x86/KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting

This allows to load a different number of MSRs depending on the context:
VMEXIT or VMENTER.

Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
CVE-2018-3620
CVE-2018-3646

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 71f97819bb7e67c002ae9bda651f5e94533f3ce5..56cf454c67d78ae34fd009ebe9160c0e686c82ec 100644 (file)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2063,12 +2063,18 @@ static void clear_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr)
        }
        i = find_msr(&m->guest, msr);
        if (i < 0)
-               return;
+               goto skip_guest;
        --m->guest.nr;
-       --m->host.nr;
        m->guest.val[i] = m->guest.val[m->guest.nr];
-       m->host.val[i] = m->host.val[m->host.nr];
        vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr);
+
+skip_guest:
+       i = find_msr(&m->host, msr);
+       if (i < 0)
+               return;
+
+       --m->host.nr;
+       m->host.val[i] = m->host.val[m->host.nr];
        vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr);
 }
 
@@ -2086,7 +2092,7 @@ static void add_atomic_switch_msr_special(struct vcpu_vmx *vmx,
 static void add_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr,
                                  u64 guest_val, u64 host_val)
 {
-       int i;
+       int i, j;
        struct msr_autoload *m = &vmx->msr_autoload;
 
        switch (msr) {
@@ -2122,21 +2128,24 @@ static void add_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr,
        }
 
        i = find_msr(&m->guest, msr);
-       if (i == NR_AUTOLOAD_MSRS) {
+       j = find_msr(&m->host, msr);
+       if (i == NR_AUTOLOAD_MSRS || j == NR_AUTOLOAD_MSRS) {
                printk_once(KERN_WARNING "Not enough msr switch entries. "
                                "Can't add msr %x\n", msr);
                return;
-       } else if (i < 0) {
+       }
+       if (i < 0) {
                i = m->guest.nr++;
-               ++m->host.nr;
                vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr);
+       }
+       if (j < 0) {
+               j = m->host.nr++;
                vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr);
        }
-
        m->guest.val[i].index = msr;
        m->guest.val[i].value = guest_val;
-       m->host.val[i].index = msr;
-       m->host.val[i].value = host_val;
+       m->host.val[j].index = msr;
+       m->host.val[j].value = host_val;
 }
 
 static bool update_transition_efer(struct vcpu_vmx *vmx, int efer_offset)