From a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255 Mon Sep 17 00:00:00 2001 From: Jinke Han Date: Tue, 8 Sep 2026 15:37:42 +0800 Subject: x86/kprobes: Fix crash when probing CS CALL instructions When using eBPF to probe CS CALL instructions within a function, a crash can be triggered. The eBPF tool probes offset 257 of the __hrtimer_run_queues() function: <__hrtimer_run_queues+249>: nopl 0x0(%rax,%rax,1) <__hrtimer_run_queues+254>: mov %r14,%rdi <__hrtimer_run_queues+257>: cs call <__x86_indirect_thunk_r12> <__hrtimer_run_queues+263>: mov %eax,%r12d <__hrtimer_run_queues+266>: xchg %ax,%ax <__hrtimer_run_queues+268>: mov %r13,%rdi Which triggers this crash: BUG: unable to handle page fault for address: 00000000000f41c9 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P RIP: 0010:__hrtimer_run_queues+0x106/0x230 Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is at the 6th byte of the above CS CALL instruction. Since the CS CALL instruction occupies 6 bytes, the exception occurred in the middle of that call instruction. The root cause is that when using eBPF tools to probe in the middle of a function, a kprobe with INT3 is used as the underlying implementation. During single-step emulation of the original CALL instruction, int3_emulate_call() assumes that the probed CALL instruction is 5 bytes long. However, the actual CS-prefixed CALL instruction occupies 6 bytes, so it constructs an incorrect exception return address. When the CPU returns from the kprobe handler, the next instruction to be executed is at the address of the last byte of that CS CALL instruction. Coincidentally, starting from that address, the CPU fetches and decodes a completely different instruction, which ultimately triggers a kernel crash. Fix the issue by using the actual instruction length obtained from the instruction decoder when constructing the exception return address, rather than relying on the hardcoded CALL_INSN_SIZE macro. [ mingo: Refined the changelog ] Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step") Suggested-by: Masami Hiramatsu (Google) Signed-off-by: Jinke Han Signed-off-by: Ingo Molnar Reviewed-by: Masami Hiramatsu (Google) Acked-by: Yafang Shao Acked-by: Borislav Petkov Cc: Peter Zijlstra Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000 --- drivers/clocksource/timer-rda.c | 202 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 202 insertions(+) create mode 100644 drivers/clocksource/timer-rda.c (limited to 'drivers/clocksource/timer-rda.c') diff --git a/drivers/clocksource/timer-rda.c b/drivers/clocksource/timer-rda.c new file mode 100644 index 000000000..0be8e0597 --- /dev/null +++ b/drivers/clocksource/timer-rda.c @@ -0,0 +1,202 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * RDA8810PL SoC timer driver + * + * Copyright RDA Microelectronics Company Limited + * Copyright (c) 2017 Andreas Färber + * Copyright (c) 2018 Manivannan Sadhasivam + * + * RDA8810PL has two independent timers: OSTIMER (56 bit) and HWTIMER (64 bit). + * Each timer provides optional interrupt support. In this driver, OSTIMER is + * used for clockevents and HWTIMER is used for clocksource. + */ + +#include +#include +#include + +#include "timer-of.h" + +#define RDA_OSTIMER_LOADVAL_L 0x000 +#define RDA_OSTIMER_CTRL 0x004 +#define RDA_HWTIMER_LOCKVAL_L 0x024 +#define RDA_HWTIMER_LOCKVAL_H 0x028 +#define RDA_TIMER_IRQ_MASK_SET 0x02c +#define RDA_TIMER_IRQ_MASK_CLR 0x030 +#define RDA_TIMER_IRQ_CLR 0x034 + +#define RDA_OSTIMER_CTRL_ENABLE BIT(24) +#define RDA_OSTIMER_CTRL_REPEAT BIT(28) +#define RDA_OSTIMER_CTRL_LOAD BIT(30) + +#define RDA_TIMER_IRQ_MASK_OSTIMER BIT(0) + +#define RDA_TIMER_IRQ_CLR_OSTIMER BIT(0) + +static int rda_ostimer_start(void __iomem *base, bool periodic, u64 cycles) +{ + u32 ctrl, load_l; + + load_l = (u32)cycles; + ctrl = ((cycles >> 32) & 