[PATCH] powerpc/kexec: Fix radix to hash kexec

[PATCH] powerpc/kexec: Fix radix to hash kexec

[Balbir Singh]

This patch fixes a crash seen while doing a kexec from
radix mode to hash mode. Key 0 is special in hash and
used in the RPN by default, we set the key values to 0
today. In radix mode key 0 is used to control
supervisor<->user access. In hash key 0 is used by default,
so the first instruction after the switch causes a crash on
kexec.

This patch fixes
(3b10d00 powerpc/mm/radix: Prevent kernel execution of user space)
The commit above introduced setting of IAMR and AMOR values to
prevent execution of user mode instructions from supervisor mode.
We need to clean up these SPR's on kexec.

Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Balbir Singh <bsingharora@gmail.com>
---

NOTES:
 This patch can be made power9 specific, but I've chosen not
 to do so, I could add it in a feature section if recommended.
 Since this is only for kexec resetting them might be helpful
 when we fully implement keys as well.

 arch/powerpc/kernel/misc_64.S | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S
index c119044..39d2b58 100644
--- a/arch/powerpc/kernel/misc_64.S
+++ b/arch/powerpc/kernel/misc_64.S
@@ -614,6 +614,16 @@ _GLOBAL(kexec_sequence)
 	li	r0,0
 	std	r0,16(r1)
 
+	/*
+	 * This is the best time to turn AMR/IAMR off.
+	 * key 0 is used in radix for supervisor<->user
+	 * protection, but on hash key 0 is reserved
+	 * ideally we want to enter with a clean state.
+	 * NOTE, we rely on r0 being 0 from above.
+	 */
+	mtspr	SPRN_IAMR,r0
+	mtspr	SPRN_AMOR,r0
+
 	/* save regs for local vars on new stack.
 	 * yes, we won't go back, but ...
 	 */
-- 
2.9.4

Re: [PATCH] powerpc/kexec: Fix radix to hash kexec

[Michael Ellerman]

Balbir Singh <bsingharora@gmail.com> writes:

> This patch fixes a crash seen while doing a kexec from
> radix mode to hash mode. Key 0 is special in hash and
> used in the RPN by default, we set the key values to 0
> today. In radix mode key 0 is used to control
> supervisor<->user access. In hash key 0 is used by default,
> so the first instruction after the switch causes a crash on
> kexec.
>
> This patch fixes
> (3b10d00 powerpc/mm/radix: Prevent kernel execution of user space)
> The commit above introduced setting of IAMR and AMOR values to
> prevent execution of user mode instructions from supervisor mode.
> We need to clean up these SPR's on kexec.
>
> Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
> Signed-off-by: Balbir Singh <bsingharora@gmail.com>
> ---
>
> NOTES:
>  This patch can be made power9 specific, but I've chosen not
>  to do so, I could add it in a feature section if recommended.

Well neither register existed in the architecture prior to Power8.
Possibly they were defined in BookIV or they were nops, but most likely
it will just explode on old CPUs.

And probably Book3E as well.

So it should be in a CPU_FTR_ARCH_207S section at a minimum.

But maybe it should just be done in C earlier in the call chain.

cheers

Re: [PATCH] powerpc/kexec: Fix radix to hash kexec

[Balbir Singh]

On Thu, Jun 29, 2017 at 7:29 PM, Michael Ellerman <mpe@ellerman.id.au> wrote:
> Balbir Singh <bsingharora@gmail.com> writes:
>
>> This patch fixes a crash seen while doing a kexec from
>> radix mode to hash mode. Key 0 is special in hash and
>> used in the RPN by default, we set the key values to 0
>> today. In radix mode key 0 is used to control
>> supervisor<->user access. In hash key 0 is used by default,
>> so the first instruction after the switch causes a crash on
>> kexec.
>>
>> This patch fixes
>> (3b10d00 powerpc/mm/radix: Prevent kernel execution of user space)
>> The commit above introduced setting of IAMR and AMOR values to
>> prevent execution of user mode instructions from supervisor mode.
>> We need to clean up these SPR's on kexec.
>>
>> Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
>> Signed-off-by: Balbir Singh <bsingharora@gmail.com>
>> ---
>>
>> NOTES:
>>  This patch can be made power9 specific, but I've chosen not
>>  to do so, I could add it in a feature section if recommended.
>
> Well neither register existed in the architecture prior to Power8.
> Possibly they were defined in BookIV or they were nops, but most likely
> it will just explode on old CPUs.
>
> And probably Book3E as well.
>
> So it should be in a CPU_FTR_ARCH_207S section at a minimum.
>

Thanks for the review, I'll do a v2, I've put it under CPU_FTR_ARCH_300

> But maybe it should just be done in C earlier in the call chain.

I thought about it, but felt that kexec_sequence would be our last let
off and might be a good place to reset the AMR's just before turning
the MMU off

Balbir Singh.