Patch "arm64: swp emulation: bound LL/SC retries before rescheduling" has been added to the 4.8-stable tree
Subsystems (2)
This is a note to let you know that I've just added the patch titled
arm64: swp emulation: bound LL/SC retries before rescheduling
to the 4.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
arm64-swp-emulation-bound-ll-sc-retries-before-rescheduling.patch
and it can be found in the queue-4.8 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From
1c5b51dfb7b4564008e0cadec5381a69e88b0d21Mon Sep 17 00:00:00 2001
From: Will Deacon <[email protected]>
Date: Mon, 4 Jul 2016 16:59:43 +0100
Subject: arm64: swp emulation: bound LL/SC retries before rescheduling
From: Will Deacon <[email protected]>
commit 1c5b51dfb7b4564008e0cadec5381a69e88b0d21 upstream.
If a CPU does not implement a global monitor for certain memory types, then userspace can attempt a kernel DoS by issuing SWP instructions targetting the problematic memory (for example, a framebuffer mapped with non-cacheable attributes).
The SWP emulation code protects against these sorts of attacks by checking for pending signals and potentially rescheduling when the STXR instruction fails during the emulation. Whilst this is good for avoiding livelock, it harms emulation of legitimate SWP instructions on CPUs where forward progress is not guaranteed if there are memory accesses to the same reservation granule (up to 2k) between the failing STXR and the retry of the LDXR.
This patch solves the problem by retrying the STXR a bounded number of times (4) before breaking out of the LL/SC loop and looking for something else to do.
--- arch/arm64/kernel/armv8_deprecated.c | 36 +++++++++++++++++++++-------------- 1 file changed, 22 insertions(+), 14 deletions(-)
arch/arm64/kernel/armv8_deprecated.c +22 -14
@@ -280,35 +280,43 @@ static void __init register_insn_emulati/* * Error-checking SWP macros implemented using ldxr{b}/stxr{b} */ -#define __user_swpX_asm (data, addr, res, temp,B ) \ + +/* Arbitrary constant to ensure forward-progress of the LL/SC loop */ +#define __SWP_LL_SC_LOOPS 4 + +#define __user_swpX_asm (data, addr, res, temp, temp2,B ) \ __asm__ __volatile__( \ + " mov %w3, %w7\n" \ ALTERNATIVE("nop", SET_PSTATE_PAN(0), ARM64_HAS_PAN, \ CONFIG_ARM64_PAN) \ - "0: ldxr"B" %w2, [%3]\n" \ - "1: stxr"B" %w0, %w1, [%3]\n" \ + "0: ldxr"B" %w2, [%4]\n" \ + "1: stxr"B" %w0, %w1, [%4]\n" \ " cbz %w0, 2f\n" \ - " mov %w0, %w4\n" \ + " sub %w3, %w3, #1\n" \ + " cbnz %w3, 0b\n" \ + " mov %w0, %w5\n" \ " b 3f\n" \ "2:\n" \ " mov %w1, %w2\n" \ "3:\n" \ " .pushsection .fixup,\"ax\"\n" \ " .align 2\n" \ - "4: mov %w0, %w5\n" \ + "4: mov %w0, %w6\n" \ " b 3b\n" \ " .popsection" \ _ASM_EXTABLE(0b, 4b) \ _ASM_EXTABLE(1b, 4b) \ ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN, \ CONFIG_ARM64_PAN) \ - : "=&r" (res), "+r" (data), "=&r" (temp) \ - : "r" (addr), "i" (-EAGAIN), "i" (-EFAULT) \ + : "=&r" (res), "+r" (data), "=&r" (temp), "=&r" (temp2) \ + : "r" (addr), "i" (-EAGAIN), "i" (-EFAULT), \ + "i" (__SWP_LL_SC_LOOPS) \ : "memory") -#define __user_swp_asm (data, addr, res, temp) \ - __user_swpX_asm(data, addr, res, temp, "") -#define __user_swpb_asm (data, addr, res, temp) \ - __user_swpX_asm(data, addr, res, temp, "b") +#define __user_swp_asm (data, addr, res, temp, temp2) \ + __user_swpX_asm(data, addr, res, temp, temp2, "") +#define __user_swpb_asm (data, addr, res, temp, temp2) \ + __user_swpX_asm(data, addr, res, temp, temp2, "b")/* * Bit 22 of the instruction encoding distinguishes between
@@ -328,12 +336,12 @@ static int emulate_swpX(unsigned int add }while (1 ) { -unsigned long temp; +unsigned long temp, temp2;if (type ==TYPE_SWPB ) -__user_swpb_asm (*data, address, res, temp); +__user_swpb_asm (*data, address, res, temp, temp2);else -__user_swp_asm (*data, address, res, temp); +__user_swp_asm (*data, address, res, temp, temp2);if (likely (res != -EAGAIN ) ||signal_pending (current))break ;
Patches currently in stable-queue which might be from [email protected] are
queue-4.8/arm64-swp-emulation-bound-ll-sc-retries-before-rescheduling.patch queue-4.8/arm64-kaslr-fix-breakage-with-config_modversions-y.patch queue-4.8/arm64-cortex-a53-errata-workaround-check-for-kernel-addresses.patch queue-4.8/arm64-kernel-init-mdcr_el2-even-in-the-absence-of-a-pmu.patch queue-4.8/arm64-kvm-take-s1-walks-into-account-when-determining-s2-write-faults.patch queue-4.8/arm64-percpu-rewrite-ll-sc-loops-in-assembly.patch