+++ /dev/null
-From e47057151422a67ce08747176fa21cb3b526a2c9 Mon Sep 17 00:00:00 2001
-From: Paul Mackerras <paulus@ozlabs.org>
-Date: Fri, 21 Jul 2017 13:57:14 +1000
-Subject: KVM: PPC: Book3S HV: Enable TM before accessing TM registers
-
-From: Paul Mackerras <paulus@ozlabs.org>
-
-commit e47057151422a67ce08747176fa21cb3b526a2c9 upstream.
-
-Commit 46a704f8409f ("KVM: PPC: Book3S HV: Preserve userspace HTM state
-properly", 2017-06-15) added code to read transactional memory (TM)
-registers but forgot to enable TM before doing so. The result is
-that if userspace does have live values in the TM registers, a KVM_RUN
-ioctl will cause a host kernel crash like this:
-
-[ 181.328511] Unrecoverable TM Unavailable Exception f60 at d00000001e7d9980
-[ 181.328605] Oops: Unrecoverable TM Unavailable Exception, sig: 6 [#1]
-[ 181.328613] SMP NR_CPUS=2048
-[ 181.328613] NUMA
-[ 181.328618] PowerNV
-[ 181.328646] Modules linked in: vhost_net vhost tap nfs_layout_nfsv41_files rpcsec_gss_krb5 nfsv4 dns_resolver nfs
-+fscache xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat
-+nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 tun ebtable_filter ebtables
-+ip6table_filter ip6_tables iptable_filter bridge stp llc kvm_hv kvm nfsd ses enclosure scsi_transport_sas ghash_generic
-+auth_rpcgss gf128mul xts sg ctr nfs_acl lockd vmx_crypto shpchp ipmi_powernv i2c_opal grace ipmi_devintf i2c_core
-+powernv_rng sunrpc ipmi_msghandler ibmpowernv uio_pdrv_genirq uio leds_powernv powernv_op_panel ip_tables xfs sd_mod
-+lpfc ipr bnx2x libata mdio ptp pps_core scsi_transport_fc libcrc32c dm_mirror dm_region_hash dm_log dm_mod
-[ 181.329278] CPU: 40 PID: 9926 Comm: CPU 0/KVM Not tainted 4.12.0+ #1
-[ 181.329337] task: c000003fc6980000 task.stack: c000003fe4d80000
-[ 181.329396] NIP: d00000001e7d9980 LR: d00000001e77381c CTR: d00000001e7d98f0
-[ 181.329465] REGS: c000003fe4d837e0 TRAP: 0f60 Not tainted (4.12.0+)
-[ 181.329523] MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE>
-[ 181.329527] CR: 24022448 XER: 00000000
-[ 181.329608] CFAR: d00000001e773818 SOFTE: 1
-[ 181.329608] GPR00: d00000001e77381c c000003fe4d83a60 d00000001e7ef410 c000003fdcfe0000
-[ 181.329608] GPR04: c000003fe4f00000 0000000000000000 0000000000000000 c000003fd7954800
-[ 181.329608] GPR08: 0000000000000001 c000003fc6980000 0000000000000000 d00000001e7e2880
-[ 181.329608] GPR12: d00000001e7d98f0 c000000007b19000 00000001295220e0 00007fffc0ce2090
-[ 181.329608] GPR16: 0000010011886608 00007fff8c89f260 0000000000000001 00007fff8c080028
-[ 181.329608] GPR20: 0000000000000000 00000100118500a6 0000010011850000 0000010011850000
-[ 181.329608] GPR24: 00007fffc0ce1b48 0000010011850000 00000000d673b901 0000000000000000
-[ 181.329608] GPR28: 0000000000000000 c000003fdcfe0000 c000003fdcfe0000 c000003fe4f00000
-[ 181.330199] NIP [d00000001e7d9980] kvmppc_vcpu_run_hv+0x90/0x6b0 [kvm_hv]
-[ 181.330264] LR [d00000001e77381c] kvmppc_vcpu_run+0x2c/0x40 [kvm]
-[ 181.330322] Call Trace:
