From be62a32044061cb4a3b70a10598e093f1319102e Mon Sep 17 00:00:00 2001 From: Craig Bergstrom Date: Wed, 15 Nov 2017 15:29:51 -0700 Subject: x86/mm: Limit mmap() of /dev/mem to valid physical addresses One thing /dev/mem access APIs should verify is that there's no way that excessively large pfn's can leak into the high bits of the page table entry. In particular, if people can use "very large physical page addresses" through /dev/mem to set the bits past bit 58 - SOFTW4 and permission key bits and NX bit, that could *really* confuse the kernel. We had an earlier attempt: ce56a86e2ade ("x86/mm: Limit mmap() of /dev/mem to valid physical addresses") ... which turned out to be too restrictive (breaking mem=... bootups for example) and had to be reverted in: 90edaac62729 ("Revert "x86/mm: Limit mmap() of /dev/mem to valid physical addresses"") This v2 attempt modifies the original patch and makes sure that mmap(/dev/mem) limits the pfns so that it at least fits in the actual pteval_t architecturally: - Make sure mmap_mem() actually validates that the offset fits in phys_addr_t ( This may be indirectly true due to some other check, but it's not entirely obvious. ) - Change valid_mmap_phys_addr_range() to just use phys_addr_valid() on the top byte ( Top byte is sufficient, because mmap_mem() has already checked that it cannot wrap. ) - Add a few comments about what the valid_phys_addr_range() vs. valid_mmap_phys_addr_range() difference is. Signed-off-by: Craig Bergstrom [ Fixed the checks and added comments. ] Signed-off-by: Linus Torvalds [ Collected the discussion and patches into a commit. ] Cc: Boris Ostrovsky Cc: Fengguang Wu Cc: Greg Kroah-Hartman Cc: Hans Verkuil Cc: Mauro Carvalho Chehab Cc: Peter Zijlstra Cc: Sander Eikelenboom Cc: Sean Young Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/CA+55aFyEcOMb657vWSmrM13OxmHxC-XxeBmNis=DwVvpJUOogQ@mail.gmail.com Signed-off-by: Ingo Molnar --- drivers/char/mem.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'drivers') diff --git a/drivers/char/mem.c b/drivers/char/mem.c index 970e1242a282..6aefe5370e5b 100644 --- a/drivers/char/mem.c +++ b/drivers/char/mem.c @@ -343,6 +343,10 @@ static int mmap_mem(struct file *file, struct vm_area_struct *vma) size_t size = vma->vm_end - vma->vm_start; phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT; + /* Does it even fit in phys_addr_t? */ + if (offset >> PAGE_SHIFT != vma->vm_pgoff) + return -EINVAL; + /* It's illegal to wrap around the end of the physical address space. */ if (offset + (phys_addr_t)size - 1 < offset) return -EINVAL; -- cgit From fd2fa6c18b729e19c51240453a521f76c766247e Mon Sep 17 00:00:00 2001 From: Bjorn Helgaas Date: Wed, 22 Nov 2017 16:13:37 -0600 Subject: x86/PCI: Remove unused HyperTransport interrupt support There are no in-tree callers of ht_create_irq(), the driver interface for HyperTransport interrupts, left. Remove the unused entry point and all the supporting code. See 8b955b0dddb3 ("[PATCH] Initial generic hypertransport interrupt support"). Signed-off-by: Bjorn Helgaas Signed-off-by: Thomas Gleixner Acked-by: "Eric W. Biederman" Cc: Andi Kleen Cc: Greg Kroah-Hartman Cc: linux-pci@vger.kernel.org Cc: Benjamin Herrenschmidt Link: https://lkml.kernel.org/r/20171122221337.3877.23362.stgit@bhelgaas-glaptop.roam.corp.google.com --- drivers/pci/Kconfig | 9 ---- drivers/pci/Makefile | 3 -- drivers/pci/htirq.c | 135 --------------------------------------------------- 3 files changed, 147 deletions(-) delete mode 100644 drivers/pci/htirq.c (limited to 'drivers') diff --git a/drivers/pci/Kconfig b/drivers/pci/Kconfig index c32a77fc8b03..99ae5e30eabe 100644 --- a/drivers/pci/Kconfig +++ b/drivers/pci/Kconfig @@ -71,15 +71,6 @@ config XEN_PCIDEV_FRONTEND The PCI device frontend driver allows the kernel to import arbitrary PCI devices from a PCI backend to support PCI driver domains. -config HT_IRQ - bool "Interrupts on hypertransport devices" - default y - depends on PCI && X86_LOCAL_APIC - help - This allows native hypertransport devices to use interrupts. - - If unsure say Y. - config PCI_ATS bool diff --git a/drivers/pci/Makefile b/drivers/pci/Makefile index 80adbdbcecce..ab0104e0ffac 