KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798)
[pandora-kernel.git] / virt / kvm / ioapic.c
1 /*
2  *  Copyright (C) 2001  MandrakeSoft S.A.
3  *  Copyright 2010 Red Hat, Inc. and/or its affiliates.
4  *
5  *    MandrakeSoft S.A.
6  *    43, rue d'Aboukir
7  *    75002 Paris - France
8  *    http://www.linux-mandrake.com/
9  *    http://www.mandrakesoft.com/
10  *
11  *  This library is free software; you can redistribute it and/or
12  *  modify it under the terms of the GNU Lesser General Public
13  *  License as published by the Free Software Foundation; either
14  *  version 2 of the License, or (at your option) any later version.
15  *
16  *  This library is distributed in the hope that it will be useful,
17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
19  *  Lesser General Public License for more details.
20  *
21  *  You should have received a copy of the GNU Lesser General Public
22  *  License along with this library; if not, write to the Free Software
23  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
24  *
25  *  Yunhong Jiang <yunhong.jiang@intel.com>
26  *  Yaozu (Eddie) Dong <eddie.dong@intel.com>
27  *  Based on Xen 3.1 code.
28  */
29
30 #include <linux/kvm_host.h>
31 #include <linux/kvm.h>
32 #include <linux/mm.h>
33 #include <linux/highmem.h>
34 #include <linux/smp.h>
35 #include <linux/hrtimer.h>
36 #include <linux/io.h>
37 #include <linux/slab.h>
38 #include <linux/export.h>
39 #include <asm/processor.h>
40 #include <asm/page.h>
41 #include <asm/current.h>
42 #include <trace/events/kvm.h>
43
44 #include "ioapic.h"
45 #include "lapic.h"
46 #include "irq.h"
47
48 #if 0
49 #define ioapic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg)
50 #else
51 #define ioapic_debug(fmt, arg...)
52 #endif
53 static int ioapic_deliver(struct kvm_ioapic *vioapic, int irq);
54
55 static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
56                                           unsigned long addr,
57                                           unsigned long length)
58 {
59         unsigned long result = 0;
60
61         switch (ioapic->ioregsel) {
62         case IOAPIC_REG_VERSION:
63                 result = ((((IOAPIC_NUM_PINS - 1) & 0xff) << 16)
64                           | (IOAPIC_VERSION_ID & 0xff));
65                 break;
66
67         case IOAPIC_REG_APIC_ID:
68         case IOAPIC_REG_ARB_ID:
69                 result = ((ioapic->id & 0xf) << 24);
70                 break;
71
72         default:
73                 {
74                         u32 redir_index = (ioapic->ioregsel - 0x10) >> 1;
75                         u64 redir_content;
76
77                         if (redir_index < IOAPIC_NUM_PINS)
78                                 redir_content =
79                                         ioapic->redirtbl[redir_index].bits;
80                         else
81                                 redir_content = ~0ULL;
82
83                         result = (ioapic->ioregsel & 0x1) ?
84                             (redir_content >> 32) & 0xffffffff :
85                             redir_content & 0xffffffff;
86                         break;
87                 }
88         }
89
90         return result;
91 }
92
93 static int ioapic_service(struct kvm_ioapic *ioapic, unsigned int idx)
94 {
95         union kvm_ioapic_redirect_entry *pent;
96         int injected = -1;
97
98         pent = &ioapic->redirtbl[idx];
99
100         if (!pent->fields.mask) {
101                 injected = ioapic_deliver(ioapic, idx);
102                 if (injected && pent->fields.trig_mode == IOAPIC_LEVEL_TRIG)
103                         pent->fields.remote_irr = 1;
104         }
105
106         return injected;
107 }
108
109 static void update_handled_vectors(struct kvm_ioapic *ioapic)
110 {
111         DECLARE_BITMAP(handled_vectors, 256);
112         int i;
113
114         memset(handled_vectors, 0, sizeof(handled_vectors));
115         for (i = 0; i < IOAPIC_NUM_PINS; ++i)
116                 __set_bit(ioapic->redirtbl[i].fields.vector, handled_vectors);
117         memcpy(ioapic->handled_vectors, handled_vectors,
118                sizeof(handled_vectors));
119         smp_wmb();
120 }
121
122 void kvm_ioapic_calculate_eoi_exitmap(struct kvm_vcpu *vcpu,
123                                         u64 *eoi_exit_bitmap)
124 {
125         struct kvm_ioapic *ioapic = vcpu->kvm->arch.vioapic;
126         union kvm_ioapic_redirect_entry *e;
127         struct kvm_lapic_irq irqe;
