KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798)
[pandora-kernel.git] / virt / kvm / ioapic.c
1 /*
2  *  Copyright (C) 2001  MandrakeSoft S.A.
3  *  Copyright 2010 Red Hat, Inc. and/or its affiliates.
4  *
5  *    MandrakeSoft S.A.
6  *    43, rue d'Aboukir
7  *    75002 Paris - France
8  *    http://www.linux-mandrake.com/
9  *    http://www.mandrakesoft.com/
10  *
11  *  This library is free software; you can redistribute it and/or
12  *  modify it under the terms of the GNU Lesser General Public
13  *  License as published by the Free Software Foundation; either
14  *  version 2 of the License, or (at your option) any later version.
15  *
16  *  This library is distributed in the hope that it will be useful,
17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
19  *  Lesser General Public License for more details.
20  *
21  *  You should have received a copy of the GNU Lesser General Public
22  *  License along with this library; if not, write to the Free Software
23  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
24  *
25  *  Yunhong Jiang <yunhong.jiang@intel.com>
26  *  Yaozu (Eddie) Dong <eddie.dong@intel.com>
27  *  Based on Xen 3.1 code.
28  */
29
30 #include <linux/kvm_host.h>
31 #include <linux/kvm.h>
32 #include <linux/mm.h>
33 #include <linux/highmem.h>
34 #include <linux/smp.h>
35 #include <linux/hrtimer.h>
36 #include <linux/io.h>
37 #include <linux/slab.h>
38 #include <asm/processor.h>
39 #include <asm/page.h>
40 #include <asm/current.h>
41 #include <trace/events/kvm.h>
42
43 #include "ioapic.h"
44 #include "lapic.h"
45 #include "irq.h"
46
47 #if 0
48 #define ioapic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg)
49 #else
50 #define ioapic_debug(fmt, arg...)
51 #endif
52 static int ioapic_deliver(struct kvm_ioapic *vioapic, int irq);
53
54 static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
55                                           unsigned long addr,
56                                           unsigned long length)
57 {
58         unsigned long result = 0;
59
60         switch (ioapic->ioregsel) {
61         case IOAPIC_REG_VERSION:
62                 result = ((((IOAPIC_NUM_PINS - 1) & 0xff) << 16)
63                           | (IOAPIC_VERSION_ID & 0xff));
64                 break;
65
66         case IOAPIC_REG_APIC_ID:
67         case IOAPIC_REG_ARB_ID:
68                 result = ((ioapic->id & 0xf) << 24);
69                 break;
70
71         default:
72                 {
73                         u32 redir_index = (ioapic->ioregsel - 0x10) >> 1;
74                         u64 redir_content;
75
76                         if (redir_index < IOAPIC_NUM_PINS)
77                                 redir_content =
78                                         ioapic->redirtbl[redir_index].bits;
79                         else
80                                 redir_content = ~0ULL;
81
82                         result = (ioapic->ioregsel & 0x1) ?
