Re: [PATCH AUTOSEL for 4.9 005/219] kretprobes: Ensure probe location is at function entry

[Naveen N. Rao]

Hi Sasha,

Sasha Levin wrote:

From: "Naveen N. Rao" 

[ Upstream commit 90ec5e89e393c76e19afc845d8f88a5dc8315919 ]



Sorry if this is obvious, but why was this patch picked up for -stable?  
I don't see the upstream commit tagging -stable, so curious why this was 
done.


I don't think this patch should be pushed to -stable since this is not 
really a bug fix. There are also other dependencies for this change (see 
commit a64e3f35a45f4a, for instance), including how userspace (perf) 
builds out the retprobe argument. As such, please drop this from -stable 
(for 3.18. 4.4 and 4.9).


Thanks,
Naveen

Re: [PATCH 1/2] powerpc/perf: Fix kernel address leak to userspace via BHRB buffer

[Balbir Singh]

On Sun, Mar 4, 2018 at 10:55 PM, Madhavan Srinivasan
 wrote:
> The current Branch History Rolling Buffer (BHRB) code does
> not check for any privilege levels before updating the data
> from BHRB. This leaks kernel addresses to userspace even when
> profiling only with userspace privileges. Add proper checks
> to prevent it.
>
> Signed-off-by: Madhavan Srinivasan 
> ---
>  arch/powerpc/perf/core-book3s.c | 4 
>  1 file changed, 4 insertions(+)
>
> diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
> index f89bbd54ecec..337db5831749 100644
> --- a/arch/powerpc/perf/core-book3s.c
> +++ b/arch/powerpc/perf/core-book3s.c
> @@ -457,6 +457,10 @@ static void power_pmu_bhrb_read(struct cpu_hw_events 
> *cpuhw)
> /* invalid entry */
> continue;
>
> +   if (perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN) 
> &&
> +   is_kernel_addr(addr))
> +   continue;
> +


Looks good to me. The scope of the leaks concern is KASLR related or
something else (figuring out what's in the cache?)

Acked-by: Balbir Singh 

Balbir Singh.

[PATCH V2 15/27] cpufreq: powernv: Don't validate the frequency table twice

[Viresh Kumar]

The cpufreq core is already validating the CPU frequency table after
calling the ->init() callback of the cpufreq drivers and the drivers
don't need to do the same anymore. Though they need to set the
policy->freq_table field directly from the ->init() callback now.

Stop validating the frequency table from powernv driver.

Signed-off-by: Viresh Kumar 
---
V1->V2:
- s/powerenv/powernv/

 drivers/cpufreq/powernv-cpufreq.c | 11 +++
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/drivers/cpufreq/powernv-cpufreq.c 
b/drivers/cpufreq/powernv-cpufreq.c
index 29cdec198657..0591874856d3 100644
--- a/drivers/cpufreq/powernv-cpufreq.c
+++ b/drivers/cpufreq/powernv-cpufreq.c
@@ -812,7 +812,7 @@ static int powernv_cpufreq_target_index(struct 
cpufreq_policy *policy,
 
 static int powernv_cpufreq_cpu_init(struct cpufreq_policy *policy)
 {
-   int base, i, ret;
+   int base, i;
struct kernfs_node *kn;
struct global_pstate_info *gpstates;
 
@@ -848,15 +848,10 @@ static int powernv_cpufreq_cpu_init(struct cpufreq_policy 
*policy)
gpstates->timer.expires = jiffies +
msecs_to_jiffies(GPSTATE_TIMER_INTERVAL);
spin_lock_init(>gpstate_lock);
-   ret = cpufreq_table_validate_and_show(policy, powernv_freqs);
-
-   if (ret < 0) {
-   kfree(policy->driver_data);
-   return ret;
-   }
 
+   policy->freq_table = powernv_freqs;
policy->fast_switch_possible = true;
-   return ret;
+   return 0;
 }
 
 static int powernv_cpufreq_cpu_exit(struct cpufreq_policy *policy)
-- 
2.15.0.194.g9af6a3dea062

Re: [PATCH 3/3] powerpc/64s/idle: POWER9 ESL=0 stop avoid save/restore overhead

[Paul Mackerras]

