[3.13.y-ckt stable] Patch KVM: MIPS: Don't leak FPU/DSP to guest has been added to staging queue

2015-03-31 Thread Kamal Mostafa
This is a note to let you know that I have just added a patch titled

KVM: MIPS: Don't leak FPU/DSP to guest

to the linux-3.13.y-queue branch of the 3.13.y-ckt extended stable tree 
which can be found at:

 
http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.13.y-queue

This patch is scheduled to be released in version 3.13.11-ckt18.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.13.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

--

From adb94d141d17042e7eee5118f4f6358bfa61ffd9 Mon Sep 17 00:00:00 2001
From: James Hogan james.ho...@imgtec.com
Date: Wed, 4 Feb 2015 17:06:37 +
Subject: KVM: MIPS: Don't leak FPU/DSP to guest

commit f798217dfd038af981a18bbe4bc57027a08bb182 upstream.

The FPU and DSP are enabled via the CP0 Status CU1 and MX bits by
kvm_mips_set_c0_status() on a guest exit, presumably in case there is
active state that needs saving if pre-emption occurs. However neither of
these bits are cleared again when returning to the guest.

This effectively gives the guest access to the FPU/DSP hardware after
the first guest exit even though it is not aware of its presence,
allowing FP instructions in guest user code to intermittently actually
execute instead of trapping into the guest OS for emulation. It will
then read  manipulate the hardware FP registers which technically
belong to the user process (e.g. QEMU), or are stale from another user
process. It can also crash the guest OS by causing an FP exception, for
which a guest exception handler won't have been registered.

First lets save and disable the FPU (and MSA) state with lose_fpu(1)
before entering the guest. This simplifies the problem, especially for
when guest FPU/MSA support is added in the future, and prevents FR=1 FPU
state being live when the FR bit gets cleared for the guest, which
according to the architecture causes the contents of the FPU and vector
registers to become UNPREDICTABLE.

We can then safely remove the enabling of the FPU in
kvm_mips_set_c0_status(), since there should never be any active FPU or
MSA state to save at pre-emption, which should plug the FPU leak.

DSP state is always live rather than being lazily restored, so for that
it is simpler to just clear the MX bit again when re-entering the guest.

Signed-off-by: James Hogan james.ho...@imgtec.com
Cc: Paolo Bonzini pbonz...@redhat.com
Cc: Ralf Baechle r...@linux-mips.org
Cc: Sanjay Lal sanj...@kymasys.com
Cc: Gleb Natapov g...@kernel.org
Cc: kvm@vger.kernel.org
Cc: linux-m...@linux-mips.org
Signed-off-by: Paolo Bonzini pbonz...@redhat.com
[ luis: backported to 3.16: files rename:
  - locore.S - kvm_locore.S
  - mips.c - kvm_mips.c ]
Signed-off-by: Luis Henriques luis.henriq...@canonical.com

Signed-off-by: Kamal Mostafa ka...@canonical.com
---
 arch/mips/kvm/kvm_locore.S | 2 +-
 arch/mips/kvm/kvm_mips.c   | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/mips/kvm/kvm_locore.S b/arch/mips/kvm/kvm_locore.S
index bbace09..03a2db5 100644
--- a/arch/mips/kvm/kvm_locore.S
+++ b/arch/mips/kvm/kvm_locore.S
@@ -428,7 +428,7 @@ __kvm_mips_return_to_guest:
/* Setup status register for running guest in UM */
.setat
or  v1, v1, (ST0_EXL | KSU_USER | ST0_IE)
-   and v1, v1, ~ST0_CU0
+   and v1, v1, ~(ST0_CU0 | ST0_MX)
.setnoat
mtc0v1, CP0_STATUS
ehb
diff --git a/arch/mips/kvm/kvm_mips.c b/arch/mips/kvm/kvm_mips.c
index 4d058a7..bdc5eeb 100644
--- a/arch/mips/kvm/kvm_mips.c
+++ b/arch/mips/kvm/kvm_mips.c
@@ -15,6 +15,7 @@
 #include linux/vmalloc.h
 #include linux/fs.h
 #include linux/bootmem.h
+#include asm/fpu.h
 #include asm/page.h
 #include asm/cacheflush.h
 #include asm/mmu_context.h
@@ -424,6 +425,8 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct 
kvm_run *run)
vcpu-mmio_needed = 0;
}

