Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d5e57437 authored by Ard Biesheuvel's avatar Ard Biesheuvel Committed by Catalin Marinas
Browse files

arm64: kaslr: use callee saved register to preserve SCTLR across C call 



The KASLR code incorrectly expects the contents of x18 to be preserved
across a call into C code, and uses it to stash the contents of SCTLR_EL1
before enabling the MMU. If the MMU needs to be disabled again to create
the randomized kernel mapping, x18 is written back to SCTLR_EL1, which is
likely to crash the system if x18 has been clobbered by kasan_early_init()
or kaslr_early_init(). So use x22 instead, which is not in use so far in
head.S

Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
parent f09f1bac

arch/arm64/kernel/head.S

+2 −2
Original line number Diff line number Diff line
@@ -732,7 +732,7 @@ ENTRY(__early_cpu_boot_status) 
 */

	.section	".idmap.text", "ax"

__enable_mmu:

	mrs	x18, sctlr_el1			// preserve old SCTLR_EL1 value

	mrs	x22, sctlr_el1			// preserve old SCTLR_EL1 value

	mrs	x1, ID_AA64MMFR0_EL1

	ubfx	x2, x1, #ID_AA64MMFR0_TGRAN_SHIFT, 4

	cmp	x2, #ID_AA64MMFR0_TGRAN_SUPPORTED
@@ -760,7 +760,7 @@ __enable_mmu: 
	 * to take into account by discarding the current kernel mapping and

	 * creating a new one.

	 */

	msr	sctlr_el1, x18			// disable the MMU

	msr	sctlr_el1, x22			// disable the MMU

	isb

	bl	__create_page_tables		// recreate kernel mapping