| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20190313181502.GA28630@rapoport-lnx>
Date: Wed, 13 Mar 2019 20:15:03 +0200
From: Mike Rapoport <rppt@...ux.ibm.com>
To: Anup Patel <Anup.Patel@....com>
Cc: Palmer Dabbelt <palmer@...ive.com>,
Albert Ou <aou@...s.berkeley.edu>,
Atish Patra <Atish.Patra@....com>,
Paul Walmsley <paul.walmsley@...ive.com>,
Christoph Hellwig <hch@...radead.org>,
"linux-riscv@...ts.infradead.org" <linux-riscv@...ts.infradead.org>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 2/3] RISC-V: Make setup_vm() independent of GCC code model
On Tue, Mar 12, 2019 at 10:08:16PM +0000, Anup Patel wrote:
> The setup_vm() must access kernel symbols in a position independent way
> because it will be called from head.S with MMU off.
>
> If we compile kernel with cmodel=medany then PC-relative addressing will
> be used in setup_vm() to access kernel symbols so it works perfectly fine.
>
> Although, if we compile kernel with cmodel=medlow then either absolute
> addressing or PC-relative addressing (based on whichever requires fewer
> instructions) is used to access kernel symbols in setup_vm(). This can
> break setup_vm() whenever any absolute addressing is used to access
> kernel symbols.
>
> With the movement of setup_vm() from kernel/setup.c to mm/init.c, the
> setup_vm() is now broken for cmodel=medlow but it works perfectly fine
> for cmodel=medany.
>
> This patch fixes setup_vm() and makes it independent of GCC code model
> by accessing kernel symbols relative to kernel load address instead of
> assuming PC-relative addressing.
>
> Fixes: 6f1e9e946f0b ("RISC-V: Move setup_vm() to mm/init.c")
> Signed-off-by: Anup Patel <anup.patel@....com>
> ---
> arch/riscv/kernel/head.S | 1 +
> arch/riscv/mm/init.c | 71 ++++++++++++++++++++++++++--------------
> 2 files changed, 47 insertions(+), 25 deletions(-)
>
> diff --git a/arch/riscv/kernel/head.S b/arch/riscv/kernel/head.S
> index fe884cd69abd..7966262b4f9d 100644
> --- a/arch/riscv/kernel/head.S
> +++ b/arch/riscv/kernel/head.S
> @@ -62,6 +62,7 @@ clear_bss_done:
>
> /* Initialize page tables and relocate to virtual addresses */
> la sp, init_thread_union + THREAD_SIZE
> + la a0, _start
> call setup_vm
> call relocate
>
> diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
> index b379a75ac6a6..f35299f2f3d5 100644
> --- a/arch/riscv/mm/init.c
> +++ b/arch/riscv/mm/init.c
> @@ -172,55 +172,76 @@ void __set_fixmap(enum fixed_addresses idx, phys_addr_t phys, pgprot_t prot)
> }
> }
>
> -asmlinkage void __init setup_vm(void)
> +static inline void *__early_va(void *ptr, uintptr_t load_pa)
> {
> extern char _start;
> + uintptr_t va = (uintptr_t)ptr;
> + uintptr_t sz = (uintptr_t)(&_end) - (uintptr_t)(&_start);
> +
> + if (va >= PAGE_OFFSET && va < (PAGE_OFFSET + sz))
> + return (void *)(load_pa + (va - PAGE_OFFSET));
This is (void *)__pa(va), isn't it?
> + return (void *)va;
The below usage suggests that __early_va() should be used solely for
addresses inside the kernel. What will happen if the accesses is outside
that range? Isn't it a BUG()?
> +}
> +
> +asmlinkage void __init setup_vm(uintptr_t load_pa)
> +{
> uintptr_t i;
> - uintptr_t pa = (uintptr_t) &_start;
> +#ifndef __PAGETABLE_PMD_FOLDED
> + pmd_t *pmdp;
> +#endif
> + pgd_t *pgdp;
> + phys_addr_t map_pa;
> + pgprot_t tableprot = __pgprot(_PAGE_TABLE);
> pgprot_t prot = __pgprot(pgprot_val(PAGE_KERNEL) | _PAGE_EXEC);
>
> - va_pa_offset = PAGE_OFFSET - pa;
> - pfn_base = PFN_DOWN(pa);
> + va_pa_offset = PAGE_OFFSET - load_pa;
> + pfn_base = PFN_DOWN(load_pa);
>
> /* Sanity check alignment and size */
> BUG_ON((PAGE_OFFSET % PGDIR_SIZE) != 0);
> - BUG_ON((pa % (PAGE_SIZE * PTRS_PER_PTE)) != 0);
> + BUG_ON((load_pa % (PAGE_SIZE * PTRS_PER_PTE)) != 0);
>
> #ifndef __PAGETABLE_PMD_FOLDED
> - trampoline_pg_dir[(PAGE_OFFSET >> PGDIR_SHIFT) % PTRS_PER_PGD] =
> - pfn_pgd(PFN_DOWN((uintptr_t)trampoline_pmd),
> - __pgprot(_PAGE_TABLE));
> - trampoline_pmd[0] = pfn_pmd(PFN_DOWN(pa), prot);
> + pgdp = __early_va(trampoline_pg_dir, load_pa);
> + map_pa = (uintptr_t)__early_va(trampoline_pmd, load_pa);
This reads a bit strange: pa = va()
BTW, I think you could keep the pa local variable instead of introducing
map_pa.