128         int index;
129
130         spin_lock(&ioapic->lock);
131         /* traverse ioapic entry to set eoi exit bitmap*/
132         for (index = 0; index < IOAPIC_NUM_PINS; index++) {
133                 e = &ioapic->redirtbl[index];
134                 if (!e->fields.mask &&
135                         (e->fields.trig_mode == IOAPIC_LEVEL_TRIG ||
136                          kvm_irq_has_notifier(ioapic->kvm, KVM_IRQCHIP_IOAPIC,
137                                  index))) {
138                         irqe.dest_id = e->fields.dest_id;
139                         irqe.vector = e->fields.vector;
140                         irqe.dest_mode = e->fields.dest_mode;
141                         irqe.delivery_mode = e->fields.delivery_mode << 8;
142                         kvm_calculate_eoi_exitmap(vcpu, &irqe, eoi_exit_bitmap);
143                 }
144         }
145         spin_unlock(&ioapic->lock);
146 }
147 EXPORT_SYMBOL_GPL(kvm_ioapic_calculate_eoi_exitmap);
148
149 void kvm_ioapic_make_eoibitmap_request(struct kvm *kvm)
150 {
151         struct kvm_ioapic *ioapic = kvm->arch.vioapic;
152
153         if (!kvm_apic_vid_enabled(kvm) || !ioapic)
154                 return;
155         kvm_make_update_eoibitmap_request(kvm);
156 }
157
158 static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val)
159 {
160         unsigned index;
161         bool mask_before, mask_after;
162         union kvm_ioapic_redirect_entry *e;
163
164         switch (ioapic->ioregsel) {
165         case IOAPIC_REG_VERSION:
166                 /* Writes are ignored. */
167                 break;
168
169         case IOAPIC_REG_APIC_ID:
170                 ioapic->id = (val >> 24) & 0xf;
171                 break;
172
173         case IOAPIC_REG_ARB_ID:
174                 break;
175
176         default:
177                 index = (ioapic->ioregsel - 0x10) >> 1;
178
179                 ioapic_debug("change redir index %x val %x\n", index, val);
180                 if (index >= IOAPIC_NUM_PINS)
181                         return;
182                 e = &ioapic->redirtbl[index];
183                 mask_before = e->fields.mask;
184                 if (ioapic->ioregsel & 1) {
185                         e->bits &= 0xffffffff;
186                         e->bits |= (u64) val << 32;
187                 } else {
188                         e->bits &= ~0xffffffffULL;
189                         e->bits |= (u32) val;
190                         e->fields.remote_irr = 0;
191                 }
192                 update_handled_vectors(ioapic);
193                 mask_after = e->fields.mask;
194                 if (mask_before != mask_after)
195                         kvm_fire_mask_notifiers(ioapic->kvm, KVM_IRQCHIP_IOAPIC, index, mask_after);
196                 if (e->fields.trig_mode == IOAPIC_LEVEL_TRIG
197                     && ioapic->irr & (1 << index))
198                         ioapic_service(ioapic, index);
199                 kvm_ioapic_make_eoibitmap_request(ioapic->kvm);
200                 break;
201         }
202 }
203
204 static int ioapic_deliver(struct kvm_ioapic *ioapic, int irq)
205 {
206         union kvm_ioapic_redirect_entry *entry = &ioapic->redirtbl[irq];
207         struct kvm_lapic_irq irqe;
208
209         ioapic_debug("dest=%x dest_mode=%x delivery_mode=%x "
210                      "vector=%x trig_mode=%x\n",
211                      entry->fields.dest_id, entry->fields.dest_mode,
212                      entry->fields.delivery_mode, entry->fields.vector,
213                      entry->fields.trig_mode);
214
215         irqe.dest_id = entry->fields.dest_id;
216         irqe.vector = entry->fields.vector;
217         irqe.dest_mode = entry->fields.dest_mode;
218         irqe.trig_mode = entry->fields.trig_mode;
219         irqe.delivery_mode = entry->fields.delivery_mode << 8;
220         irqe.level = 1;
221         irqe.shorthand = 0;
222
223         return kvm_irq_delivery_to_apic(ioapic->kvm, NULL, &irqe);
224 }
225
226 int kvm_ioapic_set_irq(struct kvm_ioapic *ioapic, int irq, int irq_source_id,
227                        int level)
228 {
229         u32 old_irr;
230         u32 mask = 1 << irq;
231         union kvm_ioapic_redirect_entry entry;
232         int ret, irq_level;
233
234         BUG_ON(irq < 0 || irq >= IOAPIC_NUM_PINS);
235
236         spin_lock(&ioapic->lock);
237         old_irr = ioapic->irr;
238         irq_level = __kvm_irq_line_state(&ioapic->irq_states[irq],
239                                          irq_source_id, level);
