arm64: tls: Avoid unconditional zeroing of tpidrro_el0 for native tasks

Commit 18011eac28c7 upstream.

When unmapping the kernel at EL0, we use tpidrro_el0 as a scratch register
during exception entry from native tasks and subsequently zero it in
the kernel_ventry macro. We can therefore avoid zeroing tpidrro_el0
in the context-switch path for native tasks using the entry trampoline.

Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Tested-by: Laura Abbott <labbott@redhat.com>
Tested-by: Shanker Donthineni <shankerd@codeaurora.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 2843ade2dad2249900f508f61068d245921ce9f1)

CVE-2017-5753
CVE-2017-5715
CVE-2017-5754

Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
Acked-by: Brad Figg <brad.figg@canonical.com>
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index e6bf19c1dddb1d21fc3293ec8ed9e725a5c19466..ccf536f53bdb6876951df8d2c5a507482714f759 100644 (file)
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -305,16 +305,14 @@ void tls_preserve_current_state(void)
 
 static void tls_thread_switch(struct task_struct *next)
 {
-       unsigned long tpidr, tpidrro;
-
        tls_preserve_current_state();
 
-       tpidr = *task_user_tls(next);
-       tpidrro = is_compat_thread(task_thread_info(next)) ?
-                 next->thread.tp_value : 0;
+       if (is_compat_thread(task_thread_info(next)))
+               write_sysreg(next->thread.tp_value, tpidrro_el0);
+       else if (!arm64_kernel_unmapped_at_el0())
+               write_sysreg(0, tpidrro_el0);
 
-       write_sysreg(tpidr, tpidr_el0);
-       write_sysreg(tpidrro, tpidrro_el0);
+       write_sysreg(*task_user_tls(next), tpidr_el0);
 }
 
 /* Restore the UAO state depending on next's addr_limit */