On Thu, Mar 01, 2018 at 09:57:34PM +1000, Nicholas Piggin wrote:
> On Thu, 1 Mar 2018 00:04:39 +0530
> Vaidyanathan Srinivasan  wrote:
> 
> > * Nicholas Piggin  [2017-11-18 00:08:07]:
[snip]
> > > diff --git a/arch/powerpc/platforms/powernv/idle.c 
> > > b/arch/powerpc/platforms/powernv/idle.c
> > > index a921d5428d76..610b1637c16f 100644
> > > --- a/arch/powerpc/platforms/powernv/idle.c
> > > +++ b/arch/powerpc/platforms/powernv/idle.c
> > > @@ -621,7 +621,12 @@ static int __init pnv_power9_idle_init(struct 
> > > device_node *np, u32 *flags,
> > >   continue;
> > >   }
> > > 
> > > - if (max_residency_ns < residency_ns[i]) {
> > > + /*
> > > +  * Deepest stop for unplug must be PSSCR[EC]=1 (wakeup at
> > > +  * 0x100.
> > > +  */
> > > + if ((max_residency_ns < residency_ns[i])&&
> > > + (psscr_val[i] & PSSCR_EC)) {
> > >   max_residency_ns = residency_ns[i];
> > >   pnv_deepest_stop_psscr_val = psscr_val[i];
> > >   pnv_deepest_stop_psscr_mask = psscr_mask[i];  
> > 
> > If firmware did not provide any ESL=EC=1 state, we can still leave
> > threads in stop ESL=0 state.  This is just a corner case or random
> > test scenario.  Why do we want to enforce that offline cpus really use
> > a ESL=0 state or just spin? 
> 
> It's because power9_offline_stop only has cases for EC=ESL=1
> states now.
> 
> It actually looks like EC=ESL=0 unplug today is broken KVM, because
> the wakeup side does not check HWTHREAD_REQ, and yet they do set
> HWTHREAD_IN_IDLE. That would probably hang in KVM if we run with
> dependent threads, wouldn't it?

Right.  KVM with indep_threads_mode=N is broken at the moment if you
run with powersave=off or if firmware provides no stop states with
EC=ESL=1.  I'm not sure what's the best way to fix that.

> I think banning it for now should be okay.

Banning what exactly?

Paul.

Re: [PATCH] KVM: PPC: Book3S HV: Fix guest time accounting with VIRT_CPU_ACCOUNTING_GEN

[Paul Mackerras]

On Fri, Mar 02, 2018 at 11:51:56AM +0100, Laurent Vivier wrote:
> Since commit 8b24e69fc47e ("KVM: PPC: Book3S HV: Close race with testing
> for signals on guest entry"), if CONFIG_VIRT_CPU_ACCOUNTING_GEN is set, the
> guest time is not accounted to guest time and user time, but instead to
> system time.
> 
> This is because guest_enter()/guest_exit() are called while interrupts
> are disabled and the tick counter cannot be updated between them.
> 
> To fix that, move guest_exit() after local_irq_enable(), and as
> guest_enter() is called with IRQ disabled, calls guest_enter_irqoff()
> instead.
> 
> Fixes: 8b24e69fc47e
> ("KVM: PPC: Book3S HV: Close race with testing for signals on guest entry")
> Signed-off-by: Laurent Vivier 

Thanks, applied to my kvm-ppc-fixes branch.

Paul.

Re: [PATCH v2] xmon: Setup xmon debugger hooks when first break-point is set

[Balbir Singh]

On Mon, Mar 5, 2018 at 4:30 AM, Vaibhav Jain  wrote:
> Presently sysrq key for xmon('x') is registered during kernel init
> irrespective of the value of kernel param 'xmon'. Thus xmon is enabled
> even if 'xmon=off' is passed on the kernel command line. However this
> doesn't enable the kernel debugger hooks needed for instruction or data
> breakpoints. Thus when a break-point is hit with xmon=off a kernel oops
> of the form below is reported:
>
> Oops: Exception in kernel mode, sig: 5 [#1]
> < snip >
> Trace/breakpoint trap
>
> To fix this the patch checks and enables debugger hooks when an
> instruction or data break-point is set via xmon console.
>
> Signed-off-by: Vaibhav Jain 
> ---
Reviewed-by: Balbir Singh 

Re: [PATCH] xmon: Clear all breakpoints when xmon is disabled via debugfs

[Balbir Singh]

On Mon, Mar 5, 2018 at 4:31 AM, Vaibhav Jain  wrote:
> Presently when xmon is disabled by debugfs any existing
> instruction/data-access breakpoints set are not disabled. This may
> lead to kernel oops when those breakpoints are hit as the necessary
> debugger hooks aren't installed.
>
> Hence this patch introduces a new function named clear_all_bpt()
> which is called when xmon is disabled via debugfs. The function will
> unpatch/clear all the trap and ciabr/dab based breakpoints.
>
> Signed-off-by: Vaibhav Jain 
> ---

Reviewed-by: Balbir Singh 

Balbir

Re: [PATCH v3 02/10] include: Move compat_timespec/ timeval to compat_time.h

[Helge Deller]

On 16.01.2018 03:18, Deepa Dinamani wrote:
> All the current architecture specific defines for these
> are the same. Refactor these common defines to a common
> header file.
> 
> The new common linux/compat_time.h is also useful as it
> will eventually be used to hold all the defines that
> are needed for compat time types that support non y2038
> safe types. New architectures need not have to define these
> new types as they will only use new y2038 safe syscalls.
> This file can be deleted after y2038 when we stop supporting
> non y2038 safe syscalls.

For parisc:

Acked-by: Helge Deller  # parisc

Re: [PATCH 05/21] powerpc: Avoid comparison of unsigned long >= 0 in pfn_valid

[christophe leroy]

Le 04/03/2018 à 11:55, Michael Ellerman a écrit :

Mathieu Malaterre  writes:


Rewrite comparison since all values compared are of type `unsigned long`.

