diff for duplicates of <14715136211266@kroah.com> diff --git a/a/content_digest b/N1/content_digest index ac6d649..c7476d8 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -10,8 +10,7 @@ ralf@linux-mips.org rkrcmar@redhat.com " stable@vger.kernel.org\0" - "Cc\0<stable@vger.kernel.org>" - " <stable-commits@vger.kernel.org>\0" + "Cc\0stable-commits@vger.kernel.org\0" "\00:1\0" "b\0" "\n" @@ -29,4 +28,4 @@ "If you, or anyone else, feels it should not be added to the stable tree,\n" please let <stable@vger.kernel.org> know about it. -8ed4403858446df09966f75fd868252f029f282b3e58296df39920651b2e505a +6eec2fefb985adc6504c308642e39f070651cfbf4f627d03c000e3007433f03d
diff --git a/a/1.txt b/N2/1.txt index 7b8d1c8..2967465 100644 --- a/a/1.txt +++ b/N2/1.txt @@ -12,3 +12,110 @@ and it can be found in the queue-3.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@vger.kernel.org> know about it. + + +>From james.hogan@imgtec.com Thu Aug 18 11:46:11 2016 +From: James Hogan <james.hogan@imgtec.com> +Date: Thu, 18 Aug 2016 10:22:52 +0100 +Subject: [PATCH BACKPORT 3.10-3.15 1/4] MIPS: KVM: Fix mapped fault broken commpage handling +To: <stable@vger.kernel.org> +Cc: James Hogan <james.hogan@imgtec.com>, Paolo Bonzini <pbonzini@redhat.com>, Radim Krčmář <rkrcmar@redhat.com>, Ralf Baechle <ralf@linux-mips.org>, <linux-mips@linux-mips.org>, <kvm@vger.kernel.org> +Message-ID: <4980f95f6ec938cc80bb79c06222c535564a521d.1471021142.git-series.james.hogan@imgtec.com> + +From: James Hogan <james.hogan@imgtec.com> + +commit c604cffa93478f8888bec62b23d6073dad03d43a upstream. + +kvm_mips_handle_mapped_seg_tlb_fault() appears to map the guest page at +virtual address 0 to PFN 0 if the guest has created its own mapping +there. The intention is unclear, but it may have been an attempt to +protect the zero page from being mapped to anything but the comm page in +code paths you wouldn't expect from genuine commpage accesses (guest +kernel mode cache instructions on that address, hitting trapping +instructions when executing from that address with a coincidental TLB +eviction during the KVM handling, and guest user mode accesses to that +address). + +Fix this to check for mappings exactly at KVM_GUEST_COMMPAGE_ADDR (it +may not be at address 0 since commit 42aa12e74e91 ("MIPS: KVM: Move +commpage so 0x0 is unmapped")), and set the corresponding EntryLo to be +interpreted as 0 (invalid). + +Fixes: 858dd5d45733 ("KVM/MIPS32: MMU/TLB operations for the Guest.") +Signed-off-by: James Hogan <james.hogan@imgtec.com> +Cc: Paolo Bonzini <pbonzini@redhat.com> +Cc: "Radim Krčmář" <rkrcmar@redhat.com> +Cc: Ralf Baechle <ralf@linux-mips.org> +Cc: linux-mips@linux-mips.org +Cc: kvm@vger.kernel.org +Signed-off-by: Radim Krčmář <rkrcmar@redhat.com> +[james.hogan@imgtec.com: Backport to v3.10.y - v3.15.y] +Signed-off-by: James Hogan <james.hogan@imgtec.