From: James Morse <james.morse@xxxxxxx> commit 03aff3a77a58b5b52a77e00537a42090ad57b80b upstream. Kpti stashes x30 in far_el1 while it uses x30 for all its work. Making the vectors a per-cpu data structure will require a second register. Allow tramp_exit two registers before it unmaps the kernel, by leaving x30 on the stack, and stashing x29 in far_el1. Reviewed-by: Russell King (Oracle) <rmk+kernel@xxxxxxxxxxxxxxx> Reviewed-by: Catalin Marinas <catalin.marinas@xxxxxxx> Signed-off-by: James Morse <james.morse@xxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/arm64/kernel/entry.S | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) --- a/arch/arm64/kernel/entry.S +++ b/arch/arm64/kernel/entry.S @@ -244,14 +244,16 @@ alternative_else_nop_endif ldp x24, x25, [sp, #16 * 12] ldp x26, x27, [sp, #16 * 13] ldp x28, x29, [sp, #16 * 14] - ldr lr, [sp, #S_LR] - add sp, sp, #S_FRAME_SIZE // restore sp .if \el == 0 -alternative_insn eret, nop, ARM64_UNMAP_KERNEL_AT_EL0 +alternative_if_not ARM64_UNMAP_KERNEL_AT_EL0 + ldr lr, [sp, #S_LR] + add sp, sp, #S_FRAME_SIZE // restore sp + eret +alternative_else_nop_endif #ifdef CONFIG_UNMAP_KERNEL_AT_EL0 bne 4f - msr far_el1, x30 + msr far_el1, x29 tramp_alias x30, tramp_exit_native br x30 4: @@ -259,6 +261,8 @@ alternative_insn eret, nop, ARM64_UNMAP_ br x30 #endif .else + ldr lr, [sp, #S_LR] + add sp, sp, #S_FRAME_SIZE // restore sp eret .endif .endm @@ -947,10 +951,12 @@ __ni_sys_trace: .macro tramp_exit, regsize = 64 adr x30, tramp_vectors msr vbar_el1, x30 - tramp_unmap_kernel x30 + ldr lr, [sp, #S_LR] + tramp_unmap_kernel x29 .if \regsize == 64 - mrs x30, far_el1 + mrs x29, far_el1 .endif + add sp, sp, #S_FRAME_SIZE // restore sp eret .endm Patches currently in stable-queue which might be from james.morse@xxxxxxx are queue-4.9/clocksource-drivers-arm_arch_timer-remove-fsl-a008585-parameter.patch queue-4.9/arm64-capabilities-clean-up-midr-range-helpers.patch queue-4.9/arm64-entry-add-macro-for-reading-symbol-addresses-from-the-trampoline.patch queue-4.9/arm64-use-the-clearbhb-instruction-in-mitigations.patch queue-4.9/arm64-add-percpu-vectors-for-el1.patch queue-4.9/arm64-arch_timer-add-workaround-for-arm-erratum-1188873.patch queue-4.9/arm64-capabilities-add-support-for-checks-based-on-a-list-of-midrs.patch queue-4.9/arm64-arch_timer-add-infrastructure-for-multiple-erratum-detection-methods.patch queue-4.9/arm64-entry-free-up-another-register-on-kpti-s-tramp_exit-path.patch queue-4.9/arm64-entry-don-t-assume-tramp_vectors-is-the-start-of-the-vectors.patch queue-4.9/arm64-entry-make-the-trampoline-cleanup-optional.patch queue-4.9/arm64-add-silicon-errata.txt-entry-for-arm-erratum-1188873.patch queue-4.9/clocksource-drivers-arm_arch_timer-introduce-generic-errata-handling-infrastructure.patch queue-4.9/kvm-arm64-add-templates-for-bhb-mitigation-sequences.patch queue-4.9/arm64-entry-add-non-kpti-__bp_harden_el1_vectors-for-mitigations.patch queue-4.9/arm64-add-id_aa64isar2_el1-sys-register.patch queue-4.9/kvm-arm64-allow-smccc_arch_workaround_3-to-be-discovered-and-migrated.patch queue-4.9/arm64-capabilities-update-prototype-for-enable-call-back.patch queue-4.9/arm64-add-neoverse-n2-cortex-a710-cpu-part-definition.patch queue-4.9/arm64-add-midr-encoding-for-arm-cortex-a55-and-cortex-a35.patch queue-4.9/arm64-capabilities-move-errata-processing-code.patch queue-4.9/arm64-arch_timer-add-erratum-handler-for-cpu-specific-capability.patch queue-4.9/arm64-errata-provide-macro-for-major-and-minor-cpu-revisions.patch queue-4.9/arm64-arch_timer-avoid-unused-function-warning.patch queue-4.9/arm64-capabilities-move-errata-work-around-check-on-boot-cpu.patch queue-4.9/arm64-add-helpers-for-checking-cpu-midr-against-a-range.patch queue-4.9/arm64-entry-move-trampoline-macros-out-of-ifdef-d-section.patch queue-4.9/arm64-entry-allow-tramp_alias-to-access-symbols-after-the-4k-boundary.patch queue-4.9/arm64-add-part-number-for-arm-cortex-a77.patch queue-4.9/arm64-capabilities-add-flags-to-handle-the-conflicts-on-late-cpu.patch queue-4.9/arm64-entry-move-the-trampoline-data-page-before-the-text-page.patch queue-4.9/arm64-entry.s-add-ventry-overflow-sanity-checks.patch queue-4.9/arm64-add-part-number-for-neoverse-n1.patch queue-4.9/arm64-entry-add-vectors-that-have-the-bhb-mitigation-sequences.patch queue-4.9/arm64-make-arm64_erratum_1188873-depend-on-compat.patch queue-4.9/arm64-mitigate-spectre-style-branch-history-side-channels.patch queue-4.9/arm64-move-arm64_update_smccc_conduit-out-of-ssbd-ifdef.patch queue-4.9/arm64-entry-allow-the-trampoline-text-to-occupy-multiple-pages.patch queue-4.9/arm64-add-cortex-x2-cpu-part-definition.patch queue-4.9/arm64-add-helper-to-decode-register-from-instruction.patch queue-4.9/arm64-capabilities-prepare-for-fine-grained-capabilities.patch queue-4.9/arm64-remove-useless-uao-ipi-and-describe-how-this-gets-enabled.patch queue-4.9/arm64-entry-make-the-kpti-trampoline-s-kpti-sequence-optional.patch
