diff mbox series

[Focal/linux-oem-5.6,CVE-2020-15852,v2] x86/ioperm: Fix io bitmap invalidation on Xen PV

Message ID 20200812143543.14700-1-william.gray@canonical.com
State New
Headers show
Series [Focal/linux-oem-5.6,CVE-2020-15852,v2] x86/ioperm: Fix io bitmap invalidation on Xen PV | expand

Commit Message

William Breathitt Gray Aug. 12, 2020, 2:35 p.m. UTC
From: Andy Lutomirski <luto@kernel.org>

tss_invalidate_io_bitmap() wasn't wired up properly through the pvop
machinery, so the TSS and Xen's io bitmap would get out of sync
whenever disabling a valid io bitmap.

Add a new pvop for tss_invalidate_io_bitmap() to fix it.

This is XSA-329.

Fixes: 22fe5b0439dd ("x86/ioperm: Move TSS bitmap update to exit to user work")
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/d53075590e1f91c19f8af705059d3ff99424c020.1595030016.git.luto@kernel.org

CVE-2020-15852

(cherry picked from commit cadfad870154e14f745ec845708bc17d166065f2)
Signed-off-by: William Breathitt Gray <william.gray@canonical.com>
---
 arch/x86/include/asm/io_bitmap.h      | 16 ++++++++++++++++
 arch/x86/include/asm/paravirt.h       |  5 +++++
 arch/x86/include/asm/paravirt_types.h |  1 +
 arch/x86/kernel/paravirt.c            |  3 ++-
 arch/x86/kernel/process.c             | 18 ++----------------
 arch/x86/xen/enlighten_pv.c           | 12 ++++++++++++
 6 files changed, 38 insertions(+), 17 deletions(-)