-[ 181.330351] [c000003fe4d83a60] [d00000001e773478] kvmppc_set_one_reg+0x48/0x340 [kvm] (unreliable)
-[ 181.330437] [c000003fe4d83b30] [d00000001e77381c] kvmppc_vcpu_run+0x2c/0x40 [kvm]
-[ 181.330513] [c000003fe4d83b50] [d00000001e7700b4] kvm_arch_vcpu_ioctl_run+0x114/0x2a0 [kvm]
-[ 181.330586] [c000003fe4d83bd0] [d00000001e7642f8] kvm_vcpu_ioctl+0x598/0x7a0 [kvm]
-[ 181.330658] [c000003fe4d83d40] [c0000000003451b8] do_vfs_ioctl+0xc8/0x8b0
-[ 181.330717] [c000003fe4d83de0] [c000000000345a64] SyS_ioctl+0xc4/0x120
-[ 181.330776] [c000003fe4d83e30] [c00000000000b004] system_call+0x58/0x6c
-[ 181.330833] Instruction dump:
-[ 181.330869] e92d0260 e9290b50 e9290108 792807e3 41820058 e92d0260 e9290b50 e9290108
-[ 181.330941] 792ae8a4 794a1f87 408204f4 e92d0260 <7d4022a6> f9490ff0 e92d0260 7d4122a6
-[ 181.331013] ---[ end trace 6f6ddeb4bfe92a92 ]---
-
-The fix is just to turn on the TM bit in the MSR before accessing the
-registers.
-
-Fixes: 46a704f8409f ("KVM: PPC: Book3S HV: Preserve userspace HTM state properly")
-Reported-by: Jan Stancek <jstancek@redhat.com>
-Tested-by: Jan Stancek <jstancek@redhat.com>
-Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- arch/powerpc/kvm/book3s_hv.c | 2 ++
- 1 file changed, 2 insertions(+)
-
---- a/arch/powerpc/kvm/book3s_hv.c
-+++ b/arch/powerpc/kvm/book3s_hv.c
-@@ -1971,6 +1971,8 @@ static int kvmppc_vcpu_run_hv(struct kvm
- run->fail_entry.hardware_entry_failure_reason = 0;
- return -EINVAL;
- }
-+ /* Enable TM so we can read the TM SPRs */
-+ mtmsr(mfmsr() | MSR_TM);
- current->thread.tm_tfhar = mfspr(SPRN_TFHAR);
- current->thread.tm_tfiar = mfspr(SPRN_TFIAR);
- current->thread.tm_texasr = mfspr(SPRN_TEXASR);
--- /dev/null
+From 4c3bb4ccd074e1a0552078c0bf94c662367a1658 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Thu, 15 Jun 2017 15:43:17 +1000
+Subject: KVM: PPC: Book3S HV: Restore critical SPRs to host values on guest exit
+
+From: Paul Mackerras <paulus@ozlabs.org>
+
+commit 4c3bb4ccd074e1a0552078c0bf94c662367a1658 upstream.
+
+This restores several special-purpose registers (SPRs) to sane values
+on guest exit that were missed before.
+
+TAR and VRSAVE are readable and writable by userspace, and we need to
+save and restore them to prevent the guest from potentially affecting
+userspace execution (not that TAR or VRSAVE are used by any known
+program that run uses the KVM_RUN ioctl). We save/restore these
+in kvmppc_vcpu_run_hv() rather than on every guest entry/exit.
+
+FSCR affects userspace execution in that it can prohibit access to
+certain facilities by userspace. We restore it to the normal value
+for the task on exit from the KVM_RUN ioctl.
+
+IAMR is normally 0, and is restored to 0 on guest exit. However,
+with a radix host on POWER9, it is set to a value that prevents the
+kernel from executing user-accessible memory. On POWER9, we save
+IAMR on guest entry and restore it on guest exit to the saved value
+rather than 0. On POWER8 we continue to set it to 0 on guest exit.
