- 21 Jun, 2021 13 commits
-
-
Christophe Leroy authored
In addition to the set_memory_xx() functions which allows to change the memory attributes of not (yet) used memory regions, implement a set_memory_attr() function to: - set the final memory protection after init on currently used kernel regions. - enable/disable kernel memory regions in the scope of DEBUG_PAGEALLOC. Unlike the set_memory_xx() which can act in three step as the regions are unused, this function must modify 'on the fly' as the kernel is executing from them. At the moment only PPC32 will use it and changing page attributes on the fly is not an issue. Reported-by:
kbuild test robot <lkp@intel.com> [ruscur: cast "data" to unsigned long instead of int] Signed-off-by:
Christophe Leroy <christophe.leroy@csgroup.eu> Signed-off-by:
Russell Currey <ruscur@russell.cc> Signed-off-by:
Jordan Niethe <jniethe5@gmail.com> Signed-off-by:
Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20210609013431.9805-9-jniethe5@gmail.com
-
Russell Currey authored
To enable strict module RWX on powerpc, set: CONFIG_STRICT_MODULE_RWX=y You should also have CONFIG_STRICT_KERNEL_RWX=y set to have any real security benefit. ARCH_HAS_STRICT_MODULE_RWX is set to require ARCH_HAS_STRICT_KERNEL_RWX. This is due to a quirk in arch/Kconfig and arch/powerpc/Kconfig that makes STRICT_MODULE_RWX *on by default* in configurations where STRICT_KERNEL_RWX is *unavailable*. Since this doesn't make much sense, and module RWX without kernel RWX doesn't make much sense, having the same dependencies as kernel RWX works around this problem. Book3s/32 603 and 604 core processors are not able to write protect kernel pages so do not set ARCH_HAS_STRICT_MODULE_RWX for Book3s/32. [jpn: - predicate on !PPC_BOOK3S_604 - make module_alloc() use PAGE_KERNEL protection] Signed-off-by: -
Jordan Niethe authored
Add the necessary call to bpf_jit_binary_lock_ro() to remove write and add exec permissions to the JIT image after it has finished being written. Without CONFIG_STRICT_MODULE_RWX the image will be writable and executable until the call to bpf_jit_binary_lock_ro(). Signed-off-by:
-
Jordan Niethe authored
Commit 74451e66 ("bpf: make jited programs visible in traces") added a default bpf_jit_free() implementation. Powerpc did not use the default bpf_jit_free() as powerpc did not set the images read-only. The default bpf_jit_free() called bpf_jit_binary_unlock_ro() is why it could not be used for powerpc. Commit d53d2f78 ("bpf: Use vmalloc special flag") moved keeping track of read-only memory to vmalloc. This included removing bpf_jit_binary_unlock_ro(). Therefore there is no reason powerpc needs its own bpf_jit_free(). Remove it. Signed-off-by:
-
Russell Currey authored
Add the arch specific insn page allocator for powerpc. This allocates ROX pages if STRICT_KERNEL_RWX is enabled. These pages are only written to with patch_instruction() which is able to write RO pages. Signed-off-by:
Daniel Axtens <dja@axtens.net> Signed-off-by:
-
Jordan Niethe authored
Make module_alloc() use PAGE_KERNEL protections instead of PAGE_KERNEL_EXEX if Strict Module RWX is enabled. Signed-off-by:
-
Jordan Niethe authored
setup_text_poke_area() is a late init call so it runs before mark_rodata_ro() and after the init calls. This lets all the init code patching simply write to their locations. In the future, kprobes is going to allocate its instruction pages RO which means they will need setup_text__poke_area() to have been already called for their code patching. However, init_kprobes() (which allocates and patches some instruction pages) is an early init call so it happens before setup_text__poke_area(). start_kernel() calls poking_init() before any of the init calls. On powerpc, poking_init() is currently a nop. setup_text_poke_area() relies on kernel virtual memory, cpu hotplug and per_cpu_areas being setup. setup_per_cpu_areas(), boot_cpu_hotplug_init() and mm_init() are called before poking_init(). Turn setup_text_poke_area() into poking_init(). Signed-off-by:
-
Russell Currey authored
The set_memory_{ro/rw/nx/x}() functions are required for STRICT_MODULE_RWX, and are generally useful primitives to have. This implementation is designed to be generic across powerpc's many MMUs. It's possible that this could be optimised to be faster for specific MMUs. This implementation does not handle cases where the caller is attempting to change the mapping of the page it is executing from, or if another CPU is concurrently using the page being altered. These cases likely shouldn't happen, but a more complex implementation with MMU-specific code could safely handle them. On hash, the linear mapping is not kept in the linux pagetable, so this will not change the protection if used on that range. Currently these functions are not used on the linear map so just WARN for now. apply_to_existing_page_range() does not work on huge pages so for now disallow changing the protection of huge pages. [jpn: - Allow set memory functions to be used without Strict RWX - Hash: Disallow certain regions - Have change_page_attr() take function pointers to manipulate ptes - Radix: Add ptesync after set_pte_at()] Signed-off-by: -
