linux-toradex.git/arch, branch v4.1.20

KVM: x86: move steal time initialization to vcpu entry time

2016-03-14T16:42:32+00:00

[ Upstream commit 7cae2bedcbd4680b155999655e49c27b9cf020fa ]

As reported at https://bugs.launchpad.net/qemu/+bug/1494350,
it is possible to have vcpu->arch.st.last_steal initialized
from a thread other than vcpu thread, say the iothread, via
KVM_SET_MSRS.

Which can cause an overflow later (when subtracting from vcpu threads
sched_info.run_delay).

To avoid that, move steal time accumulation to vcpu entry time,
before copying steal time data to guest.

Signed-off-by: Marcelo Tosatti 
Reviewed-by: David Matlack 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Sasha Levin

MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp'

2016-03-14T16:42:31+00:00

[ Upstream commit e723e3f7f9591b79e8c56b3d7c5a204a9c571b55 ]

Avoid sending a partially initialised `siginfo_t' structure along SIGFPE
signals issued from `do_ov' and `do_trap_or_bp', leading to information
leaking from the kernel stack.

Signed-off-by: Maciej W. Rozycki 
Cc: stable@vger.kernel.org
Signed-off-by: Ralf Baechle 
Signed-off-by: Sasha Levin

PM / sleep / x86: Fix crash on graph trace through x86 suspend

2016-03-09T18:15:25+00:00

[ Upstream commit 92f9e179a702a6adbc11e2fedc76ecd6ffc9e3f7 ]

Pause/unpause graph tracing around do_suspend_lowlevel as it has
inconsistent call/return info after it jumps to the wakeup vector.
The graph trace buffer will otherwise become misaligned and
may eventually crash and hang on suspend.

To reproduce the issue and test the fix:
Run a function_graph trace over suspend/resume and set the graph
function to suspend_devices_and_enter. This consistently hangs the
system without this fix.

Signed-off-by: Todd Brandt 
Cc: All applicable 
Signed-off-by: Rafael J. Wysocki 
Signed-off-by: Sasha Levin

parisc: Fix ptrace syscall number and return value modification

2016-03-09T18:15:23+00:00

[ Upstream commit 98e8b6c9ac9d1b1e9d1122dfa6783d5d566bb8f7 ]

Mike Frysinger reported that his ptrace testcase showed strange
behaviour on parisc: It was not possible to avoid a syscall and the
return value of a syscall couldn't be changed.

To modify a syscall number, we were missing to save the new syscall
number to gr20 which is then picked up later in assembly again.

The effect that the return value couldn't be changed is a side-effect of
another bug in the assembly code. When a process is ptraced, userspace
expects each syscall to report entrance and exit of a syscall.  If a
syscall number was given which doesn't exist, we jumped to the normal
syscall exit code instead of informing userspace that the (non-existant)
syscall exits. This unexpected behaviour confuses userspace and thus the
bug was misinterpreted as if we can't change the return value.

This patch fixes both problems and was tested on 64bit kernel with
32bit userspace.

Signed-off-by: Helge Deller 
Cc: Mike Frysinger 
Cc: stable@vger.kernel.org  # v4.0+
Tested-by: Mike Frysinger 
Signed-off-by: Sasha Levin

MIPS: kvm: Fix ioctl error handling.

2016-03-09T18:15:18+00:00

[ Upstream commit 887349f69f37e71e2a8bfbd743831625a0b2ff51 ]

Calling return copy_to_user(...) or return copy_from_user in an ioctl
will not do the right thing if there's a pagefault:
copy_to_user/copy_from_user return the number of bytes not copied in
this case.

Fix up kvm on mips to do
	return copy_to_user(...)) ?  -EFAULT : 0;
and
	return copy_from_user(...)) ?  -EFAULT : 0;

everywhere.

