From nobody Sat Feb 7 21:15:28 2026 Received: from pegase2.c-s.fr (pegase2.c-s.fr [93.17.235.10]) by smtp.subspace.kernel.org (Postfix) with ESMTP id DD62031D73F; Fri, 17 Oct 2025 10:50:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=93.17.235.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698211; cv=none; b=E14bBN5Mx/S2xqnCACcaVFRyQpGkFfzufHEUPlRqywfeopvscfFqato146MsRXzjumuA3lNi04ONFzazvSCof2NTf/JxW9EHkcjMO3SodIQGZWEJDNgPWfojAFWMxewqIWLWfrnujb2U7UX3L24m7sAV40UWWsFPwtAoFSnzt2o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698211; c=relaxed/simple; bh=CInTZPEi9ILbXu4UpfN2lm4dHyQfqcOZ4rC45zzBAr0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=u/E7cOXIlvBavSDMfA2KDZDgjhSQJFdSDPmo69pdzBWIdtmUYay+bJCq8xUk90DUCAUMgGNp6vzm7kzZePRb3TXXA7942+KfHxC32TmVC0pr5RTQP63ZDwBs40689nXFOUgw3P+JlS6Vm3Jg/e5d2FC7O7VAYABL/0Uil2r9u3Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu; spf=pass smtp.mailfrom=csgroup.eu; arc=none smtp.client-ip=93.17.235.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=csgroup.eu Received: from localhost (mailhub4.si.c-s.fr [172.26.127.67]) by localhost (Postfix) with ESMTP id 4cp17n17Mlz9sSK; Fri, 17 Oct 2025 12:21:25 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from pegase2.c-s.fr ([172.26.127.65]) by localhost (pegase2.c-s.fr [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kRVCKsionrA6; Fri, 17 Oct 2025 12:21:25 +0200 (CEST) Received: from messagerie.si.c-s.fr (messagerie.si.c-s.fr [192.168.25.192]) by pegase2.c-s.fr (Postfix) with ESMTP id 4cp17n0Pcsz9sSH; Fri, 17 Oct 2025 12:21:25 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by messagerie.si.c-s.fr (Postfix) with ESMTP id E3A848B776; Fri, 17 Oct 2025 12:21:24 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from messagerie.si.c-s.fr ([127.0.0.1]) by localhost (messagerie.si.c-s.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id Jnja7wOONEjS; Fri, 17 Oct 2025 12:21:24 +0200 (CEST) Received: from PO20335.idsi0.si.c-s.fr (unknown [192.168.235.99]) by messagerie.si.c-s.fr (Postfix) with ESMTP id C5C1F8B780; Fri, 17 Oct 2025 12:21:23 +0200 (CEST) From: Christophe Leroy To: Alexander Viro , Christian Brauner , Jan Kara , Thomas Gleixner , Ingo Molnar , Peter Zijlstra , Darren Hart , Davidlohr Bueso , "Andre Almeida" , Andrew Morton , Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , "David S. Miller" , Jakub Kicinski , Simon Horman , Daniel Borkmann , Dave Hansen , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin Cc: Christophe Leroy , linux-block@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Subject: [PATCH v3 01/10] iter: Avoid barrier_nospec() in copy_from_user_iter() Date: Fri, 17 Oct 2025 12:20:57 +0200 Message-ID: <09c7c1c9515a2c0b2e1a059a4a5e32a9afe31704.1760529207.git.christophe.leroy@csgroup.eu> X-Mailer: git-send-email 2.49.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1326; i=christophe.leroy@csgroup.eu; h=from:subject:message-id; bh=CInTZPEi9ILbXu4UpfN2lm4dHyQfqcOZ4rC45zzBAr0=; b=owGbwMvMwCV2d0KB2p7V54MZT6slMWR8kpjkJLj5Jud2ppKEBQcSri1LDDpe3F0ocnlh7mMLJ pMQjqk7OkpZGMS4GGTFFFmO/+feNaPrS2r+1F36MHNYmUCGMHBxCsBEulYz/OHjur5ulURd7NlJ Zhtvq0ZmLne5e+yarr2/0I3kMzKOzh8Y/ucIVFowKD2e8P3YR+XNpks2pjIfUDy1dN/PWbYNG1W 3P+UGAA== X-Developer-Key: i=christophe.leroy@csgroup.eu; a=openpgp; fpr=10FFE6F8B390DE17ACC2632368A92FEB01B8DD78 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Following patch will add missing barrier_nospec() to copy_from_user_iter(). Avoid it for architectures supporting masked user accesses, the same way as done for copy_from_user() by commit 0fc810ae3ae1 ("x86/uaccess: Avoid barrier_nospec() in 64-bit copy_from_user()") Signed-off-by: Christophe Leroy --- v2: New in v2 --- lib/iov_iter.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/lib/iov_iter.c b/lib/iov_iter.c index 2fe66a6b8789e..a589935bf3025 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -49,12 +49,16 @@ size_t copy_from_user_iter(void __user *iter_from, size= _t progress, =20 if (should_fail_usercopy()) return len; - if (access_ok(iter_from, len)) { - to +=3D progress; - instrument_copy_from_user_before(to, iter_from, len); - res =3D raw_copy_from_user(to, iter_from, len); - instrument_copy_from_user_after(to, iter_from, len, res); - } + if (can_do_masked_user_access()) + iter_from =3D mask_user_address(iter_from); + else if (!access_ok(iter_from, len)) + return res; + + to +=3D progress; + instrument_copy_from_user_before(to, iter_from, len); + res =3D raw_copy_from_user(to, iter_from, len); + instrument_copy_from_user_after(to, iter_from, len, res); + return res; } =20 --=20 2.49.0 From nobody Sat Feb 7 21:15:28 2026 Received: from pegase2.c-s.fr (pegase2.c-s.fr [93.17.235.10]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 917F131B13D; Fri, 17 Oct 2025 10:50:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=93.17.235.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698220; cv=none; b=k1lJUjyrVJpJqKvwNYj6XFS+Xa/eOisQMelfrbaxwyLzJlQcK9GjHd2SRqpV6LmMACIeq+pOgQmGjdXWir+KLGJIu8FmQMpcGNjIhkevaxDREPwRgVEDt064YsTBjnF5lzB61LEgpeT04LSA7n7wJq0mzd1LGKPVK2bL6SyJL64= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698220; c=relaxed/simple; bh=W82BJoxsF/uaSl8+888M/Hm7CO4JVyWj0vi85xuDhyA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GNx9sdXgCXZm0AGutoEZ6qq0VPRaOvbC505P0vdCnvOvmmkX+TijOmrnkbCKmh6sN+Y4PTRclMm9DwR6z2bGtLU1neo7IkKP1yTgyJMXfGh0qMcaNC2TAYI4Yon85omasa1vYH/Wb5L4RBQAu1sCaXsFF1IVyQsmMMEhIyRnrx4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu; spf=pass smtp.mailfrom=csgroup.eu; arc=none smtp.client-ip=93.17.235.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=csgroup.eu Received: from localhost (mailhub4.si.c-s.fr [172.26.127.67]) by localhost (Postfix) with ESMTP id 4cp17p1rPlz9sST; Fri, 17 Oct 2025 12:21:26 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from pegase2.c-s.fr ([172.26.127.65]) by localhost (pegase2.c-s.fr [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wz6aRj1H0ZMr; Fri, 17 Oct 2025 12:21:26 +0200 (CEST) Received: from messagerie.si.c-s.fr (messagerie.si.c-s.fr [192.168.25.192]) by pegase2.c-s.fr (Postfix) with ESMTP id 4cp17p15gFz9sSS; Fri, 17 Oct 2025 12:21:26 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by messagerie.si.c-s.fr (Postfix) with ESMTP id 0C1888B776; Fri, 17 Oct 2025 12:21:26 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from messagerie.si.c-s.fr ([127.0.0.1]) by localhost (messagerie.si.c-s.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id QD1FRUxErKgp; Fri, 17 Oct 2025 12:21:25 +0200 (CEST) Received: from PO20335.idsi0.si.c-s.fr (unknown [192.168.235.99]) by messagerie.si.c-s.fr (Postfix) with ESMTP id E4BBD8B786; Fri, 17 Oct 2025 12:21:24 +0200 (CEST) From: Christophe Leroy To: Alexander Viro , Christian Brauner , Jan Kara , Thomas Gleixner , Ingo Molnar , Peter Zijlstra , Darren Hart , Davidlohr Bueso , "Andre Almeida" , Andrew Morton , Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , "David S. Miller" , Jakub Kicinski , Simon Horman , Daniel Borkmann , Dave Hansen , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin Cc: Christophe Leroy , linux-block@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Subject: [PATCH v3 02/10] uaccess: Add speculation barrier to copy_from_user_iter() Date: Fri, 17 Oct 2025 12:20:58 +0200 Message-ID: <69e4b8d8a9bad08848945ae29573045a847755d6.1760529207.git.christophe.leroy@csgroup.eu> X-Mailer: git-send-email 2.49.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1421; i=christophe.leroy@csgroup.eu; h=from:subject:message-id; bh=W82BJoxsF/uaSl8+888M/Hm7CO4JVyWj0vi85xuDhyA=; b=owGbwMvMwCV2d0KB2p7V54MZT6slMWR8kpiUGdRbJfSwZ0vufBEP2SNqGTqSclcL1i5f4Fm+6 VxiXY1yRykLgxgXg6yYIsvx/9y7ZnR9Sc2fuksfZg4rE8gQBi5OAZjIvg6G/5mqF/9NO7cn2rA5 J7yV6+MjgaXLZ74usSgweu1hmTDX3I6RYbXwTGvZ+LiJU5O+d+y1mLv42uTIHXa2K2dbx9We03D 8wAUA X-Developer-Key: i=christophe.leroy@csgroup.eu; a=openpgp; fpr=10FFE6F8B390DE17ACC2632368A92FEB01B8DD78 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The results of "access_ok()" can be mis-speculated. The result is that you can end speculatively: if (access_ok(from, size)) // Right here For the same reason as done in copy_from_user() by commit 74e19ef0ff80 ("uaccess: Add speculation barrier to copy_from_user()"), add a speculation barrier to copy_from_user_iter(). See commit 74e19ef0ff80 ("uaccess: Add speculation barrier to copy_from_user()") for more details. Signed-off-by: Christophe Leroy --- lib/iov_iter.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/lib/iov_iter.c b/lib/iov_iter.c index a589935bf3025..896760bad455f 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -49,11 +49,19 @@ size_t copy_from_user_iter(void __user *iter_from, size= _t progress, =20 if (should_fail_usercopy()) return len; - if (can_do_masked_user_access()) + if (can_do_masked_user_access()) { iter_from =3D mask_user_address(iter_from); - else if (!access_ok(iter_from, len)) - return res; + } else { + if (!access_ok(iter_from, len)) + return res; =20 + /* + * Ensure that bad access_ok() speculation will not + * lead to nasty side effects *after* the copy is + * finished: + */ + barrier_nospec(); + } to +=3D progress; instrument_copy_from_user_before(to, iter_from, len); res =3D raw_copy_from_user(to, iter_from, len); --=20 2.49.0 From nobody Sat Feb 7 21:15:28 2026 Received: from pegase2.c-s.fr (pegase2.c-s.fr [93.17.235.10]) by smtp.subspace.kernel.org (Postfix) with ESMTP id A40CD328B6D; Fri, 17 Oct 2025 10:50:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=93.17.235.