Nicholas Piggin authored
This allows the hypervisor / firmware to describe this workarounds to the guest. Signed-off-by:
Nicholas Piggin <npiggin@gmail.com> Signed-off-by:
-
Nicholas Piggin authored
Rather than tying this mitigation to RFI L1D flush requirement, add a new bit for it. Signed-off-by:
-
Nicholas Piggin authored
This allows the hypervisor / firmware to describe these workarounds to the guest. Signed-off-by:
-
Nicholas Piggin authored
This prevents spurious rebuilds of the lds and then wrappers. Signed-off-by:
-
Nicholas Piggin authored
POWER9 and POWER10 asynchronous machine checks due to stores have their cause reported in SRR1 but SRR1[42] is set, which in other cases indicates DSISR cause. Check for these cases and clear SRR1[42], so the cause matching uses the i-side (SRR1) table. Fixes: 7b9f71f9 ("powerpc/64s: POWER9 machine check handler") Fixes: 201220bb ("powerpc/powernv: Machine check handler for POWER10") Signed-off-by:
-
- 20 Jun, 2021 17 commits
-
-
Haren Myneni authored
The user space uses /dev/crypto/nx-gzip interface to setup VAS windows, create paste mapping and close windows. This patch adds changes to create/remove this interface with VAS register/unregister functions on PowerVM platform. Signed-off-by:
Haren Myneni <haren@linux.ibm.com> Acked-by:
Herbert Xu <herbert@gondor.apana.org.au> Acked-by:
-
Haren Myneni authored
Export NX-GZIP capabilities to usrespace in sysfs /sys/devices/vio/ibm,compression-v1/nx_gzip_caps directory. These are queried by userspace accelerator libraries to set minimum length heuristics and maximum limits on request sizes. NX-GZIP capabilities: min_compress_len /*Recommended minimum compress length in bytes*/ min_decompress_len /*Recommended minimum decompress length in bytes*/ req_max_processed_len /* Maximum number of bytes processed in one request */ NX will return RMA_Reject if the request buffer size is greater than req_max_processed_len. Signed-off-by:
-
Haren Myneni authored
The hypervisor provides different NX capabilities that it supports. These capabilities such as recommended minimum compression / decompression lengths and the maximum request buffer size in bytes are used to define the user space NX request. NX will reject the request if the buffer size is more than the maximum buffer size. Whereas compression / decompression lengths are recommended values for better performance. Changes to get NX overall capabilities which points to the specific features that the hypervisor supports. Then retrieve the capabilities for the specific feature (available only for NXGZIP). Signed-off-by:
-
Haren Myneni authored
Rename nx-842-pseries.c to nx-common-pseries.c to add code for new GZIP compression type. The actual functionality is not changed in this patch. Signed-off-by:
-
Haren Myneni authored
NX generates an interrupt when sees a fault on the user space buffer and the hypervisor forwards that interrupt to OS. Then the kernel handles the interrupt by issuing H_GET_NX_FAULT hcall to retrieve the fault CRB information. This patch also adds changes to setup and free IRQ per each window and also handles the fault by updating the CSB. Signed-off-by:
-
Haren Myneni authored
This patch adds VAS window allocatioa/close with the corresponding hcalls. Also changes to integrate with the existing user space VAS API and provide register/unregister functions to NX pseries driver. The driver register function is used to create the user space interface (/dev/crypto/nx-gzip) and unregister to remove this entry. The user space process opens this device node and makes an ioctl to allocate VAS window. The close interface is used to deallocate window. Signed-off-by:
-
Haren Myneni authored
The hypervisor provides VAS capabilities for GZIP default and QoS features. These capabilities gives information for the specific features such as total number of credits available in LPAR, maximum credits allowed per window, maximum credits allowed in LPAR, whether usermode copy/paste is supported, and etc. This patch adds the following: - Retrieve all features that are provided by hypervisor using H_QUERY_VAS_CAPABILITIES hcall with 0 as feature type. - Retrieve capabilities for the specific feature using the same hcall and the feature type (1 for QoS and 2 for default type). Signed-off-by:
-
Haren Myneni authored
This patch adds the following hcall wrapper functions to allocate, modify and deallocate VAS windows, and retrieve VAS capabilities. H_ALLOCATE_VAS_WINDOW: Allocate VAS window H_DEALLOCATE_VAS_WINDOW: Close VAS window H_MODIFY_VAS_WINDOW: Setup window before using H_QUERY_VAS_CAPABILITIES: Get VAS capabilities Signed-off-by:
