• Michael Ellerman's avatar
    powerpc/64: Prevent stack protection in early boot · 7053f80d
    Michael Ellerman authored
    The previous commit reduced the amount of code that is run before we
    setup a paca. However there are still a few remaining functions that
    run with no paca, or worse, with an arbitrary value in r13 that will
    be used as a paca pointer.
    
    In particular the stack protector canary is stored in the paca, so if
    stack protector is activated for any of these functions we will read
    the stack canary from wherever r13 points. If r13 happens to point
    outside of memory we will get a machine check / checkstop.
    
    For example if we modify initialise_paca() to trigger stack
    protection, and then boot in the mambo simulator with r13 poisoned in
    skiboot before calling the kernel:
    
      DEBUG: 19952232: (19952232): INSTRUCTION: PC=0xC0000000191FC1E8: [0x3C4C006D]: addis   r2,r12,0x6D [fetch]
      DEBUG: 19952236: (19952236): INSTRUCTION: PC=0xC00000001807EAD8: [0x7D8802A6]: mflr    r12 [fetch]
      FATAL ERROR: 19952276: (19952276): Check Stop for 0:0: Machine Check with ME bit of MSR off
      DEBUG: 19952276: (19952276): INSTRUCTION: PC=0xC0000000191FCA7C: [0xE90D0CF8]: ld      r8,0xCF8(r13) [Instruction Failed]
      INFO: 19952276: (19952277): ** Execution stopped: Mambo Error, Machine Check Stop,  **
      systemsim % bt
      pc:                             0xC0000000191FCA7C      initialise_paca+0x54
      lr:                             0xC0000000191FC22C      early_setup+0x44
      stack:0x00000000198CBED0        0x0     +0x0
      stack:0x00000000198CBF00        0xC0000000191FC22C      early_setup+0x44
      stack:0x00000000198CBF90        0x1801C968      +0x1801C968
    
    So annotate the relevant functions to ensure stack protection is never
    enabled for them.
    
    Fixes: 06ec27ae ("powerpc/64: add stack protector support")
    Cc: stable@vger.kernel.org # v4.20+
    Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
    Link: https://lore.kernel.org/r/20200320032116.1024773-2-mpe@ellerman.id.au
    7053f80d
setup_64.c 25.3 KB