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698248; cv=none; b=SwY3mQSC0rJaIAGKecaI5e/g2GYSDncFnlMFkOoCTwHjp15jtPwG7osRCmTebjuhRSBYd9lB6ZKJbHhxLm0yhQHcx1EDwINQhZi7+81CWBsbYQ6cQrn8ca1YeQr/7ntiDC6FwR1Pt6C1J721vEkVrMWDmax8Gf129lPr5ptTxAQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698248; c=relaxed/simple; bh=LUaYsPfBDAifxBCt3YcfvFtnZBPfaSxbCGY+1bgSYgY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UtSfn1U3dFiwXp6jLxWYpRo6TPfLHeWgQC7vvsXYZgJh/0n3P/4aP8oI/e9RkQYE3q1rs+g2fJFNNeH5ZeinWkymLQcouhnH6Va+BEy55pbR4milx1HI5qnDbfEdKMBdR058eL22AiTwg+Y2xKhexa9Y/xl7Jg+9nRbg6CCQTAk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu; spf=pass smtp.mailfrom=csgroup.eu; arc=none smtp.client-ip=93.17.235.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=csgroup.eu Received: from localhost (mailhub4.si.c-s.fr [172.26.127.67]) by localhost (Postfix) with ESMTP id 4cp17q3TdNz9sSW; Fri, 17 Oct 2025 12:21:27 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from pegase2.c-s.fr ([172.26.127.65]) by localhost (pegase2.c-s.fr [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MUd0DI8w8h4X; Fri, 17 Oct 2025 12:21:27 +0200 (CEST) Received: from messagerie.si.c-s.fr (messagerie.si.c-s.fr [192.168.25.192]) by pegase2.c-s.fr (Postfix) with ESMTP id 4cp17q2C4rz9sSV; Fri, 17 Oct 2025 12:21:27 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by messagerie.si.c-s.fr (Postfix) with ESMTP id 351218B786; Fri, 17 Oct 2025 12:21:27 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from messagerie.si.c-s.fr ([127.0.0.1]) by localhost (messagerie.si.c-s.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id PrL50SiMsfQc; Fri, 17 Oct 2025 12:21:27 +0200 (CEST) Received: from PO20335.idsi0.si.c-s.fr (unknown [192.168.235.99]) by messagerie.si.c-s.fr (Postfix) with ESMTP id 0CB558B780; Fri, 17 Oct 2025 12:21:26 +0200 (CEST) From: Christophe Leroy To: Alexander Viro , Christian Brauner , Jan Kara , Thomas Gleixner , Ingo Molnar , Peter Zijlstra , Darren Hart , Davidlohr Bueso , "Andre Almeida" , Andrew Morton , Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , "David S. Miller" , Jakub Kicinski , Simon Horman , Daniel Borkmann , Dave Hansen , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin Cc: Christophe Leroy , linux-block@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Subject: [PATCH v3 03/10] uaccess: Add masked_user_{read/write}_access_begin Date: Fri, 17 Oct 2025 12:20:59 +0200 Message-ID: X-Mailer: git-send-email 2.49.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4825; i=christophe.leroy@csgroup.eu; h=from:subject:message-id; bh=LUaYsPfBDAifxBCt3YcfvFtnZBPfaSxbCGY+1bgSYgY=; b=owGbwMvMwCV2d0KB2p7V54MZT6slMWR8kpjMrdxgqHHhJa+5y5dc/303H/NN3Lr9qOCUqV5nf 616vDt2aUcpC4MYF4OsmCLL8f/cu2Z0fUnNn7pLH2YOKxPIEAYuTgGYSG4hI8PugxP0XD6+P++d tLxF6urFura8RdaX1zJtUZoQsmR3WYwow1+pk7tD5bt6dou+nsl7waZn/fqVSZp/NS8Vn1N76Xp zWxsbAA== X-Developer-Key: i=christophe.leroy@csgroup.eu; a=openpgp; fpr=10FFE6F8B390DE17ACC2632368A92FEB01B8DD78 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Allthough masked_user_access_begin() is to only be used when reading data from user at the moment, introduce masked_user_read_access_begin() and masked_user_write_access_begin() in order to match user_read_access_begin() and user_write_access_begin(). That means masked_user_read_access_begin() is used when user memory is exclusively read during the window, masked_user_write_access_begin() is used when user memory is exclusively writen during the window, masked_user_access_begin() remains and is used when both reads and writes are performed during the open window. Each of them is expected to be terminated by the matching user_read_access_end(), user_write_access_end() and user_access_end(). Have them default to masked_user_access_begin() when they are not defined. Signed-off-by: Christophe Leroy --- v3: Rebased on top of v6.18-rc1 =3D=3D> change in net/core/scm.c v2: Added more explanations in the commit message following comments receiv= ed. --- fs/select.c | 2 +- include/linux/uaccess.h | 7 +++++++ kernel/futex/futex.h | 4 ++-- lib/strncpy_from_user.c | 2 +- lib/strnlen_user.c | 2 +- net/core/scm.c | 2 +- 6 files changed, 13 insertions(+), 6 deletions(-) diff --git a/fs/select.c b/fs/select.c index 082cf60c7e235..36db0359388c8 100644 --- a/fs/select.c +++ b/fs/select.c @@ -777,7 +777,7 @@ static inline int get_sigset_argpack(struct sigset_argp= ack *to, // the path is hot enough for overhead of copy_from_user() to matter if (from) { if (can_do_masked_user_access()) - from =3D masked_user_access_begin(from); + from =3D masked_user_read_access_begin(from); else if (!user_read_access_begin(from, sizeof(*from))) return -EFAULT; unsafe_get_user(to->p, &from->p, Efault); diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h index 1beb5b395d81d..aa48d5415d32f 100644 --- a/include/linux/uaccess.h +++ b/include/linux/uaccess.h @@ -41,6 +41,13 @@ #define mask_user_address(src) (src) #endif =20 +#ifndef masked_user_write_access_begin +#define masked_user_write_access_begin masked_user_access_begin +#endif +#ifndef masked_user_read_access_begin +#define masked_user_read_access_begin masked_user_access_begin +#endif + /* * Architectures should provide two primitives (raw_copy_{to,from}_user()) * and get rid of their private instances of copy_{to,from}_user() and diff --git a/kernel/futex/futex.h b/kernel/futex/futex.h index 2cd57096c38e1..a1120a318c186 100644 --- a/kernel/futex/futex.h +++ b/kernel/futex/futex.h @@ -303,7 +303,7 @@ static __always_inline int futex_get_value(u32 *dest, u= 32 __user *from) u32 val; =20 if (can_do_masked_user_access()) - from =3D masked_user_access_begin(from); + from =3D masked_user_read_access_begin(from); else if (!user_read_access_begin(from, sizeof(*from))) return -EFAULT; unsafe_get_user(val, from, Efault); @@ -318,7 +318,7 @@ static __always_inline int futex_get_value(u32 *dest, u= 32 __user *from) static __always_inline int futex_put_value(u32 val, u32 __user *to) { if (can_do_masked_user_access()) - to =3D masked_user_access_begin(to); + to =3D masked_user_write_access_begin(to); else if (!user_write_access_begin(to, sizeof(*to))) return -EFAULT; unsafe_put_user(val, to, Efault); diff --git a/lib/strncpy_from_user.c b/lib/strncpy_from_user.c index 6dc234913dd58..5bb752ff7c61b 100644 --- a/lib/strncpy_from_user.c +++ b/lib/strncpy_from_user.c @@ -126,7 +126,7 @@ long strncpy_from_user(char *dst, const char __user *sr= c, long count) if (can_do_masked_user_access()) { long retval; =20 - src =3D masked_user_access_begin(src); + src =3D masked_user_read_access_begin(src); retval =3D do_strncpy_from_user(dst, src, count, count); user_read_access_end(); return retval; diff --git a/lib/strnlen_user.c b/lib/strnlen_user.c index 6e489f9e90f15..4a6574b67f824 100644 --- a/lib/strnlen_user.c +++ b/lib/strnlen_user.c @@ -99,7 +99,7 @@ long strnlen_user(const char __user *str, long count) if (can_do_masked_user_access()) { long retval; =20 - str =3D masked_user_access_begin(str); + str =3D masked_user_read_access_begin(str); retval =3D do_strnlen_user(str, count, count); user_read_access_end(); return retval; diff --git a/net/core/scm.c b/net/core/scm.c index 66eaee783e8be..4a65f9baa87e7 100644 --- a/net/core/scm.c +++ b/net/core/scm.c @@ -274,7 +274,7 @@ int put_cmsg(struct msghdr * msg, int level, int type, = int len, void *data) check_object_size(data, cmlen - sizeof(*cm), true); =20 if (can_do_masked_user_access()) - cm =3D masked_user_access_begin(cm); + cm =3D masked_user_write_access_begin(cm); else if (!user_write_access_begin(cm, cmlen)) goto efault; =20 --=20 2.49.0 From nobody Sat Feb 7 21:15:28 2026 Received: from pegase2.c-s.fr (pegase2.c-s.fr [93.17.235.10]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 39670322DD4; Fri, 17 Oct 2025 10:50:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=93.17.235.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698239; cv=none; b=kbv2EeV6ckDdcfn1M8B0UvMWj9BbS2JTVMsxMGgs7Ojy5DAXHD/UoR5W+TCyFAdTdkFaA8HjmJjyOO/49vjDEN2nYx/A4r1z1N6GIR3cz/tdahjgaltm2KVmk73YdngE+sVMsuUgUc42RxDupFrTWHsj4SWKS7+3eeuHM5Z4VC8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698239; c=relaxed/simple; bh=XnCxMhC4tKrfunwM6Qhb7mlhTjVnhGj5z8WEDISllsk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BpAtRf7gj0NvpWMLP7Qf1+zR6P7LWlkrHgZSldeifpj8GnpQzA+wgdK+aE75SxCt6xVK9+yzQbAtAB3aFY+3lprRGwmmXP3Mn34uBIfED4tJ5xmLpSin1wwa1uMXFyAPT5thgYKWjNO2p9NQ8fb3/a8cfE4xmPanZAY7OmD6yM0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu; spf=pass smtp.mailfrom=csgroup.eu; arc=none smtp.client-ip=93.17.235.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=csgroup.eu Received: from localhost (mailhub4.si.c-s.fr [172.26.127.67]) by localhost (Postfix) with ESMTP id 4cp17r4gYZz9sSZ; Fri, 17 Oct 2025 12:21:28 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from pegase2.c-s.fr ([172.26.127.65]) by localhost (pegase2.c-s.fr [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a3JlYViee4b4; Fri, 17 Oct 2025 12:21:28 +0200 (CEST) Received: from messagerie.si.c-s.fr (messagerie.si.c-s.fr [192.168.25.192]) by pegase2.c-s.fr (Postfix) with ESMTP id 4cp17r3fPXz9sSY; Fri, 17 Oct 2025 12:21:28 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by messagerie.si.c-s.fr (Postfix) with ESMTP id 5BEFE8B786; Fri, 17 Oct 2025 12:21:28 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from messagerie.si.c-s.fr ([127.0.0.1]) by localhost (messagerie.si.c-s.