Comments

Stefan Bader Aug. 13, 2020, 9:48 a.m. UTC | #1
On 12.08.20 16:35, William Breathitt Gray wrote:
> From: Andy Lutomirski <luto@kernel.org>
> 
> tss_invalidate_io_bitmap() wasn't wired up properly through the pvop
> machinery, so the TSS and Xen's io bitmap would get out of sync
> whenever disabling a valid io bitmap.
> 
> Add a new pvop for tss_invalidate_io_bitmap() to fix it.
> 
> This is XSA-329.
> 
> Fixes: 22fe5b0439dd ("x86/ioperm: Move TSS bitmap update to exit to user work")
> Signed-off-by: Andy Lutomirski <luto@kernel.org>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> Reviewed-by: Juergen Gross <jgross@suse.com>
> Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
> Cc: stable@vger.kernel.org
> Link: https://lkml.kernel.org/r/d53075590e1f91c19f8af705059d3ff99424c020.1595030016.git.luto@kernel.org
> 
> CVE-2020-15852
> 
> (cherry picked from commit cadfad870154e14f745ec845708bc17d166065f2)
> Signed-off-by: William Breathitt Gray <william.gray@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
> ---
>  arch/x86/include/asm/io_bitmap.h      | 16 ++++++++++++++++
>  arch/x86/include/asm/paravirt.h       |  5 +++++
>  arch/x86/include/asm/paravirt_types.h |  1 +
>  arch/x86/kernel/paravirt.c            |  3 ++-
>  arch/x86/kernel/process.c             | 18 ++----------------
>  arch/x86/xen/enlighten_pv.c           | 12 ++++++++++++
>  6 files changed, 38 insertions(+), 17 deletions(-)
> 
> diff --git a/arch/x86/include/asm/io_bitmap.h b/arch/x86/include/asm/io_bitmap.h
> index ac1a99ffbd8d..7f080f5c7def 100644
> --- a/arch/x86/include/asm/io_bitmap.h
> +++ b/arch/x86/include/asm/io_bitmap.h
> @@ -19,12 +19,28 @@ struct task_struct;
>  void io_bitmap_share(struct task_struct *tsk);
>  void io_bitmap_exit(struct task_struct *tsk);
>  
> +static inline void native_tss_invalidate_io_bitmap(void)
> +{
> +	/*
> +	 * Invalidate the I/O bitmap by moving io_bitmap_base outside the
> +	 * TSS limit so any subsequent I/O access from user space will
> +	 * trigger a #GP.
> +	 *
> +	 * This is correct even when VMEXIT rewrites the TSS limit
> +	 * to 0x67 as the only requirement is that the base points
> +	 * outside the limit.
> +	 */
> +	this_cpu_write(cpu_tss_rw.x86_tss.io_bitmap_base,
> +		       IO_BITMAP_OFFSET_INVALID);
> +}
> +
>  void native_tss_update_io_bitmap(void);
>  
>  #ifdef CONFIG_PARAVIRT_XXL
>  #include <asm/paravirt.h>
>  #else
>  #define tss_update_io_bitmap native_tss_update_io_bitmap
> +#define tss_invalidate_io_bitmap native_tss_invalidate_io_bitmap
>  #endif
>  
>  #else
> diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
> index 694d8daf4983..0296dd66c167 100644
> --- a/arch/x86/include/asm/paravirt.h
> +++ b/arch/x86/include/asm/paravirt.h
> @@ -296,6 +296,11 @@ static inline void write_idt_entry(gate_desc *dt, int entry, const gate_desc *g)
>  }
>  
>  #ifdef CONFIG_X86_IOPL_IOPERM
> +static inline void tss_invalidate_io_bitmap(void)
> +{
> +	PVOP_VCALL0(cpu.invalidate_io_bitmap);
> +}
> +
>  static inline void tss_update_io_bitmap(void)
>  {
>  	PVOP_VCALL0(cpu.update_io_bitmap);
> diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
> index 732f62e04ddb..8dfcb2508e6d 100644
> --- a/arch/x86/include/asm/paravirt_types.h
> +++ b/arch/x86/include/asm/paravirt_types.h
> @@ -141,6 +141,7 @@ struct pv_cpu_ops {
>  	void (*load_sp0)(unsigned long sp0);
>  
>  #ifdef CONFIG_X86_IOPL_IOPERM
> +	void (*invalidate_io_bitmap)(void);
>  	void (*update_io_bitmap)(void);
>  #endif
>  
> diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
> index c131ba4e70ef..97b4ce839b4c 100644
> --- a/arch/x86/kernel/paravirt.c
> +++ b/arch/x86/kernel/paravirt.c