-
Haren Myneni authored
PowerVM introduces two different type of credits: Default and Quality of service (QoS). The total number of default credits available on each LPAR depends on CPU resources configured. But these credits can be shared or over-committed across LPARs in shared mode which can result in paste command failure (RMA_busy). To avoid NX HW contention, the hypervisor ntroduces QoS credit type which makes sure guaranteed access to NX esources. The system admins can assign QoS credits or each LPAR via HMC. Default credit type is used to allocate a VAS window by default as on PowerVM implementation. But the process can pass VAS_TX_WIN_FLAG_QOS_CREDIT flag with VAS_TX_WIN_OPEN ioctl to open QoS type window. Signed-off-by:
-
Haren Myneni authored
This patch adds hcalls and other definitions. Also define structs that are used in VAS implementation on PowerVM. Signed-off-by:
-
Haren Myneni authored
Many elements in vas_struct are used on PowerNV and PowerVM platforms. vas_window is used for both TX and RX windows on PowerNV and for TX windows on PowerVM. So some elements are specific to these platforms. So this patch defines common vas_window and platform specific window structs (pnv_vas_window on PowerNV). Also adds the corresponding changes in PowerNV vas code. Signed-off-by:
-
Haren Myneni authored
If a coprocessor encounters an error translating an address, the VAS will cause an interrupt in the host. The kernel processes the fault by updating CSB. This functionality is same for both powerNV and pseries. So this patch moves these functions to common vas-api.c and the actual functionality is not changed. Signed-off-by:
-
Haren Myneni authored
Take pid and mm references when each window opens and drops during close. This functionality is needed for powerNV and pseries. So this patch defines the existing code as functions in common book3s platform vas-api.c Signed-off-by:
-
Haren Myneni authored
PowerNV uses registers to open/close VAS windows, and getting the paste address. Whereas the hypervisor calls are used on PowerVM. This patch adds the platform specific user space window operations and register with the common VAS user space interface. Signed-off-by:
-
Haren Myneni authored
powerNV and pseries drivers register / unregister to the corresponding platform specific VAS separately. Then these VAS functions call the common API with the specific window operations. So rename powerNV VAS API register/unregister functions. Signed-off-by:
-
Haren Myneni authored
The pseries platform will share vas and nx code and interfaces with the PowerNV platform, so create the arch/powerpc/platforms/book3s/ directory and move VAS API code there. Functionality is not changed. Signed-off-by:
-
Haren Myneni authored
The kernel handles the NX fault by updating CSB or sending signal to process. In multithread applications, children can open VAS windows and can exit without closing them. But the parent can continue to send NX requests with these windows. To prevent pid reuse, reference will be taken on pid and tgid when the window is opened and release them during window close. The current code is not releasing the tgid reference which can cause pid leak and this patch fixes the issue. Fixes: db1c08a7 ("powerpc/vas: Take reference to PID and mm for user space windows") Cc: stable@vger.kernel.org # 5.8+ Reported-by:
-
- 17 Jun, 2021 3 commits
-
-
Michael Ellerman authored
Merge some powerpc KVM patches from our topic branch. In particular this brings in Nick's big series rewriting parts of the guest entry/exit path in C. Conflicts: arch/powerpc/kernel/security.c arch/powerpc/kvm/book3s_hv_rmhandlers.S
-
Aneesh Kumar K.V authored
Update _tlbiel_pid() such that we can avoid build errors like below when using this function in other places. arch/powerpc/mm/book3s64/radix_tlb.c: In function ‘__radix__flush_tlb_range_psize’: arch/powerpc/mm/book3s64/radix_tlb.c:114:2: warning: ‘asm’ operand 3 probably does not match constraints 114 | asm volatile(PPC_TLBIEL(%0, %4, %3, %2, %1) | ^~~ arch/powerpc/mm/book3s64/radix_tlb.c:114:2: error: impossible constraint in ‘asm’ make[4]: *** [scripts/Makefile.build:271: arch/powerpc/mm/book3s64/radix_tlb.o] Error 1 m With this fix, we can also drop the __always_inline in __radix_flush_tlb_range_psize which was added by commit e12d6d7d ("powerpc/mm/radix: mark __radix__flush_tlb_range_psize() as __always_inline") Signed-off-by:Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com> Reviewed-by:
-
Michael Ellerman authored
