From patchwork Mon Jul 1 12:43:32 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Kirill A. Shutemov" X-Patchwork-Id: 809156 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5851113213D; Mon, 1 Jul 2024 12:43:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.19 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719837828; cv=none; b=O4VSeCj2/64S8D/FtePBMLkFAkzcHK6mO+dnY+KmJ+IcY6ndkSPxkB8uST+/g6f8byy8D7tgqwTTnVWLyzk3flaE1uJYgEOCQcIvF28189E6rj42yegi9nsC2vv6Mt2NUVDfO6OtHTkMGSq2r9Rc4DQ07idd3A3FQskYLMYegA8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719837828; c=relaxed/simple; bh=4dJPOn2wSzjYPHEtO815W8ilxheAN85kZevrftGA81Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=AzlVtBBNVWGeQy3e/c8jeTTI5g9Y1OnKUhNtl8Ddc2xZ1beadgJQIQBOZVE5ATdWD9ImFhfGVdbf+GHSdTcGCBlRDLSRJwFkICCEdpf7/txj7qTw59iF+pQ1wZV3HLsiFSdNjIgsOSFgx0nO1PcmL4VS8PS7Erg1uQXLh0Tt+mc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=none smtp.helo=mgamail.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=Eh6xH8wH; arc=none smtp.client-ip=198.175.65.19 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.helo=mgamail.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="Eh6xH8wH" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1719837827; x=1751373827; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=4dJPOn2wSzjYPHEtO815W8ilxheAN85kZevrftGA81Q=; b=Eh6xH8wHzwQ2aD9QN1wVJul0slVt+96W7+KhpcazrN/epEw13wsnKiNx HWsGUbqj/oyYg81B4jiPvDGxN133ajeSBK/xQDJ+1Gm3fP+sf83J1R7dM 0NuDZusSI6yB6DOC4lXF6REwdhdKNXJ6WS8fEWg4QaslrL6VOPyIJX7YR QFvCJ33MedmYufYo2WQ7USzes5DV9O4SUnbMzPWl+4CHXN8k3jQQKI7lE B3WKFh/xkFbJ+P5xsp+Wjp0IrpDc4hlyTWnHHMH5YTMlIR3/KKqERyiPT a4CUp6uAQXHL4wlh9YKSBAjrfbr5oB2wKlemJFQqZF36oUvYqkBzq5T25 A==; X-CSE-ConnectionGUID: RDBo2FdDQe62xWDFbinb8g== X-CSE-MsgGUID: LEG5JaTLSuiILunrTwRlhw== X-IronPort-AV: E=McAfee;i="6700,10204,11120"; a="16797983" X-IronPort-AV: E=Sophos;i="6.09,176,1716274800"; d="scan'208";a="16797983" Received: from orviesa005.jf.intel.com ([10.64.159.145]) by orvoesa111.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 01 Jul 2024 05:43:46 -0700 X-CSE-ConnectionGUID: o4r0dtA6Q9aj4qTAi6Fxkw== X-CSE-MsgGUID: 4+Ce8L5lRwmRcq5kDIRvfA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.09,176,1716274800"; d="scan'208";a="50469588" Received: from black.fi.intel.com ([10.237.72.28]) by orviesa005.jf.intel.com with ESMTP; 01 Jul 2024 05:43:43 -0700 Received: by black.fi.intel.com (Postfix, from userid 1000) id 4BD70330; Mon, 01 Jul 2024 15:43:41 +0300 (EEST) From: "Kirill A. Shutemov" To: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , "Rafael J. Wysocki" , Andy Lutomirski , Peter Zijlstra , Baoquan He Cc: Ard Biesheuvel , Tom Lendacky , Andrew Morton , Thomas Zimmermann , Sean Christopherson , linux-kernel@vger.kernel.org, linux-acpi@vger.kernel.org, "Kirill A. Shutemov" Subject: [PATCH 1/3] x86/mm/ident_map: Fix virtual address wrap to zero Date: Mon, 1 Jul 2024 15:43:32 +0300 Message-ID: <20240701124334.1855981-2-kirill.shutemov@linux.intel.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240701124334.1855981-1-kirill.shutemov@linux.intel.com> References: <20240701124334.1855981-1-kirill.shutemov@linux.intel.com> Precedence: bulk X-Mailing-List: linux-acpi@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Calculation of 'next' virtual address doesn't protect against wrapping to zero. It can result in page table corruption and hang. The problematic case is possible if user sets high x86_mapping_info::offset. Replace manual 'next' calculation with p?d_addr_and() which handles wrapping correctly. Signed-off-by: Kirill A. Shutemov Reviewed-by: Kai Huang --- arch/x86/mm/ident_map.c | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-) diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c index c45127265f2f..7422146b0dc9 100644 --- a/arch/x86/mm/ident_map.c +++ b/arch/x86/mm/ident_map.c @@ -100,10 +100,7 @@ static int ident_pud_init(struct x86_mapping_info *info, pud_t *pud_page, pud_t *pud = pud_page + pud_index(addr); pmd_t *pmd; - next = (addr & PUD_MASK) + PUD_SIZE; - if (next > end) - next = end; - + next = pud_addr_end(addr, end); if (info->direct_gbpages) { pud_t pudval; @@ -141,10 +138,7 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page, p4d_t *p4d = p4d_page + p4d_index(addr); pud_t *pud; - next = (addr & P4D_MASK) + P4D_SIZE; - if (next > end) - next = end; - + next = p4d_addr_end(addr, end); if (p4d_present(*p4d)) { pud = pud_offset(p4d, 0); result = ident_pud_init(info, pud, addr, next); @@ -186,10 +180,7 @@ int kernel_ident_mapping_init(struct x86_mapping_info *info, pgd_t *pgd_page, pgd_t *pgd = pgd_page + pgd_index(addr); p4d_t *p4d; - next = (addr & PGDIR_MASK) + PGDIR_SIZE; - if (next > end) - next = end; - + next = pgd_addr_end(addr, end); if (pgd_present(*pgd)) { p4d = p4d_offset(pgd, 0); result = ident_p4d_init(info, p4d, addr, next); From patchwork Mon Jul 1 12:43:33 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Kirill A. Shutemov" X-Patchwork-Id: 809155 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5DEAB158DC6; Mon, 1 Jul 2024 12:43:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.19 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719837830; cv=none; b=qk5yLanyulvVadHbEN3o406SN4Mh0z/zxHOkTJdGyTkNa80oDEgSB14yAPGqtMo7chy760XJusuXFHSCEIcUXSFzx9RJtdZYqNdewiJYS60ZPHHkBYrwWtBL9A4lu3mKwRcFrQA+C7Dn/y1Soi5VT1HJNw+iGtfrLVokXn6+mho= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719837830; c=relaxed/simple; bh=2o7s3+jwf4d7j2wX7b0YIdzDHJXWm17Dtp8dUF3Mcok=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=u1Rg7PY5rSDfTWuM4ug6S4aCp9gMdhk6fhHkD5sco54CUihfX+RxbHrPcXucMQ34yHEU9bFbc1kSb+ykw4macL+o38fFldoYEYnGJpTVGAqWBxJjD/7lSP9edD7Kaib+O+3U8pTlDeTKcoy5Ndm54tmpjesonYMF/pFXydA7UnQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=none smtp.helo=mgamail.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=EKEMhFZd; arc=none smtp.client-ip=198.175.65.19 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.helo=mgamail.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="EKEMhFZd" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1719837829; x=1751373829; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=2o7s3+jwf4d7j2wX7b0YIdzDHJXWm17Dtp8dUF3Mcok=; b=EKEMhFZdJizsIf56baEkY4MhQvjmwKwBR9m+nKhaiUapiBVBQ+Iz1FLf gjn0IgM13F4moD1vX6XK61GaGtka4JSRGGc7yHRx+zfLabhVKL5/ghQ3m +3sUoceATeE4I9pXwZu2VD8IEtHNCo1M17M3fQKPZhzsZy8r3D5Uu/K9j 5F++LCJtN8CV5XMD25XGqlCLPo4fmpOAj0NE7Cn4NswmjAMUgB9KOAbPu nm5ka4m20I17BozNglya/R3N7E46FoGdKLk74IlChcaqbCyY5fKeZdKAA 7/Cl/FXstL6+hCTJxdpFQWHVTi9baBIatzoJx6vc37w2J7rxYKrKLydv/ A==; X-CSE-ConnectionGUID: tBaGOid3R82NzG4LDiuqww== X-CSE-MsgGUID: Swcuz7kXTj2ohhpMsbjuQQ== X-IronPort-AV: E=McAfee;i="6700,10204,11120"; a="16798007" X-IronPort-AV: E=Sophos;i="6.09,176,1716274800"; d="scan'208";a="16798007" Received: from orviesa008.jf.intel.com ([10.64.159.148]) by orvoesa111.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 01 Jul 2024 05:43:47 -0700 X-CSE-ConnectionGUID: gtvZPW+YTcq6UhVJOzq/cg== X-CSE-MsgGUID: jAMtbU+rQi2eg9X7xVYG1w== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.09,176,1716274800"; d="scan'208";a="46258202" Received: from black.fi.intel.com ([10.237.72.28]) by orviesa008.jf.intel.com with ESMTP; 01 Jul 2024 05:43:42 -0700 Received: by black.fi.intel.com (Postfix, from userid 1000) id 61337389; Mon, 01 Jul 2024 15:43:41 +0300 (EEST) From: "Kirill A. Shutemov" To: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , "Rafael J. Wysocki" , Andy Lutomirski , Peter Zijlstra , Baoquan He Cc: Ard Biesheuvel , Tom Lendacky , Andrew Morton , Thomas Zimmermann , Sean Christopherson , linux-kernel@vger.kernel.org, linux-acpi@vger.kernel.org, "Kirill A. Shutemov" Subject: [PATCH 2/3] x86/acpi: Replace manual page table initialization with kernel_ident_mapping_init() Date: Mon, 1 Jul 2024 15:43:33 +0300 Message-ID: <20240701124334.1855981-3-kirill.shutemov@linux.intel.