This is a note to let you know that I've just added the patch titled
KVM: x86: revalidate steal time cache if MSR value changes
to the 5.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
kvm-x86-revalidate-steal-time-cache-if-msr-value-changes.patch
and it can be found in the queue-5.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From stable-owner@xxxxxxxxxxxxxxx Wed May 10 20:16:44 2023
From: Rishabh Bhatnagar <risbhat@xxxxxxxxxx>
Date: Wed, 10 May 2023 18:15:45 +0000
Subject: KVM: x86: revalidate steal time cache if MSR value changes
To: <gregkh@xxxxxxxxxxxxxxxxxxx>, <stable@xxxxxxxxxxxxxxx>
Cc: <lee@xxxxxxxxxx>, <seanjc@xxxxxxxxxx>, <kvm@xxxxxxxxxxxxxxx>, <bp@xxxxxxxxx>, <mingo@xxxxxxxxxx>, <tglx@xxxxxxxxxxxxx>, <pbonzini@xxxxxxxxxx>, <vkuznets@xxxxxxxxxx>, <wanpengli@xxxxxxxxxxx>, <jmattson@xxxxxxxxxx>, <joro@xxxxxxxxxx>, Dave Young <ruyang@xxxxxxxxxx>, Xiaoying Yan <yiyan@xxxxxxxxxx>, "Dr . David Alan Gilbert" <dgilbert@xxxxxxxxxx>, David Woodhouse <dwmw@xxxxxxxxxxxx>, Rishabh Bhatnagar <risbhat@xxxxxxxxxx>, Allen Pais <apais@xxxxxxxxxxxxxxxxxxx>
Message-ID: <20230510181547.22451-8-risbhat@xxxxxxxxxx>
From: Rishabh Bhatnagar <risbhat@xxxxxxxxxx>
From: Paolo Bonzini <pbonzini@xxxxxxxxxx>
commit 901d3765fa804ce42812f1d5b1f3de2dfbb26723 upstream.
Commit 7e2175ebd695 ("KVM: x86: Fix recording of guest steal time
/ preempted status", 2021-11-11) open coded the previous call to
kvm_map_gfn, but in doing so it dropped the comparison between the cached
guest physical address and the one in the MSR. This cause an incorrect
cache hit if the guest modifies the steal time address while the memslots
remain the same. This can happen with kexec, in which case the steal
time data is written at the address used by the old kernel instead of
the old one.
While at it, rename the variable from gfn to gpa since it is a plain
physical address and not a right-shifted one.
Reported-by: Dave Young <ruyang@xxxxxxxxxx>
Reported-by: Xiaoying Yan <yiyan@xxxxxxxxxx>
Analyzed-by: Dr. David Alan Gilbert <dgilbert@xxxxxxxxxx>
Cc: David Woodhouse <dwmw@xxxxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
Fixes: 7e2175ebd695 ("KVM: x86: Fix recording of guest steal time / preempted status")
Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
Signed-off-by: Rishabh Bhatnagar <risbhat@xxxxxxxxxx>
Tested-by: Allen Pais <apais@xxxxxxxxxxxxxxxxxxx>
Acked-by: Sean Christopherson <seanjc@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
arch/x86/kvm/x86.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3025,6 +3025,7 @@ static void record_steal_time(struct kvm
struct gfn_to_hva_cache *ghc = &vcpu->arch.st.cache;
struct kvm_steal_time __user *st;
struct kvm_memslots *slots;
+ gpa_t gpa = vcpu->arch.st.msr_val & KVM_STEAL_VALID_BITS;
u64 steal;
u32 version;
@@ -3037,13 +3038,12 @@ static void record_steal_time(struct kvm
slots = kvm_memslots(vcpu->kvm);
if (unlikely(slots->generation != ghc->generation ||
+ gpa != ghc->gpa ||
kvm_is_error_hva(ghc->hva) || !ghc->memslot)) {
- gfn_t gfn = vcpu->arch.st.msr_val & KVM_STEAL_VALID_BITS;
-
/* We rely on the fact that it fits in a single page. */
BUILD_BUG_ON((sizeof(*st) - 1) & KVM_STEAL_VALID_BITS);
- if (kvm_gfn_to_hva_cache_init(vcpu->kvm, ghc, gfn, sizeof(*st)) ||
+ if (kvm_gfn_to_hva_cache_init(vcpu->kvm, ghc, gpa, sizeof(*st)) ||
kvm_is_error_hva(ghc->hva) || !ghc->memslot)
return;
}
Patches currently in stable-queue which might be from stable-owner@xxxxxxxxxxxxxxx are
queue-5.10/kvm-fix-steal-time-asm-constraints.patch
queue-5.10/kvm-x86-ensure-pv-tlb-flush-tracepoint-reflects-kvm-behavior.patch
queue-5.10/blk-crypto-make-blk_crypto_evict_key-more-robust.patch
queue-5.10/kvm-x86-do-not-report-preemption-if-the-steal-time-cache-is-stale.patch
queue-5.10/kvm-x86-do-not-set-st-preempted-when-going-back-to-user-space.patch
queue-5.10/kvm-x86-move-guest_pv_has-out-of-user_access-section.patch
queue-5.10/kvm-x86-fix-recording-of-guest-steal-time-preempted-status.patch
queue-5.10/blk-mq-release-crypto-keyslot-before-reporting-i-o-complete.patch
queue-5.10/kvm-x86-revalidate-steal-time-cache-if-msr-value-changes.patch
queue-5.10/blk-crypto-make-blk_crypto_evict_key-return-void.patch
queue-5.10/kvm-x86-remove-obsolete-disabling-of-page-faults-in-kvm_arch_vcpu_put.patch