100644 --- a/drivers/pci/Makefile +++ b/drivers/pci/Makefile @@ -24,9 +24,6 @@ endif # Build the PCI MSI interrupt support obj-$(CONFIG_PCI_MSI) += msi.o -# Build the Hypertransport interrupt support -obj-$(CONFIG_HT_IRQ) += htirq.o - obj-$(CONFIG_PCI_ATS) += ats.o obj-$(CONFIG_PCI_IOV) += iov.o diff --git a/drivers/pci/htirq.c b/drivers/pci/htirq.c deleted file mode 100644 index bb88c26f5144..000000000000 --- a/drivers/pci/htirq.c +++ /dev/null @@ -1,135 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0 -/* - * File: htirq.c - * Purpose: Hypertransport Interrupt Capability - * - * Copyright (C) 2006 Linux Networx - * Copyright (C) Eric Biederman - */ - -#include -#include -#include -#include -#include -#include - -/* Global ht irq lock. - * - * This is needed to serialize access to the data port in hypertransport - * irq capability. - * - * With multiple simultaneous hypertransport irq devices it might pay - * to make this more fine grained. But start with simple, stupid, and correct. - */ -static DEFINE_SPINLOCK(ht_irq_lock); - -void write_ht_irq_msg(unsigned int irq, struct ht_irq_msg *msg) -{ - struct ht_irq_cfg *cfg = irq_get_handler_data(irq); - unsigned long flags; - - spin_lock_irqsave(&ht_irq_lock, flags); - if (cfg->msg.address_lo != msg->address_lo) { - pci_write_config_byte(cfg->dev, cfg->pos + 2, cfg->idx); - pci_write_config_dword(cfg->dev, cfg->pos + 4, msg->address_lo); - } - if (cfg->msg.address_hi != msg->address_hi) { - pci_write_config_byte(cfg->dev, cfg->pos + 2, cfg->idx + 1); - pci_write_config_dword(cfg->dev, cfg->pos + 4, msg->address_hi); - } - if (cfg->update) - cfg->update(cfg->dev, irq, msg); - spin_unlock_irqrestore(&ht_irq_lock, flags); - cfg->msg = *msg; -} - -void fetch_ht_irq_msg(unsigned int irq, struct ht_irq_msg *msg) -{ - struct ht_irq_cfg *cfg = irq_get_handler_data(irq); - - *msg = cfg->msg; -} - -void mask_ht_irq(struct irq_data *data) -{ - struct ht_irq_cfg *cfg = irq_data_get_irq_handler_data(data); - struct ht_irq_msg msg = cfg->msg; - - msg.address_lo |= 1; - write_ht_irq_msg(data->irq, &msg); -} - -void unmask_ht_irq(struct irq_data *data) -{ - struct ht_irq_cfg *cfg = irq_data_get_irq_handler_data(data); - struct ht_irq_msg msg = cfg->msg; - - msg.address_lo &= ~1; - write_ht_irq_msg(data->irq, &msg); -} - -/** - * __ht_create_irq - create an irq and attach it to a device. - * @dev: The hypertransport device to find the irq capability on. - * @idx: Which of the possible irqs to attach to. - * @update: Function to be called when changing the htirq message - * - * The irq number of the new irq or a negative error value is returned. - */ -int __ht_create_irq(struct pci_dev *dev, int idx, ht_irq_update_t *update) -{ - int max_irq, pos, irq; - unsigned long flags; - u32 data; - - pos = pci_find_ht_capability(dev, HT_CAPTYPE_IRQ); - if (!pos) - return -EINVAL; - - /* Verify the idx I want to use is in range */ - spin_lock_irqsave(&ht_irq_lock, flags); - pci_write_config_byte(dev, pos + 2, 1); - pci_read_config_dword(dev, pos + 4, &data); - spin_unlock_irqrestore(&ht_irq_lock, flags); - - max_irq = (data >> 16) & 0xff; - if (idx > max_irq) - return -EINVAL; - - irq = arch_setup_ht_irq(idx, pos, dev, update); - if (irq > 0) - dev_dbg(&dev->dev, "irq %d for HT\n", irq); - - return irq; -} -EXPORT_SYMBOL(__ht_create_irq); - -/** - * ht_create_irq - create an irq and attach it to a device. - * @dev: The hypertransport device to find the irq capability on. - * @idx: Which of the possible irqs to attach to. - * - * ht_create_irq needs to be called for all hypertransport devices - * that generate irqs. - * - * The irq number of the new irq or a negative error value is returned. - */ -int ht_create_irq(struct pci_dev *dev, int idx) -{ - return __ht_create_irq(dev, idx, NULL); -} -EXPORT_SYMBOL(ht_create_irq); - -/** - * ht_destroy_irq - destroy an irq created with ht_create_irq - * @irq: irq to be destroyed - * - * This reverses ht_create_irq removing the specified irq from - * existence. The irq should be free before this happens. - */ -void ht_destroy_irq(unsigned int irq) -{ - arch_teardown_ht_irq(irq); -} -EXPORT_SYMBOL(ht_destroy_irq); -- cgit