diff for duplicates of <1471513642247122@kroah.com> diff --git a/a/content_digest b/N1/content_digest index 6a08b28..194da29 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -10,8 +10,7 @@ ralf@linux-mips.org rkrcmar@redhat.com " stable@vger.kernel.org\0" - "Cc\0<stable@vger.kernel.org>" - " <stable-commits@vger.kernel.org>\0" + "Cc\0stable-commits@vger.kernel.org\0" "\00:1\0" "b\0" "\n" @@ -29,4 +28,4 @@ "If you, or anyone else, feels it should not be added to the stable tree,\n" please let <stable@vger.kernel.org> know about it. -b08418b581c0689e427c02ac7cea7f0cd4c6f1d3c74fc9bfaafbc97a22163ee4 +f327ff83116b4085f8afc988a86a94d46a000a7e301a6aa24af506af7536dd64
diff --git a/a/1.txt b/N2/1.txt index ce2e475..cd71102 100644 --- a/a/1.txt +++ b/N2/1.txt @@ -12,3 +12,118 @@ and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@vger.kernel.org> know about it. + + +>From james.hogan@imgtec.com Thu Aug 18 11:44:25 2016 +From: James Hogan <james.hogan@imgtec.com> +Date: Thu, 18 Aug 2016 10:05:29 +0100 +Subject: [PATCH BACKPORT 3.17-4.4 1/4] MIPS: KVM: Fix mapped fault broken commpage handling +To: <stable@vger.kernel.org> +Cc: James Hogan <james.hogan@imgtec.com>, Paolo Bonzini <pbonzini@redhat.com>, Radim Krčmář <rkrcmar@redhat.com>, Ralf Baechle <ralf@linux-mips.org>, <linux-mips@linux-mips.org>, <kvm@vger.kernel.org> +Message-ID: <68df6d553f95e9f40311c92f7e010d90a329843a.1471018436.git-series.james.hogan@imgtec.com> + +From: James Hogan <james.hogan@imgtec.com> + +commit c604cffa93478f8888bec62b23d6073dad03d43a upstream. + +kvm_mips_handle_mapped_seg_tlb_fault() appears to map the guest page at +virtual address 0 to PFN 0 if the guest has created its own mapping +there. The intention is unclear, but it may have been an attempt to +protect the zero page from being mapped to anything but the comm page in +code paths you wouldn't expect from genuine commpage accesses (guest +kernel mode cache instructions on that address, hitting trapping +instructions when executing from that address with a coincidental TLB +eviction during the KVM handling, and guest user mode accesses to that +address). + +Fix this to check for mappings exactly at KVM_GUEST_COMMPAGE_ADDR (it +may not be at address 0 since commit 42aa12e74e91 ("MIPS: KVM: Move +commpage so 0x0 is unmapped")), and set the corresponding EntryLo to be +interpreted as 0 (invalid). + +Fixes: 858dd5d45733 ("KVM/MIPS32: MMU/TLB operations for the Guest.") +Signed-off-by: James Hogan <james.hogan@imgtec.com> +Cc: Paolo Bonzini <pbonzini@redhat.com> +Cc: "Radim Krčmář" <rkrcmar@redhat.com> +Cc: Ralf Baechle <ralf@linux-mips.org> +Cc: linux-mips@linux-mips.org +Cc: kvm@vger.kernel.org +Signed-off-by: Radim Krčmář <rkrcmar@redhat.com> +[james.hogan@imgtec.com: Backport to v3.17.y - v4.4.y] +Signed-off-by: James Hogan <james.hogan@imgtec.