240         entry = ioapic->redirtbl[irq];
241         irq_level ^= entry.fields.polarity;
242         if (!irq_level) {
243                 ioapic->irr &= ~mask;
244                 ret = 1;
245         } else {
246                 int edge = (entry.fields.trig_mode == IOAPIC_EDGE_TRIG);
247                 ioapic->irr |= mask;
248                 if ((edge && old_irr != ioapic->irr) ||
249                     (!edge && !entry.fields.remote_irr))
250                         ret = ioapic_service(ioapic, irq);
251                 else
252                         ret = 0; /* report coalesced interrupt */
253         }
254         trace_kvm_ioapic_set_irq(entry.bits, irq, ret == 0);
255         spin_unlock(&ioapic->lock);
256
257         return ret;
258 }
259
260 void kvm_ioapic_clear_all(struct kvm_ioapic *ioapic, int irq_source_id)
261 {
262         int i;
263
264         spin_lock(&ioapic->lock);
265         for (i = 0; i < KVM_IOAPIC_NUM_PINS; i++)
266                 __clear_bit(irq_source_id, &ioapic->irq_states[i]);
267         spin_unlock(&ioapic->lock);
268 }
269
270 static void __kvm_ioapic_update_eoi(struct kvm_ioapic *ioapic, int vector,
271                                      int trigger_mode)
272 {
273         int i;
274
275         for (i = 0; i < IOAPIC_NUM_PINS; i++) {
276                 union kvm_ioapic_redirect_entry *ent = &ioapic->redirtbl[i];
277
278                 if (ent->fields.vector != vector)
279                         continue;
280
281                 /*
282                  * We are dropping lock while calling ack notifiers because ack
283                  * notifier callbacks for assigned devices call into IOAPIC
284                  * recursively. Since remote_irr is cleared only after call
285                  * to notifiers if the same vector will be delivered while lock
286                  * is dropped it will be put into irr and will be delivered
287                  * after ack notifier returns.
288                  */
289                 spin_unlock(&ioapic->lock);
290                 kvm_notify_acked_irq(ioapic->kvm, KVM_IRQCHIP_IOAPIC, i);
291                 spin_lock(&ioapic->lock);
292
293                 if (trigger_mode != IOAPIC_LEVEL_TRIG)
294                         continue;
295
296                 ASSERT(ent->fields.trig_mode == IOAPIC_LEVEL_TRIG);
297                 ent->fields.remote_irr = 0;
298                 if (!ent->fields.mask && (ioapic->irr & (1 << i)))
299                         ioapic_service(ioapic, i);
300         }
301 }
302
303 bool kvm_ioapic_handles_vector(struct kvm *kvm, int vector)
304 {
305         struct kvm_ioapic *ioapic = kvm->arch.vioapic;
306         smp_rmb();
307         return test_bit(vector, ioapic->handled_vectors);
308 }
309
310 void kvm_ioapic_update_eoi(struct kvm *kvm, int vector, int trigger_mode)
311 {
312         struct kvm_ioapic *ioapic = kvm->arch.vioapic;
313
314         spin_lock(&ioapic->lock);
315         __kvm_ioapic_update_eoi(ioapic, vector, trigger_mode);
316         spin_unlock(&ioapic->lock);
317 }
318
319 static inline struct kvm_ioapic *to_ioapic(struct kvm_io_device *dev)
320 {
321         return container_of(dev, struct kvm_ioapic, dev);
322 }
323
324 static inline int ioapic_in_range(struct kvm_ioapic *ioapic, gpa_t addr)
325 {
326         return ((addr >= ioapic->base_address &&
327                  (addr < ioapic->base_address + IOAPIC_MEM_LENGTH)));
328 }
329
330 static int ioapic_mmio_read(struct kvm_io_device *this, gpa_t addr, int len,
331                             void *val)
332 {
333         struct kvm_ioapic *ioapic = to_ioapic(this);
334         u32 result;
335         if (!ioapic_in_range(ioapic, addr))
336                 return -EOPNOTSUPP;
337
338         ioapic_debug("addr %lx\n", (unsigned long)addr);
339         ASSERT(!(addr & 0xf));  /* check alignment */
340
341         addr &= 0xff;
342         spin_lock(&ioapic->lock);
343         switch (addr) {
344         case IOAPIC_REG_SELECT:
345                 result = ioapic->ioregsel;
346                 break;
347
348         case IOAPIC_REG_WINDOW:
349                 result = ioapic_read_indirect(ioapic, addr, len);
350                 break;
351
352         default:
353                 result = 0;
354                 break;
355         }
356         spin_unlock(&ioapic->lock);
357
358         switch (len) {
359         case 8:
360                 *(u64 *) val = result;
361                 break;
