• Christophe Leroy's avatar
    powerpc: Fix kexec failure on book3s/32 · 6c284228
    Christophe Leroy authored
    In the old days, _PAGE_EXEC didn't exist on 6xx aka book3s/32.
    Therefore, allthough __mapin_ram_chunk() was already mapping kernel
    text with PAGE_KERNEL_TEXT and the rest with PAGE_KERNEL, the entire
    memory was executable. Part of the memory (first 512kbytes) was
    mapped with BATs instead of page table, but it was also entirely
    mapped as executable.
    
    In commit 385e89d5 ("powerpc/mm: add exec protection on
    powerpc 603"), we started adding exec protection to some 6xx, namely
    the 603, for pages mapped via pagetables.
    
    Then, in commit 63b2bc61 ("powerpc/mm/32s: Use BATs for
    STRICT_KERNEL_RWX"), the exec protection was extended to BAT mapped
    memory, so that really only the kernel text could be executed.
    
    The problem here is that kexec is based on copying some code into
    upper part of memory then executing it from there in order to install
    a fresh new kernel at its definitive location.
    
    However, the code is position independant and first part of it is
    just there to deactivate the MMU and jump to the second part. So it
    is possible to run this first part inplace instead of running the
    copy. Once the MMU is off, there is no protection anymore and the
    second part of the code will just run as before.
    Reported-by: default avatarAaro Koskinen <aaro.koskinen@iki.fi>
    Fixes: 63b2bc61 ("powerpc/mm/32s: Use BATs for STRICT_KERNEL_RWX")
    Cc: stable@vger.kernel.org # v5.1+
    Signed-off-by: default avatarChristophe Leroy <christophe.leroy@c-s.fr>
    Tested-by: default avatarAaro Koskinen <aaro.koskinen@iki.fi>
    Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
    6c284228
kexec.h 4.16 KB