From: James Morse <james.morse@xxxxxxx> commit b28a8eebe81c186fdb1a0078263b30576c8e1f42 upstream. The trampoline code needs to use the address of symbols in the wider kernel, e.g. vectors. PC-relative addressing wouldn't work as the trampoline code doesn't run at the address the linker expected. tramp_ventry uses a literal pool, unless CONFIG_RANDOMIZE_BASE is set, in which case it uses the data page as a literal pool because the data page can be unmapped when running in user-space, which is required for CPUs vulnerable to meltdown. Pull this logic out as a macro, instead of adding a third copy of it. Reviewed-by: Catalin Marinas <catalin.marinas@xxxxxxx> [ Removed SDEI for stable backport ] Signed-off-by: James Morse <james.morse@xxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/arm64/kernel/entry.S | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) --- a/arch/arm64/kernel/entry.S +++ b/arch/arm64/kernel/entry.S @@ -1022,6 +1022,15 @@ alternative_else_nop_endif sub \dst, \dst, PAGE_SIZE .endm + .macro tramp_data_read_var dst, var +#ifdef CONFIG_RANDOMIZE_BASE + tramp_data_page \dst + add \dst, \dst, #:lo12:__entry_tramp_data_\var + ldr \dst, [\dst] +#else + ldr \dst, =\var +#endif + .endm #define BHB_MITIGATION_NONE 0 #define BHB_MITIGATION_LOOP 1 @@ -1052,13 +1061,8 @@ alternative_else_nop_endif b . 2: tramp_map_kernel x30 -#ifdef CONFIG_RANDOMIZE_BASE - tramp_data_page x30 alternative_insn isb, nop, ARM64_WORKAROUND_QCOM_FALKOR_E1003 - ldr x30, [x30] -#else - ldr x30, =vectors -#endif + tramp_data_read_var x30, vectors prfm plil1strm, [x30, #(1b - \vector_start)] msr vbar_el1, x30 isb @@ -1138,7 +1142,12 @@ END(tramp_exit_compat) .align PAGE_SHIFT .globl __entry_tramp_data_start __entry_tramp_data_start: +__entry_tramp_data_vectors: .quad vectors +#ifdef CONFIG_ARM_SDE_INTERFACE +__entry_tramp_data___sdei_asm_trampoline_next_handler: + .quad __sdei_asm_handler +#endif /* CONFIG_ARM_SDE_INTERFACE */ .popsection // .rodata #endif /* CONFIG_RANDOMIZE_BASE */ #endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */ Patches currently in stable-queue which might be from james.morse@xxxxxxx are queue-4.14/arm64-entry-add-macro-for-reading-symbol-addresses-from-the-trampoline.patch queue-4.14/arm64-use-the-clearbhb-instruction-in-mitigations.patch queue-4.14/arm64-add-percpu-vectors-for-el1.patch queue-4.14/arm64-arch_timer-add-workaround-for-arm-erratum-1188873.patch queue-4.14/arm64-entry-free-up-another-register-on-kpti-s-tramp_exit-path.patch queue-4.14/arm64-entry-don-t-assume-tramp_vectors-is-the-start-of-the-vectors.patch queue-4.14/arm64-entry-make-the-trampoline-cleanup-optional.patch queue-4.14/arm64-add-silicon-errata.txt-entry-for-arm-erratum-1188873.patch queue-4.14/kvm-arm64-add-templates-for-bhb-mitigation-sequences.patch queue-4.14/arm64-entry-add-non-kpti-__bp_harden_el1_vectors-for-mitigations.patch queue-4.14/arm64-add-id_aa64isar2_el1-sys-register.patch queue-4.14/kvm-arm64-allow-smccc_arch_workaround_3-to-be-discovered-and-migrated.patch queue-4.14/arm64-add-neoverse-n2-cortex-a710-cpu-part-definition.patch queue-4.14/arm64-arch_timer-avoid-unused-function-warning.patch queue-4.14/arm64-entry-move-trampoline-macros-out-of-ifdef-d-section.patch queue-4.14/arm64-entry-allow-tramp_alias-to-access-symbols-after-the-4k-boundary.patch queue-4.14/arm64-add-part-number-for-arm-cortex-a77.patch queue-4.14/arm64-entry-move-the-trampoline-data-page-before-the-text-page.patch queue-4.14/arm64-entry.s-add-ventry-overflow-sanity-checks.patch queue-4.14/arm64-add-part-number-for-neoverse-n1.patch queue-4.14/arm64-entry-add-vectors-that-have-the-bhb-mitigation-sequences.patch queue-4.14/arm64-make-arm64_erratum_1188873-depend-on-compat.patch queue-4.14/arm64-mitigate-spectre-style-branch-history-side-channels.patch queue-4.14/arm64-entry-allow-the-trampoline-text-to-occupy-multiple-pages.patch queue-4.14/arm64-proton-pack-report-spectre-bhb-vulnerabilities-as-part-of-spectre-v2.patch queue-4.14/arm64-add-cortex-x2-cpu-part-definition.patch queue-4.14/arm64-entry-make-the-kpti-trampoline-s-kpti-sequence-optional.patch