362         case 1:
363         case 2:
364         case 4:
365                 memcpy(val, (char *)&result, len);
366                 break;
367         default:
368                 printk(KERN_WARNING "ioapic: wrong length %d\n", len);
369         }
370         return 0;
371 }
372
373 static int ioapic_mmio_write(struct kvm_io_device *this, gpa_t addr, int len,
374                              const void *val)
375 {
376         struct kvm_ioapic *ioapic = to_ioapic(this);
377         u32 data;
378         if (!ioapic_in_range(ioapic, addr))
379                 return -EOPNOTSUPP;
380
381         ioapic_debug("ioapic_mmio_write addr=%p len=%d val=%p\n",
382                      (void*)addr, len, val);
383         ASSERT(!(addr & 0xf));  /* check alignment */
384
385         switch (len) {
386         case 8:
387         case 4:
388                 data = *(u32 *) val;
389                 break;
390         case 2:
391                 data = *(u16 *) val;
392                 break;
393         case 1:
394                 data = *(u8  *) val;
395                 break;
396         default:
397                 printk(KERN_WARNING "ioapic: Unsupported size %d\n", len);
398                 return 0;
399         }
400
401         addr &= 0xff;
402         spin_lock(&ioapic->lock);
403         switch (addr) {
404         case IOAPIC_REG_SELECT:
405                 ioapic->ioregsel = data & 0xFF; /* 8-bit register */
406                 break;
407
408         case IOAPIC_REG_WINDOW:
409                 ioapic_write_indirect(ioapic, data);
410                 break;
411 #ifdef  CONFIG_IA64
412         case IOAPIC_REG_EOI:
413                 __kvm_ioapic_update_eoi(ioapic, data, IOAPIC_LEVEL_TRIG);
414                 break;
415 #endif
416
417         default:
418                 break;
419         }
420         spin_unlock(&ioapic->lock);
421         return 0;
422 }
423
424 void kvm_ioapic_reset(struct kvm_ioapic *ioapic)
425 {
426         int i;
427
428         for (i = 0; i < IOAPIC_NUM_PINS; i++)
429                 ioapic->redirtbl[i].fields.mask = 1;
430         ioapic->base_address = IOAPIC_DEFAULT_BASE_ADDRESS;
431         ioapic->ioregsel = 0;
432         ioapic->irr = 0;
433         ioapic->id = 0;
434         update_handled_vectors(ioapic);
435 }
436
437 static const struct kvm_io_device_ops ioapic_mmio_ops = {
438         .read     = ioapic_mmio_read,
439         .write    = ioapic_mmio_write,
440 };
441
442 int kvm_ioapic_init(struct kvm *kvm)
443 {
444         struct kvm_ioapic *ioapic;
445         int ret;
446
447         ioapic = kzalloc(sizeof(struct kvm_ioapic), GFP_KERNEL);
448         if (!ioapic)
449                 return -ENOMEM;
450         spin_lock_init(&ioapic->lock);
451         kvm->arch.vioapic = ioapic;
452         kvm_ioapic_reset(ioapic);
453         kvm_iodevice_init(&ioapic->dev, &ioapic_mmio_ops);
454         ioapic->kvm = kvm;
455         mutex_lock(&kvm->slots_lock);
456         ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, ioapic->base_address,
457                                       IOAPIC_MEM_LENGTH, &ioapic->dev);
458         mutex_unlock(&kvm->slots_lock);
459         if (ret < 0) {
460                 kvm->arch.vioapic = NULL;
461                 kfree(ioapic);
462         }
463
464         return ret;
465 }
466
467 void kvm_ioapic_destroy(struct kvm *kvm)
468 {
469         struct kvm_ioapic *ioapic = kvm->arch.vioapic;
470
471         if (ioapic) {
472                 kvm_io_bus_unregister_dev(kvm, KVM_MMIO_BUS, &ioapic->dev);
473                 kvm->arch.vioapic = NULL;
474                 kfree(ioapic);
475         }
476 }
477
478 int kvm_get_ioapic(struct kvm *kvm, struct kvm_ioapic_state *state)
479 {
480         struct kvm_ioapic *ioapic = ioapic_irqchip(kvm);
481         if (!ioapic)
482                 return -EINVAL;
483
484         spin_lock(&ioapic->lock);
485         memcpy(state, ioapic, sizeof(struct kvm_ioapic_state));
486         spin_unlock(&ioapic->lock);
487         return 0;
488 }
489
490 int kvm_set_ioapic(struct kvm *kvm, struct kvm_ioapic_state *state)
491 {
492         struct kvm_ioapic *ioapic = ioapic_irqchip(kvm);
493         if (!ioapic)
494                 return -EINVAL;
495
496         spin_lock(&ioapic->lock);
497         memcpy(ioapic, state, sizeof(struct kvm_ioapic_state));
498         update_handled_vectors(ioapic);
499         kvm_ioapic_make_eoibitmap_request(kvm);
500         spin_unlock(&ioapic->lock);
501         return 0;
502 }