mirror of
https://github.com/followmsi/android_kernel_google_msm.git
synced 2024-11-06 23:17:41 +00:00
777f8f3bcd
commitfda4e2e855upstream. In kvm_lapic_sync_from_vapic and kvm_lapic_sync_to_vapic there is the potential to corrupt kernel memory if userspace provides an address that is at the end of a page. This patches concerts those functions to use kvm_write_guest_cached and kvm_read_guest_cached. It also checks the vapic_address specified by userspace during ioctl processing and returns an error to userspace if the address is not a valid GPA. This is generally not guest triggerable, because the required write is done by firmware that runs before the guest. Also, it only affects AMD processors and oldish Intel that do not have the FlexPriority feature (unless you disable FlexPriority, of course; then newer processors are also affected). Fixes:b93463aa59('KVM: Accelerated apic support') Reported-by: Andrew Honig <ahonig@google.com> Cc: stable@vger.kernel.org Signed-off-by: Andrew Honig <ahonig@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> [ lizf: backported to 3.4: based on Paolo's backport hints for <3.10 ] Signed-off-by: Li Zefan <lizefan@huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
63 lines
2.2 KiB
C
63 lines
2.2 KiB
C
#ifndef __KVM_X86_LAPIC_H
|
|
#define __KVM_X86_LAPIC_H
|
|
|
|
#include "iodev.h"
|
|
#include "kvm_timer.h"
|
|
|
|
#include <linux/kvm_host.h>
|
|
|
|
struct kvm_lapic {
|
|
unsigned long base_address;
|
|
struct kvm_io_device dev;
|
|
struct kvm_timer lapic_timer;
|
|
u32 divide_count;
|
|
struct kvm_vcpu *vcpu;
|
|
bool irr_pending;
|
|
void *regs;
|
|
gpa_t vapic_addr;
|
|
struct gfn_to_hva_cache vapic_cache;
|
|
};
|
|
int kvm_create_lapic(struct kvm_vcpu *vcpu);
|
|
void kvm_free_lapic(struct kvm_vcpu *vcpu);
|
|
|
|
int kvm_apic_has_interrupt(struct kvm_vcpu *vcpu);
|
|
int kvm_apic_accept_pic_intr(struct kvm_vcpu *vcpu);
|
|
int kvm_get_apic_interrupt(struct kvm_vcpu *vcpu);
|
|
void kvm_lapic_reset(struct kvm_vcpu *vcpu);
|
|
u64 kvm_lapic_get_cr8(struct kvm_vcpu *vcpu);
|
|
void kvm_lapic_set_tpr(struct kvm_vcpu *vcpu, unsigned long cr8);
|
|
void kvm_lapic_set_eoi(struct kvm_vcpu *vcpu);
|
|
void kvm_lapic_set_base(struct kvm_vcpu *vcpu, u64 value);
|
|
u64 kvm_lapic_get_base(struct kvm_vcpu *vcpu);
|
|
void kvm_apic_set_version(struct kvm_vcpu *vcpu);
|
|
|
|
int kvm_apic_match_physical_addr(struct kvm_lapic *apic, u16 dest);
|
|
int kvm_apic_match_logical_addr(struct kvm_lapic *apic, u8 mda);
|
|
int kvm_apic_set_irq(struct kvm_vcpu *vcpu, struct kvm_lapic_irq *irq);
|
|
int kvm_apic_local_deliver(struct kvm_lapic *apic, int lvt_type);
|
|
|
|
u64 kvm_get_apic_base(struct kvm_vcpu *vcpu);
|
|
void kvm_set_apic_base(struct kvm_vcpu *vcpu, u64 data);
|
|
void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu);
|
|
int kvm_lapic_enabled(struct kvm_vcpu *vcpu);
|
|
bool kvm_apic_present(struct kvm_vcpu *vcpu);
|
|
int kvm_lapic_find_highest_irr(struct kvm_vcpu *vcpu);
|
|
|
|
u64 kvm_get_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu);
|
|
void kvm_set_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu, u64 data);
|
|
|
|
int kvm_lapic_set_vapic_addr(struct kvm_vcpu *vcpu, gpa_t vapic_addr);
|
|
void kvm_lapic_sync_from_vapic(struct kvm_vcpu *vcpu);
|
|
void kvm_lapic_sync_to_vapic(struct kvm_vcpu *vcpu);
|
|
|
|
int kvm_x2apic_msr_write(struct kvm_vcpu *vcpu, u32 msr, u64 data);
|
|
int kvm_x2apic_msr_read(struct kvm_vcpu *vcpu, u32 msr, u64 *data);
|
|
|
|
int kvm_hv_vapic_msr_write(struct kvm_vcpu *vcpu, u32 msr, u64 data);
|
|
int kvm_hv_vapic_msr_read(struct kvm_vcpu *vcpu, u32 msr, u64 *data);
|
|
|
|
static inline bool kvm_hv_vapic_assist_page_enabled(struct kvm_vcpu *vcpu)
|
|
{
|
|
return vcpu->arch.hv_vapic & HV_X64_MSR_APIC_ASSIST_PAGE_ENABLE;
|
|
}
|
|
#endif
|