From 7c73eed5a59e9dcbbfd4e7367c3cdee3f13c936d Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 3 Aug 2017 10:57:46 -0700 Subject: [PATCH] 4.4-stable patches added patches: kvm-ppc-book3s-hv-context-switch-ebb-registers-properly.patch kvm-ppc-book3s-hv-restore-critical-sprs-to-host-values-on-guest-exit.patch --- ...ontext-switch-ebb-registers-properly.patch | 79 ++++++++++++ ...ble-tm-before-accessing-tm-registers.patch | 81 ------------- ...al-sprs-to-host-values-on-guest-exit.patch | 112 ++++++++++++++++++ queue-4.4/series | 3 +- 4 files changed, 193 insertions(+), 82 deletions(-) create mode 100644 queue-4.4/kvm-ppc-book3s-hv-context-switch-ebb-registers-properly.patch delete mode 100644 queue-4.4/kvm-ppc-book3s-hv-enable-tm-before-accessing-tm-registers.patch create mode 100644 queue-4.4/kvm-ppc-book3s-hv-restore-critical-sprs-to-host-values-on-guest-exit.patch diff --git a/queue-4.4/kvm-ppc-book3s-hv-context-switch-ebb-registers-properly.patch b/queue-4.4/kvm-ppc-book3s-hv-context-switch-ebb-registers-properly.patch new file mode 100644 index 00000000000..3f5b9fbb646 --- /dev/null +++ b/queue-4.4/kvm-ppc-book3s-hv-context-switch-ebb-registers-properly.patch @@ -0,0 +1,79 @@ +From ca8efa1df1d15a1795a2da57f9f6aada6ed6b946 Mon Sep 17 00:00:00 2001 +From: Paul Mackerras +Date: Tue, 6 Jun 2017 16:47:22 +1000 +Subject: KVM: PPC: Book3S HV: Context-switch EBB registers properly + +From: Paul Mackerras + +commit ca8efa1df1d15a1795a2da57f9f6aada6ed6b946 upstream. + +This adds code to save the values of three SPRs (special-purpose +registers) used by userspace to control event-based branches (EBBs), +which are essentially interrupts that get delivered directly to +userspace. These registers are loaded up with guest values when +entering the guest, and their values are saved when exiting the +guest, but we were not saving the host values and restoring them +before going back to userspace. + +On POWER8 this would only affect userspace programs which explicitly +request the use of EBBs and also use the KVM_RUN ioctl, since the +only source of EBBs on POWER8 is the PMU, and there is an explicit +enable bit in the PMU registers (and those PMU registers do get +properly context-switched between host and guest). On POWER9 there +is provision for externally-generated EBBs, and these are not subject +to the control in the PMU registers. + +Since these registers only affect userspace, we can save them when +we first come in from userspace and restore them before returning to +userspace, rather than saving/restoring the host values on every +guest entry/exit. Similarly, we don't need to worry about their +values on offline secondary threads since they execute in the context +of the idle task, which never executes in userspace. + +Fixes: b005255e12a3 ("KVM: PPC: Book3S HV: Context-switch new POWER8 SPRs", 2014-01-08) +Signed-off-by: Paul Mackerras +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kvm/book3s_hv.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/arch/powerpc/kvm/book3s_hv.c ++++ b/arch/powerpc/kvm/book3s_hv.c +@@ -2687,6 +2687,7 @@ static int kvmppc_vcpu_run_hv(struct kvm + { + int r; + int srcu_idx; ++ unsigned long ebb_regs[3] = {}; /* shut up GCC */ + + if (!vcpu->arch.sane) { + run->exit_reason = KVM_EXIT_INTERNAL_ERROR; +@@ -2736,6 +2737,14 @@ static int kvmppc_vcpu_run_hv(struct kvm + flush_fp_to_thread(current); + flush_altivec_to_thread(current); + flush_vsx_to_thread(current); ++ ++ /* Save userspace EBB register values */ ++ if (cpu_has_feature(CPU_FTR_ARCH_207S)) { ++ ebb_regs[0] = mfspr(SPRN_EBBHR); ++ ebb_regs[1] = mfspr(SPRN_EBBRR); ++ ebb_regs[2] = mfspr(SPRN_BESCR); ++ } ++ + vcpu->arch.wqp = &vcpu->arch.vcore->wq; + vcpu->arch.pgdir = current->mm->pgd; + vcpu->arch.state = KVMPPC_VCPU_BUSY_IN_HOST; +@@ -2757,6 +2766,13 @@ static int kvmppc_vcpu_run_hv(struct kvm + } + } while (is_kvmppc_resume_guest(r)); + ++ /* Restore userspace EBB register values */ ++ if (cpu_has_feature(CPU_FTR_ARCH_207S)) { ++ mtspr(SPRN_EBBHR, ebb_regs[0]); ++ mtspr(SPRN_EBBRR, ebb_regs[1]); ++ mtspr(SPRN_BESCR, ebb_regs[2]); ++ } ++ + out: + vcpu->arch.state = KVMPPC_VCPU_NOTREADY; + atomic_dec(&vcpu->kvm->arch.vcpus_running); diff --git a/queue-4.4/kvm-ppc-book3s-hv-enable-tm-before-accessing-tm-registers.patch b/queue-4.4/kvm-ppc-book3s-hv-enable-tm-before-accessing-tm-registers.patch deleted file mode 100644 index ce8d4f43639..00000000000 --- a/queue-4.4/kvm-ppc-book3s-hv-enable-tm-before-accessing-tm-registers.patch +++ /dev/null @@ -1,81 +0,0 @@ -From e47057151422a67ce08747176fa21cb3b526a2c9 Mon Sep 17 00:00:00 2001 -From: Paul Mackerras -Date: Fri, 21 Jul 2017 13:57:14 +1000 -Subject: KVM: PPC: Book3S HV: Enable TM before accessing TM registers - -From: Paul Mackerras - -commit e47057151422a67ce08747176fa21cb3b526a2c9 upstream. - -Commit 46a704f8409f ("KVM: PPC: Book3S HV: Preserve userspace HTM state -properly", 2017-06-15) added code to read transactional memory (TM) -registers but forgot to enable TM before doing so. The result is -that if userspace does have live values in the TM registers, a KVM_RUN -ioctl will cause a host kernel crash like this: - -[ 181.328511] Unrecoverable TM Unavailable Exception f60 at d00000001e7d9980 -[ 181.328605] Oops: Unrecoverable TM Unavailable Exception, sig: 6 [#1] -[ 181.328613] SMP NR_CPUS=2048 -[ 181.328613] NUMA -[ 181.328618] PowerNV -[ 181.328646] Modules linked in: vhost_net vhost tap nfs_layout_nfsv41_files rpcsec_gss_krb5 nfsv4 dns_resolver nfs -+fscache xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat -+nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 tun ebtable_filter ebtables -+ip6table_filter ip6_tables iptable_filter bridge stp llc kvm_hv kvm nfsd ses enclosure scsi_transport_sas ghash_generic -+auth_rpcgss gf128mul xts sg ctr nfs_acl lockd vmx_crypto shpchp ipmi_powernv i2c_opal grace ipmi_devintf i2c_core -+powernv_rng sunrpc ipmi_msghandler ibmpowernv uio_pdrv_genirq uio leds_powernv powernv_op_panel ip_tables xfs sd_mod -+lpfc ipr bnx2x libata mdio ptp pps_core scsi_transport_fc libcrc32c dm_mirror dm_region_hash dm_log dm_mod -[ 181.329278] CPU: 40 PID: 9926 Comm: CPU 0/KVM Not tainted 4.12.0+ #1 -[ 181.329337] task: c000003fc6980000 task.stack: c000003fe4d80000 -[ 181.329396] NIP: d00000001e7d9980 LR: d00000001e77381c CTR: d00000001e7d98f0 -[ 181.329465] REGS: c000003fe4d837e0 TRAP: 0f60 Not tainted (4.12.0+) -[ 181.329523] MSR: 9000000000009033 -[ 181.329527] CR: 24022448 XER: 00000000 -[ 181.329608] CFAR: d00000001e773818 SOFTE: 1 -[ 181.329608] GPR00: d00000001e77381c c000003fe4d83a60 d00000001e7ef410 c000003fdcfe0000 -[ 181.329608] GPR04: c000003fe4f00000 0000000000000000 0000000000000000 c000003fd7954800 -[ 181.329608] GPR08: 0000000000000001 c000003fc6980000 0000000000000000 d00000001e7e2880 -[ 181.329608] GPR12: d00000001e7d98f0 c000000007b19000 00000001295220e0 00007fffc0ce2090 -[ 181.329608] GPR16: 0000010011886608 00007fff8c89f260 0000000000000001 00007fff8c080028 -[ 181.329608] GPR20: 0000000000000000 00000100118500a6 0000010011850000 0000010011850000 -[ 181.329608] GPR24: 00007fffc0ce1b48 0000010011850000 00000000d673b901 0000000000000000 -[ 181.329608] GPR28: 