Message ID | 20161206195312.22354-4-f.fainelli@gmail.com (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
On 12/06/2016 11:53 AM, Florian Fainelli wrote: > x86 has an option: CONFIG_DEBUG_VIRTUAL to do additional checks on > virt_to_phys calls. The goal is to catch users who are calling > virt_to_phys on non-linear addresses immediately. This includes caller > using __virt_to_phys() on image addresses instead of __pa_symbol(). This > is a generally useful debug feature to spot bad code (particulary in > drivers). > > Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> > --- > @@ -261,6 +261,16 @@ static inline unsigned long __phys_to_virt(phys_addr_t x) > ((((unsigned long)(kaddr) - PAGE_OFFSET) >> PAGE_SHIFT) + \ > PHYS_PFN_OFFSET) > > +#define __pa_symbol_nodebug(x) ((x) - (unsigned long)KERNEL_START) I don't think I got this one quite right, but I also assume that won't be the only problem with this patch series.
On 12/06/2016 11:53 AM, Florian Fainelli wrote: > x86 has an option: CONFIG_DEBUG_VIRTUAL to do additional checks on > virt_to_phys calls. The goal is to catch users who are calling > virt_to_phys on non-linear addresses immediately. This includes caller > using __virt_to_phys() on image addresses instead of __pa_symbol(). This > is a generally useful debug feature to spot bad code (particulary in > drivers). > > Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> > --- > arch/arm/Kconfig | 1 + > arch/arm/include/asm/memory.h | 16 ++++++++++++-- > arch/arm/mm/Makefile | 1 + > arch/arm/mm/physaddr.c | 51 +++++++++++++++++++++++++++++++++++++++++++ > 4 files changed, 67 insertions(+), 2 deletions(-) > create mode 100644 arch/arm/mm/physaddr.c > > diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig > index b5d529fdffab..5e66173c5787 100644 > --- a/arch/arm/Kconfig > +++ b/arch/arm/Kconfig > @@ -2,6 +2,7 @@ config ARM > bool > default y > select ARCH_CLOCKSOURCE_DATA > + select ARCH_HAS_DEBUG_VIRTUAL > select ARCH_HAS_DEVMEM_IS_ALLOWED > select ARCH_HAS_ELF_RANDOMIZE > select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST > diff --git a/arch/arm/include/asm/memory.h b/arch/arm/include/asm/memory.h > index bee7511c5098..46f192218be7 100644 > --- a/arch/arm/include/asm/memory.h > +++ b/arch/arm/include/asm/memory.h > @@ -213,7 +213,7 @@ extern const void *__pv_table_begin, *__pv_table_end; > : "r" (x), "I" (__PV_BITS_31_24) \ > : "cc") > > -static inline phys_addr_t __virt_to_phys(unsigned long x) > +static inline phys_addr_t __virt_to_phys_nodebug(unsigned long x) > { > phys_addr_t t; > > @@ -245,7 +245,7 @@ static inline unsigned long __phys_to_virt(phys_addr_t x) > #define PHYS_OFFSET PLAT_PHYS_OFFSET > #define PHYS_PFN_OFFSET ((unsigned long)(PHYS_OFFSET >> PAGE_SHIFT)) > > -static inline phys_addr_t __virt_to_phys(unsigned long x) > +static inline phys_addr_t __virt_to_phys_nodebug(unsigned long x) > { > return (phys_addr_t)x - PAGE_OFFSET + PHYS_OFFSET; > } > @@ -261,6 +261,16 @@ static inline unsigned long __phys_to_virt(phys_addr_t x) > ((((unsigned long)(kaddr) - PAGE_OFFSET) >> PAGE_SHIFT) + \ > PHYS_PFN_OFFSET) > > +#define __pa_symbol_nodebug(x) ((x) - (unsigned long)KERNEL_START) On arm64 the kernel image lives in a separate linear offset. arm doesn't do anything like that so __phys_addr_symbol should just be the regular __virt_to_phys > + > +#ifdef CONFIG_DEBUG_VIRTUAL > +extern phys_addr_t __virt_to_phys(unsigned long x); > +extern phys_addr_t __phys_addr_symbol(unsigned long x); > +#else > +#define __virt_to_phys(x) __virt_to_phys_nodebug(x) > +#define __phys_addr_symbol(x) __pa_symbol_nodebug(x) > +#endif > + > /* > * These are *only* valid on the kernel direct mapped RAM memory. > * Note: Drivers should NOT use these. They are the wrong > @@ -283,9 +293,11 @@ static inline void *phys_to_virt(phys_addr_t x) > * Drivers should NOT use these either. > */ > #define __pa(x) __virt_to_phys((unsigned long)(x)) > +#define __pa_symbol(x) __phys_addr_symbol(RELOC_HIDE((unsigned long)(x), 0)) > #define __va(x) ((void *)__phys_to_virt((phys_addr_t)(x))) > #define pfn_to_kaddr(pfn) __va((phys_addr_t)(pfn) << PAGE_SHIFT) > > + > extern long long arch_phys_to_idmap_offset; > > /* > diff --git a/arch/arm/mm/Makefile b/arch/arm/mm/Makefile > index e8698241ece9..b3dea80715b4 100644 > --- a/arch/arm/mm/Makefile > +++ b/arch/arm/mm/Makefile > @@ -14,6 +14,7 @@ endif > > obj-$(CONFIG_ARM_PTDUMP) += dump.o > obj-$(CONFIG_MODULES) += proc-syms.o > +obj-$(CONFIG_DEBUG_VIRTUAL) += physaddr.o > > obj-$(CONFIG_ALIGNMENT_TRAP) += alignment.o > obj-$(CONFIG_HIGHMEM) += highmem.o > diff --git a/arch/arm/mm/physaddr.c b/arch/arm/mm/physaddr.c > new file mode 100644 > index 000000000000..00f6dcffab8b > --- /dev/null > +++ b/arch/arm/mm/physaddr.c > @@ -0,0 +1,51 @@ > +#include <linux/bug.h> > +#include <linux/export.h> > +#include <linux/types.h> > +#include <linux/mmdebug.h> > +#include <linux/mm.h> > + > +#include <asm/sections.h> > +#include <asm/memory.h> > +#include <asm/fixmap.h> > + > +#include "mm.h" > + > +static inline bool __virt_addr_valid(unsigned long x) > +{ > + if (x < PAGE_OFFSET) > + return false; > + if (arm_lowmem_limit && is_vmalloc_or_module_addr((void *)x)) > + return false; > + if (x >= FIXADDR_START && x < FIXADDR_END) > + return false; > + return true; > +} I'd rather see this return true for only the linear range and reject everything else. asm/memory.h already has #define virt_addr_valid(kaddr) (((unsigned long)(kaddr) >= PAGE_OFFSET && (unsigned long)(kaddr) < (unsigned long)high_memory) \ && pfn_valid(virt_to_pfn(kaddr))) So we can make the check x >= PAGE_OFFSET && x < high_memory > + > +phys_addr_t __virt_to_phys(unsigned long x) > +{ > + WARN(!__virt_addr_valid(x), > + "virt_to_phys used for non-linear address :%pK\n", (void *)x); > + > + return __virt_to_phys_nodebug(x); > +} > +EXPORT_SYMBOL(__virt_to_phys); > + > +static inline bool __phys_addr_valid(unsigned long x) > +{ > + /* This is bounds checking against the kernel image only. > + * __pa_symbol should only be used on kernel symbol addresses. > + */ > + if (x < (unsigned long)KERNEL_START || > + x > (unsigned long)KERNEL_END) > + return false; > + > + return true; > +} This is a confusing name for this function, it's not checking if a physical address is valid, it's checking if a virtual address corresponding to a kernel symbol is valid. > + > +phys_addr_t __phys_addr_symbol(unsigned long x) > +{ > + VIRTUAL_BUG_ON(!__phys_addr_valid(x)); > + > + return __pa_symbol_nodebug(x); > +} > +EXPORT_SYMBOL(__phys_addr_symbol); > Thanks, Laura
