arm64: kaslr: use callee saved register to preserve SCTLR across C call

The KASLR code incorrectly expects the contents of x18 to be preserved
across a call into C code, and uses it to stash the contents of SCTLR_EL1
before enabling the MMU. If the MMU needs to be disabled again to create
the randomized kernel mapping, x18 is written back to SCTLR_EL1, which is
likely to crash the system if x18 has been clobbered by kasan_early_init()
or kaslr_early_init(). So use x22 instead, which is not in use so far in
head.S

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 1672ca9..a2cf0e3 100644 (file)
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -732,7 +732,7 @@ ENTRY(__early_cpu_boot_status)
  */
        .section        ".idmap.text", "ax"
 __enable_mmu:
-       mrs     x18, sctlr_el1                  // preserve old SCTLR_EL1 value
+       mrs     x22, sctlr_el1                  // preserve old SCTLR_EL1 value
        mrs     x1, ID_AA64MMFR0_EL1
        ubfx    x2, x1, #ID_AA64MMFR0_TGRAN_SHIFT, 4
        cmp     x2, #ID_AA64MMFR0_TGRAN_SUPPORTED
@@ -760,7 +760,7 @@ __enable_mmu:
         * to take into account by discarding the current kernel mapping and
         * creating a new one.
         */
-       msr     sctlr_el1, x18                  // disable the MMU
+       msr     sctlr_el1, x22                  // disable the MMU
        isb
        bl      __create_page_tables            // recreate kernel mapping