Fix a warning (treated as error in W=1):

   CC  arch/powerpc/kernel/irq.o
In file included from ./include/linux/bug.h:5:0,
  from ./include/linux/cpumask.h:13,
  from ./include/linux/smp.h:13,
  from ./include/linux/kernel_stat.h:5,
  from arch/powerpc/kernel/irq.c:35:
./include/linux/dma-mapping.h: In function ‘dma_map_resource’:
./arch/powerpc/include/asm/page.h:129:32: error: comparison of unsigned expression 
>= 0 is always true [-Werror=type-limits]
  #define pfn_valid(pfn)  ((pfn) >= ARCH_PFN_OFFSET && (pfn) < max_mapnr)
 ^
Suggested-by: Segher Boessenkool 
Signed-off-by: Mathieu Malaterre 
---
  arch/powerpc/include/asm/page.h | 3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
index 8da5d4c1cab2..19dea64e7ed2 100644
--- a/arch/powerpc/include/asm/page.h
+++ b/arch/powerpc/include/asm/page.h
@@ -126,7 +126,8 @@ extern long long virt_phys_offset;
  
  #ifdef CONFIG_FLATMEM

  #define ARCH_PFN_OFFSET   ((unsigned long)(MEMORY_START >> 
PAGE_SHIFT))
-#define pfn_valid(pfn) ((pfn) >= ARCH_PFN_OFFSET && (pfn) < max_mapnr)
+#define pfn_valid(pfn) \
+   (((pfn) - ARCH_PFN_OFFSET) < (max_mapnr - ARCH_PFN_OFFSET))


I'm not a big fan of this one, because the original code is *far* more
obvious as to what it's doing.

I'm not sure if we can make this one a static inline, or whether that
would help, but it would be worth investigating.



The following seems to give a good result:

diff --git a/arch/powerpc/include/asm/page.h 
b/arch/powerpc/include/asm/page.h

index 8da5d4c1cab2..6f74938483b7 100644
--- a/arch/powerpc/include/asm/page.h
+++ b/arch/powerpc/include/asm/page.h
@@ -126,7 +126,15 @@ extern long long virt_phys_offset;

 #ifdef CONFIG_FLATMEM
 #define ARCH_PFN_OFFSET((unsigned long)(MEMORY_START >> 
PAGE_SHIFT))
-#define pfn_valid(pfn) ((pfn) >= ARCH_PFN_OFFSET && (pfn) < max_mapnr)
+#ifndef __ASSEMBLY__
+extern unsigned long max_mapnr;
+static inline bool pfn_valid(unsigned long pfn)
+{
+   unsigned long min_pfn = ARCH_PFN_OFFSET;
+
+   return pfn >= min_pfn && pfn < max_mapnr;
+}
+#endif
 #endif

 #define virt_to_pfn(kaddr) (__pa(kaddr) >> PAGE_SHIFT)


Christophe

---
L'absence de virus dans ce courrier électronique a été vérifiée par le logiciel 
antivirus Avast.
https://www.avast.com/antivirus

[PATCH] xmon: Clear all breakpoints when xmon is disabled via debugfs

[Vaibhav Jain]

Presently when xmon is disabled by debugfs any existing
instruction/data-access breakpoints set are not disabled. This may
lead to kernel oops when those breakpoints are hit as the necessary
debugger hooks aren't installed.

Hence this patch introduces a new function named clear_all_bpt()
which is called when xmon is disabled via debugfs. The function will
unpatch/clear all the trap and ciabr/dab based breakpoints.

Signed-off-by: Vaibhav Jain 
---
 arch/powerpc/xmon/xmon.c | 24 
 1 file changed, 24 insertions(+)

diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index e9c7ec8f15f8..f43aacd74625 100644
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -903,6 +903,27 @@ static void remove_bpts(void)
}
 }
 
+static void clear_all_bpt(void)
+{
+   int i;
+
+   /* clear/unpatch all breakpoints */
+   remove_bpts();
+   remove_cpu_bpts();
+
+   /* Disable all breakpoints */
+   for (i = 0; i < NBPTS; ++i)
+   bpts[i].enabled = 0;
+
+   /* Clear any data or iabr breakpoints */
+   if (iabr || dabr.enabled) {
+   iabr = NULL;
+   dabr.enabled = 0;
+   }
+
+   printf("xmon: All breakpoints cleared\n");
+}
+
 static void remove_cpu_bpts(void)
 {
hw_breakpoint_disable();
@@ -3671,6 +3692,9 @@ static int xmon_dbgfs_set(void *data, u64 val)
xmon_on = !!val;
xmon_init(xmon_on);
 
+   /* make sure all breakpoints removed when disabling */
+   if (!xmon_on)
+   clear_all_bpt();
return 0;
 }
 
-- 
2.14.3

[PATCH v2] xmon: Setup xmon debugger hooks when first break-point is set

[Vaibhav Jain]

Presently sysrq key for xmon('x') is registered during kernel init
irrespective of the value of kernel param 'xmon'. Thus xmon is enabled
even if 'xmon=off' is passed on the kernel command line. However this
doesn't enable the kernel debugger hooks needed for instruction or data
breakpoints. Thus when a break-point is hit with xmon=off a kernel oops
of the form below is reported:

Oops: Exception in kernel mode, sig: 5 [#1]
< snip >
Trace/breakpoint trap

To fix this the patch checks and enables debugger hooks when an
instruction or data break-point is set via xmon console.

