Patch "KVM: s390: gaccess: fix real-space designation asce handling for gmap shadows" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

KVM: s390: gaccess: fix real-space designation asce handling for gmap shadows

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
kvm-s390-gaccess-fix-real-space-designation-asce-handling-for-gmap-shadows.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Heiko Carstens <[email protected]>
Date: Mon, 19 Jun 2017 08:02:28 +0200
Subject: KVM: s390: gaccess: fix real-space designation asce handling for gmap shadows

From: Heiko Carstens <[email protected]>

commit addb63c18a0d52a9ce2611d039f981f7b6148d2b upstream.

For real-space designation asces the asce origin part is only a token. The asce token origin must not be used to generate an effective address for storage references. This however is erroneously done within kvm_s390_shadow_tables().

Furthermore within the same function the wrong parts of virtual addresses are used to generate a corresponding real address (e.g. the region second index is used as region first index).

Both of the above can result in incorrect address translations. Only for real space designations with a token origin of zero and addresses below one megabyte the translation was correct.

Furthermore replace a "!asce.r" statement with a "!*fake" statement to make it more obvious that a specific condition has nothing to do with the architecture, but with the fake handling of real space designations.

---
 arch/s390/kvm/gaccess.c |   15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

@@ -972,11 +972,12 @@ static int kvm_s390_shadow_tables(struct
 	ptr = asce.origin * 4096;
 	if (asce.r) {
 		*fake = 1;
+		ptr = 0;
 		asce.dt = ASCE_TYPE_REGION1;
 	}
 	switch (asce.dt) {
 	case ASCE_TYPE_REGION1:
-		if (vaddr.rfx01 > asce.tl && !asce.r)
+		if (vaddr.rfx01 > asce.tl && !*fake)
 			return PGM_REGION_FIRST_TRANS;
 		break;
 	case ASCE_TYPE_REGION2:

@@ -1004,8 +1005,7 @@ static int kvm_s390_shadow_tables(struct
 		union region1_table_entry rfte;
 
 		if (*fake) {
-			/* offset in 16EB guest memory block */
-			ptr = ptr + ((unsigned long) vaddr.rsx << 53UL);
+			ptr += (unsigned long) vaddr.rfx << 53;
 			rfte.val = ptr;
 			goto shadow_r2t;
 		}

@@ -1031,8 +1031,7 @@ shadow_r2t:
 		union region2_table_entry rste;
 
 		if (*fake) {
-			/* offset in 8PB guest memory block */
-			ptr = ptr + ((unsigned long) vaddr.rtx << 42UL);
+			ptr += (unsigned long) vaddr.rsx << 42;
 			rste.val = ptr;
 			goto shadow_r3t;
 		}

@@ -1059,8 +1058,7 @@ shadow_r3t:
 		union region3_table_entry rtte;
 
 		if (*fake) {
-			/* offset in 4TB guest memory block */
-			ptr = ptr + ((unsigned long) vaddr.sx << 31UL);
+			ptr += (unsigned long) vaddr.rtx << 31;
 			rtte.val = ptr;
 			goto shadow_sgt;
 		}

@@ -1096,8 +1094,7 @@ shadow_sgt:
 		union segment_table_entry ste;
 
 		if (*fake) {
-			/* offset in 2G guest memory block */
-			ptr = ptr + ((unsigned long) vaddr.sx << 20UL);
+			ptr += (unsigned long) vaddr.sx << 20;
 			ste.val = ptr;
 			goto shadow_pgt;
 		}

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/kvm-s390-gaccess-fix-real-space-designation-asce-handling-for-gmap-shadows.patch