83                             (redir_content >> 32) & 0xffffffff :
84                             redir_content & 0xffffffff;
85                         break;
86                 }
87         }
88
89         return result;
90 }
91
92 static int ioapic_service(struct kvm_ioapic *ioapic, unsigned int idx)
93 {
94         union kvm_ioapic_redirect_entry *pent;
95         int injected = -1;
96
97         pent = &ioapic->redirtbl[idx];
98
99         if (!pent->fields.mask) {
100                 injected = ioapic_deliver(ioapic, idx);
101                 if (injected && pent->fields.trig_mode == IOAPIC_LEVEL_TRIG)
102                         pent->fields.remote_irr = 1;
103         }
104
105         return injected;
106 }
107
108 static void update_handled_vectors(struct kvm_ioapic *ioapic)
109 {
110         DECLARE_BITMAP(handled_vectors, 256);
111         int i;
112
113         memset(handled_vectors, 0, sizeof(handled_vectors));
114         for (i = 0; i < IOAPIC_NUM_PINS; ++i)
115                 __set_bit(ioapic->redirtbl[i].fields.vector, handled_vectors);
116         memcpy(ioapic->handled_vectors, handled_vectors,
117                sizeof(handled_vectors));
118         smp_wmb();
119 }
120
121 static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val)
122 {
123         unsigned index;
124         bool mask_before, mask_after;
125         union kvm_ioapic_redirect_entry *e;
126
127         switch (ioapic->ioregsel) {
128         case IOAPIC_REG_VERSION:
129                 /* Writes are ignored. */
130                 break;
131
132         case IOAPIC_REG_APIC_ID:
133                 ioapic->id = (val >> 24) & 0xf;
134                 break;
135
136         case IOAPIC_REG_ARB_ID:
137                 break;
138
139         default:
140                 index = (ioapic->ioregsel - 0x10) >> 1;
141
142                 ioapic_debug("change redir index %x val %x\n", index, val);
143                 if (index >= IOAPIC_NUM_PINS)
144                         return;
145                 e = &ioapic->redirtbl[index];
146                 mask_before = e->fields.mask;
147                 if (ioapic->ioregsel & 1) {
148                         e->bits &= 0xffffffff;
149                         e->bits |= (u64) val << 32;
150                 } else {
151                         e->bits &= ~0xffffffffULL;
152                         e->bits |= (u32) val;
153                         e->fields.remote_irr = 0;
154                 }
155                 update_handled_vectors(ioapic);
156                 mask_after = e->fields.mask;
157                 if (mask_before != mask_after)
158                         kvm_fire_mask_notifiers(ioapic->kvm, KVM_IRQCHIP_IOAPIC, index, mask_after);
159                 if (e->fields.trig_mode == IOAPIC_LEVEL_TRIG
160                     && ioapic->irr & (1 << index))
161                         ioapic_service(ioapic, index);
162                 break;
163         }
164 }
165
166 static int ioapic_deliver(struct kvm_ioapic *ioapic, int irq)
167 {
168         union kvm_ioapic_redirect_entry *entry = &ioapic->redirtbl[irq];
169         struct kvm_lapic_irq irqe;
170
171         ioapic_debug("dest=%x dest_mode=%x delivery_mode=%x "
172                      "vector=%x trig_mode=%x\n",
173                      entry->fields.dest_id, entry->fields.dest_mode,
174                      entry->fields.delivery_mode, entry->fields.vector,
175                      entry->fields.trig_mode);
176
177         irqe.dest_id = entry->fields.dest_id;
178         irqe.vector = entry->fields.vector;
179         irqe.dest_mode = entry->fields.dest_mode;
180         irqe.trig_mode = entry->fields.trig_mode;
181         irqe.delivery_mode = entry->fields.delivery_mode << 8;
182         irqe.level = 1;
183         irqe.shorthand = 0;
184
185 #ifdef CONFIG_X86
186         /* Always delivery PIT interrupt to vcpu 0 */
187         if (irq == 0) {
188                 irqe.dest_mode = 0; /* Physical mode. */
189                 /* need to read apic_id from apic regiest since
190                  * it can be rewritten */
191                 irqe.dest_id = ioapic->kvm->bsp_vcpu->vcpu_id;
192         }
193 #endif
194         return kvm_irq_delivery_to_apic(ioapic->kvm, NULL, &irqe);
195 }
196
197 int kvm_ioapic_set_irq(struct kvm_ioapic *ioapic, int irq, int level)
198 {
199         u32 old_irr;
200         u32 mask = 1 << irq;
201         union kvm_ioapic_redirect_entry entry;
202         int ret = 1;
203
204         spin_lock(&ioapic->lock);
205         old_irr = ioapic->irr;
206         if (irq >= 0 && irq < IOAPIC_NUM_PINS) {
207                 entry = ioapic->redirtbl[irq];
208                 level ^= entry.fields.polarity;
209                 if (!level)
210                         ioapic->irr &= ~mask;
211                 else {
212                         int edge = (entry.fields.trig_mode == IOAPIC_EDGE_TRIG);
213                         ioapic->irr |= mask;
214                         if ((edge && old_irr != ioapic->irr) ||
215                             (!edge && !entry.fields.remote_irr))
216                                 ret = ioapic_service(ioapic, irq);
217                         else
218                                 ret = 0; /* report coalesced interrupt */
219                 }
220                 trace_kvm_ioapic_set_irq(entry.bits, irq, ret == 0);
221         }
222         spin_unlock(&ioapic->lock);
223
224         return ret;
225 }
226
227 static void __kvm_ioapic_update_eoi(struct kvm_ioapic *ioapic, int vector,
228                                      int trigger_mode)
229 {
230         int i;
231
232         for (i = 0; i < IOAPIC_NUM_PINS; i++) {
233                 union kvm_ioapic_redirect_entry *ent = &ioapic->redirtbl[i];
234
235                 if (ent->fields.vector != vector)
236                         continue;
237
238                 /*
239                  * We are dropping lock while calling ack notifiers because ack
240                  * notifier callbacks for assigned devices call into IOAPIC
241                  * recursively. Since remote_irr is cleared only after call
242                  * to notifiers if the same vector will be delivered while lock
243                  * is dropped it will be put into irr and will be delivered
244                  * after ack notifier returns.