0xffffff); + ctrl |= RDA_OSTIMER_CTRL_LOAD | RDA_OSTIMER_CTRL_ENABLE; + if (periodic) + ctrl |= RDA_OSTIMER_CTRL_REPEAT; + + /* Enable ostimer interrupt first */ + writel_relaxed(RDA_TIMER_IRQ_MASK_OSTIMER, + base + RDA_TIMER_IRQ_MASK_SET); + + /* Write low 32 bits first, high 24 bits are with ctrl */ + writel_relaxed(load_l, base + RDA_OSTIMER_LOADVAL_L); + writel_relaxed(ctrl, base + RDA_OSTIMER_CTRL); + + return 0; +} + +static int rda_ostimer_stop(void __iomem *base) +{ + /* Disable ostimer interrupt first */ + writel_relaxed(RDA_TIMER_IRQ_MASK_OSTIMER, + base + RDA_TIMER_IRQ_MASK_CLR); + + writel_relaxed(0, base + RDA_OSTIMER_CTRL); + + return 0; +} + +static int rda_ostimer_set_state_shutdown(struct clock_event_device *evt) +{ + struct timer_of *to = to_timer_of(evt); + + rda_ostimer_stop(timer_of_base(to)); + + return 0; +} + +static int rda_ostimer_set_state_oneshot(struct clock_event_device *evt) +{ + struct timer_of *to = to_timer_of(evt); + + rda_ostimer_stop(timer_of_base(to)); + + return 0; +} + +static int rda_ostimer_set_state_periodic(struct clock_event_device *evt) +{ + struct timer_of *to = to_timer_of(evt); + unsigned long cycles_per_jiffy; + + rda_ostimer_stop(timer_of_base(to)); + + cycles_per_jiffy = ((unsigned long long)NSEC_PER_SEC / HZ * + evt->mult) >> evt->shift; + rda_ostimer_start(timer_of_base(to), true, cycles_per_jiffy); + + return 0; +} + +static int rda_ostimer_tick_resume(struct clock_event_device *evt) +{ + return 0; +} + +static int rda_ostimer_set_next_event(unsigned long evt, + struct clock_event_device *ev) +{ + struct timer_of *to = to_timer_of(ev); + + rda_ostimer_start(timer_of_base(to), false, evt); + + return 0; +} + +static irqreturn_t rda_ostimer_interrupt(int irq, void *dev_id) +{ + struct clock_event_device *evt = dev_id; + struct timer_of *to = to_timer_of(evt); + + /* clear timer int */ + writel_relaxed(RDA_TIMER_IRQ_CLR_OSTIMER, + timer_of_base(to) + RDA_TIMER_IRQ_CLR); + + if (evt->event_handler) + evt->event_handler(evt); + + return IRQ_HANDLED; +} + +static struct timer_of rda_ostimer_of = { + .flags = TIMER_OF_IRQ | TIMER_OF_BASE, + + .clkevt = { + .name = "rda-ostimer", + .rating = 250, + .features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT | + CLOCK_EVT_FEAT_DYNIRQ, + .set_state_shutdown = rda_ostimer_set_state_shutdown, + .set_state_oneshot = rda_ostimer_set_state_oneshot, + .set_state_periodic = rda_ostimer_set_state_periodic, + .tick_resume = rda_ostimer_tick_resume, + .set_next_event = rda_ostimer_set_next_event, + }, + + .of_base = { + .name = "rda-timer", + .index = 0, + }, + + .of_irq = { + .name = "ostimer", + .handler = rda_ostimer_interrupt, + .flags = IRQF_TIMER, + }, +}; + +static u64 rda_hwtimer_clocksource_read(void) +{ + void __iomem *base = timer_of_base(&rda_ostimer_of); + u32 lo, hi; + + /* Always read low 32 bits first */ + do { + lo = readl_relaxed(base + RDA_HWTIMER_LOCKVAL_L); + hi = readl_relaxed(base + RDA_HWTIMER_LOCKVAL_H); + } while (hi != readl_relaxed(base + RDA_HWTIMER_LOCKVAL_H)); + + return ((u64)hi << 32) | lo; +} + +static u64 rda_hwtimer_read(struct clocksource *cs) +{ + return rda_hwtimer_clocksource_read(); +} + +static struct clocksource rda_hwtimer_clocksource = { + .name = "rda-timer", + .rating = 400, + .read = rda_hwtimer_read, + .mask = CLOCKSOURCE_MASK(64), + .flags = CLOCK_SOURCE_IS_CONTINUOUS, +}; + +static int __init rda_timer_init(struct device_node *np) +{ + unsigned long rate = 2000000; + int ret; + + ret = timer_of_init(np, &rda_ostimer_of); + if (ret) + return ret; + + clocksource_register_hz(&rda_hwtimer_clocksource, rate); + sched_clock_register(rda_hwtimer_clocksource_read, 64, rate); + + clockevents_config_and_register(&rda_ostimer_of.clkevt, rate, + 0x2, UINT_MAX); + + return 0; +} + +TIMER_OF_DECLARE(rda8810pl, "rda,8810pl-timer", rda_timer_init); -- cgit v1.3.1