On Thu, Apr 01, 2021 at 04:32:09PM -0700, Sami Tolvanen wrote:
> With CONFIG_CFI_CLANG, the compiler replaces function pointers with
> jump table addresses, which results in __pa_symbol returning the
> physical address of the jump table entry. As the jump table contains
> an immediate jump to an EL1 virtual address, this typically won't
> work as intended. Use function_nocfi to get the actual address of
> cpu_resume.
>
> Signed-off-by: Sami Tolvanen <samitolvanen@xxxxxxxxxx>
> Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>
Acked-by: Mark Rutland <mark.rutland@xxxxxxx>
Mark.
> ---
> drivers/firmware/psci/psci.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/firmware/psci/psci.c b/drivers/firmware/psci/psci.c
> index f5fc429cae3f..64344e84bd63 100644
> --- a/drivers/firmware/psci/psci.c
> +++ b/drivers/firmware/psci/psci.c
> @@ -325,8 +325,9 @@ static int __init psci_features(u32 psci_func_id)
> static int psci_suspend_finisher(unsigned long state)
> {
> u32 power_state = state;
> + phys_addr_t pa_cpu_resume = __pa_symbol(function_nocfi(cpu_resume));
>
> - return psci_ops.cpu_suspend(power_state, __pa_symbol(cpu_resume));
> + return psci_ops.cpu_suspend(power_state, pa_cpu_resume);
> }
>
> int psci_cpu_suspend_enter(u32 state)
> @@ -344,8 +345,10 @@ int psci_cpu_suspend_enter(u32 state)
>
> static int psci_system_suspend(unsigned long unused)
> {
> + phys_addr_t pa_cpu_resume = __pa_symbol(function_nocfi(cpu_resume));
> +
> return invoke_psci_fn(PSCI_FN_NATIVE(1_0, SYSTEM_SUSPEND),
> - __pa_symbol(cpu_resume), 0, 0);
> + pa_cpu_resume, 0, 0);
> }
>
> static int psci_system_suspend_enter(suspend_state_t state)
> --
> 2.31.0.208.g409f899ff0-goog
>
