kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/arch/powerpc/kvm
History
Paul Mackerras 81bba9ff4d KVM: PPC: Book3S HV: Save/restore TM state in H_CEDE 
commit 93d17397e4 upstream.

It turns out that if the guest does a H_CEDE while the CPU is in
a transactional state, and the H_CEDE does a nap, and the nap
loses the architected state of the CPU (which is is allowed to do),
then we lose the checkpointed state of the virtual CPU.  In addition,
the transactional-memory state recorded in the MSR gets reset back
to non-transactional, and when we try to return to the guest, we take
a TM bad thing type of program interrupt because we are trying to
transition from non-transactional to transactional with a hrfid
instruction, which is not permitted.

The result of the program interrupt occurring at that point is that
the host CPU will hang in an infinite loop with interrupts disabled.
Thus this is a denial of service vulnerability in the host which can
be triggered by any guest (and depending on the guest kernel, it can
potentially triggered by unprivileged userspace in the guest).

This vulnerability has been assigned the ID CVE-2016-5412.

To fix this, we save the TM state before napping and restore it
on exit from the nap, when handling a H_CEDE in real mode.  The
case where H_CEDE exits to host virtual mode is already OK (as are
other hcalls which exit to host virtual mode) because the exit
path saves the TM state.

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2016-08-22 22:38:28 +01:00
..
44x.c KVM: PPC: Add devname:kvm aliases for modules 2014-01-09 10:14:00 +01:00
44x_emulate.c kvm: powerpc: Add kvmppc_ops callback 2013-10-17 15:24:26 +02:00
44x_tlb.c kvm: powerpc: Add kvmppc_ops callback 2013-10-17 15:24:26 +02:00
44x_tlb.h KVM: ppc: rename 44x MMU functions used in booke.c 2009-03-24 11:02:56 +02:00
book3s.c At over 200 commits, covering almost all supported architectures, this 2014-06-04 08:47:12 -07:00
book3s.h kvm: powerpc: book3s: Allow the HV and PR selection per virtual machine 2013-10-17 18:42:36 +02:00
book3s_32_mmu.c KVM: PPC: Book3S PR: Do dcbz32 patching with big endian instructions 2014-05-30 14:26:21 +02:00
book3s_32_mmu_host.c KVM: PPC: Make shared struct aka magic page guest endian 2014-05-30 14:26:21 +02:00
book3s_32_sr.S KVM: PPC: book3s_pr: Simplify transitions between virtual and real mode 2011-09-25 19:52:29 +03:00
book3s_64_mmu.c KVM: PPC: Disable NX for old magic page using guests 2014-05-30 14:26:24 +02:00
book3s_64_mmu_host.c KVM: PPC: Book3S PR: Use SLB entry 0 2014-05-30 14:26:30 +02:00
book3s_64_mmu_hv.c KVM: PPC: BOOK3S: HV: Use base page size when comparing against slb value 2014-06-25 14:07:06 +02:00
book3s_64_slb.S KVM: PPC: Book3S PR: Rework SLB switching code 2014-05-30 14:26:30 +02:00
book3s_64_vio.c ppc: kvm: use anon_inode_getfd() with O_CLOEXEC flag 2013-08-26 13:19:56 +03:00
book3s_64_vio_hv.c KVM: PPC: Book3S: Introduce hypervisor call H_GET_TCE 2014-03-26 23:34:27 +11:00
book3s_emulate.c KVM: PPC: Graciously fail broken LE hypercalls 2014-05-30 14:26:26 +02:00
book3s_exports.c KVM: PPC: Make shared struct aka magic page guest endian 2014-05-30 14:26:21 +02:00
book3s_hv.c KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR 2016-01-25 10:43:53 +00:00
book3s_hv_builtin.c powerpc/kvm/book3s_hv: Rework the secondary inhibit code 2014-05-28 13:35:34 +10:00
book3s_hv_cma.c powerpc/kvm: Use 256K chunk to track both RMA and hash page table allocation. 2013-07-08 16:21:13 +02:00
book3s_hv_cma.h powerpc/kvm: Use 256K chunk to track both RMA and hash page table allocation. 2013-07-08 16:21:13 +02:00
book3s_hv_interrupts.S powerpc/kvm: Remove redundant save of SIER AND MMCR2 2014-07-11 12:55:07 +10:00
