linux.git/virt, branch v4.17

KVM: arm/arm64: VGIC/ITS save/restore: protect kvm_read_guest() calls

2018-05-15T11:36:53+00:00

kvm_read_guest() will eventually look up in kvm_memslots(), which requires
either to hold the kvm->slots_lock or to be inside a kvm->srcu critical
section.
In contrast to x86 and s390 we don't take the SRCU lock on every guest
exit, so we have to do it individually for each kvm_read_guest() call.
Use the newly introduced wrapper for that.

Cc: Stable  # 4.12+
Reported-by: Jan Glauber 
Signed-off-by: Andre Przywara 
Acked-by: Christoffer Dall 
Signed-off-by: Paolo Bonzini

KVM: arm/arm64: VGIC/ITS: protect kvm_read_guest() calls with SRCU lock

2018-05-15T11:36:49+00:00

kvm_read_guest() will eventually look up in kvm_memslots(), which requires
either to hold the kvm->slots_lock or to be inside a kvm->srcu critical
section.
In contrast to x86 and s390 we don't take the SRCU lock on every guest
exit, so we have to do it individually for each kvm_read_guest() call.

Provide a wrapper which does that and use that everywhere.

Note that ending the SRCU critical section before returning from the
kvm_read_guest() wrapper is safe, because the data has been *copied*, so
we don't need to rely on valid references to the memslot anymore.

Cc: Stable  # 4.8+
Reported-by: Jan Glauber 
Signed-off-by: Andre Przywara 
Acked-by: Christoffer Dall 
Signed-off-by: Paolo Bonzini

KVM: arm/arm64: VGIC/ITS: Promote irq_lock() in update_affinity

2018-05-15T11:36:44+00:00

Apparently the development of update_affinity() overlapped with the
promotion of irq_lock to be _irqsave, so the patch didn't convert this
lock over. This will make lockdep complain.

Fix this by disabling IRQs around the lock.

Cc: stable@vger.kernel.org
Fixes: 08c9fd042117 ("KVM: arm/arm64: vITS: Add a helper to update the affinity of an LPI")
Reported-by: Jan Glauber 
Signed-off-by: Andre Przywara 
Acked-by: Christoffer Dall 
Signed-off-by: Paolo Bonzini

KVM: arm/arm64: Properly protect VGIC locks from IRQs

2018-05-15T11:36:27+00:00

As Jan reported [1], lockdep complains about the VGIC not being bullet
proof. This seems to be due to two issues:
- When commit 006df0f34930 ("KVM: arm/arm64: Support calling
  vgic_update_irq_pending from irq context") promoted irq_lock and
  ap_list_lock to _irqsave, we forgot two instances of irq_lock.
  lockdeps seems to pick those up.
- If a lock is _irqsave, any other locks we take inside them should be
  _irqsafe as well. So the lpi_list_lock needs to be promoted also.

This fixes both issues by simply making the remaining instances of those
locks _irqsave.
One irq_lock is addressed in a separate patch, to simplify backporting.

[1] http://lists.infradead.org/pipermail/linux-arm-kernel/2018-May/575718.html

Cc: stable@vger.kernel.org
Fixes: 006df0f34930 ("KVM: arm/arm64: Support calling vgic_update_irq_pending from irq context")
Reported-by: Jan Glauber 
Acked-by: Christoffer Dall 
Signed-off-by: Andre Przywara 
Signed-off-by: Paolo Bonzini

Merge tag 'kvmarm-fixes-for-4.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm

2018-05-05T21:05:31+00:00

KVM/arm fixes for 4.17, take #2

- Fix proxying of GICv2 CPU interface accesses
- Fix crash when switching to BE
- Track source vcpu git GICv2 SGIs
- Fix an outdated bit of documentation

KVM: arm/arm64: vgic_init: Cleanup reference to process_maintenance

2018-05-04T15:44:54+00:00

One comment still mentioned process_maintenance operations after
commit af0614991ab6 ("KVM: arm/arm64: vgic: Get rid of unnecessary
process_maintenance operation")

Update the comment to point to vgic_fold_lr_state instead, which
is where maintenance interrupts are taken care of.

