[PATCH 2/2] KVM: PPC: Book3S HV: Fix register usage when loading/saving VRSAVE

["Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>]

From: Paul Mackerras <paulus@samba.org>

Commit 595e4f7e697e ("KVM: PPC: Book3S HV: Use load/store_fp_state functions
in HV guest entry/exit") changed the register usage in kvmppc_save_fp() and
kvmppc_load_fp() but omitted changing the instructions that load and save VRSAVE.
The result is that the VRSAVE value was loaded from a constant address, and
saved to a location past the end of the vcpu struct, causing host kernel memory
corruption and various kinds of host kernel crashes.

This fixes the problem by using register r31, which contains the
vcpu pointer, instead of r3 and r4.

Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
---
 arch/powerpc/kvm/book3s_hv_rmhandlers.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index 557a47800ca1..6962d38c76f5 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -2132,7 +2132,7 @@ BEGIN_FTR_SECTION
 END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
 #endif
 	mfspr	r6,SPRN_VRSAVE
-	stw	r6,VCPU_VRSAVE(r3)
+	stw	r6,VCPU_VRSAVE(r31)
 	mtlr	r30
 	mtmsrd	r5
 	isync
@@ -2169,7 +2169,7 @@ BEGIN_FTR_SECTION
 	bl	.load_vr_state
 END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
 #endif
-	lwz	r7,VCPU_VRSAVE(r4)
+	lwz	r7,VCPU_VRSAVE(r31)
 	mtspr	SPRN_VRSAVE,r7
 	mtlr	r30
 	mr	r4,r31
-- 
1.8.3.2