releases/4.18.14/kvm-x86-fix-l1tf-s-mmio-gfn-calculation.patch

   1 From daa07cbc9ae3da2d61b7ce900c0b9107d134f2c1 Mon Sep 17 00:00:00 2001
   2 From: Sean Christopherson <sean.j.christopherson@intel.com>
   3 Date: Tue, 25 Sep 2018 13:20:00 -0700
   4 Subject: KVM: x86: fix L1TF's MMIO GFN calculation
   5
   6 From: Sean Christopherson <sean.j.christopherson@intel.com>
   7
   8 commit daa07cbc9ae3da2d61b7ce900c0b9107d134f2c1 upstream.
   9
  10 One defense against L1TF in KVM is to always set the upper five bits
  11 of the *legal* physical address in the SPTEs for non-present and
  12 reserved SPTEs, e.g. MMIO SPTEs.  In the MMIO case, the GFN of the
  13 MMIO SPTE may overlap with the upper five bits that are being usurped
  14 to defend against L1TF.  To preserve the GFN, the bits of the GFN that
  15 overlap with the repurposed bits are shifted left into the reserved
  16 bits, i.e. the GFN in the SPTE will be split into high and low parts.
  17 When retrieving the GFN from the MMIO SPTE, e.g. to check for an MMIO
  18 access, get_mmio_spte_gfn() unshifts the affected bits and restores
  19 the original GFN for comparison.  Unfortunately, get_mmio_spte_gfn()
  20 neglects to mask off the reserved bits in the SPTE that were used to
  21 store the upper chunk of the GFN.  As a result, KVM fails to detect
  22 MMIO accesses whose GPA overlaps the repurprosed bits, which in turn
  23 causes guest panics and hangs.
  24
  25 Fix the bug by generating a mask that covers the lower chunk of the
  26 GFN, i.e. the bits that aren't shifted by the L1TF mitigation.  The
  27 alternative approach would be to explicitly zero the five reserved
  28 bits that are used to store the upper chunk of the GFN, but that
  29 requires additional run-time computation and makes an already-ugly
  30 bit of code even more inscrutable.
  31
  32 I considered adding a WARN_ON_ONCE(low_phys_bits-1 <= PAGE_SHIFT) to
  33 warn if GENMASK_ULL() generated a nonsensical value, but that seemed
  34 silly since that would mean a system that supports VMX has less than
  35 18 bits of physical address space...
  36
  37 Reported-by: Sakari Ailus <sakari.ailus@iki.fi>
  38 Fixes: d9b47449c1a1 ("kvm: x86: Set highest physical address bits in non-present/reserved SPTEs")
  39 Cc: Junaid Shahid <junaids@google.com>
  40 Cc: Jim Mattson <jmattson@google.com>
  41 Cc: stable@vger.kernel.org
  42 Reviewed-by: Junaid Shahid <junaids@google.com>
  43 Tested-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  44 Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
  45 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  46 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  47
  48 ---
  49  arch/x86/kvm/mmu.c |   24 ++++++++++++++++++++----
  50  1 file changed, 20 insertions(+), 4 deletions(-)
  51
  52 --- a/arch/x86/kvm/mmu.c
  53 +++ b/arch/x86/kvm/mmu.c
  54 @@ -232,6 +232,17 @@ static u64 __read_mostly shadow_nonprese
  55   */
  56  static const u64 shadow_nonpresent_or_rsvd_mask_len = 5;
  57
  58 +/*
  59 + * In some cases, we need to preserve the GFN of a non-present or reserved
  60 + * SPTE when we usurp the upper five bits of the physical address space to
  61 + * defend against L1TF, e.g. for MMIO SPTEs.  To preserve the GFN, we'll
  62 + * shift bits of the GFN that overlap with shadow_nonpresent_or_rsvd_mask
  63 + * left into the reserved bits, i.e. the GFN in the SPTE will be split into
  64 + * high and low parts.  This mask covers the lower bits of the GFN.
  65 + */
  66 +static u64 __read_mostly shadow_nonpresent_or_rsvd_lower_gfn_mask;
  67 +
  68 +
  69  static void mmu_spte_set(u64 *sptep, u64 spte);
  70
  71  void kvm_mmu_set_mmio_spte_mask(u64 mmio_mask, u64 mmio_value)
  72 @@ -338,9 +349,7 @@ static bool is_mmio_spte(u64 spte)
  73
  74  static gfn_t get_mmio_spte_gfn(u64 spte)
  75  {
  76 -       u64 mask = generation_mmio_spte_mask(MMIO_GEN_MASK) | shadow_mmio_mask |
  77 -                  shadow_nonpresent_or_rsvd_mask;
  78 -       u64 gpa = spte & ~mask;
  79 +       u64 gpa = spte & shadow_nonpresent_or_rsvd_lower_gfn_mask;
  80
  81         gpa |= (spte >> shadow_nonpresent_or_rsvd_mask_len)
  82                & shadow_nonpresent_or_rsvd_mask;
  83 @@ -404,6 +413,8 @@ EXPORT_SYMBOL_GPL(kvm_mmu_set_mask_ptes)
  84
  85  static void kvm_mmu_reset_all_pte_masks(void)
  86  {
  87 +       u8 low_phys_bits;
  88 +
  89         shadow_user_mask = 0;
  90         shadow_accessed_mask = 0;
  91         shadow_dirty_mask = 0;
  92 @@ -418,12 +429,17 @@ static void kvm_mmu_reset_all_pte_masks(
  93          * appropriate mask to guard against L1TF attacks. Otherwise, it is
  94          * assumed that the CPU is not vulnerable to L1TF.
  95          */
  96 +       low_phys_bits = boot_cpu_data.x86_phys_bits;
  97         if (boot_cpu_data.x86_phys_bits <
  98 -           52 - shadow_nonpresent_or_rsvd_mask_len)
  99 +           52 - shadow_nonpresent_or_rsvd_mask_len) {
 100                 shadow_nonpresent_or_rsvd_mask =
 101                         rsvd_bits(boot_cpu_data.x86_phys_bits -
 102                                   shadow_nonpresent_or_rsvd_mask_len,
 103                                   boot_cpu_data.x86_phys_bits - 1);
 104 +               low_phys_bits -= shadow_nonpresent_or_rsvd_mask_len;
 105 +       }
 106 +       shadow_nonpresent_or_rsvd_lower_gfn_mask =
 107 +               GENMASK_ULL(low_phys_bits - 1, PAGE_SHIFT);
 108  }
 109
 110  static int is_cpuid_PSE36(void)