Commit e47b40a2 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux 

Pull more arm64 updates from Catalin Marinas:

 - Silence module allocation failures when CONFIG_ARM*_MODULE_PLTS is
   enabled. This requires a check for __GFP_NOWARN in alloc_vmap_area()

 - Improve/sanitise user tagged pointers handling in the kernel

 - Inline asm fixes/cleanups

* tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: Silence first allocation with CONFIG_ARM64_MODULE_PLTS=y
  ARM: Silence first allocation with CONFIG_ARM_MODULE_PLTS=y
  mm: Silence vmap() allocation failures based on caller gfp_flags
  arm64: uaccess: suppress spurious clang warning
  arm64: atomic_lse: match asm register sizes
  arm64: armv8_deprecated: ensure extension of addr
  arm64: uaccess: ensure extension of access_ok() addr
  arm64: ensure extension of smp_store_release value
  arm64: xchg: hazard against entire exchange variable
  arm64: documentation: document tagged pointer stack constraints
  arm64: entry: improve data abort handling of tagged pointers
  arm64: hw_breakpoint: fix watchpoint matching for tagged pointers
  arm64: traps: fix userspace cache maintenance emulation on a tagged pointer
parents 4892c6f7 0c2cf6d9

Documentation/arm64/tagged-pointers.txt

+47 −15
Original line number Diff line number Diff line
@@ -11,24 +11,56 @@ in AArch64 Linux. 
The kernel configures the translation tables so that translations made

via TTBR0 (i.e. userspace mappings) have the top byte (bits 63:56) of

the virtual address ignored by the translation hardware. This frees up

this byte for application use, with the following caveats:

this byte for application use.



	(1) The kernel requires that all user addresses passed to EL1

	    are tagged with tag 0x00. This means that any syscall

	    parameters containing user virtual addresses *must* have

	    their top byte cleared before trapping to the kernel.



	(2) Non-zero tags are not preserved when delivering signals.

	    This means that signal handlers in applications making use

	    of tags cannot rely on the tag information for user virtual

	    addresses being maintained for fields inside siginfo_t.

	    One exception to this rule is for signals raised in response

	    to watchpoint debug exceptions, where the tag information

	    will be preserved.

Passing tagged addresses to the kernel

--------------------------------------



	(3) Special care should be taken when using tagged pointers,

	    since it is likely that C compilers will not hazard two

	    virtual addresses differing only in the upper byte.

All interpretation of userspace memory addresses by the kernel assumes

an address tag of 0x00.



This includes, but is not limited to, addresses found in:



 - pointer arguments to system calls, including pointers in structures

   passed to system calls,



 - the stack pointer (sp), e.g. when interpreting it to deliver a

   signal,



 - the frame pointer (x29) and frame records, e.g. when interpreting

   them to generate a backtrace or call graph.



Using non-zero address tags in any of these locations may result in an

error code being returned, a (fatal) signal being raised, or other modes

of failure.



For these reasons, passing non-zero address tags to the kernel via

system calls is forbidden, and using a non-zero address tag for sp is

strongly discouraged.



Programs maintaining a frame pointer and frame records that use non-zero

address tags may suffer impaired or inaccurate debug and profiling

visibility.





Preserving tags

---------------



Non-zero tags are not preserved when delivering signals. This means that

signal handlers in applications making use of tags cannot rely on the

tag information for user virtual addresses being maintained for fields

inside siginfo_t. One exception to this rule is for signals raised in

response to watchpoint debug exceptions, where the tag information will

be preserved.



The architecture prevents the use of a tagged PC, so the upper byte will

be set to a sign-extension of bit 55 on exception return.





