lkml.org 
[lkml]   [2016]   [Nov]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 175/346] MIPS: KVM: Fix mapped fault broken commpage handling
    3.16.39-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: James Hogan <james.hogan@imgtec.com>

    commit c604cffa93478f8888bec62b23d6073dad03d43a upstream.

    kvm_mips_handle_mapped_seg_tlb_fault() appears to map the guest page at
    virtual address 0 to PFN 0 if the guest has created its own mapping
    there. The intention is unclear, but it may have been an attempt to
    protect the zero page from being mapped to anything but the comm page in
    code paths you wouldn't expect from genuine commpage accesses (guest
    kernel mode cache instructions on that address, hitting trapping
    instructions when executing from that address with a coincidental TLB
    eviction during the KVM handling, and guest user mode accesses to that
    address).

    Fix this to check for mappings exactly at KVM_GUEST_COMMPAGE_ADDR (it
    may not be at address 0 since commit 42aa12e74e91 ("MIPS: KVM: Move
    commpage so 0x0 is unmapped")), and set the corresponding EntryLo to be
    interpreted as 0 (invalid).

    Fixes: 858dd5d45733 ("KVM/MIPS32: MMU/TLB operations for the Guest.")
    Signed-off-by: James Hogan <james.hogan@imgtec.com>
    Cc: Paolo Bonzini <pbonzini@redhat.com>
    Cc: "Radim Krčmář" <rkrcmar@redhat.com>
    Cc: Ralf Baechle <ralf@linux-mips.org>
    Cc: linux-mips@linux-mips.org
    Cc: kvm@vger.kernel.org
    Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
    [bwh: Backported to 3.16: adjust filename, context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    --- a/arch/mips/kvm/kvm_tlb.c
    +++ b/arch/mips/kvm/kvm_tlb.c
    @@ -361,21 +361,32 @@ kvm_mips_handle_mapped_seg_tlb_fault(str
    unsigned long entryhi = 0, entrylo0 = 0, entrylo1 = 0;
    struct kvm *kvm = vcpu->kvm;
    pfn_t pfn0, pfn1;
    + long tlb_lo[2];


    - if ((tlb->tlb_hi & VPN2_MASK) == 0) {
    - pfn0 = 0;
    - pfn1 = 0;
    - } else {
    - if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo0) >> PAGE_SHIFT) < 0)
    - return -1;
    -
    - if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo1) >> PAGE_SHIFT) < 0)
    - return -1;
    -
    - pfn0 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb->tlb_lo0) >> PAGE_SHIFT];
    - pfn1 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb->tlb_lo1) >> PAGE_SHIFT];
    - }
    + tlb_lo[0] = tlb->tlb_lo0;
    + tlb_lo[1] = tlb->tlb_lo1;
    +
    + /*
    + * The commpage address must not be mapped to anything else if the guest
    + * TLB contains entries nearby, or commpage accesses will break.
    + */
    + if (!((tlb->tlb_hi ^ KVM_GUEST_COMMPAGE_ADDR) &
    + VPN2_MASK & (PAGE_MASK << 1)))
    + tlb_lo[(KVM_GUEST_COMMPAGE_ADDR >> PAGE_SHIFT) & 1] = 0;
    +
    + if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[0])
    + >> PAGE_SHIFT) < 0)
    + return -1;
    +
    + if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[1])
    + >> PAGE_SHIFT) < 0)
    + return -1;
    +
    + pfn0 = kvm->arch.guest_pmap[
    + mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT];
    + pfn1 = kvm->arch.guest_pmap[
    + mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT];

    if (hpa0)
    *hpa0 = pfn0 << PAGE_SHIFT;
    @@ -387,9 +398,9 @@ kvm_mips_handle_mapped_seg_tlb_fault(str
    entryhi = (tlb->tlb_hi & VPN2_MASK) | (KVM_GUEST_KERNEL_MODE(vcpu) ?
    kvm_mips_get_kernel_asid(vcpu) : kvm_mips_get_user_asid(vcpu));
    entrylo0 = mips3_paddr_to_tlbpfn(pfn0 << PAGE_SHIFT) | (0x3 << 3) |
    - (tlb->tlb_lo0 & MIPS3_PG_D) | (tlb->tlb_lo0 & MIPS3_PG_V);
    + (tlb_lo[0] & MIPS3_PG_D) | (tlb_lo[0] & MIPS3_PG_V);
    entrylo1 = mips3_paddr_to_tlbpfn(pfn1 << PAGE_SHIFT) | (0x3 << 3) |
    - (tlb->tlb_lo1 & MIPS3_PG_D) | (tlb->tlb_lo1 & MIPS3_PG_V);
    + (tlb_lo[1] & MIPS3_PG_D) | (tlb_lo[1] & MIPS3_PG_V);

    kvm_debug("@ %#lx tlb_lo0: 0x%08lx tlb_lo1: 0x%08lx\n", vcpu->arch.pc,
    tlb->tlb_lo0, tlb->tlb_lo1);
    \
     
     \ /
      Last update: 2016-11-14 04:18    [W:3.101 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site