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id a5Gh_vHjmSpQ; Fri, 17 Oct 2025 12:21:28 +0200 (CEST) Received: from PO20335.idsi0.si.c-s.fr (unknown [192.168.235.99]) by messagerie.si.c-s.fr (Postfix) with ESMTP id 30FD58B776; Fri, 17 Oct 2025 12:21:27 +0200 (CEST) From: Christophe Leroy To: Alexander Viro , Christian Brauner , Jan Kara , Thomas Gleixner , Ingo Molnar , Peter Zijlstra , Darren Hart , Davidlohr Bueso , "Andre Almeida" , Andrew Morton , Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , "David S. Miller" , Jakub Kicinski , Simon Horman , Daniel Borkmann , Dave Hansen , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin Cc: Christophe Leroy , linux-block@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Subject: [PATCH v3 04/10] powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() Date: Fri, 17 Oct 2025 12:21:00 +0200 Message-ID: <6fe09cbe2d3b9da5bf66121dde76a4920dbaca82.1760529207.git.christophe.leroy@csgroup.eu> X-Mailer: git-send-email 2.49.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3132; i=christophe.leroy@csgroup.eu; h=from:subject:message-id; bh=XnCxMhC4tKrfunwM6Qhb7mlhTjVnhGj5z8WEDISllsk=; b=kA0DAAoW3ZBwJryrz1MByyZiAGjyGJPI2gU1U0yXqA8CI9jnkuzF87axDEGtn6rexGr6Q84NF oh1BAAWCgAdFiEEx/8LupiK9GVvlbov3ZBwJryrz1MFAmjyGJMACgkQ3ZBwJryrz1M3pQD/eCAW JaaZ4jlClvQVYYWXZlktFztmKjcfyBF/SppsTgsA/0UUsqVryxj3Xmg6ltv1tmiATpYBMz2C6eS Jm+DUKowK X-Developer-Key: i=christophe.leroy@csgroup.eu; a=openpgp; fpr=10FFE6F8B390DE17ACC2632368A92FEB01B8DD78 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Commit 74e19ef0ff80 ("uaccess: Add speculation barrier to copy_from_user()") added a redundant barrier_nospec() in copy_from_user(), because powerpc is already calling barrier_nospec() in allow_read_from_user() and allow_read_write_user(). But on other architectures that call to barrier_nospec() was missing. So change powerpc instead of reverting the above commit and having to fix other architectures one by one. This is now possible because barrier_nospec() has also been added in copy_from_user_iter(). Move barrier_nospec() out of allow_read_from_user() and allow_read_write_user(). This will also allow reuse of those functions when implementing masked user access which doesn't require barrier_nospec(). Don't add it back in raw_copy_from_user() as it is already called by copy_from_user() and copy_from_user_iter(). Fixes: 74e19ef0ff80 ("uaccess: Add speculation barrier to copy_from_user()") Signed-off-by: Christophe Leroy --- arch/powerpc/include/asm/kup.h | 2 -- arch/powerpc/include/asm/uaccess.h | 4 ++++ 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/include/asm/kup.h b/arch/powerpc/include/asm/kup.h index dab63b82a8d4f..f2009d7c8cfa7 100644 --- a/arch/powerpc/include/asm/kup.h +++ b/arch/powerpc/include/asm/kup.h @@ -134,7 +134,6 @@ static __always_inline void kuap_assert_locked(void) =20 static __always_inline void allow_read_from_user(const void __user *from, = unsigned long size) { - barrier_nospec(); allow_user_access(NULL, from, size, KUAP_READ); } =20 @@ -146,7 +145,6 @@ static __always_inline void allow_write_to_user(void __= user *to, unsigned long s static __always_inline void allow_read_write_user(void __user *to, const v= oid __user *from, unsigned long size) { - barrier_nospec(); allow_user_access(to, from, size, KUAP_READ_WRITE); } =20 diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/= uaccess.h index 4f5a46a77fa2b..3987a5c33558b 100644 --- a/arch/powerpc/include/asm/uaccess.h +++ b/arch/powerpc/include/asm/uaccess.h @@ -301,6 +301,7 @@ do { \ __typeof__(sizeof(*(ptr))) __gu_size =3D sizeof(*(ptr)); \ \ might_fault(); \ + barrier_nospec(); \ allow_read_from_user(__gu_addr, __gu_size); \ __get_user_size_allowed(__gu_val, __gu_addr, __gu_size, __gu_err); \ prevent_read_from_user(__gu_addr, __gu_size); \ @@ -329,6 +330,7 @@ raw_copy_in_user(void __user *to, const void __user *fr= om, unsigned long n) { unsigned long ret; =20 + barrier_nospec(); allow_read_write_user(to, from, n); ret =3D __copy_tofrom_user(to, from, n); prevent_read_write_user(to, from, n); @@ -415,6 +417,7 @@ static __must_check __always_inline bool user_access_be= gin(const void __user *pt =20 might_fault(); =20 + barrier_nospec(); allow_read_write_user((void __user *)ptr, ptr, len); return true; } @@ -431,6 +434,7 @@ user_read_access_begin(const void __user *ptr, size_t l= en) =20 might_fault(); =20 + barrier_nospec(); allow_read_from_user(ptr, len); return true; } --=20 2.49.0 From nobody Sat Feb 7 21:15:28 2026 Received: from pegase2.c-s.fr (pegase2.c-s.fr [93.17.235.10]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 76657322DD4; Fri, 17 Oct 2025 10:50:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=93.17.235.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698229; cv=none; b=dyg+363Eq8EiOTLqA8RVvhDj83HWl7CYpiNEE9S+US+dCskJLBuW0gIooSiQrQvVhmCU4LBTHs743dhND2EfLltEArOg4MNDOLrjt0NnzNSdF4cW2FIGEVkTaoC8j9Xr63pkuXmQ4/VNQrZh8Ld3EzUSKn/bKk7oOR0m4QRQWaI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698229; c=relaxed/simple; bh=KnzlfUS7b6A05GpPdjrBHv7ZFNA1ZFx8E2W+mgIICCo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dt45XfbmDZvEfKzjU7070hOQGWY8ofmLnspg7uXGxZyPsVwQsp9cHyWcjCcAbx1uSuSii1pVUv6sHXkfw7wEX+MVsJLN7epovKRU4TyPe8fZkwfk+fl6O3u4SUjjhh2SO8IgE/EmpPuI98B+3wCGgKlec56kMqVjSh6O7xcaElM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu; spf=pass smtp.mailfrom=csgroup.eu; arc=none smtp.client-ip=93.17.235.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=csgroup.eu Received: from localhost (mailhub4.si.c-s.fr [172.26.127.67]) by localhost (Postfix) with ESMTP id 4cp17s5Wfbz9sSf; Fri, 17 Oct 2025 12:21:29 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from pegase2.c-s.fr ([172.26.127.65]) by localhost (pegase2.c-s.fr [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6yjdANs33xzn; Fri, 17 Oct 2025 12:21:29 +0200 (CEST) Received: from messagerie.si.c-s.fr (messagerie.si.c-s.fr [192.168.25.192]) by pegase2.c-s.fr (Postfix) with ESMTP id 4cp17s4ZMHz9sSd; Fri, 17 Oct 2025 12:21:29 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by messagerie.si.c-s.fr (Postfix) with ESMTP id 8780F8B786; Fri, 17 Oct 2025 12:21:29 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from messagerie.si.c-s.fr ([127.0.0.1]) by localhost (messagerie.si.c-s.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id ArRtS1RISlwm; Fri, 17 Oct 2025 12:21:29 +0200 (CEST) Received: from PO20335.idsi0.si.c-s.fr (unknown [192.168.235.99]) by messagerie.si.c-s.fr (Postfix) with ESMTP id 5A1988B780; Fri, 17 Oct 2025 12:21:28 +0200 (CEST) From: Christophe Leroy To: Alexander Viro , Christian Brauner , Jan Kara , Thomas Gleixner , Ingo Molnar , Peter Zijlstra , Darren Hart , Davidlohr Bueso , "Andre Almeida" , Andrew Morton , Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , "David S. Miller" , Jakub Kicinski , Simon Horman , Daniel Borkmann , Dave Hansen , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin Cc: Christophe Leroy , linux-block@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Subject: [PATCH v3 05/10] powerpc/uaccess: Remove unused size and from parameters from allow_access_user() Date: Fri, 17 Oct 2025 12:21:01 +0200 Message-ID: <62374ab8b781365da76cadba5d9cceb57127f856.1760529207.git.christophe.leroy@csgroup.eu> X-Mailer: git-send-email 2.49.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5364; i=christophe.leroy@csgroup.eu; h=from:subject:message-id; bh=KnzlfUS7b6A05GpPdjrBHv7ZFNA1ZFx8E2W+mgIICCo=; b=owGbwMvMwCV2d0KB2p7V54MZT6slMWR8kph8e+rcVP1jbU9s/s5dd0dic7reD2ud5dXzUz40B /1ZPkkiuaOUhUGMi0FWTJHl+H/uXTO6vqTmT92lDzOHlQlkCAMXpwBMREWT4X/S1hSL4NVd1WZO EzwPNJ4Kyjsg8PupmNQkm2NLd6bM7Eth+B8kbF61y6FlnvSDDzf258lN4Ws6/p1XYvdVm+CFJQn bwnkB X-Developer-Key: i=christophe.leroy@csgroup.eu; a=openpgp; fpr=10FFE6F8B390DE17ACC2632368A92FEB01B8DD78 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Since commit 16132529cee5 ("powerpc/32s: Rework Kernel Userspace Access Protection") the size parameter is unused on all platforms. And the 'from' parameter has never been used. Remove them. Signed-off-by: Christophe Leroy --- v2: Also remove 'from' param. --- arch/powerpc/include/asm/book3s/32/kup.h | 3 +-- arch/powerpc/include/asm/book3s/64/kup.h | 6 ++---- arch/powerpc/include/asm/kup.h | 9 ++++----- arch/powerpc/include/asm/nohash/32/kup-8xx.h | 3 +-- arch/powerpc/include/asm/nohash/kup-booke.h | 3 +-- 5 files changed, 9 insertions(+), 15 deletions(-) diff --git a/arch/powerpc/include/asm/book3s/32/kup.h b/arch/powerpc/includ= e/asm/book3s/32/kup.h index 873c5146e3261..a3558419c41b1 100644 --- a/arch/powerpc/include/asm/book3s/32/kup.h +++ b/arch/powerpc/include/asm/book3s/32/kup.h @@ -97,8 +97,7 @@ static __always_inline unsigned long __kuap_get_and_asser= t_locked(void) } #define __kuap_get_and_assert_locked __kuap_get_and_assert_locked =20 -static __always_inline void allow_user_access(void __user *to, const void = __user *from, - u32 size, unsigned long dir) +static __always_inline void allow_user_access(void __user *to, unsigned lo= ng dir) { BUILD_BUG_ON(!