mirror of
https://github.com/edk2-porting/linux-next.git
synced 2025-01-04 11:43:54 +08:00
6c284228eb
In the old days, _PAGE_EXEC didn't exist on 6xx aka book3s/32. Therefore, allthough __mapin_ram_chunk() was already mapping kernel text with PAGE_KERNEL_TEXT and the rest with PAGE_KERNEL, the entire memory was executable. Part of the memory (first 512kbytes) was mapped with BATs instead of page table, but it was also entirely mapped as executable. In commit385e89d5b2("powerpc/mm: add exec protection on powerpc 603"), we started adding exec protection to some 6xx, namely the 603, for pages mapped via pagetables. Then, in commit63b2bc6195("powerpc/mm/32s: Use BATs for STRICT_KERNEL_RWX"), the exec protection was extended to BAT mapped memory, so that really only the kernel text could be executed. The problem here is that kexec is based on copying some code into upper part of memory then executing it from there in order to install a fresh new kernel at its definitive location. However, the code is position independant and first part of it is just there to deactivate the MMU and jump to the second part. So it is possible to run this first part inplace instead of running the copy. Once the MMU is off, there is no protection anymore and the second part of the code will just run as before. Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi> Fixes:63b2bc6195("powerpc/mm/32s: Use BATs for STRICT_KERNEL_RWX") Cc: stable@vger.kernel.org # v5.1+ Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr> Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
72 lines
2.1 KiB
C
72 lines
2.1 KiB
C
/*
|
|
* PPC32 code to handle Linux booting another kernel.
|
|
*
|
|
* Copyright (C) 2002-2003 Eric Biederman <ebiederm@xmission.com>
|
|
* GameCube/ppc32 port Copyright (C) 2004 Albert Herranz
|
|
* Copyright (C) 2005 IBM Corporation.
|
|
*
|
|
* This source code is licensed under the GNU General Public License,
|
|
* Version 2. See the file COPYING for more details.
|
|
*/
|
|
|
|
#include <linux/kexec.h>
|
|
#include <linux/mm.h>
|
|
#include <linux/string.h>
|
|
#include <asm/cacheflush.h>
|
|
#include <asm/hw_irq.h>
|
|
#include <asm/io.h>
|
|
|
|
typedef void (*relocate_new_kernel_t)(
|
|
unsigned long indirection_page,
|
|
unsigned long reboot_code_buffer,
|
|
unsigned long start_address) __noreturn;
|
|
|
|
/*
|
|
* This is a generic machine_kexec function suitable at least for
|
|
* non-OpenFirmware embedded platforms.
|
|
* It merely copies the image relocation code to the control page and
|
|
* jumps to it.
|
|
* A platform specific function may just call this one.
|
|
*/
|
|
void default_machine_kexec(struct kimage *image)
|
|
{
|
|
extern const unsigned int relocate_new_kernel_size;
|
|
unsigned long page_list;
|
|
unsigned long reboot_code_buffer, reboot_code_buffer_phys;
|
|
relocate_new_kernel_t rnk;
|
|
|
|
/* Interrupts aren't acceptable while we reboot */
|
|
local_irq_disable();
|
|
|
|
/* mask each interrupt so we are in a more sane state for the
|
|
* kexec kernel */
|
|
machine_kexec_mask_interrupts();
|
|
|
|
page_list = image->head;
|
|
|
|
/* we need both effective and real address here */
|
|
reboot_code_buffer =
|
|
(unsigned long)page_address(image->control_code_page);
|
|
reboot_code_buffer_phys = virt_to_phys((void *)reboot_code_buffer);
|
|
|
|
/* copy our kernel relocation code to the control code page */
|
|
memcpy((void *)reboot_code_buffer, relocate_new_kernel,
|
|
relocate_new_kernel_size);
|
|
|
|
flush_icache_range(reboot_code_buffer,
|
|
reboot_code_buffer + KEXEC_CONTROL_PAGE_SIZE);
|
|
printk(KERN_INFO "Bye!\n");
|
|
|
|
if (!IS_ENABLED(CONFIG_FSL_BOOKE) && !IS_ENABLED(CONFIG_44x))
|
|
relocate_new_kernel(page_list, reboot_code_buffer_phys, image->start);
|
|
|
|
/* now call it */
|
|
rnk = (relocate_new_kernel_t) reboot_code_buffer;
|
|
(*rnk)(page_list, reboot_code_buffer_phys, image->start);
|
|
}
|
|
|
|
int default_machine_kexec_prepare(struct kimage *image)
|
|
{
|
|
return 0;
|
|
}
|