Commit 4d6c551e authored by Aneesh Kumar K.V's avatar Aneesh Kumar K.V Committed by Michael Ellerman
Browse files

powerpc/book3s64/kuap: Restrict access to userspace based on userspace AMR 



If an application has configured address protection such that read/write is
denied using pkey even the kernel should receive a FAULT on accessing the same.

This patch use user AMR value stored in pt_regs.amr to achieve the same.

Signed-off-by: default avatarAneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
Reviewed-by: default avatarSandipan Das <sandipan@linux.ibm.com>
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201127044424.40686-16-aneesh.kumar@linux.ibm.com
parent 48a8ab4e

arch/powerpc/include/asm/book3s/64/kup.h

+9 −3
Original line number Diff line number Diff line
@@ -314,14 +314,20 @@ bad_kuap_fault(struct pt_regs *regs, unsigned long address, bool is_write) 
static __always_inline void allow_user_access(void __user *to, const void __user *from,

					      unsigned long size, unsigned long dir)

{

	unsigned long thread_amr = 0;



	// This is written so we can resolve to a single case at build time

	BUILD_BUG_ON(!__builtin_constant_p(dir));



	if (mmu_has_feature(MMU_FTR_PKEY))

		thread_amr = current_thread_amr();



	if (dir == KUAP_READ)

		set_kuap(AMR_KUAP_BLOCK_WRITE);

		set_kuap(thread_amr | AMR_KUAP_BLOCK_WRITE);

	else if (dir == KUAP_WRITE)

		set_kuap(AMR_KUAP_BLOCK_READ);

		set_kuap(thread_amr | AMR_KUAP_BLOCK_READ);

	else if (dir == KUAP_READ_WRITE)

		set_kuap(0);

		set_kuap(thread_amr);

	else

		BUILD_BUG();

}