__builtin_constant_p(dir)); =20 diff --git a/arch/powerpc/include/asm/book3s/64/kup.h b/arch/powerpc/includ= e/asm/book3s/64/kup.h index 03aec3c6c851c..9ccf8a5e0926f 100644 --- a/arch/powerpc/include/asm/book3s/64/kup.h +++ b/arch/powerpc/include/asm/book3s/64/kup.h @@ -353,8 +353,7 @@ __bad_kuap_fault(struct pt_regs *regs, unsigned long ad= dress, bool is_write) return (regs->amr & AMR_KUAP_BLOCK_READ) =3D=3D AMR_KUAP_BLOCK_READ; } =20 -static __always_inline void allow_user_access(void __user *to, const void = __user *from, - unsigned long size, unsigned long dir) +static __always_inline void allow_user_access(void __user *to, unsigned lo= ng dir) { unsigned long thread_amr =3D 0; =20 @@ -383,8 +382,7 @@ static __always_inline unsigned long get_kuap(void) =20 static __always_inline void set_kuap(unsigned long value) { } =20 -static __always_inline void allow_user_access(void __user *to, const void = __user *from, - unsigned long size, unsigned long dir) +static __always_inline void allow_user_access(void __user *to, unsigned lo= ng dir) { } =20 #endif /* !CONFIG_PPC_KUAP */ diff --git a/arch/powerpc/include/asm/kup.h b/arch/powerpc/include/asm/kup.h index f2009d7c8cfa7..3963584ac1cf1 100644 --- a/arch/powerpc/include/asm/kup.h +++ b/arch/powerpc/include/asm/kup.h @@ -72,8 +72,7 @@ static __always_inline void __kuap_kernel_restore(struct = pt_regs *regs, unsigned * platforms. */ #ifndef CONFIG_PPC_BOOK3S_64 -static __always_inline void allow_user_access(void __user *to, const void = __user *from, - unsigned long size, unsigned long dir) { } +static __always_inline void allow_user_access(void __user *to, unsigned lo= ng dir) { } static __always_inline void prevent_user_access(unsigned long dir) { } static __always_inline unsigned long prevent_user_access_return(void) { re= turn 0UL; } static __always_inline void restore_user_access(unsigned long flags) { } @@ -134,18 +133,18 @@ static __always_inline void kuap_assert_locked(void) =20 static __always_inline void allow_read_from_user(const void __user *from, = unsigned long size) { - allow_user_access(NULL, from, size, KUAP_READ); + allow_user_access(NULL, KUAP_READ); } =20 static __always_inline void allow_write_to_user(void __user *to, unsigned = long size) { - allow_user_access(to, NULL, size, KUAP_WRITE); + allow_user_access(to, KUAP_WRITE); } =20 static __always_inline void allow_read_write_user(void __user *to, const v= oid __user *from, unsigned long size) { - allow_user_access(to, from, size, KUAP_READ_WRITE); + allow_user_access(to, KUAP_READ_WRITE); } =20 static __always_inline void prevent_read_from_user(const void __user *from= , unsigned long size) diff --git a/arch/powerpc/include/asm/nohash/32/kup-8xx.h b/arch/powerpc/in= clude/asm/nohash/32/kup-8xx.h index 08486b15b2075..efffb5006d190 100644 --- a/arch/powerpc/include/asm/nohash/32/kup-8xx.h +++ b/arch/powerpc/include/asm/nohash/32/kup-8xx.h @@ -49,8 +49,7 @@ static __always_inline void uaccess_end_8xx(void) "i"(SPRN_MD_AP), "r"(MD_APG_KUAP), "i"(MMU_FTR_KUAP) : "memory"); } =20 -static __always_inline void allow_user_access(void __user *to, const void = __user *from, - unsigned long size, unsigned long dir) +static __always_inline void allow_user_access(void __user *to, unsigned lo= ng dir) { uaccess_begin_8xx(MD_APG_INIT); } diff --git a/arch/powerpc/include/asm/nohash/kup-booke.h b/arch/powerpc/inc= lude/asm/nohash/kup-booke.h index d6bbb6d78bbe4..cb2d5a96c3df7 100644 --- a/arch/powerpc/include/asm/nohash/kup-booke.h +++ b/arch/powerpc/include/asm/nohash/kup-booke.h @@ -73,8 +73,7 @@ static __always_inline void uaccess_end_booke(void) "i"(SPRN_PID), "r"(0), "i"(MMU_FTR_KUAP) : "memory"); } =20 -static __always_inline void allow_user_access(void __user *to, const void = __user *from, - unsigned long size, unsigned long dir) +static __always_inline void allow_user_access(void __user *to, unsigned lo= ng dir) { uaccess_begin_booke(current->thread.pid); } --=20 2.49.0 From nobody Sat Feb 7 21:15:28 2026 Received: from pegase2.c-s.fr (pegase2.c-s.fr [93.17.235.10]) by smtp.subspace.kernel.org (Postfix) with ESMTP id D4DAA31691F; Fri, 17 Oct 2025 10:50:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=93.17.235.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698243; cv=none; b=KfTOCsLwm27nGPHrJyVrzSds61fmH/QuX0c0W352JyBcUR8koo2nT4iXSGzRPlCODQFmXh3NwjvCIkqu1IXXzpBG51ykzghCNCRzCuJqjw2AbSP971rylQwDsZQFcmsx9ZrgCzsXjYwcO+in+/zGih8LKx0V+HgQahg7Wj8azy8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698243; c=relaxed/simple; bh=y3f64tKhN7ET5qx1JK+lbghEU+YrDp/rltVLgFdTK8s=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=iyfggiZuuvgU9w8MeJ4bC6j7G+DVak2yOhgskEKpS1uoWL0QRFDZUHGR1K+t/+qs32alJZsaOyaV6EnXE1BXlVU+KVnpGNV38sKlyHG/nihMxC9ns/xD6Dodw4AY0yzTAGjD7ZrozLY1qdj+eW9V5EfMqLCcizhR11fqP+G05OM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu; spf=pass smtp.mailfrom=csgroup.eu; arc=none smtp.client-ip=93.17.235.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=csgroup.eu Received: from localhost (mailhub4.si.c-s.fr [172.26.127.67]) by localhost (Postfix) with ESMTP id 4cp17t6Wdvz9sSh; Fri, 17 Oct 2025 12:21:30 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from pegase2.c-s.fr ([172.26.127.65]) by localhost (pegase2.c-s.fr [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XWBO7AuKPMGU; Fri, 17 Oct 2025 12:21:30 +0200 (CEST) Received: from messagerie.si.c-s.fr (messagerie.si.c-s.fr [192.168.25.192]) by pegase2.c-s.fr (Postfix) with ESMTP id 4cp17t5YRjz9sSg; Fri, 17 Oct 2025 12:21:30 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by messagerie.si.c-s.fr (Postfix) with ESMTP id A8CC18B786; Fri, 17 Oct 2025 12:21:30 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from messagerie.si.c-s.fr ([127.0.0.1]) by localhost (messagerie.si.c-s.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id 5Sd_UtXEJfxn; Fri, 17 Oct 2025 12:21:30 +0200 (CEST) Received: from PO20335.idsi0.si.c-s.fr (unknown [192.168.235.99]) by messagerie.si.c-s.fr (Postfix) with ESMTP id 7D0DA8B776; Fri, 17 Oct 2025 12:21:29 +0200 (CEST) From: Christophe Leroy To: Alexander Viro , Christian Brauner , Jan Kara , Thomas Gleixner , Ingo Molnar , Peter Zijlstra , Darren Hart , Davidlohr Bueso , "Andre Almeida" , Andrew Morton , Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , "David S. Miller" , Jakub Kicinski , Simon Horman , Daniel Borkmann , Dave Hansen , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin Cc: Christophe Leroy , linux-block@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Subject: [PATCH v3 06/10] powerpc/uaccess: Remove {allow/prevent}_{read/write/read_write}_{from/to/}_user() Date: Fri, 17 Oct 2025 12:21:02 +0200 Message-ID: <17a008d24903f50a2ae55df795d1c51c684f5183.1760529207.git.christophe.leroy@csgroup.eu> X-Mailer: git-send-email 2.49.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5385; i=christophe.leroy@csgroup.eu; h=from:subject:message-id; bh=y3f64tKhN7ET5qx1JK+lbghEU+YrDp/rltVLgFdTK8s=; b=owGbwMvMwCV2d0KB2p7V54MZT6slMWR8kpj86PdGjql6NumX9O8vYD6j3V247N7WC7qpSss09 mXxrk5a2lHKwiDGxSArpshy/D/3rhldX1Lzp+7Sh5nDygQyhIGLUwAmsmsKwx+u+tgFOa471AyZ G1/U2XzimNz+yyZlj1Lb5PzbRce4FFQZGWaqa6q68lh9ecXJtbF1ik1C58Hds04knZSMXNURV66 cxAQA X-Developer-Key: i=christophe.leroy@csgroup.eu; a=openpgp; fpr=10FFE6F8B390DE17ACC2632368A92FEB01B8DD78 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The six following functions have become simple single-line fonctions that do not have much added value anymore: - allow_read_from_user() - allow_write_to_user() - allow_read_write_user() - prevent_read_from_user() - prevent_write_to_user() - prevent_read_write_user() Directly call allow_user_access() and prevent_user_access(), it doesn't reduce the readability and it removes unnecessary middle functions. Signed-off-by: Christophe Leroy --- v2: New --- arch/powerpc/include/asm/kup.h | 47 ------------------------------ arch/powerpc/include/asm/uaccess.h | 30 +++++++++---------- 2 files changed, 15 insertions(+), 62 deletions(-) diff --git a/arch/powerpc/include/asm/kup.h b/arch/powerpc/include/asm/kup.h index 3963584ac1cf1..4a4145a244f29 100644 --- a/arch/powerpc/include/asm/kup.h +++ b/arch/powerpc/include/asm/kup.h @@ -131,53 +131,6 @@ static __always_inline void kuap_assert_locked(void) kuap_get_and_assert_locked(); } =20 -static __always_inline void allow_read_from_user(const void __user *from, = unsigned long size) -{ - allow_user_access(NULL, KUAP_READ); -} - -static __always_inline void allow_write_to_user(void __user *to, unsigned = long size) -{ - allow_user_access(to, KUAP_WRITE); -} - -static __always_inline void allow_read_write_user(void __user *to, const v= oid __user *from, - unsigned long size) -{ - allow_user_access(to, KUAP_READ_WRITE); -} - -static __always_inline void prevent_read_from_user(const void __user *from= , unsigned long size) -{ - prevent_user_access(KUAP_READ); -} - -static __always_inline void prevent_write_to_user(void __user *to, unsigne= d long size) -{ - prevent_user_access(KUAP_WRITE); -} - -static __always_inline void prevent_read_write_user(void __user *to, const= void __user *from, - unsigned long size) -{ - prevent_user_access(KUAP_READ_WRITE); -} - -static __always_inline void prevent_current_access_user(void) -{ - prevent_user_access(KUAP_READ_WRITE); -} - -static __always_inline void prevent_current_read_from_user(void) -{ - prevent_user_access(KUAP_READ); -} - -static __always_inline void prevent_current_write_to_user(void) -{ - prevent_user_access(KUAP_WRITE); -} - #endif /* !