1. 13 Mar, 2020 4 commits
  2. 10 Mar, 2020 1 commit
  3. 05 Mar, 2020 1 commit
    • Michael Ellerman's avatar
      powerpc/mm: Fix missing KUAP disable in flush_coherent_icache() · 59bee45b
      Michael Ellerman authored
      Stefan reported a strange kernel fault which turned out to be due to a
      missing KUAP disable in flush_coherent_icache() called from
      flush_icache_range().
      
      The fault looks like:
      
        Kernel attempted to access user page (7fffc30d9c00) - exploit attempt? (uid: 1009)
        BUG: Unable to handle kernel data access on read at 0x7fffc30d9c00
        Faulting instruction address: 0xc00000000007232c
        Oops: Kernel access of bad area, sig: 11 [#1]
        LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV
        CPU: 35 PID: 5886 Comm: sigtramp Not tainted 5.6.0-rc2-gcc-8.2.0-00003-gfc37a163 #79
        NIP:  c00000000007232c LR: c00000000003b7fc CTR: 0000000000000000
        REGS: c000001e11093940 TRAP: 0300   Not tainted  (5.6.0-rc2-gcc-8.2.0-00003-gfc37a163)
        MSR:  900000000280b033 <SF,HV,VEC,VSX,EE,FP,ME,IR,DR,RI,LE>  CR: 28000884  XER: 00000000
        CFAR: c0000000000722fc DAR: 00007fffc30d9c00 DSISR: 08000000 IRQMASK: 0
        GPR00: c00000000003b7fc c000001e11093bd0 c0000000023ac200 00007fffc30d9c00
        GPR04: 00007fffc30d9c18 0000000000000000 c000001e11093bd4 0000000000000000
        GPR08: 0000000000000000 0000000000000001 0000000000000000 c000001e1104ed80
        GPR12: 0000000000000000 c000001fff6ab380 c0000000016be2d0 4000000000000000
        GPR16: c000000000000000 bfffffffffffffff 0000000000000000 0000000000000000
        GPR20: 00007fffc30d9c00 00007fffc30d8f58 00007fffc30d9c18 00007fffc30d9c20
        GPR24: 00007fffc30d9c18 0000000000000000 c000001e11093d90 c000001e1104ed80
        GPR28: c000001e11093e90 0000000000000000 c0000000023d9d18 00007fffc30d9c00
        NIP flush_icache_range+0x5c/0x80
        LR  handle_rt_signal64+0x95c/0xc2c
        Call Trace:
          0xc000001e11093d90 (unreliable)
          handle_rt_signal64+0x93c/0xc2c
          do_notify_resume+0x310/0x430
          ret_from_except_lite+0x70/0x74
        Instruction dump:
        409e002c 7c0802a6 3c62ff31 3863f6a0 f8010080 48195fed 60000000 48fe4c8d
        60000000 e8010080 7c0803a6 7c0004ac <7c00ffac> 7c0004ac 4c00012c 38210070
      
      This path through handle_rt_signal64() to setup_trampoline() and
      flush_icache_range() is only triggered by 64-bit processes that have
      unmapped their VDSO, which is rare.
      
      flush_icache_range() takes a range of addresses to flush. In
      flush_coherent_icache() we implement an optimisation for CPUs where we
      know we don't actually have to flush the whole range, we just need to
      do a single icbi.
      
      However we still execute the icbi on the user address of the start of
      the range we're flushing. On CPUs that also implement KUAP (Power9)
      that leads to the spurious fault above.
      
      We should be able to pass any address, including a kernel address, to
      the icbi on these CPUs, which would avoid any interaction with KUAP.
      But I don't want to make that change in a bug fix, just in case it
      surfaces some strange behaviour on some CPU.
      
      So for now just disable KUAP around the icbi. Note the icbi is treated
      as a load, so we allow read access, not write as you'd expect.
      