> @@ -343,7 +343,8 @@ struct paravirt_patch_template pv_ops = {
>  	.cpu.swapgs		= native_swapgs,
>  
>  #ifdef CONFIG_X86_IOPL_IOPERM
> -	.cpu.update_io_bitmap	= native_tss_update_io_bitmap,
> +	.cpu.invalidate_io_bitmap	= native_tss_invalidate_io_bitmap,
> +	.cpu.update_io_bitmap		= native_tss_update_io_bitmap,
>  #endif
>  
>  	.cpu.start_context_switch	= paravirt_nop,
> diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
> index 3d88300ec306..070383626d7f 100644
> --- a/arch/x86/kernel/process.c
> +++ b/arch/x86/kernel/process.c
> @@ -323,20 +323,6 @@ void arch_setup_new_exec(void)
>  }
>  
>  #ifdef CONFIG_X86_IOPL_IOPERM
> -static inline void tss_invalidate_io_bitmap(struct tss_struct *tss)
> -{
> -	/*
> -	 * Invalidate the I/O bitmap by moving io_bitmap_base outside the
> -	 * TSS limit so any subsequent I/O access from user space will
> -	 * trigger a #GP.
> -	 *
> -	 * This is correct even when VMEXIT rewrites the TSS limit
> -	 * to 0x67 as the only requirement is that the base points
> -	 * outside the limit.
> -	 */
> -	tss->x86_tss.io_bitmap_base = IO_BITMAP_OFFSET_INVALID;
> -}
> -
>  static inline void switch_to_bitmap(unsigned long tifp)
>  {
>  	/*
> @@ -347,7 +333,7 @@ static inline void switch_to_bitmap(unsigned long tifp)
>  	 * user mode.
>  	 */
>  	if (tifp & _TIF_IO_BITMAP)
> -		tss_invalidate_io_bitmap(this_cpu_ptr(&cpu_tss_rw));
> +		tss_invalidate_io_bitmap();
>  }
>  
>  static void tss_copy_io_bitmap(struct tss_struct *tss, struct io_bitmap *iobm)
> @@ -381,7 +367,7 @@ void native_tss_update_io_bitmap(void)
>  	u16 *base = &tss->x86_tss.io_bitmap_base;
>  
>  	if (!test_thread_flag(TIF_IO_BITMAP)) {
> -		tss_invalidate_io_bitmap(tss);
> +		native_tss_invalidate_io_bitmap();
>  		return;
>  	}
>  
> diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
> index 507f4fb88fa7..9621d31104b6 100644
> --- a/arch/x86/xen/enlighten_pv.c
> +++ b/arch/x86/xen/enlighten_pv.c
> @@ -841,6 +841,17 @@ static void xen_load_sp0(unsigned long sp0)
>  }
>  
>  #ifdef CONFIG_X86_IOPL_IOPERM
> +static void xen_invalidate_io_bitmap(void)
> +{
> +	struct physdev_set_iobitmap iobitmap = {
> +		.bitmap = 0,
> +		.nr_ports = 0,
> +	};
> +
> +	native_tss_invalidate_io_bitmap();
> +	HYPERVISOR_physdev_op(PHYSDEVOP_set_iobitmap, &iobitmap);
> +}
> +
>  static void xen_update_io_bitmap(void)
>  {
>  	struct physdev_set_iobitmap iobitmap;
> @@ -1070,6 +1081,7 @@ static const struct pv_cpu_ops xen_cpu_ops __initconst = {
>  	.load_sp0 = xen_load_sp0,
>  
>  #ifdef CONFIG_X86_IOPL_IOPERM
> +	.invalidate_io_bitmap = xen_invalidate_io_bitmap,
>  	.update_io_bitmap = xen_update_io_bitmap,
>  #endif
>  	.io_delay = xen_io_delay,
>
Kleber Souza Aug. 20, 2020, 7:58 a.m. UTC | #2
On 12.08.20 16:35, William Breathitt Gray wrote:
> From: Andy Lutomirski <luto@kernel.org>
> 
> tss_invalidate_io_bitmap() wasn't wired up properly through the pvop
> machinery, so the TSS and Xen's io bitmap would get out of sync
> whenever disabling a valid io bitmap.
> 
> Add a new pvop for tss_invalidate_io_bitmap() to fix it.
> 
> This is XSA-329.
> 
> Fixes: 22fe5b0439dd ("x86/ioperm: Move TSS bitmap update to exit to user work")
> Signed-off-by: Andy Lutomirski <luto@kernel.org>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> Reviewed-by: Juergen Gross <jgross@suse.com>
> Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
> Cc: stable@vger.kernel.org
> Link: https://lkml.kernel.org/r/d53075590e1f91c19f8af705059d3ff99424c020.1595030016.git.luto@kernel.org
> 
> CVE-2020-15852
> 
> (cherry picked from commit cadfad870154e14f745ec845708bc17d166065f2)
> Signed-off-by: William Breathitt Gray <william.gray@canonical.com>

Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

> ---
>  arch/x86/include/asm/io_bitmap.h      | 16 ++++++++++++++++
>  arch/x86/include/asm/paravirt.h       |  5 +++++
>  arch/x86/include/asm/paravirt_types.h |  1 +
>  arch/x86/kernel/paravirt.c            |  3 ++-
>  arch/x86/kernel/process.c             | 18 ++----------------
>  arch/x86/xen/enlighten_pv.c           | 12 ++++++++++++
>  6 files changed, 38 insertions(+), 17 deletions(-)
> 
> diff --git a/arch/x86/include/asm/io_bitmap.h b/arch/x86/include/asm/io_bitmap.h
> index ac1a99ffbd8d..7f080f5c7def 100644
> --- a/arch/x86/include/asm/io_bitmap.h
> +++ b/arch/x86/include/asm/io_bitmap.h
> @@ -19,12 +19,28 @@ struct task_struct;
>  void io_bitmap_share(struct task_struct *tsk);
>  void io_bitmap_exit(struct task_struct *tsk);
>  
> +static inline void native_tss_invalidate_io_bitmap(void)
> +{
> +	/*
> +	 * Invalidate the I/O bitmap by moving io_bitmap_base outside the
> +	 * TSS limit so any subsequent I/O access from user space will
> +	 * trigger a #GP.
> +	 *
> +	 * This is correct even when VMEXIT rewrites the TSS limit
> +	 * to 0x67 as the only requirement is that the base points
> +	 * outside the limit.
> +	 */
> +	this_cpu_write(cpu_tss_rw.x86_tss.io_bitmap_base,
> +		       IO_BITMAP_OFFSET_INVALID);
> +}
> +
>  void native_tss_update_io_bitmap(void);
>  
>  #ifdef CONFIG_PARAVIRT_XXL
>  #include <asm/paravirt.h>
>  #else
>  #define tss_update_io_bitmap native_tss_update_io_bitmap
> +#define tss_invalidate_io_bitmap native_tss_invalidate_io_bitmap
>  #endif
>  
>  #else
> diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
> index 694d8daf4983..0296dd66c167 100644
> --- a/arch/x86/include/asm/paravirt.h
> +++ b/arch/x86/include/asm/paravirt.h
> @@ -296,6 +296,11 @@ static inline void write_idt_entry(gate_desc *dt, int entry, const gate_desc *g)
>  }
>  
>  #ifdef CONFIG_X86_IOPL_IOPERM
> +static inline void tss_invalidate_io_bitmap(void)
> +{
> +	PVOP_VCALL0(cpu.invalidate_io_bitmap);
> +}
> +
>  static inline void tss_update_io_bitmap(void)
>  {
>  	PVOP_VCALL0(cpu.update_io_bitmap);
> diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
> index 732f62e04ddb..8dfcb2508e6d 100644
> --- a/arch/x86/include/asm/paravirt_types.h
> +++ b/arch/x86/include/asm/paravirt_types.h
> @@ -141,6 +141,7 @@ struct pv_cpu_ops {
>  	void (*load_sp0)(unsigned long sp0);
>  
>  #ifdef CONFIG_X86_IOPL_IOPERM
> +	void (*invalidate_io_bitmap)(void);
>  	void (*update_io_bitmap)(void);
>  #endif
>  
> diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
> index c131ba4e70ef..97b4ce839b4c 100644
> --- a/arch/x86/kernel/paravirt.c
> +++ b/arch/x86/kernel/paravirt.c
> @@ -343,7 +343,8 @@ struct paravirt_patch_template pv_ops = {
>  	.cpu.swapgs		= native_swapgs,
>  
>  #ifdef CONFIG_X86_IOPL_IOPERM
> -	.cpu.update_io_bitmap	= native_tss_update_io_bitmap,
> +	.cpu.invalidate_io_bitmap	= native_tss_invalidate_io_bitmap,
> +	.cpu.update_io_bitmap		= native_tss_update_io_bitmap,
>  #endif
>  
>  	.cpu.start_context_switch	= paravirt_nop,
> diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
> index 3d88300ec306..070383626d7f 100644
> --- a/arch/x86/kernel/process.c
> +++ b/arch/x86/kernel/process.c
> @@ -323,20 +323,6 @@ void arch_setup_new_exec(void)
>  }
>  
>  #ifdef CONFIG_X86_IOPL_IOPERM
> -static inline void tss_invalidate_io_bitmap(struct tss_struct *tss)
> -{
> -	/*
> -	 * Invalidate the I/O bitmap by moving io_bitmap_base outside the
> -	 * TSS limit so any subsequent I/O access from user space will
> -	 * trigger a #GP.
> -	 *
> -	 * This is correct even when VMEXIT rewrites the TSS limit
> -	 * to 0x67 as the only requirement is that the base points
> -	 * outside the limit.
> -	 */
> -	tss->x86_tss.io_bitmap_base = IO_BITMAP_OFFSET_INVALID;
> -}
> -
>  static inline void switch_to_bitmap(unsigned long tifp)
>  {
>  	/*
