Message ID | 1398627854-9617-2-git-send-email-larry.bassel@linaro.org |
---|---|
State | New |
Headers | show |
On Sun, Apr 27, 2014 at 08:44:12PM +0100, Larry Bassel wrote: > diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S > index 39ac630..eda7755 100644 > --- a/arch/arm64/kernel/entry.S > +++ b/arch/arm64/kernel/entry.S [...] > @@ -421,28 +421,30 @@ el0_da: > /* > * Data abort handling > */ > - mrs x0, far_el1 > - bic x0, x0, #(0xff << 56) > disable_step x1 > isb > enable_dbg > // enable interrupts before calling the main handler > enable_irq > + mrs x0, far_el1 > + bic x0, x0, #(0xff << 56) > mov x1, x25 > mov x2, sp > + adr lr, ret_from_exception > b do_mem_abort Reading the far_el1 after enable_dbg and enable_irq is racy, we can no longer guarantee its value in the original data abort context. > el0_ia: > /* > * Instruction abort handling > */ > - mrs x0, far_el1 > disable_step x1 > isb > enable_dbg > // enable interrupts before calling the main handler > enable_irq > + mrs x0, far_el1 > orr x1, x25, #1 << 24 // use reserved ISS bit for instruction aborts > mov x2, sp > + adr lr, ret_from_exception > b do_mem_abort > el0_fpsimd_acc: Same here.
[+ Mark R. since we looked at this together a little at ELC] Catalin Marinas <catalin.marinas@arm.com> writes: > On Sun, Apr 27, 2014 at 08:44:12PM +0100, Larry Bassel wrote: >> diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S >> index 39ac630..eda7755 100644 >> --- a/arch/arm64/kernel/entry.S >> +++ b/arch/arm64/kernel/entry.S > [...] >> @@ -421,28 +421,30 @@ el0_da: >> /* >> * Data abort handling >> */ >> - mrs x0, far_el1 >> - bic x0, x0, #(0xff << 56) >> disable_step x1 >> isb >> enable_dbg >> // enable interrupts before calling the main handler >> enable_irq >> + mrs x0, far_el1 >> + bic x0, x0, #(0xff << 56) >> mov x1, x25 >> mov x2, sp >> b do_mem_abort > > Reading the far_el1 after enable_dbg and enable_irq is racy, we can no > longer guarantee its value in the original data abort context. Catalin, can you confirm x26 would be a safe place to stash far_el1 and then restore it after ct_user_exit. Something like this (which seems to work for me): el0_da: /* * Data abort handling */ mrs x26, far_el1 disable_step x1 isb enable_dbg // enable interrupts before calling the main handler enable_irq ct_user_exit mov x0, x26 bic x0, x0, #(0xff << 56) mov x1, x25 mov x2, sp adr lr, ret_from_exception b do_mem_abort Kevin -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S index 39ac630..eda7755 100644 --- a/arch/arm64/kernel/entry.S +++ b/arch/arm64/kernel/entry.S @@ -349,11 +349,11 @@ el0_sync: lsr x24, x25, #ESR_EL1_EC_SHIFT // exception class cmp x24, #ESR_EL1_EC_SVC64 // SVC in 64-bit state b.eq el0_svc - adr lr, ret_from_exception cmp x24, #ESR_EL1_EC_DABT_EL0 // data abort in EL0 b.eq el0_da cmp x24, #ESR_EL1_EC_IABT_EL0 // instruction abort in EL0 b.eq el0_ia + adr lr, ret_from_exception cmp x24, #ESR_EL1_EC_FP_ASIMD // FP/ASIMD access b.eq el0_fpsimd_acc cmp x24, #ESR_EL1_EC_FP_EXC64 // FP/ASIMD exception @@ -378,11 +378,11 @@ el0_sync_compat: lsr x24, x25, #ESR_EL1_EC_SHIFT // exception class cmp x24, #ESR_EL1_EC_SVC32 // SVC in 32-bit state b.eq el0_svc_compat - adr lr, ret_from_exception cmp x24, #ESR_EL1_EC_DABT_EL0 // data abort in EL0 b.eq el0_da cmp x24, #ESR_EL1_EC_IABT_EL0 // instruction abort in EL0 b.eq el0_ia + adr lr, ret_from_exception cmp x24, #ESR_EL1_EC_FP_ASIMD // FP/ASIMD access b.eq el0_fpsimd_acc cmp x24, #ESR_EL1_EC_FP_EXC32 // FP/ASIMD exception @@ -421,28 +421,30 @@ el0_da: /* * Data abort handling */ - mrs x0, far_el1 - bic x0, x0, #(0xff << 56) disable_step x1 isb enable_dbg // enable interrupts before calling the main handler enable_irq + mrs x0, far_el1 + bic x0, x0, #(0xff << 56) mov x1, x25 mov x2, sp + adr lr, ret_from_exception b do_mem_abort el0_ia: /* * Instruction abort handling */ - mrs x0, far_el1 disable_step x1 isb enable_dbg // enable interrupts before calling the main handler enable_irq + mrs x0, far_el1 orr x1, x25, #1 << 24 // use reserved ISS bit for instruction aborts mov x2, sp + adr lr, ret_from_exception b do_mem_abort el0_fpsimd_acc: /*