This patch fixes a crash seen while doing a kexec from
radix mode to hash mode. Key 0 is special in hash and
used in the RPN by default, we set the key values to 0
today. In radix mode key 0 is used to control
supervisor<->user access. In hash key 0 is used by default,
so the first instruction after the switch causes a crash on
kexec.
This patch fixes
(3b10d00 powerpc/mm/radix: Prevent kernel execution of user space)
The commit above introduced setting of IAMR and AMOR values to
prevent execution of user mode instructions from supervisor mode.
We need to clean up these SPR's on kexec.
Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Balbir Singh <bsingharora@gmail.com>
---
NOTES:
This patch can be made power9 specific, but I've chosen not
to do so, I could add it in a feature section if recommended.
Since this is only for kexec resetting them might be helpful
when we fully implement keys as well.
arch/powerpc/kernel/misc_64.S | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S
index c119044..39d2b58 100644
--- a/arch/powerpc/kernel/misc_64.S
+++ b/arch/powerpc/kernel/misc_64.S
@@ -614,6 +614,16 @@ _GLOBAL(kexec_sequence)
li r0,0
std r0,16(r1)
+ /*
+ * This is the best time to turn AMR/IAMR off.
+ * key 0 is used in radix for supervisor<->user
+ * protection, but on hash key 0 is reserved
+ * ideally we want to enter with a clean state.
+ * NOTE, we rely on r0 being 0 from above.
+ */
+ mtspr SPRN_IAMR,r0
+ mtspr SPRN_AMOR,r0
+
/* save regs for local vars on new stack.
* yes, we won't go back, but ...
*/
--
2.9.4
Balbir Singh [off-list ref] writes:
This patch fixes a crash seen while doing a kexec from
radix mode to hash mode. Key 0 is special in hash and
used in the RPN by default, we set the key values to 0
today. In radix mode key 0 is used to control
supervisor<->user access. In hash key 0 is used by default,
so the first instruction after the switch causes a crash on
kexec.
This patch fixes
(3b10d00 powerpc/mm/radix: Prevent kernel execution of user space)
The commit above introduced setting of IAMR and AMOR values to
prevent execution of user mode instructions from supervisor mode.
We need to clean up these SPR's on kexec.
Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Balbir Singh <bsingharora@gmail.com>
---
NOTES:
This patch can be made power9 specific, but I've chosen not
to do so, I could add it in a feature section if recommended.
Well neither register existed in the architecture prior to Power8.
Possibly they were defined in BookIV or they were nops, but most likely
it will just explode on old CPUs.
And probably Book3E as well.
So it should be in a CPU_FTR_ARCH_207S section at a minimum.
But maybe it should just be done in C earlier in the call chain.
cheers
On Thu, Jun 29, 2017 at 7:29 PM, Michael Ellerman [off-list ref] wrote:
Balbir Singh [off-list ref] writes:
quoted
This patch fixes a crash seen while doing a kexec from
radix mode to hash mode. Key 0 is special in hash and
used in the RPN by default, we set the key values to 0
today. In radix mode key 0 is used to control
supervisor<->user access. In hash key 0 is used by default,
so the first instruction after the switch causes a crash on
kexec.
This patch fixes
(3b10d00 powerpc/mm/radix: Prevent kernel execution of user space)
The commit above introduced setting of IAMR and AMOR values to
prevent execution of user mode instructions from supervisor mode.
We need to clean up these SPR's on kexec.
Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Balbir Singh <bsingharora@gmail.com>
---
NOTES:
This patch can be made power9 specific, but I've chosen not
to do so, I could add it in a feature section if recommended.
Well neither register existed in the architecture prior to Power8.
Possibly they were defined in BookIV or they were nops, but most likely
it will just explode on old CPUs.
And probably Book3E as well.
So it should be in a CPU_FTR_ARCH_207S section at a minimum.
Thanks for the review, I'll do a v2, I've put it under CPU_FTR_ARCH_300
But maybe it should just be done in C earlier in the call chain.
I thought about it, but felt that kexec_sequence would be our last let
off and might be a good place to reset the AMR's just before turning
the MMU off
Balbir Singh.