> @@ -347,7 +333,7 @@ static inline void switch_to_bitmap(unsigned long tifp)
>  	 * user mode.
>  	 */
>  	if (tifp & _TIF_IO_BITMAP)
> -		tss_invalidate_io_bitmap(this_cpu_ptr(&cpu_tss_rw));
> +		tss_invalidate_io_bitmap();
>  }
>  
>  static void tss_copy_io_bitmap(struct tss_struct *tss, struct io_bitmap *iobm)
> @@ -381,7 +367,7 @@ void native_tss_update_io_bitmap(void)
>  	u16 *base = &tss->x86_tss.io_bitmap_base;
>  
>  	if (!test_thread_flag(TIF_IO_BITMAP)) {
> -		tss_invalidate_io_bitmap(tss);
> +		native_tss_invalidate_io_bitmap();
>  		return;
>  	}
>  
> diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
> index 507f4fb88fa7..9621d31104b6 100644
> --- a/arch/x86/xen/enlighten_pv.c
> +++ b/arch/x86/xen/enlighten_pv.c
> @@ -841,6 +841,17 @@ static void xen_load_sp0(unsigned long sp0)
>  }
>  
>  #ifdef CONFIG_X86_IOPL_IOPERM
> +static void xen_invalidate_io_bitmap(void)
> +{
> +	struct physdev_set_iobitmap iobitmap = {
> +		.bitmap = 0,
> +		.nr_ports = 0,
> +	};
> +
> +	native_tss_invalidate_io_bitmap();
> +	HYPERVISOR_physdev_op(PHYSDEVOP_set_iobitmap, &iobitmap);
> +}
> +
>  static void xen_update_io_bitmap(void)
>  {
>  	struct physdev_set_iobitmap iobitmap;
> @@ -1070,6 +1081,7 @@ static const struct pv_cpu_ops xen_cpu_ops __initconst = {
>  	.load_sp0 = xen_load_sp0,
>  
>  #ifdef CONFIG_X86_IOPL_IOPERM
> +	.invalidate_io_bitmap = xen_invalidate_io_bitmap,
>  	.update_io_bitmap = xen_update_io_bitmap,
>  #endif
>  	.io_delay = xen_io_delay,
>
Timo Aaltonen Aug. 24, 2020, 8:16 a.m. UTC | #3
On 12.8.2020 17.35, William Breathitt Gray wrote:
> From: Andy Lutomirski <luto@kernel.org>
> 
> tss_invalidate_io_bitmap() wasn't wired up properly through the pvop
> machinery, so the TSS and Xen's io bitmap would get out of sync
> whenever disabling a valid io bitmap.
> 
> Add a new pvop for tss_invalidate_io_bitmap() to fix it.
> 
> This is XSA-329.
> 
> Fixes: 22fe5b0439dd ("x86/ioperm: Move TSS bitmap update to exit to user work")
> Signed-off-by: Andy Lutomirski <luto@kernel.org>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> Reviewed-by: Juergen Gross <jgross@suse.com>
> Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
> Cc: stable@vger.kernel.org
> Link: https://lkml.kernel.org/r/d53075590e1f91c19f8af705059d3ff99424c020.1595030016.git.luto@kernel.org
> 
> CVE-2020-15852
> 
> (cherry picked from commit cadfad870154e14f745ec845708bc17d166065f2)
> Signed-off-by: William Breathitt Gray <william.gray@canonical.com>
> ---
>  arch/x86/include/asm/io_bitmap.h      | 16 ++++++++++++++++
>  arch/x86/include/asm/paravirt.h       |  5 +++++
>  arch/x86/include/asm/paravirt_types.h |  1 +
>  arch/x86/kernel/paravirt.c            |  3 ++-
>  arch/x86/kernel/process.c             | 18 ++----------------
>  arch/x86/xen/enlighten_pv.c           | 12 ++++++++++++
>  6 files changed, 38 insertions(+), 17 deletions(-)
> 
> diff --git a/arch/x86/include/asm/io_bitmap.h b/arch/x86/include/asm/io_bitmap.h
> index ac1a99ffbd8d..7f080f5c7def 100644
> --- a/arch/x86/include/asm/io_bitmap.h
> +++ b/arch/x86/include/asm/io_bitmap.h
> @@ -19,12 +19,28 @@ struct task_struct;
>  void io_bitmap_share(struct task_struct *tsk);
>  void io_bitmap_exit(struct task_struct *tsk);
>  
> +static inline void native_tss_invalidate_io_bitmap(void)
> +{
> +	/*
> +	 * Invalidate the I/O bitmap by moving io_bitmap_base outside the
> +	 * TSS limit so any subsequent I/O access from user space will
> +	 * trigger a #GP.
> +	 *
> +	 * This is correct even when VMEXIT rewrites the TSS limit
> +	 * to 0x67 as the only requirement is that the base points
> +	 * outside the limit.
> +	 */
> +	this_cpu_write(cpu_tss_rw.x86_tss.io_bitmap_base,
> +		       IO_BITMAP_OFFSET_INVALID);
> +}
> +
>  void native_tss_update_io_bitmap(void);
>  
>  #ifdef CONFIG_PARAVIRT_XXL
>  #include <asm/paravirt.h>
>  #else
>  #define tss_update_io_bitmap native_tss_update_io_bitmap
