From 072daeed5525a0d8ad1e5ddfb38f29cef1ca25f2 Mon Sep 17 00:00:00 2001 From: Scott Wood Date: Mon, 24 Aug 2015 11:43:03 -0500 Subject: powerpc/fsl_pci: Check for get_user/probe_kernel_address failure Signed-off-by: Scott Wood Reported-by: Andrew Morton Cc: Andrew Morton Cc: Benjamin Herrenschmidt Cc: Hongtao Jia --- arch/powerpc/sysdev/fsl_pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'arch/powerpc/sysdev/fsl_pci.c') diff --git a/arch/powerpc/sysdev/fsl_pci.c b/arch/powerpc/sysdev/fsl_pci.c index ebc1f412cf49..c42609dde8d2 100644 --- a/arch/powerpc/sysdev/fsl_pci.c +++ b/arch/powerpc/sysdev/fsl_pci.c @@ -1002,7 +1002,7 @@ int fsl_pci_mcheck_exception(struct pt_regs *regs) ret = probe_kernel_address(regs->nip, inst); } - if (mcheck_handle_load(regs, inst)) { + if (!ret && mcheck_handle_load(regs, inst)) { regs->nip += 4; return 1; } -- cgit v1.2.3 From 1930bb5ccf77da3bf1483e2cd85a12ec9c0ed0f6 Mon Sep 17 00:00:00 2001 From: Scott Wood Date: Tue, 6 Oct 2015 22:48:08 -0500 Subject: powerpc/fsl_pci: Don't set up inbound windows in kdump crash kernel Otherwise, because the top end of the crash kernel is treated as the absolute top of memory rather than the beginning of a reserved region, in-flight DMA from the previous kernel that targets areas above the crash kernel can trigger a storm of PCI errors. We only do this for kdump, not normal kexec, in case kexec is being used to upgrade to a kernel that wants a different inbound memory map. Signed-off-by: Scott Wood Cc: Mingkai Hu --- arch/powerpc/sysdev/fsl_pci.c | 84 +++++++++++++++++++++++++++++++------------ 1 file changed, 61 insertions(+), 23 deletions(-) (limited to 'arch/powerpc/sysdev/fsl_pci.c') diff --git a/arch/powerpc/sysdev/fsl_pci.c b/arch/powerpc/sysdev/fsl_pci.c index c42609dde8d2..1c65ef92768d 100644 --- a/arch/powerpc/sysdev/fsl_pci.c +++ b/arch/powerpc/sysdev/fsl_pci.c @@ -179,6 +179,19 @@ static int setup_one_atmu(struct ccsr_pci __iomem *pci, return i; } +static bool is_kdump(void) +{ + struct device_node *node; + + node = of_find_node_by_type(NULL, "memory"); + if (!node) { + WARN_ON_ONCE(1); + return false; + } + + return of_property_read_bool(node, "linux,usable-memory"); +} + /* atmu setup for fsl pci/pcie controller */ static void setup_pci_atmu(struct pci_controller *hose) { @@ -192,6 +205,16 @@ static void setup_pci_atmu(struct pci_controller *hose) const char *name = hose->dn->full_name; const u64 *reg; int len; + bool setup_inbound; + + /* + * If this is kdump, we don't want to trigger a bunch of PCI + * errors by closing the window on in-flight DMA. + * + * We still run most of the function's logic so that things like + * hose->dma_window_size still get set. + */ + setup_inbound = !is_kdump(); if (early_find_capability(hose, 0, 0, PCI_CAP_ID_EXP)) { if (in_be32(&pci->block_rev1) >= PCIE_IP_REV_2_2) { @@ -204,8 +227,11 @@ static void setup_pci_atmu(struct pci_controller *hose) /* Disable all windows (except powar0 since it's ignored) */ for(i = 1; i < 5; i++) out_be32(&pci->pow[i].powar, 0); - for (i = start_idx; i < end_idx; i++) - out_be32(&pci->piw[i].piwar, 0); + + if (setup_inbound) { + for (i = start_idx; i < end_idx; i++) + out_be32(&pci->piw[i].piwar, 0); + } /* Setup outbound MEM window */ for(i = 0, j = 1; i < 3; i++) { @@ -278,6 +304,7 @@ static void setup_pci_atmu(struct pci_controller *hose) /* Setup inbound mem window */ mem = memblock_end_of_DRAM(); + pr_info("%s: end of DRAM %llx\n", __func__, mem); /* * The msi-address-64 property, if it exists, indicates the physical @@ -320,12 +347,14 @@ static void setup_pci_atmu(struct pci_controller *hose) piwar |= ((mem_log - 