linux-kernel - Re: [PATCH] KVM: PPC: Book3S PR: Enable MSR_DR for switch_mmu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <5CBF19EB-F2DA-4DBA-9BD0-D38E3A3F959A@ozlabs.org>
Date:   Tue, 10 May 2022 11:33:45 +0100
From:   Matt Evans <matt@...abs.org>
To:     Alexander Graf <graf@...zon.com>
Cc:     kvm@...r.kernel.org, linuxppc-dev@...ts.ozlabs.org,
        linux-kernel@...r.kernel.org,
        Christophe Leroy <christophe.leroy@...roup.eu>,
        Paul Mackerras <paulus@...ba.org>,
        Ben Herrenschmitt <benh@...nel.crashing.org>,
        Michael Ellerman <mpe@...erman.id.au>, stable@...r.kernel.org
Subject: Re: [PATCH] KVM: PPC: Book3S PR: Enable MSR_DR for
 switch_mmu_context()

Hi Alex,

> On 9 May 2022, at 21:23, Alexander Graf <graf@...zon.com> wrote:
> 
> Commit 863771a28e27 ("powerpc/32s: Convert switch_mmu_context() to C")
> moved the switch_mmu_context() to C. While in principle a good idea, it
> meant that the function now uses the stack. The stack is not accessible
> from real mode though.
> 
> So to keep calling the function, let's turn on MSR_DR while we call it.
> That way, all pointer references to the stack are handled virtually.
> 
> Reported-by: Matt Evans <matt@...abs.org>
> Fixes: 863771a28e27 ("powerpc/32s: Convert switch_mmu_context() to C")
> Signed-off-by: Alexander Graf <graf@...zon.com>
> Cc: stable@...r.kernel.org

Many thanks - this addresses the issue I saw, and has been...

Tested-by: Matt Evans <matt@...abs.org>

...on a G4 host.  One comment though:

> —
> arch/powerpc/kvm/book3s_32_sr.S | 20 +++++++++++++++-----
> 1 file changed, 15 insertions(+), 5 deletions(-)
> 
> diff --git a/arch/powerpc/kvm/book3s_32_sr.S b/arch/powerpc/kvm/book3s_32_sr.S
> index e3ab9df6cf19..bd4f798f7a46 100644
> --- a/arch/powerpc/kvm/book3s_32_sr.S
> +++ b/arch/powerpc/kvm/book3s_32_sr.S
> @@ -122,11 +122,21 @@
> 
> 	/* 0x0 - 0xb */
> 
> -	/* 'current->mm' needs to be in r4 */
> -	tophys(r4, r2)
> -	lwz	r4, MM(r4)
> -	tophys(r4, r4)
> -	/* This only clobbers r0, r3, r4 and r5 */
> +	/* switch_mmu_context() needs paging, let's enable it */
> +	mfmsr   r9
> +	ori     r11, r9, MSR_DR
> +	mtmsr   r11
> +	sync
> +
> +	/* Calling switch_mmu_context(<inv>, current->mm, <inv>); */
> +	lwz	r4, MM(r2)
> 	bl	switch_mmu_context

Of the volatile registers, I believe r12 is still valuable here and would need to be preserved.
(I can’t spot any others but would defer to your judgement here.)

For example:

diff --git a/arch/powerpc/kvm/book3s_32_sr.S b/arch/powerpc/kvm/book3s_32_sr.S
index e3ab9df6cf19..41fc9ca12d38 100644
--- a/arch/powerpc/kvm/book3s_32_sr.S
+++ b/arch/powerpc/kvm/book3s_32_sr.S
@@ -122,11 +122,23 @@
 
 	/* 0x0 - 0xb */
 
-	/* 'current->mm' needs to be in r4 */
-	tophys(r4, r2)
-	lwz	r4, MM(r4)
-	tophys(r4, r4)
-	/* This only clobbers r0, r3, r4 and r5 */
+	/* switch_mmu_context() needs paging, let's enable it */
+	mfmsr   r9
+	ori     r11, r9, MSR_DR
+	mtmsr   r11
+	sync
+
+	SAVE_GPR(12, r1)
+	/* Calling switch_mmu_context(<inv>, current->mm, <inv>); */
+	lwz	r4, MM(r2)
 	bl	switch_mmu_context
+	REST_GPR(12, r1)
+
+	/* Disable paging again */
+	mfmsr   r9
+	li      r6, MSR_DR
+	andc    r9, r9, r6
+	mtmsr	r9
+	sync
 
 .endm


Matt

> 
> +	/* Disable paging again */
> +	mfmsr   r9
> +	li      r6, MSR_DR
> +	andc    r9, r9, r6
> +	mtmsr	r9
> +	sync
> +
> .endm
> -- 
> 2.28.0.394.ge197136389
> 
> 
> 
> 
> Amazon Development Center Germany GmbH
> Krausenstr. 38
> 10117 Berlin
> Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss
> Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B
> Sitz: Berlin
> Ust-ID: DE 289 237 879
> 
> 
>