rebase patches on top of Ubuntu-5.11.0-34.36

[pve-kernel.git] / patches / kernel / 0008-UBUNTU-SAUCE-KVM-nSVM-avoid-picking-up-unsupported-b.patch

diff --git a/patches/kernel/0008-UBUNTU-SAUCE-KVM-nSVM-avoid-picking-up-unsupported-b.patch b/patches/kernel/0008-UBUNTU-SAUCE-KVM-nSVM-avoid-picking-up-unsupported-b.patch
deleted file mode 100644 (file)
index 696a17f..0000000
--- a/patches/kernel/0008-UBUNTU-SAUCE-KVM-nSVM-avoid-picking-up-unsupported-b.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Maxim Levitsky <mlevitsk@redhat.com>
-Date: Thu, 29 Jul 2021 17:54:04 +0300
-Subject: [PATCH] UBUNTU: SAUCE: KVM: nSVM: avoid picking up unsupported bits
- from L2 in int_ctl
-
-This fixes CVE-2021-3653 that allowed a malicious L1 to run L2 with
-AVIC enabled, which allowed the L2 to exploit the uninitialized and enabled
-AVIC to read/write the host physical memory at some offsets.
-
-The bug was discovered by Maxim Levitsky.
-
-Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler")
-Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-CVE-2021-3653
-Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
-Acked-by: Stefan Bader <stefan.bader@canonical.com>
-Acked-by: Ben Romer <benjamin.romer@canonical.com>
-Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
-(cherry picked from commit d4c8d125f361e6aef5d58490672f7efa83dab257)
-Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
----
- arch/x86/include/asm/svm.h |  2 ++
- arch/x86/kvm/svm/nested.c  | 11 +++++++----
- arch/x86/kvm/svm/svm.c     |  8 ++++----
- 3 files changed, 13 insertions(+), 8 deletions(-)
-
-diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h
-index 1c561945b426..6278111bbf97 100644
---- a/arch/x86/include/asm/svm.h
-+++ b/arch/x86/include/asm/svm.h
-@@ -178,6 +178,8 @@ struct __attribute__ ((__packed__)) vmcb_control_area {
- #define V_IGN_TPR_SHIFT 20
- #define V_IGN_TPR_MASK (1 << V_IGN_TPR_SHIFT)
- 
-+#define V_IRQ_INJECTION_BITS_MASK (V_IRQ_MASK | V_INTR_PRIO_MASK | V_IGN_TPR_MASK)
-+
- #define V_INTR_MASKING_SHIFT 24
- #define V_INTR_MASKING_MASK (1 << V_INTR_MASKING_SHIFT)
- 
-diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
-index 0b3bf6e2aeb9..049d3cbbee5a 100644
---- a/arch/x86/kvm/svm/nested.c
-+++ b/arch/x86/kvm/svm/nested.c
-@@ -429,7 +429,10 @@ static void nested_prepare_vmcb_save(struct vcpu_svm *svm, struct vmcb *vmcb12)
- 
- static void nested_prepare_vmcb_control(struct vcpu_svm *svm)
- {
--      const u32 mask = V_INTR_MASKING_MASK | V_GIF_ENABLE_MASK | V_GIF_MASK;
-+      const u32 int_ctl_vmcb01_bits =
-+              V_INTR_MASKING_MASK | V_GIF_MASK | V_GIF_ENABLE_MASK;
-+
-+      const u32 int_ctl_vmcb12_bits = V_TPR_MASK | V_IRQ_INJECTION_BITS_MASK;
- 
-       if (nested_npt_enabled(svm))
-               nested_svm_init_mmu_context(&svm->vcpu);
-@@ -437,9 +440,9 @@ static void nested_prepare_vmcb_control(struct vcpu_svm *svm)
-       svm->vmcb->control.tsc_offset = svm->vcpu.arch.tsc_offset =
-               svm->vcpu.arch.l1_tsc_offset + svm->nested.ctl.tsc_offset;
- 
--      svm->vmcb->control.int_ctl             =
--              (svm->nested.ctl.int_ctl & ~mask) |
--              (svm->nested.hsave->control.int_ctl & mask);
-+      svm->vmcb->control.int_ctl =
-+              (svm->nested.ctl.int_ctl & int_ctl_vmcb12_bits) |
-+              (svm->nested.hsave->control.int_ctl & int_ctl_vmcb01_bits);
- 
-       svm->vmcb->control.virt_ext            = svm->nested.ctl.virt_ext;
-       svm->vmcb->control.int_vector          = svm->nested.ctl.int_vector;
-diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
-index 786c0eb8bd29..b676386f877e 100644
---- a/arch/x86/kvm/svm/svm.c
-+++ b/arch/x86/kvm/svm/svm.c
-@@ -1547,17 +1547,17 @@ static void svm_set_vintr(struct vcpu_svm *svm)
- 
- static void svm_clear_vintr(struct vcpu_svm *svm)
- {
--      const u32 mask = V_TPR_MASK | V_GIF_ENABLE_MASK | V_GIF_MASK | V_INTR_MASKING_MASK;
-       svm_clr_intercept(svm, INTERCEPT_VINTR);
- 
-       /* Drop int_ctl fields related to VINTR injection.  */
--      svm->vmcb->control.int_ctl &= mask;
-+      svm->vmcb->control.int_ctl &= ~V_IRQ_INJECTION_BITS_MASK;
-       if (is_guest_mode(&svm->vcpu)) {
--              svm->nested.hsave->control.int_ctl &= mask;
-+              svm->nested.hsave->control.int_ctl &= ~V_IRQ_INJECTION_BITS_MASK;
- 
-               WARN_ON((svm->vmcb->control.int_ctl & V_TPR_MASK) !=
-                       (svm->nested.ctl.int_ctl & V_TPR_MASK));
--              svm->vmcb->control.int_ctl |= svm->nested.ctl.int_ctl & ~mask;
-+              svm->vmcb->control.int_ctl |= svm->nested.ctl.int_ctl &
-+                      V_IRQ_INJECTION_BITS_MASK;
-       }
- 
-       vmcb_mark_dirty(svm->vmcb, VMCB_INTR);