |
| 224 | 228 | * r0 - r3: caller save |
| 225 | 229 | * r12: caller save |
| @@ -363,6 +367,11 @@ hyp_hvc: · 137 unmodified lines | ||
| 363 | 367 | host_switch_to_hyp: |
| 364 | 368 | pop {r0, r1, r2} |
| 365 | 369 | |
| 370 | + /* Check for __hyp_get_vectors */ | |
| 371 | + cmp r0, #-1 | |
| 372 | + mrceq p15, 4, r0, c12, c0, 0 @ get HVBAR | |
| 373 | + beq 1f | |
| 374 | + | |
| 366 | 375 | push {lr} |
| 367 | 376 | mrs lr, SPSR |
| 368 | 377 | push {lr} |
| @@ -378,7 +387,7 @@ THUMB( orr lr, #1) · 9 unmodified lines | ||
| 378 | 387 | pop {lr} |
| 379 | 388 | msr SPSR_csxf, lr |
| 380 | 389 | pop {lr} |
| 381 | − eret | |
| 390 | +1: eret | |
| 382 | 391 | |
| 383 | 392 | guest_trap: |
| 384 | 393 | load_vcpu @ Load VCPU pointer to r0 |
| @@ -694,6 +694,24 @@ __hyp_panic_str: · 693 unmodified lines | ||
| 694 | 694 | |
| 695 | 695 | .align 2 |
| 696 | 696 | |
| 697 | +/* | |
| 698 | + * u64 kvm_call_hyp(void *hypfn, ...); | |
| 699 | + * | |
| 700 | + * This is not really a variadic function in the classic C-way and care must | |
| 701 | + * be taken when calling this to ensure parameters are passed in registers | |
| 702 | + * only, since the stack will change between the caller and the callee. | |
| 703 | + * | |
| 704 | + * Call the function with the first argument containing a pointer to the | |
| 705 | + * function you wish to call in Hyp mode, and subsequent arguments will be | |
| 706 | + * passed as x0, x1, and x2 (a maximum of 3 arguments in addition to the | |
| 707 | + * function pointer can be passed). The function being called must be mapped | |
| 708 | + * in Hyp mode (see init_hyp_mode in arch/arm/kvm/arm.c). Return values are | |
| 709 | + * passed in r0 and r1. | |
| 710 | + * | |
| 711 | + * A function pointer with a value of 0 has a special meaning, and is | |
| 712 | + * used to implement __hyp_get_vectors in the same way as in | |
| 713 | + * arch/arm64/kernel/hyp_stub.S. | |
| 714 | + */ | |
| 697 | 715 | ENTRY(kvm_call_hyp) |
| 698 | 716 | hvc #0 |
| 699 | 717 | ret |
| @@ -737,7 +755,12 @@ el1_sync: // Guest trapped into EL2 · 37 unmodified lines | ||
| 737 | 755 | pop x2, x3 |
| 738 | 756 | pop x0, x1 |
| 739 | 757 | |
| 740 | − push lr, xzr | |
| 758 | + /* Check for __hyp_get_vectors */ | |
| 759 | + cbnz x0, 1f | |
| 760 | + mrs x0, vbar_el2 | |
| 761 | + b 2f | |
| 762 | + | |
| 763 | +1: push lr, xzr | |
| 741 | 764 | |
| 742 | 765 | /* |
| 743 | 766 | * Compute the function address in EL2, and shuffle the parameters. |
| @@ -750,7 +773,7 @@ el1_sync: // Guest trapped into EL2 · 6 unmodified lines | ||
| 750 | 773 | blr lr |
| 751 | 774 | |
| 752 | 775 | pop lr, xzr |
| 753 | − eret | |
| 776 | +2: eret | |
| 754 | 777 | |
| 755 | 778 | el1_trap: |
| 756 | 779 | /* |
| @@ -2672,6 +2672,7 @@ static int __direct_map(struct kvm_vcpu *vcpu, gpa_t v, int write, · 2671 unmodified lines | ||
| 2672 | 2672 | break; |
| 2673 | 2673 | } |
| 2674 | 2674 | |
| 2675 | + drop_large_spte(vcpu, iterator.sptep); | |
| 2675 | 2676 | if (!is_shadow_present_pte(*iterator.sptep)) { |
| 2676 | 2677 | u64 base_addr = iterator.addr; |
| 2677 | 2678 | |
| @@ -6688,7 +6688,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu) · 6687 unmodified lines | ||
| 6688 | 6688 | else if (is_page_fault(intr_info)) |
| 6689 | 6689 | return enable_ept; |
| 6690 | 6690 | else if (is_no_device(intr_info) && |
| 6691 | − !(nested_read_cr0(vmcs12) & X86_CR0_TS)) | |
| 6691 | + !(vmcs12->guest_cr0 & X86_CR0_TS)) | |
| 6692 | 6692 | return 0; |
| 6693 | 6693 | return vmcs12->exception_bitmap & |
| 6694 | 6694 | (1u << (intr_info & INTR_INFO_VECTOR_MASK)); |
| @@ -6186,7 +6186,7 @@ static int complete_emulated_mmio(struct kvm_vcpu *vcpu) · 6185 unmodified lines | ||
| 6186 | 6186 | frag->len -= len; |
| 6187 | 6187 | } |
| 6188 | 6188 | |
| 6189 | − if (vcpu->mmio_cur_fragment == vcpu->mmio_nr_fragments) { | |
| 6189 | + if (vcpu->mmio_cur_fragment >= vcpu->mmio_nr_fragments) { | |
| 6190 | 6190 | vcpu->mmio_needed = 0; |
| 6191 | 6191 | |
| 6192 | 6192 | /* FIXME: return into emulator if single-stepping. */ |