[stable:PATCH] KVM: arm64: Reset PMC_EL0 to avoid a panic() on systems with no PMU

[stable:PATCH] KVM: arm64: Reset PMC_EL0 to avoid a panic() on systems with no PMU

[James Morse]

The logic in commit 2a5f1b67ec57 "KVM: arm64: Don't access PMCR_EL0 when no
PMU is available" relies on an empty reset handler being benign.  This was
not the case in earlier kernel versions, so the stable backport of this
patch is causing problems.

KVMs behaviour in this area changed over time. In particular, prior to commit
03fdfb269009 ("KVM: arm64: Don't write junk to sysregs on reset"), an empty
reset handler will trigger a warning, as the guest registers have been
poisoned.
Prior to commit 20589c8cc47d ("arm/arm64: KVM: Don't panic on failure to
properly reset system registers"), this warning was a panic().

Instead of reverting the backport, make it write 0 to the sys_reg[] array.
This keeps the reset logic happy, and the dodgy value can't be seen by
the guest as it can't request the emulation.

The original bug was accessing the PMCR_EL0 register on CPUs that don't
implement that feature. There is no known silicon that does this, but
v4.9's ACPI support is unable to find the PMU, so triggers this code:

| Kernel panic - not syncing: Didn't reset vcpu_sys_reg(24)
| CPU: 1 PID: 3055 Comm: lkvm Not tainted 4.9.302-00032-g64e078a56789 #13476
| Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Jul 30 2018
| Call trace:
| [<ffff00000808b4b0>] dump_backtrace+0x0/0x1a0
| [<ffff00000808b664>] show_stack+0x14/0x20
| [<ffff0000088f0e18>] dump_stack+0x98/0xb8
| [<ffff0000088eef08>] panic+0x118/0x274
| [<ffff0000080b50e0>] access_actlr+0x0/0x20
| [<ffff0000080b2620>] kvm_reset_vcpu+0x5c/0xac
| [<ffff0000080ac688>] kvm_arch_vcpu_ioctl+0x3e4/0x490
| [<ffff0000080a382c>] kvm_vcpu_ioctl+0x5b8/0x720
| [<ffff000008201e44>] do_vfs_ioctl+0x2f4/0x884
| [<ffff00000820244c>] SyS_ioctl+0x78/0x9c
| [<ffff000008083a9c>] __sys_trace_return+0x0/0x4

Cc: <stable@vger.kernel.org> # < v5.3 with 2a5f1b67ec57 backported
Signed-off-by: James Morse <james.morse@arm.com>
---
 arch/arm64/kvm/sys_regs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 10d80456f38f..8d548fdbb6b2 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -451,8 +451,10 @@ static void reset_pmcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
 	u64 pmcr, val;
 
 	/* No PMU available, PMCR_EL0 may UNDEF... */
-	if (!kvm_arm_support_pmu_v3())
+	if (!kvm_arm_support_pmu_v3()) {
+		vcpu_sys_reg(vcpu, PMCR_EL0) = 0;
 		return;
+	}
 
 	pmcr = read_sysreg(pmcr_el0);
 	/*
-- 
2.30.2

Re: [stable:PATCH] KVM: arm64: Reset PMC_EL0 to avoid a panic() on systems with no PMU

[Greg KH]

On Tue, Mar 08, 2022 at 04:29:39PM +0000, James Morse wrote:
> The logic in commit 2a5f1b67ec57 "KVM: arm64: Don't access PMCR_EL0 when no
> PMU is available" relies on an empty reset handler being benign.  This was
> not the case in earlier kernel versions, so the stable backport of this
> patch is causing problems.
> 
> KVMs behaviour in this area changed over time. In particular, prior to commit
> 03fdfb269009 ("KVM: arm64: Don't write junk to sysregs on reset"), an empty
> reset handler will trigger a warning, as the guest registers have been
> poisoned.
> Prior to commit 20589c8cc47d ("arm/arm64: KVM: Don't panic on failure to
> properly reset system registers"), this warning was a panic().
> 
> Instead of reverting the backport, make it write 0 to the sys_reg[] array.
> This keeps the reset logic happy, and the dodgy value can't be seen by
> the guest as it can't request the emulation.
> 
> The original bug was accessing the PMCR_EL0 register on CPUs that don't
> implement that feature. There is no known silicon that does this, but
> v4.9's ACPI support is unable to find the PMU, so triggers this code:
> 
> | Kernel panic - not syncing: Didn't reset vcpu_sys_reg(24)
> | CPU: 1 PID: 3055 Comm: lkvm Not tainted 4.9.302-00032-g64e078a56789 #13476
> | Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Jul 30 2018
> | Call trace:
> | [<ffff00000808b4b0>] dump_backtrace+0x0/0x1a0
> | [<ffff00000808b664>] show_stack+0x14/0x20
> | [<ffff0000088f0e18>] dump_stack+0x98/0xb8
> | [<ffff0000088eef08>] panic+0x118/0x274
> | [<ffff0000080b50e0>] access_actlr+0x0/0x20
> | [<ffff0000080b2620>] kvm_reset_vcpu+0x5c/0xac
> | [<ffff0000080ac688>] kvm_arch_vcpu_ioctl+0x3e4/0x490
> | [<ffff0000080a382c>] kvm_vcpu_ioctl+0x5b8/0x720
> | [<ffff000008201e44>] do_vfs_ioctl+0x2f4/0x884
> | [<ffff00000820244c>] SyS_ioctl+0x78/0x9c
> | [<ffff000008083a9c>] __sys_trace_return+0x0/0x4
> 
> Cc: <stable@vger.kernel.org> # < v5.3 with 2a5f1b67ec57 backported
> Signed-off-by: James Morse <james.morse@arm.com>
> ---
>  arch/arm64/kvm/sys_regs.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

Now queued up for 4.9, 4.14, and 4.19 kernels, thanks!

greg k-h