Commit 24c907e7 authored by Lin RuiFeng's avatar Lin RuiFeng
Browse files

powerpc/pseries: Fix scv instruction crash with kexec 

stable inclusion
from stable-v6.1.98
commit c550679d604798d9fed8a5b2bb5693448a25407c
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAHJIE
CVE: CVE-2024-42230

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c550679d604798d9fed8a5b2bb5693448a25407c



--------------------------------

commit 21a741eb75f80397e5f7d3739e24d7d75e619011 upstream.

kexec on pseries disables AIL (reloc_on_exc), required for scv
instruction support, before other CPUs have been shut down. This means
they can execute scv instructions after AIL is disabled, which causes an
interrupt at an unexpected entry location that crashes the kernel.

Change the kexec sequence to disable AIL after other CPUs have been
brought down.

As a refresher, the real-mode scv interrupt vector is 0x17000, and the
fixed-location head code probably couldn't easily deal with implementing
such high addresses so it was just decided not to support that interrupt
at all.

Fixes: 7fa95f9a ("powerpc/64s: system call support for scv/rfscv
instructions")
Cc: stable@vger.kernel.org # v5.9+
Reported-by: default avatarSourabh Jain <sourabhjain@linux.ibm.com>
Closes:
https://lore.kernel.org/3b4b2943-49ad-4619-b195-bc416f1d1409@linux.ibm.com


Signed-off-by: default avatarNicholas Piggin <npiggin@gmail.com>
Tested-by: default avatarGautam Menghani <gautam@linux.ibm.com>
Tested-by: default avatarSourabh Jain <sourabhjain@linux.ibm.com>
Link: https://msgid.link/20240625134047.298759-1-npiggin@gmail.com


Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Conflicts:
	arch/powerpc/kexec/core_64.c
	arch/powerpc/platforms/pseries/kexec.c
	arch/powerpc/platforms/pseries/pseries.h
	arch/powerpc/platforms/pseries/setup.c
[Fix context conflicts because the content of c550679d604798d9fed8a5b2bb5693448a25407c
is based on commit 2ab2d579, 2ab2d579
moves function  "pSeries_machine_kexec" from "arch/powerpc/platforms/pseries/setup.c" to
"arch/powerpc/platforms/pseries/kexec.c". But 2ab2d579 is not
incorporated in this version]
Signed-off-by: default avatarLin RuiFeng <linruifeng4@huawei.com>
parent 28a1e2d3

arch/powerpc/kexec/core_64.c

+11 −0
Original line number Diff line number Diff line
@@ -25,6 +25,7 @@ 
#include <asm/paca.h>

#include <asm/mmu.h>

#include <asm/sections.h>	/* _end */

#include <asm/setup.h>

#include <asm/prom.h>

#include <asm/smp.h>

#include <asm/hw_breakpoint.h>
@@ -313,6 +314,16 @@ void default_machine_kexec(struct kimage *image) 
	if (!kdump_in_progress())

		kexec_prepare_cpus();



	#ifdef CONFIG_PPC_PSERIES

		/*

		 * This must be done after other CPUs have shut down, otherwise they

		 * could execute the 'scv' instruction, which is not supported with

		 * reloc disabled (see configure_exceptions()).

		 */

		if (firmware_has_feature(FW_FEATURE_SET_MODE))

			pseries_disable_reloc_on_exc();

	#endif



	printk("kexec: Starting switchover sequence.\n");



	/* switch to a staticly allocated stack.  Based on irq stack code.

arch/powerpc/platforms/pseries/setup.c

+0 −11
Original line number Diff line number Diff line
@@ -409,16 +409,6 @@ void pseries_disable_reloc_on_exc(void) 
}

EXPORT_SYMBOL(pseries_disable_reloc_on_exc);



#ifdef CONFIG_KEXEC_CORE

static void pSeries_machine_kexec(struct kimage *image)

{

	if (firmware_has_feature(FW_FEATURE_SET_MODE))

		pseries_disable_reloc_on_exc();



	default_machine_kexec(image);

}

#endif



#ifdef __LITTLE_ENDIAN__

void pseries_big_endian_exceptions(void)

{
@@ -1071,7 +1061,6 @@ define_machine(pseries) { 
	.machine_check_early	= pseries_machine_check_realmode,

	.machine_check_exception = pSeries_machine_check_exception,

#ifdef CONFIG_KEXEC_CORE

	.machine_kexec          = pSeries_machine_kexec,

	.kexec_cpu_down         = pseries_kexec_cpu_down,

#endif

#ifdef CONFIG_MEMORY_HOTPLUG_SPARSE