linux/arch/powerpc/platforms/pseries/hvCall.S

371 lines
6.8 KiB
ArmAsm
Raw Permalink Normal View History

/* SPDX-License-Identifier: GPL-2.0-or-later */
/*
* This file contains the generic code to perform a call to the
* pSeries LPAR hypervisor.
*/
#include <linux/jump_label.h>
#include <asm/hvcall.h>
#include <asm/processor.h>
#include <asm/ppc_asm.h>
#include <asm/asm-offsets.h>
#include <asm/ptrace.h>
#include <asm/feature-fixups.h>
.section ".text"
#ifdef CONFIG_TRACEPOINTS
#ifndef CONFIG_JUMP_LABEL
.data
.globl hcall_tracepoint_refcount
hcall_tracepoint_refcount:
.8byte 0
.section ".text"
#endif
/*
* precall must preserve all registers. use unused STK_PARAM()
* areas to save snapshots and opcode. STK_PARAM() in the caller's
* frame will be available even on ELFv2 because these are all
* variadic functions.
*/
#define HCALL_INST_PRECALL(FIRST_REG) \
mflr r0; \
std r3,STK_PARAM(R3)(r1); \
std r4,STK_PARAM(R4)(r1); \
std r5,STK_PARAM(R5)(r1); \
std r6,STK_PARAM(R6)(r1); \
std r7,STK_PARAM(R7)(r1); \
std r8,STK_PARAM(R8)(r1); \
std r9,STK_PARAM(R9)(r1); \
std r10,STK_PARAM(R10)(r1); \
std r0,16(r1); \
addi r4,r1,STK_PARAM(FIRST_REG); \
stdu r1,-STACK_FRAME_MIN_SIZE(r1); \
bl CFUNC(__trace_hcall_entry); \
ld r3,STACK_FRAME_MIN_SIZE+STK_PARAM(R3)(r1); \
ld r4,STACK_FRAME_MIN_SIZE+STK_PARAM(R4)(r1); \
ld r5,STACK_FRAME_MIN_SIZE+STK_PARAM(R5)(r1); \
ld r6,STACK_FRAME_MIN_SIZE+STK_PARAM(R6)(r1); \
ld r7,STACK_FRAME_MIN_SIZE+STK_PARAM(R7)(r1); \
ld r8,STACK_FRAME_MIN_SIZE+STK_PARAM(R8)(r1); \
ld r9,STACK_FRAME_MIN_SIZE+STK_PARAM(R9)(r1); \
ld r10,STACK_FRAME_MIN_SIZE+STK_PARAM(R10)(r1)
/*
* postcall is performed immediately before function return which
* allows liberal use of volatile registers.
*/
#define __HCALL_INST_POSTCALL \
ld r0,STACK_FRAME_MIN_SIZE+STK_PARAM(R3)(r1); \
std r3,STACK_FRAME_MIN_SIZE+STK_PARAM(R3)(r1); \
mr r4,r3; \
mr r3,r0; \
bl CFUNC(__trace_hcall_exit); \
ld r0,STACK_FRAME_MIN_SIZE+16(r1); \
addi r1,r1,STACK_FRAME_MIN_SIZE; \
ld r3,STK_PARAM(R3)(r1); \
mtlr r0
#define HCALL_INST_POSTCALL_NORETS \
li r5,0; \
__HCALL_INST_POSTCALL
#define HCALL_INST_POSTCALL(BUFREG) \
mr r5,BUFREG; \
__HCALL_INST_POSTCALL
#ifdef CONFIG_JUMP_LABEL
#define HCALL_BRANCH(LABEL) \
ARCH_STATIC_BRANCH(LABEL, hcall_tracepoint_key)
#else
/*
* We branch around this in early init (eg when populating the MMU
* hashtable) by using an unconditional cpu feature.