Signed-off-by: Vaibhav Jain 
---
Change-log:

v2 -> Moved the code that was force enabling xmon to a separate inline
  function (Balbir)

  The change related to clearing all breakpoints when xmon is
  disabled via debugfs will be respinned as a separate
  patch. (Mpe)
---
 arch/powerpc/xmon/xmon.c | 19 ++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index 82e1a3ee6e0f..e9c7ec8f15f8 100644
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -1273,6 +1273,18 @@ static long check_bp_loc(unsigned long addr)
return 1;
 }
 
+/* Force enable xmon if not already enabled */
+static inline void force_enable_xmon(void)
+{
+   static const char warnxmon[] = "xmon: Enabling debugger hooks\n";
+
+   /* Enable xmon hooks if needed */
+   if (!xmon_on) {
+   printf(warnxmon);
+   xmon_on = 1;
+   }
+}
+
 static char *breakpoint_help_string =
 "Breakpoint command usage:\n"
 "bshow breakpoints\n"
@@ -1315,6 +1327,8 @@ bpt_cmds(void)
dabr.address &= ~HW_BRK_TYPE_DABR;
dabr.enabled = mode | BP_DABR;
}
+
+   force_enable_xmon();
break;
 
case 'i':   /* bi - hardware instr breakpoint */
@@ -1335,6 +1349,7 @@ bpt_cmds(void)
if (bp != NULL) {
bp->enabled |= BP_CIABR;
iabr = bp;
+   force_enable_xmon();
}
break;
 #endif
@@ -1399,8 +1414,10 @@ bpt_cmds(void)
if (!check_bp_loc(a))
break;
bp = new_breakpoint(a);
-   if (bp != NULL)
+   if (bp != NULL) {
bp->enabled |= BP_TRAP;
+   force_enable_xmon();
+   }
break;
}
 }
-- 
2.14.3

[PATCH] powerpc/perf: Fix kernel address leaks via Sampling registers

[Madhavan Srinivasan]

From: Michael Ellerman 

Current code in power_pmu_disable() does not clear the sampling
registers like Sampling Instruction Address Register (SAIR) and
Sampling Data Address Register (SDAR) after disabling the PMU.
Since these are userspace readable and could contain kernel
address, add code to explicitly clear the content of these registers.
Patch also adds a "context synchronizing instruction" to enforce
no further updates to these registers as mandated by PowerISA.

"If an mtspr instruction is executed that changes the
value of a Performance Monitor register other than
SIAR, SDAR, and SIER, the change is not guaranteed
to have taken effect until after a subsequent context
synchronizing instruction has been executed (see
Chapter 11. "Synchronization Requirements for Con-
text Alterations" on page 1133)."

Tested-by: Madhavan Srinivasan 
Reviewed-by: Madhavan Srinivasan 
Signed-off-by: Madhavan Srinivasan 
---
 arch/powerpc/perf/core-book3s.c | 11 +++
 1 file changed, 11 insertions(+)

diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 73f997b84d19..e8754243f3cb 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -1235,6 +1235,7 @@ static void power_pmu_disable(struct pmu *pmu)
 */
write_mmcr0(cpuhw, val);
mb();
+   isync();
 
/*
 * Disable instruction sampling if it was enabled
@@ -1243,12 +1244,22 @@ static void power_pmu_disable(struct pmu *pmu)
mtspr(SPRN_MMCRA,
  cpuhw->mmcr[2] & ~MMCRA_SAMPLE_ENABLE);
mb();
+   isync();
}
 
cpuhw->disabled = 1;
cpuhw->n_added = 0;
 
ebb_switch_out(mmcr0);
+
+   /*
+* These are readable by userspace, may contain kernel
+* addresses and are not switched by context switch, so clear
+* them now to avoid leaking anything to userspace in general
+* including to another process.
+*/
+   mtspr(SPRN_SDAR, 0);
+   mtspr(SPRN_SIAR, 0);
}
 
local_irq_restore(flags);
-- 
2.7.4

[PATCH 3/3] powerpc/perf: Add blacklisted events for power9 dd2.2

[Madhavan Srinivasan]

Signed-off-by: Madhavan Srinivasan 
---
 arch/powerpc/perf/power9-events-list.h | 15 +++
 arch/powerpc/perf/power9-pmu.c | 22 ++
 2 files changed, 37 insertions(+)