Signed-off-by: Michael S. Tsirkin 
Cc: Paolo Bonzini 
Cc: James Hogan 
Cc: linux-kernel@vger.kernel.org
Cc: linux-mips@linux-mips.org
Cc: stable@vger.kernel.org
Cc: kvm@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/12709/
Signed-off-by: Ralf Baechle 
Signed-off-by: Sasha Levin

arm/arm64: KVM: Fix ioctl error handling

2016-03-09T18:15:17+00:00

[ Upstream commit 4cad67fca3fc952d6f2ed9e799621f07666a560f ]

Calling return copy_to_user(...) in an ioctl will not
do the right thing if there's a pagefault:
copy_to_user returns the number of bytes not copied
in this case.

Fix up kvm to do
	return copy_to_user(...)) ?  -EFAULT : 0;

everywhere.

Cc: stable@vger.kernel.org
Acked-by: Christoffer Dall 
Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Marc Zyngier 
Signed-off-by: Sasha Levin

x86/mpx: Fix off-by-one comparison with nr_registers

2016-03-09T18:15:11+00:00

[ Upstream commit 9bf148cb0812595bfdf5100bd2c07e9bec9c6ef5 ]

In the unlikely event that regno == nr_registers then we get an array
overrun on regoff because the invalid register check is currently
off-by-one. Fix this with a check that regno is >= nr_registers instead.

Detected with static analysis using CoverityScan.

Fixes: fcc7ffd67991 "x86, mpx: Decode MPX instruction to get bound violation information"
Signed-off-by: Colin Ian King 
Acked-by: Dave Hansen 
Cc: Borislav Petkov 
Cc: "Kirill A . Shutemov" 
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/1456512931-3388-1-git-send-email-colin.king@canonical.com
Signed-off-by: Thomas Gleixner 
Signed-off-by: Sasha Levin

KVM: x86: fix root cause for missed hardware breakpoints

2016-03-09T18:15:10+00:00

[ Upstream commit 70e4da7a8ff62f2775337b705f45c804bb450454 ]

Commit 172b2386ed16 ("KVM: x86: fix missed hardware breakpoints",
2016-02-10) worked around a case where the debug registers are not loaded
correctly on preemption and on the first entry to KVM_RUN.

However, Xiao Guangrong pointed out that the root cause must be that
KVM_DEBUGREG_BP_ENABLED is not being set correctly.  This can indeed
happen due to the lazy debug exit mechanism, which does not call
kvm_update_dr7.  Fix it by replacing the existing loop (more or less
equivalent to kvm_update_dr0123) with calls to all the kvm_update_dr*
functions.

Cc: stable@vger.kernel.org   # 4.1+
Fixes: 172b2386ed16a9143d9a456aae5ec87275c61489
Reviewed-by: Xiao Guangrong 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Sasha Levin

KVM: x86: MMU: fix ubsan index-out-of-range warning

2016-03-09T18:15:06+00:00

[ Upstream commit 17e4bce0ae63c7e03f3c7fa8d80890e7af3d4971 ]

Ubsan reports the following warning due to a typo in
update_accessed_dirty_bits template, the patch fixes
the typo:

