[Qemu-devel] [PATCH 1/2] pseries: Synchronize qemu and KVM state on hypercalls

[David Gibson <david@gibson.dropbear.id.au>]

Currently the KVM exit path for PAPR hypercalls does not synchronize the
qemu cpu state with the KVM state.  Mostly this works, because the actual
hypercall arguments and return values are explicitly passed through the
kvm_run structure.  However, the hypercall path includes a privilege check,
to ensure that only the guest kernel can invoke hypercalls, not the guest
userspace.  Because of the lack of sync, this privilege check will use an
out of date copy of the MSR, which could lead either to guest userspace
being able to invoke hypercalls (a security hole for the guest) or to the
guest kernel being incorrectly refused privilege leading to various other
failures.

This patch fixes the bug by forcing a synchronization on the hypercall exit
path.  This does mean we have a potentially quite expensive get and set of
the state, however performance critical hypercalls are generally already
implemented inside KVM so this probably won't matter.  If it is a
performance problem we can optimize it later by having the kernel perform
the privilege check.  That will need a new capability, however, since qemu
will still need the privilege check for older kernels.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
 target-ppc/kvm.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/target-ppc/kvm.c b/target-ppc/kvm.c
index 546c116..78a47fb 100644
--- a/target-ppc/kvm.c
+++ b/target-ppc/kvm.c
@@ -813,6 +813,7 @@ int kvm_arch_handle_exit(CPUPPCState *env, struct kvm_run *run)
 #ifdef CONFIG_PSERIES
     case KVM_EXIT_PAPR_HCALL:
         dprintf("handle PAPR hypercall\n");
+        cpu_synchronize_state(env);
         run->papr_hcall.ret = spapr_hypercall(env, run->papr_hcall.nr,
                                               run->papr_hcall.args);
         ret = 0;
-- 
1.7.10.4