Skip to content

Commit 62d18ec

Browse files
torvaldstorvalds
committed
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull more arm64 fixes from Will Deacon: - fix application of read-only permissions to kernel section mappings - sanitise reported ESR values for signals delivered on a kernel address - ensure tishift GCC helpers are exported to modules - fix inline asm constraints for some LSE atomics * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: Make sure permission updates happen for pmd/pud arm64: fault: Don't leak data in ESR context for user fault on kernel VA arm64: export tishift functions to modules arm64: lse: Add early clobbers to some input/output asm operands
2 parents b133ef6 + 82034c2 commit 62d18ec

File tree

5 files changed

+83
-31
lines changed

5 files changed

+83
-31
lines changed

‎arch/arm64/include/asm/atomic_lse.h

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ static inline void atomic_and(int i, atomic_t *v)
117117
/* LSE atomics */
118118
" mvn %w[i], %w[i]\n"
119119
" stclr %w[i], %[v]")
120-
: [i] "+r" (w0), [v] "+Q" (v->counter)
120+
: [i] "+&r" (w0), [v] "+Q" (v->counter)
121121
: "r" (x1)
122122
: __LL_SC_CLOBBERS);
123123
}
@@ -135,7 +135,7 @@ static inline int atomic_fetch_and##name(int i, atomic_t *v) \
135135
/* LSE atomics */ \
136136
" mvn %w[i], %w[i]\n" \
137137
" ldclr" #mb " %w[i], %w[i], %[v]") \
138-
: [i] "+r" (w0), [v] "+Q" (v->counter) \
138+
: [i] "+&r" (w0), [v] "+Q" (v->counter) \
139139
: "r" (x1) \
140140
: __LL_SC_CLOBBERS, ##cl); \
141141
\
@@ -161,7 +161,7 @@ static inline void atomic_sub(int i, atomic_t *v)
161161
/* LSE atomics */
162162
" neg %w[i], %w[i]\n"
163163
" stadd %w[i], %[v]")
164-
: [i] "+r" (w0), [v] "+Q" (v->counter)
164+
: [i] "+&r" (w0), [v] "+Q" (v->counter)
165165
: "r" (x1)
166166
: __LL_SC_CLOBBERS);
167167
}
@@ -180,7 +180,7 @@ static inline int atomic_sub_return##name(int i, atomic_t *v) \
180180
" neg %w[i], %w[i]\n" \
181181
" ldadd" #mb " %w[i], w30, %[v]\n" \
182182
" add %w[i], %w[i], w30") \
183-
: [i] "+r" (w0), [v] "+Q" (v->counter) \
183+
: [i] "+&r" (w0), [v] "+Q" (v->counter) \
184184
: "r" (x1) \
185185
: __LL_SC_CLOBBERS , ##cl); \
186186
\
@@ -207,7 +207,7 @@ static inline int atomic_fetch_sub##name(int i, atomic_t *v) \
207207
/* LSE atomics */ \
208208
" neg %w[i], %w[i]\n" \
209209
" ldadd" #mb " %w[i], %w[i], %[v]") \
210-
: [i] "+r" (w0), [v] "+Q" (v->counter) \
210+
: [i] "+&r" (w0), [v] "+Q" (v->counter) \
211211
: "r" (x1) \
212212
: __LL_SC_CLOBBERS, ##cl); \
213213
\
@@ -314,7 +314,7 @@ static inline void atomic64_and(long i, atomic64_t *v)
314314
/* LSE atomics */
315315
" mvn %[i], %[i]\n"
316316
" stclr %[i], %[v]")
317-
: [i] "+r" (x0), [v] "+Q" (v->counter)
317+
: [i] "+&r" (x0), [v] "+Q" (v->counter)
318318
: "r" (x1)
319319
: __LL_SC_CLOBBERS);
320320
}
@@ -332,7 +332,7 @@ static inline long atomic64_fetch_and##name(long i, atomic64_t *v) \
332332
/* LSE atomics */ \
333333
" mvn %[i], %[i]\n" \
334334
" ldclr" #mb " %[i], %[i], %[v]") \
335-
: [i] "+r" (x0), [v] "+Q" (v->counter) \
335+
: [i] "+&r" (x0), [v] "+Q" (v->counter) \
336336
: "r" (x1) \
337337
: __LL_SC_CLOBBERS, ##cl); \
338338
\
@@ -358,7 +358,7 @@ static inline void atomic64_sub(long i, atomic64_t *v)
358358
/* LSE atomics */
359359
" neg %[i], %[i]\n"
360360
" stadd %[i], %[v]")
361-
: [i] "+r" (x0), [v] "+Q" (v->counter)
361+
: [i] "+&r" (x0), [v] "+Q" (v->counter)
362362
: "r" (x1)
363363
: __LL_SC_CLOBBERS);
364364
}
@@ -377,7 +377,7 @@ static inline long atomic64_sub_return##name(long i, atomic64_t *v) \
377377
" neg %[i], %[i]\n" \
378378
" ldadd" #mb " %[i], x30, %[v]\n" \
379379
" add %[i], %[i], x30") \
380-
: [i] "+r" (x0), [v] "+Q" (v->counter) \
380+
: [i] "+&r" (x0), [v] "+Q" (v->counter) \
381381
: "r" (x1) \
382382
: __LL_SC_CLOBBERS, ##cl); \
383383
\
@@ -404,7 +404,7 @@ static inline long atomic64_fetch_sub##name(long i, atomic64_t *v) \
404404
/* LSE atomics */ \
405405
" neg %[i], %[i]\n" \
406406
" ldadd" #mb " %[i], %[i], %[v]") \
407-
: [i] "+r" (x0), [v] "+Q" (v->counter) \
407+
: [i] "+&r" (x0), [v] "+Q" (v->counter) \
408408
: "r" (x1) \
409409
: __LL_SC_CLOBBERS, ##cl); \
410410
\
@@ -435,7 +435,7 @@ static inline long atomic64_dec_if_positive(atomic64_t *v)
435435
" sub x30, x30, %[ret]\n"
436436
" cbnz x30, 1b\n"
437437
"2:")
438-
: [ret] "+r" (x0), [v] "+Q" (v->counter)
438+
: [ret] "+&r" (x0), [v] "+Q" (v->counter)
439439
:
440440
: __LL_SC_CLOBBERS, "cc", "memory");
441441

