Commit 62cffa49 authored by Ard Biesheuvel's avatar Ard Biesheuvel Committed by Will Deacon
Browse files

arm64/mm: Override PARange for !LPA2 and use it consistently 



When FEAT_LPA{,2} are not implemented, the ID_AA64MMFR0_EL1.PARange and
TCR.IPS values corresponding with 52-bit physical addressing are
reserved.

Setting the TCR.IPS field to 0b110 (52-bit physical addressing) has side
effects, such as how the TTBRn_ELx.BADDR fields are interpreted, and so
it is important that disabling FEAT_LPA2 (by overriding the
ID_AA64MMFR0.TGran fields) also presents a PARange field consistent with
that.

So limit the field to 48 bits unless LPA2 is enabled, and update
existing references to use the override consistently.

Fixes: 352b0395 ("arm64: Enable 52-bit virtual addressing for 4k and 16k granule configs")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
Acked-by: default avatarMarc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20241212081841.2168124-10-ardb+git@google.com


Signed-off-by: default avatarWill Deacon <will@kernel.org>
parent bf74bb73

arch/arm64/include/asm/assembler.h

+5 −0
Original line number Diff line number Diff line
@@ -343,6 +343,11 @@ alternative_cb_end 
	// Narrow PARange to fit the PS field in TCR_ELx

	ubfx	\tmp0, \tmp0, #ID_AA64MMFR0_EL1_PARANGE_SHIFT, #3

	mov	\tmp1, #ID_AA64MMFR0_EL1_PARANGE_MAX

#ifdef CONFIG_ARM64_LPA2

alternative_if_not ARM64_HAS_VA52

	mov	\tmp1, #ID_AA64MMFR0_EL1_PARANGE_48

alternative_else_nop_endif

#endif

	cmp	\tmp0, \tmp1

	csel	\tmp0, \tmp1, \tmp0, hi

	bfi	\tcr, \tmp0, \pos, #3

arch/arm64/kernel/cpufeature.c

+1 −1
Original line number Diff line number Diff line
@@ -3478,7 +3478,7 @@ static void verify_hyp_capabilities(void) 
		return;



	safe_mmfr1 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR1_EL1);

	mmfr0 = read_cpuid(ID_AA64MMFR0_EL1);

	mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1);

	mmfr1 = read_cpuid(ID_AA64MMFR1_EL1);



	/* Verify VMID bits */

arch/arm64/kernel/pi/idreg-override.c

+9 −0
Original line number Diff line number Diff line
@@ -83,6 +83,15 @@ static bool __init mmfr2_varange_filter(u64 val) 
		id_aa64mmfr0_override.val |=

			(ID_AA64MMFR0_EL1_TGRAN_LPA2 - 1) << ID_AA64MMFR0_EL1_TGRAN_SHIFT;

		id_aa64mmfr0_override.mask |= 0xfU << ID_AA64MMFR0_EL1_TGRAN_SHIFT;



		/*

		 * Override PARange to 48 bits - the override will just be

		 * ignored if the actual PARange is smaller, but this is

		 * unlikely to be the case for LPA2 capable silicon.

		 */

		id_aa64mmfr0_override.val |=

			ID_AA64MMFR0_EL1_PARANGE_48 << ID_AA64MMFR0_EL1_PARANGE_SHIFT;

		id_aa64mmfr0_override.mask |= 0xfU << ID_AA64MMFR0_EL1_PARANGE_SHIFT;

	}

#endif

	return true;

arch/arm64/kernel/pi/map_kernel.c

+6 −0
Original line number Diff line number Diff line
@@ -136,6 +136,12 @@ static void noinline __section(".idmap.text") set_ttbr0_for_lpa2(u64 ttbr) 
{

	u64 sctlr = read_sysreg(sctlr_el1);

	u64 tcr = read_sysreg(tcr_el1) | TCR_DS;

	u64 mmfr0 = read_sysreg(id_aa64mmfr0_el1);

	u64 parange = cpuid_feature_extract_unsigned_field(mmfr0,

							   ID_AA64MMFR0_EL1_PARANGE_SHIFT);



	tcr &= ~TCR_IPS_MASK;

	tcr |= parange << TCR_IPS_SHIFT;



	asm("	msr	sctlr_el1, %0		;"

	    "	isb				;"

arch/arm64/mm/init.c

+6 −1
Original line number Diff line number Diff line
@@ -279,7 +279,12 @@ void __init arm64_memblock_init(void) 


	if (IS_ENABLED(CONFIG_RANDOMIZE_BASE)) {

		extern u16 memstart_offset_seed;

		u64 mmfr0 = read_cpuid(ID_AA64MMFR0_EL1);



		/*

		 * Use the sanitised version of id_aa64mmfr0_el1 so that linear

		 * map randomization can be enabled by shrinking the IPA space.

		 */

		u64 mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1);

		int parange = cpuid_feature_extract_unsigned_field(

					mmfr0, ID_AA64MMFR0_EL1_PARANGE_SHIFT);

		s64 range = linear_region_size -