From: James Morse <james.morse@xxxxxxx> commit 03aff3a77a58b5b52a77e00537a42090ad57b80b upstream. Kpti stashes x30 in far_el1 while it uses x30 for all its work. Making the vectors a per-cpu data structure will require a second register. Allow tramp_exit two registers before it unmaps the kernel, by leaving x30 on the stack, and stashing x29 in far_el1. Reviewed-by: Russell King (Oracle) <rmk+kernel@xxxxxxxxxxxxxxx> Reviewed-by: Catalin Marinas <catalin.marinas@xxxxxxx> Signed-off-by: James Morse <james.morse@xxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/arm64/kernel/entry.S | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) --- a/arch/arm64/kernel/entry.S +++ b/arch/arm64/kernel/entry.S @@ -419,14 +419,16 @@ alternative_else_nop_endif ldp x24, x25, [sp, #16 * 12] ldp x26, x27, [sp, #16 * 13] ldp x28, x29, [sp, #16 * 14] - ldr lr, [sp, #S_LR] - add sp, sp, #PT_REGS_SIZE // restore sp .if \el == 0 -alternative_insn eret, nop, ARM64_UNMAP_KERNEL_AT_EL0 +alternative_if_not ARM64_UNMAP_KERNEL_AT_EL0 + ldr lr, [sp, #S_LR] + add sp, sp, #PT_REGS_SIZE // restore sp + eret +alternative_else_nop_endif #ifdef CONFIG_UNMAP_KERNEL_AT_EL0 bne 4f - msr far_el1, x30 + msr far_el1, x29 tramp_alias x30, tramp_exit_native br x30 4: @@ -434,6 +436,9 @@ alternative_insn eret, nop, ARM64_UNMAP_ br x30 #endif .else + ldr lr, [sp, #S_LR] + add sp, sp, #PT_REGS_SIZE // restore sp + /* Ensure any device/NC reads complete */ alternative_insn nop, "dmb sy", ARM64_WORKAROUND_1508412 @@ -674,10 +679,12 @@ alternative_else_nop_endif .macro tramp_exit, regsize = 64 adr x30, tramp_vectors msr vbar_el1, x30 - tramp_unmap_kernel x30 + ldr lr, [sp, #S_LR] + tramp_unmap_kernel x29 .if \regsize == 64 - mrs x30, far_el1 + mrs x29, far_el1 .endif + add sp, sp, #PT_REGS_SIZE // restore sp eret sb .endm Patches currently in stable-queue which might be from james.morse@xxxxxxx are queue-5.16/arm64-entry-add-macro-for-reading-symbol-addresses-from-the-trampoline.patch queue-5.16/arm64-use-the-clearbhb-instruction-in-mitigations.patch queue-5.16/arm64-add-percpu-vectors-for-el1.patch queue-5.16/arm64-entry-free-up-another-register-on-kpti-s-tramp_exit-path.patch queue-5.16/arm64-entry-don-t-assume-tramp_vectors-is-the-start-of-the-vectors.patch queue-5.16/arm64-entry-make-the-trampoline-cleanup-optional.patch queue-5.16/arm64-proton-pack-include-unprivileged-ebpf-status-in-spectre-v2-mitigation-reporting.patch queue-5.16/arm64-entry-add-non-kpti-__bp_harden_el1_vectors-for-mitigations.patch queue-5.16/arm64-add-id_aa64isar2_el1-sys-register.patch queue-5.16/kvm-arm64-allow-smccc_arch_workaround_3-to-be-discovered-and-migrated.patch queue-5.16/arm64-spectre-rename-spectre_v4_patch_fw_mitigation_conduit.patch queue-5.16/arm64-entry-move-trampoline-macros-out-of-ifdef-d-section.patch queue-5.16/arm64-entry-allow-tramp_alias-to-access-symbols-after-the-4k-boundary.patch queue-5.16/arm64-entry-move-the-trampoline-data-page-before-the-text-page.patch queue-5.16/arm64-entry.s-add-ventry-overflow-sanity-checks.patch queue-5.16/arm64-entry-add-vectors-that-have-the-bhb-mitigation-sequences.patch queue-5.16/arm64-mitigate-spectre-style-branch-history-side-channels.patch queue-5.16/arm64-entry-allow-the-trampoline-text-to-occupy-multiple-pages.patch queue-5.16/arm64-proton-pack-report-spectre-bhb-vulnerabilities-as-part-of-spectre-v2.patch queue-5.16/kvm-arm64-allow-indirect-vectors-to-be-used-without-spectre_v3a.patch queue-5.16/arm64-entry-make-the-kpti-trampoline-s-kpti-sequence-optional.patch
