search

frno7 / linux

Linux 2.2, 2.6, 3.x, 4.x and 5.x kernels for the PlayStation 2.
Other
92 stars 6 forks source link

Reliably trap RDHWR instruction as an SQ address exception #32

Closed frno7 closed 3 years ago

frno7 commented 5 years ago

On the R5900, the RDHWR instruction is interpreted as the R5900 specific SQ instruction[1] that traps into a zero page address exception. Hence RDHWR can be emulated by emulate_load_store_insn.

Commit 50747d6639d8ee473a7bc0a1905a4845a1312af2 traps the RDHWR instruction as an SQ address exception. In addition, CONFIG_DEFAULT_MMAP_MIN_ADDR must not be less than PAGE_SIZE to trap and emulate RDHWR, so this is made a BUILD_BUG_ON for the R5900:

https://github.com/frno7/linux/blob/c94ed72e624d28f05c2f1f034917fa432d259bc2/arch/mips/kernel/unaligned.c#L958-L959

Maciej W. Rozycki notes that

I think a more complex solution is required as the value can be changed at run time, via /proc/sys/vm/mmap_min_addr, defeating this protection. E.g. by introducing an ARCH_MIN_MMAP_MIN_ADDR minimum value, by default 0 unless overridden by the architecture selected, and then using it for both the default DEFAULT_MMAP_MIN_ADDR value and the minimum accepted via /proc/sys/vm/mmap_min_addr.

This is required for #1.

[1] TX System RISC TX79 Core Architecture manual, revision 2.0, Toshiba Corporation, p. B-162.

frno7 commented 3 years ago

Fixed in commit f418234844b5b6f71d4d83e186dce08b337c1e7e. The zero page is never accessed, only 0xffffe83b in 32-bit KSEG2. See also MIPS: R5900: Trap the RDHWR instruction as an SQ address exception.