Other considerations

--------------------



Special care should be taken when using tagged pointers, since it is

likely that C compilers will not hazard two virtual addresses differing

only in the upper byte.

arch/arm/kernel/module.c

+9 −2
Original line number Diff line number Diff line
@@ -40,8 +40,15 @@ 
#ifdef CONFIG_MMU

void *module_alloc(unsigned long size)

{

	void *p = __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END,

				GFP_KERNEL, PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE,

	gfp_t gfp_mask = GFP_KERNEL;

	void *p;



	/* Silence the initial allocation */

	if (IS_ENABLED(CONFIG_ARM_MODULE_PLTS))

		gfp_mask |= __GFP_NOWARN;



	p = __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END,

				gfp_mask, PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE,

				__builtin_return_address(0));

	if (!IS_ENABLED(CONFIG_ARM_MODULE_PLTS) || p)

		return p;

arch/arm64/include/asm/asm-uaccess.h

+9 −0
Original line number Diff line number Diff line
@@ -62,4 +62,13 @@ alternative_if ARM64_ALT_PAN_NOT_UAO 
alternative_else_nop_endif

	.endm



/*

 * Remove the address tag from a virtual address, if present.

 */

	.macro	clear_address_tag, dst, addr

	tst	\addr, #(1 << 55)

	bic	\dst, \addr, #(0xff << 56)

	csel	\dst, \dst, \addr, eq

	.endm



#endif

arch/arm64/include/asm/atomic_lse.h

+2 −2
Original line number Diff line number Diff line
@@ -322,7 +322,7 @@ static inline void atomic64_and(long i, atomic64_t *v) 
#define ATOMIC64_FETCH_OP_AND(name, mb, cl...)				\

static inline long atomic64_fetch_and##name(long i, atomic64_t *v)	\

{									\

	register long x0 asm ("w0") = i;				\

	register long x0 asm ("x0") = i;				\

	register atomic64_t *x1 asm ("x1") = v;				\

									\

	asm volatile(ARM64_LSE_ATOMIC_INSN(				\
@@ -394,7 +394,7 @@ ATOMIC64_OP_SUB_RETURN( , al, "memory") 
#define ATOMIC64_FETCH_OP_SUB(name, mb, cl...)				\

static inline long atomic64_fetch_sub##name(long i, atomic64_t *v)	\

{									\

	register long x0 asm ("w0") = i;				\

	register long x0 asm ("x0") = i;				\

	register atomic64_t *x1 asm ("x1") = v;				\

									\

	asm volatile(ARM64_LSE_ATOMIC_INSN(				\

arch/arm64/include/asm/barrier.h

+15 −5
Original line number Diff line number Diff line
@@ -44,23 +44,33 @@ 


#define __smp_store_release(p, v)					\

do {									\

	union { typeof(*p) __val; char __c[1]; } __u =			\

		{ .__val = (__force typeof(*p)) (v) }; 			\

	compiletime_assert_atomic_type(*p);				\

	switch (sizeof(*p)) {						\

	case 1:								\

		asm volatile ("stlrb %w1, %0"				\

				: "=Q" (*p) : "r" (v) : "memory");	\

				: "=Q" (*p)				\

				: "r" (*(__u8 *)__u.__c)		\

				: "memory");				\

		break;							\

	case 2:								\

		asm volatile ("stlrh %w1, %0"				\

				: "=Q" (*p) : "r" (v) : "memory");	\

				: "=Q" (*p)				\

				: "r" (*(__u16 *)__u.__c)		\

				: "memory");				\

		break;							\

	case 4:								\

		asm volatile ("stlr %w1, %0"				\

				: "=Q" (*p) : "r" (v) : "memory");	\

				: "=Q" (*p)				\

				: "r" (*(__u32 *)__u.__c)		\

				: "memory");				\

		break;							\

	case 8:								\

		asm volatile ("stlr %1, %0"				\

				: "=Q" (*p) : "r" (v) : "memory");	\

				: "=Q" (*p)				\

				: "r" (*(__u64 *)__u.__c)		\

				: "memory");				\

		break;							\

	}								\

} while (0)

CRA Git | Maintained and supported by SUSTech CRA and CCSE