• Michael Neuling's avatar
    KVM: PPC: Book3S HV: Fix r3 corruption in h_set_dabr() · fabb2efc
    Michael Neuling authored
    Commit c1fe190c ("powerpc: Add force enable of DAWR on P9 option")
    screwed up some assembler and corrupted a pointer in r3. This resulted
    in crashes like the below:
    
      BUG: Kernel NULL pointer dereference at 0x000013bf
      Faulting instruction address: 0xc00000000010b044
      Oops: Kernel access of bad area, sig: 11 [#1]
      LE PAGE_SIZE=64K MMU=Radix MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
      CPU: 8 PID: 1771 Comm: qemu-system-ppc Kdump: loaded Not tainted 5.2.0-rc4+ #3
      NIP:  c00000000010b044 LR: c0080000089dacf4 CTR: c00000000010aff4
      REGS: c00000179b397710 TRAP: 0300   Not tainted  (5.2.0-rc4+)
      MSR:  800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE>  CR: 42244842  XER: 00000000
      CFAR: c00000000010aff8 DAR: 00000000000013bf DSISR: 42000000 IRQMASK: 0
      GPR00: c0080000089dd6bc c00000179b3979a0 c008000008a04300 ffffffffffffffff
      GPR04: 0000000000000000 0000000000000003 000000002444b05d c0000017f11c45d0
      ...
      NIP kvmppc_h_set_dabr+0x50/0x68
      LR  kvmppc_pseries_do_hcall+0xa3c/0xeb0 [kvm_hv]
      Call Trace:
        0xc0000017f11c0000 (unreliable)
        kvmppc_vcpu_run_hv+0x694/0xec0 [kvm_hv]
        kvmppc_vcpu_run+0x34/0x48 [kvm]
        kvm_arch_vcpu_ioctl_run+0x2f4/0x400 [kvm]
        kvm_vcpu_ioctl+0x460/0x850 [kvm]
        do_vfs_ioctl+0xe4/0xb40
        ksys_ioctl+0xc4/0x110
        sys_ioctl+0x28/0x80
        system_call+0x5c/0x70
      Instruction dump:
      4082fff4 4c00012c 38600000 4e800020 e96280c0 896b0000 2c2b0000 3860ffff
      4d820020 50852e74 508516f6 78840724 <f88313c0> f8a313c8 7c942ba6 7cbc2ba6
    
    Fix the bug by only changing r3 when we are returning immediately.
    
    Fixes: c1fe190c ("powerpc: Add force enable of DAWR on P9 option")
    Signed-off-by: default avatarMichael Neuling <mikey@neuling.org>
    Signed-off-by: default avatarSuraj Jitindar Singh <sjitindarsingh@gmail.com>
    Reported-by: default avatarCédric Le Goater <clg@kaod.org>
    Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
    fabb2efc
book3s_hv_rmhandlers.S 85.4 KB