Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]powerpc/rtas: Fix RTAS MSR[HV] handling for Cell[EOL][EOL]The semi-recent changes to MSR handling when entering RTAS (firmware)[EOL]cause crashes on IBM Cell machines. An example trace:[EOL][EOL]  kernel tried to execute user page (2fff01a8) - exploit attempt? (uid: 0)[EOL]  BUG: Unable to handle kernel instruction fetch[EOL]  Faulting instruction address: 0x2fff01a8[EOL]  Oops: Kernel access of bad area, sig: 11 [#1][EOL]  BE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=4 NUMA Cell[EOL]  Modules linked in:[EOL]  CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W          6.0.0-rc2-00433-gede0a8d3307a #207[EOL]  NIP:  000000002fff01a8 LR: 0000000000032608 CTR: 0000000000000000[EOL]  REGS: c0000000015236b0 TRAP: 0400   Tainted: G        W           (6.0.0-rc2-00433-gede0a8d3307a)[EOL]  MSR:  0000000008001002 <ME,RI>  CR: 00000000  XER: 20000000[EOL]  ...[EOL]  NIP 0x2fff01a8[EOL]  LR  0x32608[EOL]  Call Trace:[EOL]    0xc00000000143c5f8 (unreliable)[EOL]    .rtas_call+0x224/0x320[EOL]    .rtas_get_boot_time+0x70/0x150[EOL]    .read_persistent_clock64+0x114/0x140[EOL]    .read_persistent_wall_and_boot_offset+0x24/0x80[EOL]    .timekeeping_init+0x40/0x29c[EOL]    .start_kernel+0x674/0x8f0[EOL]    start_here_common+0x1c/0x50[EOL][EOL]Unlike PAPR platforms where RTAS is only used in guests, on the IBM Cell[EOL]machines Linux runs with MSR[HV] set but also uses RTAS, provided by[EOL]SLOF.[EOL][EOL]Fix it by copying the MSR[HV] bit from the MSR value we've just read[EOL]using mfmsr into the value used for RTAS.[EOL][EOL]It seems like we could also fix it using an #ifdef CELL to set MSR[HV],[EOL]but that doesn't work because it's possible to build a single kernel[EOL]image that runs on both Cell native and pseries.

CREATE(Triage):(User=lchen-cn) [CVE-2022-49955 (https://nvd.nist.gov/vuln/detail/CVE-2022-49955)