From a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255 Mon Sep 17 00:00:00 2001 From: Jinke Han Date: Tue, 8 Sep 2026 15:37:42 +0800 Subject: x86/kprobes: Fix crash when probing CS CALL instructions When using eBPF to probe CS CALL instructions within a function, a crash can be triggered. The eBPF tool probes offset 257 of the __hrtimer_run_queues() function: <__hrtimer_run_queues+249>: nopl 0x0(%rax,%rax,1) <__hrtimer_run_queues+254>: mov %r14,%rdi <__hrtimer_run_queues+257>: cs call <__x86_indirect_thunk_r12> <__hrtimer_run_queues+263>: mov %eax,%r12d <__hrtimer_run_queues+266>: xchg %ax,%ax <__hrtimer_run_queues+268>: mov %r13,%rdi Which triggers this crash: BUG: unable to handle page fault for address: 00000000000f41c9 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P RIP: 0010:__hrtimer_run_queues+0x106/0x230 Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is at the 6th byte of the above CS CALL instruction. Since the CS CALL instruction occupies 6 bytes, the exception occurred in the middle of that call instruction. The root cause is that when using eBPF tools to probe in the middle of a function, a kprobe with INT3 is used as the underlying implementation. During single-step emulation of the original CALL instruction, int3_emulate_call() assumes that the probed CALL instruction is 5 bytes long. However, the actual CS-prefixed CALL instruction occupies 6 bytes, so it constructs an incorrect exception return address. When the CPU returns from the kprobe handler, the next instruction to be executed is at the address of the last byte of that CS CALL instruction. Coincidentally, starting from that address, the CPU fetches and decodes a completely different instruction, which ultimately triggers a kernel crash. Fix the issue by using the actual instruction length obtained from the instruction decoder when constructing the exception return address, rather than relying on the hardcoded CALL_INSN_SIZE macro. [ mingo: Refined the changelog ] Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step") Suggested-by: Masami Hiramatsu (Google) Signed-off-by: Jinke Han Signed-off-by: Ingo Molnar Reviewed-by: Masami Hiramatsu (Google) Acked-by: Yafang Shao Acked-by: Borislav Petkov Cc: Peter Zijlstra Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000 --- drivers/reset/hisilicon/Kconfig | 14 +++ drivers/reset/hisilicon/Makefile | 3 + drivers/reset/hisilicon/hi6220_reset.c | 223 +++++++++++++++++++++++++++++++++ drivers/reset/hisilicon/reset-hi3660.c | 127 +++++++++++++++++++ 4 files changed, 367 insertions(+) create mode 100644 drivers/reset/hisilicon/Kconfig create mode 100644 drivers/reset/hisilicon/Makefile create mode 100644 drivers/reset/hisilicon/hi6220_reset.c create mode 100644 drivers/reset/hisilicon/reset-hi3660.c (limited to 'drivers/reset/hisilicon') diff --git a/drivers/reset/hisilicon/Kconfig b/drivers/reset/hisilicon/Kconfig new file mode 100644 index 000000000..945ef7a12 --- /dev/null +++ b/drivers/reset/hisilicon/Kconfig @@ -0,0 +1,14 @@ +# SPDX-License-Identifier: GPL-2.0-only +config COMMON_RESET_HI3660 + tristate "Hi3660 Reset Driver" + depends on ARCH_HISI || COMPILE_TEST + default ARCH_HISI + help + Build the Hisilicon Hi3660 