0000000000000000 c000003fdcfe0000 c000003fdcfe0000 c000003fe4f00000 -[ 181.330199] NIP [d00000001e7d9980] kvmppc_vcpu_run_hv+0x90/0x6b0 [kvm_hv] -[ 181.330264] LR [d00000001e77381c] kvmppc_vcpu_run+0x2c/0x40 [kvm] -[ 181.330322] Call Trace: -[ 181.330351] [c000003fe4d83a60] [d00000001e773478] kvmppc_set_one_reg+0x48/0x340 [kvm] (unreliable) -[ 181.330437] [c000003fe4d83b30] [d00000001e77381c] kvmppc_vcpu_run+0x2c/0x40 [kvm] -[ 181.330513] [c000003fe4d83b50] [d00000001e7700b4] kvm_arch_vcpu_ioctl_run+0x114/0x2a0 [kvm] -[ 181.330586] [c000003fe4d83bd0] [d00000001e7642f8] kvm_vcpu_ioctl+0x598/0x7a0 [kvm] -[ 181.330658] [c000003fe4d83d40] [c0000000003451b8] do_vfs_ioctl+0xc8/0x8b0 -[ 181.330717] [c000003fe4d83de0] [c000000000345a64] SyS_ioctl+0xc4/0x120 -[ 181.330776] [c000003fe4d83e30] [c00000000000b004] system_call+0x58/0x6c -[ 181.330833] Instruction dump: -[ 181.330869] e92d0260 e9290b50 e9290108 792807e3 41820058 e92d0260 e9290b50 e9290108 -[ 181.330941] 792ae8a4 794a1f87 408204f4 e92d0260 <7d4022a6> f9490ff0 e92d0260 7d4122a6 -[ 181.331013] ---[ end trace 6f6ddeb4bfe92a92 ]--- - -The fix is just to turn on the TM bit in the MSR before accessing the -registers. - -Fixes: 46a704f8409f ("KVM: PPC: Book3S HV: Preserve userspace HTM state properly") -Reported-by: Jan Stancek -Tested-by: Jan Stancek -Signed-off-by: Paul Mackerras -Signed-off-by: Greg Kroah-Hartman - ---- - arch/powerpc/kvm/book3s_hv.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/arch/powerpc/kvm/book3s_hv.c -+++ b/arch/powerpc/kvm/book3s_hv.c -@@ -2707,6 +2707,8 @@ static int kvmppc_vcpu_run_hv(struct kvm - run->fail_entry.hardware_entry_failure_reason = 0; - return -EINVAL; - } -+ /* Enable TM so we can read the TM SPRs */ -+ mtmsr(mfmsr() | MSR_TM); - current->thread.tm_tfhar = mfspr(SPRN_TFHAR); - current->thread.tm_tfiar = mfspr(SPRN_TFIAR); - current->thread.tm_texasr = mfspr(SPRN_TEXASR); diff --git a/queue-4.4/kvm-ppc-book3s-hv-restore-critical-sprs-to-host-values-on-guest-exit.patch b/queue-4.4/kvm-ppc-book3s-hv-restore-critical-sprs-to-host-values-on-guest-exit.patch new file mode 100644 index 00000000000..290a955dc70 --- /dev/null +++ b/queue-4.4/kvm-ppc-book3s-hv-restore-critical-sprs-to-host-values-on-guest-exit.patch @@ -0,0 +1,112 @@ +From 4c3bb4ccd074e1a0552078c0bf94c662367a1658 Mon Sep 17 00:00:00 2001 +From: Paul Mackerras +Date: Thu, 15 Jun 2017 15:43:17 +1000 +Subject: KVM: PPC: Book3S HV: Restore critical SPRs to host values on guest exit + +From: Paul Mackerras + +commit 4c3bb4ccd074e1a0552078c0bf94c662367a1658 upstream. + +This restores several special-purpose registers (SPRs) to sane values +on guest exit that were missed before. + +TAR and VRSAVE are readable and writable by userspace, and we need to +save and restore them to prevent the guest from potentially affecting +userspace execution (not that TAR or VRSAVE are used by any known +program that run uses the KVM_RUN ioctl). We save/restore these +in kvmppc_vcpu_run_hv() rather than on every guest entry/exit. + +FSCR affects userspace execution in that it can prohibit access to +certain facilities by userspace. We restore it to the normal value +for the task on exit from the KVM_RUN ioctl. + +IAMR is normally 0, and is restored to 0 on guest exit. However, +with a radix host on POWER9, it is set to a value that prevents the +kernel from executing user-accessible memory. On POWER9, we save +IAMR on guest entry and restore it on guest exit to the saved value +rather than 0. On POWER8 we continue to set it to 0 on guest exit. + +PSPB is normally 0. We restore it to 0 on guest exit to