> +#define tss_invalidate_io_bitmap native_tss_invalidate_io_bitmap
>  #endif
>  
>  #else
> diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
> index 694d8daf4983..0296dd66c167 100644
> --- a/arch/x86/include/asm/paravirt.h
> +++ b/arch/x86/include/asm/paravirt.h
> @@ -296,6 +296,11 @@ static inline void write_idt_entry(gate_desc *dt, int entry, const gate_desc *g)
>  }
>  
>  #ifdef CONFIG_X86_IOPL_IOPERM
> +static inline void tss_invalidate_io_bitmap(void)
> +{
> +	PVOP_VCALL0(cpu.invalidate_io_bitmap);
> +}
> +
>  static inline void tss_update_io_bitmap(void)
>  {
>  	PVOP_VCALL0(cpu.update_io_bitmap);
> diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
> index 732f62e04ddb..8dfcb2508e6d 100644
> --- a/arch/x86/include/asm/paravirt_types.h
> +++ b/arch/x86/include/asm/paravirt_types.h
> @@ -141,6 +141,7 @@ struct pv_cpu_ops {
>  	void (*load_sp0)(unsigned long sp0);
>  
>  #ifdef CONFIG_X86_IOPL_IOPERM
> +	void (*invalidate_io_bitmap)(void);
>  	void (*update_io_bitmap)(void);
>  #endif
>  
> diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
> index c131ba4e70ef..97b4ce839b4c 100644
> --- a/arch/x86/kernel/paravirt.c
> +++ b/arch/x86/kernel/paravirt.c
> @@ -343,7 +343,8 @@ struct paravirt_patch_template pv_ops = {
>  	.cpu.swapgs		= native_swapgs,
>  
>  #ifdef CONFIG_X86_IOPL_IOPERM
> -	.cpu.update_io_bitmap	= native_tss_update_io_bitmap,
> +	.cpu.invalidate_io_bitmap	= native_tss_invalidate_io_bitmap,
> +	.cpu.update_io_bitmap		= native_tss_update_io_bitmap,
>  #endif
>  
>  	.cpu.start_context_switch	= paravirt_nop,
> diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
> index 3d88300ec306..070383626d7f 100644
> --- a/arch/x86/kernel/process.c
> +++ b/arch/x86/kernel/process.c
> @@ -323,20 +323,6 @@ void arch_setup_new_exec(void)
>  }
>  
>  #ifdef CONFIG_X86_IOPL_IOPERM
> -static inline void tss_invalidate_io_bitmap(struct tss_struct *tss)
> -{
> -	/*
> -	 * Invalidate the I/O bitmap by moving io_bitmap_base outside the
> -	 * TSS limit so any subsequent I/O access from user space will
> -	 * trigger a #GP.
> -	 *
> -	 * This is correct even when VMEXIT rewrites the TSS limit
> -	 * to 0x67 as the only requirement is that the base points
> -	 * outside the limit.
> -	 */
> -	tss->x86_tss.io_bitmap_base = IO_BITMAP_OFFSET_INVALID;
> -}
> -
>  static inline void switch_to_bitmap(unsigned long tifp)
>  {
>  	/*
> @@ -347,7 +333,7 @@ static inline void switch_to_bitmap(unsigned long tifp)
>  	 * user mode.
>  	 */
>  	if (tifp & _TIF_IO_BITMAP)
> -		tss_invalidate_io_bitmap(this_cpu_ptr(&cpu_tss_rw));
> +		tss_invalidate_io_bitmap();
>  }
>  
>  static void tss_copy_io_bitmap(struct tss_struct *tss, struct io_bitmap *iobm)
> @@ -381,7 +367,7 @@ void native_tss_update_io_bitmap(void)
>  	u16 *base = &tss->x86_tss.io_bitmap_base;
>  
>  	if (!test_thread_flag(TIF_IO_BITMAP)) {
> -		tss_invalidate_io_bitmap(tss);
> +		native_tss_invalidate_io_bitmap();
>  		return;
>  	}
>  
> diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
> index 507f4fb88fa7..9621d31104b6 100644
> --- a/arch/x86/xen/enlighten_pv.c
> +++ b/arch/x86/xen/enlighten_pv.c
> @@ -841,6 +841,17 @@ static void xen_load_sp0(unsigned long sp0)
>  }
>  
>  #ifdef CONFIG_X86_IOPL_IOPERM
> +static void xen_invalidate_io_bitmap(void)
> +{
> +	struct physdev_set_iobitmap iobitmap = {
> +		.bitmap = 0,
> +		.nr_ports = 0,
> +	};
> +
> +	native_tss_invalidate_io_bitmap();
> +	HYPERVISOR_physdev_op(PHYSDEVOP_set_iobitmap, &iobitmap);
> +}
> +
>  static void xen_update_io_bitmap(void)
>  {
>  	struct physdev_set_iobitmap iobitmap;
> @@ -1070,6 +1081,7 @@ static const struct pv_cpu_ops xen_cpu_ops __initconst = {
>  	.load_sp0 = xen_load_sp0,
>  
>  #ifdef CONFIG_X86_IOPL_IOPERM
> +	.invalidate_io_bitmap = xen_invalidate_io_bitmap,
>  	.update_io_bitmap = xen_update_io_bitmap,
>  #endif
>  	.io_delay = xen_io_delay,
>
applied to oem-5.6, thanks!
diff mbox series

