# git rev-parse -q --verify 51d92826594c3ac1f9b7179a3ab246394a11ecd8^{commit} 51d92826594c3ac1f9b7179a3ab246394a11ecd8 already have revision, skipping fetch # git checkout -q -f -B kisskb 51d92826594c3ac1f9b7179a3ab246394a11ecd8 # git clean -qxdf # < git log -1 # commit 51d92826594c3ac1f9b7179a3ab246394a11ecd8 # Author: Christophe Leroy # Date: Mon Feb 1 06:29:50 2021 +0000 # # powerpc/603: Fix protection of user pages mapped with PROT_NONE # # On book3s/32, page protection is defined by the PP bits in the PTE # which provide the following protection depending on the access # keys defined in the matching segment register: # - PP 00 means RW with key 0 and N/A with key 1. # - PP 01 means RW with key 0 and RO with key 1. # - PP 10 means RW with both key 0 and key 1. # - PP 11 means RO with both key 0 and key 1. # # Since the implementation of kernel userspace access protection, # PP bits have been set as follows: # - PP00 for pages without _PAGE_USER # - PP01 for pages with _PAGE_USER and _PAGE_RW # - PP11 for pages with _PAGE_USER and without _PAGE_RW # # For kernelspace segments, kernel accesses are performed with key 0 # and user accesses are performed with key 1. As PP00 is used for # non _PAGE_USER pages, user can't access kernel pages not flagged # _PAGE_USER while kernel can. # # For userspace segments, both kernel and user accesses are performed # with key 0, therefore pages not flagged _PAGE_USER are still # accessible to the user. # # This shouldn't be an issue, because userspace is expected to be # accessible to the user. But unlike most other architectures, powerpc # implements PROT_NONE protection by removing _PAGE_USER flag instead of # flagging the page as not valid. This means that pages in userspace # that are not flagged _PAGE_USER shall remain inaccessible. # # To get the expected behaviour, just mimic other architectures in the # TLB miss handler by checking _PAGE_USER permission on userspace # accesses as if it was the _PAGE_PRESENT bit. # # Note that this problem only is only for 603 cores. The 604+ have # an hash table, and hash_page() function already implement the # verification of _PAGE_USER permission on userspace pages. # # Fixes: f342adca3afc ("powerpc/32s: Prepare Kernel Userspace Access Protection") # Cc: stable@vger.kernel.org # v5.2+ # Reported-by: Christoph Plattner # Signed-off-by: Christophe Leroy # Signed-off-by: Michael Ellerman # Link: https://lore.kernel.org/r/4a0c6e3bb8f0c162457bf54d9bc6fd8d7b55129f.1612160907.git.christophe.leroy@csgroup.eu # < /opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux-gcc --version # < /opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux-ld --version # < git log --format=%s --max-count=1 51d92826594c3ac1f9b7179a3ab246394a11ecd8 # < make -s -j 32 ARCH=powerpc O=/kisskb/build/powerpc-fixes_ppc64_defconfig+NO_HUGETLB+4K_PAGES_powerpc-gcc5 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux- ppc64_defconfig # Added to kconfig CONFIG_PPC_64K_PAGES=n # Added to kconfig CONFIG_PPC_4K_PAGES=y # Added to kconfig CONFIG_HUGETLBFS=n # < make -s -j 32 ARCH=powerpc O=/kisskb/build/powerpc-fixes_ppc64_defconfig+NO_HUGETLB+4K_PAGES_powerpc-gcc5 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux- help # make -s -j 32 ARCH=powerpc O=/kisskb/build/powerpc-fixes_ppc64_defconfig+NO_HUGETLB+4K_PAGES_powerpc-gcc5 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux- olddefconfig .config:4379:warning: override: reassigning to symbol PPC_4K_PAGES # make -s -j 32 ARCH=powerpc O=/kisskb/build/powerpc-fixes_ppc64_defconfig+NO_HUGETLB+4K_PAGES_powerpc-gcc5 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux- Completed OK # rm -rf /kisskb/build/powerpc-fixes_ppc64_defconfig+NO_HUGETLB+4K_PAGES_powerpc-gcc5 # Build took: 0:04:11.954568