Paul Mackerras d745f0f67b KVM: PPC: Book3S HV: Enable TM before accessing TM registers ... commit e470571514 upstream. Commit 46a704f840 ("KVM: PPC: Book3S HV: Preserve userspace HTM state properly", 2017-06-15) added code to read transactional memory (TM) registers but forgot to enable TM before doing so. The result is that if userspace does have live values in the TM registers, a KVM_RUN ioctl will cause a host kernel crash like this: [ 181.328511] Unrecoverable TM Unavailable Exception f60 at d00000001e7d9980 [ 181.328605] Oops: Unrecoverable TM Unavailable Exception, sig: 6 [#1] [ 181.328613] SMP NR_CPUS=2048 [ 181.328613] NUMA [ 181.328618] PowerNV [ 181.328646] Modules linked in: vhost_net vhost tap nfs_layout_nfsv41_files rpcsec_gss_krb5 nfsv4 dns_resolver nfs +fscache xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat +nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 tun ebtable_filter ebtables +ip6table_filter ip6_tables iptable_filter bridge stp llc kvm_hv kvm nfsd ses enclosure scsi_transport_sas ghash_generic +auth_rpcgss gf128mul xts sg ctr nfs_acl lockd vmx_crypto shpchp ipmi_powernv i2c_opal grace ipmi_devintf i2c_core +powernv_rng sunrpc ipmi_msghandler ibmpowernv uio_pdrv_genirq uio leds_powernv powernv_op_panel ip_tables xfs sd_mod +lpfc ipr bnx2x libata mdio ptp pps_core scsi_transport_fc libcrc32c dm_mirror dm_region_hash dm_log dm_mod [ 181.329278] CPU: 40 PID: 9926 Comm: CPU 0/KVM Not tainted 4.12.0+ #1 [ 181.329337] task: c000003fc6980000 task.stack: c000003fe4d80000 [ 181.329396] NIP: d00000001e7d9980 LR: d00000001e77381c CTR: d00000001e7d98f0 [ 181.329465] REGS: c000003fe4d837e0 TRAP: 0f60 Not tainted (4.12.0+) [ 181.329523] MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE> [ 181.329527] CR: 24022448 XER: 00000000 [ 181.329608] CFAR: d00000001e773818 SOFTE: 1 [ 181.329608] GPR00: d00000001e77381c c000003fe4d83a60 d00000001e7ef410 c000003fdcfe0000 [ 181.329608] GPR04: c000003fe4f00000 0000000000000000 0000000000000000 c000003fd7954800 [ 181.329608] GPR08: 0000000000000001 c000003fc6980000 0000000000000000 d00000001e7e2880 [ 181.329608] GPR12: d00000001e7d98f0 c000000007b19000 00000001295220e0 00007fffc0ce2090 [ 181.329608] GPR16: 0000010011886608 00007fff8c89f260 0000000000000001 00007fff8c080028 [ 181.329608] GPR20: 0000000000000000 00000100118500a6 0000010011850000 0000010011850000 [ 181.329608] GPR24: 00007fffc0ce1b48 0000010011850000 00000000d673b901 0000000000000000 [ 181.329608] GPR28: 0000000000000000 c000003fdcfe0000 c000003fdcfe0000 c000003fe4f00000 [ 181.330199] NIP [d00000001e7d9980] kvmppc_vcpu_run_hv+0x90/0x6b0 [kvm_hv] [ 181.330264] LR [d00000001e77381c] kvmppc_vcpu_run+0x2c/0x40 [kvm] [ 181.330322] Call Trace: [ 181.330351] [c000003fe4d83a60] [d00000001e773478] kvmppc_set_one_reg+0x48/0x340 [kvm] (unreliable) [ 181.330437] [c000003fe4d83b30] [d00000001e77381c] kvmppc_vcpu_run+0x2c/0x40 [kvm] [ 181.330513] [c000003fe4d83b50] [d00000001e7700b4] kvm_arch_vcpu_ioctl_run+0x114/0x2a0 [kvm] [ 181.330586] [c000003fe4d83bd0] [d00000001e7642f8] kvm_vcpu_ioctl+0x598/0x7a0 [kvm] [ 181.330658] [c000003fe4d83d40] [c0000000003451b8] do_vfs_ioctl+0xc8/0x8b0 [ 181.330717] [c000003fe4d83de0] [c000000000345a64] SyS_ioctl+0xc4/0x120 [ 181.330776] [c000003fe4d83e30] [c00000000000b004] system_call+0x58/0x6c [ 181.330833] Instruction dump: [ 181.330869] e92d0260 e9290b50 e9290108 792807e3 41820058 e92d0260 e9290b50 e9290108 [ 181.330941] 792ae8a4 794a1f87 408204f4 e92d0260 <7d4022a6> f9490ff0 e92d0260 7d4122a6 [ 181.331013] ---[ end trace 6f6ddeb4bfe92a92 ]--- The fix is just to turn on the TM bit in the MSR before accessing the registers. Fixes: 46a704f840 ("KVM: PPC: Book3S HV: Preserve userspace HTM state properly") Reported-by: Jan Stancek <jstancek@redhat.com> Tested-by: Jan Stancek <jstancek@redhat.com> Signed-off-by: Paul Mackerras <paulus@ozlabs.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-08-06 18:59:40 -07:00
..
