Commit bfe29874 authored by James Morse's avatar James Morse Committed by Catalin Marinas
Browse files

arm64: entry-common: don't touch daif before bp-hardening 



The previous patches mechanically transformed the assembly version of
entry.S to entry-common.c for synchronous exceptions.

The C version of local_daif_restore() doesn't quite do the same thing
as the assembly versions if pseudo-NMI is in use. In particular,
| local_daif_restore(DAIF_PROCCTX_NOIRQ)
will still allow pNMI to be delivered. This is not the behaviour
do_el0_ia_bp_hardening() and do_sp_pc_abort() want as it should not
be possible for the PMU handler to run as an NMI until the bp-hardening
sequence has run.

The bp-hardening calls were placed where they are because this was the
first C code to run after the relevant exceptions. As we've now moved
that point earlier, move the checks and calls earlier too.

This makes it clearer that this stuff runs before any kind of exception,
and saves modifying PSTATE twice.

Signed-off-by: default avatarJames Morse <james.morse@arm.com>
Reviewed-by: default avatarMark Rutland <mark.rutland@arm.com>
Cc: Julien Thierry <julien.thierry.kdev@gmail.com>
Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
parent afa7c0e5

arch/arm64/include/asm/processor.h

+14 −0
Original line number Diff line number Diff line
@@ -26,10 +26,12 @@ 
#include <linux/init.h>

#include <linux/stddef.h>

#include <linux/string.h>

#include <linux/thread_info.h>



#include <asm/alternative.h>

#include <asm/cpufeature.h>

#include <asm/hw_breakpoint.h>

#include <asm/kasan.h>

#include <asm/lse.h>

#include <asm/pgtable-hwdef.h>

#include <asm/pointer_auth.h>
@@ -214,6 +216,18 @@ static inline void start_thread(struct pt_regs *regs, unsigned long pc, 
	regs->sp = sp;

}



static inline bool is_ttbr0_addr(unsigned long addr)

{

	/* entry assembly clears tags for TTBR0 addrs */

	return addr < TASK_SIZE;

}



static inline bool is_ttbr1_addr(unsigned long addr)

{

	/* TTBR1 addresses may have a tag if KASAN_SW_TAGS is in use */

	return arch_kasan_reset_tag(addr) >= PAGE_OFFSET;

}



#ifdef CONFIG_COMPAT

static inline void compat_start_thread(struct pt_regs *regs, unsigned long pc,

				       unsigned long sp)

arch/arm64/kernel/entry-common.c

+15 −3
Original line number Diff line number Diff line
@@ -14,6 +14,7 @@ 
#include <asm/esr.h>

#include <asm/exception.h>

#include <asm/kprobes.h>

#include <asm/mmu.h>

#include <asm/sysreg.h>



static void notrace el1_abort(struct pt_regs *regs, unsigned long esr)
@@ -112,9 +113,17 @@ static void notrace el0_ia(struct pt_regs *regs, unsigned long esr) 
{

	unsigned long far = read_sysreg(far_el1);



	/*

	 * We've taken an instruction abort from userspace and not yet

	 * re-enabled IRQs. If the address is a kernel address, apply

	 * BP hardening prior to enabling IRQs and pre-emption.

	 */

	if (!is_ttbr0_addr(far))

		arm64_apply_bp_hardening();



	user_exit_irqoff();

	local_daif_restore(DAIF_PROCCTX_NOIRQ);

	do_el0_ia_bp_hardening(far, esr, regs);

	local_daif_restore(DAIF_PROCCTX);

	do_mem_abort(far, esr, regs);

}

NOKPROBE_SYMBOL(el0_ia);
@@ -154,8 +163,11 @@ static void notrace el0_pc(struct pt_regs *regs, unsigned long esr) 
{

	unsigned long far = read_sysreg(far_el1);



	if (!is_ttbr0_addr(instruction_pointer(regs)))

		arm64_apply_bp_hardening();



	user_exit_irqoff();

	local_daif_restore(DAIF_PROCCTX_NOIRQ);

	local_daif_restore(DAIF_PROCCTX);

	do_sp_pc_abort(far, esr, regs);

}

NOKPROBE_SYMBOL(el0_pc);

arch/arm64/mm/fault.c

+1 −35
Original line number Diff line number Diff line
@@ -32,8 +32,8 @@ 
#include <asm/daifflags.h>

#include <asm/debug-monitors.h>

#include <asm/esr.h>

#include <asm/kasan.h>

#include <asm/kprobes.h>

#include <asm/processor.h>

#include <asm/sysreg.h>

#include <asm/system_misc.h>

#include <asm/pgtable.h>
@@ -102,18 +102,6 @@ static void mem_abort_decode(unsigned int esr) 
		data_abort_decode(esr);

}



static inline bool is_ttbr0_addr(unsigned long addr)

{

	/* entry assembly clears tags for TTBR0 addrs */

	return addr < TASK_SIZE;

}



static inline bool is_ttbr1_addr(unsigned long addr)

{

	/* TTBR1 addresses may have a tag if KASAN_SW_TAGS is in use */

	return arch_kasan_reset_tag(addr) >= PAGE_OFFSET;

}



static inline unsigned long mm_to_pgd_phys(struct mm_struct *mm)

{

	/* Either init_pg_dir or swapper_pg_dir */
@@ -758,30 +746,8 @@ void do_el0_irq_bp_hardening(void) 
}

NOKPROBE_SYMBOL(do_el0_irq_bp_hardening);



void do_el0_ia_bp_hardening(unsigned long addr,  unsigned int esr,

			    struct pt_regs *regs)

{

	/*

	 * We've taken an instruction abort from userspace and not yet

	 * re-enabled IRQs. If the address is a kernel address, apply

	 * BP hardening prior to enabling IRQs and pre-emption.

	 */

	if (!is_ttbr0_addr(addr))

		arm64_apply_bp_hardening();



	local_daif_restore(DAIF_PROCCTX);

	do_mem_abort(addr, esr, regs);

}

NOKPROBE_SYMBOL(do_el0_ia_bp_hardening);



void do_sp_pc_abort(unsigned long addr, unsigned int esr, struct pt_regs *regs)

{

	if (user_mode(regs)) {

		if (!is_ttbr0_addr(instruction_pointer(regs)))

			arm64_apply_bp_hardening();

		local_daif_restore(DAIF_PROCCTX);

	}



	arm64_notify_die("SP/PC alignment exception", regs,

			 SIGBUS, BUS_ADRALN, (void __user *)addr, esr);

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE