powerpc updates for 5.19

- Convert to the generic mmap support (ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT).
 
  - Add support for outline-only KASAN with 64-bit Radix MMU (P9 or later).
 
  - Increase SIGSTKSZ and MINSIGSTKSZ and add support for AT_MINSIGSTKSZ.
 
  - Enable the DAWR (Data Address Watchpoint) on POWER9 DD2.3 or later.
 
  - Drop support for system call instruction emulation.
 
  - Many other small features and fixes.
 
 Thanks to: Alexey Kardashevskiy, Alistair Popple, Andy Shevchenko, Bagas Sanjaya, Bjorn
 Helgaas, Bo Liu, Chen Huang, Christophe Leroy, Colin Ian King, Daniel Axtens, Dwaipayan
 Ray, Fabiano Rosas, Finn Thain, Frank Rowand, Fuqian Huang, Guilherme G. Piccoli, Hangyu
 Hua, Haowen Bai, Haren Myneni, Hari Bathini, He Ying, Jason Wang, Jiapeng Chong, Jing
 Yangyang, Joel Stanley, Julia Lawall, Kajol Jain, Kevin Hao, Krzysztof Kozlowski, Laurent
 Dufour, Lv Ruyi, Madhavan Srinivasan, Magali Lemes, Miaoqian Lin, Minghao Chi, Nathan
 Chancellor, Naveen N. Rao, Nicholas Piggin, Oliver O'Halloran, Oscar Salvador, Pali Rohár,
 Paul Mackerras, Peng Wu, Qing Wang, Randy Dunlap, Reza Arbab, Russell Currey, Sohaib
 Mohamed, Vaibhav Jain, Vasant Hegde, Wang Qing, Wang Wensheng, Xiang wangx, Xiaomeng Tong,
 Xu Wang, Yang Guang, Yang Li, Ye Bin, YueHaibing, Yu Kuai, Zheng Bin, Zou Wei, Zucheng
 Zheng.
 -----BEGIN PGP SIGNATURE-----
 
 iQJHBAABCAAxFiEEJFGtCPCthwEv2Y/bUevqPMjhpYAFAmKSEgETHG1wZUBlbGxl
 cm1hbi5pZC5hdQAKCRBR6+o8yOGlgJpLEACee7mu2I00Z7VWtW5ckT4RFbAXYZcM
 Hv5DbTnVB2ItoQMRHvG52DNbR73j9HnYrz8kpwfTBVk90udxVP14L/swXDs3xbT4
 riXEYtJ1DRVc/bLiOK637RLPWNrmmZStWZme7k0Y9Ki5Aif8i1Erjjq7EIy47m9j
 j1MTcwp3ND7IsBON2nZ3PkttEHhevKvOwCPb/BWtPMDV0OhyQUFKB2SNegrlCrkT
 wshDgdQcYqbIix98PoGa2ZfUVgFQD3JVLzXa4sLpqouzGD+HvEFStOFa2Gq/ZEvV
 zunaeXDdZUCjlib6KvA8+aumBbIQ1s/urrDbxd+3BuYxZ094vNP1B428NT1AWVtl
 3bEZQIN8GSx0v9aHxZ8HePsAMXgG9d2o0xC9EMQ430+cqroN+6UHP7lkekwkprb7
 U9EpZCG9U8jV6SDcaMigW3tooEjn657we0R8nZG2NgUNssdSHVh/JYxGDALPXIAk
 awL3NQrR0tYF3Y3LJm5AxdQrK1hJH8E+hZFCZvIpUXGsr/uf9Gemy/62pD1rhrr/
 niULpxIneRGkJiXB5qdGy8pRu27ED53k7Ky6+8MWSEFQl1mUsHSryYACWz939D8c
 DydhBwQqDTl6Ozs41a5TkVjIRLOCrZADUd/VZM6A4kEOqPJ5t2Gz22Bn8ya1z6Ks
 5Sx6vrGH7GnDjA==
 =15oQ
 -----END PGP SIGNATURE-----

Merge tag 'powerpc-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

Pull powerpc updates from Michael Ellerman:

 - Convert to the generic mmap support (ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT)

 - Add support for outline-only KASAN with 64-bit Radix MMU (P9 or later)