[  168.791851] ================================================================================
[  168.791862] UBSAN: Undefined behaviour in arch/x86/kvm/paging_tmpl.h:252:15
[  168.791866] index 4 is out of range for type 'u64 [4]'
[  168.791871] CPU: 0 PID: 2950 Comm: qemu-system-x86 Tainted: G           O L  4.5.0-rc5-next-20160222 #7
[  168.791873] Hardware name: LENOVO 23205NG/23205NG, BIOS G2ET95WW (2.55 ) 07/09/2013
[  168.791876]  0000000000000000 ffff8801cfcaf208 ffffffff81c9f780 0000000041b58ab3
[  168.791882]  ffffffff82eb2cc1 ffffffff81c9f6b4 ffff8801cfcaf230 ffff8801cfcaf1e0
[  168.791886]  0000000000000004 0000000000000001 0000000000000000 ffffffffa1981600
[  168.791891] Call Trace:
[  168.791899]  [] dump_stack+0xcc/0x12c
[  168.791904]  [] ? _atomic_dec_and_lock+0xc4/0xc4
[  168.791910]  [] ubsan_epilogue+0xd/0x8a
[  168.791914]  [] __ubsan_handle_out_of_bounds+0x15c/0x1a3
[  168.791918]  [] ? __ubsan_handle_shift_out_of_bounds+0x2bd/0x2bd
[  168.791922]  [] ? get_user_pages_fast+0x2bf/0x360
[  168.791954]  [] ? kvm_largepages_enabled+0x30/0x30 [kvm]
[  168.791958]  [] ? __get_user_pages_fast+0x360/0x360
[  168.791987]  [] paging64_walk_addr_generic+0x1b28/0x2600 [kvm]
[  168.792014]  [] ? init_kvm_mmu+0x1100/0x1100 [kvm]
[  168.792019]  [] ? debug_check_no_locks_freed+0x350/0x350
[  168.792044]  [] ? init_kvm_mmu+0x1100/0x1100 [kvm]
[  168.792076]  [] paging64_gva_to_gpa+0x7d/0x110 [kvm]
[  168.792121]  [] ? paging64_walk_addr_generic+0x2600/0x2600 [kvm]
[  168.792130]  [] ? debug_lockdep_rcu_enabled+0x7b/0x90
[  168.792178]  [] emulator_read_write_onepage+0x27a/0x1150 [kvm]
[  168.792208]  [] ? __kvm_read_guest_page+0x54/0x70 [kvm]
[  168.792234]  [] ? kvm_task_switch+0x160/0x160 [kvm]
[  168.792238]  [] ? debug_lockdep_rcu_enabled+0x7b/0x90
[  168.792263]  [] emulator_read_write+0xe7/0x6d0 [kvm]
[  168.792290]  [] ? em_cr_write+0x230/0x230 [kvm]
[  168.792314]  [] emulator_write_emulated+0x15/0x20 [kvm]
[  168.792340]  [] segmented_write+0xf8/0x130 [kvm]
[  168.792367]  [] ? em_lgdt+0x20/0x20 [kvm]
[  168.792374]  [] ? vmx_read_guest_seg_ar+0x42/0x1e0 [kvm_intel]
[  168.792400]  [] writeback+0x3f2/0x700 [kvm]
[  168.792424]  [] ? em_sidt+0xa0/0xa0 [kvm]
[  168.792449]  [] ? x86_decode_insn+0x1b3d/0x4f70 [kvm]
[  168.792474]  [] x86_emulate_insn+0x572/0x3010 [kvm]
[  168.792499]  [] x86_emulate_instruction+0x3bd/0x2110 [kvm]
[  168.792524]  [] ? reexecute_instruction.part.110+0x2e0/0x2e0 [kvm]
[  168.792532]  [] handle_ept_misconfig+0x61/0x460 [kvm_intel]
[  168.792539]  [] ? handle_pause+0x450/0x450 [kvm_intel]
[  168.792546]  [] vmx_handle_exit+0xd6a/0x1ad0 [kvm_intel]
[  168.792572]  [] ? kvm_arch_vcpu_ioctl_run+0xbdc/0x6090 [kvm]
[  168.792597]  [] kvm_arch_vcpu_ioctl_run+0xd3d/0x6090 [kvm]
[  168.792621]  [] ? kvm_arch_vcpu_ioctl_run+0xbdc/0x6090 [kvm]
[  168.792627]  [] ? __ww_mutex_lock_interruptible+0x1630/0x1630
[  168.792651]  [] ? kvm_arch_vcpu_runnable+0x4f0/0x4f0 [kvm]
[  168.792656]  [] ? preempt_notifier_unregister+0x190/0x190
[  168.792681]  [] ? kvm_arch_vcpu_load+0x127/0x650 [kvm]
[  168.792704]  [] kvm_vcpu_ioctl+0x553/0xda0 [kvm]
[  168.792727]  [] ? vcpu_put+0x40/0x40 [kvm]
[  168.792732]  [] ? debug_check_no_locks_freed+0x350/0x350
[  168.792735]  [] ? _raw_spin_unlock+0x27/0x40
[  168.792740]  [] ? handle_mm_fault+0x1673/0x2e40
[  168.792744]  [] ? trace_hardirqs_on_caller+0x478/0x6c0
[  168.792747]  [] ? trace_hardirqs_on+0xd/0x10
[  168.792751]  [] ? debug_lockdep_rcu_enabled+0x7b/0x90
[  168.792756]  [] do_vfs_ioctl+0x1b0/0x12b0
[  168.792759]  [] ? ioctl_preallocate+0x210/0x210
[  168.792763]  [] ? __fget+0x273/0x4a0
[  168.792766]  [] ? __fget+0x50/0x4a0
[  168.792770]  [] ? __fget_light+0x96/0x2b0
[  168.792773]  [] SyS_ioctl+0x79/0x90
[  168.792777]  [] entry_SYSCALL_64_fastpath+0x23/0xc1
[  168.792780] ================================================================================