+
+PSPB is normally 0. We restore it to 0 on guest exit to prevent
+userspace taking advantage of the guest having set it non-zero
+(which would allow userspace to set its SMT priority to high).
+
+UAMOR is normally 0. We restore it to 0 on guest exit to prevent
+the AMR from being used as a covert channel between userspace
+processes, since the AMR is not context-switched at present.
+
+[paulus@ozlabs.org - removed IAMR bits that are only needed on POWER9;
+ adjusted FSCR save/restore for lack of fscr field in thread_struct.]
+
+Fixes: b005255e12a3 ("KVM: PPC: Book3S HV: Context-switch new POWER8 SPRs", 2014-01-08)
+Cc: stable@vger.kernel.org # v3.14+
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kvm/book3s_hv.c | 13 +++++++++++--
+ arch/powerpc/kvm/book3s_hv_rmhandlers.S | 2 ++
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -1951,6 +1951,9 @@ static int kvmppc_vcpu_run_hv(struct kvm
+ int r;
+ int srcu_idx;
+ unsigned long ebb_regs[3] = {}; /* shut up GCC */
++ unsigned long user_tar = 0;
++ unsigned long proc_fscr = 0;
++ unsigned int user_vrsave;
+
+ if (!vcpu->arch.sane) {
+ run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+@@ -2001,12 +2004,15 @@ static int kvmppc_vcpu_run_hv(struct kvm
+ flush_altivec_to_thread(current);
+ flush_vsx_to_thread(current);
+
+- /* Save userspace EBB register values */
++ /* Save userspace EBB and other register values */
+ if (cpu_has_feature(CPU_FTR_ARCH_207S)) {
+ ebb_regs[0] = mfspr(SPRN_EBBHR);
+ ebb_regs[1] = mfspr(SPRN_EBBRR);
+ ebb_regs[2] = mfspr(SPRN_BESCR);
++ user_tar = mfspr(SPRN_TAR);
++ proc_fscr = mfspr(SPRN_FSCR);
+ }
++ user_vrsave = mfspr(SPRN_VRSAVE);
+
+ vcpu->arch.wqp = &vcpu->arch.vcore->wq;
+ vcpu->arch.pgdir = current->mm->pgd;
+@@ -2027,12 +2033,15 @@ static int kvmppc_vcpu_run_hv(struct kvm
+ }
+ } while (is_kvmppc_resume_guest(r));
+
+- /* Restore userspace EBB register values */
++ /* Restore userspace EBB and other register values */
+ if (cpu_has_feature(CPU_FTR_ARCH_207S)) {
+ mtspr(SPRN_EBBHR, ebb_regs[0]);
+ mtspr(SPRN_EBBRR, ebb_regs[1]);
+ mtspr(SPRN_BESCR, ebb_regs[2]);
++ mtspr(SPRN_TAR, user_tar);
++ mtspr(SPRN_FSCR, proc_fscr);
+ }
++ mtspr(SPRN_VRSAVE, user_vrsave);
+
+ out:
+ vcpu->arch.state = KVMPPC_VCPU_NOTREADY;
+--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+@@ -1182,6 +1182,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
+ mtspr SPRN_IAMR, r0
+ mtspr SPRN_CIABR, r0
+ mtspr SPRN_DAWRX, r0
++ mtspr SPRN_PSPB, r0
+ mtspr SPRN_TCSCR, r0
+ mtspr SPRN_WORT, r0
+ /* Set MMCRS to 1<<31 to freeze and disable the SPMC counters */
+@@ -1198,6 +1199,7 @@ BEGIN_FTR_SECTION
+ std r6,VCPU_UAMOR(r9)
+ li r6,0
+ mtspr SPRN_AMR,r6
++ mtspr SPRN_UAMOR, r6
+ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_206)
+
+ /* Switch DSCR back to host value */
projects / thirdparty / kernel / stable-queue.git / commitdiff
