Re: [PATCH 1/2] riscv: Fix crash during early errata patching

From: Alexandre Ghiti
Date: Thu Sep 22 2022 - 03:32:11 EST


Hi Samuel,

On 9/22/22 07:47, Samuel Holland wrote:
The patch function for the T-Head PBMT errata calls __pa_symbol() before
relocation. This crashes when CONFIG_DEBUG_VIRTUAL is enabled, because
__pa_symbol() forwards to __phys_addr_symbol(), and __phys_addr_symbol()
checks against the absolute kernel start/end address.

Fix this by directly using the underlying kernel_mapping_va_to_pa().


I'd rather fix __phys_addr_symbol so that we can use __pa_symbol and then take advantage of the address range check. Instead of using _end in phys_addr_symbol, we have access to the size of the kernel mapping, so we could do something like that:

diff --git a/arch/riscv/mm/physaddr.c b/arch/riscv/mm/physaddr.c
index f981b1f95fa0..150691aef058 100644
--- a/arch/riscv/mm/physaddr.c
+++ b/arch/riscv/mm/physaddr.c
@@ -22,7 +22,7 @@ EXPORT_SYMBOL(__virt_to_phys);
 phys_addr_t __phys_addr_symbol(unsigned long x)
 {
        unsigned long kernel_start = kernel_map.virt_addr;
-       unsigned long kernel_end = (unsigned long)_end;
+       unsigned long kernel_end = kernel_map.virt_addr + kernel_map.size;

        /*
         * Boundary checking aginst the kernel image mapping.

Thanks,

Alex


Fixes: a35707c3d850 ("riscv: add memory-type errata for T-Head")
Signed-off-by: Samuel Holland <samuel@xxxxxxxxxxxx>
---

arch/riscv/errata/thead/errata.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/errata/thead/errata.c b/arch/riscv/errata/thead/errata.c
index 202c83f677b2..83174f13783e 100644
--- a/arch/riscv/errata/thead/errata.c
+++ b/arch/riscv/errata/thead/errata.c
@@ -76,8 +76,9 @@ void __init_or_module thead_errata_patch_func(struct alt_entry *begin, struct al
if (cpu_req_errata & tmp) {
/* On vm-alternatives, the mmu isn't running yet */
if (stage == RISCV_ALTERNATIVES_EARLY_BOOT)
- memcpy((void *)__pa_symbol(alt->old_ptr),
- (void *)__pa_symbol(alt->alt_ptr), alt->alt_len);
+ memcpy((void *)kernel_mapping_va_to_pa((unsigned long)alt->old_ptr),
+ (void *)kernel_mapping_va_to_pa((unsigned long)alt->alt_ptr),
+ alt->alt_len);
else
patch_text_nosync(alt->old_ptr, alt->alt_ptr, alt->alt_len);
}