> + pgdp[(PAGE_OFFSET >> PGDIR_SHIFT) % PTRS_PER_PGD] =
> + pfn_pgd(PFN_DOWN(map_pa), tableprot);
> + trampoline_pmd[0] = pfn_pmd(PFN_DOWN(load_pa), prot);
> +
> + pgdp = __early_va(swapper_pg_dir, load_pa);
>
> for (i = 0; i < (-PAGE_OFFSET)/PGDIR_SIZE; ++i) {
> size_t o = (PAGE_OFFSET >> PGDIR_SHIFT) % PTRS_PER_PGD + i;
>
> - swapper_pg_dir[o] =
> - pfn_pgd(PFN_DOWN((uintptr_t)swapper_pmd) + i,
> - __pgprot(_PAGE_TABLE));
> + map_pa = (uintptr_t)__early_va(swapper_pmd, load_pa);
> + pgdp[o] = pfn_pgd(PFN_DOWN(map_pa) + i, tableprot);
> }
> + pmdp = __early_va(swapper_pmd, load_pa);
> for (i = 0; i < ARRAY_SIZE(swapper_pmd); i++)
> - swapper_pmd[i] = pfn_pmd(PFN_DOWN(pa + i * PMD_SIZE), prot);
> + pmdp[i] = pfn_pmd(PFN_DOWN(load_pa + i * PMD_SIZE), prot);
>
> - swapper_pg_dir[(FIXADDR_START >> PGDIR_SHIFT) % PTRS_PER_PGD] =
> - pfn_pgd(PFN_DOWN((uintptr_t)fixmap_pmd),
> - __pgprot(_PAGE_TABLE));
> + map_pa = (uintptr_t)__early_va(fixmap_pmd, load_pa);
> + pgdp[(FIXADDR_START >> PGDIR_SHIFT) % PTRS_PER_PGD] =
> + pfn_pgd(PFN_DOWN(map_pa), tableprot);
> + pmdp = __early_va(fixmap_pmd, load_pa);
> + map_pa = (uintptr_t)__early_va(fixmap_pte, load_pa);
> fixmap_pmd[(FIXADDR_START >> PMD_SHIFT) % PTRS_PER_PMD] =
> - pfn_pmd(PFN_DOWN((uintptr_t)fixmap_pte),
> - __pgprot(_PAGE_TABLE));
> + pfn_pmd(PFN_DOWN(map_pa), tableprot);
> #else
> - trampoline_pg_dir[(PAGE_OFFSET >> PGDIR_SHIFT) % PTRS_PER_PGD] =
> - pfn_pgd(PFN_DOWN(pa), prot);
> + pgdp = __early_va(trampoline_pg_dir, load_pa);
> + pgdp[(PAGE_OFFSET >> PGDIR_SHIFT) % PTRS_PER_PGD] =
> + pfn_pgd(PFN_DOWN(load_pa), prot);
> +
> + pgdp = __early_va(swapper_pg_dir, load_pa);
>
> for (i = 0; i < (-PAGE_OFFSET)/PGDIR_SIZE; ++i) {
> size_t o = (PAGE_OFFSET >> PGDIR_SHIFT) % PTRS_PER_PGD + i;
>
> - swapper_pg_dir[o] =
> - pfn_pgd(PFN_DOWN(pa + i * PGDIR_SIZE), prot);
> + pgdp[o] = pfn_pgd(PFN_DOWN(load_pa + i * PGDIR_SIZE), prot);
> }
>
> - swapper_pg_dir[(FIXADDR_START >> PGDIR_SHIFT) % PTRS_PER_PGD] =
> - pfn_pgd(PFN_DOWN((uintptr_t)fixmap_pte),
> - __pgprot(_PAGE_TABLE));
> + map_pa = (uintptr_t)__early_va(fixmap_pte, load_pa);
> + pgdp[(FIXADDR_START >> PGDIR_SHIFT) % PTRS_PER_PGD] =
> + pfn_pgd(PFN_DOWN(map_pa), tableprot);
> #endif
> }
> --
> 2.17.1
>
--
Sincerely yours,
Mike.
Powered by blists - more mailing lists