reset driver. + +config COMMON_RESET_HI6220 + tristate "Hi6220 Reset Driver" + depends on ARCH_HISI || COMPILE_TEST + default ARCH_HISI + help + Build the Hisilicon Hi6220 reset driver. diff --git a/drivers/reset/hisilicon/Makefile b/drivers/reset/hisilicon/Makefile new file mode 100644 index 000000000..cf86d1308 --- /dev/null +++ b/drivers/reset/hisilicon/Makefile @@ -0,0 +1,3 @@ +# SPDX-License-Identifier: GPL-2.0-only +obj-$(CONFIG_COMMON_RESET_HI6220) += hi6220_reset.o +obj-$(CONFIG_COMMON_RESET_HI3660) += reset-hi3660.o diff --git a/drivers/reset/hisilicon/hi6220_reset.c b/drivers/reset/hisilicon/hi6220_reset.c new file mode 100644 index 000000000..65aa5ff5e --- /dev/null +++ b/drivers/reset/hisilicon/hi6220_reset.c @@ -0,0 +1,223 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Hisilicon Hi6220 reset controller driver + * + * Copyright (c) 2016 Linaro Limited. + * Copyright (c) 2015-2016 HiSilicon Limited. + * + * Author: Feng Chen + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define PERIPH_ASSERT_OFFSET 0x300 +#define PERIPH_DEASSERT_OFFSET 0x304 +#define PERIPH_MAX_INDEX 0x509 + +#define SC_MEDIA_RSTEN 0x052C +#define SC_MEDIA_RSTDIS 0x0530 +#define MEDIA_MAX_INDEX 8 + +#define to_reset_data(x) container_of(x, struct hi6220_reset_data, rc_dev) + +enum hi6220_reset_ctrl_type { + PERIPHERAL, + MEDIA, + AO, +}; + +struct hi6220_reset_data { + struct reset_controller_dev rc_dev; + struct regmap *regmap; +}; + +static int hi6220_peripheral_assert(struct reset_controller_dev *rc_dev, + unsigned long idx) +{ + struct hi6220_reset_data *data = to_reset_data(rc_dev); + struct regmap *regmap = data->regmap; + u32 bank = idx >> 8; + u32 offset = idx & 0xff; + u32 reg = PERIPH_ASSERT_OFFSET + bank * 0x10; + + return regmap_write(regmap, reg, BIT(offset)); +} + +static int hi6220_peripheral_deassert(struct reset_controller_dev *rc_dev, + unsigned long idx) +{ + struct hi6220_reset_data *data = to_reset_data(rc_dev); + struct regmap *regmap = data->regmap; + u32 bank = idx >> 8; + u32 offset = idx & 0xff; + u32 reg = PERIPH_DEASSERT_OFFSET + bank * 0x10; + + return regmap_write(regmap, reg, BIT(offset)); +} + +static const struct reset_control_ops hi6220_peripheral_reset_ops = { + .assert = hi6220_peripheral_assert, + .deassert = hi6220_peripheral_deassert, +}; + +static int hi6220_media_assert(struct reset_controller_dev *rc_dev, + unsigned long idx) +{ + struct hi6220_reset_data *data = to_reset_data(rc_dev); + struct regmap *regmap = data->regmap; + + return regmap_write(regmap, SC_MEDIA_RSTEN, BIT(idx)); +} + +static int hi6220_media_deassert(struct reset_controller_dev *rc_dev, + unsigned long idx) +{ + struct hi6220_reset_data *data = to_reset_data(rc_dev); + struct regmap *regmap = data->regmap; + + return regmap_write(regmap, SC_MEDIA_RSTDIS, BIT(idx)); +} + +static const struct reset_control_ops hi6220_media_reset_ops = { + .assert = hi6220_media_assert, + .deassert = hi6220_media_deassert, +}; + +#define AO_SCTRL_SC_PW_CLKEN0 0x800 +#define AO_SCTRL_SC_PW_CLKDIS0 0x804 + +#define AO_SCTRL_SC_PW_RSTEN0 0x810 +#define AO_SCTRL_SC_PW_RSTDIS0 0x814 + +#define AO_SCTRL_SC_PW_ISOEN0 0x820 +#define AO_SCTRL_SC_PW_ISODIS0 0x824 +#define AO_MAX_INDEX 