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + arch/mips/kvm/tlb.c | 45 ++++++++++++++++++++++++++------------------- + 1 file changed, 26 insertions(+), 19 deletions(-) + +--- a/arch/mips/kvm/tlb.c ++++ b/arch/mips/kvm/tlb.c +@@ -361,24 +361,31 @@ int kvm_mips_handle_mapped_seg_tlb_fault + unsigned long entryhi = 0, entrylo0 = 0, entrylo1 = 0; + struct kvm *kvm = vcpu->kvm; + pfn_t pfn0, pfn1; ++ long tlb_lo[2]; + +- if ((tlb->tlb_hi & VPN2_MASK) == 0) { +- pfn0 = 0; +- pfn1 = 0; +- } else { +- if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo0) +- >> PAGE_SHIFT) < 0) +- return -1; +- +- if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo1) +- >> PAGE_SHIFT) < 0) +- return -1; +- +- pfn0 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb->tlb_lo0) +- >> PAGE_SHIFT]; +- pfn1 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb->tlb_lo1) +- >> PAGE_SHIFT]; +- } ++ tlb_lo[0] = tlb->tlb_lo0; ++ tlb_lo[1] = tlb->tlb_lo1; ++ ++ /* ++ * The commpage address must not be mapped to anything else if the guest ++ * TLB contains entries nearby, or commpage accesses will break. ++ */ ++ if (!((tlb->tlb_hi ^ KVM_GUEST_COMMPAGE_ADDR) & ++ VPN2_MASK & (PAGE_MASK << 1))) ++ tlb_lo[(KVM_GUEST_COMMPAGE_ADDR >> PAGE_SHIFT) & 1] = 0; ++ ++ if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[0]) ++ >> PAGE_SHIFT) < 0) ++ return -1; ++ ++ if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[1]) ++ >> PAGE_SHIFT) < 0) ++ return -1; ++ ++ pfn0 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb_lo[0]) ++ >> PAGE_SHIFT]; ++ pfn1 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb_lo[1]) ++ >> PAGE_SHIFT]; + + if (hpa0) + *hpa0 = pfn0 << PAGE_SHIFT; +@@ -391,9 +398,9 @@ int kvm_mips_handle_mapped_seg_tlb_fault + kvm_mips_get_kernel_asid(vcpu) : + kvm_mips_get_user_asid(vcpu)); + entrylo0 = mips3_paddr_to_tlbpfn(pfn0 << PAGE_SHIFT) | (0x3 << 3) | +- (tlb->tlb_lo0 & MIPS3_PG_D) | (tlb->tlb_lo0 & MIPS3_PG_V); ++ (tlb_lo[0] & MIPS3_PG_D) | (tlb_lo[0] & MIPS3_PG_V); + entrylo1 = mips3_paddr_to_tlbpfn(pfn1 << PAGE_SHIFT) | (0x3 << 3) | +- (tlb->tlb_lo1 & MIPS3_PG_D) | (tlb->tlb_lo1 & MIPS3_PG_V); ++ (tlb_lo[1] & MIPS3_PG_D) | (tlb_lo[1] & MIPS3_PG_V); + + kvm_debug("@ %#lx tlb_lo0: 0x%08lx tlb_lo1: 0x%08lx\n", vcpu->arch.pc, + tlb->tlb_lo0, tlb->tlb_lo1); + + +Patches currently in stable-queue which might be from james.hogan@imgtec.com are + +queue-4.4/mips-kvm-add-missing-gfn-range-check.patch +queue-4.4/mips-kvm-propagate-kseg0-mapped-tlb-fault-errors.patch +queue-4.4/mips-kvm-fix-mapped-fault-broken-commpage-handling.patch +queue-4.4/mips-kvm-fix-gfn-range-check-in-kseg0-tlb-faults.patch diff --git a/a/content_digest b/N2/content_digest index 6a08b28..0351c14 100644 --- a/a/content_digest +++ b/N2/content_digest @@ -27,6 +27,121 @@ "and it can be found in the queue-4.4 subdirectory.