Commit 19f07f6c authored Aug 04, 2015 by Will Deacon Committed by Sami Tolvanen Nov 22, 2016

UPSTREAM: arm64: mm: ensure patched kernel text is fetched from PoU



The arm64 booting document requires that the bootloader has cleaned the
kernel image to the PoC. However, when a CPU re-enters the kernel due to
either a CPU hotplug "on" event or resuming from a low-power state (e.g.
cpuidle), the kernel text may in-fact be dirty at the PoU due to things
like alternative patching or even module loading.

Thanks to I-cache speculation with the MMU off, stale instructions could
be fetched prior to enabling the MMU, potentially leading to crashes
when executing regions of code that have been modified at runtime.

This patch addresses the issue by ensuring that the local I-cache is
invalidated immediately after a CPU has enabled its MMU but before
jumping out of the identity mapping. Any stale instructions fetched from
the PoC will then be discarded and refetched correctly from the PoU.
Patching kernel text executed prior to the MMU being enabled is
prohibited, so the early entry code will always be clean.

Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

Bug: 31432001
Change-Id: I54cb48e91047592e3363600ce12af4431c74cbef
(cherry picked from commit 8ec41987436d566f7c4559c6871738b869f7ef07)
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>

parent ce6e6c84

arch/arm64/kernel/head.S

+8 −0

Original line number	Diff line number	Diff line
		@@ -661,6 +661,14 @@ ENDPROC(__enable_mmu)
		__turn_mmu_on:
		msr sctlr_el1, x0
		isb
		/*
		* Invalidate the local I-cache so that any instructions fetched
		* speculatively from the PoC are discarded, since they may have
		* been dynamically patched at the PoU.
		*/
		ic iallu
		dsb nsh
		isb
		br x27
		ENDPROC(__turn_mmu_on)

arch/arm64/kernel/sleep.S

+8 −0

Original line number	Diff line number	Diff line
		@@ -132,6 +132,14 @@ ENTRY(cpu_resume_mmu)
		ldr x3, =cpu_resume_after_mmu
		msr sctlr_el1, x0 // restore sctlr_el1
		isb
		/*
		* Invalidate the local I-cache so that any instructions fetched
		* speculatively from the PoC are discarded, since they may have
		* been dynamically patched at the PoU.
		*/
		ic iallu
		dsb nsh
		isb
		br x3 // global jump to virtual address
		ENDPROC(cpu_resume_mmu)
		cpu_resume_after_mmu:

arch/arm64/mm/proc.S

+0 −1

Original line number	Diff line number	Diff line
		@@ -191,7 +191,6 @@ ENDPROC(cpu_do_switch_mm)
		* value of the SCTLR_EL1 register.
		*/
		ENTRY(__cpu_setup)
		ic iallu // I+BTB cache invalidate
		tlbi vmalle1is // invalidate I + D TLBs
		dsb ish