Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 71b20cdb authored by Russell Currey's avatar Russell Currey Committed by Greg Kroah-Hartman
Browse files

powerpc/powernv/idle: Restore IAMR after idle 



commit a3f3072db6cad40895c585dce65e36aab997f042 upstream.

Without restoring the IAMR after idle, execution prevention on POWER9
with Radix MMU is overwritten and the kernel can freely execute
userspace without faulting.

This is necessary when returning from any stop state that modifies
user state, as well as hypervisor state.

To test how this fails without this patch, load the lkdtm driver and
do the following:

  $ echo EXEC_USERSPACE > /sys/kernel/debug/provoke-crash/DIRECT

which won't fault, then boot the kernel with powersave=off, where it
will fault. Applying this patch will fix this.

Fixes: 3b10d009 ("powerpc/mm/radix: Prevent kernel execution of user space")
Cc: stable@vger.kernel.org # v4.10+
Signed-off-by: default avatarRussell Currey <ruscur@russell.cc>
Reviewed-by: default avatarAkshay Adiga <akshay.adiga@linux.vnet.ibm.com>
Reviewed-by: default avatarNicholas Piggin <npiggin@gmail.com>
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 69c2b71c

arch/powerpc/kernel/idle_book3s.S

+20 −0
Original line number Diff line number Diff line
@@ -170,6 +170,9 @@ core_idle_lock_held: 
	bne-	core_idle_lock_held

	blr



/* Reuse an unused pt_regs slot for IAMR */

#define PNV_POWERSAVE_IAMR	_DAR



/*

 * Pass requested state in r3:

 *	r3 - PNV_THREAD_NAP/SLEEP/WINKLE in POWER8
@@ -200,6 +203,12 @@ pnv_powersave_common: 
	/* Continue saving state */

	SAVE_GPR(2, r1)

	SAVE_NVGPRS(r1)



BEGIN_FTR_SECTION

	mfspr	r5, SPRN_IAMR

	std	r5, PNV_POWERSAVE_IAMR(r1)

END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)



	mfcr	r5

	std	r5,_CCR(r1)

	std	r1,PACAR1(r13)
@@ -924,6 +933,17 @@ BEGIN_FTR_SECTION 
END_FTR_SECTION_IFSET(CPU_FTR_HVMODE)

	REST_NVGPRS(r1)

	REST_GPR(2, r1)



BEGIN_FTR_SECTION

	/* IAMR was saved in pnv_powersave_common() */

	ld	r5, PNV_POWERSAVE_IAMR(r1)

	mtspr	SPRN_IAMR, r5

	/*

	 * We don't need an isync here because the upcoming mtmsrd is

	 * execution synchronizing.

	 */

END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)



	ld	r4,PACAKMSR(r13)

	ld	r5,_LINK(r1)

	ld	r6,_CCR(r1)