prevent +userspace taking advantage of the guest having set it non-zero +(which would allow userspace to set its SMT priority to high). + +UAMOR is normally 0. We restore it to 0 on guest exit to prevent +the AMR from being used as a covert channel between userspace +processes, since the AMR is not context-switched at present. + +[paulus@ozlabs.org - removed IAMR bits that are only needed on POWER9; + adjusted FSCR save/restore for lack of fscr field in thread_struct.] + +Fixes: b005255e12a3 ("KVM: PPC: Book3S HV: Context-switch new POWER8 SPRs", 2014-01-08) +Signed-off-by: Paul Mackerras +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kvm/book3s_hv.c | 13 +++++++++++-- + arch/powerpc/kvm/book3s_hv_rmhandlers.S | 2 ++ + 2 files changed, 13 insertions(+), 2 deletions(-) + +--- a/arch/powerpc/kvm/book3s_hv.c ++++ b/arch/powerpc/kvm/book3s_hv.c +@@ -2688,6 +2688,9 @@ static int kvmppc_vcpu_run_hv(struct kvm + int r; + int srcu_idx; + unsigned long ebb_regs[3] = {}; /* shut up GCC */ ++ unsigned long user_tar = 0; ++ unsigned long proc_fscr = 0; ++ unsigned int user_vrsave; + + if (!vcpu->arch.sane) { + run->exit_reason = KVM_EXIT_INTERNAL_ERROR; +@@ -2738,12 +2741,15 @@ static int kvmppc_vcpu_run_hv(struct kvm + flush_altivec_to_thread(current); + flush_vsx_to_thread(current); + +- /* Save userspace EBB register values */ ++ /* Save userspace EBB and other register values */ + if (cpu_has_feature(CPU_FTR_ARCH_207S)) { + ebb_regs[0] = mfspr(SPRN_EBBHR); + ebb_regs[1] = mfspr(SPRN_EBBRR); + ebb_regs[2] = mfspr(SPRN_BESCR); ++ user_tar = mfspr(SPRN_TAR); ++ proc_fscr = mfspr(SPRN_FSCR); + } ++ user_vrsave = mfspr(SPRN_VRSAVE); + + vcpu->arch.wqp = &vcpu->arch.vcore->wq; + vcpu->arch.pgdir = current->mm->pgd; +@@ -2766,12 +2772,15 @@ static int kvmppc_vcpu_run_hv(struct kvm + } + } while (is_kvmppc_resume_guest(r)); + +- /* Restore userspace EBB register values */ ++ /* Restore userspace EBB and other register values */ + if (cpu_has_feature(CPU_FTR_ARCH_207S)) { + mtspr(SPRN_EBBHR, ebb_regs[0]); + mtspr(SPRN_EBBRR, ebb_regs[1]); + mtspr(SPRN_BESCR, ebb_regs[2]); ++ mtspr(SPRN_TAR, user_tar); ++ mtspr(SPRN_FSCR, proc_fscr); + } ++ mtspr(SPRN_VRSAVE, user_vrsave); + + out: + vcpu->arch.state = KVMPPC_VCPU_NOTREADY; +--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S ++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +@@ -1268,6 +1268,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S) + mtspr SPRN_IAMR, r0 + mtspr SPRN_CIABR, r0 + mtspr SPRN_DAWRX, r0 ++ mtspr SPRN_PSPB, r0 + mtspr SPRN_TCSCR, r0 + mtspr SPRN_WORT, r0 + /* Set MMCRS to 1<<31 to freeze and disable the SPMC counters */ +@@ -1283,6 +1284,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S) + std r6,VCPU_UAMOR(r9) + li r6,0 + mtspr SPRN_AMR,r6 ++ mtspr SPRN_UAMOR, r6 + + /* Switch DSCR back to host value */ + mfspr r8, SPRN_DSCR diff --git a/queue-4.4/series b/queue-4.4/series index ccd453e0ec3..4ed3e634c40 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -3,7 +3,8 @@ pstore-make-spinlock-per-zone-instead-of-global.patch net-reduce-skb_warn_bad_offload-noise.patch powerpc-pseries-fix-of_node_put-underflow-during-reconfig-remove.patch crypto-authencesn-fix-digest_null-crash.patch -kvm-ppc-book3s-hv-enable-tm-before-accessing-tm-registers.patch md-raid5-add-thread_group-worker-async_tx_issue_pending_all.patch drm-vmwgfx-fix-gcc-7.1.1-warning.patch drm-nouveau-bar-gf100-fix-access-to-upper-half-of-bar2.patch +kvm-ppc-book3s-hv-context-switch-ebb-registers-properly.patch +kvm-ppc-book3s-hv-restore-critical-sprs-to-host-values-on-guest-exit.patch -- 2.47.3