diff --git a/arch/powerpc/perf/power9-events-list.h 
b/arch/powerpc/perf/power9-events-list.h
index 9d7a16a943a8..7de344b7d9cc 100644
--- a/arch/powerpc/perf/power9-events-list.h
+++ b/arch/powerpc/perf/power9-events-list.h
@@ -82,3 +82,18 @@ EVENT(PM_RADIX_PWC_L3_HIT,   0x3f056)
 EVENT(PM_RUN_CYC_SMT2_MODE,0x3006c)
 EVENT(PM_TM_TX_PASS_RUN_INST,  0x4e014)
 EVENT(PM_DISP_HELD_SYNC_HOLD,  0x4003c)
+EVENT(PM_DTLB_MISS_16G,0x1c058)
+EVENT(PM_DERAT_MISS_2M,0x1c05a)
+EVENT(PM_DTLB_MISS_2M, 0x1c05c)
+EVENT(PM_MRK_DTLB_MISS_1G, 0x1d15c)
+EVENT(PM_DTLB_MISS_4K, 0x2c056)
+EVENT(PM_DERAT_MISS_1G,0x2c05a)
+EVENT(PM_MRK_DERAT_MISS_2M,0x2d152)
+EVENT(PM_MRK_DTLB_MISS_4K, 0x2d156)
+EVENT(PM_MRK_DTLB_MISS_16G,0x2d15e)
+EVENT(PM_DTLB_MISS_64K,0x3c056)
+EVENT(PM_MRK_DERAT_MISS_1G,0x3d152)
+EVENT(PM_MRK_DTLB_MISS_64K,0x3d156)
+EVENT(PM_DTLB_MISS_16M,0x4c056)
+EVENT(PM_DTLB_MISS_1G, 0x4c05a)
+EVENT(PM_MRK_DTLB_MISS_16M,0x4c15e)
diff --git a/arch/powerpc/perf/power9-pmu.c b/arch/powerpc/perf/power9-pmu.c
index 3847607c16f0..2ca0b33b4efb 100644
--- a/arch/powerpc/perf/power9-pmu.c
+++ b/arch/powerpc/perf/power9-pmu.c
@@ -121,6 +121,25 @@ int p9_dd21_bl_ev[] = {
PM_DISP_HELD_SYNC_HOLD,
 };
 
+int p9_dd22_bl_ev[] = {
+   PM_DTLB_MISS_16G,
+   PM_DERAT_MISS_2M,
+   PM_DTLB_MISS_2M,
+   PM_MRK_DTLB_MISS_1G,
+   PM_DTLB_MISS_4K,
+   PM_DERAT_MISS_1G,
+   PM_MRK_DERAT_MISS_2M,
+   PM_MRK_DTLB_MISS_4K,
+   PM_MRK_DTLB_MISS_16G,
+   PM_DTLB_MISS_64K,
+   PM_MRK_DERAT_MISS_1G,
+   PM_MRK_DTLB_MISS_64K,
+   PM_DISP_HELD_SYNC_HOLD,
+   PM_DTLB_MISS_16M,
+   PM_DTLB_MISS_1G,
+   PM_MRK_DTLB_MISS_16M,
+};
+
 /* Table of alternatives, sorted by column 0 */
 static const unsigned int power9_event_alternatives[][MAX_ALT] = {
{ PM_INST_DISP, PM_INST_DISP_ALT },
@@ -475,6 +494,9 @@ static int __init init_power9_pmu(void)
if ((PVR_CFG(pvr) == 2) && (PVR_MIN(pvr) == 1)) {
power9_pmu.blacklist_ev = p9_dd21_bl_ev;
power9_pmu.n_blacklist_ev = ARRAY_SIZE(p9_dd21_bl_ev);
+   } else if ((PVR_CFG(pvr) == 2) && (PVR_MIN(pvr) == 2)) {
+   power9_pmu.blacklist_ev = p9_dd22_bl_ev;
+   power9_pmu.n_blacklist_ev = ARRAY_SIZE(p9_dd22_bl_ev);
}
}
 
-- 
2.7.4

[PATCH 2/3] powerpc/perf: Add blacklisted events for power9 dd2.1

[Madhavan Srinivasan]

Signed-off-by: Madhavan Srinivasan 
---
 arch/powerpc/perf/power9-events-list.h | 13 +
 arch/powerpc/perf/power9-pmu.c | 26 ++
 2 files changed, 39 insertions(+)

diff --git a/arch/powerpc/perf/power9-events-list.h 
b/arch/powerpc/perf/power9-events-list.h
index e99c6bf4d391..9d7a16a943a8 100644
--- a/arch/powerpc/perf/power9-events-list.h
+++ b/arch/powerpc/perf/power9-events-list.h
@@ -69,3 +69,16 @@ EVENT(PM_BR_CMPL_ALT,0x10012)
 EVENT(PM_BR_2PATH, 0x20036)
 /* ALternate branch event that are not strongly biased */
 EVENT(PM_BR_2PATH_ALT, 0x40036)
+
+/* Blacklisted events */
+EVENT(PM_MRK_ST_DONE_L2,   0x10134)
+EVENT(PM_RADIX_PWC_L1_HIT, 0x1f056)
+EVENT(PM_FLOP_CMPL,0x100f4)
+EVENT(PM_MRK_NTF_FIN,  0x20112)
+EVENT(PM_RADIX_PWC_L2_HIT, 0x2d024)
+EVENT(PM_IFETCH_THROTTLE,  0x3405e)
+EVENT(PM_MRK_L2_TM_ST_ABORT_SISTER,0x3e15c)
+EVENT(PM_RADIX_PWC_L3_HIT, 0x3f056)
+EVENT(PM_RUN_CYC_SMT2_MODE,0x3006c)
+EVENT(PM_TM_TX_PASS_RUN_INST,  0x4e014)
+EVENT(PM_DISP_HELD_SYNC_HOLD,  0x4003c)
diff --git a/arch/powerpc/perf/power9-pmu.c b/arch/powerpc/perf/power9-pmu.c
index 24b5b5b7a206..3847607c16f0 100644
--- a/arch/powerpc/perf/power9-pmu.c
+++ b/arch/powerpc/perf/power9-pmu.c
@@ -101,9 +101,26 @@ enum {
 #define POWER9_MMCRA_IFM2  0x8000UL
 #define POWER9_MMCRA_IFM3  0xC000UL
 
