linux-brain/arch
Nicholas Piggin 962ce043ef KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state
commit d9c57d3ed52a92536f5fa59dc5ccdd58b4875076 upstream.

The H_ENTER_NESTED hypercall is handled by the L0, and it is a request
by the L1 to switch the context of the vCPU over to that of its L2
guest, and return with an interrupt indication. The L1 is responsible
for switching some registers to guest context, and the L0 switches
others (including all the hypervisor privileged state).

If the L2 MSR has TM active, then the L1 is responsible for
recheckpointing the L2 TM state. Then the L1 exits to L0 via the
H_ENTER_NESTED hcall, and the L0 saves the TM state as part of the exit,
and then it recheckpoints the TM state as part of the nested entry and
finally HRFIDs into the L2 with TM active MSR. Not efficient, but about
the simplest approach for something that's horrendously complicated.

Problems arise if the L1 exits to the L0 with a TM state which does not
match the L2 TM state being requested. For example if the L1 is
transactional but the L2 MSR is non-transactional, or vice versa. The
L0's HRFID can take a TM Bad Thing interrupt and crash.

Fix this by disallowing H_ENTER_NESTED in TM[T] state entirely, and then
ensuring that if the L1 is suspended then the L2 must have TM active,
and if the L1 is not suspended then the L2 must not have TM active.

Fixes: 360cae3137 ("KVM: PPC: Book3S HV: Nested guest entry via hypercall")
Cc: stable@vger.kernel.org # v4.20+
Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Acked-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-07-28 13:30:59 +02:00
..
alpha alpha: fix annotation of io{read,write}{16,32}be() 2020-08-26 10:40:58 +02:00
arc ARCv2: save ABI registers across signal handling 2021-06-23 14:41:29 +02:00
arm ARM: dts: stm32: move stmmac axi config in ethernet node on stm32mp15 2021-07-25 14:35:12 +02:00
arm64 arm64: dts: marvell: armada-37xx: move firmware node to generic dtsi file 2021-07-25 14:35:13 +02:00
c6x mm: consolidate pgtable_cache_init() and pgd_cache_init() 2019-09-24 15:54:09 -07:00
csky csky: change a Kconfig symbol name to fix e1000 build error 2021-04-28 13:19:16 +02:00
h8300 h8300: fix PREEMPTION build, TI_PRE_COUNT undefined 2021-02-17 10:35:18 +01:00
hexagon hexagon: use common DISCARDS macro 2021-07-20 16:10:50 +02:00
ia64 ia64: mca_drv: fix incorrect array size calculation 2021-07-14 16:53:19 +02:00
m68k m68k: atari: Fix ATARI_KBD_CORE kconfig unmet dependency warning 2021-07-14 16:53:22 +02:00
microblaze microblaze: Prevent the overflow of the start 2020-02-24 08:37:02 +01:00
mips Revert "MIPS: add PMD table accounting into MIPS'pmd_alloc_one" 2021-07-28 13:30:58 +02:00
nds32 nds32: flush_dcache_page: use page_mapping_file to avoid races with swapoff 2021-04-14 08:24:10 +02:00
nios2 nios2 update for v5.4-rc1 2019-09-27 13:02:19 -07:00
openrisc openrisc: Define memory barrier mb 2021-06-03 08:59:11 +02:00
parisc parisc: avoid a warning on u8 cast for cmpxchg on u8 pointers 2021-04-14 08:24:11 +02:00
powerpc KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state 2021-07-28 13:30:59 +02:00
riscv riscv: Use -mno-relax when using lld linker 2021-06-18 09:58:58 +02:00
s390 s390/boot: fix use of expolines in the DMA code 2021-07-28 13:30:58 +02:00
sh sh: dma: fix kconfig dependency for G2_DMA 2021-01-27 11:47:52 +01:00
sparc sparc64: Fix opcode filtering in handling of no fault loads 2021-03-30 14:35:22 +02:00
um um: fix error return code in winch_tramp() 2021-07-20 16:10:49 +02:00
unicore32 mm: treewide: clarify pgtable_page_{ctor,dtor}() naming 2019-09-26 10:10:44 -07:00
x86 x86/fpu: Limit xstate copy size in xstateregs_set() 2021-07-20 16:10:50 +02:00
xtensa xtensa: move coprocessor_flush to the .text section 2021-04-07 14:47:42 +02:00
.gitignore
Kconfig Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS" 2020-12-30 11:51:47 +01:00