Skip to contentSkip to conversation

FAILED: patch "[PATCH] arm64: hw_breakpoint: fix watchpoint matching for tagged" failed to apply to 4.4-stable tree

PATCH [email protected] 1 participant 1 message May 23, 2017

Subsystems (3)
Stable branch arm64 Arm PMU profiling and debugging
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

Quoted 1 line

From 7dcd9dd8cebe9fa626af7e2358d03a37041a70fb Mon Sep 17 00:00:00 2001

From: Kristina Martsenko <[email protected]>
Date: Wed, 3 May 2017 16:37:46 +0100
Subject: [PATCH] arm64: hw_breakpoint: fix watchpoint matching for tagged
pointers

When we take a watchpoint exception, the address that triggered the watchpoint is found in FAR_EL1. We compare it to the address of each configured watchpoint to see which one was hit.

The configured watchpoint addresses are untagged, while the address in FAR_EL1 will have an address tag if the data access was done using a tagged address. The tag needs to be removed to compare the address to the watchpoints.

Currently we don't remove it, and as a result can report the wrong watchpoint as being hit (specifically, always either the highest TTBR0 watchpoint or lowest TTBR1 watchpoint). This patch removes the tag.

Fixes d50240a5f6ce ("arm64: mm: permit use of tagged pointers at EL0")
Cc <[email protected]> # 3.12.x-
Acked-by Mark Rutland <[email protected]>
Acked-by Will Deacon <[email protected]>
Signed-off-by Kristina Martsenko <[email protected]>
Signed-off-by Catalin Marinas <[email protected]>
arch/arm64/include/asm/uaccess.h +3 -3
index 5308d696311b..0221029e27ff 100644
@@ -106,9 +106,9 @@ static inline void set_fs(mm_segment_t fs)
 })
 
 /*
- * When dealing with data aborts or instruction traps we may end up with
- * a tagged userland pointer. Clear the tag to get a sane pointer to pass
- * on to access_ok(), for instance.
+ * When dealing with data aborts, watchpoints, or instruction traps we may end
+ * up with a tagged userland pointer. Clear the tag to get a sane pointer to
+ * pass on to access_ok(), for instance.
  */
 #define untagged_addr(addr)		sign_extend64(addr, 55)
arch/arm64/kernel/hw_breakpoint.c +3 -0
index 0296e7924240..749f81779420 100644
@@ -36,6 +36,7 @@
 #include <asm/traps.h>
 #include <asm/cputype.h>
 #include <asm/system_misc.h>
+#include <asm/uaccess.h>
 
 /* Breakpoint currently in use for each BRP. */
 static DEFINE_PER_CPU(struct perf_event *, bp_on_reg[ARM_MAX_BRP]);

@@ -721,6 +722,8 @@ static u64 get_distance_from_watchpoint(unsigned long addr, u64 val,
 	u64 wp_low, wp_high;
 	u32 lens, lene;
 
+	addr = untagged_addr(addr);
+
 	lens = __ffs(ctrl->len);
 	lene = __fls(ctrl->len);