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + arch/mips/kvm/kvm_tlb.c | 36 +++++++++++++++++++++--------------- + 1 file changed, 21 insertions(+), 15 deletions(-) + +--- a/arch/mips/kvm/kvm_tlb.c ++++ b/arch/mips/kvm/kvm_tlb.c +@@ -370,21 +370,27 @@ kvm_mips_handle_mapped_seg_tlb_fault(str + unsigned long entryhi = 0, entrylo0 = 0, entrylo1 = 0; + struct kvm *kvm = vcpu->kvm; + pfn_t pfn0, pfn1; ++ long tlb_lo[2]; + ++ tlb_lo[0] = tlb->tlb_lo0; ++ tlb_lo[1] = tlb->tlb_lo1; + +- if ((tlb->tlb_hi & VPN2_MASK) == 0) { +- pfn0 = 0; +- pfn1 = 0; +- } else { +- if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo0) >> PAGE_SHIFT) < 0) +- return -1; +- +- if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo1) >> PAGE_SHIFT) < 0) +- return -1; +- +- pfn0 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb->tlb_lo0) >> PAGE_SHIFT]; +- pfn1 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb->tlb_lo1) >> PAGE_SHIFT]; +- } ++ /* ++ * The commpage address must not be mapped to anything else if the guest ++ * TLB contains entries nearby, or commpage accesses will break. ++ */ ++ if (!((tlb->tlb_hi ^ KVM_GUEST_COMMPAGE_ADDR) & ++ VPN2_MASK & (PAGE_MASK << 1))) ++ tlb_lo[(KVM_GUEST_COMMPAGE_ADDR >> PAGE_SHIFT) & 1] = 0; ++ ++ if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT) < 0) ++ return -1; ++ ++ if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT) < 0) ++ return -1; ++ ++ pfn0 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT]; ++ pfn1 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT]; + + if (hpa0) + *hpa0 = pfn0 << PAGE_SHIFT; +@@ -396,9 +402,9 @@ kvm_mips_handle_mapped_seg_tlb_fault(str + entryhi = (tlb->tlb_hi & VPN2_MASK) | (KVM_GUEST_KERNEL_MODE(vcpu) ? + kvm_mips_get_kernel_asid(vcpu) : kvm_mips_get_user_asid(vcpu)); + entrylo0 = mips3_paddr_to_tlbpfn(pfn0 << PAGE_SHIFT) | (0x3 << 3) | +- (tlb->tlb_lo0 & MIPS3_PG_D) | (tlb->tlb_lo0 & MIPS3_PG_V); ++ (tlb_lo[0] & MIPS3_PG_D) | (tlb_lo[0] & MIPS3_PG_V); + entrylo1 = mips3_paddr_to_tlbpfn(pfn1 << PAGE_SHIFT) | (0x3 << 3) | +- (tlb->tlb_lo1 & MIPS3_PG_D) | (tlb->tlb_lo1 & MIPS3_PG_V); ++ (tlb_lo[1] & MIPS3_PG_D) | (tlb_lo[1] & MIPS3_PG_V); + + #ifdef DEBUG + kvm_debug("@ %#lx tlb_lo0: 0x%08lx tlb_lo1: 0x%08lx\n", vcpu->arch.pc, + + +Patches currently in stable-queue which might be from james.hogan@imgtec.com are + +queue-3.14/mips-kvm-add-missing-gfn-range-check.patch +queue-3.14/mips-kvm-propagate-kseg0-mapped-tlb-fault-errors.patch +queue-3.14/mips-kvm-fix-mapped-fault-broken-commpage-handling.patch +queue-3.14/mips-kvm-fix-gfn-range-check-in-kseg0-tlb-faults.patch diff --git a/a/content_digest b/N2/content_digest index ac6d649..1cce563 100644 --- a/a/content_digest +++ b/N2/content_digest @@ -27,6 +27,113 @@ "and it can be found in the queue-3.14 subdirectory.