Patch

diff --git a/arch/x86/include/asm/io_bitmap.h b/arch/x86/include/asm/io_bitmap.h
index ac1a99ffbd8d..7f080f5c7def 100644
--- a/arch/x86/include/asm/io_bitmap.h
+++ b/arch/x86/include/asm/io_bitmap.h
@@ -19,12 +19,28 @@  struct task_struct;
 void io_bitmap_share(struct task_struct *tsk);
 void io_bitmap_exit(struct task_struct *tsk);
 
+static inline void native_tss_invalidate_io_bitmap(void)
+{
+	/*
+	 * Invalidate the I/O bitmap by moving io_bitmap_base outside the
+	 * TSS limit so any subsequent I/O access from user space will
+	 * trigger a #GP.
+	 *
+	 * This is correct even when VMEXIT rewrites the TSS limit
+	 * to 0x67 as the only requirement is that the base points
+	 * outside the limit.
+	 */
+	this_cpu_write(cpu_tss_rw.x86_tss.io_bitmap_base,
+		       IO_BITMAP_OFFSET_INVALID);
+}
+
 void native_tss_update_io_bitmap(void);
 
 #ifdef CONFIG_PARAVIRT_XXL
 #include <asm/paravirt.h>
 #else
 #define tss_update_io_bitmap native_tss_update_io_bitmap
+#define tss_invalidate_io_bitmap native_tss_invalidate_io_bitmap
 #endif
 
 #else
diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
index 694d8daf4983..0296dd66c167 100644
--- a/arch/x86/include/asm/paravirt.h
+++ b/arch/x86/include/asm/paravirt.h
@@ -296,6 +296,11 @@  static inline void write_idt_entry(gate_desc *dt, int entry, const gate_desc *g)
 }
 
