Skip to contentSkip to conversation

KVM: PPC: Book3S: Fix CONFIG_TRANSACTIONAL_MEM=n crash

PATCH Applied Nicholas Piggin 2 participants 3 messages Jul 16, 2021 – Jul 21, 2021

Subsystems (2)
PowerPC KVM PowerPC
lore
Share & tools
lore

Nicholas Piggin

author reviewer
#0 lore raw

PATCH 1/2 KVM: PPC: Book3S: Fix CONFIG_TRANSACTIONAL_MEM=n crash

When running CPU_FTR_P9_TM_HV_ASSIST, HFSCR[TM] is set for the guest even if the host has CONFIG_TRANSACTIONAL_MEM=n, which causes it to be unprepared to handle guest exits while transactional.

Normal guests don't have a problem because the HTM capability will not be advertised, but a rogue or buggy one could crash the host.

Reported-by Alexey Kardashevskiy <[email protected]>
Fixes 4bb3c7a0208f ("KVM: PPC: Book3S HV: Work around transactional memory bugs in POWER9")
Signed-off-by Nicholas Piggin <[email protected]>
---
 arch/powerpc/kvm/book3s_hv.c | 2 ++
 1 file changed, 2 insertions(+)
arch/powerpc/kvm/book3s_hv.c +2 -0
index 1d1fcc290fca..085fb8ecbf68 100644
@@ -2697,8 +2697,10 @@ static int kvmppc_core_vcpu_create_hv(struct kvm_vcpu *vcpu)
 		HFSCR_DSCR | HFSCR_VECVSX | HFSCR_FP | HFSCR_PREFIX;
 	if (cpu_has_feature(CPU_FTR_HVMODE)) {
 		vcpu->arch.hfscr &= mfspr(SPRN_HFSCR);
+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
 		if (cpu_has_feature(CPU_FTR_P9_TM_HV_ASSIST))
 			vcpu->arch.hfscr |= HFSCR_TM;
+#endif
 	}
 	if (cpu_has_feature(CPU_FTR_TM_COMP))
 		vcpu->arch.hfscr |= HFSCR_TM;
Signature · 1 line
2.23.0
author reviewer
#1 lore raw

PATCH 2/2 KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak

vcpu_put is not called if the user copy fails. This can result in preempt notifier corruption and crashes, among other issues.

Reported-by Alexey Kardashevskiy <[email protected]>
Fixes b3cebfe8c1ca ("KVM: PPC: Move vcpu_load/vcpu_put down to each ioctl case in kvm_arch_vcpu_ioctl")
Signed-off-by Nicholas Piggin <[email protected]>
---
 arch/powerpc/kvm/powerpc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/kvm/powerpc.c +2 -2
index be33b5321a76..b4e6f70b97b9 100644
@@ -2048,9 +2048,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
 	{
 		struct kvm_enable_cap cap;
 		r = -EFAULT;
-		vcpu_load(vcpu);
 		if (copy_from_user(&cap, argp, sizeof(cap)))
 			goto out;
+		vcpu_load(vcpu);
 		r = kvm_vcpu_ioctl_enable_cap(vcpu, &cap);
 		vcpu_put(vcpu);
 		break;

@@ -2074,9 +2074,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
 	case KVM_DIRTY_TLB: {
 		struct kvm_dirty_tlb dirty;
 		r = -EFAULT;
-		vcpu_load(vcpu);
 		if (copy_from_user(&dirty, argp, sizeof(dirty)))
 			goto out;
+		vcpu_load(vcpu);
 		r = kvm_vcpu_ioctl_dirty_tlb(vcpu, &dirty);
 		vcpu_put(vcpu);
 		break;
Signature · 1 line
2.23.0
Applied
#2 lore raw
In reply to Nicholas Piggin
Quoted 6 lines · Nicholas Piggin

When running CPU_FTR_P9_TM_HV_ASSIST, HFSCR[TM] is set for the guest even if the host has CONFIG_TRANSACTIONAL_MEM=n, which causes it to be unprepared to handle guest exits while transactional.

Normal guests don't have a problem because the HTM capability will not be advertised, but a rogue or buggy one could crash the host.

Applied to powerpc/fixes.

[1/2] KVM: PPC: Book3S: Fix CONFIG_TRANSACTIONAL_MEM=n crash

      https://git.kernel.org/powerpc/c/bd31ecf44b8e18ccb1e5f6b50f85de6922a60de3
[2/2] KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak
      https://git.kernel.org/powerpc/c/bc4188a2f56e821ea057aca6bf444e138d06c252

cheers