KVM: s390: vsie: Fix length of facility list shadowed

The length of the facility list accessed when interpretively executing
STFLE is the same as the hosts facility list (in case of format-0)
The memory following the facility list doesn't need to be accessible.
The current VSIE implementation accesses a fixed length that exceeds the
guest/host facility list length and can therefore wrongly inject a
validity intercept.
Instead, find out the host facility list length by running STFLE and
copy only as much as necessary when shadowing.

Acked-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Acked-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Link: https://lore.kernel.org/r/20231219140854.1042599-3-nsg@linux.ibm.com
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Message-ID: <20231219140854.1042599-3-nsg@linux.ibm.com>

diff --git a/arch/s390/include/asm/facility.h b/arch/s390/include/asm/facility.h
index 94b6919026dfb8d75d74ca8c9d3aa52f80fc72e1..796007125dff21cbe5c5db0a0eebaf6f0436a4c0 100644 (file)
--- a/arch/s390/include/asm/facility.h
+++ b/arch/s390/include/asm/facility.h
@@ -111,4 +111,10 @@ static inline void stfle(u64 *stfle_fac_list, int size)
        preempt_enable();
 }
 
+/**
+ * stfle_size - Actual size of the facility list as specified by stfle
+ * (number of double words)
+ */
+unsigned int stfle_size(void);
+
 #endif /* __ASM_FACILITY_H */

diff --git a/arch/s390/kernel/Makefile b/arch/s390/kernel/Makefile
index 353def93973b312b0a696d4d6aa36e70b416ebf1..7a562b4199c81b2b2bcb30f4efe0a84e59075a99 100644 (file)
--- a/arch/s390/kernel/Makefile
+++ b/arch/s390/kernel/Makefile
@@ -41,7 +41,7 @@ obj-y += sysinfo.o lgr.o os_info.o ctlreg.o
 obj-y  += runtime_instr.o cache.o fpu.o dumpstack.o guarded_storage.o sthyi.o
 obj-y  += entry.o reipl.o kdebugfs.o alternative.o
 obj-y  += nospec-branch.o ipl_vmparm.o machine_kexec_reloc.o unwind_bc.o
-obj-y  += smp.o text_amode31.o stacktrace.o abs_lowcore.o
+obj-y  += smp.o text_amode31.o stacktrace.o abs_lowcore.o facility.o
 
 extra-y                                += vmlinux.lds
 

diff --git a/arch/s390/kernel/facility.c b/arch/s390/kernel/facility.c
new file mode 100644 (file)
index 0000000..f021272
--- /dev/null
+++ b/arch/s390/kernel/facility.c
@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright IBM Corp. 2023
+ */
+
+#include <asm/facility.h>
+
+unsigned int stfle_size(void)
+{
+       static unsigned int size;
+       unsigned int r;
+       u64 dummy;
+
+       r = READ_ONCE(size);
+       if (!r) {
+               r = __stfle_asm(&dummy, 1) + 1;
+               WRITE_ONCE(size, r);
+       }
+       return r;
+}
+EXPORT_SYMBOL(stfle_size);

diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
index 3cf95bc0401de159c2315f4084157a5baf9ee9ec..aa8f4ab11e33e140e75d71c9c4a3d29624ddbb1e 100644 (file)
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -19,6 +19,7 @@
 #include <asm/nmi.h>
 #include <asm/dis.h>
 #include <asm/fpu/api.h>
+#include <asm/facility.h>
 #include "kvm-s390.h"
 #include "gaccess.h"
 
@@ -990,6 +991,10 @@ static int handle_stfle(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
        struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s;
        __u32 fac = READ_ONCE(vsie_page->scb_o->fac);
 
+       /*
+        * Alternate-STFLE-Interpretive-Execution facilities are not supported
+        * -> format-0 flcb
+        */
        if (fac && test_kvm_facility(vcpu->kvm, 7)) {
                retry_vsie_icpt(vsie_page);
                /*
@@ -997,8 +1002,13 @@ static int handle_stfle(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
                 * so we need to mask here before reading.
                 */
                fac = fac & 0x7ffffff8U;
+               /*
+                * format-0 -> size of nested guest's facility list == guest's size
+                * guest's size == host's size, since STFLE is interpretatively executed
+                * using a format-0 for the guest, too.
+                */
                if (read_guest_real(vcpu, fac, &vsie_page->fac,
-                                   sizeof(vsie_page->fac)))
+                                   stfle_size() * sizeof(u64)))
                        return set_validity_icpt(scb_s, 0x1090U);
                scb_s->fac = (__u32)(__u64) &vsie_page->fac;
        }