\n" "\n" "If you, or anyone else, feels it should not be added to the stable tree,\n" - please let <stable@vger.kernel.org> know about it. + "please let <stable@vger.kernel.org> know about it.\n" + "\n" + "\n" + ">From james.hogan@imgtec.com Thu Aug 18 11:46:11 2016\n" + "From: James Hogan <james.hogan@imgtec.com>\n" + "Date: Thu, 18 Aug 2016 10:22:52 +0100\n" + "Subject: [PATCH BACKPORT 3.10-3.15 1/4] MIPS: KVM: Fix mapped fault broken commpage handling\n" + "To: <stable@vger.kernel.org>\n" + "Cc: James Hogan <james.hogan@imgtec.com>, Paolo Bonzini <pbonzini@redhat.com>, Radim Kr\304\215m\303\241\305\231 <rkrcmar@redhat.com>, Ralf Baechle <ralf@linux-mips.org>, <linux-mips@linux-mips.org>, <kvm@vger.kernel.org>\n" + "Message-ID: <4980f95f6ec938cc80bb79c06222c535564a521d.1471021142.git-series.james.hogan@imgtec.com>\n" + "\n" + "From: James Hogan <james.hogan@imgtec.com>\n" + "\n" + "commit c604cffa93478f8888bec62b23d6073dad03d43a upstream.\n" + "\n" + "kvm_mips_handle_mapped_seg_tlb_fault() appears to map the guest page at\n" + "virtual address 0 to PFN 0 if the guest has created its own mapping\n" + "there. The intention is unclear, but it may have been an attempt to\n" + "protect the zero page from being mapped to anything but the comm page in\n" + "code paths you wouldn't expect from genuine commpage accesses (guest\n" + "kernel mode cache instructions on that address, hitting trapping\n" + "instructions when executing from that address with a coincidental TLB\n" + "eviction during the KVM handling, and guest user mode accesses to that\n" + "address).\n" + "\n" + "Fix this to check for mappings exactly at KVM_GUEST_COMMPAGE_ADDR (it\n" + "may not be at address 0 since commit 42aa12e74e91 (\"MIPS: KVM: Move\n" + "commpage so 0x0 is unmapped\")), and set the corresponding EntryLo to be\n" + "interpreted as 0 (invalid).\n" + "\n" + "Fixes: 858dd5d45733 (\"KVM/MIPS32: MMU/TLB operations for the Guest.\")\n" + "Signed-off-by: James Hogan <james.hogan@imgtec.com>\n" + "Cc: Paolo Bonzini <pbonzini@redhat.com>\n" + "Cc: \"Radim Kr\304\215m\303\241\305\231\" <rkrcmar@redhat.com>\n" + "Cc: Ralf Baechle <ralf@linux-mips.org>\n" + "Cc: linux-mips@linux-mips.org\n" + "Cc: kvm@vger.kernel.org\n" + "Signed-off-by: Radim Kr\304\215m\303\241\305\231 <rkrcmar@redhat.com>\n" + "[james.hogan@imgtec.com: Backport to v3.10.y - v3.15.y]\n" + "Signed-off-by: James Hogan <james.hogan@imgtec.com>\n" + "Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n" + "---\n" + " arch/mips/kvm/kvm_tlb.c | 36 +++++++++++++++++++++---------------\n" + " 1 file changed, 21 insertions(+), 15 deletions(-)\n" + "\n" + "--- a/arch/mips/kvm/kvm_tlb.c\n" + "+++ b/arch/mips/kvm/kvm_tlb.c\n" + "@@ -370,21 +370,27 @@ kvm_mips_handle_mapped_seg_tlb_fault(str\n" + " \tunsigned long entryhi = 0, entrylo0 = 0, entrylo1 = 0;\n" + " \tstruct