linux-kernel - Re: [PATCH] powerpc/chrp: Revert "Move PHB discovery" and "Make hydra

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210717175750.Horde.TLZWyADKWFGAyFWIYtmglA2@messagerie.c-s.fr>
Date:   Sat, 17 Jul 2021 17:57:50 +0200
From:   Christophe Leroy <christophe.leroy@...roup.eu>
To:     Guenter Roeck <linux@...ck-us.net>
Cc:     linuxppc-dev@...ts.ozlabs.org, Paul Mackerras <paulus@...ba.org>,
        Oliver O'Halloran <oohall@...il.com>,
        Geert Uytterhoeven <geert@...ux-m68k.org>,
        linux-kernel@...r.kernel.org, Michael Ellerman <mpe@...erman.id.au>
Subject: Re: [PATCH] powerpc/chrp: Revert "Move PHB discovery" and "Make
 hydra_init() static"

Guenter Roeck <linux@...ck-us.net> a écrit :

> This patch reverts commit 407d418f2fd4 ("powerpc/chrp: Move PHB
> discovery") and commit 9634afa67bfd ("powerpc/chrp: Make hydra_init()
> static").
>
> Running the upstream kernel on Qemu's brand new "pegasos2" emulation
> results in a variety of backtraces such as
>
> Kernel attempted to write user page (a1) - exploit attempt? (uid: 0)
> ------------[ cut here ]------------
> Bug: Write fault blocked by KUAP!
> WARNING: CPU: 0 PID: 0 at arch/powerpc/mm/fault.c:230  
> do_page_fault+0x4f4/0x920
> CPU: 0 PID: 0 Comm: swapper Not tainted 5.13.2 #40
> NIP:  c0021824 LR: c0021824 CTR: 00000000
> REGS: c1085d50 TRAP: 0700   Not tainted  (5.13.2)
> MSR:  00021032 <ME,IR,DR,RI>  CR: 24042254  XER: 00000000
>
> GPR00: c0021824 c1085e10 c0f8c520 00000021 3fffefff c1085c60  
> c1085c58 00000000
> GPR08: 00001032 00000000 00000000 c0ffb3ec 44042254 00000000  
> 00000000 00000004
> GPR16: 00000000 ffffffff 000000c4 000000d0 0188c6e0 01006000  
> 00000001 40b14000
> GPR24: c0ec000c 00000300 02000000 00000000 42000000 000000a1  
> 00000000 c1085e60
> NIP [c0021824] do_page_fault+0x4f4/0x920
> LR [c0021824] do_page_fault+0x4f4/0x920
> Call Trace:
> [c1085e10] [c0021824] do_page_fault+0x4f4/0x920 (unreliable)
> [c1085e50] [c0004254] DataAccess_virt+0xd4/0xe4
>
> and the system fails to boot. Bisect points to commit 407d418f2fd4
> ("powerpc/chrp: Move PHB discovery"). Reverting this patch together with
> commit 9634afa67bfd ("powerpc/chrp: Make hydra_init() static") fixes
> the problem.

Isn't there more than that in the backtrace ? If there is a fault  
blocked by Kuap, it means there is a fault. It should be visible in  
the traces.

Should we fix the problem instead of reverting the commit that made  
the problem visible ?


>
> Cc: Oliver O'Halloran <oohall@...il.com>
> Cc: Geert Uytterhoeven <geert@...ux-m68k.org>
> Fixes: 407d418f2fd4 ("powerpc/chrp: Move PHB discovery")
> Signed-off-by: Guenter Roeck <linux@...ck-us.net>
> ---
>  arch/powerpc/include/asm/hydra.h    |  2 ++
>  arch/powerpc/platforms/chrp/pci.c   | 11 ++---------
>  arch/powerpc/platforms/chrp/setup.c | 12 +++++++++++-
>  3 files changed, 15 insertions(+), 10 deletions(-)
>
> diff --git a/arch/powerpc/include/asm/hydra.h  
> b/arch/powerpc/include/asm/hydra.h
> index d024447283a0..ae02eb53d6ef 100644
> --- a/arch/powerpc/include/asm/hydra.h
> +++ b/arch/powerpc/include/asm/hydra.h
> @@ -94,6 +94,8 @@ extern volatile struct Hydra __iomem *Hydra;
>  #define HYDRA_INT_EXT7		18	/* Power Off Request */
>  #define HYDRA_INT_SPARE		19
>
> +extern int hydra_init(void);
> +
>  #endif /* __KERNEL__ */
>
>  #endif /* _ASMPPC_HYDRA_H */
> diff --git a/arch/powerpc/platforms/chrp/pci.c  
> b/arch/powerpc/platforms/chrp/pci.c
> index 76e6256cb0a7..b2c2bf35b76c 100644
> --- a/arch/powerpc/platforms/chrp/pci.c
> +++ b/arch/powerpc/platforms/chrp/pci.c
> @@ -131,7 +131,8 @@ static struct pci_ops rtas_pci_ops =
>
>  volatile struct Hydra __iomem *Hydra = NULL;
>
> -static int __init hydra_init(void)
> +int __init
> +hydra_init(void)
>  {
>  	struct device_node *np;
>  	struct resource r;
> @@ -313,14 +314,6 @@ chrp_find_bridges(void)
>  		}
>  	}
>  	of_node_put(root);
> -
> -	/*
> -	 *  "Temporary" fixes for PCI devices.
> -	 *  -- Geert
> -	 */
> -	hydra_init();		/* Mac I/O */
> -
> -	pci_create_OF_bus_map();
>  }
>
>  /* SL82C105 IDE Control/Status Register */
> diff --git a/arch/powerpc/platforms/chrp/setup.c  
> b/arch/powerpc/platforms/chrp/setup.c
> index 3cfc382841e5..c45435aa5e36 100644
> --- a/arch/powerpc/platforms/chrp/setup.c
> +++ b/arch/powerpc/platforms/chrp/setup.c
> @@ -334,11 +334,22 @@ static void __init chrp_setup_arch(void)
>  	/* On pegasos, enable the L2 cache if not already done by OF */
>  	pegasos_set_l2cr();
>
> +	/* Lookup PCI host bridges */
> +	chrp_find_bridges();
> +
> +	/*
> +	 *  Temporary fixes for PCI devices.
> +	 *  -- Geert
> +	 */
> +	hydra_init();		/* Mac I/O */
> +
>  	/*
>  	 *  Fix the Super I/O configuration
>  	 */
>  	sio_init();
>
> +	pci_create_OF_bus_map();
> +
>  	/*
>  	 * Print the banner, then scroll down so boot progress
>  	 * can be printed.  -- Cort
> @@ -571,7 +582,6 @@ define_machine(chrp) {
>  	.name			= "CHRP",
>  	.probe			= chrp_probe,
>  	.setup_arch		= chrp_setup_arch,
> -	.discover_phbs		= chrp_find_bridges,
>  	.init			= chrp_init2,
>  	.show_cpuinfo		= chrp_show_cpuinfo,
>  	.init_IRQ		= chrp_init_IRQ,
> --
> 2.25.1