From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Joey Gouly <joey.gouly@arm.com>,
Mark Rutland <mark.rutland@arm.com>,
Catalin Marinas <catalin.marinas@arm.com>,
Will Deacon <will@kernel.org>, Sasha Levin <sashal@kernel.org>,
ardb@kernel.org, tabba@google.com,
linux-arm-kernel@lists.infradead.org
Subject: [PATCH AUTOSEL 5.10 18/30] arm64: alternatives: mark patch_alternative() as `noinstr`
Date: Mon, 11 Apr 2022 20:48:52 -0400 [thread overview]
Message-ID: <20220412004906.350678-18-sashal@kernel.org> (raw)
In-Reply-To: <20220412004906.350678-1-sashal@kernel.org>
From: Joey Gouly <joey.gouly@arm.com>
[ Upstream commit a2c0b0fbe01419f8f5d1c0b9c581631f34ffce8b ]
The alternatives code must be `noinstr` such that it does not patch itself,
as the cache invalidation is only performed after all the alternatives have
been applied.
Mark patch_alternative() as `noinstr`. Mark branch_insn_requires_update()
and get_alt_insn() with `__always_inline` since they are both only called
through patch_alternative().
Booting a kernel in QEMU TCG with KCSAN=y and ARM64_USE_LSE_ATOMICS=y caused
a boot hang:
[ 0.241121] CPU: All CPU(s) started at EL2
The alternatives code was patching the atomics in __tsan_read4() from LL/SC
atomics to LSE atomics.
The following fragment is using LL/SC atomics in the .text section:
| <__tsan_unaligned_read4+304>: ldxr x6, [x2]
| <__tsan_unaligned_read4+308>: add x6, x6, x5
| <__tsan_unaligned_read4+312>: stxr w7, x6, [x2]
| <__tsan_unaligned_read4+316>: cbnz w7, <__tsan_unaligned_read4+304>
This LL/SC atomic sequence was to be replaced with LSE atomics. However since
the alternatives code was instrumentable, __tsan_read4() was being called after
only the first instruction was replaced, which led to the following code in memory:
| <__tsan_unaligned_read4+304>: ldadd x5, x6, [x2]
| <__tsan_unaligned_read4+308>: add x6, x6, x5
| <__tsan_unaligned_read4+312>: stxr w7, x6, [x2]
| <__tsan_unaligned_read4+316>: cbnz w7, <__tsan_unaligned_read4+304>
This caused an infinite loop as the `stxr` instruction never completed successfully,
so `w7` was always 0.
Signed-off-by: Joey Gouly <joey.gouly@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20220405104733.11476-1-joey.gouly@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kernel/alternative.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/kernel/alternative.c b/arch/arm64/kernel/alternative.c
index 73039949b5ce..5f8e4c2df53c 100644
--- a/arch/arm64/kernel/alternative.c
+++ b/arch/arm64/kernel/alternative.c
@@ -41,7 +41,7 @@ bool alternative_is_applied(u16 cpufeature)
/*
* Check if the target PC is within an alternative block.
*/
-static bool branch_insn_requires_update(struct alt_instr *alt, unsigned long pc)
+static __always_inline bool branch_insn_requires_update(struct alt_instr *alt, unsigned long pc)
{
unsigned long replptr = (unsigned long)ALT_REPL_PTR(alt);
return !(pc >= replptr && pc <= (replptr + alt->alt_len));
@@ -49,7 +49,7 @@ static bool branch_insn_requires_update(struct alt_instr *alt, unsigned long pc)
#define align_down(x, a) ((unsigned long)(x) & ~(((unsigned long)(a)) - 1))
-static u32 get_alt_insn(struct alt_instr *alt, __le32 *insnptr, __le32 *altinsnptr)
+static __always_inline u32 get_alt_insn(struct alt_instr *alt, __le32 *insnptr, __le32 *altinsnptr)
{
u32 insn;
@@ -94,7 +94,7 @@ static u32 get_alt_insn(struct alt_instr *alt, __le32 *insnptr, __le32 *altinsnp
return insn;
}
-static void patch_alternative(struct alt_instr *alt,
+static noinstr void patch_alternative(struct alt_instr *alt,
__le32 *origptr, __le32 *updptr, int nr_inst)
{
__le32 *replptr;
--
2.35.1
next prev parent reply other threads:[~2022-04-12 1:02 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-12 0:48 [PATCH AUTOSEL 5.10 01/30] drm/amd: Add USBC connector ID Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 02/30] btrfs: fix fallocate to use file_modified to update permissions consistently Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 03/30] btrfs: do not warn for free space inode in cow_file_range Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 04/30] drm/amd/display: fix audio format not updated after edid updated Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 05/30] drm/amd/display: FEC check in timing validation Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 06/30] drm/amd/display: Update VTEM Infopacket definition Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 07/30] drm/amdkfd: Fix Incorrect VMIDs passed to HWS Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 08/30] drm/amdgpu/vcn: improve vcn dpg stop procedure Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 09/30] drm/amdkfd: Check for potential null return of kmalloc_array() Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 10/30] Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 11/30] scsi: target: tcmu: Fix possible page UAF Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 12/30] scsi: lpfc: Fix queue failures when recovering from PCI parity error Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 13/30] scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024 Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 14/30] net: micrel: fix KS8851_MLL Kconfig Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 15/30] ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 16/30] gpu: ipu-v3: Fix dev_dbg frequency output Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 17/30] regulator: wm8994: Add an off-on delay for WM8994 variant Sasha Levin
2022-04-12 0:48 ` Sasha Levin [this message]
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 19/30] tlb: hugetlb: Add more sizes to tlb_remove_huge_tlb_entry Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 20/30] net: axienet: setup mdio unconditionally Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 21/30] net: usb: aqc111: Fix out-of-bounds accesses in RX fixup Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 22/30] myri10ge: fix an incorrect free for skb in myri10ge_sw_tso Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 23/30] drm/amd/display: Revert FEC check in validation Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 24/30] drm/amd/display: Fix allocate_mst_payload assert on resume Sasha Levin
2022-04-12 0:48 ` [PATCH AUTOSEL 5.10 25/30] powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit Sasha Levin
2022-04-12 0:49 ` [PATCH AUTOSEL 5.10 26/30] scsi: mvsas: Add PCI ID of RocketRaid 2640 Sasha Levin
2022-04-12 0:49 ` [PATCH AUTOSEL 5.10 27/30] scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan Sasha Levin
2022-04-12 0:49 ` [PATCH AUTOSEL 5.10 28/30] drivers: net: slip: fix NPD bug in sl_tx_timeout() Sasha Levin
2022-04-12 0:49 ` [PATCH AUTOSEL 5.10 29/30] arm64: Add part number for Arm Cortex-A78AE Sasha Levin
2022-04-12 0:49 ` [PATCH AUTOSEL 5.10 30/30] perf/imx_ddr: Fix undefined behavior due to shift overflowing the constant Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220412004906.350678-18-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=ardb@kernel.org \
--cc=catalin.marinas@arm.com \
--cc=joey.gouly@arm.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=stable@vger.kernel.org \
--cc=tabba@google.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).