 - Increase SIGSTKSZ and MINSIGSTKSZ and add support for AT_MINSIGSTKSZ

 - Enable the DAWR (Data Address Watchpoint) on POWER9 DD2.3 or later

 - Drop support for system call instruction emulation

 - Many other small features and fixes

Thanks to Alexey Kardashevskiy, Alistair Popple, Andy Shevchenko, Bagas
Sanjaya, Bjorn Helgaas, Bo Liu, Chen Huang, Christophe Leroy, Colin Ian
King, Daniel Axtens, Dwaipayan Ray, Fabiano Rosas, Finn Thain, Frank
Rowand, Fuqian Huang, Guilherme G. Piccoli, Hangyu Hua, Haowen Bai,
Haren Myneni, Hari Bathini, He Ying, Jason Wang, Jiapeng Chong, Jing
Yangyang, Joel Stanley, Julia Lawall, Kajol Jain, Kevin Hao, Krzysztof
Kozlowski, Laurent Dufour, Lv Ruyi, Madhavan Srinivasan, Magali Lemes,
Miaoqian Lin, Minghao Chi, Nathan Chancellor, Naveen N. Rao, Nicholas
Piggin, Oliver O'Halloran, Oscar Salvador, Pali Rohár, Paul Mackerras,
Peng Wu, Qing Wang, Randy Dunlap, Reza Arbab, Russell Currey, Sohaib
Mohamed, Vaibhav Jain, Vasant Hegde, Wang Qing, Wang Wensheng, Xiang
wangx, Xiaomeng Tong, Xu Wang, Yang Guang, Yang Li, Ye Bin, YueHaibing,
Yu Kuai, Zheng Bin, Zou Wei, and Zucheng Zheng.

* tag 'powerpc-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (200 commits)
  powerpc/64: Include cache.h directly in paca.h
  powerpc/64s: Only set HAVE_ARCH_UNMAPPED_AREA when CONFIG_PPC_64S_HASH_MMU is set
  powerpc/xics: Include missing header
  powerpc/powernv/pci: Drop VF MPS fixup
  powerpc/fsl_book3e: Don't set rodata RO too early
  powerpc/microwatt: Add mmu bits to device tree
  powerpc/powernv/flash: Check OPAL flash calls exist before using
  powerpc/powermac: constify device_node in of_irq_parse_oldworld()
  powerpc/powermac: add missing g5_phy_disable_cpu1() declaration
  selftests/powerpc/pmu: fix spelling mistake "mis-match" -> "mismatch"
  powerpc: Enable the DAWR on POWER9 DD2.3 and above
  powerpc/64s: Add CPU_FTRS_POWER10 to ALWAYS mask
  powerpc/64s: Add CPU_FTRS_POWER9_DD2_2 to CPU_FTRS_ALWAYS mask
  powerpc: Fix all occurences of "the the"
  selftests/powerpc/pmu/ebb: remove fixed_instruction.S
  powerpc/platforms/83xx: Use of_device_get_match_data()
  powerpc/eeh: Drop redundant spinlock initialization
  powerpc/iommu: Add missing of_node_put in iommu_init_early_dart
  powerpc/pseries/vas: Call misc_deregister if sysfs init fails
  powerpc/papr_scm: Fix leaking nvdimm_events_map elements
  ...
This commit is contained in:
Linus Torvalds 2022-05-28 11:27:17 -07:00
commit 6112bd00e8
504 changed files with 3407 additions and 4600 deletions

View file

@ -135,6 +135,11 @@ do { \
#define PPC_FEATURE2_ARCH_3_1 0x00040000
#endif
/* POWER10 features */
#ifndef PPC_FEATURE2_MMA
#define PPC_FEATURE2_MMA 0x00020000
#endif
#if defined(__powerpc64__)
#define UCONTEXT_NIA(UC) (UC)->uc_mcontext.gp_regs[PT_NIP]
#define UCONTEXT_MSR(UC) (UC)->uc_mcontext.gp_regs[PT_MSR]

