Re: [PATCH] powerpc/powernv/idle: Restore IAMR after idle

Russell Currey [off-list ref] writes:

On Thu, 2019-02-07 at 15:08 +1000, Nicholas Piggin wrote:

quoted

Russell Currey's on February 6, 2019 4:28 pm:

quoted

Without restoring the IAMR after idle, execution prevention on
POWER9
with Radix MMU is overwritten and the kernel can freely execute
userspace without
faulting.

This is necessary when returning from any stop state that modifies
user
state, as well as hypervisor state.

To test how this fails without this patch, load the lkdtm driver
and
do the following:

   echo EXEC_USERSPACE > /sys/kernel/debug/provoke-crash/DIRECT

which won't fault, then boot the kernel with powersave=off, where
it
will fault.  Applying this patch will fix this.

Fixes: 3b10d0095a1e ("powerpc/mm/radix: Prevent kernel execution of
user
space")
Cc: <redacted>
Signed-off-by: Russell Currey <redacted>

Good catch and debugging. This really should be a quirk, we don't
want
to have to restore this thing on a thread switch.

Can we put it under a CONFIG option if we're not using IAMR?

I don't exactly know when we do or don't use the IAMR (since the only
thing I've used it for is radix).  When wouldn't we care about
restoring it on hash?

On hash it's used for memory protection keys (code is in
arch/powerpc/mm/pkeys.c). The kernel doesn't use protection keys, but
userspace apps may use it explicitly via specific syscalls
(pkey_alloc(), pkey_mprotect, pkey_free()).

Also, the kernel may use a protection key if the process does an
mmap(PROT_EXEC).

--
Thiago Jung Bauermann
IBM Linux Technology Center