Re: [PATCH] powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()

On Sun, Aug 30, 2026 at 08:24:30PM +0530, Ritesh Harjani (IBM) wrote:
> KUAP means kernel cannot touch user memory unless it explicitly is
> enabled. In the kernel it should stay AMR_KUAP_BLOCKED. While returning
> to userspace just before RFI, kernel should restore the user AMR value
> back.
> 
> Looks like GENERIC_ENTRY might be treating arch_exit_to_user_mode_prepare()
> as the last architecture step before returning to userspace.
> commit bee25f97ad24 ("powerpc: Enable GENERIC_ENTRY feature")
> therefore called kuap_user_restore() from that hook. But on PowerPC that
> is too early. After irqentry_exit() / syscall_exit_to_user_mode() we
> still run platform specific exit routines.
> 
> e.g. code snippets showing both exception handling and system call
> handling as the callers of function arch_exit_to_user_mode_prepare()
> which does kuap_user_restore(). The below path shows that calling
> kuap_user_restore() is too early when called from
> arch_exit_to_user_mode_prepare().
> 
> Exception handling in exceptions-64s.S
> =======================================
> 
> bl	CFUNC(do_page_fault)
> 	  ..DEFINE_INTERRUPT_HANDLER_ASYNC(do_page_fault)
> 	      arch_interrupt_async_enter_prepare(regs);
> 	      state = irqentry_enter(regs);
> 	      instrumentation_begin();
> 	      irq_enter_rcu();
> 	      handler(regs);
> 	      nap_adjust_return(regs);
> 	      irq_exit_rcu();
> 	      instrumentation_end();
> 	      arch_interrupt_async_exit_prepare(regs);
> 	      irqentry_exit(regs, state); 		   <<< too early
> 	        irqentry_exit_to_user_mode()
> 		  __exit_to_user_mode_prepare(regs, EXIT_TO_USER_MODE_WORK_IRQ);
> 		    arch_exit_to_user_mode_prepare(regs, ti_work);  <<< too early
> b	interrupt_return_srr
> 		.. bl	CFUNC(interrupt_exit_user_prepare) <<< already calls kuap_user_restore
> 
> prep_irq_for_enabled_exit() retry can run kernel code with IRQs on. So
> only when that routine is fully finished is when the user KUAP should be
> fully restored which interrupt_exit_user_prepare() already takes care of
> before returning.
> 
> Similarly for system call handling in interrupt_64.S
> ======================================================
> 
> 	bl	CFUNC(system_call_exception)
> 
> .Lsyscall_exit:
> 	addi	r4,r1,STACK_INT_FRAME_REGS
> 	li	r5,0 /* !scv */
> 	bl	CFUNC(syscall_exit_prepare)
> 		  .. kuap_assert_locked();
> 		     syscall_exit_to_user_mode(regs); <<< too early
> 		       syscall_exit_to_user_mode_prepare(regs);  <<< too early
>  		     kuap_user_restore(regs);         <<< already calls
> 
> syscall_exit_prepare(), which can enable IRQs, replay a pending
> interrupt, and only then rfi. Those functions already restore KUAP
> immediately before rfi.
> 
> Note that if we restore the user AMR too early like in the current code
> as shown from the code snippets above, then we get the following warning
> when CONFIG_PPC_KUAP_DEBUG is enabled:
>   WARNING: arch/powerpc/include/asm/book3s/64/kup.h:293 at interrupt_exit_user_prepare+0x1a0/0x1c0
>   Hardware name: IBM pSeries (emulated by qemu) POWER10 (architected)
>   TRAP: 0700
>   LR: c00000000000d8d4 CTR: c0000000021fe500
>   MSR: <SF,EE,ME,IR,DR,RI,LE>  CR: 44000804  XER: 20040000
>   interrupt_exit_user_prepare+0x1a0/0x1c0
>   interrupt_return_srr_user+0x8/0x12c
> 
> Fixes: bee25f97ad24 ("powerpc: Enable GENERIC_ENTRY feature")
> Fixes: 02565a782c1ee ("powerpc: Introduce syscall exit arch functions")
> Signed-off-by: Ritesh Harjani (IBM) <[email protected]>
> ---
>  arch/powerpc/include/asm/entry-common.h | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/powerpc/include/asm/entry-common.h b/arch/powerpc/include/asm/entry-common.h
> index c5adb5006361..94083516df57 100644
> --- a/arch/powerpc/include/asm/entry-common.h
> +++ b/arch/powerpc/include/asm/entry-common.h
> @@ -515,8 +515,14 @@ static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs,
>  #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
>  	local_paca->tm_scratch = regs->msr;
>  #endif
> -	/* Restore user access locks last */
> -	kuap_user_restore(regs);
> +	/*
> +	 * Do not restore KUAP here. Generic entry might treat this as the last
> +	 * arch step before userspace but PowerPC still has kernel work after
> +	 * irqentry_exit()/syscall_exit_to_user_mode() i.e. in
> +	 * interrupt_exit_user_prepare() / syscall_exit_prepare() may enable
> +	 * IRQs and retry. Those functions restore KUAP immediately before rfi,
> +	 * which is where it should belong.
> +	 */
>  }
> 
>  #define arch_exit_to_user_mode_prepare arch_exit_to_user_mode_prepare
> --
> 2.39.5
> 
> 
Yeah, KUAP access should be restored last.

Reviewed-by: Mukesh Kumar Chaurasiya (IBM) <[email protected]>