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240701124334.1855981-1-kirill.shutemov@linux.intel.com> References: <20240701124334.1855981-1-kirill.shutemov@linux.intel.com> Precedence: bulk X-Mailing-List: linux-acpi@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 The function init_transition_pgtable() maps the page with asm_acpi_mp_play_dead() into an identity mapping. Replace manual page table initialization with kernel_ident_mapping_init() to avoid code duplicatiion. Use x86_mapping_info::offset to get the page is mapped at the correct location. Signed-off-by: Kirill A. Shutemov Reviewed-by: Kai Huang --- arch/x86/kernel/acpi/madt_wakeup.c | 73 ++++++------------------------ 1 file changed, 15 insertions(+), 58 deletions(-) diff --git a/arch/x86/kernel/acpi/madt_wakeup.c b/arch/x86/kernel/acpi/madt_wakeup.c index 6cfe762be28b..acbc9305c8e3 100644 --- a/arch/x86/kernel/acpi/madt_wakeup.c +++ b/arch/x86/kernel/acpi/madt_wakeup.c @@ -70,58 +70,6 @@ static void __init free_pgt_page(void *pgt, void *dummy) return memblock_free(pgt, PAGE_SIZE); } -/* - * Make sure asm_acpi_mp_play_dead() is present in the identity mapping at - * the same place as in the kernel page tables. asm_acpi_mp_play_dead() switches - * to the identity mapping and the function has be present at the same spot in - * the virtual address space before and after switching page tables. - */ -static int __init init_transition_pgtable(pgd_t *pgd) -{ - pgprot_t prot = PAGE_KERNEL_EXEC_NOENC; - unsigned long vaddr, paddr; - p4d_t *p4d; - pud_t *pud; - pmd_t *pmd; - pte_t *pte; - - vaddr = (unsigned long)asm_acpi_mp_play_dead; - pgd += pgd_index(vaddr); - if (!pgd_present(*pgd)) { - p4d = (p4d_t *)alloc_pgt_page(NULL); - if (!p4d) - return -ENOMEM; - set_pgd(pgd, __pgd(__pa(p4d) | _KERNPG_TABLE)); - } - p4d = p4d_offset(pgd, vaddr); - if (!p4d_present(*p4d)) { - pud = (pud_t *)alloc_pgt_page(NULL); - if (!pud) - return -ENOMEM; - set_p4d(p4d, __p4d(__pa(pud) | _KERNPG_TABLE)); - } - pud = pud_offset(p4d, vaddr); - if (!pud_present(*pud)) { - pmd = (pmd_t *)alloc_pgt_page(NULL); - if (!pmd) - return -ENOMEM; - set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE)); - } - pmd = pmd_offset(pud, vaddr); - if (!pmd_present(*pmd)) { - pte = (pte_t *)alloc_pgt_page(NULL); - if (!pte) - return -ENOMEM; - set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE)); - } - pte = pte_offset_kernel(pmd, vaddr); - - paddr = __pa(vaddr); - set_pte(pte, pfn_pte(paddr >> PAGE_SHIFT, prot)); - - return 0; -} - static int __init acpi_mp_setup_reset(u64 reset_vector) { struct x86_mapping_info info = { @@ -130,6 +78,7 @@ static int __init acpi_mp_setup_reset(u64 reset_vector) .page_flag = __PAGE_KERNEL_LARGE_EXEC, .kernpg_flag = _KERNPG_TABLE_NOENC, }; + unsigned long mstart, mend; pgd_t *pgd; pgd = alloc_pgt_page(NULL); @@ -137,8 +86,6 @@ static int __init acpi_mp_setup_reset(u64 reset_vector) return -ENOMEM; for (int i = 0; i < nr_pfn_mapped; i++) { - unsigned long mstart, mend; - mstart = pfn_mapped[i].start << PAGE_SHIFT; mend = pfn_mapped[i].end << PAGE_SHIFT; if (kernel_ident_mapping_init(&info, pgd, mstart, mend)) { @@ -147,14 +94,24 @@ static int __init acpi_mp_setup_reset(u64 reset_vector) } } - if (kernel_ident_mapping_init(&info, pgd, - PAGE_ALIGN_DOWN(reset_vector), - PAGE_ALIGN(reset_vector + 1))) { + mstart = PAGE_ALIGN_DOWN(reset_vector); + mend = mstart + PAGE_SIZE; + if (kernel_ident_mapping_init(&info, pgd, mstart, mend)) { kernel_ident_mapping_free(&info, pgd); return -ENOMEM; } - if (init_transition_pgtable(pgd)) { + /* + * Make sure asm_acpi_mp_play_dead() is present in the identity mapping + * at the same place as in the kernel page tables. + * asm_acpi_mp_play_dead() switches to the identity mapping and the + * function has be present at the same spot in the virtual address space + * before and after switching page tables. + */ + info.offset = __START_KERNEL_map - phys_base; + mstart = PAGE_ALIGN_DOWN(__pa(asm_acpi_mp_play_dead)); + mend = mstart + PAGE_SIZE; + if (kernel_ident_mapping_init(&info, pgd, mstart, mend)) { kernel_ident_mapping_free(&info, pgd); return -ENOMEM; }