-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Maxim Levitsky <mlevitsk@redhat.com>
-Date: Thu, 29 Jul 2021 17:54:04 +0300
-Subject: [PATCH] UBUNTU: SAUCE: KVM: nSVM: avoid picking up unsupported bits
- from L2 in int_ctl
-
-This fixes CVE-2021-3653 that allowed a malicious L1 to run L2 with
-AVIC enabled, which allowed the L2 to exploit the uninitialized and enabled
-AVIC to read/write the host physical memory at some offsets.
-
-The bug was discovered by Maxim Levitsky.
-
-Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler")
-Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-CVE-2021-3653
-Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
-Acked-by: Stefan Bader <stefan.bader@canonical.com>
-Acked-by: Ben Romer <benjamin.romer@canonical.com>
-Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
-(cherry picked from commit d4c8d125f361e6aef5d58490672f7efa83dab257)
-Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
----
- arch/x86/include/asm/svm.h | 2 ++
- arch/x86/kvm/svm/nested.c | 11 +++++++----
- arch/x86/kvm/svm/svm.c | 8 ++++----
- 3 files changed, 13 insertions(+), 8 deletions(-)
-
-diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h
-index 1c561945b426..6278111bbf97 100644
---- a/arch/x86/include/asm/svm.h
-+++ b/arch/x86/include/asm/svm.h
-@@ -178,6 +178,8 @@ struct __attribute__ ((__packed__)) vmcb_control_area {
- #define V_IGN_TPR_SHIFT 20
- #define V_IGN_TPR_MASK (1 << V_IGN_TPR_SHIFT)
-
-+#define V_IRQ_INJECTION_BITS_MASK (V_IRQ_MASK | V_INTR_PRIO_MASK | V_IGN_TPR_MASK)
-+
- #define V_INTR_MASKING_SHIFT 24
- #define V_INTR_MASKING_MASK (1 << V_INTR_MASKING_SHIFT)
-
-diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
-index 0b3bf6e2aeb9..049d3cbbee5a 100644
---- a/arch/x86/kvm/svm/nested.c
-+++ b/arch/x86/kvm/svm/nested.c
-@@ -429,7 +429,10 @@ static void nested_prepare_vmcb_save(struct vcpu_svm *svm, struct vmcb *vmcb12)
-
- static void nested_prepare_vmcb_control(struct vcpu_svm *svm)
- {
-- const u32 mask = V_INTR_MASKING_MASK | V_GIF_ENABLE_MASK | V_GIF_MASK;
-+ const u32 int_ctl_vmcb01_bits =
-+ V_INTR_MASKING_MASK | V_GIF_MASK | V_GIF_ENABLE_MASK;
-+
-+ const u32 int_ctl_vmcb12_bits = V_TPR_MASK | V_IRQ_INJECTION_BITS_MASK;
-
- if (nested_npt_enabled(svm))
- nested_svm_init_mmu_context(&svm->vcpu);
-@@ -437,9 +440,9 @@ static void nested_prepare_vmcb_control(struct vcpu_svm *svm)
- svm->vmcb->control.tsc_offset = svm->vcpu.arch.tsc_offset =
- svm->vcpu.arch.l1_tsc_offset + svm->nested.ctl.tsc_offset;
-
-- svm->vmcb->control.int_ctl =
-- (svm->nested.ctl.int_ctl & ~mask) |
-- (svm->nested.hsave->control.int_ctl & mask);
-+ svm->vmcb->control.int_ctl =
-+ (svm->nested.ctl.int_ctl & int_ctl_vmcb12_bits) |
-+ (svm->nested.hsave->control.int_ctl & int_ctl_vmcb01_bits);
-
- svm->vmcb->control.virt_ext = svm->nested.ctl.virt_ext;
- svm->vmcb->control.int_vector = svm->nested.ctl.int_vector;
-diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
-index 786c0eb8bd29..b676386f877e 100644
---- a/arch/x86/kvm/svm/svm.c
-+++ b/arch/x86/kvm/svm/svm.c
-@@ -1547,17 +1547,17 @@ static void svm_set_vintr(struct vcpu_svm *svm)
-
- static void svm_clear_vintr(struct vcpu_svm *svm)
- {
-- const u32 mask = V_TPR_MASK | V_GIF_ENABLE_MASK | V_GIF_MASK | V_INTR_MASKING_MASK;
- svm_clr_intercept(svm, INTERCEPT_VINTR);
-
- /* Drop int_ctl fields related to VINTR injection. */
-- svm->vmcb->control.int_ctl &= mask;
-+ svm->vmcb->control.int_ctl &= ~V_IRQ_INJECTION_BITS_MASK;
- if (is_guest_mode(&svm->vcpu)) {
-- svm->nested.hsave->control.int_ctl &= mask;
-+ svm->nested.hsave->control.int_ctl &= ~V_IRQ_INJECTION_BITS_MASK;
-
- WARN_ON((svm->vmcb->control.int_ctl & V_TPR_MASK) !=
- (svm->nested.ctl.int_ctl & V_TPR_MASK));
-- svm->vmcb->control.int_ctl |= svm->nested.ctl.int_ctl & ~mask;
-+ svm->vmcb->control.int_ctl |= svm->nested.ctl.int_ctl &
-+ V_IRQ_INJECTION_BITS_MASK;
- }
-
- vmcb_mark_dirty(svm->vmcb, VMCB_INTR);