alpha	osf_wait4(): fix infoleak	2017-05-25 15:44:47 +02:00
arc	mm: larger stack guard gap, between vmas	2017-06-24 07:11:18 +02:00
arm	arm: move ELF_ET_DYN_BASE to 4MB	2017-07-21 07:42:21 +02:00
arm64	ARM64: dts: marvell: armada37xx: Fix timer interrupt specifiers	2017-07-21 07:42:22 +02:00
avr32	Merge branch 'akpm' (patches from Andrew)	2016-10-07 21:38:00 -07:00
blackfin	ptrace: Don't allow accessing an undumpable mm	2017-01-06 10:40:13 +01:00
c6x	c6x/ptrace: Remove useless PTRACE_SETREGSET implementation	2017-03-31 10:31:46 +02:00
cris	cris: Only build flash rescue image if CONFIG_ETRAX_AXISFLASHMAP is selected	2017-01-12 11:39:24 +01:00
frv	mm: larger stack guard gap, between vmas	2017-06-24 07:11:18 +02:00
h8300	h8300/ptrace: Fix incorrect register transfer count	2017-03-31 10:31:46 +02:00
hexagon	nmi_backtrace: generate one-line reports for idle cpus	2016-10-07 18:46:30 -07:00
ia64	ptrace: Don't allow accessing an undumpable mm	2017-01-06 10:40:13 +01:00
m32r	mm: replace access_process_vm() write parameter with gup_flags	2016-10-19 08:31:25 -07:00
m68k	m68k: Fix ndelay() macro	2016-10-30 10:13:55 +01:00
metag	metag/uaccess: Check access_ok in strncpy_from_user	2017-05-25 15:44:46 +02:00
microblaze	Merge branch 'work.uaccess2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2016-10-11 23:38:39 -07:00
mips	MIPS: Fix a typo: s/preset/present/ in r2-to-r6 emulation error message	2017-07-27 15:08:05 -07:00
mn10300	mn10300: fix build error of missing fpu_save()	2017-06-17 06:41:56 +02:00
nios2	nios2: reserve boot memory for device tree	2017-04-12 12:41:14 +02:00
openrisc	openrisc: Define __ro_after_init to avoid crash	2016-11-06 08:01:12 -08:00
parisc	parisc: Suspend lockup detectors before system halt	2017-08-06 18:59:40 -07:00
powerpc	KVM: PPC: Book3S HV: Enable TM before accessing TM registers	2017-08-06 18:59:40 -07:00
s390	s390/syscalls: Fix out of bounds arguments access	2017-07-27 15:08:02 -07:00
score	Merge branch 'gup_flag-cleanups'	2016-10-19 08:39:47 -07:00
sh	mm: larger stack guard gap, between vmas	2017-06-24 07:11:18 +02:00
sparc	sparc64: Zero pages on allocation for mondo and error queues.	2017-07-05 14:40:19 +02:00
tile	mm: larger stack guard gap, between vmas	2017-06-24 07:11:18 +02:00
um	um: Fix to call read_initrd after init_bootmem	2017-05-25 15:44:47 +02:00
unicore32	unicore32: use simpler API for random address requests	2016-10-11 15:06:32 -07:00
x86	x86/ioapic: Pass the correct data to unmask_ioapic_irq()	2017-07-27 15:08:04 -07:00
xtensa	mm: larger stack guard gap, between vmas	2017-06-24 07:11:18 +02:00
.gitignore
Kconfig	This adds a new gcc plugin named "latent_entropy". It is designed to	2016-10-15 10:03:15 -07:00