Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1357285

Re: [PATCH] x86/efi: Always map boot service regions into new EFI page tables

From Matt Fleming <matt@codeblueprint.co.uk>
Newsgroups linux.kernel
Subject Re: [PATCH] x86/efi: Always map boot service regions into new EFI page tables
Date 2016-03-14 15:30 +0100
Message-ID <rcBFo-4SW-33@gated-at.bofh.it> (permalink)
References (3 earlier) <rcmdl-2U2-7@gated-at.bofh.it> <rcnj3-3Oo-3@gated-at.bofh.it> <rcy4N-2xH-3@gated-at.bofh.it> <rcz0S-38S-23@gated-at.bofh.it> <rcztT-3yx-7@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Mon, 14 Mar, at 01:05:02PM, Ingo Molnar wrote:
> 
> There's a number of such occurences that look suspicious:
> 
>  triton:~/tip> git grep 'cpa->pfn.*<<.*PAGE_SHIFT' arch/x86/
>  arch/x86/mm/pageattr.c:         set_pmd(pmd, __pmd(cpa->pfn << PAGE_SHIFT | _PAGE_PSE |
>  arch/x86/mm/pageattr.c:         set_pud(pud, __pud(cpa->pfn << PAGE_SHIFT | _PAGE_PSE |
>  arch/x86/mm/pageattr.c: unsigned long laddr = (unsigned long)__va(cpa->pfn << PAGE_SHIFT);
>  arch/x86/mm/pageattr.c:         unsigned long temp_cpa_vaddr = (cpa->pfn << PAGE_SHIFT) +
> 
> are you sure none of the code runs on 32-bit?

The following occurrences do not run on 32-bit,

>  arch/x86/mm/pageattr.c:         set_pmd(pmd, __pmd(cpa->pfn << PAGE_SHIFT | _PAGE_PSE |
>  arch/x86/mm/pageattr.c:         set_pud(pud, __pud(cpa->pfn << PAGE_SHIFT | _PAGE_PSE |

but these might,

>  arch/x86/mm/pageattr.c: unsigned long laddr = (unsigned long)__va(cpa->pfn << PAGE_SHIFT);
>  arch/x86/mm/pageattr.c:         unsigned long temp_cpa_vaddr = (cpa->pfn << PAGE_SHIFT) +

> All this got introduced with:
> 
> | commit edc3b9129cecd0f0857112136f5b8b1bc1d45918
> | Author: Matt Fleming <matt@codeblueprint.co.uk>
> | Date:   Fri Nov 27 21:09:31 2015 +0000
> |
> |    x86/mm/pat: Ensure cpa->pfn only contains page frame numbers
> 
> AFAICS.
 
Kinda. The bugs that do not run on 32-bit were introduced with this
commit. The ones that will run on 32-bit existed before this.

Running the attached semantic patch across arch/x86/mm yields a few
more places where we get the data type wrong for PAE,
 
* file: arch/x86/mm/mmap.c:43 shifting int '( ( - 1UL ) & STACK_RND_MASK )' by PAGE_SHIFT is truncated to 32-bits
* file: arch/x86/mm/pageattr-test.c:57 shifting long 'i' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/pageattr-test.c:138 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/gup.c:422 shifting int 'nr' by PAGE_SHIFT is truncated to 32-bits
* file: arch/x86/mm/gup.c:303 shifting unsigned long '( unsigned long ) nr_pages' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/gup.c:370 shifting unsigned long '( unsigned long ) nr_pages' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/pat.c:751 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/pageattr-test.c:57 shifting long 'i' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/pageattr.c:947 shifting unsigned 'num_pages' by PAGE_SHIFT is truncated to 32-bits
* file: arch/x86/mm/pageattr.c:1995 shifting unsigned 'numpages' by PAGE_SHIFT is truncated to 32-bits
* file: arch/x86/mm/pageattr-test.c:138 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/pageattr.c:1117 shifting unsigned long 'cpa -> numpages' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/pageattr.c:1017 shifting unsigned long 'cpa -> numpages' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/pageattr.c:1277 shifting unsigned long 'cpa -> pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/pageattr.c:1318 shifting unsigned long 'cpa -> pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/pageattr.c:986 shifting unsigned long 'cpa -> pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/pageattr.c:1059 shifting unsigned long 'cpa -> pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/init.c:197 shifting unsigned long 'end_pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/init.c:100 shifting unsigned long 'min_pfn_mapped' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/init.c:641 shifting unsigned long 'pagenr' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/init.c:111 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/init.c:121 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/init.c:111 shifting unsigned long __initdata 'pgt_buf_end' by PAGE_SHIFT is truncated to 32-bits
* file: arch/x86/mm/init.c:196 shifting unsigned long 'start_pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/init.c:91 shifting unsigned long '( unsigned long ) num' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/init.c:117 shifting unsigned long '( pfn + i )' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/init_32.c:293 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/init_32.c:301 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/init_32.c:344 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/init_32.c:361 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
* file: arch/x86/mm/init_32.c:471 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE

