From: James Morse <james.morse@xxxxxxx> commit 03aff3a77a58b5b52a77e00537a42090ad57b80b upstream. Kpti stashes x30 in far_el1 while it uses x30 for all its work. Making the vectors a per-cpu data structure will require a second register. Allow tramp_exit two registers before it unmaps the kernel, by leaving x30 on the stack, and stashing x29 in far_el1. Reviewed-by: Russell King (Oracle) <rmk+kernel@xxxxxxxxxxxxxxx> Reviewed-by: Catalin Marinas <catalin.marinas@xxxxxxx> Signed-off-by: James Morse <james.morse@xxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/arm64/kernel/entry.S | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) --- a/arch/arm64/kernel/entry.S +++ b/arch/arm64/kernel/entry.S @@ -348,18 +348,20 @@ alternative_else_nop_endif ldp x24, x25, [sp, #16 * 12] ldp x26, x27, [sp, #16 * 13] ldp x28, x29, [sp, #16 * 14] - ldr lr, [sp, #S_LR] - add sp, sp, #S_FRAME_SIZE // restore sp /* * ARCH_HAS_MEMBARRIER_SYNC_CORE rely on eret context synchronization * when returning from IPI handler, and when returning to user-space. */ .if \el == 0 -alternative_insn eret, nop, ARM64_UNMAP_KERNEL_AT_EL0 +alternative_if_not ARM64_UNMAP_KERNEL_AT_EL0 + ldr lr, [sp, #S_LR] + add sp, sp, #S_FRAME_SIZE // restore sp + eret +alternative_else_nop_endif #ifdef CONFIG_UNMAP_KERNEL_AT_EL0 bne 4f - msr far_el1, x30 + msr far_el1, x29 tramp_alias x30, tramp_exit_native br x30 4: @@ -367,6 +369,8 @@ alternative_insn eret, nop, ARM64_UNMAP_ br x30 #endif .else + ldr lr, [sp, #S_LR] + add sp, sp, #S_FRAME_SIZE // restore sp eret .endif .endm @@ -996,10 +1000,12 @@ alternative_insn isb, nop, ARM64_WORKARO .macro tramp_exit, regsize = 64 adr x30, tramp_vectors msr vbar_el1, x30 - tramp_unmap_kernel x30 + ldr lr, [sp, #S_LR] + tramp_unmap_kernel x29 .if \regsize == 64 - mrs x30, far_el1 + mrs x29, far_el1 .endif + add sp, sp, #S_FRAME_SIZE // restore sp eret .endm Patches currently in stable-queue which might be from james.morse@xxxxxxx are queue-4.19/arm64-entry-add-macro-for-reading-symbol-addresses-from-the-trampoline.patch queue-4.19/arm64-use-the-clearbhb-instruction-in-mitigations.patch queue-4.19/arm64-add-percpu-vectors-for-el1.patch queue-4.19/arm64-entry-free-up-another-register-on-kpti-s-tramp_exit-path.patch queue-4.19/arm64-entry-don-t-assume-tramp_vectors-is-the-start-of-the-vectors.patch queue-4.19/arm64-entry-make-the-trampoline-cleanup-optional.patch queue-4.19/kvm-arm64-add-templates-for-bhb-mitigation-sequences.patch queue-4.19/arm64-entry-add-non-kpti-__bp_harden_el1_vectors-for-mitigations.patch queue-4.19/arm64-add-id_aa64isar2_el1-sys-register.patch queue-4.19/kvm-arm64-allow-smccc_arch_workaround_3-to-be-discovered-and-migrated.patch queue-4.19/arm64-add-neoverse-n2-cortex-a710-cpu-part-definition.patch queue-4.19/arm64-entry-move-trampoline-macros-out-of-ifdef-d-section.patch queue-4.19/arm64-entry-allow-tramp_alias-to-access-symbols-after-the-4k-boundary.patch queue-4.19/arm64-add-part-number-for-arm-cortex-a77.patch queue-4.19/arm64-entry-move-the-trampoline-data-page-before-the-text-page.patch queue-4.19/arm64-entry.s-add-ventry-overflow-sanity-checks.patch queue-4.19/arm64-entry-add-vectors-that-have-the-bhb-mitigation-sequences.patch queue-4.19/arm64-mitigate-spectre-style-branch-history-side-channels.patch queue-4.19/arm64-entry-allow-the-trampoline-text-to-occupy-multiple-pages.patch queue-4.19/arm64-proton-pack-report-spectre-bhb-vulnerabilities-as-part-of-spectre-v2.patch queue-4.19/arm64-add-cortex-x2-cpu-part-definition.patch queue-4.19/arm64-entry-make-the-kpti-trampoline-s-kpti-sequence-optional.patch
