1 files changed, 33 insertions, 0 deletions

diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index cfd65b63f36f..9808da29a653 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -8,6 +8,7 @@
  */
 
 #include <linux/acpi.h>
+#include <linux/bitfield.h>
 #include <linux/extable.h>
 #include <linux/signal.h>
 #include <linux/mm.h>
@@ -242,6 +243,34 @@ static inline bool is_el1_permission_fault(unsigned long addr, unsigned int esr,
         return false;
 }
 
+static bool __kprobes is_spurious_el1_translation_fault(unsigned long addr,
+                                                        unsigned int esr,
+                                                        struct pt_regs *regs)
+{
+        unsigned long flags;
+        u64 par, dfsc;
+
+        if (ESR_ELx_EC(esr) != ESR_ELx_EC_DABT_CUR ||
+            (esr & ESR_ELx_FSC_TYPE) != ESR_ELx_FSC_FAULT)
+                return false;
+
+        local_irq_save(flags);
+        asm volatile("at s1e1r, %0" :: "r" (addr));
+        isb();
+        par = read_sysreg(par_el1);
+        local_irq_restore(flags);
+
+        if (!(par & SYS_PAR_EL1_F))
+                return false;
+
+        /*
+         * If we got a different type of fault from the AT instruction,
+         * treat the translation fault as spurious.
+         */
+        dfsc = FIELD_PREP(SYS_PAR_EL1_FST, par);
+        return (dfsc & ESR_ELx_FSC_TYPE) != ESR_ELx_FSC_FAULT;
+}
+
 static void die_kernel_fault(const char *msg, unsigned long addr,
                              unsigned int esr, struct pt_regs *regs)
 {
@@ -270,6 +299,10 @@ static void __do_kernel_fault(unsigned long addr, unsigned int esr,
         if (!is_el1_instruction_abort(esr) && fixup_exception(regs))
                 return;
 
+        if (WARN_RATELIMIT(is_spurious_el1_translation_fault(addr, esr, regs),
+            "Ignoring spurious kernel translation fault at virtual address %016lx\n", addr))
+                return;
+
         if (is_el1_permission_fault(addr, esr, regs)) {
                 if (esr & ESR_ELx_WNR)
                         msg = "write to read-only memory";