__ASSEMBLER__ */ =20 #endif /* _ASM_POWERPC_KUAP_H_ */ diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/= uaccess.h index 3987a5c33558b..698996f348914 100644 --- a/arch/powerpc/include/asm/uaccess.h +++ b/arch/powerpc/include/asm/uaccess.h @@ -45,14 +45,14 @@ do { \ __label__ __pu_failed; \ \ - allow_write_to_user(__pu_addr, __pu_size); \ + allow_user_access(__pu_addr, KUAP_WRITE); \ __put_user_size_goto(__pu_val, __pu_addr, __pu_size, __pu_failed); \ - prevent_write_to_user(__pu_addr, __pu_size); \ + prevent_user_access(KUAP_WRITE); \ __pu_err =3D 0; \ break; \ \ __pu_failed: \ - prevent_write_to_user(__pu_addr, __pu_size); \ + prevent_user_access(KUAP_WRITE); \ __pu_err =3D -EFAULT; \ } while (0); \ \ @@ -302,9 +302,9 @@ do { \ \ might_fault(); \ barrier_nospec(); \ - allow_read_from_user(__gu_addr, __gu_size); \ + allow_user_access(NULL, KUAP_READ); \ __get_user_size_allowed(__gu_val, __gu_addr, __gu_size, __gu_err); \ - prevent_read_from_user(__gu_addr, __gu_size); \ + prevent_user_access(KUAP_READ); \ (x) =3D (__typeof__(*(ptr)))__gu_val; \ \ __gu_err; \ @@ -331,9 +331,9 @@ raw_copy_in_user(void __user *to, const void __user *fr= om, unsigned long n) unsigned long ret; =20 barrier_nospec(); - allow_read_write_user(to, from, n); + allow_user_access(to, KUAP_READ_WRITE); ret =3D __copy_tofrom_user(to, from, n); - prevent_read_write_user(to, from, n); + prevent_user_access(KUAP_READ_WRITE); return ret; } #endif /* __powerpc64__ */ @@ -343,9 +343,9 @@ static inline unsigned long raw_copy_from_user(void *to, { unsigned long ret; =20 - allow_read_from_user(from, n); + allow_user_access(NULL, KUAP_READ); ret =3D __copy_tofrom_user((__force void __user *)to, from, n); - prevent_read_from_user(from, n); + prevent_user_access(KUAP_READ); return ret; } =20 @@ -354,9 +354,9 @@ raw_copy_to_user(void __user *to, const void *from, uns= igned long n) { unsigned long ret; =20 - allow_write_to_user(to, n); + allow_user_access(to, KUAP_WRITE); ret =3D __copy_tofrom_user(to, (__force const void __user *)from, n); - prevent_write_to_user(to, n); + prevent_user_access(KUAP_WRITE); return ret; } =20 @@ -367,9 +367,9 @@ static inline unsigned long __clear_user(void __user *a= ddr, unsigned long size) unsigned long ret; =20 might_fault(); - allow_write_to_user(addr, size); + allow_user_access(addr, KUAP_WRITE); ret =3D __arch_clear_user(addr, size); - prevent_write_to_user(addr, size); + prevent_user_access(KUAP_WRITE); return ret; } =20 @@ -397,9 +397,9 @@ copy_mc_to_user(void __user *to, const void *from, unsi= gned long n) { if (check_copy_size(from, n, true)) { if (access_ok(to, n)) { - allow_write_to_user(to, n); + allow_user_access(to, KUAP_WRITE); n =3D copy_mc_generic((void __force *)to, from, n); - prevent_write_to_user(to, n); + prevent_user_access(KUAP_WRITE); } } =20 --=20 2.49.0 From nobody Sat Feb 7 21:15:28 2026 Received: from pegase2.c-s.fr (pegase2.c-s.fr [93.17.235.10]) by smtp.subspace.kernel.org (Postfix) with ESMTP id D4A5E31AF18; Fri, 17 Oct 2025 10:50:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=93.17.235.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698215; cv=none; b=SMpmzRzqz9rbEWAuIAAFIsf9ToXmY3xI54QjxpsElErZwpVTkXQGfIaSBTuvsVe8AFDWPkCaKP8H2cRdFcomiveREzi3D8gJe7db7IgJjau3Ks+Lq25nqfFN8XaW2p0pzlfBpcmBf6OlUznSsRRvv0tCEyQeOTknYpzB4bTDlsw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698215; c=relaxed/simple; bh=UvRe1comr2eR9AXgYZtq85YOzdzM9AabV0Yw9dB03zE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=lY9YWW4bKQodjsTOvZiUaM/MDhzYmGaVIgUI/41c7AOgK08/uH0oXEQTIJKM0RCpwkZsEi1/TJqea7QqjGz4+IqoLV5hMh6kWp1m338tTx31yDSU4pwPUIS5TB84/SYbQbvuNmM13WW7rJSJv25igZLdZxZUnpMUdjDYjtXCbrI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu; spf=pass smtp.mailfrom=csgroup.eu; arc=none smtp.client-ip=93.17.235.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=csgroup.eu Received: from localhost (mailhub4.si.c-s.fr [172.26.127.67]) by localhost (Postfix) with ESMTP id 4cp17w0N06z9sSn; Fri, 17 Oct 2025 12:21:32 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from pegase2.c-s.fr ([172.26.127.65]) by localhost (pegase2.c-s.fr [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mFW7-YaYrFBX; Fri, 17 Oct 2025 12:21:31 +0200 (CEST) Received: from messagerie.si.c-s.fr (messagerie.si.c-s.fr [192.168.25.192]) by pegase2.c-s.fr (Postfix) with ESMTP id 4cp17v6MQLz9sSm; Fri, 17 Oct 2025 12:21:31 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by messagerie.si.c-s.fr (Postfix) with ESMTP id C62308B786; Fri, 17 Oct 2025 12:21:31 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from messagerie.si.c-s.fr ([127.0.0.1]) by localhost (messagerie.si.c-s.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id RGRc2vgVmK50; Fri, 17 Oct 2025 12:21:31 +0200 (CEST) Received: from PO20335.idsi0.si.c-s.fr (unknown [192.168.235.99]) by messagerie.si.c-s.fr (Postfix) with ESMTP id A01AE8B780; Fri, 17 Oct 2025 12:21:30 +0200 (CEST) From: Christophe Leroy To: Alexander Viro , Christian Brauner , Jan Kara , Thomas Gleixner , Ingo Molnar , Peter Zijlstra , Darren Hart , Davidlohr Bueso , "Andre Almeida" , Andrew Morton , Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , "David S. Miller" , Jakub Kicinski , Simon Horman , Daniel Borkmann , Dave Hansen , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin Cc: Christophe Leroy , linux-block@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Subject: [PATCH v3 07/10] powerpc/uaccess: Refactor user_{read/write/}_access_begin() Date: Fri, 17 Oct 2025 12:21:03 +0200 Message-ID: X-Mailer: git-send-email 2.49.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3535; i=christophe.leroy@csgroup.eu; h=from:subject:message-id; bh=UvRe1comr2eR9AXgYZtq85YOzdzM9AabV0Yw9dB03zE=; b=owGbwMvMwCV2d0KB2p7V54MZT6slMWR8kphikPjQIlVxtt1uu8/8/Bt13125Kectqvz6vQxv6 L7pj/rOd5SyMIhxMciKKbIc/8+9a0bXl9T8qbv0YeawMoEMYeDiFICJJCxkZLiXzfjswjqPzfkN 3h/vb63Ou6Q9Y/7mF0qpM/7vCXW+dJ+d4X+gzoGGUukPsj2FAYwpE6fkLLrsxO8y9+aU71yftBv f7WAEAA== X-Developer-Key: i=christophe.leroy@csgroup.eu; a=openpgp; fpr=10FFE6F8B390DE17ACC2632368A92FEB01B8DD78 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" user_read_access_begin() and user_write_access_begin() and user_access_begin() are now very similar. Create a common __user_access_begin() that take direction as parameter. In order to avoid a warning with the conditional call of barrier_nospec() which is sometimes an empty macro, change it to a do {} while (0). Signed-off-by: Christophe Leroy --- v2: New --- arch/powerpc/include/asm/barrier.h | 2 +- arch/powerpc/include/asm/uaccess.h | 46 +++++++++--------------------- 2 files changed, 14 insertions(+), 34 deletions(-) diff --git a/arch/powerpc/include/asm/barrier.h b/arch/powerpc/include/asm/= barrier.h index 9e9833faa4af8..9d2f612cfb1d7 100644 --- a/arch/powerpc/include/asm/barrier.h +++ b/arch/powerpc/include/asm/barrier.h @@ -102,7 +102,7 @@ do { \ =20 #else /* !CONFIG_PPC_BARRIER_NOSPEC */ #define barrier_nospec_asm -#define barrier_nospec() +#define barrier_nospec() do {} while (0) #endif /* CONFIG_PPC_BARRIER_NOSPEC */ =20 /* diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/= uaccess.h index 698996f348914..49254f7d90691 100644 --- a/arch/powerpc/include/asm/uaccess.h +++ b/arch/powerpc/include/asm/uaccess.h @@ -410,50 +410,30 @@ copy_mc_to_user(void __user *to, const void *from, un= signed long n) extern long __copy_from_user_flushcache(void *dst, const void __user *src, unsigned size); =20 -static __must_check __always_inline bool user_access_begin(const void __us= er *ptr, size_t len) +static __must_check __always_inline bool __user_access_begin(const void __= user *ptr, size_t len, + unsigned long dir) { if (unlikely(!access_ok(ptr, len))) return false; =20 might_fault(); =20 - barrier_nospec(); - allow_read_write_user((void __user *)ptr, ptr, len); + if (dir & KUAP_READ) + barrier_nospec(); + allow_user_access((void __user *)ptr, dir); return true; } -#define user_access_begin user_access_begin -#define user_access_end prevent_current_access_user -#define user_access_save prevent_user_access_return -#define user_access_restore restore_user_access =20 -static __must_check __always_inline bool -user_read_access_begin(const void __user *ptr, size_t len) -{ - if (unlikely(!access_ok(ptr, len))) - return false; +#define user_access_begin(p, l) __user_access_begin(p, l, KUAP_READ_WRITE) +#define user_read_access_begin(p, l) __user_access_begin(p, l, KUAP_READ) +#define user_write_access_begin(p, l) __user_access_begin(p, l, KUAP_WRITE) =20 - might_fault(); - - barrier_nospec(); - allow_read_from_user(ptr, len); - return true; -} -#define user_read_access_begin user_read_access_begin -#define user_read_access_end prevent_current_read_from_user +#define user_access_end() prevent_user_access(KUAP_READ_WRITE) +#define user_read_access_end() prevent_user_access(KUAP_READ) +#define user_write_access_end() prevent_user_access(KUAP_WRITE) =20 -static __must_check __always_inline bool -user_write_access_begin(const void __user *ptr, size_t len) -{ - if (unlikely(!access_ok(ptr, len))) - return false; - - might_fault(); - - allow_write_to_user((void __user *)ptr, len); - return true; -} -#define user_write_access_begin user_write_access_begin -#define user_write_access_end prevent_current_write_to_user +#define user_access_save prevent_user_access_return +#define user_access_restore restore_user_access =20 #define unsafe_get_user(x, p, e) do { \ __long_type(*(p)) __gu_val; \ --=20 2.49.0 From nobody Sat Feb 7 21:15:28 2026 Received: from pegase2.c-s.fr (pegase2.c-s.fr [93.17.235.10]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 1F3C231AF22; Fri, 17 Oct 2025 10:50:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=93.17.235.