kvm *kvm = vcpu->kvm;\n" + " \tpfn_t pfn0, pfn1;\n" + "+\tlong tlb_lo[2];\n" + " \n" + "+\ttlb_lo[0] = tlb->tlb_lo0;\n" + "+\ttlb_lo[1] = tlb->tlb_lo1;\n" + " \n" + "-\tif ((tlb->tlb_hi & VPN2_MASK) == 0) {\n" + "-\t\tpfn0 = 0;\n" + "-\t\tpfn1 = 0;\n" + "-\t} else {\n" + "-\t\tif (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo0) >> PAGE_SHIFT) < 0)\n" + "-\t\t\treturn -1;\n" + "-\n" + "-\t\tif (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo1) >> PAGE_SHIFT) < 0)\n" + "-\t\t\treturn -1;\n" + "-\n" + "-\t\tpfn0 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb->tlb_lo0) >> PAGE_SHIFT];\n" + "-\t\tpfn1 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb->tlb_lo1) >> PAGE_SHIFT];\n" + "-\t}\n" + "+\t/*\n" + "+\t * The commpage address must not be mapped to anything else if the guest\n" + "+\t * TLB contains entries nearby, or commpage accesses will break.\n" + "+\t */\n" + "+\tif (!((tlb->tlb_hi ^ KVM_GUEST_COMMPAGE_ADDR) &\n" + "+\t\t\tVPN2_MASK & (PAGE_MASK << 1)))\n" + "+\t\ttlb_lo[(KVM_GUEST_COMMPAGE_ADDR >> PAGE_SHIFT) & 1] = 0;\n" + "+\n" + "+\tif (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT) < 0)\n" + "+\t\treturn -1;\n" + "+\n" + "+\tif (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT) < 0)\n" + "+\t\treturn -1;\n" + "+\n" + "+\tpfn0 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT];\n" + "+\tpfn1 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT];\n" + " \n" + " \tif (hpa0)\n" + " \t\t*hpa0 = pfn0 << PAGE_SHIFT;\n" + "@@ -396,9 +402,9 @@ kvm_mips_handle_mapped_seg_tlb_fault(str\n" + " \tentryhi = (tlb->tlb_hi & VPN2_MASK) | (KVM_GUEST_KERNEL_MODE(vcpu) ?\n" + " \t\t\tkvm_mips_get_kernel_asid(vcpu) : kvm_mips_get_user_asid(vcpu));\n" + " \tentrylo0 = mips3_paddr_to_tlbpfn(pfn0 << PAGE_SHIFT) | (0x3 << 3) |\n" + "-\t\t\t(tlb->tlb_lo0 & MIPS3_PG_D) | (tlb->tlb_lo0 & MIPS3_PG_V);\n" + "+\t\t\t(tlb_lo[0] & MIPS3_PG_D) | (tlb_lo[0] & MIPS3_PG_V);\n" + " \tentrylo1 = mips3_paddr_to_tlbpfn(pfn1 << PAGE_SHIFT) | (0x3 << 3) |\n" + "-\t\t\t(tlb->tlb_lo1 & MIPS3_PG_D) | (tlb->tlb_lo1 & MIPS3_PG_V);\n" + "+\t\t\t(tlb_lo[1] & MIPS3_PG_D) | (tlb_lo[1] & MIPS3_PG_V);\n" + " \n" + " #ifdef DEBUG\n" + " \tkvm_debug(\"@ %#lx tlb_lo0: 0x%08lx tlb_lo1: 0x%08lx\\n\", vcpu->arch.pc,\n" + "\n" + "\n" + "Patches currently in stable-queue which might be from james.hogan@imgtec.com are\n" + "\n" + "queue-3.14/mips-kvm-add-missing-gfn-range-check.patch\n" + "queue-3.14/mips-kvm-propagate-kseg0-mapped-tlb-fault-errors.patch\n" + "queue-3.14/mips-kvm-fix-mapped-fault-broken-commpage-handling.patch\n" + queue-3.14/mips-kvm-fix-gfn-range-check-in-kseg0-tlb-faults.patch -8ed4403858446df09966f75fd868252f029f282b3e58296df39920651b2e505a +31fc00e7b9565254de7c97a4c3b122f39e9df9fe4245b13a5c16bcb8c2f9ba43
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.