arm64/boot: Disable trapping of PMZR_EL0 writes to EL2grafted

__init_el2_fgt2() writes one mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2.
PMZR_EL0 is write-only, so its trap bit, nPMZR_EL0, exists only in
HDFGWTR2_EL2 and is therefore never set: a PMZR_EL0 write from the host
traps to EL2, where the nVHE hypervisor has no handler and BUG()s. The
kernel never writes PMZR_EL0, but kernel.perf_user_access=1 has the PMU
driver set PMUSERENR_EL0.UEN for a task with a user-read event, so a
write from EL0 reaches the trap and takes the host down without a panic
message.

Accumulate the HDFGWTR2_EL2 bits separately, as __init_el2_fgt() already
does for HDFGWTR_EL2, and set nPMZR_EL0 with the other FEAT_PMUv3p9
bits.

Fixes: 858c7bfcb35e1 ("arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9")
Cc: stable@vger.kernel.org
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Reviewed-by: Oliver Upton <oupton@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>

1 files changed, 141 insertions, 0 deletions

diff --git a/drivers/accessibility/speakup/selection.c b/drivers/accessibility/speakup/selection.c
new file mode 100644
index 000000000..1713ce4e0
--- /dev/null
+++ b/drivers/accessibility/speakup/selection.c
@@ -0,0 +1,141 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/slab.h> /* for kmalloc */
+#include <linux/consolemap.h>
+#include <linux/interrupt.h>
+#include <linux/sched.h>
+#include <linux/device.h> /* for dev_warn */
+#include <linux/selection.h>
+#include <linux/workqueue.h>
+#include <linux/tty.h>
+#include <linux/tty_flip.h>
+#include <linux/atomic.h>
+#include <linux/console.h>
+
+#include "speakup.h"
+
+u16 spk_xs, spk_ys, spk_xe, spk_ye; /* our region points */
+struct vc_data *spk_sel_cons;
+
+struct speakup_selection_work {
+	struct work_struct work;
+	struct tiocl_selection sel;
+	struct tty_struct *tty;
+};
+
+static void __speakup_set_selection(struct work_struct *work)
+{
+	struct speakup_selection_work *ssw =
+		container_of(work, struct speakup_selection_work, work);
+
+	struct tty_struct *tty;
+	struct tiocl_selection sel;
+
+	sel = ssw->sel;
+
+	/* this ensures we copy sel before releasing the lock below */
+	rmb();
+
+	/* release the lock by setting tty of the struct to NULL */
+	tty = xchg(&ssw->tty, NULL);
+
+	if (spk_sel_cons != vc_cons[fg_console].d) {
+		spk_sel_cons = vc_cons[fg_console].d;
+		pr_warn("Selection: mark console not the same as cut\n");
+		goto unref;
+	}
+
+	console_lock();
+	clear_selection();
+	console_unlock();
+
+	set_selection_kernel(&sel, tty);
+
+unref:
+	tty_kref_put(tty);
+}
+
+static struct speakup_selection_work speakup_sel_work = {
+	.work = __WORK_INITIALIZER(speakup_sel_work.work,
+				   __speakup_set_selection)
+};
+
+int speakup_set_selection(struct tty_struct *tty)
+{
+	/* we get kref here first in order to avoid a subtle race when
+	 * cancelling selection work. getting kref first establishes the
+	 * invariant that if speakup_sel_work.tty is not NULL when
+	 * speakup_cancel_selection() is called, it must be the case that a put
+	 * kref is pending.
+	 */
+	tty_kref_get(tty);
+	if (cmpxchg(&speakup_sel_work.tty, NULL, tty)) {
+		tty_kref_put(tty);
+		return -EBUSY;
+	}
+	/* now we have the 'lock' by setting tty member of
+	 * speakup_selection_work. wmb() ensures that writes to
+	 * speakup_sel_work don't happen before cmpxchg() above.
+	 */
+	wmb();
+
+	speakup_sel_work.sel.xs = spk_xs + 1;
+	speakup_sel_work.sel.ys = spk_ys + 1;
+	speakup_sel_work.sel.xe = spk_xe + 1;
+	speakup_sel_work.sel.ye = spk_ye + 1;
+	speakup_sel_work.sel.sel_mode = TIOCL_SELCHAR;
+
+	schedule_work_on(WORK_CPU_UNBOUND, &speakup_sel_work.work);
+
+	return 0;
+}
+
+void speakup_cancel_selection(void)
+{
+	struct tty_struct *tty;
+
+	cancel_work_sync(&speakup_sel_work.work);
+	/* setting to null so that if work fails to run and we cancel it,
+	 * we can run it again without getting EBUSY forever from there on.
+	 * we need to use xchg here to avoid race with speakup_set_selection()
+	 */
+	tty = xchg(&speakup_sel_work.tty, NULL);
+	if (tty)
+		tty_kref_put(tty);
+}
+
+static void __speakup_paste_selection(struct work_struct *work)
+{
+	struct speakup_selection_work *ssw =
+		container_of(work, struct speakup_selection_work, work);
+	struct tty_struct *tty = xchg(&ssw->tty, NULL);
+
+	paste_selection(tty);
+	tty_kref_put(tty);
+}
+
+static struct speakup_selection_work speakup_paste_work = {
+	.work = __WORK_INITIALIZER(speakup_paste_work.work,
+				   __speakup_paste_selection)
+};
+
+int speakup_paste_selection(struct tty_struct *tty)
+{
+	tty_kref_get(tty);
+	if (cmpxchg(&speakup_paste_work.tty, NULL, tty)) {
+		tty_kref_put(tty);
+		return -EBUSY;
+	}
+
+	schedule_work_on(WORK_CPU_UNBOUND, &speakup_paste_work.work);
+	return 0;
+}
+
+void speakup_cancel_paste(void)
+{
+	struct tty_struct *tty;
+
+	cancel_work_sync(&speakup_paste_work.work);
+	tty = xchg(&speakup_paste_work.tty, NULL);
+	if (tty)
+		tty_kref_put(tty);
+}