+   lose_fpu(1);
+
local_irq_disable();
/* Check if we have any exceptions/interrupts pending */
kvm_mips_deliver_interrupts(vcpu,
@@ -1028,9 +1031,6 @@ void kvm_mips_set_c0_status(void)
 {
uint32_t status = read_c0_status();

-   if (cpu_has_fpu)
-   status |= (ST0_CU1);
-
if (cpu_has_dsp)
status |= (ST0_MX);

--
1.9.1

--
To unsubscribe from this list: send the line unsubscribe kvm in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[3.16.y-ckt stable] Patch KVM: MIPS: Don't leak FPU/DSP to guest has been added to staging queue

2015-03-02 Thread Luis Henriques
This is a note to let you know that I have just added a patch titled

KVM: MIPS: Don't leak FPU/DSP to guest

to the linux-3.16.y-queue branch of the 3.16.y-ckt extended stable tree 
which can be found at:

 
http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.16.y-queue

This patch is scheduled to be released in version 3.16.7-ckt8.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.16.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Luis

--

From b4db76b6e5898d4f4389cc944e5262788fa90d8c Mon Sep 17 00:00:00 2001
From: James Hogan james.ho...@imgtec.com
Date: Wed, 4 Feb 2015 17:06:37 +
Subject: KVM: MIPS: Don't leak FPU/DSP to guest

commit f798217dfd038af981a18bbe4bc57027a08bb182 upstream.

The FPU and DSP are enabled via the CP0 Status CU1 and MX bits by
kvm_mips_set_c0_status() on a guest exit, presumably in case there is
active state that needs saving if pre-emption occurs. However neither of
these bits are cleared again when returning to the guest.

This effectively gives the guest access to the FPU/DSP hardware after
the first guest exit even though it is not aware of its presence,
allowing FP instructions in guest user code to intermittently actually
execute instead of trapping into the guest OS for emulation. It will
then read  manipulate the hardware FP registers which technically
belong to the user process (e.g. QEMU), or are stale from another user
process. It can also crash the guest OS by causing an FP exception, for
which a guest exception handler won't have been registered.

First lets save and disable the FPU (and MSA) state with lose_fpu(1)
before entering the guest. This simplifies the problem, especially for
when guest FPU/MSA support is added in the future, and prevents FR=1 FPU
state being live when the FR bit gets cleared for the guest, which
according to the architecture causes the contents of the FPU and vector
registers to become UNPREDICTABLE.

We can then safely remove the enabling of the FPU in
kvm_mips_set_c0_status(), since there should never be any active FPU or
MSA state to save at pre-emption, which should plug the FPU leak.

DSP state is always live rather than being lazily restored, so for that
it is simpler to just clear the MX bit again when re-entering the guest.

Signed-off-by: James Hogan james.ho...@imgtec.com
Cc: Paolo Bonzini pbonz...@redhat.com
Cc: Ralf Baechle r...@linux-mips.org
Cc: Sanjay Lal sanj...@kymasys.com
Cc: Gleb Natapov g...@kernel.org
Cc: kvm@vger.kernel.org
Cc: linux-m...@linux-mips.org
Signed-off-by: Paolo Bonzini pbonz...@redhat.com
[ luis: backported to 3.16: files rename:
  - locore.S - kvm_locore.S
  - mips.c - kvm_mips.c ]
Signed-off-by: Luis Henriques luis.henriq...@canonical.com
---
 arch/mips/kvm/kvm_locore.S | 2 +-
 arch/mips/kvm/kvm_mips.c   | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/mips/kvm/kvm_locore.S b/arch/mips/kvm/kvm_locore.S
index 033ac343e72c..17376cd838e6 100644
--- a/arch/mips/kvm/kvm_locore.S
+++ b/arch/mips/kvm/kvm_locore.S
@@ -428,7 +428,7 @@ __kvm_mips_return_to_guest:
/* Setup status register for running guest in UM */
.setat
or  v1, v1, (ST0_EXL | KSU_USER | ST0_IE)
-   and v1, v1, ~ST0_CU0
+   and v1, v1, ~(ST0_CU0 | ST0_MX)
.setnoat
mtc0v1, CP0_STATUS
ehb
diff --git a/arch/mips/kvm/kvm_mips.c b/arch/mips/kvm/kvm_mips.c
index f3c56a182fd8..d84f96e51349 100644
--- a/arch/mips/kvm/kvm_mips.c
+++ b/arch/mips/kvm/kvm_mips.c
@@ -15,6 +15,7 @@
 #include linux/vmalloc.h
 #include linux/fs.h
 #include linux/bootmem.h
+#include asm/fpu.h
 #include asm/page.h
 #include asm/cacheflush.h
 #include asm/mmu_context.h
@@ -413,6 +414,8 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct 
kvm_run *run)
vcpu-mmio_needed = 0;
}

