Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Francesco Dolcini <francesco.dolcini@toradex.com>
To:     Richard Zhu <hongxing.zhu@nxp.com>,
        Lucas Stach <l.stach@pengutronix.de>,
        Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>,
        Rob Herring <robh@kernel.org>,
        =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= <kw@linux.com>,
        Sascha Hauer <s.hauer@pengutronix.de>,
        Pengutronix Kernel Team <kernel@pengutronix.de>,
        Fabio Estevam <festevam@gmail.com>,
        NXP Linux Team <linux-imx@nxp.com>,
        Jason Liu <jason.hui.liu@nxp.com>
Cc:     linux-pci@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
        linux-kernel@vger.kernel.org, Bjorn Helgaas <bhelgaas@google.com>,
        Shawn Guo <shawnguo@kernel.org>,
        Francesco Dolcini <francesco.dolcini@toradex.com>
Subject: [RFC PATCH] PCI: imx6: Handle the abort from user-space
Date:   Fri, 28 Jan 2022 09:29:20 +0100
Message-Id: <20220128082920.591115-1-francesco.dolcini@toradex.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Wk6T2yZRtN5gTH1QGt8DDNAzVAEYsic2l0P5iuy3mXpEwD8ReYN/lpIvyG5z?=
 =?us-ascii?Q?rAo4CyshYb8ilKWnbSkz6LCZzcK40MXFPGeBkrXjBjB6ZAufTJZAvYv9IY9Q?=
 =?us-ascii?Q?vj2pFLgzEu30/Feodh8N0Yo7rBloDPsLXfllBZPU2OppY23ZzNxP4XOr2g8Z?=
 =?us-ascii?Q?HESGlqDCmO78foiekrD83ZhvV06FZiKd8eHX3QGQujhhb4/caSyouhZn9Mlg?=
 =?us-ascii?Q?E8YWpDZhXZmoaMjdyEjmh5Pz2rTUx91gFCRTgUSuxNMEXEhvkSYcz4Zap7XI?=
 =?us-ascii?Q?u+IwRLFytzGVPyxBU0YzuHuMNe+KfmXepzTsikZvdWkcbiJ30w88TsyFH9/V?=
 =?us-ascii?Q?Y6HIWQGm7bF+DCQ1my4lVOTLttTexWRnnWI08ZbLbda5Xj2zV/IbDFtpArs6?=
 =?us-ascii?Q?deAQQ2vzGPzyL3gwjrR6rVtOxFl7pa4G7MGMzIxAAGOm/5KzPKHglde+yn2p?=
 =?us-ascii?Q?lCd1hd2YRYAtYZJDUgQ0T7srJlLiC+ZtssKhL7+L5weqvHLIsog7Q/JxBbMX?=
 =?us-ascii?Q?3kSzjrlWix9BvXJA7/ZuzC3TvyapvOgeYafu5/oKZ62Kjjw5me1BIXhnx+DA?=
 =?us-ascii?Q?XkhLcDg1rtQy36QuKegsLoxoL2F9TD6whndl+Z/CHDB1QTVF9G6KrODd7sVX?=
 =?us-ascii?Q?uhmjBXu2cqgZFcX4J9r+atOqaZzUGXStCNN3AfPPcBD9UqwzTu6borOg/LGp?=
 =?us-ascii?Q?cSo8FMXDXwTPnrD8WH31EPK5OH/qrZHGbdyunUp6UJMDDyD/ARF/k4nCW+L5?=
 =?us-ascii?Q?Q+bXDGJFrIrCX5gkTARCT17I8D6/KjUO3Wtkmg578Wh60+tSGaQg/kyXh/fJ?=
 =?us-ascii?Q?i8qUlzt0r3CQxobfiMrR7GMURlTagH6Da3q/NMaCJTuXGU1AX2Cgxp7SLJY+?=
 =?us-ascii?Q?zgSl32WjENO0a2UOSQs+gVSIO6hmhf/A3Qrp1RIpIDskKGIPLMCizGgO11od?=
 =?us-ascii?Q?q4dZCUn0/a9y2wsiypCZaOQNs8yoomsUjYGqn2Dpa1UUpWEfGqBcXVCK+Nua?=
 =?us-ascii?Q?BzQzQGyUpfddiELzTGXD6fQ7qr8TUz0AAAZ3KBHbVqNrbrBuWWE+vDzr9ceH?=
 =?us-ascii?Q?+fgsJuBrrhGsY13hY/fneebIpxTSwerEvzvDHZy5NIyBfk7K4GDQyhnwksQq?=
 =?us-ascii?Q?0xPyso75ROT2OApOkRVqo785mz0ICEZCNG5d8alKy61Nily93IzWq/yn0U+f?=
 =?us-ascii?Q?9SfpVl3GPJlJ+AjgrAi5PTBBOMXQr0Qi2qScW5eaA2im9IBs8CGgFhAZvKEl?=
 =?us-ascii?Q?69K4TsQwkDh/U+FvbHfXoIHrMrF1VztEYlSI165oMxBPS8ivW/ZnqR84nCE3?=
 =?us-ascii?Q?SVZ1m/HBQ9eFjEHNGO3wgHtjzRRkTzO2frywBiE8zAiQdo2Rm0nkHVFMVwhg?=
 =?us-ascii?Q?J8bvkXTR/pxJOgyWZ1hVzuiB2Tg/qa3pSF1TQDHQZtxuxI0KUq1Rqo1ZTGAz?=
 =?us-ascii?Q?jWIaam7F5kZfMktVspcwzoNwh7OXrJTFdRb/sxNxh0DEdAShBJz/fqCip3Dr?=
 =?us-ascii?Q?+dASIu9X7MzxDIJ7hWPXdTSWiBOiAb/zR2bT6jvHxB3MaxCGLQX0wZao4Rl5?=
 =?us-ascii?Q?0GSozh5jIeZvBCYmK/jK/c/0FufGmAKk4v08IHP/RrNsXqKaJ9oylUh9M6Ke?=
 =?us-ascii?Q?q8yRL3Rl0+Os5wv9XwVfP6CVAGWSGkwgJNXoQaZrzAt91f4DgsDYm6TIgInU?=
 =?us-ascii?Q?oLcaKw=3D=3D?=
X-OriginatorOrg: toradex.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 45f1e6af-b28e-4f3d-06f8-08d9e238492d
X-MS-Exchange-CrossTenant-AuthSource: ZRAP278MB0642.CHEP278.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Jan 2022 08:29:22.3994
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: d9995866-0d9b-4251-8315-093f062abab4
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 6P4cA31WnDBJIcc/svrn9+46miXuq8BvFiIU/I5MTb+tKyF+Q5CLWH1+7G+vk2MglrD2Mf4KbT53xkVXwm0CIr4L91XQQ87f2wQWPzqcFN4=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV0P278MB0386
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From: Jason Liu <jason.hui.liu@nxp.com>

