[PATCH v2 6/7] riscv: Ensure gp is NULL or points to valid data

[Rick Chen]

Hi Sean

> From: U-Boot [mailto:u-boot-bounces at lists.denx.de] On Behalf Of Sean Anderson
> Sent: Monday, September 14, 2020 10:23 PM
> To: u-boot at lists.denx.de
> Cc: Alan Quey-Liang Kao(高魁良); Leo Yu-Chi Liang(梁育齊); Heinrich Schuchardt; Bin Meng; Rick Chen; Sean Anderson
> Subject: [PATCH v2 6/7] riscv: Ensure gp is NULL or points to valid data
>
> This allows code to use a construct like `if (gd & gd->...) { ... }` when
> accessing the global data pointer. Without this change, it was possible for
> a very early trap to cause _exit_trap to read arbitrary memory. This could
> cause a second trap, preventing show_regs from being printed.
>
> XIP cannot use locks because flash is not writable. This leaves it
> vulnerable to the same class of bugs regarding already-pending IPIs as
> before this series. Fixing that would require finding another method of
> synchronization, which is outside the scope of this series.
>
> Fixes: 7c6ca03eae ("riscv: additional crash information")
> Signed-off-by: Sean Anderson <seanga2 at gmail.com>
> ---
>
> Changes in v2:
> - Set gp early with XIP
>
>  arch/riscv/cpu/start.S      | 26 +++++++++++++++++++++++---
>  arch/riscv/lib/interrupts.c |  3 ++-
>  2 files changed, 25 insertions(+), 4 deletions(-)
>
> diff --git a/arch/riscv/cpu/start.S b/arch/riscv/cpu/start.S
> index 66ca1c7020..a16af79fbe 100644
> --- a/arch/riscv/cpu/start.S
> +++ b/arch/riscv/cpu/start.S
> @@ -47,6 +47,13 @@ _start:
>         mv      tp, a0
>         mv      s1, a1
>
> +       /*
> +        * Set the global data pointer to a known value in case we get a very
> +        * early trap. The global data pointer will be set its actual value only
> +        * after it has been initialized.
> +        */
> +       mv      gp, zero
> +
>         la      t0, trap_entry
>         csrw    MODE_PREFIX(tvec), t0
>
> @@ -85,10 +92,10 @@ call_board_init_f_0:
>         jal     board_init_f_alloc_reserve
>
>         /*
> -        * Set global data pointer here for all harts, uninitialized at this
> -        * point.
> +        * Save global data pointer for later. We don't set it here because it
> +        * is not initialized yet.
>          */
> -       mv      gp, a0
> +       mv      s0, a0
>
>         /* setup stack */
>  #if CONFIG_IS_ENABLED(SMP)
> @@ -109,6 +116,12 @@ call_board_init_f_0:
>         amoswap.w s2, t1, 0(t0)
>         bnez    s2, wait_for_gd_init
>  #else
> +       /*
> +        * FIXME: gp is set before it is initialized. If an XIP U-Boot ever
> +        * encounters a pending IPI on boot it is liable to jump to whatever
> +        * memory happens to be in ipi_data.addr on boot.
> +        */
> +       mv      gp, s0
>         bnez    tp, secondary_hart_loop
>  #endif
>
> @@ -133,6 +146,13 @@ wait_for_gd_init:
>  1:     amoswap.w.aq t1, t1, 0(t0)
>         bnez    t1, 1b
>
> +       /*
> +        * Set the global data pointer only when gd_t has been initialized.
> +        * This was already set by arch_setup_gd on the boot hart, but all other
> +        * harts' global data pointers gets set here.
> +        */
> +       mv      gp, s0
> +

This method seem a little speculative and complicated to read.
Otherwise if the board_init_f_init_reserve() be modified in the future
and the gp will not synchronize any more.
board_init_f_init_reserve is belong generic flow, it can be touch by
anyone and anytime.

May I ask some questions ?
This patch is trying to prevent printing garbage messages form early
trap or early trap itself ?
When early trap occurs, how is the status of mtvec ?
How the early trap be handled in handle_trap ?

Thanks,
Rick



>         /* register available harts in the available_harts mask */
>         li      t1, 1
>         sll     t1, t1, tp
> diff --git a/arch/riscv/lib/interrupts.c b/arch/riscv/lib/interrupts.c
> index cd47e64487..ad870e98d8 100644
> --- a/arch/riscv/lib/interrupts.c
> +++ b/arch/riscv/lib/interrupts.c
> @@ -78,7 +78,8 @@ static void _exit_trap(ulong code, ulong epc, ulong tval, struct pt_regs *regs)
>
>         printf("EPC: " REG_FMT " RA: " REG_FMT " TVAL: " REG_FMT "\n",
>                epc, regs->ra, tval);
> -       if (gd->flags & GD_FLG_RELOC)
> +       /* Print relocation adjustments, but only if gd is initialized */
> +       if (gd && gd->flags & GD_FLG_RELOC)
>                 printf("EPC: " REG_FMT " RA: " REG_FMT " reloc adjusted\n\n",
>                        epc - gd->reloc_off, regs->ra - gd->reloc_off);
>
> --
> 2.28.0
>