+   lose_fpu(1);
+
local_irq_disable();
/* Check if we have any exceptions/interrupts pending */
kvm_mips_deliver_interrupts(vcpu,
@@ -1028,9 +1031,6 @@ void kvm_mips_set_c0_status(void)
 {
uint32_t status = read_c0_status();

-   if (cpu_has_fpu)
-   status |= (ST0_CU1);
-
if (cpu_has_dsp)
status |= (ST0_MX);

--
To unsubscribe from this list: send the line unsubscribe kvm in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: [PATCH] KVM: MIPS: Don't leak FPU/DSP to guest

2015-02-10 Thread Paolo Bonzini
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1



On 09/02/2015 23:58, James Hogan wrote:
 First lets save and disable the FPU (and MSA) state with
 lose_fpu(1)
 
 Please don't apply this patch yet. lose_fpu() uses function
 symbols which aren't exported for modules to use yet, so that'll
 need fixing first or KVM won't build as a module.

Well, too late. :)

James/Ralf, should I revert, or can that be fixed during the RC period?

Paolo
-BEGIN PGP SIGNATURE-
Version: GnuPG v2

iQEcBAEBAgAGBQJU2brAAAoJEL/70l94x66DdXIIAImur1pdSKYWw1+FzZH+H8Xo
86j9EfptORk554o0a62LG9dOTY+5sJfAV9CoB7Q+8IfdLDKxpk1sLjMkiS0E0EWU
2ilQfjYEXLTgCW38p03ype4m6g4uSfT16dnizrwnUviFk/EvVgCWHy88tA3+Vfn/
WgoxcXkd+hguyNaLR2oAVqyNhAETLTo4kQQqKwGbXFXf0GLno44pj7bJprCR/jlO
4+sUzuV5dno/GI6z8dyMmASo0QEy+IoXJ+aSw+IoRED9nlBMAS4+7uD4XfocGpca
En5KmXVnyJoazgV3Y6w2ymS606S0JNGRcOzqr8ZbOHtjJmAsZxjuVxP6PVzZqQg=
=ozzu
-END PGP SIGNATURE-
--
To unsubscribe from this list: send the line unsubscribe kvm in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: [PATCH] KVM: MIPS: Don't leak FPU/DSP to guest

2015-02-10 Thread James Hogan
On Tue, Feb 10, 2015 at 09:01:07AM +0100, Paolo Bonzini wrote:
 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA1
 
 
 
 On 09/02/2015 23:58, James Hogan wrote:
  First lets save and disable the FPU (and MSA) state with
  lose_fpu(1)
  
  Please don't apply this patch yet. lose_fpu() uses function
  symbols which aren't exported for modules to use yet, so that'll
  need fixing first or KVM won't build as a module.
 
 Well, too late. :)
 
 James/Ralf, should I revert, or can that be fixed during the RC period?

Okay no problem. I have patches ready so I'll submit today.

Sorry about that!

Cheers
James

 
 Paolo
 -BEGIN PGP SIGNATURE-
 Version: GnuPG v2
 
 iQEcBAEBAgAGBQJU2brAAAoJEL/70l94x66DdXIIAImur1pdSKYWw1+FzZH+H8Xo
 86j9EfptORk554o0a62LG9dOTY+5sJfAV9CoB7Q+8IfdLDKxpk1sLjMkiS0E0EWU
 2ilQfjYEXLTgCW38p03ype4m6g4uSfT16dnizrwnUviFk/EvVgCWHy88tA3+Vfn/
 WgoxcXkd+hguyNaLR2oAVqyNhAETLTo4kQQqKwGbXFXf0GLno44pj7bJprCR/jlO
 4+sUzuV5dno/GI6z8dyMmASo0QEy+IoXJ+aSw+IoRED9nlBMAS4+7uD4XfocGpca
 En5KmXVnyJoazgV3Y6w2ymS606S0JNGRcOzqr8ZbOHtjJmAsZxjuVxP6PVzZqQg=
 =ozzu
 -END PGP SIGNATURE-


