提交 c13aede9 编写于 作者: J James Morse 提交者: Yongqiang Liu

arm64: entry: Don't assume tramp_vectors is the start of the vectors

stable inclusion
from stable-v4.19.236
commit af484e69b5e83095609d8b5c8abaf13a5460229e
category: bugfix
bugzilla: 186460, https://gitee.com/src-openeuler/kernel/issues/I53MHA
CVE: CVE-2022-23960

--------------------------------

commit ed50da77 upstream.

The tramp_ventry macro uses tramp_vectors as the address of the vectors
when calculating which ventry in the 'full fat' vectors to branch to.

While there is one set of tramp_vectors, this will be true.
Adding multiple sets of vectors will break this assumption.

Move the generation of the vectors to a macro, and pass the start
of the vectors as an argument to tramp_ventry.
Reviewed-by: NRussell King (Oracle) <rmk+kernel@armlinux.org.uk>
Reviewed-by: NCatalin Marinas <catalin.marinas@arm.com>
Signed-off-by: NJames Morse <james.morse@arm.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NChen Jiahao <chenjiahao16@huawei.com>
Reviewed-by: NHanjun Guo <guohanjun@huawei.com>
Reviewed-by: NLiao Chang <liaochang1@huawei.com>
Signed-off-by: NYongqiang Liu <liuyongqiang13@huawei.com>
上级 656f57bd
...@@ -1075,7 +1075,7 @@ alternative_else_nop_endif ...@@ -1075,7 +1075,7 @@ alternative_else_nop_endif
sub \dst, \dst, PAGE_SIZE sub \dst, \dst, PAGE_SIZE
.endm .endm
.macro tramp_ventry, regsize = 64 .macro tramp_ventry, vector_start, regsize
.align 7 .align 7
1: 1:
.if \regsize == 64 .if \regsize == 64
...@@ -1097,9 +1097,9 @@ alternative_insn isb, nop, ARM64_WORKAROUND_QCOM_FALKOR_E1003 ...@@ -1097,9 +1097,9 @@ alternative_insn isb, nop, ARM64_WORKAROUND_QCOM_FALKOR_E1003
#else #else
ldr x30, =vectors ldr x30, =vectors
#endif #endif
prfm plil1strm, [x30, #(1b - tramp_vectors)] prfm plil1strm, [x30, #(1b - \vector_start)]
msr vbar_el1, x30 msr vbar_el1, x30
add x30, x30, #(1b - tramp_vectors + 4) add x30, x30, #(1b - \vector_start + 4)
isb isb
ret ret
.org 1b + 128 // Did we overflow the ventry slot? .org 1b + 128 // Did we overflow the ventry slot?
...@@ -1117,19 +1117,21 @@ alternative_insn isb, nop, ARM64_WORKAROUND_QCOM_FALKOR_E1003 ...@@ -1117,19 +1117,21 @@ alternative_insn isb, nop, ARM64_WORKAROUND_QCOM_FALKOR_E1003
eret eret
.endm .endm
.align 11 .macro generate_tramp_vector
ENTRY(tramp_vectors) .Lvector_start\@:
.space 0x400 .space 0x400
tramp_ventry .rept 4
tramp_ventry tramp_ventry .Lvector_start\@, 64
tramp_ventry .endr
tramp_ventry .rept 4
tramp_ventry .Lvector_start\@, 32
.endr
.endm
tramp_ventry 32 .align 11
tramp_ventry 32 ENTRY(tramp_vectors)
tramp_ventry 32 generate_tramp_vector
tramp_ventry 32
END(tramp_vectors) END(tramp_vectors)
ENTRY(tramp_exit_native) ENTRY(tramp_exit_native)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册