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698224; cv=none; b=MKDEzF/QEjz5Kts+7zFENIewg/0kkYDepBYOVgjq+a8Lqw4gcMbWC5/wHhZsxVUDIa2IGXePhrWTI1IkyaiOVNG8Sb6XhaA7vnHS/qE59RC/3DZS4KI0kaxkGblfqiXSGoRhm0QGGezhXvL0MzlTtldMDyFeZkYcHlk3htWM2Pg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698224; c=relaxed/simple; bh=zuDbabfiUqTOLj4mSt5xh9aoc6FtrRisXd/DqchyYms=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VQGGmNWPgP8IViPN9V8Efd3Db7CrV52c/QWU3rL42KtcGbUORDhlz+ZpkQDLkf8vuzqB9Xuzt2M+O7vVDpHv65ouD4lK/A3EiLJf8O8OSkRIHb8CGz8CJOa+jG9UqPErosZuAjnz7jJvfTxNFfKC+SMjlzUSDbr/TgIxqvgsDvc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu; spf=pass smtp.mailfrom=csgroup.eu; arc=none smtp.client-ip=93.17.235.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=csgroup.eu Received: from localhost (mailhub4.si.c-s.fr [172.26.127.67]) by localhost (Postfix) with ESMTP id 4cp17x1RJQz9sSq; Fri, 17 Oct 2025 12:21:33 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from pegase2.c-s.fr ([172.26.127.65]) by localhost (pegase2.c-s.fr [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EnSLQg-DIa5r; Fri, 17 Oct 2025 12:21:33 +0200 (CEST) Received: from messagerie.si.c-s.fr (messagerie.si.c-s.fr [192.168.25.192]) by pegase2.c-s.fr (Postfix) with ESMTP id 4cp17x0RxVz9sSp; Fri, 17 Oct 2025 12:21:33 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by messagerie.si.c-s.fr (Postfix) with ESMTP id EE2B88B786; Fri, 17 Oct 2025 12:21:32 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from messagerie.si.c-s.fr ([127.0.0.1]) by localhost (messagerie.si.c-s.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id 8c1X3xpv_Dtf; Fri, 17 Oct 2025 12:21:32 +0200 (CEST) Received: from PO20335.idsi0.si.c-s.fr (unknown [192.168.235.99]) by messagerie.si.c-s.fr (Postfix) with ESMTP id BD4418B776; Fri, 17 Oct 2025 12:21:31 +0200 (CEST) From: Christophe Leroy To: Alexander Viro , Christian Brauner , Jan Kara , Thomas Gleixner , Ingo Molnar , Peter Zijlstra , Darren Hart , Davidlohr Bueso , "Andre Almeida" , Andrew Morton , Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , "David S. Miller" , Jakub Kicinski , Simon Horman , Daniel Borkmann , Dave Hansen , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin Cc: Christophe Leroy , linux-block@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Subject: [PATCH v3 08/10] powerpc/32s: Fix segments setup when TASK_SIZE is not a multiple of 256M Date: Fri, 17 Oct 2025 12:21:04 +0200 Message-ID: <43ca51e6005cd102389ad18f362d0f552210ad0a.1760529207.git.christophe.leroy@csgroup.eu> X-Mailer: git-send-email 2.49.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4823; i=christophe.leroy@csgroup.eu; h=from:subject:message-id; bh=zuDbabfiUqTOLj4mSt5xh9aoc6FtrRisXd/DqchyYms=; b=owGbwMvMwCV2d0KB2p7V54MZT6slMWR8kpgS03Bzr9E8uZs8H98yXhHmyl+8sOp5Wg9H/u7LU ps/bn4Z3lHKwiDGxSArpshy/D/3rhldX1Lzp+7Sh5nDygQyhIGLUwAm4nyfkeEg3+k7NcHvHU87 ff/3ddH9+fmZ2kvq1svyrUmw//xB76Yyw/+ADwVlrxVVDA8lmD09uPTmxx09IpoeXJlv8nbqhHP ksbADAA== X-Developer-Key: i=christophe.leroy@csgroup.eu; a=openpgp; fpr=10FFE6F8B390DE17ACC2632368A92FEB01B8DD78 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For book3s/32 it is assumed that TASK_SIZE is a multiple of 256 Mbytes, but Kconfig allows any value for TASK_SIZE. In all relevant calculations, align TASK_SIZE to the upper 256 Mbytes boundary. Also use ASM_CONST() in the definition of TASK_SIZE to ensure it is seen as an unsigned constant. Signed-off-by: Christophe Leroy --- arch/powerpc/include/asm/book3s/32/mmu-hash.h | 5 ++++- arch/powerpc/include/asm/task_size_32.h | 2 +- arch/powerpc/kernel/asm-offsets.c | 2 +- arch/powerpc/kernel/head_book3s_32.S | 6 +++--- arch/powerpc/mm/book3s32/mmu.c | 2 +- arch/powerpc/mm/ptdump/segment_regs.c | 2 +- 6 files changed, 11 insertions(+), 8 deletions(-) diff --git a/arch/powerpc/include/asm/book3s/32/mmu-hash.h b/arch/powerpc/i= nclude/asm/book3s/32/mmu-hash.h index 8435bf3cdabfa..387d370c8a358 100644 --- a/arch/powerpc/include/asm/book3s/32/mmu-hash.h +++ b/arch/powerpc/include/asm/book3s/32/mmu-hash.h @@ -192,12 +192,15 @@ extern s32 patch__hash_page_B, patch__hash_page_C; extern s32 patch__flush_hash_A0, patch__flush_hash_A1, patch__flush_hash_A= 2; extern s32 patch__flush_hash_B; =20 +#include +#include + #include #include =20 static __always_inline void update_user_segment(u32 n, u32 val) { - if (n << 28 < TASK_SIZE) + if (n << 28 < ALIGN(TASK_SIZE, SZ_256M)) mtsr(val + n * 0x111, n << 28); } =20 diff --git a/arch/powerpc/include/asm/task_size_32.h b/arch/powerpc/include= /asm/task_size_32.h index de7290ee770fb..30edc21f71fbd 100644 --- a/arch/powerpc/include/asm/task_size_32.h +++ b/arch/powerpc/include/asm/task_size_32.h @@ -6,7 +6,7 @@ #error User TASK_SIZE overlaps with KERNEL_START address #endif =20 -#define TASK_SIZE (CONFIG_TASK_SIZE) +#define TASK_SIZE ASM_CONST(CONFIG_TASK_SIZE) =20 /* * This decides where the kernel will search for a free chunk of vm space = during diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-of= fsets.c index a4bc80b30410a..46149f326fd42 100644 --- a/arch/powerpc/kernel/asm-offsets.c +++ b/arch/powerpc/kernel/asm-offsets.c @@ -331,7 +331,7 @@ int main(void) =20 #ifndef CONFIG_PPC64 DEFINE(TASK_SIZE, TASK_SIZE); - DEFINE(NUM_USER_SEGMENTS, TASK_SIZE>>28); + DEFINE(NUM_USER_SEGMENTS, ALIGN(TASK_SIZE, SZ_256M) >> 28); #endif /* ! CONFIG_PPC64 */ =20 /* datapage offsets for use by vdso */ diff --git a/arch/powerpc/kernel/head_book3s_32.S b/arch/powerpc/kernel/hea= d_book3s_32.S index cb2bca76be535..c1779455ea32f 100644 --- a/arch/powerpc/kernel/head_book3s_32.S +++ b/arch/powerpc/kernel/head_book3s_32.S @@ -420,7 +420,7 @@ InstructionTLBMiss: lwz r2,0(r2) /* get pmd entry */ #ifdef CONFIG_EXECMEM rlwinm r3, r0, 4, 0xf - subi r3, r3, (TASK_SIZE >> 28) & 0xf + subi r3, r3, NUM_USER_SEGMENTS #endif rlwinm. r2,r2,0,0,19 /* extract address of pte page */ beq- InstructionAddressInvalid /* return if no mapping */ @@ -475,7 +475,7 @@ DataLoadTLBMiss: lwz r2,0(r1) /* get pmd entry */ rlwinm r3, r0, 4, 0xf rlwinm. r2,r2,0,0,19 /* extract address of pte page */ - subi r3, r3, (TASK_SIZE >> 28) & 0xf + subi r3, r3, NUM_USER_SEGMENTS beq- 2f /* bail if no mapping */ 1: rlwimi r2,r0,22,20,29 /* insert next 10 bits of address */ lwz r2,0(r2) /* get linux-style pte */ @@ -554,7 +554,7 @@ DataStoreTLBMiss: lwz r2,0(r1) /* get pmd entry */ rlwinm r3, r0, 4, 0xf rlwinm. r2,r2,0,0,19 /* extract address of pte page */ - subi r3, r3, (TASK_SIZE >> 28) & 0xf + subi r3, r3, NUM_USER_SEGMENTS beq- 2f /* bail if no mapping */ 1: rlwimi r2,r0,22,20,29 /* insert next 10 bits of address */ diff --git a/arch/powerpc/mm/book3s32/mmu.c b/arch/powerpc/mm/book3s32/mmu.c index c42ecdf94e48c..37eefc6786a72 100644 --- a/arch/powerpc/mm/book3s32/mmu.c +++ b/arch/powerpc/mm/book3s32/mmu.c @@ -225,7 +225,7 @@ int mmu_mark_initmem_nx(void) =20 BUILD_BUG_ON(ALIGN_DOWN(MODULES_VADDR, SZ_256M) < TASK_SIZE); =20 - for (i =3D TASK_SIZE >> 28; i < 16; i++) { + for (i =3D ALIGN(TASK_SIZE, SZ_256M) >> 28; i < 16; i++) { /* Do not set NX on VM space for modules */ if (is_module_segment(i << 28)) continue; diff --git a/arch/powerpc/mm/ptdump/segment_regs.c b/arch/powerpc/mm/ptdump= /segment_regs.c index 9df3af8d481f1..c06704b18a2c8 100644 --- a/arch/powerpc/mm/ptdump/segment_regs.c +++ b/arch/powerpc/mm/ptdump/segment_regs.c @@ -31,7 +31,7 @@ static int sr_show(struct seq_file *m, void *v) int i; =20 seq_puts(m, "---[ User Segments ]---\n"); - for (i =3D 0; i < TASK_SIZE >> 28; i++) + for (i =3D 0; i < ALIGN(TASK_SIZE, SZ_256M) >> 28; i++) seg_show(m, i); =20 seq_puts(m, "\n---[ Kernel Segments ]---\n"); --=20 2.49.0 From nobody Sat Feb 7 21:15:28 2026 Received: from pegase2.c-s.fr (pegase2.c-s.fr [93.17.235.10]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 2F4233195E5; Fri, 17 Oct 2025 10:50:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=93.17.235.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698206; cv=none; b=ApHp5tMkdhTlCEyU6MfiS9kjsbs8EUg5raTzu4VRZGilZH8KYA5kMhbs+JGojCAlJSn+yG5MrioIgZD77M5GmLicXToRx+SMVEwmzaDHReRWtVvXN2NALRWX1YQzSQZ9GZMkpTj07mdtDf783we1h9ZMdrVAdBo5fFVjDAtCQto= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698206; c=relaxed/simple; bh=Im9UZffnD6V0KfkjwdG+DCiJql6cfGfj6sEhY/Erl40=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tN/r4NJjvTtXVnxEtUOO/fI7p/1/OF2b7hDmGTJoZc6/vQcWvRyjBGMwNz0QQNnooxLmnMIJj/zzXe67BC9czK7S915h8w4/qFmcOoclTRQnZDdfHyJf6TKNjZd7DNgiCPH837anZ6pb4l4kx8SFXSHIQwkbXgHyO1+qiBvYXHk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu; spf=pass smtp.mailfrom=csgroup.eu; arc=none smtp.client-ip=93.17.235.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=csgroup.eu Received: from localhost (mailhub4.si.c-s.fr [172.26.127.67]) by localhost (Postfix) with ESMTP id 4cp17y2Lvmz9sSs; Fri, 17 Oct 2025 12:21:34 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from pegase2.c-s.fr ([172.26.127.65]) by localhost (pegase2.c-s.fr [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0D7ea81fU72c; Fri, 17 Oct 2025 12:21:34 +0200 (CEST) Received: from messagerie.si.c-s.fr (messagerie.si.c-s.fr [192.168.25.192]) by pegase2.c-s.fr (Postfix) with ESMTP id 4cp17y1QHqz9sSr; Fri, 17 Oct 2025 12:21:34 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by messagerie.si.c-s.fr (Postfix) with ESMTP id 1A9798B786; Fri, 17 Oct 2025 12:21:34 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from messagerie.si.c-s.fr ([127.0.0.1]) by localhost (messagerie.si.c-s.