| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20190321094710.16552-3-anup.patel@wdc.com>
Date: Thu, 21 Mar 2019 09:47:47 +0000
From: Anup Patel <Anup.Patel@....com>
To: Palmer Dabbelt <palmer@...ive.com>,
Albert Ou <aou@...s.berkeley.edu>
CC: Atish Patra <Atish.Patra@....com>,
Paul Walmsley <paul.walmsley@...ive.com>,
Christoph Hellwig <hch@...radead.org>,
Mike Rapoport <rppt@...ux.ibm.com>,
"linux-riscv@...ts.infradead.org" <linux-riscv@...ts.infradead.org>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
Anup Patel <Anup.Patel@....com>
Subject: [PATCH v2 2/5] RISC-V: Make setup_vm() independent of GCC code model
The setup_vm() must access kernel symbols in a position independent way
because it will be called from head.S with MMU off.
If we compile kernel with cmodel=medany then PC-relative addressing will
be used in setup_vm() to access kernel symbols so it works perfectly fine.
Although, if we compile kernel with cmodel=medlow then either absolute
addressing or PC-relative addressing (based on whichever requires fewer
instructions) is used to access kernel symbols in setup_vm(). This can
break setup_vm() whenever any absolute addressing is used to access
kernel symbols.
With the movement of setup_vm() from kernel/setup.c to mm/init.c, the
setup_vm() is now broken for cmodel=medlow but it works perfectly fine
for cmodel=medany.
This patch fixes setup_vm() and makes it independent of GCC code model
by accessing kernel symbols relative to kernel load address instead of
assuming PC-relative addressing.
Fixes: 6f1e9e946f0b ("RISC-V: Move setup_vm() to mm/init.c")
Signed-off-by: Anup Patel <anup.patel@....com>
---
arch/riscv/kernel/head.S | 1 +
arch/riscv/mm/init.c | 73 ++++++++++++++++++++++++++--------------
2 files changed, 49 insertions(+), 25 deletions(-)
diff --git a/arch/riscv/kernel/head.S b/arch/riscv/kernel/head.S
index fe884cd69abd..7966262b4f9d 100644
--- a/arch/riscv/kernel/head.S
+++ b/arch/riscv/kernel/head.S
@@ -62,6 +62,7 @@ clear_bss_done:
/* Initialize page tables and relocate to virtual addresses */
la sp, init_thread_union + THREAD_SIZE
+ la a0, _start
call setup_vm
call relocate
diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
index b379a75ac6a6..e38f8195e45b 100644
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -172,55 +172,78 @@ void __set_fixmap(enum fixed_addresses idx, phys_addr_t phys, pgprot_t prot)
}
}
-asmlinkage void __init setup_vm(void)
+static inline void *__load_addr(void *ptr, uintptr_t load_pa)
{
extern char _start;
+ uintptr_t va = (uintptr_t)ptr;
+ uintptr_t sz = (uintptr_t)(&_end) - (uintptr_t)(&_start);
+
+ if (va >= PAGE_OFFSET && va <= (PAGE_OFFSET + sz))
+ return (void *)(load_pa + (va - PAGE_OFFSET));
+ return (void *)va;
+}
+
+#define __load_va(ptr, load_pa) __load_addr(ptr, load_pa)
+#define __load_pa(ptr, load_pa) ((uintptr_t)__load_addr(ptr, load_pa))
+
+asmlinkage void __init setup_vm(uintptr_t load_pa)
+{
uintptr_t i;
