[PATCH 3.12 30/39] KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR

From	Jiri Slaby <jslaby@suse.cz>
Newsgroups	linux.kernel
Subject	[PATCH 3.12 30/39] KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR
Date	2016-01-25 13:00 +0100
Message-ID	<qUNYo-3kJ-61@gated-at.bofh.it> (permalink)
References	<qUNYl-3kJ-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

From: Paul Mackerras <paulus@ozlabs.org>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit c20875a3e638e4a03e099b343ec798edd1af5cc6 upstream.

Currently it is possible for userspace (e.g. QEMU) to set a value
for the MSR for a guest VCPU which has both of the TS bits set,
which is an illegal combination.  The result of this is that when
we execute a hrfid (hypervisor return from interrupt doubleword)
instruction to enter the guest, the CPU will take a TM Bad Thing
type of program interrupt (vector 0x700).

Now, if PR KVM is configured in the kernel along with HV KVM, we
actually handle this without crashing the host or giving hypervisor
privilege to the guest; instead what happens is that we deliver a
program interrupt to the guest, with SRR0 reflecting the address
of the hrfid instruction and SRR1 containing the MSR value at that
point.  If PR KVM is not configured in the kernel, then we try to
run the host's program interrupt handler with the MMU set to the
guest context, which almost certainly causes a host crash.

This closes the hole by making kvmppc_set_msr_hv() check for the
illegal combination and force the TS field to a safe value (00,
meaning non-transactional).

Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 arch/powerpc/kvm/book3s_hv.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 211974a386d6..ed6e0be80b3b 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -160,6 +160,12 @@ void kvmppc_core_vcpu_put(struct kvm_vcpu *vcpu)
 
 void kvmppc_set_msr(struct kvm_vcpu *vcpu, u64 msr)
 {
+	/*
+	 * Check for illegal transactional state bit combination
+	 * and if we find it, force the TS field to a safe state.
+	 */
+	if ((msr & MSR_TS_MASK) == MSR_TS_MASK)
+		msr &= ~MSR_TS_MASK;
 	vcpu->arch.shregs.msr = msr;
 	kvmppc_end_cede(vcpu);
 }
-- 
2.7.0

Thread

[PATCH 3.12 01/39] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 02/39] tools: Add a "make all" rule Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 26/39] udp: properly support MSG_PEEK with truncated buffers Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 24/39] KEYS: Fix race between read and revoke Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 22/39] sctp: Prevent soft lockup when sctp_accept() is called during a timeout event Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 28/39] xen/gntdev: Grant maps should not be subject to NUMA balancing Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 36/39] MAINTAINERS: Add public mailing list for ARC Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 27/39] x86/signal: Fix restart_syscall number for x32 tasks Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 16/39] staging/dgnc: fix info leak in ioctl Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 37/39] ARC: Fix silly typo in MAINTAINERS file commit 30b9dbee895ff0d5cbf155bd1ef3f0f5992bca6f upstream. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 25/39] KEYS: Fix keyring ref leak in join_session_keyring() Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 32/39] x86/boot: Double BOOT_HEAP_SIZE to 64KB Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 38/39] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 12/39] block: Always check queue limits for cloned requests Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 20/39] m68k/mm: Check for mm != NULL in do_page_fault() debug code Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 18/39] m32r: fix potential NULL-pointer dereference Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 15/39] module: remove MODULE_GENERIC_TABLE Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 23/39] USB: quirks: Fix another ELAN touchscreen Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 17/39] pm: use GFP_ATOMIC when pm core call this function Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 39/39] ppp, slip: Validate VJ compression slot parameters completely Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 30/39] KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 21/39] m68k/mac: Make SCC reset work more reliably Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 34/39] ALSA: hda - Add Intel Lewisburg device IDs Audio Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 04/39] dlm: make posix locks interruptible Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 35/39] ALSA: hda - Apply pin fixup for HP ProBook 6550b Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 14/39] qla2xxx: Fix hardware lock/unlock issue causing kernel panic. Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 29/39] x86/xen: don't reset vcpu_info on a cancelled suspend Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 10/39] drm/i915: Fix SRC_COPY width on 830/845g Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:10 +0100
  [PATCH 3.12 07/39] route: Use ipv4_mtu instead of raw rt_pmtu Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:10 +0100
  [PATCH 3.12 13/39] Input: aiptek - fix crash on detecting device without endpoints Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:10 +0100
  [PATCH 3.12 05/39] PCI: Drop "setting latency timer" messages Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:10 +0100
  [PATCH 3.12 11/39] lpfc: Fix null ndlp dereference in target_reset_handler Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:10 +0100
  [PATCH 3.12 09/39] ring-buffer: Always run per-cpu ring buffer resize with schedule_work_on() Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:10 +0100
  [PATCH 3.12 06/39] ipv4: Don't increase PMTU with Datagram Too Big message. Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:10 +0100
  [PATCH 3.12 03/39] ALSA: hda - Fix noise problems on Thinkpad T440s Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:10 +0100
  [PATCH 3.12 08/39] SUNRPC: Fix oops when trace sunrpc_task events in nfs client Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:10 +0100

csiph-web