When delivering a signal to a sigaction style handler (SA_SIGINFO), we pass pointers to the siginfo and ucontext via r4 and r5. Currently we populate the values in those registers by reading the pointers out of the sigframe in user memory, even though the values in user memory were written by the kernel just prior: unsafe_put_user(&frame->info, &frame->pinfo, badframe_block); unsafe_put_user(&frame->uc, &frame->puc, badframe_block); ... if (ksig->ka.sa.sa_flags & SA_SIGINFO) { err |= get_user(regs->gpr[4], (unsigned long __user *)&frame->pinfo); err |= get_user(regs->gpr[5], (unsigned long __user *)&frame->puc); ie. we write &frame->info into frame->pinfo, and then read frame->pinfo back into r4, and similarly for &frame->uc. The code has always been like this, since linux-fullhistory commit d4f2d95eca2c ("Forward port of 2.4 ppc64 signal changes."). There's no reason for us to read the values back from user memory, rather than just setting the value in the gpr[4/5] directly. In fact reading the value back from user memory opens up the possibility of another user thread changing the values before we read them back. Although any process doing that would be racing against the kernel delivering the signal, and would risk corrupting the stack, so that would be a userspace bug. Note that this is 64-bit only code, so there's no subtlety with the size of pointers differing between kernel and user. Also the frame variable is not modified to point elsewhere during the function. In the past reading the values back from user memory was not costly, but now that we have KUAP on some CPUs it is, so we'd rather avoid it for that reason too. So change the code to just set the values directly, using the same values we have written to the sigframe previously in the function. Note also that this matches what our 32-bit signal code does. Using a version of will-it-scale's signal1_threads that sets SA_SIGINFO, this results in a ~4% increase in signals per second on a Power9, from 229,777 to 239,766. Reviewed-by:
-
- 16 Jun, 2021 7 commits
-
-
Sudeep Holla authored
This implementation uses spin_until_cond in wd_smp_lock including neither linux/processor.h nor asm/processor.h This patch includes linux/processor.h here for spin_until_cond usage. Signed-off-by:
Sudeep Holla <sudeep.holla@arm.com> Signed-off-by:
-
Sudeep Holla authored
linux/processor.h has exactly same defination for spin_until_cond. Drop the redundant defination in asm/processor.h Signed-off-by:
-
Christophe Leroy authored
PPC_TRANSACTIONAL_MEM is only on book3s/64 SPE is only on booke PPC_TRANSACTIONAL_MEM selects ALTIVEC and VSX Therefore, within PPC_TRANSACTIONAL_MEM sections, ALTIVEC and VSX are always defined while SPE never is. Remove all SPE code and all #ifdef ALTIVEC and VSX in tm functions. Signed-off-by:
-
Christophe Leroy authored
book3s/32 and 8xx don't use vmalloc for modules. Print the modules area at startup as part of the virtual memory layout: [ 0.000000] Kernel virtual memory layout: [ 0.000000] * 0xffafc000..0xffffc000 : fixmap [ 0.000000] * 0xc9000000..0xffafc000 : vmalloc & ioremap [ 0.000000] * 0xb0000000..0xc0000000 : modules [ 0.000000] Memory: 118480K/131072K available (7152K kernel code, 2320K rwdata, 1328K rodata, 368K init, 854K bss, 12592K reserved, 0K cma-reserved) Signed-off-by:
-
Daniel Axtens authored
Make our stack-walking code KASAN-safe by using __no_sanitize_address. Generic code, arm64, s390 and x86 all make accesses unchecked for similar sorts of reasons: when unwinding a stack, we might touch memory that KASAN has marked as being out-of-bounds. In ppc64 KASAN development, I hit this sometimes when checking for an exception frame - because we're checking an arbitrary offset into the stack frame. See commit 20955746 ("s390/kasan: avoid false positives during stack unwind"), commit bcaf669b ("arm64: disable kasan when accessing frame->fp in unwind_frame"), commit 91e08ab0 ("x86/dumpstack: Prevent KASAN false positive warnings") and commit 6e22c836 ("tracing, kasan: Silence Kasan warning in check_stack of stack_tracer"). Signed-off-by:
-
Athira Rajeev authored
With the MMCR0 control bit (PMCCEXT) in ISA v3.1, read access to group B registers is restricted when MMCR0 PMCC=0b00. In other platforms (like power9), the older behaviour works where group B PMU SPRs are readable. Patch creates a selftest which verifies that the test takes a SIGILL when attempting to read PMU registers via helper function "dump_ebb_state" for ISA v3.1. Signed-off-by:
Athira Rajeev <atrajeev@linux.vnet.ibm.com> Tested-by:
Nageswara R Sastry <rnsastry@linux.ibm.com <mailto:rnsastry@linux.ibm.com>> Signed-off-by:
-
Athira Rajeev authored
The "no_handler_test" in ebb selftests attempts to read the PMU registers twice via helper function "dump_ebb_state". First dump is just before closing of event and the second invocation is done after closing of the event. The original intention of second dump_ebb_state was to dump the state of registers at the end of the test when the counters are frozen. But this will be achieved with the first call itself since sample period is set to low value and PMU will be frozen by then. Hence patch removes the dump which was done before closing of the event. Reported-by:
Shirisha Ganta <shirisha.ganta1@ibm.com> Signed-off-by:
-