*/
#define HCALL_BRANCH(LABEL) \
BEGIN_FTR_SECTION; \
b 1f; \
END_FTR_SECTION(0, 1); \
LOAD_REG_ADDR(r12, hcall_tracepoint_refcount) ; \
ld r12,0(r12); \
cmpdi r12,0; \
bne- LABEL; \
1:
#endif
#else
#define HCALL_INST_PRECALL(FIRST_ARG)
#define HCALL_INST_POSTCALL_NORETS
#define HCALL_INST_POSTCALL(BUFREG)
#define HCALL_BRANCH(LABEL)
#endif
_GLOBAL_TOC(plpar_hcall_norets_notrace)
HMT_MEDIUM
mfcr r0
stw r0,8(r1)
HVSC /* invoke the hypervisor */
li r4,0
stb r4,PACASRR_VALID(r13)
lwz r0,8(r1)
mtcrf 0xff,r0
blr /* return r3 = status */
_GLOBAL_TOC(plpar_hcall_norets)
HMT_MEDIUM
mfcr r0
stw r0,8(r1)
HCALL_BRANCH(plpar_hcall_norets_trace)
HVSC /* invoke the hypervisor */
li r4,0
stb r4,PACASRR_VALID(r13)
lwz r0,8(r1)
mtcrf 0xff,r0
blr /* return r3 = status */
#ifdef CONFIG_TRACEPOINTS
plpar_hcall_norets_trace:
HCALL_INST_PRECALL(R4)
HVSC
HCALL_INST_POSTCALL_NORETS
li r4,0
stb r4,PACASRR_VALID(r13)
lwz r0,8(r1)
mtcrf 0xff,r0
blr
#endif
_GLOBAL_TOC(plpar_hcall)
HMT_MEDIUM
mfcr r0
stw r0,8(r1)
HCALL_BRANCH(plpar_hcall_trace)
std r4,STK_PARAM(R4)(r1) /* Save ret buffer */
mr r4,r5
mr r5,r6
mr r6,r7
mr r7,r8
mr r8,r9
mr r9,r10
HVSC /* invoke the hypervisor */
ld r12,STK_PARAM(R4)(r1)
std r4, 0(r12)
std r5, 8(r12)
std r6, 16(r12)
std r7, 24(r12)
li r4,0
stb r4,PACASRR_VALID(r13)
lwz r0,8(r1)
mtcrf 0xff,r0
blr /* return r3 = status */
#ifdef CONFIG_TRACEPOINTS
plpar_hcall_trace:
HCALL_INST_PRECALL(R5)
mr r4,r5
mr r5,r6
mr r6,r7
mr r7,r8
mr r8,r9
mr r9,r10
HVSC
powerpc/pseries: Fix STK_PARAM access in the hcall tracing code In powerpc pseries system, below behaviour is observed while enabling tracing on hcall: # cd /sys/kernel/debug/tracing/ # cat events/powerpc/hcall_exit/enable 0 # echo 1 > events/powerpc/hcall_exit/enable # ls -bash: fork: Bad address Above is from power9 lpar with latest kernel. Past this, softlockup is observed. Initially while attempting via perf_event_open to use "PERF_TYPE_TRACEPOINT", kernel panic was observed. perf config used: ================ memset(&pe[1],0,sizeof(struct perf_event_attr)); pe[1].type=PERF_TYPE_TRACEPOINT; pe[1].size=96; pe[1].config=0x26ULL; /* 38 raw_syscalls/sys_exit */ pe[1].sample_type=0; /* 0 */ pe[1].read_format=PERF_FORMAT_TOTAL_TIME_ENABLED|PERF_FORMAT_TOTAL_TIME_RUNNING|PERF_FORMAT_ID|PERF_FORMAT_GROUP|0x10ULL; /* 1f */ pe[1].inherit=1; pe[1].precise_ip=0; /* arbitrary skid */ pe[1].wakeup_events=0; pe[1].bp_type=HW_BREAKPOINT_EMPTY; pe[1].config1=0x1ULL; Kernel panic logs: ================== Kernel attempted to read user page (8) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000008 Faulting instruction address: 0xc0000000004c2814 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries Modules linked in: nfnetlink bonding tls rfkill sunrpc dm_service_time dm_multipath pseries_rng xts vmx_crypto