linux-kernel - Re: [PATCH] powerpc/chrp: Revert "Move PHB discovery" and "Make hydra

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20210717180127.Horde.OIjMJnVEEfP_oAQkDsg2IA1@messagerie.c-s.fr>
Date:   Sat, 17 Jul 2021 18:01:27 +0200
From:   Christophe Leroy <christophe.leroy@...roup.eu>
To:     Guenter Roeck <linux@...ck-us.net>
Cc:     linuxppc-dev@...ts.ozlabs.org,
        Oliver O'Halloran <oohall@...il.com>,
        Paul Mackerras <paulus@...ba.org>,
        Geert Uytterhoeven <geert@...ux-m68k.org>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] powerpc/chrp: Revert "Move PHB discovery" and "Make
 hydra_init() static"

Christophe Leroy <christophe.leroy@...roup.eu> a écrit :

> Guenter Roeck <linux@...ck-us.net> a écrit :
>
>> This patch reverts commit 407d418f2fd4 ("powerpc/chrp: Move PHB
>> discovery") and commit 9634afa67bfd ("powerpc/chrp: Make hydra_init()
>> static").
>>
>> Running the upstream kernel on Qemu's brand new "pegasos2" emulation
>> results in a variety of backtraces such as
>>
>> Kernel attempted to write user page (a1) - exploit attempt? (uid: 0)
>> ------------[ cut here ]------------
>> Bug: Write fault blocked by KUAP!
>> WARNING: CPU: 0 PID: 0 at arch/powerpc/mm/fault.c:230  
>> do_page_fault+0x4f4/0x920
>> CPU: 0 PID: 0 Comm: swapper Not tainted 5.13.2 #40
>> NIP:  c0021824 LR: c0021824 CTR: 00000000
>> REGS: c1085d50 TRAP: 0700   Not tainted  (5.13.2)
>> MSR:  00021032 <ME,IR,DR,RI>  CR: 24042254  XER: 00000000
>>
>> GPR00: c0021824 c1085e10 c0f8c520 00000021 3fffefff c1085c60  
>> c1085c58 00000000
>> GPR08: 00001032 00000000 00000000 c0ffb3ec 44042254 00000000  
>> 00000000 00000004
>> GPR16: 00000000 ffffffff 000000c4 000000d0 0188c6e0 01006000  
>> 00000001 40b14000
>> GPR24: c0ec000c 00000300 02000000 00000000 42000000 000000a1  
>> 00000000 c1085e60
>> NIP [c0021824] do_page_fault+0x4f4/0x920
>> LR [c0021824] do_page_fault+0x4f4/0x920
>> Call Trace:
>> [c1085e10] [c0021824] do_page_fault+0x4f4/0x920 (unreliable)
>> [c1085e50] [c0004254] DataAccess_virt+0xd4/0xe4
>>
>> and the system fails to boot. Bisect points to commit 407d418f2fd4
>> ("powerpc/chrp: Move PHB discovery"). Reverting this patch together with
>> commit 9634afa67bfd ("powerpc/chrp: Make hydra_init() static") fixes
>> the problem.
>
> Isn't there more than that in the backtrace ? If there is a fault  
> blocked by Kuap, it means there is a fault. It should be visible in  
> the traces.
>
> Should we fix the problem instead of reverting the commit that made  
> the problem visible ?
>

Also, as it is a KUAP fault, did you test without CONFIG_PPC_KUAP ?  
Does it boot ?

>
>>
>> Cc: Oliver O'Halloran <oohall@...il.com>
>> Cc: Geert Uytterhoeven <geert@...ux-m68k.org>
>> Fixes: 407d418f2fd4 ("powerpc/chrp: Move PHB discovery")
>> Signed-off-by: Guenter Roeck <linux@...ck-us.net>
>> ---
>> arch/powerpc/include/asm/hydra.h    |  2 ++
>> arch/powerpc/platforms/chrp/pci.c   | 11 ++---------
>> arch/powerpc/platforms/chrp/setup.c | 12 +++++++++++-
>> 3 files changed, 15 insertions(+), 10 deletions(-)
>>
>> diff --git a/arch/powerpc/include/asm/hydra.h  
>> b/arch/powerpc/include/asm/hydra.h
>> index d024447283a0..ae02eb53d6ef 100644
>> --- a/arch/powerpc/include/asm/hydra.h
>> +++ b/arch/powerpc/include/asm/hydra.h
>> @@ -94,6 +94,8 @@ extern volatile struct Hydra __iomem *Hydra;
>> #define HYDRA_INT_EXT7		18	/* Power Off Request */
>> #define HYDRA_INT_SPARE		19
>>
>> +extern int hydra_init(void);
>> +
>> #endif /* __KERNEL__ */
>>
>> #endif /* _ASMPPC_HYDRA_H */
>> diff --git a/arch/powerpc/platforms/chrp/pci.c  
>> b/arch/powerpc/platforms/chrp/pci.c
>> index 76e6256cb0a7..b2c2bf35b76c 100644
>> --- a/arch/powerpc/platforms/chrp/pci.c
>> +++ b/arch/powerpc/platforms/chrp/pci.c
>> @@ -131,7 +131,8 @@ static struct pci_ops rtas_pci_ops =
>>
>> volatile struct Hydra __iomem *Hydra = NULL;
>>
>> -static int __init hydra_init(void)
>> +int __init
>> +hydra_init(void)
>> {
>> 	struct device_node *np;
>> 	struct resource r;
>> @@ -313,14 +314,6 @@ chrp_find_bridges(void)
>> 		}
>> 	}
>> 	of_node_put(root);
>> -
>> -	/*
>> -	 *  "Temporary" fixes for PCI devices.
>> -	 *  -- Geert
>> -	 */
>> -	hydra_init();		/* Mac I/O */
>> -
>> -	pci_create_OF_bus_map();
>> }
>>
>> /* SL82C105 IDE Control/Status Register */
>> diff --git a/arch/powerpc/platforms/chrp/setup.c  
>> b/arch/powerpc/platforms/chrp/setup.c
>> index 3cfc382841e5..c45435aa5e36 100644
>> --- a/arch/powerpc/platforms/chrp/setup.c
>> +++ b/arch/powerpc/platforms/chrp/setup.c
>> @@ -334,11 +334,22 @@ static void __init chrp_setup_arch(void)
>> 	/* On pegasos, enable the L2 cache if not already done by OF */
>> 	pegasos_set_l2cr();
>>
>> +	/* Lookup PCI host bridges */
>> +	chrp_find_bridges();
>> +
>> +	/*
>> +	 *  Temporary fixes for PCI devices.
>> +	 *  -- Geert
>> +	 */
>> +	hydra_init();		/* Mac I/O */
>> +
>> 	/*
>> 	 *  Fix the Super I/O configuration
>> 	 */
>> 	sio_init();
>>
>> +	pci_create_OF_bus_map();
>> +
>> 	/*
>> 	 * Print the banner, then scroll down so boot progress
>> 	 * can be printed.  -- Cort
>> @@ -571,7 +582,6 @@ define_machine(chrp) {
>> 	.name			= "CHRP",
>> 	.probe			= chrp_probe,
>> 	.setup_arch		= chrp_setup_arch,
>> -	.discover_phbs		= chrp_find_bridges,
>> 	.init			= chrp_init2,
>> 	.show_cpuinfo		= chrp_show_cpuinfo,
>> 	.init_IRQ		= chrp_init_IRQ,
>> --
>> 2.25.1