linux-toradex.git/virt, branch v3.2.61

KVM: async_pf: mm->mm_users can not pin apf->mm

2014-06-09T12:29:03+00:00

commit 41c22f626254b9dc0376928cae009e73d1b6a49a upstream.

get_user_pages(mm) is simply wrong if mm->mm_users == 0 and exit_mmap/etc
was already called (or is in progress), mm->mm_count can only pin mm->pgd
and mm_struct itself.

Change kvm_setup_async_pf/async_pf_execute to inc/dec mm->mm_users.

kvm_create_vm/kvm_destroy_vm play with ->mm_count too but this case looks
fine at first glance, it seems that this ->mm is only used to verify that
current->mm == kvm->mm.

Signed-off-by: Oleg Nesterov 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Ben Hutchings

kvm: remove .done from struct kvm_async_pf

2014-06-09T12:29:03+00:00

commit 98fda169290b3b28c0f2db2b8f02290c13da50ef upstream.

'.done' is used to mark the completion of 'async_pf_execute()', but
'cancel_work_sync()' returns true when the work was canceled, so we
use it instead.

Signed-off-by: Radim Krčmář 
Reviewed-by: Paolo Bonzini 
Reviewed-by: Gleb Natapov 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Ben Hutchings

kvm: free resources after canceling async_pf

2014-06-09T12:29:03+00:00

commit 28b441e24088081c1e213139d1303b451a34a4f4 upstream.

When we cancel 'async_pf_execute()', we should behave as if the work was
never scheduled in 'kvm_setup_async_pf()'.
Fixes a bug when we can't unload module because the vm wasn't destroyed.

Signed-off-by: Radim Krčmář 
Reviewed-by: Paolo Bonzini 
Reviewed-by: Gleb Natapov 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Ben Hutchings

KVM: return an error code in kvm_vm_ioctl_register_coalesced_mmio()

2014-04-01T23:58:46+00:00

commit aac5c4226e7136c331ed384c25d5560204da10a0 upstream.

If kvm_io_bus_register_dev() fails then it returns success but it should
return an error code.

I also did a little cleanup like removing an impossible NULL test.

Fixes: 2b3c246a682c ('KVM: Make coalesced mmio use a device per zone')
Signed-off-by: Dan Carpenter 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Ben Hutchings

KVM: Fix iommu map/unmap to handle memory slot moves

2014-01-03T04:33:35+00:00

commit e40f193f5bb022e927a57a4f5d5194e4f12ddb74 upstream.

The iommu integration into memory slots expects memory slots to be
added or removed and doesn't handle the move case.  We can unmap
slots from the iommu after we mark them invalid and map them before
installing the final memslot array.  Also re-order the kmemdup vs
map so we don't leave iommu mappings if we get ENOMEM.

Reviewed-by: Gleb Natapov 
Signed-off-by: Alex Williamson 
Signed-off-by: Marcelo Tosatti 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

KVM: perform an invalid memslot step for gpa base change

2014-01-03T04:33:35+00:00

commit 12d6e7538e2d418c08f082b1b44ffa5fb7270ed8 upstream.

PPC must flush all translations before the new memory slot
is visible.

Signed-off-by: Marcelo Tosatti 
Signed-off-by: Avi Kivity 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

KVM: Improve create VCPU parameter (CVE-2013-4587)

2014-01-03T04:33:31+00:00

commit 338c7dbadd2671189cec7faf64c84d01071b3f96 upstream.

In multiple functions the vcpu_id is used as an offset into a bitfield.  Ag
malicious user could specify a vcpu_id greater than 255 in order to set or
clear bits in kernel memory.  This could be used to elevate priveges in the
kernel.  This patch verifies that the vcpu_id provided is less than 255.
The api documentation already specifies that the vcpu_id must be less than
max_vcpus, but this is currently not checked.

Reported-by: Andrew Honig 
Signed-off-by: Andrew Honig 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Ben Hutchings

KVM: IOMMU: hva align mapping page size

2014-01-03T04:33:17+00:00

commit 27ef63c7e97d1e5dddd85051c03f8d44cc887f34 upstream.

When determining the page size we could use to map with the IOMMU, the
page size should also be aligned with the hva, not just the gfn.  The
gfn may not reflect the real alignment within the hugetlbfs file.

Most of the time, this works fine.  However, if the hugetlbfs file is
backed by non-contiguous huge pages, a multi-huge page memslot starts at
an unaligned offset within the hugetlbfs file, and the gfn is aligned
with respect to the huge page size, kvm_host_page_size() will return the
huge page size and we will use that to map with the IOMMU.

When we later unpin that same memslot, the IOMMU returns the unmap size
as the huge page size, and we happily unpin that many pfns in
monotonically increasing order, not realizing we are spanning
non-contiguous huge pages and partially unpin the wrong huge page.

Ensure the IOMMU mapping page size is aligned with the hva corresponding
to the gfn, which does reflect the alignment within the hugetlbfs file.

Reviewed-by: Marcelo Tosatti 
Signed-off-by: Greg Edwards 
Signed-off-by: Gleb Natapov 
[bwh: Backported to 3.2: s/__gfn_to_hva_memslot/gfn_to_hva_memslot/]
Signed-off-by: Ben Hutchings

KVM: Allow cross page reads and writes from cached translations.

2013-04-25T19:25:50+00:00

commit 8f964525a121f2ff2df948dac908dcc65be21b5b upstream.

This patch adds support for kvm_gfn_to_hva_cache_init functions for
reads and writes that will cross a page.  If the range falls within
the same memslot, then this will be a fast operation.  If the range
is split between two memslots, then the slower kvm_read_guest and
kvm_write_guest are used.

Tested: Test against kvm_clock unit tests.

Signed-off-by: Andrew Honig 
Signed-off-by: Gleb Natapov 
[bwh: Backported to 3.2:
 - Drop change in lapic.c
 - Keep using __gfn_to_memslot() in kvm_gfn_to_hva_cache_init()]
Signed-off-by: Ben Hutchings

KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798)

2013-04-25T19:25:50+00:00

commit a2c118bfab8bc6b8bb213abfc35201e441693d55 upstream.

If the guest specifies a IOAPIC_REG_SELECT with an invalid value and follows
that with a read of the IOAPIC_REG_WINDOW KVM does not properly validate
that request.  ioapic_read_indirect contains an
ASSERT(redir_index < IOAPIC_NUM_PINS), but the ASSERT has no effect in
non-debug builds.  In recent kernels this allows a guest to cause a kernel
oops by reading invalid memory.  In older kernels (pre-3.3) this allows a
guest to read from large ranges of host memory.

Tested: tested against apic unit tests.

Signed-off-by: Andrew Honig 
Signed-off-by: Marcelo Tosatti 
Signed-off-by: Ben Hutchings