View file

@ -1,5 +1,5 @@
# SPDX-License-Identifier: GPL-2.0
TEST_GEN_PROGS := fpu_syscall fpu_preempt fpu_signal fpu_denormal vmx_syscall vmx_preempt vmx_signal vsx_preempt
TEST_GEN_PROGS := fpu_syscall fpu_preempt fpu_signal fpu_denormal vmx_syscall vmx_preempt vmx_signal vsx_preempt mma
top_srcdir = ../../../../..
include ../../lib.mk
@ -17,3 +17,5 @@ $(OUTPUT)/vmx_signal: vmx_asm.S ../utils.c
$(OUTPUT)/vsx_preempt: CFLAGS += -mvsx
$(OUTPUT)/vsx_preempt: vsx_asm.S ../utils.c
$(OUTPUT)/mma: mma.c mma.S ../utils.c

View file

@ -0,0 +1,33 @@
/* SPDX-License-Identifier: GPL-2.0-or-later
*
* Test basic matrix multiply assist (MMA) functionality if available.
*
* Copyright 2020, Alistair Popple, IBM Corp.
*/
.global test_mma
test_mma:
/* Load accumulator via VSX registers from image passed in r3 */
lxvh8x 4,0,3
lxvh8x 5,0,4
/* Clear and prime the accumulator (xxsetaccz) */
.long 0x7c030162
/* Prime the accumulator with MMA VSX move to accumulator
* X-form (xxmtacc) (not needed due to above zeroing) */
//.long 0x7c010162
/* xvi16ger2s */
.long 0xec042958
/* Store result in image passed in r5 */
stxvw4x 0,0,5
addi 5,5,16
stxvw4x 1,0,5
addi 5,5,16
stxvw4x 2,0,5
addi 5,5,16
stxvw4x 3,0,5
addi 5,5,16
blr

View file

@ -0,0 +1,48 @@
// SPDX-License-Identifier: GPL-2.0-or-later
/*
* Test basic matrix multiply assist (MMA) functionality if available.
*
* Copyright 2020, Alistair Popple, IBM Corp.
*/
#include <stdio.h>
#include <stdint.h>
#include "utils.h"
extern void test_mma(uint16_t (*)[8], uint16_t (*)[8], uint32_t (*)[4*4]);
static int mma(void)
{
int i;
int rc = 0;
uint16_t x[] = {1, 0, 2, 0, 3, 0, 4, 0};
uint16_t y[] = {1, 0, 2, 0, 3, 0, 4, 0};
uint32_t z[4*4];
uint32_t exp[4*4] = {1, 2, 3, 4,
2, 4, 6, 8,
3, 6, 9, 12,
4, 8, 12, 16};
SKIP_IF_MSG(!have_hwcap2(PPC_FEATURE2_ARCH_3_1), "Need ISAv3.1");
SKIP_IF_MSG(!have_hwcap2(PPC_FEATURE2_MMA), "Need MMA");
test_mma(&x, &y, &z);
for (i = 0; i < 16; i++) {
printf("MMA[%d] = %d ", i, z[i]);
if (z[i] == exp[i]) {
printf(" (Correct)\n");
} else {
printf(" (Incorrect)\n");
rc = 1;
}
}
return rc;
}
int main(int argc, char *argv[])
{
return test_harness(mma, "mma");
}

View file

@ -12,3 +12,4 @@ pkey_exec_prot
pkey_siginfo
stack_expansion_ldst
stack_expansion_signal
large_vm_gpr_corruption

View file

@ -4,7 +4,8 @@ noarg:
TEST_GEN_PROGS := hugetlb_vs_thp_test subpage_prot prot_sao segv_errors wild_bctr \
large_vm_fork_separation bad_accesses pkey_exec_prot \
pkey_siginfo stack_expansion_signal stack_expansion_ldst
pkey_siginfo stack_expansion_signal stack_expansion_ldst \
large_vm_gpr_corruption
TEST_PROGS := stress_code_patching.sh
TEST_GEN_PROGS_EXTENDED := tlbie_test
@ -19,6 +20,7 @@ $(OUTPUT)/prot_sao: ../utils.c
$(OUTPUT)/wild_bctr: CFLAGS += -m64
$(OUTPUT)/large_vm_fork_separation: CFLAGS += -m64
$(OUTPUT)/large_vm_gpr_corruption: CFLAGS += -m64
$(OUTPUT)/bad_accesses: CFLAGS += -m64
$(OUTPUT)/pkey_exec_prot: CFLAGS += -m64
$(OUTPUT)/pkey_siginfo: CFLAGS += -m64