- uintptr_t pa = (uintptr_t) &_start;
+#ifndef __PAGETABLE_PMD_FOLDED
+ pmd_t *pmdp;
+#endif
+ pgd_t *pgdp;
+ phys_addr_t map_pa;
+ pgprot_t tableprot = __pgprot(_PAGE_TABLE);
pgprot_t prot = __pgprot(pgprot_val(PAGE_KERNEL) | _PAGE_EXEC);
- va_pa_offset = PAGE_OFFSET - pa;
- pfn_base = PFN_DOWN(pa);
+ va_pa_offset = PAGE_OFFSET - load_pa;
+ pfn_base = PFN_DOWN(load_pa);
/* Sanity check alignment and size */
BUG_ON((PAGE_OFFSET % PGDIR_SIZE) != 0);
- BUG_ON((pa % (PAGE_SIZE * PTRS_PER_PTE)) != 0);
+ BUG_ON((load_pa % (PAGE_SIZE * PTRS_PER_PTE)) != 0);
#ifndef __PAGETABLE_PMD_FOLDED
- trampoline_pg_dir[(PAGE_OFFSET >> PGDIR_SHIFT) % PTRS_PER_PGD] =
- pfn_pgd(PFN_DOWN((uintptr_t)trampoline_pmd),
- __pgprot(_PAGE_TABLE));
- trampoline_pmd[0] = pfn_pmd(PFN_DOWN(pa), prot);
+ pgdp = __load_va(trampoline_pg_dir, load_pa);
+ map_pa = __load_pa(trampoline_pmd, load_pa);
+ pgdp[(PAGE_OFFSET >> PGDIR_SHIFT) % PTRS_PER_PGD] =
+ pfn_pgd(PFN_DOWN(map_pa), tableprot);
+ trampoline_pmd[0] = pfn_pmd(PFN_DOWN(load_pa), prot);
+
+ pgdp = __load_va(swapper_pg_dir, load_pa);
for (i = 0; i < (-PAGE_OFFSET)/PGDIR_SIZE; ++i) {
size_t o = (PAGE_OFFSET >> PGDIR_SHIFT) % PTRS_PER_PGD + i;
- swapper_pg_dir[o] =
- pfn_pgd(PFN_DOWN((uintptr_t)swapper_pmd) + i,
- __pgprot(_PAGE_TABLE));
+ map_pa = __load_pa(swapper_pmd, load_pa);
+ pgdp[o] = pfn_pgd(PFN_DOWN(map_pa) + i, tableprot);
}
+ pmdp = __load_va(swapper_pmd, load_pa);
for (i = 0; i < ARRAY_SIZE(swapper_pmd); i++)
- swapper_pmd[i] = pfn_pmd(PFN_DOWN(pa + i * PMD_SIZE), prot);
+ pmdp[i] = pfn_pmd(PFN_DOWN(load_pa + i * PMD_SIZE), prot);
- swapper_pg_dir[(FIXADDR_START >> PGDIR_SHIFT) % PTRS_PER_PGD] =
- pfn_pgd(PFN_DOWN((uintptr_t)fixmap_pmd),
- __pgprot(_PAGE_TABLE));
+ map_pa = __load_pa(fixmap_pmd, load_pa);
+ pgdp[(FIXADDR_START >> PGDIR_SHIFT) % PTRS_PER_PGD] =
+ pfn_pgd(PFN_DOWN(map_pa), tableprot);
+ pmdp = __load_va(fixmap_pmd, load_pa);
+ map_pa = __load_pa(fixmap_pte, load_pa);
fixmap_pmd[(FIXADDR_START >> PMD_SHIFT) % PTRS_PER_PMD] =
- pfn_pmd(PFN_DOWN((uintptr_t)fixmap_pte),
- __pgprot(_PAGE_TABLE));
+ pfn_pmd(PFN_DOWN(map_pa), tableprot);
#else
- trampoline_pg_dir[(PAGE_OFFSET >> PGDIR_SHIFT) % PTRS_PER_PGD] =
- pfn_pgd(PFN_DOWN(pa), prot);
+ pgdp = __load_va(trampoline_pg_dir, load_pa);
+ pgdp[(PAGE_OFFSET >> PGDIR_SHIFT) % PTRS_PER_PGD] =
+ pfn_pgd(PFN_DOWN(load_pa), prot);
+ pgdp = __load_va(swapper_pg_dir, load_pa);
for (i = 0; i < (-PAGE_OFFSET)/PGDIR_SIZE; ++i) {
size_t o = (PAGE_OFFSET >> PGDIR_SHIFT) % PTRS_PER_PGD + i;
- swapper_pg_dir[o] =
- pfn_pgd(PFN_DOWN(pa + i * PGDIR_SIZE), prot);
+ pgdp[o] = pfn_pgd(PFN_DOWN(load_pa + i * PGDIR_SIZE), prot);
}
- swapper_pg_dir[(FIXADDR_START >> PGDIR_SHIFT) % PTRS_PER_PGD] =
- pfn_pgd(PFN_DOWN((uintptr_t)fixmap_pte),
- __pgprot(_PAGE_TABLE));
+ map_pa = __load_pa(fixmap_pte, load_pa);
+ pgdp[(FIXADDR_START >> PGDIR_SHIFT) % PTRS_PER_PGD] =
+ pfn_pgd(PFN_DOWN(map_pa), tableprot);
#endif
}
--
2.17.1
Powered by blists - more mailing lists