On 12/06/2016 06:00 PM, Laura Abbott wrote: >> @@ -261,6 +261,16 @@ static inline unsigned long __phys_to_virt(phys_addr_t x) >> ((((unsigned long)(kaddr) - PAGE_OFFSET) >> PAGE_SHIFT) + \ >> PHYS_PFN_OFFSET) >> >> +#define __pa_symbol_nodebug(x) ((x) - (unsigned long)KERNEL_START) > > On arm64 the kernel image lives in a separate linear offset. arm doesn't > do anything like that so __phys_addr_symbol should just be the regular > __virt_to_phys Yep, which is what I have queued locally now too, thanks! >> +static inline bool __virt_addr_valid(unsigned long x) >> +{ >> + if (x < PAGE_OFFSET) >> + return false; >> + if (arm_lowmem_limit && is_vmalloc_or_module_addr((void *)x)) >> + return false; >> + if (x >= FIXADDR_START && x < FIXADDR_END) >> + return false; >> + return true; >> +} > > I'd rather see this return true for only the linear range and > reject everything else. asm/memory.h already has > > #define virt_addr_valid(kaddr) (((unsigned long)(kaddr) >= PAGE_OFFSET && (unsigned long)(kaddr) < (unsigned long)high_memory) \ > && pfn_valid(virt_to_pfn(kaddr))) > > So we can make the check x >= PAGE_OFFSET && x < high_memory OK that's simpler indeed. I did the check this way because we have early callers of __pa() from drivers/of/fdt.c, in particular MIN_MEMBLOCK_ADDR there, and we also have pcpu_dfl_fc_alloc which uses DMA_MAX_ADDR (which is 0xffff_ffff on my platform). >> +static inline bool __phys_addr_valid(unsigned long x) >> +{ >> + /* This is bounds checking against the kernel image only. >> + * __pa_symbol should only be used on kernel symbol addresses. >> + */ >> + if (x < (unsigned long)KERNEL_START || >> + x > (unsigned long)KERNEL_END) >> + return false; >> + >> + return true; >> +} > > This is a confusing name for this function, it's not checking if > a physical address is valid, it's checking if a virtual address > corresponding to a kernel symbol is valid. I have removed it and just moved the check within VIRTUAL_BUG_ON(). Thanks!
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig index b5d529fdffab..5e66173c5787 100644 --- a/arch/arm/Kconfig +++ b/arch/arm/Kconfig @@ -2,6 +2,7 @@ config ARM bool default y select ARCH_CLOCKSOURCE_DATA + select ARCH_HAS_DEBUG_VIRTUAL select ARCH_HAS_DEVMEM_IS_ALLOWED select ARCH_HAS_ELF_RANDOMIZE select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST diff --git a/arch/arm/include/asm/memory.h b/arch/arm/include/asm/memory.h index bee7511c5098..46f192218be7 100644 --- a/arch/arm/include/asm/memory.h +++ b/arch/arm/include/asm/memory.h @@ -213,7 +213,7 @@ extern const void *__pv_table_begin, *__pv_table_end; : "r" (x), "I" (__PV_BITS_31_24) \ : "cc") -static inline phys_addr_t __virt_to_phys(unsigned long x) +static inline phys_addr_t __virt_to_phys_nodebug(unsigned long x) { phys_addr_t t; @@ -245,7 +245,7 @@ static inline unsigned long __phys_to_virt(phys_addr_t x) #define PHYS_OFFSET PLAT_PHYS_OFFSET #define PHYS_PFN_OFFSET ((unsigned long)(PHYS_OFFSET >> PAGE_SHIFT)) -static inline phys_addr_t __virt_to_phys(unsigned long x) +static inline phys_addr_t __virt_to_phys_nodebug(unsigned long x) { return (phys_addr_t)x - PAGE_OFFSET + PHYS_OFFSET; } @@ -261,6 +261,16 @@ static inline unsigned long __phys_to_virt(phys_addr_t x) ((((unsigned long)(kaddr) - PAGE_OFFSET) >> PAGE_SHIFT) + \ PHYS_PFN_OFFSET) +#define __pa_symbol_nodebug(x) ((x) - (unsigned long)KERNEL_START) + +#ifdef CONFIG_DEBUG_VIRTUAL +extern phys_addr_t __virt_to_phys(unsigned long x); +extern phys_addr_t __phys_addr_symbol(unsigned long x); +#else +#define __virt_to_phys(x) __virt_to_phys_nodebug(x) +#define __phys_addr_symbol(x) __pa_symbol_nodebug(x) +#endif + /* * These are *only* valid on the kernel direct mapped RAM memory. * Note: Drivers should NOT use these. They are the wrong @@ -283,9 +293,11 @@ static inline void *phys_to_virt(phys_addr_t x) * Drivers should NOT use these either. */ #define __pa(x) __virt_to_phys((unsigned long)(x)) +#define __pa_symbol(x) __phys_addr_symbol(RELOC_HIDE((unsigned long)(x), 0)) #define __va(x) ((void *)__phys_to_virt((phys_addr_t)(x))) #define pfn_to_kaddr(pfn) __va((phys_addr_t)(pfn) << PAGE_SHIFT) + extern long long arch_phys_to_idmap_offset; /* diff --git a/arch/arm/mm/Makefile b/arch/arm/mm/Makefile index e8698241ece9..b3dea80715b4 100644 --- a/arch/arm/mm/Makefile +++ b/arch/arm/mm/Makefile @@ -14,6 +14,7 @@ endif obj-$(CONFIG_ARM_PTDUMP) += dump.o obj-$(CONFIG_MODULES) += proc-syms.o +obj-$(CONFIG_DEBUG_VIRTUAL) += physaddr.o obj-$(CONFIG_ALIGNMENT_TRAP) += alignment.o obj-$(CONFIG_HIGHMEM) += highmem.o diff --git a/arch/arm/mm/physaddr.c b/arch/arm/mm/physaddr.c new file mode 100644 index 000000000000..00f6dcffab8b --- /dev/null +++ b/arch/arm/mm/physaddr.c @@ -0,0 +1,51 @@ +#include <linux/bug.h> +#include <linux/export.h> +#include <linux/types.h> +#include <linux/mmdebug.h> +#include <linux/mm.h> + +#include <asm/sections.h> +#include <asm/memory.h> +#include <asm/fixmap.h> + +#include "mm.h" + +static inline bool __virt_addr_valid(unsigned long x) +{ + if (x < PAGE_OFFSET) + return false; + if (arm_lowmem_limit && is_vmalloc_or_module_addr((void *)x)) + return false; + if (x >= FIXADDR_START && x < FIXADDR_END) + return false; + return true; +} + +phys_addr_t __virt_to_phys(unsigned long x) +{ + WARN(!__virt_addr_valid(x), + "virt_to_phys used for non-linear address :%pK\n", (void *)x); + + return __virt_to_phys_nodebug(x); +} +EXPORT_SYMBOL(__virt_to_phys); + +static inline bool __phys_addr_valid(unsigned long x) +{ + /* This is bounds checking against the kernel image only. + * __pa_symbol should only be used on kernel symbol addresses. + */ + if (x < (unsigned long)KERNEL_START || + x > (unsigned long)KERNEL_END) + return false; + + return true; +} + +phys_addr_t __phys_addr_symbol(unsigned long x) +{ + VIRTUAL_BUG_ON(!__phys_addr_valid(x)); + + return __pa_symbol_nodebug(x); +} +EXPORT_SYMBOL(__phys_addr_symbol);
x86 has an option: CONFIG_DEBUG_VIRTUAL to do additional checks on virt_to_phys calls. The goal is to catch users who are calling virt_to_phys on non-linear addresses immediately. This includes caller using __virt_to_phys() on image addresses instead of __pa_symbol(). This is a generally useful debug feature to spot bad code (particulary in drivers). Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> --- arch/arm/Kconfig | 1 + arch/arm/include/asm/memory.h | 16 ++++++++++++-- arch/arm/mm/Makefile | 1 + arch/arm/mm/physaddr.c | 51 +++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 67 insertions(+), 2 deletions(-) create mode 100644 arch/arm/mm/physaddr.c