leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

powerpc/powernv/idle: Restore IAMR after idle

Browse Source 
Without restoring the IAMR after idle, execution prevention on POWER9
with Radix MMU is overwritten and the kernel can freely execute
userspace without faulting.

This is necessary when returning from any stop state that modifies
user state, as well as hypervisor state.

To test how this fails without this patch, load the lkdtm driver and
do the following:

  $ echo EXEC_USERSPACE > /sys/kernel/debug/provoke-crash/DIRECT

which won't fault, then boot the kernel with powersave=off, where it
will fault. Applying this patch will fix this.

Fixes: 3b10d0095a ("powerpc/mm/radix: Prevent kernel execution of user space")
Cc: stable@vger.kernel.org # v4.10+
Signed-off-by: Russell Currey <ruscur@russell.cc>
Reviewed-by: Akshay Adiga <akshay.adiga@linux.vnet.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
This commit is contained in:
Russell Currey 2019-04-18 16:51:16 +10:00 committed by Michael Ellerman
parent 558f86493d
commit a3f3072db6
1 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
arch/powerpc/kernel/idle_book3s.S
View File

@ -170,6 +170,9 @@ core_idle_lock_held:
bne- core_idle_lock_held
blr
/* Reuse an unused pt_regs slot for IAMR */
#define PNV_POWERSAVE_IAMR _DAR
/*
* Pass requested state in r3:
* r3 - PNV_THREAD_NAP/SLEEP/WINKLE in POWER8
@ -200,6 +203,12 @@ pnv_powersave_common:
/* Continue saving state */
SAVE_GPR(2, r1)
SAVE_NVGPRS(r1)
BEGIN_FTR_SECTION
mfspr r5, SPRN_IAMR
std r5, PNV_POWERSAVE_IAMR(r1)
END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
mfcr r5
std r5,_CCR(r1)
std r1,PACAR1(r13)
@ -924,6 +933,17 @@ BEGIN_FTR_SECTION
END_FTR_SECTION_IFSET(CPU_FTR_HVMODE)
REST_NVGPRS(r1)
REST_GPR(2, r1)
BEGIN_FTR_SECTION
/* IAMR was saved in pnv_powersave_common() */
ld r5, PNV_POWERSAVE_IAMR(r1)
mtspr SPRN_IAMR, r5
/*
* We don't need an isync here because the upcoming mtmsrd is
* execution synchronizing.
*/
END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
ld r4,PACAKMSR(r13)
ld r5,_LINK(r1)
ld r6,_CCR(r1)