xfs libcrc32c sd_mod t10_pi crc64_rocksoft crc64 sg ibmvfc scsi_transport_fc ibmveth dm_mirror dm_region_hash dm_log dm_mod fuse CPU: 0 PID: 1431 Comm: login Not tainted 6.4.0+ #1 Hardware name: IBM,8375-42A POWER9 (raw) 0x4e0202 0xf000005 of:IBM,FW950.30 (VL950_892) hv:phyp pSeries NIP page_remove_rmap+0x44/0x320 LR wp_page_copy+0x384/0xec0 Call Trace: 0xc00000001416e400 (unreliable) wp_page_copy+0x384/0xec0 __handle_mm_fault+0x9d4/0xfb0 handle_mm_fault+0xf0/0x350 ___do_page_fault+0x48c/0xc90 hash__do_page_fault+0x30/0x70 do_hash_fault+0x1a4/0x330 data_access_common_virt+0x198/0x1f0 --- interrupt: 300 at 0x7fffae971abc git bisect tracked this down to below commit: 'commit baa49d81a94b ("powerpc/pseries: hvcall stack frame overhead")' This commit changed STACK_FRAME_OVERHEAD (112 ) to STACK_FRAME_MIN_SIZE (32 ) since 32 bytes is the minimum size for ELFv2 stack. With the latest kernel, when running on ELFv2, STACK_FRAME_MIN_SIZE is used to allocate stack size. During plpar_hcall_trace, first call is made to HCALL_INST_PRECALL which saves the registers and allocates new stack frame. In the plpar_hcall_trace code, STK_PARAM is accessed at two places. 1. To save r4: std r4,STK_PARAM(R4)(r1) 2. To access r4 back: ld r12,STK_PARAM(R4)(r1) HCALL_INST_PRECALL precall allocates a new stack frame. So all the stack parameter access after the precall, needs to be accessed with +STACK_FRAME_MIN_SIZE. So the store instruction should be: std r4,STACK_FRAME_MIN_SIZE+STK_PARAM(R4)(r1) If the "std" is not updated with STACK_FRAME_MIN_SIZE, we will end up with overwriting stack contents and cause corruption. But instead of updating 'std', we can instead remove it since HCALL_INST_PRECALL already saves it to the correct location. similarly load instruction should be: ld r12,STACK_FRAME_MIN_SIZE+STK_PARAM(R4)(r1) Fix the load instruction to correctly access the stack parameter with +STACK_FRAME_MIN_SIZE and remove the store of r4 since the precall saves it correctly. Cc: stable@vger.kernel.org # v6.2+ Fixes: baa49d81a94b ("powerpc/pseries: hvcall stack frame overhead") Co-developed-by: Naveen N Rao <naveen@kernel.org> Signed-off-by: Naveen N Rao <naveen@kernel.org> Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://msgid.link/20230929172337.7906-1-atrajeev@linux.vnet.ibm.com
2023-09-29 22:53:36 +05:30
ld r12,STACK_FRAME_MIN_SIZE+STK_PARAM(R4)(r1)
std r4,0(r12)
std r5,8(r12)
std r6,16(r12)
std r7,24(r12)
HCALL_INST_POSTCALL(r12)
li r4,0
stb r4,PACASRR_VALID(r13)
lwz r0,8(r1)
mtcrf 0xff,r0
blr
#endif
/*
* plpar_hcall_raw can be called in real mode. kexec/kdump need some
* hypervisor calls to be executed in real mode. So plpar_hcall_raw
* does not access the per cpu hypervisor call statistics variables,
* since these variables may not be present in the RMO region.