@@ -516,7 +516,7 @@ static inline long __cmpxchg_double##name(unsigned long old1, \
516516
" eor %[old1], %[old1], %[oldval1]\n" \
517517
" eor %[old2], %[old2], %[oldval2]\n" \
518518
" orr %[old1], %[old1], %[old2]") \
519-
: [old1] "+r" (x0), [old2] "+r" (x1), \
519+
: [old1] "+&r" (x0), [old2] "+&r" (x1), \
520520
[v] "+Q" (*(unsigned long *)ptr) \
521521
: [new1] "r" (x2), [new2] "r" (x3), [ptr] "r" (x4), \
522522
[oldval1] "r" (oldval1), [oldval2] "r" (oldval2) \

‎arch/arm64/kernel/arm64ksyms.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,3 +75,11 @@ NOKPROBE_SYMBOL(_mcount);
7575
/* arm-smccc */
7676
EXPORT_SYMBOL(__arm_smccc_smc);
7777
EXPORT_SYMBOL(__arm_smccc_hvc);
78+
79+
/* tishift.S */
80+
extern long long __ashlti3(long long a, int b);
81+
EXPORT_SYMBOL(__ashlti3);
82+
extern long long __ashrti3(long long a, int b);
83+
EXPORT_SYMBOL(__ashrti3);
84+
extern long long __lshrti3(long long a, int b);
85+
EXPORT_SYMBOL(__lshrti3);

‎arch/arm64/lib/tishift.S

Lines changed: 2 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,6 @@
1-
/*
2-
* Copyright (C) 2017 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
1+
/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
32
*
4-
* This program is free software; you can redistribute it and/or modify
5-
* it under the terms of the GNU General Public License version 2 as
6-
* published by the Free Software Foundation.
7-
*
8-
* This program is distributed in the hope that it will be useful,
9-
* but WITHOUT ANY WARRANTY; without even the implied warranty of
10-
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11-
* GNU General Public License for more details.
12-
*
13-
* You should have received a copy of the GNU General Public License
14-
* along with this program. If not, see <http://www.gnu.org/licenses/>.
3+
* Copyright (C) 2017-2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
154
*/
165

