Commit 6a97c4d5 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm 

Pull kvm fixes from Paolo Bonzini:
 "arm64:

   - Fix ITS EventID sanitisation when restoring an interrupt
     translation table.

   - Fix PPI memory leak when failing to initialise a vcpu.

   - Correctly return an error when the validation of a hypervisor trace
     descriptor fails, and limit this validation to protected mode only.

  RISC-V:

   - Fix invalid HVA warning in steal-time recording

   - Return SBI_ERR_FAILURE to guest upon OOM in pmu_event_info() and
     pmu_snapshot_set_shmem()

   - Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler

   - Fix sign extension of value for MMIO loads

  s390:

   - Fix bugs in vSIE (nested virtualization) and UCONTROL, caused by
     the page table rewrite.

  x86:

   - Apply erratum #1235 workaround (disable AVIC IPI virtualization) on
     Hygon Family 18h, just like on AMD Family 17h.

   - When KVM_CAP_X86_APIC_BUS_CYCLES_NS is queried on a specific VM,
     return the VM's configured APIC bus frequency instead of the
     default. This is less confusing (read: not wrong) and makes it
     easier to fill in CPUID information that communicates the APIC bus
     frequency to the guest.

  Selftests:

   - Do not include glibc-internal <bits/endian.h>; it worked by chance
     and broke building KVM selftests with musl"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)
  KVM: selftests: Verify that KVM returns the configured APIC cycle length
  KVM: x86: Return the VM's configured APIC bus frequency when queried
  KVM: selftests: elf: Include <endian.h> instead of <bits/endian.h>
  KVM: s390: Properly reset zero bit in PGSTE
  KVM: s390: vsie: Fix redundant rmap entries
  KVM: s390: vsie: Fix unshadowing logic
  KVM: s390: Fix leaking kvm_s390_mmu_cache in case of errors
  KVM: s390: vsie: Fix memory leak when unshadowing
  KVM: arm64: Fix nVHE/pKVM hyp tracing error on invalid desc
  KVM: arm64: vgic: Free private_irqs when init fails after allocation
  KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits
  RISC-V: KVM: Fix sign extension for MMIO loads
  RISC-V: KVM: Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler
  riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when OOM
  riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem() when OOM
  RISC-V: KVM: Fix invalid HVA warning in steal-time recording
parents 3526d746 9a12fa52

arch/arm64/kvm/arm.c

+3 −1
Original line number Diff line number Diff line
@@ -555,8 +555,10 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu) 
	kvm_destroy_mpidr_data(vcpu->kvm);



	err = kvm_vgic_vcpu_init(vcpu);

	if (err)

	if (err) {

		kvm_vgic_vcpu_destroy(vcpu);

		return err;

	}



	err = kvm_share_hyp(vcpu, vcpu + 1);

	if (err)

arch/arm64/kvm/hyp/nvhe/trace.c

+7 −2
Original line number Diff line number Diff line
@@ -164,13 +164,16 @@ static int hyp_trace_buffer_load(struct hyp_trace_buffer *trace_buffer, 
	return ret;

}



static bool hyp_trace_desc_validate(struct hyp_trace_desc *desc, size_t desc_size)

static bool hyp_trace_desc_is_valid(struct hyp_trace_desc *desc, size_t desc_size)

{

	struct ring_buffer_desc *rb_desc;

	unsigned int cpu;

	size_t nr_bpages;

	void *desc_end;



	if (!is_protected_kvm_enabled())

		return true;



	/*

	 * Both desc_size and bpages_backing_size are untrusted host-provided

	 * values. We rely on __pkvm_host_donate_hyp() to enforce their validity.
@@ -212,8 +215,10 @@ int __tracing_load(unsigned long desc_hva, size_t desc_size) 
	if (ret)

		return ret;



	if (!hyp_trace_desc_validate(desc, desc_size))

	if (!hyp_trace_desc_is_valid(desc, desc_size)) {

		ret = -EINVAL;

		goto err_release_desc;

	}



	hyp_spin_lock(&trace_buffer.lock);

arch/arm64/kvm/vgic/vgic-its.c

+4 −0
Original line number Diff line number Diff line
@@ -2307,6 +2307,10 @@ static int vgic_its_restore_dte(struct vgic_its *its, u32 id, 
	/* dte entry is valid */

	offset = (entry & KVM_ITS_DTE_NEXT_MASK) >> KVM_ITS_DTE_NEXT_SHIFT;



	/* Mimic the MAPD behaviour and reject invalid EID bits. */

	if (num_eventid_bits > VITS_TYPER_IDBITS)

		return -EINVAL;



	if (!vgic_its_check_id(its, baser, id, NULL))

		return -EINVAL;

arch/riscv/kvm/vcpu_insn.c

+4 −5
Original line number Diff line number Diff line
@@ -415,7 +415,6 @@ int kvm_riscv_vcpu_mmio_load(struct kvm_vcpu *vcpu, struct kvm_run *run, 
		shift = 8 * (sizeof(ulong) - len);

	} else if ((insn & INSN_MASK_LBU) == INSN_MATCH_LBU) {

		len = 1;

		shift = 8 * (sizeof(ulong) - len);

#ifdef CONFIG_64BIT

	} else if ((insn & INSN_MASK_LD) == INSN_MATCH_LD) {

		len = 8;
@@ -649,22 +648,22 @@ int kvm_riscv_vcpu_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run) 
	case 1:

		data8 = *((u8 *)run->mmio.data);

		SET_RD(insn, &vcpu->arch.guest_context,

			(ulong)data8 << shift >> shift);

			(long)((ulong)data8 << shift) >> shift);

		break;

	case 2:

		data16 = *((u16 *)run->mmio.data);

		SET_RD(insn, &vcpu->arch.guest_context,

			(ulong)data16 << shift >> shift);

			(long)((ulong)data16 << shift) >> shift);

		break;

	case 4:

		data32 = *((u32 *)run->mmio.data);

		SET_RD(insn, &vcpu->arch.guest_context,

			(ulong)data32 << shift >> shift);

			(long)((ulong)data32 << shift) >> shift);

		break;

	case 8:

		data64 = *((u64 *)run->mmio.data);

		SET_RD(insn, &vcpu->arch.guest_context,

			(ulong)data64 << shift >> shift);

			(long)((ulong)data64 << shift) >> shift);

		break;

	default:

		return -EOPNOTSUPP;

arch/riscv/kvm/vcpu_pmu.c

+8 −4
Original line number Diff line number Diff line
@@ -453,8 +453,10 @@ int kvm_riscv_vcpu_pmu_snapshot_set_shmem(struct kvm_vcpu *vcpu, unsigned long s 
	}



	kvpmu->sdata = kzalloc(snapshot_area_size, GFP_ATOMIC);

	if (!kvpmu->sdata)

		return -ENOMEM;

	if (!kvpmu->sdata) {

		sbiret = SBI_ERR_FAILURE;

		goto out;

	}



	/* No need to check writable slot explicitly as kvm_vcpu_write_guest does it internally */

	if (kvm_vcpu_write_guest(vcpu, saddr, kvpmu->sdata, snapshot_area_size)) {
@@ -499,8 +501,10 @@ int kvm_riscv_vcpu_pmu_event_info(struct kvm_vcpu *vcpu, unsigned long saddr_low 
	}



	einfo = kzalloc(shmem_size, GFP_KERNEL);

	if (!einfo)

		return -ENOMEM;

	if (!einfo) {

		ret = SBI_ERR_FAILURE;

		goto out;

	}



	ret = kvm_vcpu_read_guest(vcpu, shmem, einfo, shmem_size);

	if (ret) {