1) & PIWAR_SZ_MASK); - /* Setup inbound memory window */ - out_be32(&pci->piw[win_idx].pitar, 0x00000000); - out_be32(&pci->piw[win_idx].piwbar, 0x00000000); - out_be32(&pci->piw[win_idx].piwar, piwar); - win_idx--; + if (setup_inbound) { + /* Setup inbound memory window */ + out_be32(&pci->piw[win_idx].pitar, 0x00000000); + out_be32(&pci->piw[win_idx].piwbar, 0x00000000); + out_be32(&pci->piw[win_idx].piwar, piwar); + } + win_idx--; hose->dma_window_base_cur = 0x00000000; hose->dma_window_size = (resource_size_t)sz; @@ -343,13 +372,15 @@ static void setup_pci_atmu(struct pci_controller *hose) piwar = (piwar & ~PIWAR_SZ_MASK) | (mem_log - 1); - /* Setup inbound memory window */ - out_be32(&pci->piw[win_idx].pitar, 0x00000000); - out_be32(&pci->piw[win_idx].piwbear, - pci64_dma_offset >> 44); - out_be32(&pci->piw[win_idx].piwbar, - pci64_dma_offset >> 12); - out_be32(&pci->piw[win_idx].piwar, piwar); + if (setup_inbound) { + /* Setup inbound memory window */ + out_be32(&pci->piw[win_idx].pitar, 0x00000000); + out_be32(&pci->piw[win_idx].piwbear, + pci64_dma_offset >> 44); + out_be32(&pci->piw[win_idx].piwbar, + pci64_dma_offset >> 12); + out_be32(&pci->piw[win_idx].piwar, piwar); + } /* * install our own dma_set_mask handler to fixup dma_ops @@ -362,12 +393,15 @@ static void setup_pci_atmu(struct pci_controller *hose) } else { u64 paddr = 0; - /* Setup inbound memory window */ - out_be32(&pci->piw[win_idx].pitar, paddr >> 12); - out_be32(&pci->piw[win_idx].piwbar, paddr >> 12); - out_be32(&pci->piw[win_idx].piwar, (piwar | (mem_log - 1))); - win_idx--; + if (setup_inbound) { + /* Setup inbound memory window */ + out_be32(&pci->piw[win_idx].pitar, paddr >> 12); + out_be32(&pci->piw[win_idx].piwbar, paddr >> 12); + out_be32(&pci->piw[win_idx].piwar, + (piwar | (mem_log - 1))); + } + win_idx--; paddr += 1ull << mem_log; sz -= 1ull << mem_log; @@ -375,11 +409,15 @@ static void setup_pci_atmu(struct pci_controller *hose) mem_log = ilog2(sz); piwar |= (mem_log - 1); - out_be32(&pci->piw[win_idx].pitar, paddr >> 12); - out_be32(&pci->piw[win_idx].piwbar, paddr >> 12); - out_be32(&pci->piw[win_idx].piwar, piwar); - win_idx--; + if (setup_inbound) { + out_be32(&pci->piw[win_idx].pitar, + paddr >> 12); + out_be32(&pci->piw[win_idx].piwbar, + paddr >> 12); + out_be32(&pci->piw[win_idx].piwar, piwar); + } + win_idx--; paddr += 1ull << mem_log; } -- cgit v1.2.3 From 0ab32b6f1b88444524e52429fab334ff96683a3f Mon Sep 17 00:00:00 2001 From: Andrew Morton Date: Thu, 5 Nov 2015 18:46:03 -0800 Subject: uaccess: reimplement probe_kernel_address() using probe_kernel_read() probe_kernel_address() is basically the same as the (later added) probe_kernel_read(). The return value on EFAULT is a bit different: probe_kernel_address() returns number-of-bytes-not-copied whereas probe_kernel_read() returns -EFAULT. All callers have been checked, none cared. probe_kernel_read() can be overridden by the architecture whereas probe_kernel_address() cannot. parisc, blackfin and um do this, to insert additional checking. Hence this patch possibly fixes obscure bugs, although there are only two probe_kernel_address() callsites outside arch/. My first attempt involved removing probe_kernel_address() entirely and converting all callsites to use probe_kernel_read() directly, but that got tiresome. This patch shrinks mm/slab_common.o by 218 bytes. For a single probe_kernel_address() callsite. Cc: Steven Miao Cc: Jeff Dike Cc: Richard Weinberger Cc: "James E.J. Bottomley" Cc: Helge Deller Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- arch/arm/mm/alignment.c | 2 +- arch/powerpc/sysdev/fsl_pci.c | 2 +- include/linux/uaccess.h | 40 ++++++++++------------------------------ mm/maccess.c | 5 +++++ 4 files changed, 17 insertions(+), 32 deletions(-) (limited to 'arch/powerpc/sysdev/fsl_pci.c') diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c index 00b7f7de28a1..7d5f4c736a16 100644 --- a/arch/arm/mm/alignment.c +++ b/arch/arm/mm/alignment.c @@ -803,7 +803,7 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs) } } } else { - fault = probe_kernel_address(instrptr, instr); + fault = probe_kernel_address((void *)instrptr, instr); instr = __mem_to_opcode_arm(instr); } diff --git a/arch/powerpc/sysdev/fsl_pci.c b/arch/powerpc/sysdev/fsl_pci.c index ebc1f412cf49..13b9bcf5485e 100644 --- a/arch/powerpc/sysdev/fsl_pci.c +++ b/arch/powerpc/sysdev/fsl_pci.c @@ -999,7 +999,7 @@ int fsl_pci_mcheck_exception(struct pt_regs *regs) ret = get_user(regs->nip, &inst); pagefault_enable(); } else { - ret = probe_kernel_address(regs->nip, inst); + ret = probe_kernel_address((void *)regs->nip, inst); } if (mcheck_handle_load(regs, inst)) { diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h index d6f2c2c5b043..558129af828a 100644 --- a/include/linux/uaccess.h +++ b/include/linux/uaccess.h @@ -75,36 +75,6 @@ static inline unsigned long __copy_from_user_nocache(void *to, #endif /* ARCH_HAS_NOCACHE_UACCESS */ -/** - * probe_kernel_address(): safely attempt to read from a location - * @addr: address to read from - its type is type typeof(retval)* - * @retval: read into this variable - * - * Safely read from address @addr into variable @revtal. If a kernel fault - * happens, handle that and return -EFAULT. - * We ensure that the __get_user() is executed in atomic context so that - * do_page_fault() doesn't attempt to take mmap_sem. This makes - * probe_kernel_address() suitable for use within regions where the caller - * already holds mmap_sem, or other locks which nest inside mmap_sem. - * This must be a macro because __get_user() needs to know the types of the - * args. - * - * We don't include enough header files to be able to do the set_fs(). We - * require that the probe_kernel_address() caller will do that. - */ -#define probe_kernel_address(addr, retval) \ - ({ \ - long ret; \ - mm_segment_t old_fs = get_fs(); \ - \ - set_fs(KERNEL_DS); \ - pagefault_disable(); \ - ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \ - pagefault_enable(); \ - set_fs(old_fs); \ - ret; \ - }) - /* * probe_kernel_read(): safely attempt to read from a location * @dst: pointer to the buffer that shall take the data @@ -131,4 +101,14 @@ extern long notrace __probe_kernel_write(void *dst, const void *src, size_t size extern long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count); +/** + * probe_kernel_address(): safely attempt to read from a location + * @addr: address to read from + * @retval: read into this variable + * + * Returns 0 on success, or -EFAULT. + */ +#define probe_kernel_address(addr, retval) \ + probe_kernel_read(&retval, addr, sizeof(retval)) + #endif /* __LINUX_UACCESS_H__ */ diff --git a/mm/maccess.c b/mm/maccess.c index 34fe24759ed1..1b13638d238d 100644 --- a/mm/maccess.c +++ b/mm/maccess.c @@ -13,6 +13,11 @@ * * Safely read from address @src to the buffer at @dst. If a kernel fault * happens, handle that and return -EFAULT. + * + * We ensure that the copy_from_user is executed in atomic context so that + * do_page_fault() doesn't attempt to take mmap_sem. This makes + * probe_kernel_read() suitable for use within regions where the caller + * already holds mmap_sem, or other locks which nest inside mmap_sem. */ long __weak probe_kernel_read(void *dst, const void *src, size_t size) -- cgit v1.2.3