 #ifdef CONFIG_X86_IOPL_IOPERM
+static inline void tss_invalidate_io_bitmap(void)
+{
+	PVOP_VCALL0(cpu.invalidate_io_bitmap);
+}
+
 static inline void tss_update_io_bitmap(void)
 {
 	PVOP_VCALL0(cpu.update_io_bitmap);
diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
index 732f62e04ddb..8dfcb2508e6d 100644
--- a/arch/x86/include/asm/paravirt_types.h
+++ b/arch/x86/include/asm/paravirt_types.h
@@ -141,6 +141,7 @@  struct pv_cpu_ops {
 	void (*load_sp0)(unsigned long sp0);
 
 #ifdef CONFIG_X86_IOPL_IOPERM
+	void (*invalidate_io_bitmap)(void);
 	void (*update_io_bitmap)(void);
 #endif
 
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
index c131ba4e70ef..97b4ce839b4c 100644
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -343,7 +343,8 @@  struct paravirt_patch_template pv_ops = {
 	.cpu.swapgs		= native_swapgs,
 
 #ifdef CONFIG_X86_IOPL_IOPERM
-	.cpu.update_io_bitmap	= native_tss_update_io_bitmap,
+	.cpu.invalidate_io_bitmap	= native_tss_invalidate_io_bitmap,
+	.cpu.update_io_bitmap		= native_tss_update_io_bitmap,
 #endif
 
 	.cpu.start_context_switch	= paravirt_nop,
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 3d88300ec306..070383626d7f 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -323,20 +323,6 @@  void arch_setup_new_exec(void)
 }
 
 #ifdef CONFIG_X86_IOPL_IOPERM
-static inline void tss_invalidate_io_bitmap(struct tss_struct *tss)
-{
-	/*
-	 * Invalidate the I/O bitmap by moving io_bitmap_base outside the
-	 * TSS limit so any subsequent I/O access from user space will
-	 * trigger a #GP.
-	 *
-	 * This is correct even when VMEXIT rewrites the TSS limit
-	 * to 0x67 as the only requirement is that the base points
-	 * outside the limit.
-	 */
-	tss->x86_tss.io_bitmap_base = IO_BITMAP_OFFSET_INVALID;
-}
-
 static inline void switch_to_bitmap(unsigned long tifp)
 {
 	/*
@@ -347,7 +333,7 @@  static inline void switch_to_bitmap(unsigned long tifp)
 	 * user mode.
 	 */
 	if (tifp & _TIF_IO_BITMAP)
-		tss_invalidate_io_bitmap(this_cpu_ptr(&cpu_tss_rw));
+		tss_invalidate_io_bitmap();
 }
 
 static void tss_copy_io_bitmap(struct tss_struct *tss, struct io_bitmap *iobm)
@@ -381,7 +367,7 @@  void native_tss_update_io_bitmap(void)
 	u16 *base = &tss->x86_tss.io_bitmap_base;
 
 	if (!test_thread_flag(TIF_IO_BITMAP)) {
-		tss_invalidate_io_bitmap(tss);
+		native_tss_invalidate_io_bitmap();
 		return;
 	}
 
diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
index 507f4fb88fa7..9621d31104b6 100644
--- a/arch/x86/xen/enlighten_pv.c
+++ b/arch/x86/xen/enlighten_pv.c
@@ -841,6 +841,17 @@  static void xen_load_sp0(unsigned long sp0)
 }
 
 #ifdef CONFIG_X86_IOPL_IOPERM
+static void xen_invalidate_io_bitmap(void)
+{
+	struct physdev_set_iobitmap iobitmap = {
+		.bitmap = 0,
+		.nr_ports = 0,
+	};
+
+	native_tss_invalidate_io_bitmap();
+	HYPERVISOR_physdev_op(PHYSDEVOP_set_iobitmap, &iobitmap);
+}
+
 static void xen_update_io_bitmap(void)
 {
 	struct physdev_set_iobitmap iobitmap;
@@ -1070,6 +1081,7 @@  static const struct pv_cpu_ops xen_cpu_ops __initconst = {
 	.load_sp0 = xen_load_sp0,
 
 #ifdef CONFIG_X86_IOPL_IOPERM
+	.invalidate_io_bitmap = xen_invalidate_io_bitmap,
 	.update_io_bitmap = xen_update_io_bitmap,
 #endif
 	.io_delay = xen_io_delay,