View file

@ -0,0 +1,156 @@
// SPDX-License-Identifier: GPL-2.0+
//
// Copyright 2022, Michael Ellerman, IBM Corp.
//
// Test that the 4PB address space SLB handling doesn't corrupt userspace registers
// (r9-r13) due to a SLB fault while saving the PPR.
//
// The bug was introduced in f384796c4 ("powerpc/mm: Add support for handling > 512TB
// address in SLB miss") and fixed in 4c2de74cc869 ("powerpc/64: Interrupts save PPR on
// stack rather than thread_struct").
//
// To hit the bug requires the task struct and kernel stack to be in different segments.
// Usually that requires more than 1TB of RAM, or if that's not practical, boot the kernel
// with "disable_1tb_segments".
//
// The test works by creating mappings above 512TB, to trigger the large address space
// support. It creates 64 mappings, double the size of the SLB, to cause SLB faults on
// each access (assuming naive replacement). It then loops over those mappings touching
// each, and checks that r9-r13 aren't corrupted.
//
// It then forks another child and tries again, because a new child process will get a new
// kernel stack and thread struct allocated, which may be more optimally placed to trigger
// the bug. It would probably be better to leave the previous child processes hanging
// around, so that kernel stack & thread struct allocations are not reused, but that would
// amount to a 30 second fork bomb. The current design reliably triggers the bug on
// unpatched kernels.
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include "utils.h"
#ifndef MAP_FIXED_NOREPLACE
#define MAP_FIXED_NOREPLACE MAP_FIXED // "Should be safe" above 512TB
#endif
#define BASE_ADDRESS (1ul << 50) // 1PB
#define STRIDE (2ul << 40) // 2TB
#define SLB_SIZE 32
#define NR_MAPPINGS (SLB_SIZE * 2)
static volatile sig_atomic_t signaled;
static void signal_handler(int sig)
{
signaled = 1;
}
#define CHECK_REG(_reg) \
if (_reg != _reg##_orig) { \
printf(str(_reg) " corrupted! Expected 0x%lx != 0x%lx\n", _reg##_orig, \
_reg); \
_exit(1); \
}
static int touch_mappings(void)
{
unsigned long r9_orig, r10_orig, r11_orig, r12_orig, r13_orig;
unsigned long r9, r10, r11, r12, r13;
unsigned long addr, *p;
int i;
for (i = 0; i < NR_MAPPINGS; i++) {
addr = BASE_ADDRESS + (i * STRIDE);
p = (unsigned long *)addr;
asm volatile("mr %0, %%r9 ;" // Read original GPR values
"mr %1, %%r10 ;"
"mr %2, %%r11 ;"
"mr %3, %%r12 ;"
"mr %4, %%r13 ;"
"std %10, 0(%11) ;" // Trigger SLB fault
"mr %5, %%r9 ;" // Save possibly corrupted values
"mr %6, %%r10 ;"
"mr %7, %%r11 ;"
"mr %8, %%r12 ;"
"mr %9, %%r13 ;"
"mr %%r9, %0 ;" // Restore original values
"mr %%r10, %1 ;"
"mr %%r11, %2 ;"
"mr %%r12, %3 ;"
"mr %%r13, %4 ;"
: "=&b"(r9_orig), "=&b"(r10_orig), "=&b"(r11_orig),
"=&b"(r12_orig), "=&b"(r13_orig), "=&b"(r9), "=&b"(r10),
"=&b"(r11), "=&b"(r12), "=&b"(r13)
: "b"(i), "b"(p)
: "r9", "r10", "r11", "r12", "r13");
CHECK_REG(r9);
CHECK_REG(r10);
CHECK_REG(r11);
CHECK_REG(r12);
CHECK_REG(r13);
}
return 0;
}
static int test(void)
{
unsigned long page_size, addr, *p;
struct sigaction action;
bool hash_mmu;
int i, status;
pid_t pid;
// This tests a hash MMU specific bug.
FAIL_IF(using_hash_mmu(&hash_mmu));
SKIP_IF(!hash_mmu);
page_size = sysconf(_SC_PAGESIZE);
for (i = 0; i < NR_MAPPINGS; i++) {
addr = BASE_ADDRESS + (i * STRIDE);
p = mmap((void *)addr, page_size, PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED_NOREPLACE, -1, 0);
if (p == MAP_FAILED) {
perror("mmap");
printf("Error: couldn't mmap(), confirm kernel has 4PB support?\n");
return 1;
}
}
action.sa_handler = signal_handler;
action.sa_flags = SA_RESTART;
FAIL_IF(sigaction(SIGALRM, &action, NULL) < 0);
// Seen to always crash in under ~10s on affected kernels.
alarm(30);
while (!signaled) {
// Fork new processes, to increase the chance that we hit the case where
// the kernel stack and task struct are in different segments.
pid = fork();
if (pid == 0)
exit(touch_mappings());
FAIL_IF(waitpid(-1, &status, 0) == -1);
FAIL_IF(WIFSIGNALED(status));
FAIL_IF(!WIFEXITED(status));
FAIL_IF(WEXITSTATUS(status));
}
return 0;
}
int main(void)
{
return test_harness(test, "large_vm_gpr_corruption");
}

