Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1319572

[PATCH 3.10 05/53] KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR

Show all headers | View raw

3.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paul Mackerras <paulus@ozlabs.org>

commit c20875a3e638e4a03e099b343ec798edd1af5cc6 upstream.

Currently it is possible for userspace (e.g. QEMU) to set a value
for the MSR for a guest VCPU which has both of the TS bits set,
which is an illegal combination.  The result of this is that when
we execute a hrfid (hypervisor return from interrupt doubleword)
instruction to enter the guest, the CPU will take a TM Bad Thing
type of program interrupt (vector 0x700).

Now, if PR KVM is configured in the kernel along with HV KVM, we
actually handle this without crashing the host or giving hypervisor
privilege to the guest; instead what happens is that we deliver a
program interrupt to the guest, with SRR0 reflecting the address
of the hrfid instruction and SRR1 containing the MSR value at that
point.  If PR KVM is not configured in the kernel, then we try to
run the host's program interrupt handler with the MMU set to the
guest context, which almost certainly causes a host crash.

This closes the hole by making kvmppc_set_msr_hv() check for the
illegal combination and force the TS field to a safe value (00,
meaning non-transactional).

Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/kvm/book3s_hv.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -160,6 +160,12 @@ void kvmppc_core_vcpu_put(struct kvm_vcp
 
 void kvmppc_set_msr(struct kvm_vcpu *vcpu, u64 msr)
 {
+	/*
+	 * Check for illegal transactional state bit combination
+	 * and if we find it, force the TS field to a safe state.
+	 */
+	if ((msr & MSR_TS_MASK) == MSR_TS_MASK)
+		msr &= ~MSR_TS_MASK;
 	vcpu->arch.shregs.msr = msr;
 	kvmppc_end_cede(vcpu);
 }

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.10 00/53] 3.10.96-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 42/53] team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 46/53] scripts/recordmcount.pl: support data in text section on powerpc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 04/53] x86/xen: dont reset vcpu_info on a cancelled suspend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 43/53] powerpc/tm: Block signal return setting invalid MSR state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 44/53] powerpc: Make value-returning atomics fully ordered Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 29/53] USB: cp210x: add ID for ELV Marble Sound Board 1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 32/53] ipv6/addrlabel: fix ip6addrlbl_get() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 06/53] x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[] Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 05/53] KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 53/53] mn10300: Select CONFIG_HAVE_UID16 to fix build failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 30/53] xhci: refuse loading if nousb is used Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 45/53] powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 39/53] phonet: properly unshare skbs in phonet_rcv() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 40/53] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 47/53] arm64: fix building without CONFIG_UID16 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 37/53] net: possible use after free in dst_release Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 07/53] x86/boot: Double BOOT_HEAP_SIZE to 64KB Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 49/53] arm64: mm: ensure that the zero page is visible to the page table walker Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 38/53] tcp_yeah: dont set ssthresh below 2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 09/53] ALSA: hda - Add Intel Lewisburg device IDs Audio Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 34/53] connector: bump skb->users before callback invocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 08/53] ipmi: move timer init to before irq is setup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 33/53] sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 51/53] HID: core: Avoid uninitialized buffer access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 48/53] arm64: Clear out any singlestep state on a ptrace detach operation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 36/53] bridge: Only call /sbin/bridge-stp for the initial network namespace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 50/53] parisc iommu: fix panic due to trying to allocate too large region Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 52/53] openrisc: fix CONFIG_UID16 setting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.10 13/53] ALSA: hda - Set SKL+ hda controller power at freeze() and thaw() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 11/53] ALSA: rme96: Fix unexpected volume reset after rate changes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 23/53] ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 01/53] af_unix: fix incorrect revert of lock_interruptible in stream receive code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 28/53] USB: ipaq.c: fix a timeout loop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 15/53] ALSA: seq: Fix missing NULL check at remove_events ioctl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 16/53] ALSA: seq: Fix race at timer setup and close Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 03/53] xen/gntdev: Grant maps should not be subject to NUMA balancing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 22/53] ALSA: hrtimer: Fix stall by hrtimer_cancel() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 14/53] ALSA: hda/realtek - Fix silent headphone output on MacPro 4,1 (v2) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 26/53] ASoC: compress: Fix compress device direction check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 25/53] ASoC: arizona: Fix bclk for sample rates that are multiple of 4kHz Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 10/53] ALSA: hda - Apply pin fixup for HP ProBook 6550b Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 19/53] ALSA: timer: Fix double unlink of active_list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 17/53] ALSA: timer: Harden slave timer list handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 20/53] ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 21/53] ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 12/53] ALSA: hda - Add inverted dmic for Packard Bell DOTS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 24/53] ASoC: wm8962: correct addresses for HPF_C_0/1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 27/53] usb: xhci: fix config fail of FS hub behind a HS hub with MTT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 02/53] x86/signal: Fix restart_syscall number for x32 tasks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.10 18/53] ALSA: timer: Fix race among timer ioctls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  Re: [PATCH 3.10 00/53] 3.10.96-stable review Willy Tarreau <w@1wt.eu> - 2016-01-27 22:20 +0100
    Re: [PATCH 3.10 00/53] 3.10.96-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 22:30 +0100
  Re: [PATCH 3.10 00/53] 3.10.96-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-01-28 00:30 +0100
    Re: [PATCH 3.10 00/53] 3.10.96-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-29 06:50 +0100
  Re: [PATCH 3.10 00/53] 3.10.96-stable review Guenter Roeck <linux@roeck-us.net> - 2016-01-28 03:10 +0100
    Re: [PATCH 3.10 00/53] 3.10.96-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-29 07:00 +0100
  Re: [PATCH 3.10 00/53] 3.10.96-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-29 07:00 +0100
    Re: [PATCH 3.10 00/53] 3.10.96-stable review Kevin Hilman <khilman@baylibre.com> - 2016-01-29 23:50 +0100

csiph-web