\n" "\n" "If you, or anyone else, feels it should not be added to the stable tree,\n" - please let <stable@vger.kernel.org> know about it. + "please let <stable@vger.kernel.org> know about it.\n" + "\n" + "\n" + ">From james.hogan@imgtec.com Thu Aug 18 11:44:25 2016\n" + "From: James Hogan <james.hogan@imgtec.com>\n" + "Date: Thu, 18 Aug 2016 10:05:29 +0100\n" + "Subject: [PATCH BACKPORT 3.17-4.4 1/4] MIPS: KVM: Fix mapped fault broken commpage handling\n" + "To: <stable@vger.kernel.org>\n" + "Cc: James Hogan <james.hogan@imgtec.com>, Paolo Bonzini <pbonzini@redhat.com>, Radim Kr\304\215m\303\241\305\231 <rkrcmar@redhat.com>, Ralf Baechle <ralf@linux-mips.org>, <linux-mips@linux-mips.org>, <kvm@vger.kernel.org>\n" + "Message-ID: <68df6d553f95e9f40311c92f7e010d90a329843a.1471018436.git-series.james.hogan@imgtec.com>\n" + "\n" + "From: James Hogan <james.hogan@imgtec.com>\n" + "\n" + "commit c604cffa93478f8888bec62b23d6073dad03d43a upstream.\n" + "\n" + "kvm_mips_handle_mapped_seg_tlb_fault() appears to map the guest page at\n" + "virtual address 0 to PFN 0 if the guest has created its own mapping\n" + "there. The intention is unclear, but it may have been an attempt to\n" + "protect the zero page from being mapped to anything but the comm page in\n" + "code paths you wouldn't expect from genuine commpage accesses (guest\n" + "kernel mode cache instructions on that address, hitting trapping\n" + "instructions when executing from that address with a coincidental TLB\n" + "eviction during the KVM handling, and guest user mode accesses to that\n" + "address).\n" + "\n" + "Fix this to check for mappings exactly at KVM_GUEST_COMMPAGE_ADDR (it\n" + "may not be at address 0 since commit 42aa12e74e91 (\"MIPS: KVM: Move\n" + "commpage so 0x0 is unmapped\")), and set the corresponding EntryLo to be\n" + "interpreted as 0 (invalid).\n" + "\n" + "Fixes: 858dd5d45733 (\"KVM/MIPS32: MMU/TLB operations for the Guest.\")\n" + "Signed-off-by: James Hogan <james.hogan@imgtec.com>\n" + "Cc: Paolo Bonzini <pbonzini@redhat.com>\n" + "Cc: \"Radim Kr\304\215m\303\241\305\231\" <rkrcmar@redhat.com>\n" + "Cc: Ralf Baechle <ralf@linux-mips.org>\n" + "Cc: linux-mips@linux-mips.org\n" + "Cc: kvm@vger.kernel.org\n" + "Signed-off-by: Radim Kr\304\215m\303\241\305\231 <rkrcmar@redhat.com>\n" + "[james.hogan@imgtec.com: Backport to v3.17.y - v4.4.y]\n" + "Signed-off-by: James Hogan <james.hogan@imgtec.com>\n" + "Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n" + "---\n" + " arch/mips/kvm/tlb.c | 45 ++++++++++++++++++++++++++-------------------\n" + " 1 file changed, 26 insertions(+), 19 deletions(-)\n" + "\n" + "--- a/arch/mips/kvm/tlb.c\n" + "+++ b/arch/mips/kvm/tlb.c\n" + "@@ -361,24 +361,31 @@ int kvm_mips_handle_mapped_seg_tlb_fault\n" + " \tunsigned long entryhi = 0, entrylo0 = 0, entrylo1 = 0;\n" + " \tstruct kvm *kvm = vcpu->kvm;\n" + " \tpfn_t pfn0, pfn1;\n" + "+\tlong tlb_lo[2];\n" + " \n" + "-\tif ((tlb->tlb_hi & VPN2_MASK) == 