signature.asc
Description: Digital signature


Re: [PATCH] KVM: MIPS: Don't leak FPU/DSP to guest

2015-02-09 Thread James Hogan
Hi Paolo,

On Wed, Feb 04, 2015 at 05:06:37PM +, James Hogan wrote:
 The FPU and DSP are enabled via the CP0 Status CU1 and MX bits by
 kvm_mips_set_c0_status() on a guest exit, presumably in case there is
 active state that needs saving if pre-emption occurs. However neither of
 these bits are cleared again when returning to the guest.
 
 This effectively gives the guest access to the FPU/DSP hardware after
 the first guest exit even though it is not aware of its presence,
 allowing FP instructions in guest user code to intermittently actually
 execute instead of trapping into the guest OS for emulation. It will
 then read  manipulate the hardware FP registers which technically
 belong to the user process (e.g. QEMU), or are stale from another user
 process. It can also crash the guest OS by causing an FP exception, for
 which a guest exception handler won't have been registered.
 
 First lets save and disable the FPU (and MSA) state with lose_fpu(1)

Please don't apply this patch yet. lose_fpu() uses function symbols
which aren't exported for modules to use yet, so that'll need fixing
first or KVM won't build as a module.

Thanks
James

 before entering the guest. This simplifies the problem, especially for
 when guest FPU/MSA support is added in the future, and prevents FR=1 FPU
 state being live when the FR bit gets cleared for the guest, which
 according to the architecture causes the contents of the FPU and vector
 registers to become UNPREDICTABLE.
 
 We can then safely remove the enabling of the FPU in
 kvm_mips_set_c0_status(), since there should never be any active FPU or
 MSA state to save at pre-emption, which should plug the FPU leak.
 
 DSP state is always live rather than being lazily restored, so for that
 it is simpler to just clear the MX bit again when re-entering the guest.
 
 Signed-off-by: James Hogan james.ho...@imgtec.com
 Cc: Paolo Bonzini pbonz...@redhat.com
 Cc: Ralf Baechle r...@linux-mips.org
 Cc: Sanjay Lal sanj...@kymasys.com
 Cc: Gleb Natapov g...@kernel.org
 Cc: kvm@vger.kernel.org
 Cc: linux-m...@linux-mips.org
 Cc: sta...@vger.kernel.org # v3.10+: 044f0f03eca0: MIPS: KVM: Deliver guest 
 interrupts
 Cc: sta...@vger.kernel.org # v3.10+
 ---
  arch/mips/kvm/locore.S | 2 +-
  arch/mips/kvm/mips.c   | 6 +++---
  2 files changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/arch/mips/kvm/locore.S b/arch/mips/kvm/locore.S
 index d7279c03c517..4a68b176d6e4 100644
 --- a/arch/mips/kvm/locore.S
 +++ b/arch/mips/kvm/locore.S
 @@ -434,7 +434,7 @@ __kvm_mips_return_to_guest:
   /* Setup status register for running guest in UM */
   .setat
   or  v1, v1, (ST0_EXL | KSU_USER | ST0_IE)
 - and v1, v1, ~ST0_CU0
 + and v1, v1, ~(ST0_CU0 | ST0_MX)
   .setnoat
   mtc0v1, CP0_STATUS
   ehb
 diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
 index dd133ccecec4..270bbd41769e 100644
 --- a/arch/mips/kvm/mips.c
 +++ b/arch/mips/kvm/mips.c
 @@ -15,6 +15,7 @@
  #include linux/vmalloc.h
  #include linux/fs.h
  #include linux/bootmem.h
 +#include asm/fpu.h
  #include asm/page.h
  #include asm/cacheflush.h
  #include asm/mmu_context.h
 @@ -379,6 +380,8 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct 
 kvm_run *run)
   vcpu-mmio_needed = 0;
   }
  