176
#include <linux/linkage.h>

‎arch/arm64/mm/fault.c

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -293,6 +293,57 @@ static void __do_kernel_fault(unsigned long addr, unsigned int esr,
293293
static void __do_user_fault(struct siginfo *info, unsigned int esr)
294294
{
295295
current->thread.fault_address = (unsigned long)info->si_addr;
296+
297+
/*
298+
* If the faulting address is in the kernel, we must sanitize the ESR.
299+
* From userspace's point of view, kernel-only mappings don't exist
300+
* at all, so we report them as level 0 translation faults.
301+
* (This is not quite the way that "no mapping there at all" behaves:
302+
* an alignment fault not caused by the memory type would take
303+
* precedence over translation fault for a real access to empty
304+
* space. Unfortunately we can't easily distinguish "alignment fault
305+
* not caused by memory type" from "alignment fault caused by memory
306+
* type", so we ignore this wrinkle and just return the translation
307+
* fault.)
308+
*/
309+
if (current->thread.fault_address >= TASK_SIZE) {
310+
switch (ESR_ELx_EC(esr)) {
311+
case ESR_ELx_EC_DABT_LOW:
312+
/*
313+
* These bits provide only information about the
314+
* faulting instruction, which userspace knows already.
315+
* We explicitly clear bits which are architecturally
316+
* RES0 in case they are given meanings in future.
317+
* We always report the ESR as if the fault was taken
318+
* to EL1 and so ISV and the bits in ISS[23:14] are
319+
* clear. (In fact it always will be a fault to EL1.)
320+
*/
321+
esr &= ESR_ELx_EC_MASK | ESR_ELx_IL |
322+
ESR_ELx_CM | ESR_ELx_WNR;
323+
esr |= ESR_ELx_FSC_FAULT;
324+
break;
325+
case ESR_ELx_EC_IABT_LOW:
326+
/*
327+
* Claim a level 0 translation fault.
328+
* All other bits are architecturally RES0 for faults
329+
* reported with that DFSC value, so we clear them.
330+
*/
331+
esr &= ESR_ELx_EC_MASK | ESR_ELx_IL;
332+
esr |= ESR_ELx_FSC_FAULT;
333+
break;
334+
default:
335+
/*
336+
* This should never happen (entry.S only brings us
337+
* into this code for insn and data aborts from a lower
338+
* exception level). Fail safe by not providing an ESR
339+
* context record at all.
340+
*/
341+
WARN(1, "ESR 0x%x is not DABT or IABT from EL0\n", esr);
342+
esr = 0;
343+
break;
344+
}
345+
}
346+
296347
current->thread.fault_code = esr;
297348
arm64_force_sig_info(info, esr_to_fault_info(esr)->name, current);
298349
}

‎arch/arm64/mm/mmu.c

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -933,27 +933,31 @@ int pud_set_huge(pud_t *pudp, phys_addr_t phys, pgprot_t prot)
933933
{
934934
pgprot_t sect_prot = __pgprot(PUD_TYPE_SECT |
935935
pgprot_val(mk_sect_prot(prot)));
936+
pud_t new_pud = pfn_pud(__phys_to_pfn(phys), sect_prot);
936937

937-
/* ioremap_page_range doesn't honour BBM */
938-
if (pud_present(READ_ONCE(*pudp)))
938+
/* Only allow permission changes for now */
939+
if (!pgattr_change_is_safe(READ_ONCE(pud_val(*pudp)),
940+
pud_val(new_pud)))
939941
return 0;
940942

941943
BUG_ON(phys & ~PUD_MASK);
942-
set_pud(pudp, pfn_pud(__phys_to_pfn(phys), sect_prot));
944+
set_pud(pudp, new_pud);
943945
return 1;
944946
}
945947

946948
int pmd_set_huge(pmd_t *pmdp, phys_addr_t phys, pgprot_t prot)
947949
{
948950
pgprot_t sect_prot = __pgprot(PMD_TYPE_SECT |
949951
pgprot_val(mk_sect_prot(prot)));
952+
pmd_t new_pmd = pfn_pmd(__phys_to_pfn(phys), sect_prot);
950953

951-
/* ioremap_page_range doesn't honour BBM */
952-
if (pmd_present(READ_ONCE(*pmdp)))
954+
/* Only allow permission changes for now */
955+
if (!pgattr_change_is_safe(READ_ONCE(pmd_val(*pmdp)),
956+
pmd_val(new_pmd)))
953957
return 0;
954958

955959
BUG_ON(phys & ~PMD_MASK);
956-
set_pmd(pmdp, pfn_pmd(__phys_to_pfn(phys), sect_prot));
960+
set_pmd(pmdp, new_pmd);
957961
return 1;
958962
}
959963

0 commit comments

Comments
 (0)