1. 18 12月, 2013 2 次提交
    • P
      KVM: PPC: Book3S HV: Don't drop low-order page address bits · df9059bb
      Paul Mackerras 提交于
      Commit caaa4c80 ("KVM: PPC: Book3S HV: Fix physical address
      calculations") unfortunately resulted in some low-order address bits
      getting dropped in the case where the guest is creating a 4k HPTE
      and the host page size is 64k.  By getting the low-order bits from
      hva rather than gpa we miss out on bits 12 - 15 in this case, since
      hva is at page granularity.  This puts the missing bits back in.
      Reported-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: NPaul Mackerras <paulus@samba.org>
      Signed-off-by: NAlexander Graf <agraf@suse.de>
      df9059bb
    • A
      powerpc: book3s: kvm: Don't abuse host r2 in exit path · 36e7bb38
      Aneesh Kumar K.V 提交于
      We don't use PACATOC for PR. Avoid updating HOST_R2 with PR
      KVM mode when both HV and PR are enabled in the kernel. Without this we
      get the below crash
      
      (qemu)
      Unable to handle kernel paging request for data at address 0xffffffffffff8310
      Faulting instruction address: 0xc00000000001d5a4
      cpu 0x2: Vector: 300 (Data Access) at [c0000001dc53aef0]
          pc: c00000000001d5a4: .vtime_delta.isra.1+0x34/0x1d0
          lr: c00000000001d760: .vtime_account_system+0x20/0x60
          sp: c0000001dc53b170
         msr: 8000000000009032
         dar: ffffffffffff8310
       dsisr: 40000000
        current = 0xc0000001d76c62d0
        paca    = 0xc00000000fef1100   softe: 0        irq_happened: 0x01
          pid   = 4472, comm = qemu-system-ppc
      enter ? for help
      [c0000001dc53b200] c00000000001d760 .vtime_account_system+0x20/0x60
      [c0000001dc53b290] c00000000008d050 .kvmppc_handle_exit_pr+0x60/0xa50
      [c0000001dc53b340] c00000000008f51c kvm_start_lightweight+0xb4/0xc4
      [c0000001dc53b510] c00000000008cdf0 .kvmppc_vcpu_run_pr+0x150/0x2e0
      [c0000001dc53b9e0] c00000000008341c .kvmppc_vcpu_run+0x2c/0x40
      [c0000001dc53ba50] c000000000080af4 .kvm_arch_vcpu_ioctl_run+0x54/0x1b0
      [c0000001dc53bae0] c00000000007b4c8 .kvm_vcpu_ioctl+0x478/0x730
      [c0000001dc53bca0] c0000000002140cc .do_vfs_ioctl+0x4ac/0x770
      [c0000001dc53bd80] c0000000002143e8 .SyS_ioctl+0x58/0xb0
      [c0000001dc53be30] c000000000009e58 syscall_exit+0x0/0x98
      Signed-off-by: NAlexander Graf <agraf@suse.de>
      36e7bb38
  2. 14 12月, 2013 1 次提交
    • R
      ARM: fix asm/memory.h build error · b713aa0b
      Russell King 提交于
      Jason Gunthorpe reports a build failure when ARM_PATCH_PHYS_VIRT is
      not defined:
      
      In file included from arch/arm/include/asm/page.h:163:0,
                       from include/linux/mm_types.h:16,
                       from include/linux/sched.h:24,
                       from arch/arm/kernel/asm-offsets.c:13:
      arch/arm/include/asm/memory.h: In function '__virt_to_phys':
      arch/arm/include/asm/memory.h:244:40: error: 'PHYS_OFFSET' undeclared (first use in this function)
      arch/arm/include/asm/memory.h:244:40: note: each undeclared identifier is reported only once for each function it appears in
      arch/arm/include/asm/memory.h: In function '__phys_to_virt':
      arch/arm/include/asm/memory.h:249:13: error: 'PHYS_OFFSET' undeclared (first use in this function)
      
      Fixes: ca5a45c0 ("ARM: mm: use phys_addr_t appropriately in p2v and v2p conversions")
      Tested-By: NJason Gunthorpe <jgunthorpe@obsidianresearch.com>
      Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>
      b713aa0b
  3. 13 12月, 2013 3 次提交
    • G
      KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376) · 17d68b76
      Gleb Natapov 提交于
      A guest can cause a BUG_ON() leading to a host kernel crash.
      When the guest writes to the ICR to request an IPI, while in x2apic
      mode the following things happen, the destination is read from
      ICR2, which is a register that the guest can control.
      
      kvm_irq_delivery_to_apic_fast uses the high 16 bits of ICR2 as the
      cluster id.  A BUG_ON is triggered, which is a protection against
      accessing map->logical_map with an out-of-bounds access and manages
      to avoid that anything really unsafe occurs.
      
      The logic in the code is correct from real HW point of view. The problem
      is that KVM supports only one cluster with ID 0 in clustered mode, but
      the code that has the bug does not take this into account.
      Reported-by: NLars Bull <larsbull@google.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: NGleb Natapov <gleb@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      17d68b76
    • A
      KVM: x86: Convert vapic synchronization to _cached functions (CVE-2013-6368) · fda4e2e8
      Andy Honig 提交于
      In kvm_lapic_sync_from_vapic and kvm_lapic_sync_to_vapic there is the
      potential to corrupt kernel memory if userspace provides an address that
      is at the end of a page.  This patches concerts those functions to use
      kvm_write_guest_cached and kvm_read_guest_cached.  It also checks the
      vapic_address specified by userspace during ioctl processing and returns
      an error to userspace if the address is not a valid GPA.
      
      This is generally not guest triggerable, because the required write is
      done by firmware that runs before the guest.  Also, it only affects AMD
      processors and oldish Intel that do not have the FlexPriority feature
      (unless you disable FlexPriority, of course; then newer processors are
      also affected).
      
      Fixes: b93463aa ('KVM: Accelerated apic support')
      Reported-by: NAndrew Honig <ahonig@google.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: NAndrew Honig <ahonig@google.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      fda4e2e8
    • A
      KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367) · b963a22e
      Andy Honig 提交于
      Under guest controllable circumstances apic_get_tmcct will execute a
      divide by zero and cause a crash.  If the guest cpuid support
      tsc deadline timers and performs the following sequence of requests
      the host will crash.
      - Set the mode to periodic
      - Set the TMICT to 0
      - Set the mode bits to 11 (neither periodic, nor one shot, nor tsc deadline)
      - Set the TMICT to non-zero.
      Then the lapic_timer.period will be 0, but the TMICT will not be.  If the
      guest then reads from the TMCCT then the host will perform a divide by 0.
      
      This patch ensures that if the lapic_timer.period is 0, then the division
      does not occur.
      Reported-by: NAndrew Honig <ahonig@google.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: NAndrew Honig <ahonig@google.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      b963a22e
  4. 12 12月, 2013 5 次提交
  5. 11 12月, 2013 3 次提交
  6. 10 12月, 2013 22 次提交
  7. 09 12月, 2013 4 次提交