+/* Nasty Power9 specific hack */
+#define PVR_POWER9_CUMULUS 0x2000
+
 /* PowerISA v2.07 format attribute structure*/
 extern struct attribute_group isa207_pmu_format_group;
 
+int p9_dd21_bl_ev[] = {
+   PM_MRK_ST_DONE_L2,
+   PM_RADIX_PWC_L1_HIT,
+   PM_FLOP_CMPL,
+   PM_MRK_NTF_FIN,
+   PM_RADIX_PWC_L2_HIT,
+   PM_IFETCH_THROTTLE,
+   PM_MRK_L2_TM_ST_ABORT_SISTER,
+   PM_RADIX_PWC_L3_HIT,
+   PM_RUN_CYC_SMT2_MODE,
+   PM_TM_TX_PASS_RUN_INST,
+   PM_DISP_HELD_SYNC_HOLD,
+};
+
 /* Table of alternatives, sorted by column 0 */
 static const unsigned int power9_event_alternatives[][MAX_ALT] = {
{ PM_INST_DISP, PM_INST_DISP_ALT },
@@ -446,12 +463,21 @@ static struct power_pmu power9_pmu = {
 static int __init init_power9_pmu(void)
 {
int rc = 0;
+   unsigned int pvr = mfspr(SPRN_PVR);
 
/* Comes from cpu_specs[] */
if (!cur_cpu_spec->oprofile_cpu_type ||
strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc64/power9"))
return -ENODEV;
 
+   /* Blacklist events */
+   if (!(pvr & PVR_POWER9_CUMULUS)) {
+   if ((PVR_CFG(pvr) == 2) && (PVR_MIN(pvr) == 1)) {
+   power9_pmu.blacklist_ev = p9_dd21_bl_ev;
+   power9_pmu.n_blacklist_ev = ARRAY_SIZE(p9_dd21_bl_ev);
+   }
+   }
+
if (cpu_has_feature(CPU_FTR_POWER9_DD1)) {
/*
 * Since PM_INST_CMPL may not provide right counts in all
-- 
2.7.4

[PATCH 1/3] powerpc/perf: Infrastructure to support addition of blacklisted events

[Madhavan Srinivasan]

Introduce code to support addition of blacklisted events for a
processor version. A 'pointer' and 'int' variable to hold the
number of events are added to 'struct power_pmu', along with a
generic function to loop through the list to validate the given
event. Generic function 'is_event_blacklisted' is called in
power_pmu_event_init() to detect and reject early.

Signed-off-by: Madhavan Srinivasan 
---
 arch/powerpc/include/asm/perf_event_server.h |  2 ++
 arch/powerpc/perf/core-book3s.c  | 21 +
 2 files changed, 23 insertions(+)

diff --git a/arch/powerpc/include/asm/perf_event_server.h 
b/arch/powerpc/include/asm/perf_event_server.h
index 723bf48e7494..67a8a9585d50 100644
--- a/arch/powerpc/include/asm/perf_event_server.h
+++ b/arch/powerpc/include/asm/perf_event_server.h
@@ -53,6 +53,8 @@ struct power_pmu {
   [PERF_COUNT_HW_CACHE_OP_MAX]
   [PERF_COUNT_HW_CACHE_RESULT_MAX];
 
+   int n_blacklist_ev;
+   int *blacklist_ev;
/* BHRB entries in the PMU */
int bhrb_nr;
 };
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index c4525323d691..73f997b84d19 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -1819,6 +1819,18 @@ static int hw_perf_cache_event(u64 config, u64 *eventp)
return 0;
 }
 
+static bool is_event_blacklisted(u64 ev)
+{
+   int i;
+
+   for (i=0; i < ppmu->n_blacklist_ev; i++) {
+   if (ppmu->blacklist_ev[i] == ev)
+   return true;
+   }
+
+   return false;
+}
+
 static int power_pmu_event_init(struct perf_event *event)
 {
u64 ev;
@@ -1844,15 +1856,24 @@ static int power_pmu_event_init(struct perf_event 
*event)
ev = event->attr.config;
if (ev >= ppmu->n_generic || ppmu->generic_events[ev] == 0)
return -EOPNOTSUPP;
+
+   if (ppmu->blacklist_ev && is_event_blacklisted(ev))
+   return -EINVAL;
ev = ppmu->generic_events[ev];
break;
case PERF_TYPE_HW_CACHE:
err = hw_perf_cache_event(event->attr.config, );
if (err)
return err;
+
+   if (ppmu->blacklist_ev && is_event_blacklisted(ev))
+   return -EINVAL;
break;
case PERF_TYPE_RAW:
ev = event->attr.config;
+
+   if (ppmu->blacklist_ev && is_event_blacklisted(ev))
+   return -EINVAL;
break;
default:
return -ENOENT;
-- 
2.7.4

[PATCH 2/2] powerpc/perf: Fix the kernel address leak to userspace via SDAR

[Madhavan Srinivasan]

Sampled Data Address Register (SDAR) is a 64-bit
register that contains the effective address of
the storage operand of an instruction that was
being executed, possibly out-of-order, at or around
the time that the Performance Monitor alert occurred.