      Fixes: 890274c2 ("powerpc/64s: Implement KUAP for Radix MMU")
      Cc: stable@vger.kernel.org # v5.2+
      Reported-by: default avatarStefan Berger <stefanb@linux.ibm.com>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      Link: https://lore.kernel.org/r/20200303235708.26004-1-mpe@ellerman.id.au
      59bee45b
  4. 04 Mar, 2020 26 commits
  5. 27 Feb, 2020 1 commit
  6. 25 Feb, 2020 3 commits
  7. 24 Feb, 2020 2 commits
  8. 19 Feb, 2020 2 commits
    • Christophe Leroy's avatar
      powerpc/32s: Slenderize _tlbia() for powerpc 603/603e · e1347a02
      Christophe Leroy authored
      _tlbia() is a function used only on 603/603e core, ie on CPUs which
      don't have a hash table.
      
      _tlbia() uses the tlbia macro which implements a loop of 1024 tlbie.
      
      On the 603/603e core, flushing the entire TLB requires no more than
      32 tlbie.
      
      Replace tlbia by a loop of 32 tlbie.
      Signed-off-by: default avatarChristophe Leroy <christophe.leroy@c-s.fr>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      Link: https://lore.kernel.org/r/12f4f4f0ff89aeab3b937fc96c84fb35e1b2517e.1580748445.git.christophe.leroy@c-s.fr
      e1347a02
    • Libor Pechacek's avatar
      powerpc/pseries: Avoid NULL pointer dereference when drmem is unavailable · a83836db
      Libor Pechacek authored
      In guests without hotplugagble memory drmem structure is only zero
      initialized. Trying to manipulate DLPAR parameters results in a crash.
      
        $ echo "memory add count 1" > /sys/kernel/dlpar
        Oops: Kernel access of bad area, sig: 11 [#1]
        LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
        ...
        NIP:  c0000000000ff294 LR: c0000000000ff248 CTR: 0000000000000000
        REGS: c0000000fb9d3880 TRAP: 0300   Tainted: G            E      (5.5.0-rc6-2-default)
        MSR:  8000000000009033 <SF,EE,ME,IR,DR,RI,LE>  CR: 28242428  XER: 20000000
        CFAR: c0000000009a6c10 DAR: 0000000000000010 DSISR: 40000000 IRQMASK: 0
        ...
        NIP dlpar_memory+0x6e4/0xd00
        LR  dlpar_memory+0x698/0xd00
        Call Trace:
          dlpar_memory+0x698/0xd00 (unreliable)
          handle_dlpar_errorlog+0xc0/0x190
          dlpar_store+0x198/0x4a0
          kobj_attr_store+0x30/0x50
          sysfs_kf_write+0x64/0x90
          kernfs_fop_write+0x1b0/0x290
          __vfs_write+0x3c/0x70
          vfs_write+0xd0/0x260
          ksys_write+0xdc/0x130
          system_call+0x5c/0x68
      
      Taking closer look at the code, I can see that for_each_drmem_lmb is a
      macro expanding into `for (lmb = &drmem_info->lmbs[0]; lmb <=
      &drmem_info->lmbs[drmem_info->n_lmbs - 1]; lmb++)`. When drmem_info->lmbs
      is NULL, the loop would iterate through the whole address range if it
      weren't stopped by the NULL pointer dereference on the next line.
      
      This patch aligns for_each_drmem_lmb and for_each_drmem_lmb_in_range
      macro behavior with the common C semantics, where the end marker does
      not belong to the scanned range, and alters get_lmb_range() semantics.
      As a side effect, the wraparound observed in the crash is prevented.
      
      Fixes: 6c6ea537 ("powerpc/mm: Separate ibm, dynamic-memory data from DT format")
      Cc: stable@vger.kernel.org # v4.16+
      Signed-off-by: default avatarLibor Pechacek <lpechacek@suse.cz>
      Signed-off-by: default avatarMichal Suchanek <msuchanek@suse.de>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      Link: https://lore.kernel.org/r/20200131132829.10281-1-msuchanek@suse.de
      a83836db