From patchwork Tue Feb 21 02:52:11 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Gibson X-Patchwork-Id: 9583833 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 05BDB6047C for ; Tue, 21 Feb 2017 03:01:39 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D887728909 for ; Tue, 21 Feb 2017 03:01:38 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id CBC0828919; Tue, 21 Feb 2017 03:01:38 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id F041628909 for ; Tue, 21 Feb 2017 03:01:37 +0000 (UTC) Received: from localhost ([::1]:41983 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cg0hs-0002b9-Ie for patchwork-qemu-devel@patchwork.kernel.org; Mon, 20 Feb 2017 22:01:36 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:42451) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cg0Yz-0004kL-Nz for qemu-devel@nongnu.org; Mon, 20 Feb 2017 21:52:26 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cg0Yv-0005dQ-QG for qemu-devel@nongnu.org; Mon, 20 Feb 2017 21:52:25 -0500 Received: from ozlabs.org ([103.22.144.67]:36819) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cg0Yv-0005c2-6Y; Mon, 20 Feb 2017 21:52:21 -0500 Received: by ozlabs.org (Postfix, from userid 1007) id 3vS4m01qB4z9s85; Tue, 21 Feb 2017 13:52:16 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gibson.dropbear.id.au; s=201602; t=1487645536; bh=aSSJpA4DXdF3D+McKEi7pl0rg1Y1Z4IScGt8FdoUgWI=; h=From:To:Cc:Subject:Date:From; b=PsikRa8tFbdHUT//74oKpM4h6TRWxqDH5+P2XuN3ANJNSKLzDLpj8Y6Nj4jQ8cDit XixpnP2DuPY+DVbMK/qOd1Gy7+fX8nA7AJOd/UHrxWrgyMEsRXmjK9Ub7Sv5lcAM0b YvtYvcdeUpExYCaDpbN5eCSUgcY+PV35SmzNyytQ= From: David Gibson To: qemu-devel@nongnu.org, qemu-ppc@nongnu.org, qemu-stable@nongnu.org Date: Tue, 21 Feb 2017 13:52:11 +1100 Message-Id: <20170221025211.30007-1-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.9.3 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 103.22.144.67 Subject: [Qemu-devel] [PATCH] target/ppc: Fix serious bug in HPTE writeback X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: lvivier@redhat.com, thuth@redhat.com, aik@ozlabs.ru, mdroth@linux.vnet.ibm.com, agraf@suse.de, David Gibson Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP ppc_hash64_store_hpte() is used to update HPTEs in the hashed page table (HPT) for 64-bit machines. This is used when the (emulated) CPU needs to update the referenced (R) or changed (C) bits in the HPTE. Some time ago this was converted to take an HPTE index, instead of a raw offset to the HPTE within the HPT (similar functions for 32-bit still take an offset). In the process a serious bug was introduced: we're still using the index parameter as though it was an offset, failing to multiply by the size of an HPTE, so it will update bits in the wrong part of the HPT. This can corrupt the guests's HPT, causing crashes or data loss. AFAICT the reason we haven't noticed this error earlier is that for 64-bit machines we've been testing almost exclusively with Linux guests. Linux on ppc does not make use of the hardware R & C bits, so this writeback will never be triggered. It also occurs only on TCG, not KVM, guests. Signed-off-by: David Gibson --- target/ppc/mmu-hash64.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/target/ppc/mmu-hash64.c b/target/ppc/mmu-hash64.c index bb78fb5..dc3b5f7 100644 --- a/target/ppc/mmu-hash64.c +++ b/target/ppc/mmu-hash64.c @@ -894,12 +894,15 @@ void ppc_hash64_store_hpte(PowerPCCPU *cpu, pte_index *= HASH_PTE_SIZE_64; if (env->external_htab) { - stq_p(env->external_htab + pte_index, pte0); - stq_p(env->external_htab + pte_index + HASH_PTE_SIZE_64 / 2, pte1); + stq_p(env->external_htab + pte_index * HASH_PTE_SIZE_64, pte0); + stq_p(env->external_htab + pte_index * HASH_PTE_SIZE_64 + + HASH_PTE_SIZE_64 / 2, pte1); } else { - stq_phys(CPU(cpu)->as, env->htab_base + pte_index, pte0); stq_phys(CPU(cpu)->as, - env->htab_base + pte_index + HASH_PTE_SIZE_64 / 2, pte1); + env->htab_base + pte_index * HASH_PTE_SIZE_64, pte0); + stq_phys(CPU(cpu)->as, + env->htab_base + pte_index * HASH_PTE_SIZE_64 + + HASH_PTE_SIZE_64 / 2, pte1); } }