In certain scenario SDAR happen to contain the kernel
address even for userspace only sampling. Add checks
to prevent it.

Signed-off-by: Madhavan Srinivasan 
---
 arch/powerpc/perf/core-book3s.c | 11 ---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 337db5831749..c4525323d691 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -95,7 +95,7 @@ static inline unsigned long perf_ip_adjust(struct pt_regs 
*regs)
 {
return 0;
 }
-static inline void perf_get_data_addr(struct pt_regs *regs, u64 *addrp) { }
+static inline void perf_get_data_addr(struct pt_regs *regs, u64 *addrp, struct 
perf_event *event) { }
 static inline u32 perf_get_misc_flags(struct pt_regs *regs)
 {
return 0;
@@ -174,7 +174,7 @@ static inline unsigned long perf_ip_adjust(struct pt_regs 
*regs)
  * pointed to by SIAR; this is indicated by the [POWER6_]MMCRA_SDSYNC, the
  * [POWER7P_]MMCRA_SDAR_VALID bit in MMCRA, or the SDAR_VALID bit in SIER.
  */
-static inline void perf_get_data_addr(struct pt_regs *regs, u64 *addrp)
+static inline void perf_get_data_addr(struct pt_regs *regs, u64 *addrp, struct 
perf_event *event)
 {
unsigned long mmcra = regs->dsisr;
bool sdar_valid;
@@ -198,6 +198,11 @@ static inline void perf_get_data_addr(struct pt_regs 
*regs, u64 *addrp)
 
if (!(mmcra & MMCRA_SAMPLE_ENABLE) || sdar_valid)
*addrp = mfspr(SPRN_SDAR);
+
+   if (perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN) &&
+   (event->attr.exclude_kernel || event->attr.exclude_hv) &&
+   is_kernel_addr(mfspr(SPRN_SDAR)))
+   *addrp = 0;
 }
 
 static bool regs_sihv(struct pt_regs *regs)
@@ -2054,7 +2059,7 @@ static void record_and_restart(struct perf_event *event, 
unsigned long val,
 
if (event->attr.sample_type &
(PERF_SAMPLE_ADDR | PERF_SAMPLE_PHYS_ADDR))
-   perf_get_data_addr(regs, );
+   perf_get_data_addr(regs, , event);
 
if (event->attr.sample_type & PERF_SAMPLE_BRANCH_STACK) {
struct cpu_hw_events *cpuhw;
-- 
2.7.4

[PATCH 1/2] powerpc/perf: Fix kernel address leak to userspace via BHRB buffer

[Madhavan Srinivasan]

The current Branch History Rolling Buffer (BHRB) code does
not check for any privilege levels before updating the data
from BHRB. This leaks kernel addresses to userspace even when
profiling only with userspace privileges. Add proper checks
to prevent it.

Signed-off-by: Madhavan Srinivasan 
---
 arch/powerpc/perf/core-book3s.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index f89bbd54ecec..337db5831749 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -457,6 +457,10 @@ static void power_pmu_bhrb_read(struct cpu_hw_events 
*cpuhw)
/* invalid entry */
continue;
 
+   if (perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN) &&
+   is_kernel_addr(addr))
+   continue;
+
/* Branches are read most recent first (ie. mfbhrb 0 is
 * the most recent branch).
 * There are two types of valid entries:
-- 
2.7.4

Re: [PATCH 05/21] powerpc: Avoid comparison of unsigned long >= 0 in pfn_valid

[Michael Ellerman]

Mathieu Malaterre  writes:

> Rewrite comparison since all values compared are of type `unsigned long`.
>
> Fix a warning (treated as error in W=1):
>
>   CC  arch/powerpc/kernel/irq.o
> In file included from ./include/linux/bug.h:5:0,
>  from ./include/linux/cpumask.h:13,
>  from ./include/linux/smp.h:13,
>  from ./include/linux/kernel_stat.h:5,
>  from arch/powerpc/kernel/irq.c:35:
> ./include/linux/dma-mapping.h: In function ‘dma_map_resource’:
> ./arch/powerpc/include/asm/page.h:129:32: error: comparison of unsigned 
> expression >= 0 is always true [-Werror=type-limits]
>  #define pfn_valid(pfn)  ((pfn) >= ARCH_PFN_OFFSET && (pfn) < max_mapnr)
> ^
> Suggested-by: Segher Boessenkool 
> Signed-off-by: Mathieu Malaterre 
> ---
>  arch/powerpc/include/asm/page.h | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
> index 8da5d4c1cab2..19dea64e7ed2 100644
> --- a/arch/powerpc/include/asm/page.h
> +++ b/arch/powerpc/include/asm/page.h
> @@ -126,7 +126,8 @@ extern long long virt_phys_offset;
>  
>  #ifdef CONFIG_FLATMEM
>  #define ARCH_PFN_OFFSET  ((unsigned long)(MEMORY_START >> 
> PAGE_SHIFT))
> -#define pfn_valid(pfn)   ((pfn) >= ARCH_PFN_OFFSET && (pfn) < 
> max_mapnr)
> +#define pfn_valid(pfn) \
> + (((pfn) - ARCH_PFN_OFFSET) < (max_mapnr - ARCH_PFN_OFFSET))