 + lose_fpu(1);
 +
   local_irq_disable();
   /* Check if we have any exceptions/interrupts pending */
   kvm_mips_deliver_interrupts(vcpu,
 @@ -987,9 +990,6 @@ static void kvm_mips_set_c0_status(void)
  {
   uint32_t status = read_c0_status();
  
 - if (cpu_has_fpu)
 - status |= (ST0_CU1);
 -
   if (cpu_has_dsp)
   status |= (ST0_MX);
  
 -- 
 2.0.5
 


signature.asc
Description: Digital signature


[PATCH] KVM: MIPS: Don't leak FPU/DSP to guest

2015-02-04 Thread James Hogan
The FPU and DSP are enabled via the CP0 Status CU1 and MX bits by
kvm_mips_set_c0_status() on a guest exit, presumably in case there is
active state that needs saving if pre-emption occurs. However neither of
these bits are cleared again when returning to the guest.

This effectively gives the guest access to the FPU/DSP hardware after
the first guest exit even though it is not aware of its presence,
allowing FP instructions in guest user code to intermittently actually
execute instead of trapping into the guest OS for emulation. It will
then read  manipulate the hardware FP registers which technically
belong to the user process (e.g. QEMU), or are stale from another user
process. It can also crash the guest OS by causing an FP exception, for
which a guest exception handler won't have been registered.

First lets save and disable the FPU (and MSA) state with lose_fpu(1)
before entering the guest. This simplifies the problem, especially for
when guest FPU/MSA support is added in the future, and prevents FR=1 FPU
state being live when the FR bit gets cleared for the guest, which
according to the architecture causes the contents of the FPU and vector
registers to become UNPREDICTABLE.

We can then safely remove the enabling of the FPU in
kvm_mips_set_c0_status(), since there should never be any active FPU or
MSA state to save at pre-emption, which should plug the FPU leak.

DSP state is always live rather than being lazily restored, so for that
it is simpler to just clear the MX bit again when re-entering the guest.

Signed-off-by: James Hogan james.ho...@imgtec.com
Cc: Paolo Bonzini pbonz...@redhat.com
Cc: Ralf Baechle r...@linux-mips.org
Cc: Sanjay Lal sanj...@kymasys.com
Cc: Gleb Natapov g...@kernel.org
Cc: kvm@vger.kernel.org
Cc: linux-m...@linux-mips.org
Cc: sta...@vger.kernel.org # v3.10+: 044f0f03eca0: MIPS: KVM: Deliver guest 
interrupts
Cc: sta...@vger.kernel.org # v3.10+
---
 arch/mips/kvm/locore.S | 2 +-
 arch/mips/kvm/mips.c   | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/mips/kvm/locore.S b/arch/mips/kvm/locore.S
index d7279c03c517..4a68b176d6e4 100644
--- a/arch/mips/kvm/locore.S
+++ b/arch/mips/kvm/locore.S
@@ -434,7 +434,7 @@ __kvm_mips_return_to_guest:
/* Setup status register for running guest in UM */
.setat
or  v1, v1, (ST0_EXL | KSU_USER | ST0_IE)
-   and v1, v1, ~ST0_CU0
+   and v1, v1, ~(ST0_CU0 | ST0_MX)
.setnoat
mtc0v1, CP0_STATUS
ehb
diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
index dd133ccecec4..270bbd41769e 100644
--- a/arch/mips/kvm/mips.c
+++ b/arch/mips/kvm/mips.c
@@ -15,6 +15,7 @@
 #include linux/vmalloc.h
 #include linux/fs.h
 #include linux/bootmem.h
+#include asm/fpu.h
 #include asm/page.h
 #include asm/cacheflush.h
 #include asm/mmu_context.h
@@ -379,6 +380,8 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct 
kvm_run *run)
vcpu-mmio_needed = 0;
}
 
+   lose_fpu(1);
+
local_irq_disable();
/* Check if we have any exceptions/interrupts pending */
kvm_mips_deliver_interrupts(vcpu,
@@ -987,9 +990,6 @@ static void kvm_mips_set_c0_status(void)
 {
uint32_t status = read_c0_status();
 
-   if (cpu_has_fpu)
-   status |= (ST0_CU1);
-
if (cpu_has_dsp)
status |= (ST0_MX);
 
-- 
2.0.5

--
To unsubscribe from this list: send the line unsubscribe kvm in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html