The driver install one hook to handle the external abort, but issue
is that if the abort introduced from user space code, the following
code unsigned long instr = *(unsigned long *)pc; which will created
another data-abort(page domain fault) if CONFIG_CPU_SW_DOMAIN_PAN.

The patch does not intent to use copy_from_user and then do the hack
due to the security consideration. In fact, we can just return and
report the external abort to user-space.

Signed-off-by: Jason Liu <jason.hui.liu@nxp.com>
Reviewed-by: Richard Zhu <hongxing.zhu@nxp.com>
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
---
We have this patch from NXP downstream kernel [1] in our kernel branch [2]
since a long time, to me it would make sense to upstream it. Any concern?

[1] https://source.codeaurora.org/external/imxsupport/linux-imx/commit/?id=62dfb2fb953463dd1b6710567c9e174672a98f24
[2] https://git.toradex.com/cgit/linux-toradex.git/commit/?id=2b42547cf659f979be2defdff6a99f921b33d0f1
---
 drivers/pci/controller/dwc/pci-imx6.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
index 6974bd5aa116..6b178a29e253 100644
--- a/drivers/pci/controller/dwc/pci-imx6.c
+++ b/drivers/pci/controller/dwc/pci-imx6.c
@@ -27,6 +27,7 @@
 #include <linux/resource.h>
 #include <linux/signal.h>
 #include <linux/types.h>
+#include <linux/uaccess.h>
 #include <linux/interrupt.h>
 #include <linux/reset.h>
 #include <linux/phy/phy.h>
@@ -297,8 +298,15 @@ static int imx6q_pcie_abort_handler(unsigned long addr,
 		unsigned int fsr, struct pt_regs *regs)
 {
 	unsigned long pc = instruction_pointer(regs);
-	unsigned long instr = *(unsigned long *)pc;
-	int reg = (instr >> 12) & 15;
+	unsigned long instr;
+	int reg;
+
+	/* if the abort from user-space, just return and report it */
+	if (user_mode(regs))
+		return 1;
+
+	instr = *(unsigned long *)pc;
+	reg = (instr >> 12) & 15;
 
 	/*
 	 * If the instruction being executed was a read,
-- 
2.25.1