1. 28 Nov, 2016 8 commits
  2. 26 Nov, 2016 1 commit
    • Balbir Singh's avatar
      powerpc/mm/radix: Prevent kernel execution of user space · 3b10d009
      Balbir Singh authored
      ISA 3 defines new encoded access authority that allows instruction
      access prevention in privileged mode and allows normal access
      to problem state. This patch just enables IAMR (Instruction Authority
      Mask Register), enabling AMR would require more work.
      
      I've tested this with a buggy driver and a simple payload. The payload
      is specific to the build I've tested.
      
      mpe: Also tested with LKDTM:
      
        # echo EXEC_USERSPACE > /sys/kernel/debug/provoke-crash/DIRECT
        lkdtm: Performing direct entry EXEC_USERSPACE
        lkdtm: attempting ok execution at c0000000005bf560
        lkdtm: attempting bad execution at 00003fff8d940000
        Unable to handle kernel paging request for instruction fetch
        Faulting instruction address: 0x3fff8d940000
        Oops: Kernel access of bad area, sig: 11 [#1]
        NIP: 00003fff8d940000 LR: c0000000005bfa58 CTR: 00003fff8d940000
        REGS: c0000000f1fcf900 TRAP: 0400   Not tainted  (4.9.0-rc5-compiler_gcc-6.2.0-00109-g956dbc06232a)
        MSR: 9000000010009033 <SF,HV,EE,ME,IR,DR,RI,LE>  CR: 48002222  XER: 00000000
        ...
        Call Trace:
          lkdtm_EXEC_USERSPACE+0x104/0x120 (unreliable)
          lkdtm_do_action+0x3c/0x80
          direct_entry+0x100/0x1b0
          full_proxy_write+0x94/0x100
          __vfs_write+0x3c/0x1b0
          vfs_write+0xcc/0x230
          SyS_write+0x60/0x110
          system_call+0x38/0xfc
      Signed-off-by: default avatarBalbir Singh <bsingharora@gmail.com>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      3b10d009
  3. 25 Nov, 2016 7 commits
  4. 24 Nov, 2016 1 commit
  5. 23 Nov, 2016 8 commits
  6. 22 Nov, 2016 8 commits
  7. 21 Nov, 2016 1 commit
  8. 18 Nov, 2016 6 commits
    • Michael Ellerman's avatar
      powerpc/64: Used named initialisers for ibm_pa_features · e9eb0278
      Michael Ellerman authored
      The ibm_pa_features array consists of structures that describe which bit
      and byte in the ibm,pa-features property toggles one or more flags in
      either the CPU, MMU, or user visible feature flags.
      
      Each one consists of 7 values, which are all unsigned long, int or char,
      meaning the compiler gives us no warning if we assign the wrong values
      to the wrong elements. In fact we have had a bug here in the past, where
      we were setting incorrect bits, see commit 6997e57d ("powerpc:
      scan_features() updates incorrect bits for REAL_LE").
      
      So switch to using named initialisers for the structure elements, to
      reduce the likelihood of future bugs, and hopefully improve readability
      also.
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      Reviewed-by: default avatarBalbir Singh <bsingharora@gmail.com>
      e9eb0278
    • Michael Ellerman's avatar
      powerpc/configs: Turn on PPC crypto implementations in the server defconfigs · 3baad970
      Michael Ellerman authored
      These are the PPC optimised versions of various crypto algorithms, so we
      should turn them on by default to get test coverage.
      Suggested-by: default avatarNicholas Piggin <npiggin@gmail.com>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      3baad970
    • Michael Ellerman's avatar
      powerpc/pseries: Disable IBMEBUS on little endian builds · 90ee8762
      Michael Ellerman authored
      The IBMEBUS code supports the GX bus found on Power7 and earlier CPUs.
      On Power8 it has been replaced, and so we have no need for it.
      
      We don't actually have a config symbol for Power8 vs Power7 etc., but
      we only support booting little endian on Power8 or later, so use that as
      a reasonable approximation.
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      90ee8762
    • Michael Ellerman's avatar
      powerpc/pseries: Move ibmebus.c into platforms pseries · 30757de2
      Michael Ellerman authored
      ibmebus.c is pseries only code, so move it in there.
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      30757de2
    • Michael Ellerman's avatar
      powerpc/pseries: Move vio.c into platforms pseries · 139ac5af
      Michael Ellerman authored
      vio.c is pseries only code, so move it in there.
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      139ac5af
    • Frederic Barrat's avatar
      cxl: Fix coredump generation when cxl_get_fd() is used · bdecf76e
      Frederic Barrat authored
      If a process dumps core while owning a cxl file descriptor obtained
      from an AFU driver (e.g. cxlflash) through the cxl_get_fd() API, the
      following error occurs:
      
        [  868.027591] Unable to handle kernel paging request for data at address ...
        [  868.027778] Faulting instruction address: 0xc00000000035edb0
        cpu 0x8c: Vector: 300 (Data Access) at [c000003c688275e0]
            pc: c00000000035edb0: elf_core_dump+0xd60/0x1300
            lr: c00000000035ed80: elf_core_dump+0xd30/0x1300
            sp: c000003c68827860
           msr: 9000000100009033
           dar: c
        dsisr: 40000000
         current = 0xc000003c68780000
         paca    = 0xc000000001b73200   softe: 0        irq_happened: 0x01
            pid   = 46725, comm = hxesurelock
        enter ? for help
        [c000003c68827a60] c00000000036948c do_coredump+0xcec/0x11e0
        [c000003c68827c20] c0000000000ce9e0 get_signal+0x540/0x7b0
        [c000003c68827d10] c000000000017354 do_signal+0x54/0x2b0
        [c000003c68827e00] c00000000001777c do_notify_resume+0xbc/0xd0
        [c000003c68827e30] c000000000009838 ret_from_except_lite+0x64/0x68
        --- Exception: 300 (Data Access) at 00003fff98ad2918
      
      The root cause is that the address_space structure for the file
      doesn't define a 'host' member.
      
      When cxl allocates a file descriptor, it's using the anonymous inode
      to back the file, but allocates a private address_space for each
      context. The private address_space allows to track memory allocation
      for each context. cxl doesn't define the 'host' member of the address
      space, i.e. the inode. We don't want to define it as the anonymous
      inode, since there's no longer a 1-to-1 relation between address_space
      and inode.
      
      To fix it, instead of using the anonymous inode, we introduce a simple
      pseudo filesystem so that cxl can allocate its own inodes. So we now
      have one inode for each file and address_space. The pseudo filesystem
      is only mounted on the first allocation of a file descriptor by
      cxl_get_fd().
      
      Tested with cxlflash.
      Signed-off-by: default avatarFrederic Barrat <fbarrat@linux.vnet.ibm.com>
      Reviewed-by: default avatarMatthew R. Ochs <mrochs@linux.vnet.ibm.com>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      bdecf76e