From 1d54cf2b973a6265789b382b7d305771321b9b57 Mon Sep 17 00:00:00 2001 From: "sukadev@linux.vnet.ibm.com" Date: Tue, 30 Aug 2011 09:19:17 +0000 Subject: powerpc: Implement CONFIG_STRICT_DEVMEM As described in the help text in the patch, this token restricts general access to /dev/mem as a way of increasing the security. Specifically, access to exclusive IOMEM and kernel RAM is denied unless CONFIG_STRICT_DEVMEM is set to 'n'. Implement the 'devmem_is_allowed()' interface for Powerpc. It will be called from range_is_allowed() when userpsace attempts to access /dev/mem. This patch is based on an earlier patch from Steve Best and with input from Paul Mackerras and Scott Wood. [BenH] Fixed a typo or two and removed the generic change which should be submitted as a separate patch Signed-off-by: Sukadev Bhattiprolu Signed-off-by: Benjamin Herrenschmidt --- arch/powerpc/mm/mem.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'arch/powerpc/mm/mem.c') diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c index 2dd6bdd31fe1..22563b9664c3 100644 --- a/arch/powerpc/mm/mem.c +++ b/arch/powerpc/mm/mem.c @@ -585,3 +585,21 @@ static int add_system_ram_resources(void) return 0; } subsys_initcall(add_system_ram_resources); + +#ifdef CONFIG_STRICT_DEVMEM +/* + * devmem_is_allowed(): check to see if /dev/mem access to a certain address + * is valid. The argument is a physical page number. + * + * Access has to be given to non-kernel-ram areas as well, these contain the + * PCI mmio resources as well as potential bios/acpi data regions. + */ +int devmem_is_allowed(unsigned long pfn) +{ + if (iomem_is_exclusive(pfn << PAGE_SHIFT)) + return 0; + if (!page_is_ram(pfn)) + return 1; + return 0; +} +#endif /* CONFIG_STRICT_DEVMEM */ -- cgit v1.2.3 From d93e4d7d72037d8c9405e8d404ecb2ee162adc25 Mon Sep 17 00:00:00 2001 From: Becky Bruce Date: Mon, 28 Nov 2011 14:43:33 +0000 Subject: powerpc/book3e: Change hugetlb preload to take vma argument This avoids an extra find_vma() and is less error-prone. Signed-off-by: Becky Bruce Signed-off-by: Benjamin Herrenschmidt --- arch/powerpc/mm/mem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'arch/powerpc/mm/mem.c') diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c index 22563b9664c3..83d819f30864 100644 --- a/arch/powerpc/mm/mem.c +++ b/arch/powerpc/mm/mem.c @@ -553,7 +553,7 @@ void update_mmu_cache(struct vm_area_struct *vma, unsigned long address, #if (defined(CONFIG_PPC_BOOK3E_64) || defined(CONFIG_PPC_FSL_BOOK3E)) \ && defined(CONFIG_HUGETLB_PAGE) if (is_vm_hugetlb_page(vma)) - book3e_hugetlb_preload(vma->vm_mm, address, *ptep); + book3e_hugetlb_preload(vma, address, *ptep); #endif } -- cgit v1.2.3 From 8a3e3d31d13ece3003e8f750178a7db02c5cd123 Mon Sep 17 00:00:00 2001 From: "sukadev@linux.vnet.ibm.com" Date: Fri, 2 Dec 2011 12:26:23 +0000 Subject: powerpc: Punch a hole in /dev/mem for librtas With CONFIG_STRICT_DEVMEM=y, user space cannot read any part of /dev/mem. Since this breaks librtas, punch a hole in /dev/mem to allow access to the rmo_buffer that librtas needs. Anton Blanchard reported the problem and helped with the fix. A quick test for this patch: # cat /proc/rtas/rmo_buffer 000000000f190000 10000 # python -c "print 0x000000000f190000 / 0x10000" 3865 # dd if=/dev/mem of=/tmp/foo count=1 bs=64k skip=3865 1+0 records in 1+0 records out 65536 bytes (66 kB) copied, 0.000205235 s, 319 MB/s # dd if=/dev/mem of=/tmp/foo dd: reading `/dev/mem': Operation not permitted 0+0 records in 0+0 records out 0 bytes (0 B) copied, 0.00022519 s, 0.0 kB/s Signed-off-by: Sukadev Bhattiprolu Signed-off-by: Benjamin Herrenschmidt --- arch/powerpc/mm/mem.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'arch/powerpc/mm/mem.c') diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c index 83d819f30864..395f42d5f785 100644 --- a/arch/powerpc/mm/mem.c +++ b/arch/powerpc/mm/mem.c @@ -51,6 +51,7 @@ #include #include #include +#include #include "mmu_decl.h" @@ -600,6 +601,8 @@ int devmem_is_allowed(unsigned long pfn) return 0; if (!page_is_ram(pfn)) return 1; + if (page_is_rtas_user_buf(pfn)) + return 1; return 0; } #endif /* CONFIG_STRICT_DEVMEM */ -- cgit v1.2.3