Signed-off-by: Mike Krinkin 
Reviewed-by: Xiao Guangrong 
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini 
Signed-off-by: Sasha Levin

KVM: x86: fix missed hardware breakpoints

2016-03-07T21:35:09+00:00

[ Upstream commit 172b2386ed16a9143d9a456aae5ec87275c61489 ]

Sometimes when setting a breakpoint a process doesn't stop on it.
This is because the debug registers are not loaded correctly on
VCPU load.

The following simple reproducer from Oleg Nesterov tries using debug
registers in two threads.  To see the bug, run a 2-VCPU guest with
"taskset -c 0" and run "./bp 0 1" inside the guest.

    #include 
    #include 
    #include 
    #include 
    #include 
    #include 
    #include 
    #include 
    #include 

    #define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER)

    unsigned long encode_dr7(int drnum, int enable, unsigned int type, unsigned int len)
    {
        unsigned long dr7;

        dr7 = ((len | type) & 0xf)
            << (DR_CONTROL_SHIFT + drnum * DR_CONTROL_SIZE);
        if (enable)
            dr7 |= (DR_GLOBAL_ENABLE << (drnum * DR_ENABLE_SIZE));

        return dr7;
    }

    int write_dr(int pid, int dr, unsigned long val)
    {
        return ptrace(PTRACE_POKEUSER, pid,
                offsetof (struct user, u_debugreg[dr]),
                val);
    }

    void set_bp(pid_t pid, void *addr)
    {
        unsigned long dr7;
        assert(write_dr(pid, 0, (long)addr) == 0);
        dr7 = encode_dr7(0, 1, DR_RW_EXECUTE, DR_LEN_1);
        assert(write_dr(pid, 7, dr7) == 0);
    }

    void *get_rip(int pid)
    {
        return (void*)ptrace(PTRACE_PEEKUSER, pid,
                offsetof(struct user, regs.rip), 0);
    }

    void test(int nr)
    {
        void *bp_addr = &&label + nr, *bp_hit;
        int pid;

        printf("test bp %d\n", nr);
        assert(nr < 16); // see 16 asm nops below

        pid = fork();
        if (!pid) {
            assert(ptrace(PTRACE_TRACEME, 0,0,0) == 0);
            kill(getpid(), SIGSTOP);
            for (;;) {
                label: asm (
                    "nop; nop; nop; nop;"
                    "nop; nop; nop; nop;"
                    "nop; nop; nop; nop;"
                    "nop; nop; nop; nop;"
                );
            }
        }

        assert(pid == wait(NULL));
        set_bp(pid, bp_addr);

        for (;;) {
            assert(ptrace(PTRACE_CONT, pid, 0, 0) == 0);
            assert(pid == wait(NULL));

            bp_hit = get_rip(pid);
            if (bp_hit != bp_addr)
                fprintf(stderr, "ERR!! hit wrong bp %ld != %d\n",
                    bp_hit - &&label, nr);
        }
    }

    int main(int argc, const char *argv[])
    {
        while (--argc) {
            int nr = atoi(*++argv);
            if (!fork())
                test(nr);
        }

        while (wait(NULL) > 0)
            ;
        return 0;
    }

Cc: stable@vger.kernel.org
Suggested-by: Nadav Amit 
Reported-by: Andrey Wagin 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Sasha Levin