• Mark Rutland's avatar
    arm64: split EL0/EL1 UNDEF handlers · 61d64a37
    Mark Rutland authored
    In general, exceptions taken from EL1 need to be handled separately from
    exceptions taken from EL0, as the logic to handle the two cases can be
    significantly divergent, and exceptions taken from EL1 typically have
    more stringent requirements on locking and instrumentation.
    
    Subsequent patches will rework the way EL1 UNDEFs are handled in order
    to address longstanding soundness issues with instrumentation and RCU.
    In preparation for that rework, this patch splits the existing
    do_undefinstr() handler into separate do_el0_undef() and do_el1_undef()
    handlers.
    
    Prior to this patch, do_undefinstr() was marked with NOKPROBE_SYMBOL(),
    preventing instrumentation via kprobes. However, do_undefinstr() invokes
    other code which can be instrumented, and:
    
    * For UNDEFINED exceptions taken from EL0, there is no risk of recursion
      within kprobes. Therefore it is safe for do_el0_undef to be
      instrumented with kprobes, and it does not need to be marked with
      NOKPROBE_SYMBOL().
    
    * For UNDEFINED exceptions taken from EL1, either:
    
      (a) The exception is has been taken when manipulating SSBS; these cases
          are limited and do not occur within code that can be invoked
          recursively via kprobes. Hence, in these cases instrumentation
          with kprobes is benign.
    
      (b) The exception has been taken for an unknown reason, as other than
          manipulating SSBS we do not expect to take UNDEFINED exceptions
          from EL1. Any handling of these exception is best-effort.
    
      ... and in either case, marking do_el1_undef() with NOKPROBE_SYMBOL()
      isn't sufficient to prevent recursion via kprobes as functions it
      calls (including die()) are instrumentable via kprobes.
    
      Hence, it's not worthwhile to mark do_el1_undef() with
      NOKPROBE_SYMBOL(). The same applies to do_el1_bti() and do_el1_fpac(),
      so their NOKPROBE_SYMBOL() annotations are also removed.
    
    Aside from the new instrumentability, there should be no functional
    change as a result of this patch.
    Signed-off-by: default avatarMark Rutland <mark.rutland@arm.com>
    Cc: Catalin Marinas <catalin.marinas@arm.com>
    Cc: James Morse <james.morse@arm.com>
    Cc: Joey Gouly <joey.gouly@arm.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Will Deacon <will@kernel.org>
    Link: https://lore.kernel.org/r/20221019144123.612388-3-mark.rutland@arm.comSigned-off-by: default avatarWill Deacon <will@kernel.org>
    61d64a37
exception.h 3.18 KB