View file

@ -1,43 +0,0 @@
/* SPDX-License-Identifier: GPL-2.0-only */
/*
* Copyright 2014, Michael Ellerman, IBM Corp.
*/
#include <ppc-asm.h>
.text
FUNC_START(thirty_two_instruction_loop)
cmpwi r3,0
beqlr
addi r4,r3,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1
addi r4,r4,1 # 28 addi's
subi r3,r3,1
b FUNC_NAME(thirty_two_instruction_loop)
FUNC_END(thirty_two_instruction_loop)

View file

@ -274,7 +274,7 @@ u64 *get_intr_regs(struct event *event, void *sample_buff)
return intr_regs;
}
static const unsigned int __perf_reg_mask(const char *register_name)
static const int __perf_reg_mask(const char *register_name)
{
if (!strcmp(register_name, "R0"))
return 0;

View file

@ -182,17 +182,23 @@ int spectre_v2_test(void)
case COUNT_CACHE_FLUSH_HW:
// These should all not affect userspace branch prediction
if (miss_percent > 15) {
printf("Branch misses > 15%% unexpected in this configuration!\n");
printf("Possible mis-match between reported & actual mitigation\n");
/*
* Such a mismatch may be caused by a guest system
* reporting as vulnerable when the host is mitigated.
* Return skip code to avoid detecting this as an error.
* We are not vulnerable and reporting otherwise, so
* missing such a mismatch is safe.
*/
if (miss_percent > 95)
if (miss_percent > 95) {
/*
* Such a mismatch may be caused by a system being unaware
* the count cache is disabled. This may be to enable
* guest migration between hosts with different settings.
* Return skip code to avoid detecting this as an error.
* We are not vulnerable and reporting otherwise, so
* missing such a mismatch is safe.
*/
printf("Branch misses > 95%% unexpected in this configuration.\n");
printf("Count cache likely disabled without Linux knowing.\n");
if (state == COUNT_CACHE_FLUSH_SW)
printf("WARNING: Kernel performing unnecessary flushes.\n");
return 4;
}
printf("Branch misses > 15%% unexpected in this configuration!\n");
printf("Possible mismatch between reported & actual mitigation\n");
return 1;
}
@ -201,14 +207,14 @@ int spectre_v2_test(void)
// This seems to affect userspace branch prediction a bit?
if (miss_percent > 25) {
printf("Branch misses > 25%% unexpected in this configuration!\n");
printf("Possible mis-match between reported & actual mitigation\n");
printf("Possible mismatch between reported & actual mitigation\n");
return 1;
}
break;
case COUNT_CACHE_DISABLED:
if (miss_percent < 95) {
printf("Branch misses < 20%% unexpected in this configuration!\n");
printf("Possible mis-match between reported & actual mitigation\n");
printf("Branch misses < 95%% unexpected in this configuration!\n");
printf("Possible mismatch between reported & actual mitigation\n");
return 1;
}
break;