I'm not a big fan of this one, because the original code is *far* more
obvious as to what it's doing.

I'm not sure if we can make this one a static inline, or whether that
would help, but it would be worth investigating.

cheers

Re: [PATCH 17/21] powerpc: Add missing prototype for sys_debug_setcontext

[Michael Ellerman]

Mathieu Malaterre  writes:

> In commit 81e7009ea46c ("powerpc: merge ppc signal.c and ppc64 signal32.c")
> the function sys_debug_setcontext was added without a prototype.
>
> Fix compilation warning (treated as error in W=1):
>
>   CC  arch/powerpc/kernel/signal_32.o
> arch/powerpc/kernel/signal_32.c:1227:5: error: no previous prototype for 
> ‘sys_debug_setcontext’ [-Werror=missing-prototypes]
>  int sys_debug_setcontext(struct ucontext __user *ctx,
>  ^~~~
> cc1: all warnings being treated as errors

This one should actually be using the SYSCALL_DEFINE syntax, so that it
can be used with CONFIG_FTRACE_SYSCALLS.

See eg. our mmap:

  SYSCALL_DEFINE6(mmap, unsigned long, addr, size_t, len,
unsigned long, prot, unsigned long, flags,
unsigned long, fd, off_t, offset)
  {
return do_mmap2(addr, len, prot, flags, fd, offset, PAGE_SHIFT);
  }


We probably still need this patch, but I'm not entirely sure because the
SYSCALL_DEFINE macro does all sorts of shenanigans.

cheers

Re: [PATCH 15/21] powerpc: Add missing prototype for MMU_setup

[Michael Ellerman]

Mathieu Malaterre  writes:
> Add a function declaration for MMU_setup at the beginning of the file to
> fix a warning (treated as error in W=1):
>
>   CC  kernel/sys.o
> arch/powerpc/mm/init_32.c:102:13: error: no previous prototype for 
> ‘MMU_setup’ [-Werror=missing-prototypes]
>  void __init MMU_setup(void)
>  ^
> cc1: all warnings being treated as errors

Can't it be static instead?

  $ git grep -n MMU_setup
  arch/powerpc/mm/init_32.c:102:void __init MMU_setup(void)
  arch/powerpc/mm/init_32.c:135:  MMU_setup();

cheers

Re: [PATCH 03/21] powerpc: Mark the variable earlycon_acpi_spcr_enable maybe_unused

[Michael Ellerman]

Mathieu Malaterre  writes:

> Re-use the object-like macro EARLYCON_USED_OR_UNUSED to mark
> `earlycon_acpi_spcr_enable` as maybe_unused.
>
> Fix the following warning (treated as error in W=1)
>
>   CC  arch/powerpc/kernel/setup-common.o
> In file included from ./include/linux/serial_8250.h:14:0,
>  from arch/powerpc/kernel/setup-common.c:33:
> ./include/linux/serial_core.h:382:19: error: ‘earlycon_acpi_spcr_enable’ 
> defined but not used [-Werror=unused-const-variable=]
>  static const bool earlycon_acpi_spcr_enable;
>^
> cc1: all warnings being treated as errors
>
> Signed-off-by: Mathieu Malaterre 
> ---
>  include/linux/serial_core.h | 1 +

I can't take this one as that's not a file I maintain.

The script says:

  $ ./scripts/get_maintainer.pl include/linux/serial_core.h
  gre...@linuxfoundation.org
  jsl...@suse.com
  linux-ker...@vger.kernel.org


Can you resend it to them?

> diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
> index b32df49a3bd5..4d14ecd7dbe8 100644
> --- a/include/linux/serial_core.h
> +++ b/include/linux/serial_core.h
> @@ -379,6 +379,7 @@ extern int of_setup_earlycon(const struct earlycon_id 
> *match,
>  extern bool earlycon_acpi_spcr_enable __initdata;
>  int setup_earlycon(char *buf);
>  #else
> +EARLYCON_USED_OR_UNUSED
>  static const bool earlycon_acpi_spcr_enable;

The macro eventually turns into an __attribute__, which I think is
typically placed after the variable, so eg:

  static const bool earlycon_acpi_spcr_enable EARLYCON_USED_OR_UNUSED;


cheers

>  static inline int setup_earlycon(char *buf) { return 0; }
>  #endif
> -- 
> 2.11.0