0) {\n" + "-\t\tpfn0 = 0;\n" + "-\t\tpfn1 = 0;\n" + "-\t} else {\n" + "-\t\tif (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo0)\n" + "-\t\t\t\t\t >> PAGE_SHIFT) < 0)\n" + "-\t\t\treturn -1;\n" + "-\n" + "-\t\tif (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo1)\n" + "-\t\t\t\t\t >> PAGE_SHIFT) < 0)\n" + "-\t\t\treturn -1;\n" + "-\n" + "-\t\tpfn0 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb->tlb_lo0)\n" + "-\t\t\t\t\t >> PAGE_SHIFT];\n" + "-\t\tpfn1 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb->tlb_lo1)\n" + "-\t\t\t\t\t >> PAGE_SHIFT];\n" + "-\t}\n" + "+\ttlb_lo[0] = tlb->tlb_lo0;\n" + "+\ttlb_lo[1] = tlb->tlb_lo1;\n" + "+\n" + "+\t/*\n" + "+\t * The commpage address must not be mapped to anything else if the guest\n" + "+\t * TLB contains entries nearby, or commpage accesses will break.\n" + "+\t */\n" + "+\tif (!((tlb->tlb_hi ^ KVM_GUEST_COMMPAGE_ADDR) &\n" + "+\t\t\tVPN2_MASK & (PAGE_MASK << 1)))\n" + "+\t\ttlb_lo[(KVM_GUEST_COMMPAGE_ADDR >> PAGE_SHIFT) & 1] = 0;\n" + "+\n" + "+\tif (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[0])\n" + "+\t\t\t\t >> PAGE_SHIFT) < 0)\n" + "+\t\treturn -1;\n" + "+\n" + "+\tif (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[1])\n" + "+\t\t\t\t >> PAGE_SHIFT) < 0)\n" + "+\t\treturn -1;\n" + "+\n" + "+\tpfn0 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb_lo[0])\n" + "+\t\t\t\t >> PAGE_SHIFT];\n" + "+\tpfn1 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb_lo[1])\n" + "+\t\t\t\t >> PAGE_SHIFT];\n" + " \n" + " \tif (hpa0)\n" + " \t\t*hpa0 = pfn0 << PAGE_SHIFT;\n" + "@@ -391,9 +398,9 @@ int kvm_mips_handle_mapped_seg_tlb_fault\n" + " \t\t\t\t\t kvm_mips_get_kernel_asid(vcpu) :\n" + " \t\t\t\t\t kvm_mips_get_user_asid(vcpu));\n" + " \tentrylo0 = mips3_paddr_to_tlbpfn(pfn0 << PAGE_SHIFT) | (0x3 << 3) |\n" + "-\t\t (tlb->tlb_lo0 & MIPS3_PG_D) | (tlb->tlb_lo0 & MIPS3_PG_V);\n" + "+\t\t (tlb_lo[0] & MIPS3_PG_D) | (tlb_lo[0] & MIPS3_PG_V);\n" + " \tentrylo1 = mips3_paddr_to_tlbpfn(pfn1 << PAGE_SHIFT) | (0x3 << 3) |\n" + "-\t\t (tlb->tlb_lo1 & MIPS3_PG_D) | (tlb->tlb_lo1 & MIPS3_PG_V);\n" + "+\t\t (tlb_lo[1] & MIPS3_PG_D) | (tlb_lo[1] & MIPS3_PG_V);\n" + " \n" + " \tkvm_debug(\"@ %#lx tlb_lo0: 0x%08lx tlb_lo1: 0x%08lx\\n\", vcpu->arch.pc,\n" + " \t\t tlb->tlb_lo0, tlb->tlb_lo1);\n" + "\n" + "\n" + "Patches currently in stable-queue which might be from james.hogan@imgtec.com are\n" + "\n" + "queue-4.4/mips-kvm-add-missing-gfn-range-check.patch\n" + "queue-4.4/mips-kvm-propagate-kseg0-mapped-tlb-fault-errors.patch\n" + "queue-4.4/mips-kvm-fix-mapped-fault-broken-commpage-handling.patch\n" + queue-4.4/mips-kvm-fix-gfn-range-check-in-kseg0-tlb-faults.patch -b08418b581c0689e427c02ac7cea7f0cd4c6f1d3c74fc9bfaafbc97a22163ee4 +fe49cd42fefe0483d676ab499ad2a42b9fecec8cbe0d9a641f509bf15ec64b6d
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.