245                  */
246                 spin_unlock(&ioapic->lock);
247                 kvm_notify_acked_irq(ioapic->kvm, KVM_IRQCHIP_IOAPIC, i);
248                 spin_lock(&ioapic->lock);
249
250                 if (trigger_mode != IOAPIC_LEVEL_TRIG)
251                         continue;
252
253                 ASSERT(ent->fields.trig_mode == IOAPIC_LEVEL_TRIG);
254                 ent->fields.remote_irr = 0;
255                 if (!ent->fields.mask && (ioapic->irr & (1 << i)))
256                         ioapic_service(ioapic, i);
257         }
258 }
259
260 void kvm_ioapic_update_eoi(struct kvm *kvm, int vector, int trigger_mode)
261 {
262         struct kvm_ioapic *ioapic = kvm->arch.vioapic;
263
264         smp_rmb();
265         if (!test_bit(vector, ioapic->handled_vectors))
266                 return;
267         spin_lock(&ioapic->lock);
268         __kvm_ioapic_update_eoi(ioapic, vector, trigger_mode);
269         spin_unlock(&ioapic->lock);
270 }
271
272 static inline struct kvm_ioapic *to_ioapic(struct kvm_io_device *dev)
273 {
274         return container_of(dev, struct kvm_ioapic, dev);
275 }
276
277 static inline int ioapic_in_range(struct kvm_ioapic *ioapic, gpa_t addr)
278 {
279         return ((addr >= ioapic->base_address &&
280                  (addr < ioapic->base_address + IOAPIC_MEM_LENGTH)));
281 }
282
283 static int ioapic_mmio_read(struct kvm_io_device *this, gpa_t addr, int len,
284                             void *val)
285 {
286         struct kvm_ioapic *ioapic = to_ioapic(this);
287         u32 result;
288         if (!ioapic_in_range(ioapic, addr))
289                 return -EOPNOTSUPP;
290
291         ioapic_debug("addr %lx\n", (unsigned long)addr);
292         ASSERT(!(addr & 0xf));  /* check alignment */
293
294         addr &= 0xff;
295         spin_lock(&ioapic->lock);
296         switch (addr) {
297         case IOAPIC_REG_SELECT:
298                 result = ioapic->ioregsel;
299                 break;
300
301         case IOAPIC_REG_WINDOW:
302                 result = ioapic_read_indirect(ioapic, addr, len);
303                 break;
304
305         default:
306                 result = 0;
307                 break;
308         }
309         spin_unlock(&ioapic->lock);
310
311         switch (len) {
312         case 8:
313                 *(u64 *) val = result;
314                 break;
315         case 1:
316         case 2:
317         case 4:
318                 memcpy(val, (char *)&result, len);
319                 break;
320         default:
321                 printk(KERN_WARNING "ioapic: wrong length %d\n", len);
322         }
323         return 0;
324 }
325
326 static int ioapic_mmio_write(struct kvm_io_device *this, gpa_t addr, int len,
327                              const void *val)
328 {
329         struct kvm_ioapic *ioapic = to_ioapic(this);
330         u32 data;
331         if (!ioapic_in_range(ioapic, addr))
332                 return -EOPNOTSUPP;
333
334         ioapic_debug("ioapic_mmio_write addr=%p len=%d val=%p\n",
335                      (void*)addr, len, val);
336         ASSERT(!(addr & 0xf));  /* check alignment */
337
338         if (len == 4 || len == 8)
339                 data = *(u32 *) val;
340         else {
