From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Date: Fri, 12 Sep 2014 13:16:00 +0000 (+0200)
Subject: KVM: check for !is_zero_pfn() in kvm_is_mmio_pfn()
X-Git-Tag: v3.12.68~7
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=79024d0fdd8b839a0c7664e4027f4e6be99eb2be;p=thirdparty%2Fkernel%2Fstable.git

KVM: check for !is_zero_pfn() in kvm_is_mmio_pfn()

commit 85c8555ff07ef09261bd50d603cd4290cff5a8cc upstream.

Read-only memory ranges may be backed by the zero page, so avoid
misidentifying it a a MMIO pfn.

This fixes another issue I identified when testing QEMU+KVM_UEFI, where
a read to an uninitialized emulated NOR flash brought in the zero page,
but mapped as a read-write device region, because kvm_is_mmio_pfn()
misidentifies it as a MMIO pfn due to its PG_reserved bit being set.

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Fixes: b88657674d39 ("ARM: KVM: user_mem_abort: support stage 2 MMIO page mapping")
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 3351605d26087..e7a1166c3eb4b 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -104,7 +104,7 @@ static bool largepages_enabled = true;
 bool kvm_is_mmio_pfn(pfn_t pfn)
 {
 	if (pfn_valid(pfn))
-		return PageReserved(pfn_to_page(pfn));
+		return !is_zero_pfn(pfn) && PageReserved(pfn_to_page(pfn));
 
 	return true;
 }