# git rev-parse -q --verify 76fa4975f3ed12d15762bc979ca44078598ed8ee^{commit} 76fa4975f3ed12d15762bc979ca44078598ed8ee already have revision, skipping fetch # git checkout -q -f -B kisskb 76fa4975f3ed12d15762bc979ca44078598ed8ee # git clean -qxdf # < git log -1 # commit 76fa4975f3ed12d15762bc979ca44078598ed8ee # Author: Alexey Kardashevskiy # Date: Tue Jul 17 17:19:13 2018 +1000 # # KVM: PPC: Check if IOMMU page is contained in the pinned physical page # # A VM which has: # - a DMA capable device passed through to it (eg. network card); # - running a malicious kernel that ignores H_PUT_TCE failure; # - capability of using IOMMU pages bigger that physical pages # can create an IOMMU mapping that exposes (for example) 16MB of # the host physical memory to the device when only 64K was allocated to the VM. # # The remaining 16MB - 64K will be some other content of host memory, possibly # including pages of the VM, but also pages of host kernel memory, host # programs or other VMs. # # The attacking VM does not control the location of the page it can map, # and is only allowed to map as many pages as it has pages of RAM. # # We already have a check in drivers/vfio/vfio_iommu_spapr_tce.c that # an IOMMU page is contained in the physical page so the PCI hardware won't # get access to unassigned host memory; however this check is missing in # the KVM fastpath (H_PUT_TCE accelerated code). We were lucky so far and # did not hit this yet as the very first time when the mapping happens # we do not have tbl::it_userspace allocated yet and fall back to # the userspace which in turn calls VFIO IOMMU driver, this fails and # the guest does not retry, # # This stores the smallest preregistered page size in the preregistered # region descriptor and changes the mm_iommu_xxx API to check this against # the IOMMU page size. # # This calculates maximum page size as a minimum of the natural region # alignment and compound page size. For the page shift this uses the shift # returned by find_linux_pte() which indicates how the page is mapped to # the current userspace - if the page is huge and this is not a zero, then # it is a leaf pte and the page is mapped within the range. # # Fixes: 121f80ba68f1 ("KVM: PPC: VFIO: Add in-kernel acceleration for VFIO") # Cc: stable@vger.kernel.org # v4.12+ # Signed-off-by: Alexey Kardashevskiy # Reviewed-by: David Gibson # Signed-off-by: Michael Ellerman # < /opt/cross/kisskb/br-mipsel-o32-full-2016.08-613-ge98b4dd/bin/mipsel-linux-gcc --version # < git log --format=%s --max-count=1 76fa4975f3ed12d15762bc979ca44078598ed8ee # < make -s -j 20 ARCH=mips O=/kisskb/build/powerpc-fixes_mips-defconfig_mipsel CROSS_COMPILE=/opt/cross/kisskb/br-mipsel-o32-full-2016.08-613-ge98b4dd/bin/mipsel-linux- defconfig # make -s -j 20 ARCH=mips O=/kisskb/build/powerpc-fixes_mips-defconfig_mipsel CROSS_COMPILE=/opt/cross/kisskb/br-mipsel-o32-full-2016.08-613-ge98b4dd/bin/mipsel-linux- FIT description: Linux 4.18.0-rc3-g76fa497 Created: Wed Jul 18 19:31:39 2018 Image 0 (kernel@0) Description: Linux 4.18.0-rc3-g76fa497 Created: Wed Jul 18 19:31:39 2018 Type: Kernel Image Compression: gzip compressed Data Size: 4499490 Bytes = 4394.03 kB = 4.29 MB Architecture: MIPS OS: Linux Load Address: 0x80100000 Entry Point: 0x80877e70 Hash algo: sha1 Hash value: c4946ffdbb91d5b6b0ef808d99ab50451431fe92 Image 1 (fdt@boston) Description: img,boston Device Tree Created: Wed Jul 18 19:31:39 2018 Type: Flat Device Tree Compression: uncompressed Data Size: 3668 Bytes = 3.58 kB = 0.00 MB Architecture: MIPS Hash algo: sha1 Hash value: 569c37cc891ce1e1f3a193cb41cc691a5d2debb5 Image 2 (fdt@ni169445) Description: NI 169445 device tree Created: Wed Jul 18 19:31:39 2018 Type: Flat Device Tree Compression: uncompressed Data Size: 1871 Bytes = 1.83 kB = 0.00 MB Architecture: MIPS Hash algo: sha1 Hash value: 51b89b31605ee62038c8468c429af091dfc75ec7 Image 3 (fdt@xilfpga) Description: MIPSfpga (xilfpga) Device Tree Created: Wed Jul 18 19:31:39 2018 Type: Flat Device Tree Compression: uncompressed Data Size: 2708 Bytes = 2.64 kB = 0.00 MB Architecture: MIPS Hash algo: sha1 Hash value: 509ce58e44c561d54539e64e9d4b47054e696fc6 Default Configuration: 'conf@default' Configuration 0 (conf@default) Description: Generic Linux kernel Kernel: kernel@0 Configuration 1 (conf@boston) Description: Boston Linux kernel Kernel: kernel@0 FDT: fdt@boston Configuration 2 (conf@ni169445) Description: NI 169445 Linux Kernel Kernel: kernel@0 FDT: fdt@ni169445 Configuration 3 (conf@xilfpga) Description: MIPSfpga Linux kernel Kernel: kernel@0 FDT: fdt@xilfpga Completed OK # rm -rf /kisskb/build/powerpc-fixes_mips-defconfig_mipsel # Build took: 0:02:13.789952