[v2] powerpc/powernv/idle: Restore IAMR after idle

Message ID 20190208111103.4901-1-ruscur@russell.cc
State New
Headers show
  • [v2] powerpc/powernv/idle: Restore IAMR after idle
Related show


Context Check Description
snowpatch_ozlabs/checkpatch warning total: 0 errors, 1 warnings, 0 checks, 30 lines checked
snowpatch_ozlabs/build-pmac32 success build succeeded & removed 0 sparse warning(s)
snowpatch_ozlabs/build-ppc64e success build succeeded & removed 0 sparse warning(s)
snowpatch_ozlabs/build-ppc64be success build succeeded & removed 0 sparse warning(s)
snowpatch_ozlabs/build-ppc64le success build succeeded & removed 0 sparse warning(s)
snowpatch_ozlabs/apply_patch success next/apply_patch Successfully applied

Commit Message

Russell Currey Feb. 8, 2019, 11:11 a.m.
Without restoring the IAMR after idle, execution prevention on POWER9
with Radix MMU is overwritten and the kernel can freely execute userspace without

This is necessary when returning from any stop state that modifies user
state, as well as hypervisor state.

To test how this fails without this patch, load the lkdtm driver and
do the following:

   echo EXEC_USERSPACE > /sys/kernel/debug/provoke-crash/DIRECT

which won't fault, then boot the kernel with powersave=off, where it
will fault.  Applying this patch will fix this.

Fixes: 3b10d0095a1e ("powerpc/mm/radix: Prevent kernel execution of user
Cc: <stable@vger.kernel.org>
Signed-off-by: Russell Currey <ruscur@russell.cc>
Since v1:
      - no longer use paca to save IAMR, instead use _DAR (thanks mpe)
      - remove isync and pnv_wakeup_noloss section (thanks Nick)

 arch/powerpc/kernel/idle_book3s.S | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)


diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
index 7f5ac2e8581b..551cc4649021 100644
--- a/arch/powerpc/kernel/idle_book3s.S
+++ b/arch/powerpc/kernel/idle_book3s.S
@@ -200,6 +200,13 @@  pnv_powersave_common:
 	/* Continue saving state */
 	SAVE_GPR(2, r1)
+	/* _DAR is unused here, so (ab)use it to save the IAMR */
+	mfspr	r5,SPRN_IAMR
+	std	r5,_DAR(r1)
 	mfcr	r5
 	std	r5,_CCR(r1)
 	std	r1,PACAR1(r13)
@@ -924,6 +931,17 @@  BEGIN_FTR_SECTION
 	REST_GPR(2, r1)
+	/* IAMR was saved in regs->dar in pnv_powersave_common */
+	ld	r4,_DAR(r1)
+	mtspr	SPRN_IAMR,r4
+	/*
+	 * We don't need an isync here because the upcoming mtmsrd is
+	 * execution synchronizing.
+	 */
 	ld	r4,PACAKMSR(r13)
 	ld	r5,_LINK(r1)
 	ld	r6,_CCR(r1)