*/
_GLOBAL(plpar_hcall_raw)
HMT_MEDIUM
mfcr r0
stw r0,8(r1)
std r4,STK_PARAM(R4)(r1) /* Save ret buffer */
mr r4,r5
mr r5,r6
mr r6,r7
mr r7,r8
mr r8,r9
mr r9,r10
HVSC /* invoke the hypervisor */
ld r12,STK_PARAM(R4)(r1)
std r4, 0(r12)
std r5, 8(r12)
std r6, 16(r12)
std r7, 24(r12)
li r4,0
stb r4,PACASRR_VALID(r13)
lwz r0,8(r1)
mtcrf 0xff,r0
blr /* return r3 = status */
_GLOBAL_TOC(plpar_hcall9)
HMT_MEDIUM
mfcr r0
stw r0,8(r1)
HCALL_BRANCH(plpar_hcall9_trace)
std r4,STK_PARAM(R4)(r1) /* Save ret buffer */
mr r4,r5
mr r5,r6
mr r6,r7
mr r7,r8
mr r8,r9
mr r9,r10
ld r10,STK_PARAM(R11)(r1) /* put arg7 in R10 */
ld r11,STK_PARAM(R12)(r1) /* put arg8 in R11 */
ld r12,STK_PARAM(R13)(r1) /* put arg9 in R12 */
HVSC /* invoke the hypervisor */
mr r0,r12
ld r12,STK_PARAM(R4)(r1)
std r4, 0(r12)
std r5, 8(r12)
std r6, 16(r12)
std r7, 24(r12)
std r8, 32(r12)
std r9, 40(r12)
std r10,48(r12)
std r11,56(r12)
std r0, 64(r12)
li r4,0
stb r4,PACASRR_VALID(r13)
lwz r0,8(r1)
mtcrf 0xff,r0
blr /* return r3 = status */
#ifdef CONFIG_TRACEPOINTS
plpar_hcall9_trace:
HCALL_INST_PRECALL(R5)
mr r4,r5
mr r5,r6
mr r6,r7
mr r7,r8
mr r8,r9
mr r9,r10
ld r10,STACK_FRAME_MIN_SIZE+STK_PARAM(R11)(r1)
ld r11,STACK_FRAME_MIN_SIZE+STK_PARAM(R12)(r1)
ld r12,STACK_FRAME_MIN_SIZE+STK_PARAM(R13)(r1)
HVSC
mr r0,r12
ld r12,STACK_FRAME_MIN_SIZE+STK_PARAM(R4)(r1)
std r4,0(r12)
std r5,8(r12)
std r6,16(r12)
std r7,24(r12)
std r8,32(r12)
std r9,40(r12)
std r10,48(r12)
std r11,56(r12)
std r0,64(r12)
HCALL_INST_POSTCALL(r12)
li r4,0
stb r4,PACASRR_VALID(r13)
lwz r0,8(r1)
mtcrf 0xff,r0
blr
#endif
/* See plpar_hcall_raw to see why this is needed */
_GLOBAL(plpar_hcall9_raw)
HMT_MEDIUM
mfcr r0
stw r0,8(r1)
std r4,STK_PARAM(R4)(r1) /* Save ret buffer */
mr r4,r5
mr r5,r6
mr r6,r7
mr r7,r8
mr r8,r9
mr r9,r10
ld r10,STK_PARAM(R11)(r1) /* put arg7 in R10 */
ld r11,STK_PARAM(R12)(r1) /* put arg8 in R11 */
ld r12,STK_PARAM(R13)(r1) /* put arg9 in R12 */
HVSC /* invoke the hypervisor */
mr r0,r12
ld r12,STK_PARAM(R4)(r1)
std r4, 0(r12)
std r5, 8(r12)
std r6, 16(r12)
std r7, 24(r12)
std r8, 32(r12)
std r9, 40(r12)
std r10,48(r12)
std r11,56(r12)
std r0, 64(r12)
li r4,0
stb r4,PACASRR_VALID(r13)
lwz r0,8(r1)
mtcrf 0xff,r0
blr /* return r3 = status */