ARM: mm: shrink permanent FDT mapping to avoid mismatched attributes
Zhen Lei writes in commit 598f0a99fa8a ("ARM: 9210/1: Mark the FDT_FIXED
sections as shareable"):
Commit 7a1be318f579 ("ARM: 9012/1: move device tree mapping out of
linear region") uses FDT_FIXED_BASE to map the whole FDT_FIXED_SIZE
memory area which contains fdt. But it only reserves the exact physical
memory that fdt occupied. Unfortunately, this mapping is non-shareable.
An illegal or speculative read access can bring the RAM content from
non-fdt zone into cache, PIPT makes it to be hit by subsequently read
access through shareable mapping (such as linear mapping), and the
cache consistency between cores is lost due to non-shareable property.
|<---------FDT_FIXED_SIZE------>|
| |
-------------------------------
| <non-fdt> | <fdt> | <non-fdt> |
-------------------------------
1. CoreA read <non-fdt> through MT_ROM mapping, the old data is loaded
into the cache.
2. CoreB write <non-fdt> to update data through linear mapping. CoreA
received the notification to invalid the corresponding cachelines,
but the property non-shareable makes it to be ignored.
3. CoreA read <non-fdt> through linear mapping, cache hit, the old data
is read.
However, the resulting fix is incomplete, as mismatched shareability
attributes are not the only potential problem vector here: the non-fdt
regions might also be covered by a no-map memory reservation, or be
mapped with non-cacheable attributes for, e.g., firmware calls or
non-coherent DMA. This means, in order to eliminate any potential
mismatched attribute mappings, we must reduce the size of the FDT
mapping to match its memblock reservation, and eliminate the non-fdt
regions altogether.
The permanent FDT region will no longer cover the ATAGS when booting a
non-DT system, but this mapping was never used or exposed after boot
anyway. (The ATAGS are copied into a separate buffer by the early ATAGS
processing code)
Reported-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
3 files changed