The coccinelle script isn't perfect, and there are a number of false
positives. For example, the first hit is bogus and looks like a
coccinelle bug, but the results do show some things that need to be
investigated.

Running it over arch/x86/ turns up 66 potential issues.

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[GIT PULL] EFI urgent fix for v4.6 queue Matt Fleming <matt@codeblueprint.co.uk> - 2016-03-11 12:20 +0100
  [PATCH] x86/efi: Always map boot service regions into new EFI page tables Matt Fleming <matt@codeblueprint.co.uk> - 2016-03-11 12:30 +0100
    [tip:x86/urgent] x86/efi: Fix boot crash by always mapping boot  service regions into new EFI page tables tip-bot for Matt Fleming <tipbot@zytor.com> - 2016-03-12 20:00 +0100
      Re: [tip:x86/urgent] x86/efi: Fix boot crash by always mapping boot  service regions into new EFI page tables Matt Fleming <matt@codeblueprint.co.uk> - 2016-03-13 00:10 +0100
        Re: [tip:x86/urgent] x86/efi: Fix boot crash by always mapping boot  service regions into new EFI page tables Ingo Molnar <mingo@kernel.org> - 2016-03-13 19:00 +0100
    Re: [PATCH] x86/efi: Always map boot service regions into new EFI  page tables Matt Fleming <matt@codeblueprint.co.uk> - 2016-03-13 23:00 +0100
      Re: [PATCH] x86/efi: Always map boot service regions into new EFI  page tables Matt Fleming <matt@codeblueprint.co.uk> - 2016-03-14 00:10 +0100
        Re: [PATCH] x86/efi: Always map boot service regions into new EFI  page tables Scott Ashcroft <scott.ashcroft@talk21.com> - 2016-03-14 02:10 +0100
        Re: [PATCH] x86/efi: Always map boot service regions into new EFI  page tables Ingo Molnar <mingo@kernel.org> - 2016-03-14 11:40 +0100
          Re: [PATCH] x86/efi: Always map boot service regions into new EFI  page tables Matt Fleming <matt@codeblueprint.co.uk> - 2016-03-14 12:40 +0100
            Re: [PATCH] x86/efi: Always map boot service regions into new EFI  page tables Ingo Molnar <mingo@kernel.org> - 2016-03-14 13:10 +0100
              Re: [PATCH] x86/efi: Always map boot service regions into new EFI  page tables Matt Fleming <matt@codeblueprint.co.uk> - 2016-03-14 15:30 +0100
                Re: [PATCH] x86/efi: Always map boot service regions into new EFI  page tables Ingo Molnar <mingo@kernel.org> - 2016-03-14 17:50 +0100
                Re: [PATCH] x86/efi: Always map boot service regions into new EFI  page tables Matt Fleming <matt@codeblueprint.co.uk> - 2016-03-15 17:00 +0100
                Re: [PATCH] x86/efi: Always map boot service regions into new EFI  page tables Borislav Petkov <bp@alien8.de> - 2016-03-15 17:10 +0100
                Re: [PATCH] x86/efi: Always map boot service regions into new EFI  page tables Julia Lawall <julia.lawall@lip6.fr> - 2016-03-15 17:30 +0100

csiph-web