mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-30 08:02:30 +00:00
342f43af70
Starting with commit a799c2bd29
("x86/setup: Consolidate early memory reservations")
memory reservations have been moved earlier during the boot process,
before the execution of the Kernel Address Space Layout Randomization code.
setup_arch() calls the iscsi_ibft's find_ibft_region() function
to find and reserve the memory dedicated to the iBFT and this function
also saves a virtual pointer to the iBFT table for later use.
The problem is that if KALSR is active, the physical memory gets
remapped somewhere else in the virtual address space and the pointer is
no longer valid, this will cause a kernel panic when the iscsi driver tries
to dereference it.
iBFT detected.
BUG: unable to handle page fault for address: ffff888000099fd8
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] SMP PTI
..snip..
Call Trace:
? ibft_create_kobject+0x1d2/0x1d2 [iscsi_ibft]
do_one_initcall+0x44/0x1d0
? kmem_cache_alloc_trace+0x119/0x220
do_init_module+0x5c/0x270
__do_sys_init_module+0x12e/0x1b0
do_syscall_64+0x40/0x80
entry_SYSCALL_64_after_hwframe+0x44/0xae
Fix this bug by saving the address of the physical location
of the ibft; later the driver will use isa_bus_to_virt() to get
the correct virtual address.
N.B. On each reboot KASLR randomizes the virtual addresses so
assuming phys_to_virt before KASLR does its deed is incorrect.
Simplify the code by renaming find_ibft_region()
to reserve_ibft_region() and remove all the wrappers.
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad@kernel.org>
92 lines
2.1 KiB
C
92 lines
2.1 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* Copyright 2007-2010 Red Hat, Inc.
|
|
* by Peter Jones <pjones@redhat.com>
|
|
* Copyright 2007 IBM, Inc.
|
|
* by Konrad Rzeszutek <konradr@linux.vnet.ibm.com>
|
|
* Copyright 2008
|
|
* by Konrad Rzeszutek <ketuzsezr@darnok.org>
|
|
*
|
|
* This code finds the iSCSI Boot Format Table.
|
|
*/
|
|
|
|
#include <linux/memblock.h>
|
|
#include <linux/blkdev.h>
|
|
#include <linux/ctype.h>
|
|
#include <linux/device.h>
|
|
#include <linux/efi.h>
|
|
#include <linux/err.h>
|
|
#include <linux/init.h>
|
|
#include <linux/limits.h>
|
|
#include <linux/module.h>
|
|
#include <linux/pci.h>
|
|
#include <linux/stat.h>
|
|
#include <linux/string.h>
|
|
#include <linux/types.h>
|
|
#include <linux/acpi.h>
|
|
#include <linux/iscsi_ibft.h>
|
|
|
|
#include <asm/mmzone.h>
|
|
|
|
/*
|
|
* Physical location of iSCSI Boot Format Table.
|
|
*/
|
|
phys_addr_t ibft_phys_addr;
|
|
EXPORT_SYMBOL_GPL(ibft_phys_addr);
|
|
|
|
static const struct {
|
|
char *sign;
|
|
} ibft_signs[] = {
|
|
{ "iBFT" },
|
|
{ "BIFT" }, /* Broadcom iSCSI Offload */
|
|
};
|
|
|
|
#define IBFT_SIGN_LEN 4
|
|
#define IBFT_START 0x80000 /* 512kB */
|
|
#define IBFT_END 0x100000 /* 1MB */
|
|
#define VGA_MEM 0xA0000 /* VGA buffer */
|
|
#define VGA_SIZE 0x20000 /* 128kB */
|
|
|
|
/*
|
|
* Routine used to find and reserve the iSCSI Boot Format Table
|
|
*/
|
|
void __init reserve_ibft_region(void)
|
|
{
|
|
unsigned long pos;
|
|
unsigned int len = 0;
|
|
void *virt;
|
|
int i;
|
|
|
|
ibft_phys_addr = 0;
|
|
|
|
/* iBFT 1.03 section 1.4.3.1 mandates that UEFI machines will
|
|
* only use ACPI for this
|
|
*/
|
|
if (efi_enabled(EFI_BOOT))
|
|
return;
|
|
|
|
for (pos = IBFT_START; pos < IBFT_END; pos += 16) {
|
|
/* The table can't be inside the VGA BIOS reserved space,
|
|
* so skip that area */
|
|
if (pos == VGA_MEM)
|
|
pos += VGA_SIZE;
|
|
virt = isa_bus_to_virt(pos);
|
|
|
|
for (i = 0; i < ARRAY_SIZE(ibft_signs); i++) {
|
|
if (memcmp(virt, ibft_signs[i].sign, IBFT_SIGN_LEN) ==
|
|
0) {
|
|
unsigned long *addr =
|
|
(unsigned long *)isa_bus_to_virt(pos + 4);
|
|
len = *addr;
|
|
/* if the length of the table extends past 1M,
|
|
* the table cannot be valid. */
|
|
if (pos + len <= (IBFT_END-1)) {
|
|
ibft_phys_addr = pos;
|
|
memblock_reserve(ibft_phys_addr, PAGE_ALIGN(len));
|
|
pr_info("iBFT found at 0x%lx.\n", ibft_phys_addr);
|
|
return;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|