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id CQQoDsn3Q25M; Fri, 17 Oct 2025 12:21:33 +0200 (CEST) Received: from PO20335.idsi0.si.c-s.fr (unknown [192.168.235.99]) by messagerie.si.c-s.fr (Postfix) with ESMTP id E4FAB8B780; Fri, 17 Oct 2025 12:21:32 +0200 (CEST) From: Christophe Leroy To: Alexander Viro , Christian Brauner , Jan Kara , Thomas Gleixner , Ingo Molnar , Peter Zijlstra , Darren Hart , Davidlohr Bueso , "Andre Almeida" , Andrew Morton , Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , "David S. Miller" , Jakub Kicinski , Simon Horman , Daniel Borkmann , Dave Hansen , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin Cc: Christophe Leroy , linux-block@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Subject: [PATCH v3 09/10] powerpc/32: Automatically adapt TASK_SIZE based on constraints Date: Fri, 17 Oct 2025 12:21:05 +0200 Message-ID: X-Mailer: git-send-email 2.49.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=6170; i=christophe.leroy@csgroup.eu; h=from:subject:message-id; bh=Im9UZffnD6V0KfkjwdG+DCiJql6cfGfj6sEhY/Erl40=; b=owGbwMvMwCV2d0KB2p7V54MZT6slMWR8kpiSordoxcnw7sKJe379vmp2pkBIe2vow6RdiZq9y Q59P+0vd5SyMIhxMciKKbIc/8+9a0bXl9T8qbv0YeawMoEMYeDiFICJXNnMyHDKrezVhC0ebi9+ nbQ6ZLvkdPgZab76IyJO9R6nJ9Qk8HMy/FNr+yKb1c9SrVbAsWbeova7NU8EJv/3OylotfDci/r W89wA X-Developer-Key: i=christophe.leroy@csgroup.eu; a=openpgp; fpr=10FFE6F8B390DE17ACC2632368A92FEB01B8DD78 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" At the time being, TASK_SIZE can be customized by the user via Kconfig but it is not possible to check all constraints in Kconfig. Impossible setups are detected at compile time with BUILD_BUG() but that leads to build failure when setting crazy values. It is not a problem on its own because the user will usually either use the default value or set a well thought value. However build robots generate crazy random configs that lead to build failures, and build robots see it as a regression every time a patch adds such a constraint. So instead of failing the build when the custom TASK_SIZE is too big, just adjust it to the maximum possible value matching the setup. Several architectures already calculate TASK_SIZE based on other parameters and options. In order to do so, move MODULES_VADDR calculation into task_size_32.h and ensure that: - On book3s/32, userspace and module area have their own segments (256M) - On 8xx, userspace has its own full PGDIR entries (4M) Then TASK_SIZE is guaranteed to be correct so remove related BUILD_BUG()s. Signed-off-by: Christophe Leroy --- arch/powerpc/Kconfig | 3 +-- arch/powerpc/include/asm/book3s/32/pgtable.h | 4 --- arch/powerpc/include/asm/nohash/32/mmu-8xx.h | 4 --- arch/powerpc/include/asm/task_size_32.h | 26 ++++++++++++++++++++ arch/powerpc/mm/book3s32/mmu.c | 2 -- arch/powerpc/mm/mem.c | 2 -- arch/powerpc/mm/nohash/8xx.c | 2 -- 7 files changed, 27 insertions(+), 16 deletions(-) diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig index e24f4d88885ae..10a8d4a5fea1f 100644 --- a/arch/powerpc/Kconfig +++ b/arch/powerpc/Kconfig @@ -1292,9 +1292,8 @@ config TASK_SIZE_BOOL Say N here unless you know what you are doing. =20 config TASK_SIZE - hex "Size of user task space" if TASK_SIZE_BOOL + hex "Size of maximum user task space" if TASK_SIZE_BOOL default "0x80000000" if PPC_8xx - default "0xb0000000" if PPC_BOOK3S_32 && EXECMEM default "0xc0000000" =20 config MODULES_SIZE_BOOL diff --git a/arch/powerpc/include/asm/book3s/32/pgtable.h b/arch/powerpc/in= clude/asm/book3s/32/pgtable.h index 87dcca962be78..41ae404d0b7a6 100644 --- a/arch/powerpc/include/asm/book3s/32/pgtable.h +++ b/arch/powerpc/include/asm/book3s/32/pgtable.h @@ -195,10 +195,6 @@ void unmap_kernel_page(unsigned long va); #define VMALLOC_END ioremap_bot #endif =20 -#define MODULES_END ALIGN_DOWN(PAGE_OFFSET, SZ_256M) -#define MODULES_SIZE (CONFIG_MODULES_SIZE * SZ_1M) -#define MODULES_VADDR (MODULES_END - MODULES_SIZE) - #ifndef __ASSEMBLER__ #include #include diff --git a/arch/powerpc/include/asm/nohash/32/mmu-8xx.h b/arch/powerpc/in= clude/asm/nohash/32/mmu-8xx.h index f19115db8072f..74ad32e1588cf 100644 --- a/arch/powerpc/include/asm/nohash/32/mmu-8xx.h +++ b/arch/powerpc/include/asm/nohash/32/mmu-8xx.h @@ -170,10 +170,6 @@ =20 #define mmu_linear_psize MMU_PAGE_8M =20 -#define MODULES_END PAGE_OFFSET -#define MODULES_SIZE (CONFIG_MODULES_SIZE * SZ_1M) -#define MODULES_VADDR (MODULES_END - MODULES_SIZE) - #ifndef __ASSEMBLER__ =20 #include diff --git a/arch/powerpc/include/asm/task_size_32.h b/arch/powerpc/include= /asm/task_size_32.h index 30edc21f71fbd..42a64bbd1964f 100644 --- a/arch/powerpc/include/asm/task_size_32.h +++ b/arch/powerpc/include/asm/task_size_32.h @@ -2,11 +2,37 @@ #ifndef _ASM_POWERPC_TASK_SIZE_32_H #define _ASM_POWERPC_TASK_SIZE_32_H =20 +#include + #if CONFIG_TASK_SIZE > CONFIG_KERNEL_START #error User TASK_SIZE overlaps with KERNEL_START address #endif =20 +#ifdef CONFIG_PPC_8xx +#define MODULES_END ASM_CONST(CONFIG_PAGE_OFFSET) +#define MODULES_SIZE (CONFIG_MODULES_SIZE * SZ_1M) +#define MODULES_VADDR (MODULES_END - MODULES_SIZE) +#define MODULES_BASE (MODULES_VADDR & ~(UL(SZ_4M) - 1)) +#define USER_TOP MODULES_BASE +#endif + +#ifdef CONFIG_PPC_BOOK3S_32 +#define MODULES_END (ASM_CONST(CONFIG_PAGE_OFFSET) & ~(UL(SZ_256M) - 1)) +#define MODULES_SIZE (CONFIG_MODULES_SIZE * SZ_1M) +#define MODULES_VADDR (MODULES_END - MODULES_SIZE) +#define MODULES_BASE (MODULES_VADDR & ~(UL(SZ_256M) - 1)) +#define USER_TOP MODULES_BASE +#endif + +#ifndef USER_TOP +#define USER_TOP ASM_CONST(CONFIG_PAGE_OFFSET) +#endif + +#if CONFIG_TASK_SIZE < USER_TOP #define TASK_SIZE ASM_CONST(CONFIG_TASK_SIZE) +#else +#define TASK_SIZE USER_TOP +#endif =20 /* * This decides where the kernel will search for a free chunk of vm space = during diff --git a/arch/powerpc/mm/book3s32/mmu.c b/arch/powerpc/mm/book3s32/mmu.c index 37eefc6786a72..07660e8badbda 100644 --- a/arch/powerpc/mm/book3s32/mmu.c +++ b/arch/powerpc/mm/book3s32/mmu.c @@ -223,8 +223,6 @@ int mmu_mark_initmem_nx(void) =20 update_bats(); =20 - BUILD_BUG_ON(ALIGN_DOWN(MODULES_VADDR, SZ_256M) < TASK_SIZE); - for (i =3D ALIGN(TASK_SIZE, SZ_256M) >> 28; i < 16; i++) { /* Do not set NX on VM space for modules */ if (is_module_segment(i << 28)) diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c index 3ddbfdbfa9413..bc0f1a9eb0bc0 100644 --- a/arch/powerpc/mm/mem.c +++ b/arch/powerpc/mm/mem.c @@ -401,8 +401,6 @@ struct execmem_info __init *execmem_arch_setup(void) #ifdef MODULES_VADDR unsigned long limit =3D (unsigned long)_etext - SZ_32M; =20 - BUILD_BUG_ON(TASK_SIZE > MODULES_VADDR); - /* First try within 32M limit from _etext to avoid branch trampolines */ if (MODULES_VADDR < PAGE_OFFSET && MODULES_END > limit) { start =3D limit; diff --git a/arch/powerpc/mm/nohash/8xx.c b/arch/powerpc/mm/nohash/8xx.c index ab1505cf42bf5..a9d3f4729eada 100644 --- a/arch/powerpc/mm/nohash/8xx.c +++ b/arch/powerpc/mm/nohash/8xx.c @@ -209,8 +209,6 @@ void __init setup_initial_memory_limit(phys_addr_t firs= t_memblock_base, =20 /* 8xx can only access 32MB at the moment */ memblock_set_current_limit(min_t(u64, first_memblock_size, SZ_32M)); - - BUILD_BUG_ON(ALIGN_DOWN(MODULES_VADDR, PGDIR_SIZE) < TASK_SIZE); } =20 int pud_clear_huge(pud_t *pud) --=20 2.49.0 From nobody Sat Feb 7 21:15:28 2026 Received: from pegase2.c-s.fr (pegase2.c-s.fr [93.17.235.10]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 231EB31DDB9; Fri, 17 Oct 2025 10:50:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=93.17.235.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698234; cv=none; b=gVuTlxZXrdQAnR0NOV3UB6OsYTszhqHdizo9TKWpLVY0II48SStE9sQKh9TX39snrIHlnDfAB9D1fKH3DwBRRcfHjDytVj5jAH5TIlRHvqnGZBSf6HK9q0HoYcR7txZq3G2jhd5HYiiGmwinGTPHQqr1mA6BLGs5xKhpPPk0E+c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760698234; c=relaxed/simple; bh=1n3jix8GAFus2icu2hVBBUdHzlbbrlmGYrh+XGB2nFw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=C5g+egbTfTHq5tVAqmQHtL3dFj9sUat8z4aU24iROMK84oUBbmHkc6nd72t6v9GMoAMyHygQVHFv840KpUkMeyio9bdkhCgEg9aaSMPx62u1yeZj7/gNV3OSKi3t3nT0FnvWmAqItjp45Jkp81XFreDa7vV4S9oI7SFd+Uj+s94= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu; spf=pass smtp.mailfrom=csgroup.eu; arc=none smtp.client-ip=93.17.235.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=csgroup.eu Received: from localhost (mailhub4.si.c-s.fr [172.26.127.67]) by localhost (Postfix) with ESMTP id 4cp17z4S6Bz9sSv; Fri, 17 Oct 2025 12:21:35 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from pegase2.c-s.fr ([172.26.127.65]) by localhost (pegase2.c-s.fr [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3Oi-5uUs2W2I; Fri, 17 Oct 2025 12:21:35 +0200 (CEST) Received: from messagerie.si.c-s.fr (messagerie.si.c-s.fr [192.168.25.192]) by pegase2.c-s.fr (Postfix) with ESMTP id 4cp17z2zZkz9sSt; Fri, 17 Oct 2025 12:21:35 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by messagerie.si.c-s.fr (Postfix) with ESMTP id 4FC4B8B780; Fri, 17 Oct 2025 12:21:35 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from messagerie.si.c-s.fr ([127.0.0.1]) by localhost (messagerie.si.c-s.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id 2LwN0z7fCh8C; Fri, 17 Oct 2025 12:21:35 +0200 (CEST) Received: from PO20335.idsi0.si.c-s.fr (unknown [192.168.235.99]) by messagerie.si.c-s.fr (Postfix) with ESMTP id 119018B776; Fri, 17 Oct 2025 12:21:34 +0200 (CEST) From: Christophe Leroy To: Alexander Viro , Christian Brauner , Jan Kara , Thomas Gleixner , Ingo Molnar , Peter Zijlstra , Darren Hart , Davidlohr Bueso , "Andre Almeida" , Andrew Morton , Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , "David S. Miller" , Jakub Kicinski , Simon Horman , Daniel Borkmann , Dave Hansen , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin Cc: Christophe Leroy , linux-block@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Subject: [PATCH v3 10/10] powerpc/uaccess: Implement masked user access Date: Fri, 17 Oct 2025 12:21:06 +0200 Message-ID: <179dbcda9eb3bdc5d314c949047db6ef8fd8a2ee.1760529207.git.christophe.leroy@csgroup.eu> X-Mailer: git-send-email 2.49.