12 + +static int hi6220_ao_assert(struct reset_controller_dev *rc_dev, + unsigned long idx) +{ + struct hi6220_reset_data *data = to_reset_data(rc_dev); + struct regmap *regmap = data->regmap; + int ret; + + ret = regmap_write(regmap, AO_SCTRL_SC_PW_RSTEN0, BIT(idx)); + if (ret) + return ret; + + ret = regmap_write(regmap, AO_SCTRL_SC_PW_ISOEN0, BIT(idx)); + if (ret) + return ret; + + ret = regmap_write(regmap, AO_SCTRL_SC_PW_CLKDIS0, BIT(idx)); + return ret; +} + +static int hi6220_ao_deassert(struct reset_controller_dev *rc_dev, + unsigned long idx) +{ + struct hi6220_reset_data *data = to_reset_data(rc_dev); + struct regmap *regmap = data->regmap; + int ret; + + /* + * It was suggested to disable isolation before enabling + * the clocks and deasserting reset, to avoid glitches. + * But this order is preserved to keep it matching the + * vendor code. + */ + ret = regmap_write(regmap, AO_SCTRL_SC_PW_RSTDIS0, BIT(idx)); + if (ret) + return ret; + + ret = regmap_write(regmap, AO_SCTRL_SC_PW_ISODIS0, BIT(idx)); + if (ret) + return ret; + + ret = regmap_write(regmap, AO_SCTRL_SC_PW_CLKEN0, BIT(idx)); + return ret; +} + +static const struct reset_control_ops hi6220_ao_reset_ops = { + .assert = hi6220_ao_assert, + .deassert = hi6220_ao_deassert, +}; + +static int hi6220_reset_probe(struct platform_device *pdev) +{ + struct device_node *np = pdev->dev.of_node; + struct device *dev = &pdev->dev; + enum hi6220_reset_ctrl_type type; + struct hi6220_reset_data *data; + struct regmap *regmap; + + data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL); + if (!data) + return -ENOMEM; + + type = (uintptr_t)of_device_get_match_data(dev); + + regmap = syscon_node_to_regmap(np); + if (IS_ERR(regmap)) { + dev_err(dev, "failed to get reset controller regmap\n"); + return PTR_ERR(regmap); + } + + data->regmap = regmap; + data->rc_dev.of_node = np; + if (type == MEDIA) { + data->rc_dev.ops = &hi6220_media_reset_ops; + data->rc_dev.nr_resets = MEDIA_MAX_INDEX; + } else if (type == PERIPHERAL) { + data->rc_dev.ops = &hi6220_peripheral_reset_ops; + data->rc_dev.nr_resets = PERIPH_MAX_INDEX; + } else { + data->rc_dev.ops = &hi6220_ao_reset_ops; + data->rc_dev.nr_resets = AO_MAX_INDEX; + } + + return reset_controller_register(&data->rc_dev); +} + +static const struct of_device_id hi6220_reset_match[] = { + { + .compatible = "hisilicon,hi6220-sysctrl", + .data = (void *)PERIPHERAL, + }, + { + .compatible = "hisilicon,hi6220-mediactrl", + .data = (void *)MEDIA, + }, + { + .compatible = "hisilicon,hi6220-aoctrl", + .data = (void *)AO, + }, + { /* sentinel */ }, +}; +MODULE_DEVICE_TABLE(of, hi6220_reset_match); + +static struct platform_driver hi6220_reset_driver = { + .probe = hi6220_reset_probe, + .driver = { + .name = "reset-hi6220", + .of_match_table = hi6220_reset_match, + }, +}; + +static int __init hi6220_reset_init(void) +{ + return platform_driver_register(&hi6220_reset_driver); +} + +postcore_initcall(hi6220_reset_init); + +MODULE_DESCRIPTION("Hisilicon Hi6220 reset controller driver"); +MODULE_LICENSE("GPL v2"); diff --git a/drivers/reset/hisilicon/reset-hi3660.c b/drivers/reset/hisilicon/reset-hi3660.c new file mode 100644 index 000000000..1beb27527 --- /dev/null +++ b/drivers/reset/hisilicon/reset-hi3660.c @@ -0,0 +1,127 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* + * Copyright (c) 2016-2017 Linaro Ltd. + * Copyright (c) 2016-2017 HiSilicon Technologies Co., Ltd. + */ +#include +#include +#include +#include +#include +#include +#include + +struct hi3660_reset_controller { + struct reset_controller_dev rst; + struct regmap *map; +}; + +#define to_hi3660_reset_controller(_rst) \ + container_of(_rst, struct hi3660_reset_controller, rst) + +static int hi3660_reset_program_hw(struct reset_controller_dev *rcdev, + unsigned long idx, bool assert) +{ + struct hi3660_reset_controller *rc = to_hi3660_reset_controller(rcdev); + unsigned int offset = idx >> 8; + unsigned int mask = BIT(idx & 0x1f); + + if (assert) + return regmap_write(rc->map, offset, mask); + else + return regmap_write(rc->map, offset + 4, mask); +} + +static int hi3660_reset_assert(struct reset_controller_dev *rcdev, + unsigned long idx) +{ + return hi3660_reset_program_hw(rcdev, idx, true); +} + +static int hi3660_reset_deassert(struct reset_controller_dev *rcdev, + unsigned long idx) +{ + return hi3660_reset_program_hw(rcdev, idx, false); +} + +static int hi3660_reset_dev(struct reset_controller_dev *rcdev, + unsigned long idx) +{ + int err; + + err = hi3660_reset_assert(rcdev, idx); + if (err) + return err; + + return hi3660_reset_deassert(rcdev, idx); +} + +static const struct reset_control_ops hi3660_reset_ops = { + .reset = hi3660_reset_dev, + .assert = hi3660_reset_assert, + .deassert = hi3660_reset_deassert, +}; + +static int hi3660_reset_xlate(struct reset_controller_dev *rcdev, + const struct of_phandle_args *reset_spec) +{ + unsigned int offset, bit; + + offset = reset_spec->args[0]; + bit = reset_spec->args[1]; + + return (offset << 8) | bit; +} + +static int hi3660_reset_probe(struct platform_device *pdev) +{ + struct hi3660_reset_controller *rc; + struct device_node *np = pdev->dev.of_node; + struct device *dev = &pdev->dev; + + rc = devm_kzalloc(dev, sizeof(*rc), GFP_KERNEL); + if (!rc) + return -ENOMEM; + + rc->map = syscon_regmap_lookup_by_phandle(np, "hisilicon,rst-syscon"); + if (rc->map == ERR_PTR(-ENODEV)) { + /* fall back to the deprecated compatible */ + rc->map = syscon_regmap_lookup_by_phandle(np, + "hisi,rst-syscon"); + } + if (IS_ERR(rc->map)) { + return dev_err_probe(dev, PTR_ERR(rc->map), + "failed to get hisilicon,rst-syscon\n"); + } + + rc->rst.ops = &hi3660_reset_ops, + rc->rst.of_node = np; + rc->rst.of_reset_n_cells = 2; + rc->rst.of_xlate = hi3660_reset_xlate; + + return reset_controller_register(&rc->rst); +} + +static const struct of_device_id hi3660_reset_match[] = { + { .compatible = "hisilicon,hi3660-reset", }, + {}, +}; +MODULE_DEVICE_TABLE(of, hi3660_reset_match); + +static struct platform_driver hi3660_reset_driver = { + .probe = hi3660_reset_probe, + .driver = { + .name = "hi3660-reset", + .of_match_table = hi3660_reset_match, + }, +}; + +static int __init hi3660_reset_init(void) +{ + return platform_driver_register(&hi3660_reset_driver); +} +arch_initcall(hi3660_reset_init); + +MODULE_LICENSE("GPL"); +MODULE_ALIAS("platform:hi3660-reset"); +MODULE_DESCRIPTION("HiSilicon Hi3660 Reset Driver"); -- cgit v1.3.1