# git rev-parse -q --verify 51d92826594c3ac1f9b7179a3ab246394a11ecd8^{commit} 51d92826594c3ac1f9b7179a3ab246394a11ecd8 already have revision, skipping fetch # git checkout -q -f -B kisskb 51d92826594c3ac1f9b7179a3ab246394a11ecd8 # git clean -qxdf # < git log -1 # commit 51d92826594c3ac1f9b7179a3ab246394a11ecd8 # Author: Christophe Leroy # Date: Mon Feb 1 06:29:50 2021 +0000 # # powerpc/603: Fix protection of user pages mapped with PROT_NONE # # On book3s/32, page protection is defined by the PP bits in the PTE # which provide the following protection depending on the access # keys defined in the matching segment register: # - PP 00 means RW with key 0 and N/A with key 1. # - PP 01 means RW with key 0 and RO with key 1. # - PP 10 means RW with both key 0 and key 1. # - PP 11 means RO with both key 0 and key 1. # # Since the implementation of kernel userspace access protection, # PP bits have been set as follows: # - PP00 for pages without _PAGE_USER # - PP01 for pages with _PAGE_USER and _PAGE_RW # - PP11 for pages with _PAGE_USER and without _PAGE_RW # # For kernelspace segments, kernel accesses are performed with key 0 # and user accesses are performed with key 1. As PP00 is used for # non _PAGE_USER pages, user can't access kernel pages not flagged # _PAGE_USER while kernel can. # # For userspace segments, both kernel and user accesses are performed # with key 0, therefore pages not flagged _PAGE_USER are still # accessible to the user. # # This shouldn't be an issue, because userspace is expected to be # accessible to the user. But unlike most other architectures, powerpc # implements PROT_NONE protection by removing _PAGE_USER flag instead of # flagging the page as not valid. This means that pages in userspace # that are not flagged _PAGE_USER shall remain inaccessible. # # To get the expected behaviour, just mimic other architectures in the # TLB miss handler by checking _PAGE_USER permission on userspace # accesses as if it was the _PAGE_PRESENT bit. # # Note that this problem only is only for 603 cores. The 604+ have # an hash table, and hash_page() function already implement the # verification of _PAGE_USER permission on userspace pages. # # Fixes: f342adca3afc ("powerpc/32s: Prepare Kernel Userspace Access Protection") # Cc: stable@vger.kernel.org # v5.2+ # Reported-by: Christoph Plattner # Signed-off-by: Christophe Leroy # Signed-off-by: Michael Ellerman # Link: https://lore.kernel.org/r/4a0c6e3bb8f0c162457bf54d9bc6fd8d7b55129f.1612160907.git.christophe.leroy@csgroup.eu # < /opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux-gcc --version # < /opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux-ld --version # < git log --format=%s --max-count=1 51d92826594c3ac1f9b7179a3ab246394a11ecd8 # < make -s -j 120 ARCH=powerpc O=/kisskb/build/powerpc-fixes_83xx_kmeter1_defconfig_powerpc-gcc5 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux- 83xx/kmeter1_defconfig # < make -s -j 120 ARCH=powerpc O=/kisskb/build/powerpc-fixes_83xx_kmeter1_defconfig_powerpc-gcc5 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux- help # make -s -j 120 ARCH=powerpc O=/kisskb/build/powerpc-fixes_83xx_kmeter1_defconfig_powerpc-gcc5 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux- olddefconfig # make -s -j 120 ARCH=powerpc O=/kisskb/build/powerpc-fixes_83xx_kmeter1_defconfig_powerpc-gcc5 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux- INFO: Uncompressed kernel (size 0x6c1258) overlaps the address of the wrapper(0x400000) INFO: Fixing the link_address of wrapper to (0x700000) Image Name: Linux-5.11.0-g51d92826594c Created: Thu Feb 25 01:05:17 2021 Image Type: PowerPC Linux Kernel Image (gzip compressed) Data Size: 2950802 Bytes = 2881.64 KiB = 2.81 MiB Load Address: 00000000 Entry Point: 00000000 Completed OK # rm -rf /kisskb/build/powerpc-fixes_83xx_kmeter1_defconfig_powerpc-gcc5 # Build took: 0:00:34.524602