[SRU,Bionic,1/1] KVM: PPC: Book3S HV: Fix guest r11 corruption with POWER9 TM workarounds

Message ID 821db60e1e8f257d895a38afbef316d35cac3f26.1539288024.git.joseph.salisbury@canonical.com
State New
Headers show
Series
  • KVM: PPC: Book3S HV: Fix guest r11 corruption with POWER9 TM workarounds
Related show

Commit Message

Joseph Salisbury Oct. 11, 2018, 8:06 p.m.
From: Michael Neuling <mikey@neuling.org>

BugLink: https://bugs.launchpad.net/bugs/1792501

When we come into the softpatch handler (0x1500), we use r11 to store
the HSRR0 for later use by the denorm handler.

We also use the softpatch handler for the TM workarounds for
POWER9. Unfortunately, in kvmppc_interrupt_hv we later store r11 out
to the vcpu assuming it's still what we got from userspace.

This causes r11 to be corrupted in the VCPU and hence when we restore
the guest, we get a corrupted r11. We've seen this when running TM
tests inside guests on P9.

This fixes the problem by only touching r11 in the denorm case.

Fixes: 4bb3c7a020 ("KVM: PPC: Book3S HV: Work around transactional memory bugs in POWER9")
Cc: <stable@vger.kernel.org> # 4.17+
Test-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
Reviewed-by: Paul Mackerras <paulus@ozlabs.org>
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
(cherry picked from commit f14040bca89258b8a1c71e2112e430462172ce93)
Signed-off-by: Joseph Salisbury <joseph.salisbury@canonical.com>
---
 arch/powerpc/kernel/exceptions-64s.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Stefan Bader Oct. 12, 2018, 8:04 a.m. | #1
On 11.10.2018 22:06, Joseph Salisbury wrote:
> From: Michael Neuling <mikey@neuling.org>
> 
> BugLink: https://bugs.launchpad.net/bugs/1792501
> 
> When we come into the softpatch handler (0x1500), we use r11 to store
> the HSRR0 for later use by the denorm handler.
> 
> We also use the softpatch handler for the TM workarounds for
> POWER9. Unfortunately, in kvmppc_interrupt_hv we later store r11 out
> to the vcpu assuming it's still what we got from userspace.
> 
> This causes r11 to be corrupted in the VCPU and hence when we restore
> the guest, we get a corrupted r11. We've seen this when running TM
> tests inside guests on P9.
> 
> This fixes the problem by only touching r11 in the denorm case.
> 
> Fixes: 4bb3c7a020 ("KVM: PPC: Book3S HV: Work around transactional memory bugs in POWER9")
> Cc: <stable@vger.kernel.org> # 4.17+
> Test-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
> Reviewed-by: Paul Mackerras <paulus@ozlabs.org>
> Signed-off-by: Michael Neuling <mikey@neuling.org>
> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
> (cherry picked from commit f14040bca89258b8a1c71e2112e430462172ce93)
> Signed-off-by: Joseph Salisbury <joseph.salisbury@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
> ---
>  arch/powerpc/kernel/exceptions-64s.S | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
> index 59f5cfa5449b..dcef07a22579 100644
> --- a/arch/powerpc/kernel/exceptions-64s.S
> +++ b/arch/powerpc/kernel/exceptions-64s.S
> @@ -1318,9 +1318,7 @@ EXC_REAL_BEGIN(denorm_exception_hv, 0x1500, 0x100)
>  
>  #ifdef CONFIG_PPC_DENORMALISATION
>  	mfspr	r10,SPRN_HSRR1
> -	mfspr	r11,SPRN_HSRR0		/* save HSRR0 */
>  	andis.	r10,r10,(HSRR1_DENORM)@h /* denorm? */
> -	addi	r11,r11,-4		/* HSRR0 is next instruction */
>  	bne+	denorm_assist
>  #endif
>  
> @@ -1386,6 +1384,8 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
>   */
>  	XVCPSGNDP32(32)
>  denorm_done:
> +	mfspr	r11,SPRN_HSRR0
> +	subi	r11,r11,4
>  	mtspr	SPRN_HSRR0,r11
>  	mtcrf	0x80,r9
>  	ld	r9,PACA_EXGEN+EX_R9(r13)
>

Patch

diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 59f5cfa5449b..dcef07a22579 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -1318,9 +1318,7 @@  EXC_REAL_BEGIN(denorm_exception_hv, 0x1500, 0x100)
 
 #ifdef CONFIG_PPC_DENORMALISATION
 	mfspr	r10,SPRN_HSRR1
-	mfspr	r11,SPRN_HSRR0		/* save HSRR0 */
 	andis.	r10,r10,(HSRR1_DENORM)@h /* denorm? */
-	addi	r11,r11,-4		/* HSRR0 is next instruction */
 	bne+	denorm_assist
 #endif
 
@@ -1386,6 +1384,8 @@  END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
  */
 	XVCPSGNDP32(32)
 denorm_done:
+	mfspr	r11,SPRN_HSRR0
+	subi	r11,r11,4
 	mtspr	SPRN_HSRR0,r11
 	mtcrf	0x80,r9
 	ld	r9,PACA_EXGEN+EX_R9(r13)