Acked-by: Christoffer Dall 
Signed-off-by: Valentin Schneider 
Signed-off-by: Marc Zyngier

rMerge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

2018-04-27T23:13:31+00:00

Pull KVM fixes from Radim Krčmář:
 "ARM:
   - PSCI selection API, a leftover from 4.16 (for stable)
   - Kick vcpu on active interrupt affinity change
   - Plug a VMID allocation race on oversubscribed systems
   - Silence debug messages
   - Update Christoffer's email address (linaro -> arm)

  x86:
   - Expose userspace-relevant bits of a newly added feature
   - Fix TLB flushing on VMX with VPID, but without EPT"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  x86/headers/UAPI: Move DISABLE_EXITS KVM capability bits to the UAPI
  kvm: apic: Flush TLB after APIC mode/address change if VPIDs are in use
  arm/arm64: KVM: Add PSCI version selection API
  KVM: arm/arm64: vgic: Kick new VCPU on interrupt migration
  arm64: KVM: Demote SVE and LORegion warnings to debug only
  MAINTAINERS: Update e-mail address for Christoffer Dall
  KVM: arm/arm64: Close VMID generation race

KVM: arm/arm64: vgic: Fix source vcpu issues for GICv2 SGI

2018-04-27T11:39:09+00:00

Now that we make sure we don't inject multiple instances of the
same GICv2 SGI at the same time, we've made another bug more
obvious:

If we exit with an active SGI, we completely lose track of which
vcpu it came from. On the next entry, we restore it with 0 as a
source, and if that wasn't the right one, too bad. While this
doesn't seem to trouble GIC-400, the architectural model gets
offended and doesn't deactivate the interrupt on EOI.

Another connected issue is that we will happilly make pending
an interrupt from another vcpu, overriding the above zero with
something that is just as inconsistent. Don't do that.

The final issue is that we signal a maintenance interrupt when
no pending interrupts are present in the LR. Assuming we've fixed
the two issues above, we end-up in a situation where we keep
exiting as soon as we've reached the active state, and not be
able to inject the following pending.

The fix comes in 3 parts:
- GICv2 SGIs have their source vcpu saved if they are active on
  exit, and restored on entry
- Multi-SGIs cannot go via the Pending+Active state, as this would
  corrupt the source field
- Multi-SGIs are converted to using MI on EOI instead of NPIE

Fixes: 16ca6a607d84bef0 ("KVM: arm/arm64: vgic: Don't populate multiple LRs with the same vintid")
Reported-by: Mark Rutland 
Tested-by: Mark Rutland 
Reviewed-by: Christoffer Dall 
Signed-off-by: Marc Zyngier

KVM: arm/arm64: vgic: fix possible spectre-v1 in vgic_mmio_read_apr()

2018-04-26T16:06:00+00:00

It's possible for userspace to control n. Sanitize n when using it as an
array index.

Note that while it appears that n must be bound to the interval [0,3]
due to the way it is extracted from addr, we cannot guarantee that
compiler transformations (and/or future refactoring) will ensure this is
the case, and given this is a slow path it's better to always perform
the masking.

Found by smatch.

Signed-off-by: Mark Rutland 
Acked-by: Christoffer Dall 
Acked-by: Marc Zyngier 
Cc: kvmarm@lists.cs.columbia.edu
Signed-off-by: Will Deacon

KVM: arm/arm64: vgic: fix possible spectre-v1 in vgic_get_irq()

2018-04-26T16:02:37+00:00

It's possible for userspace to control intid. Sanitize intid when using
it as an array index.

At the same time, sort the includes when adding .

Found by smatch.

Signed-off-by: Mark Rutland 
Acked-by: Christoffer Dall 
Acked-by: Marc Zyngier 
Cc: kvmarm@lists.cs.columbia.edu
Signed-off-by: Will Deacon