book3s_hv_ras.c powerpc/book3s: Fix guest MC delivery mechanism to avoid soft lockups in guest. 2014-06-11 19:15:15 +10:00
book3s_hv_rm_mmu.c KVM: PPC: BOOK3S: HV: Use base page size when comparing against slb value 2014-06-25 14:07:06 +02:00
book3s_hv_rm_xics.c KVM: PPC: Book3S HV: Add support for real mode ICP in XICS emulation 2013-04-26 20:27:32 +02:00
book3s_hv_rmhandlers.S KVM: PPC: Book3S HV: Save/restore TM state in H_CEDE 2016-08-22 22:38:28 +01:00
book3s_interrupts.S KVM: PPC: Book3S PR: Fix ABIv2 on LE 2014-07-07 12:02:51 +02:00
book3s_mmu_hpte.c kvm: powerpc: book3s: pr: move PR related tracepoints to a separate header 2013-10-17 15:36:22 +02:00
book3s_paired_singles.c KVM: PPC: Make shared struct aka magic page guest endian 2014-05-30 14:26:21 +02:00
book3s_pr.c KVM: PPC: Book3S: Fix LPCR one_reg interface 2014-09-05 16:36:32 -07:00
book3s_pr_papr.c KVM: PPC: Make shared struct aka magic page guest endian 2014-05-30 14:26:21 +02:00
book3s_rmhandlers.S KVM: PPC: Book3S PR: Fix ABIv2 on LE 2014-07-07 12:02:51 +02:00
book3s_rtas.c KVM: PPC: RTAS: Do byte swaps explicitly 2014-07-07 23:17:20 +02:00
book3s_segment.S KVM: PPC: Book3S PR: Handle Facility interrupt and FSCR 2014-05-30 14:26:22 +02:00
book3s_xics.c KVM: PPC: fix couple of memory leaks in MPIC/XICS devices 2014-01-09 10:14:54 +01:00
book3s_xics.h KVM: PPC: Book3S: Add API for in-kernel XICS emulation 2013-05-02 15:28:36 +02:00
booke.c Merge branch 'kvm-ppc-next' of git://github.com/agraf/linux-2.6 into kvm-queue 2014-01-29 18:29:01 +01:00
booke.h KVM: PPC: Load/save FP/VMX/VSX state directly to/from vcpu struct 2014-01-09 10:15:02 +01:00
booke_emulate.c KVM: PPC: BookE: Emulate mfspr on EPR 2013-01-10 13:42:30 +01:00
booke_interrupts.S KVM: PPC: booke: Added debug handler 2013-03-22 01:21:09 +01:00
bookehv_interrupts.S powerpc/booke64: Use SPRG_TLB_EXFRAME on bolted handlers 2014-03-19 19:57:15 -05:00
e500.c KVM: PPC: Add devname:kvm aliases for modules 2014-01-09 10:14:00 +01:00
e500.h kvm: powerpc: use caching attributes as per linux pte 2014-01-09 10:15:08 +01:00
e500_emulate.c KVM: PPC: E500: Add dcbtls emulation 2014-05-30 14:26:17 +02:00
e500_mmu.c KVM: PPC: e500: Fix bad address type in deliver_tlb_misss() 2014-01-27 16:00:54 +01:00
e500_mmu_host.c KVM: PPC: Book3E: Unlock mmu_lock when setting caching atttribute 2014-06-24 15:37:25 +02:00
e500_mmu_host.h KVM: PPC: E500: Make clear_tlb_refs and clear_tlb1_bitmap static 2013-01-24 19:23:33 +01:00
e500mc.c KVM: PPC: Add devname:kvm aliases for modules 2014-01-09 10:14:00 +01:00
emulate.c KVM: PPC: Make shared struct aka magic page guest endian 2014-05-30 14:26:21 +02:00
fpu.S powerpc: Remove fpscr use from [kvm_]cvt_{fd,df} 2010-09-02 14:07:32 +10:00
irq.h KVM: PPC: Book3S: Add API for in-kernel XICS emulation 2013-05-02 15:28:36 +02:00
Kconfig KVM: PPC: Book3S: Move little endian conflict to HV KVM 2014-05-30 14:26:21 +02:00
Makefile kvm: powerpc: book3s: Support building HV and PR KVM as module 2013-10-17 15:45:35 +02:00
mpic.c KVM: PPC: MPIC: Reset IRQ source private members 2014-05-30 14:26:26 +02:00
powerpc.c Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc 2014-06-10 18:54:22 -07:00
timing.c KVM: PPC: fix partial application of "exit timing in ticks" 2011-07-12 13:16:28 +03:00
timing.h KVM: PPC: booke: category E.HV (GS-mode) support 2012-04-08 12:51:19 +03:00
trace.h kvm: powerpc: booke: Move booke related tracepoints to separate header 2013-10-17 15:37:16 +02:00
trace_booke.h kvm: powerpc: booke: Move booke related tracepoints to separate header 2013-10-17 15:37:16 +02:00
trace_pr.h KVM: PPC: Make shared struct aka magic page guest endian 2014-05-30 14:26:21 +02:00