From: James Morse <james.morse@xxxxxxx> commit ed50da7764535f1e24432ded289974f2bf2b0c5a upstream. The tramp_ventry macro uses tramp_vectors as the address of the vectors when calculating which ventry in the 'full fat' vectors to branch to. While there is one set of tramp_vectors, this will be true. Adding multiple sets of vectors will break this assumption. Move the generation of the vectors to a macro, and pass the start of the vectors as an argument to tramp_ventry. Reviewed-by: Russell King (Oracle) <rmk+kernel@xxxxxxxxxxxxxxx> Reviewed-by: Catalin Marinas <catalin.marinas@xxxxxxx> Signed-off-by: James Morse <james.morse@xxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/arm64/kernel/entry.S | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) --- a/arch/arm64/kernel/entry.S +++ b/arch/arm64/kernel/entry.S @@ -652,7 +652,7 @@ alternative_else_nop_endif sub \dst, \dst, PAGE_SIZE .endm - .macro tramp_ventry, regsize = 64 + .macro tramp_ventry, vector_start, regsize .align 7 1: .if \regsize == 64 @@ -675,10 +675,10 @@ alternative_insn isb, nop, ARM64_WORKARO ldr x30, =vectors #endif alternative_if_not ARM64_WORKAROUND_CAVIUM_TX2_219_PRFM - prfm plil1strm, [x30, #(1b - tramp_vectors)] + prfm plil1strm, [x30, #(1b - \vector_start)] alternative_else_nop_endif msr vbar_el1, x30 - add x30, x30, #(1b - tramp_vectors + 4) + add x30, x30, #(1b - \vector_start + 4) isb ret .org 1b + 128 // Did we overflow the ventry slot? @@ -697,19 +697,21 @@ alternative_else_nop_endif sb .endm - .align 11 -SYM_CODE_START_NOALIGN(tramp_vectors) + .macro generate_tramp_vector +.Lvector_start\@: .space 0x400 - tramp_ventry - tramp_ventry - tramp_ventry - tramp_ventry - - tramp_ventry 32 - tramp_ventry 32 - tramp_ventry 32 - tramp_ventry 32 + .rept 4 + tramp_ventry .Lvector_start\@, 64 + .endr + .rept 4 + tramp_ventry .Lvector_start\@, 32 + .endr + .endm + + .align 11 +SYM_CODE_START_NOALIGN(tramp_vectors) + generate_tramp_vector SYM_CODE_END(tramp_vectors) SYM_CODE_START(tramp_exit_native) Patches currently in stable-queue which might be from james.morse@xxxxxxx are queue-5.16/arm64-entry-add-macro-for-reading-symbol-addresses-from-the-trampoline.patch queue-5.16/arm64-use-the-clearbhb-instruction-in-mitigations.patch queue-5.16/arm64-add-percpu-vectors-for-el1.patch queue-5.16/arm64-entry-free-up-another-register-on-kpti-s-tramp_exit-path.patch queue-5.16/arm64-entry-don-t-assume-tramp_vectors-is-the-start-of-the-vectors.patch queue-5.16/arm64-entry-make-the-trampoline-cleanup-optional.patch queue-5.16/arm64-proton-pack-include-unprivileged-ebpf-status-in-spectre-v2-mitigation-reporting.patch queue-5.16/arm64-entry-add-non-kpti-__bp_harden_el1_vectors-for-mitigations.patch queue-5.16/arm64-add-id_aa64isar2_el1-sys-register.patch queue-5.16/kvm-arm64-allow-smccc_arch_workaround_3-to-be-discovered-and-migrated.patch queue-5.16/arm64-spectre-rename-spectre_v4_patch_fw_mitigation_conduit.patch queue-5.16/arm64-entry-move-trampoline-macros-out-of-ifdef-d-section.patch queue-5.16/arm64-entry-allow-tramp_alias-to-access-symbols-after-the-4k-boundary.patch queue-5.16/arm64-entry-move-the-trampoline-data-page-before-the-text-page.patch queue-5.16/arm64-entry.s-add-ventry-overflow-sanity-checks.patch queue-5.16/arm64-entry-add-vectors-that-have-the-bhb-mitigation-sequences.patch queue-5.16/arm64-mitigate-spectre-style-branch-history-side-channels.patch queue-5.16/arm64-entry-allow-the-trampoline-text-to-occupy-multiple-pages.patch queue-5.16/arm64-proton-pack-report-spectre-bhb-vulnerabilities-as-part-of-spectre-v2.patch queue-5.16/kvm-arm64-allow-indirect-vectors-to-be-used-without-spectre_v3a.patch queue-5.16/arm64-entry-make-the-kpti-trampoline-s-kpti-sequence-optional.patch