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=9919; i=christophe.leroy@csgroup.eu; h=from:subject:message-id; bh=1n3jix8GAFus2icu2hVBBUdHzlbbrlmGYrh+XGB2nFw=; b=owGbwMvMwCV2d0KB2p7V54MZT6slMWR8kphynq246FJOj/j+fKEfe4+m+oukT3uw3FIjYO6cm itXXOoOdpSyMIhxMciKKbIc/8+9a0bXl9T8qbv0YeawMoEMYeDiFICJ/Cxk+GcsHXm1Zp/tpl2c Tc9Xq/JP/dO+3dou1Szm21H/fXHVP7cy/E9MWSBbKqYvyW+arBNbdmmBpZzUC2ndCr913YufnX6 Zxg4A X-Developer-Key: i=christophe.leroy@csgroup.eu; a=openpgp; fpr=10FFE6F8B390DE17ACC2632368A92FEB01B8DD78 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Masked user access avoids the address/size verification by access_ok(). Allthough its main purpose is to skip the speculation in the verification of user address and size hence avoid the need of spec mitigation, it also has the advantage of reducing the amount of instructions required so it even benefits to platforms that don't need speculation mitigation, especially when the size of the copy is not know at build time. So implement masked user access on powerpc. The only requirement is to have memory gap that faults between the top user space and the real start of kernel area. On 64 bits platforms the address space is divided that way: 0xffffffffffffffff +------------------+ | | | kernel space | | | 0xc000000000000000 +------------------+ <=3D=3D PAGE_OFFSET |//////////////////| |//////////////////| 0x8000000000000000 |//////////////////| |//////////////////| |//////////////////| 0x0010000000000000 +------------------+ <=3D=3D TASK_SIZE_MAX | | | user space | | | 0x0000000000000000 +------------------+ Kernel is always above 0x8000000000000000 and user always below, with a gap in-between. It leads to a 3 instructions sequence: 20: 7c 69 fe 76 sradi r9,r3,63 24: 7c 69 48 78 andc r9,r3,r9 28: 79 23 00 4c rldimi r3,r9,0,1 This sequence leaves r3 unmodified when it is below 0x8000000000000000 and clamps it to 0x8000000000000000 if it is above. On 32 bits it is more tricky. In theory user space can go up to 0xbfffffff while kernel will usually start at 0xc0000000. So a gap needs to be added in-between. Allthough in theory a single 4k page would suffice, it is easier and more efficient to enforce a 128k gap below kernel, as it simplifies the masking. e500 has the isel instruction which allows selecting one value or the other without branch and that instruction is not speculative, so use it. Allthough GCC usually generates code using that instruction, it is safer to use inline assembly to be sure. The result is: 14: 3d 20 bf fe lis r9,-16386 18: 7c 03 48 40 cmplw r3,r9 1c: 7c 69 18 5e iselgt r3,r9,r3 On other ones, when kernel space is over 0x80000000 and user space is below, the logic in mask_user_address_simple() leads to a 3 instruction sequence: 70: 7c 69 fe 70 srawi r9,r3,31 74: 7c 69 48 78 andc r9,r3,r9 78: 51 23 00 7e rlwimi r3,r9,0,1,31 This is the default on powerpc 8xx. When the limit between user space and kernel space is not 0x80000000, mask_user_address_32() is used and a 6 instructions sequence is generated: 24: 54 69 7c 7e srwi r9,r3,17 28: 21 29 57 ff subfic r9,r9,22527 2c: 7d 29 fe 70 srawi r9,r9,31 30: 75 2a b0 00 andis. r10,r9,45056 34: 7c 63 48 78 andc r3,r3,r9 38: 7c 63 53 78 or r3,r3,r10 The constraint is that TASK_SIZE be aligned to 128K in order to get the most optimal number of instructions. When CONFIG_PPC_BARRIER_NOSPEC is not defined, fallback on the test-based masking as it is quicker than the 6 instructions sequence but not quicker than the 3 instructions sequences above. As an exemple, allthough barrier_nospec() voids on the 8xx, this change has the following impact on strncpy_from_user(): the length of the function is reduced from 488 to 340 bytes: Start of the function with the patch: 00000000 : 0: 7c ab 2b 79 mr. r11,r5 4: 40 81 01 48 ble 14c 8: 7c 89 fe 70 srawi r9,r4,31 c: 7c 84 48 78 andc r4,r4,r9 10: 51 24 00 00 rlwimi r4,r9,0,0,0 14: 94 21 ff f0 stwu r1,-16(r1) 18: 3d 20 dc 00 lis r9,-9216 1c: 7d 3a c3 a6 mtspr 794,r9 20: 2f 8b 00 03 cmpwi cr7,r11,3 24: 40 9d 00 b8 ble cr7,dc ... Start of the function without the patch: 00000000 : 0: 7c a0 2b 79 mr. r0,r5 4: 40 81 01 10 ble 114 8: 2f 84 00 00 cmpwi cr7,r4,0 c: 41 9c 01 30 blt cr7,13c 10: 3d 20 80 00 lis r9,-32768 14: 7d 24 48 50 subf r9,r4,r9 18: 7f 80 48 40 cmplw cr7,r0,r9 1c: 7c 05 03 78 mr r5,r0 20: 41 9d 01 00 bgt cr7,120 24: 3d 20 80 00 lis r9,-32768 28: 7d 25 48 50 subf r9,r5,r9 2c: 7f 84 48 40 cmplw cr7,r4,r9 30: 38 e0 ff f2 li r7,-14 34: 41 9d 00 e4 bgt cr7,118 38: 94 21 ff e0 stwu r1,-32(r1) 3c: 3d 20 dc 00 lis r9,-9216 40: 7d 3a c3 a6 mtspr 794,r9 44: 2b 85 00 03 cmplwi cr7,r5,3 48: 40 9d 01 6c ble cr7,1b4 ... 118: 7c e3 3b 78 mr r3,r7 11c: 4e 80 00 20 blr 120: 7d 25 4b 78 mr r5,r9 124: 3d 20 80 00 lis r9,-32768 128: 7d 25 48 50 subf r9,r5,r9 12c: 7f 84 48 40 cmplw cr7,r4,r9 130: 38 e0 ff f2 li r7,-14 134: 41 bd ff e4 bgt cr7,118 138: 4b ff ff 00 b 38 13c: 38 e0 ff f2 li r7,-14 140: 4b ff ff d8 b 118 ... Signed-off-by: Christophe Leroy --- v3: Rewrite mask_user_address_simple() for a smaller result on powerpc64, s= uggested by Gabriel v2: Added 'likely()' to the test in mask_user_address_fallback() --- arch/powerpc/include/asm/task_size_32.h | 6 +- arch/powerpc/include/asm/uaccess.h | 79 +++++++++++++++++++++++++ 2 files changed, 82 insertions(+), 3 deletions(-) diff --git a/arch/powerpc/include/asm/task_size_32.h b/arch/powerpc/include= /asm/task_size_32.h index 42a64bbd1964f..725ddbf06217f 100644 --- a/arch/powerpc/include/asm/task_size_32.h +++ b/arch/powerpc/include/asm/task_size_32.h @@ -13,7 +13,7 @@ #define MODULES_SIZE (CONFIG_MODULES_SIZE * SZ_1M) #define MODULES_VADDR (MODULES_END - MODULES_SIZE) #define MODULES_BASE (MODULES_VADDR & ~(UL(SZ_4M) - 1)) -#define USER_TOP MODULES_BASE +#define USER_TOP (MODULES_BASE - SZ_4M) #endif =20 #ifdef CONFIG_PPC_BOOK3S_32 @@ -21,11 +21,11 @@ #define MODULES_SIZE (CONFIG_MODULES_SIZE * SZ_1M) #define MODULES_VADDR (MODULES_END - MODULES_SIZE) #define MODULES_BASE (MODULES_VADDR & ~(UL(SZ_256M) - 1)) -#define USER_TOP MODULES_BASE +#define USER_TOP (MODULES_BASE - SZ_4M) #endif =20 #ifndef USER_TOP -#define USER_TOP ASM_CONST(CONFIG_PAGE_OFFSET) +#define USER_TOP ((ASM_CONST(CONFIG_PAGE_OFFSET) - SZ_128K) & ~(UL(SZ_128K= ) - 1)) #endif =20 #if CONFIG_TASK_SIZE < USER_TOP diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/= uaccess.h index 49254f7d90691..a045914fd7135 100644 --- a/arch/powerpc/include/asm/uaccess.h +++ b/arch/powerpc/include/asm/uaccess.h @@ -2,6 +2,8 @@ #ifndef _ARCH_POWERPC_UACCESS_H #define _ARCH_POWERPC_UACCESS_H =20 +#include + #include #include #include @@ -435,6 +437,83 @@ static __must_check __always_inline bool __user_access= _begin(const void __user * #define user_access_save prevent_user_access_return #define user_access_restore restore_user_access =20 +/* + * Masking the user address is an alternative to a conditional + * user_access_begin that can avoid the fencing. This only works + * for dense accesses starting at the address. + */ +static inline void __user *mask_user_address_simple(const void __user *ptr) +{ + unsigned long addr =3D (unsigned long)ptr; + unsigned long sh =3D BITS_PER_LONG - 1; + unsigned long mask =3D (unsigned long)((long)addr >> sh); + + addr =3D ((addr & ~mask) & ((1UL << sh) - 1)) | ((mask & 1UL) << sh); + + return (void __user *)addr; +} + +static inline void __user *mask_user_address_isel(const void __user *ptr) +{ + unsigned long addr; + + asm("cmplw %1, %2; iselgt %0, %2, %1" : "=3Dr"(addr) : "r"(ptr), "r"(TASK= _SIZE) : "cr0"); + + return (void __user *)addr; +} + +/* TASK_SIZE is a multiple of 128K for shifting by 17 to the right */ +static inline void __user *mask_user_address_32(const void __user *ptr) +{ + unsigned long addr =3D (unsigned long)ptr; + unsigned long mask =3D (unsigned long)((long)((TASK_SIZE >> 17) - 1 - (ad= dr >> 17)) >> 31); + + addr =3D (addr & ~mask) | (TASK_SIZE & mask); + + return (void __user *)addr; +} + +static inline void __user *mask_user_address_fallback(const void __user *p= tr) +{ + unsigned long addr =3D (unsigned long)ptr; + + return (void __user *)(likely(addr < TASK_SIZE) ? addr : TASK_SIZE); +} + +static inline void __user *mask_user_address(const void __user *ptr) +{ +#ifdef MODULES_VADDR + const unsigned long border =3D MODULES_VADDR; +#else + const unsigned long border =3D PAGE_OFFSET; +#endif + + if (IS_ENABLED(CONFIG_PPC64)) + return mask_user_address_simple(ptr); + if (IS_ENABLED(CONFIG_E500)) + return mask_user_address_isel(ptr); + if (TASK_SIZE <=3D UL(SZ_2G) && border >=3D UL(SZ_2G)) + return mask_user_address_simple(ptr); + if (IS_ENABLED(CONFIG_PPC_BARRIER_NOSPEC)) + return mask_user_address_32(ptr); + return mask_user_address_fallback(ptr); +} + +static __always_inline void __user *__masked_user_access_begin(const void = __user *p, + unsigned long dir) +{ + void __user *ptr =3D mask_user_address(p); + + might_fault(); + allow_user_access(ptr, dir); + + return ptr; +} + +#define masked_user_access_begin(p) __masked_user_access_begin(p, KUAP_REA= D_WRITE) +#define masked_user_read_access_begin(p) __masked_user_access_begin(p, KUA= P_READ) +#define masked_user_write_access_begin(p) __masked_user_access_begin(p, KU= AP_WRITE) + #define unsafe_get_user(x, p, e) do { \ __long_type(*(p)) __gu_val; \ __typeof__(*(p)) __user *__gu_addr =3D (p); \ --=20 2.49.0