KVM: x86: hyper-v: Fix the maximum number of sparse banks for XMM fast TLB flush...

commit 7321f47eada53a395fb3086d49297eebb19e8e58 upstream.

When TLB flush hypercalls (HVCALL_FLUSH_VIRTUAL_ADDRESS_{LIST,SPACE}_EX are
issued in 'XMM fast' mode, the maximum number of allowed sparse_banks is
not 'HV_HYPERCALL_MAX_XMM_REGISTERS - 1' (5) but twice as many (10) as each
XMM register is 128 bit long and can hold two 64 bit long banks.

Cc: stable@vger.kernel.org # 5.14.x
Fixes: 5974565bc26d ("KVM: x86: kvm_hv_flush_tlb use inputs from XMM registers")
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Message-Id: <20220222154642.684285-4-vkuznets@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
index 88f240aba9505d8d3f8b2c92daeeea25e5f2c6fe..97201636664928e8966d12afe56c8436ec769472 100644 (file)
--- a/arch/x86/kvm/hyperv.c
+++ b/arch/x86/kvm/hyperv.c
@@ -1820,7 +1820,8 @@ static u64 kvm_hv_flush_tlb(struct kvm_vcpu *vcpu, struct kvm_hv_hcall *hc)
 
                if (!all_cpus) {
                        if (hc->fast) {
-                               if (sparse_banks_len > HV_HYPERCALL_MAX_XMM_REGISTERS - 1)
+                               /* XMM0 is already consumed, each XMM holds two sparse banks. */
+                               if (sparse_banks_len > 2 * (HV_HYPERCALL_MAX_XMM_REGISTERS - 1))
                                        return HV_STATUS_INVALID_HYPERCALL_INPUT;
                                for (i = 0; i < sparse_banks_len; i += 2) {
                                        sparse_banks[i] = sse128_lo(hc->xmm[i / 2 + 1]);