Prev: [071/200] PCI: Disable MSI for MCP55 on P5N32-E SLI
Next: [083/200] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c
From: Greg KH on 1 Jul 2010 17:30
2.6.34-stable review patch. If anyone has any objections, please let me know.

------------------

From: Joerg Roedel <joerg.roedel(a)amd.com>

This patch fixes a bug in the KVM efer-msr write path. If a
guest writes to a reserved efer bit the set_efer function
injects the #GP directly. The architecture dependent wrmsr
function does not see this, assumes success and advances the
rip. This results in a #GP in the guest with the wrong rip.
This patch fixes this by reporting efer write errors back to
the architectural wrmsr function.

Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com>
Signed-off-by: Avi Kivity <avi(a)redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)suse.de>

(Cherry-picked from commit b69e8caef5b190af48c525f6d715e7b7728a77f6)
---
arch/x86/kvm/x86.c | 31 ++++++++++++-------------------
1 file changed, 12 insertions(+), 19 deletions(-)

--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -624,37 +624,29 @@ static u32 emulated_msrs[] = {
MSR_IA32_MISC_ENABLE,
};

-static void set_efer(struct kvm_vcpu *vcpu, u64 efer)
+static int set_efer(struct kvm_vcpu *vcpu, u64 efer)
{
- if (efer & efer_reserved_bits) {
- kvm_inject_gp(vcpu, 0);
- return;
- }
+ if (efer & efer_reserved_bits)
+ return 1;

if (is_paging(vcpu)
- && (vcpu->arch.efer & EFER_LME) != (efer & EFER_LME)) {
- kvm_inject_gp(vcpu, 0);
- return;
- }
+ && (vcpu->arch.efer & EFER_LME) != (efer & EFER_LME))
+ return 1;

if (efer & EFER_FFXSR) {
struct kvm_cpuid_entry2 *feat;

feat = kvm_find_cpuid_entry(vcpu, 0x80000001, 0);
- if (!feat || !(feat->edx & bit(X86_FEATURE_FXSR_OPT))) {
- kvm_inject_gp(vcpu, 0);
- return;
- }
+ if (!feat || !(feat->edx & bit(X86_FEATURE_FXSR_OPT)))
+ return 1;
}

if (efer & EFER_SVME) {
struct kvm_cpuid_entry2 *feat;

feat = kvm_find_cpuid_entry(vcpu, 0x80000001, 0);
- if (!feat || !(feat->ecx & bit(X86_FEATURE_SVM))) {
- kvm_inject_gp(vcpu, 0);
- return;
- }
+ if (!feat || !(feat->ecx & bit(X86_FEATURE_SVM)))
+ return 1;
}

efer &= ~EFER_LMA;
@@ -666,6 +658,8 @@ static void set_efer(struct kvm_vcpu *vc

vcpu->arch.mmu.base_role.nxe = (efer & EFER_NX) && !tdp_enabled;
kvm_mmu_reset_context(vcpu);
+
+ return 0;
}

void kvm_enable_efer_bits(u64 mask)
@@ -1094,8 +1088,7 @@ int kvm_set_msr_common(struct kvm_vcpu *
{
switch (msr) {
case MSR_EFER:
- set_efer(vcpu, data);
- break;
+ return set_efer(vcpu, data);
case MSR_K7_HWCR:
data &= ~(u64)0x40; /* ignore flush filter disable */
if (data != 0) {


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
 | 
Pages: 1
Prev: [071/200] PCI: Disable MSI for MCP55 on P5N32-E SLI
Next: [083/200] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c