341                 printk(KERN_WARNING "ioapic: Unsupported size %d\n", len);
342                 return 0;
343         }
344
345         addr &= 0xff;
346         spin_lock(&ioapic->lock);
347         switch (addr) {
348         case IOAPIC_REG_SELECT:
349                 ioapic->ioregsel = data;
350                 break;
351
352         case IOAPIC_REG_WINDOW:
353                 ioapic_write_indirect(ioapic, data);
354                 break;
355 #ifdef  CONFIG_IA64
356         case IOAPIC_REG_EOI:
357                 __kvm_ioapic_update_eoi(ioapic, data, IOAPIC_LEVEL_TRIG);
358                 break;
359 #endif
360
361         default:
362                 break;
363         }
364         spin_unlock(&ioapic->lock);
365         return 0;
366 }
367
368 void kvm_ioapic_reset(struct kvm_ioapic *ioapic)
369 {
370         int i;
371
372         for (i = 0; i < IOAPIC_NUM_PINS; i++)
373                 ioapic->redirtbl[i].fields.mask = 1;
374         ioapic->base_address = IOAPIC_DEFAULT_BASE_ADDRESS;
375         ioapic->ioregsel = 0;
376         ioapic->irr = 0;
377         ioapic->id = 0;
378         update_handled_vectors(ioapic);
379 }
380
381 static const struct kvm_io_device_ops ioapic_mmio_ops = {
382         .read     = ioapic_mmio_read,
383         .write    = ioapic_mmio_write,
384 };
385
386 int kvm_ioapic_init(struct kvm *kvm)
387 {
388         struct kvm_ioapic *ioapic;
389         int ret;
390
391         ioapic = kzalloc(sizeof(struct kvm_ioapic), GFP_KERNEL);
392         if (!ioapic)
393                 return -ENOMEM;
394         spin_lock_init(&ioapic->lock);
395         kvm->arch.vioapic = ioapic;
396         kvm_ioapic_reset(ioapic);
397         kvm_iodevice_init(&ioapic->dev, &ioapic_mmio_ops);
398         ioapic->kvm = kvm;
399         mutex_lock(&kvm->slots_lock);
400         ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, ioapic->base_address,
401                                       IOAPIC_MEM_LENGTH, &ioapic->dev);
402         mutex_unlock(&kvm->slots_lock);
403         if (ret < 0) {
404                 kvm->arch.vioapic = NULL;
405                 kfree(ioapic);
406         }
407
408         return ret;
409 }
410
411 void kvm_ioapic_destroy(struct kvm *kvm)
412 {
413         struct kvm_ioapic *ioapic = kvm->arch.vioapic;
414
415         if (ioapic) {
416                 kvm_io_bus_unregister_dev(kvm, KVM_MMIO_BUS, &ioapic->dev);
417                 kvm->arch.vioapic = NULL;
418                 kfree(ioapic);
419         }
420 }
421
422 int kvm_get_ioapic(struct kvm *kvm, struct kvm_ioapic_state *state)
423 {
424         struct kvm_ioapic *ioapic = ioapic_irqchip(kvm);
425         if (!ioapic)
426                 return -EINVAL;
427
428         spin_lock(&ioapic->lock);
429         memcpy(state, ioapic, sizeof(struct kvm_ioapic_state));
430         spin_unlock(&ioapic->lock);
431         return 0;
432 }
433
434 int kvm_set_ioapic(struct kvm *kvm, struct kvm_ioapic_state *state)
435 {
436         struct kvm_ioapic *ioapic = ioapic_irqchip(kvm);
437         if (!ioapic)
438                 return -EINVAL;
439
440         spin_lock(&ioapic->lock);
441         memcpy(ioapic, state, sizeof(struct kvm_ioapic_state));
442         update_handled_vectors(ioapic);
443         spin_unlock(&ioapic->lock);
444         return 0;
445 }