linux-stable.git/arch/arm/kernel, branch v4.4.263

ARM: p2v: fix handling of LPAE translation in BE mode

2020-12-29T12:42:34+00:00

[ Upstream commit 4e79f0211b473f8e1eab8211a9fd50cc41a3a061 ]

When running in BE mode on LPAE hardware with a PA-to-VA translation
that exceeds 4 GB, we patch bits 39:32 of the offset into the wrong
byte of the opcode. So fix that, by rotating the offset in r0 to the
right by 8 bits, which will put the 8-bit immediate in bits 31:24.

Note that this will also move bit #22 in its correct place when
applying the rotation to the constant #0x400000.

Fixes: d9a790df8e984 ("ARM: 7883/1: fix mov to mvn conversion in case of 64 bit phys_addr_t and BE")
Acked-by: Nicolas Pitre 
Reviewed-by: Linus Walleij 
Signed-off-by: Ard Biesheuvel 
Signed-off-by: Sasha Levin

ARM: 8992/1: Fix unwind_frame for clang-built kernels

2020-08-21T08:53:04+00:00

commit b4d5ec9b39f8b31d98f65bc5577b5d15d93795d7 upstream.

Since clang does not push pc and sp in function prologues, the current
implementation of unwind_frame does not work. By using the previous
frame's lr/fp instead of saved pc/sp we get valid unwinds on clang-built
kernels.

The bounds check on next frame pointer must be changed as well since
there are 8 less bytes between frames.

This fixes /proc//stack.

Link: https://github.com/ClangBuiltLinux/linux/issues/912

Reported-by: Miles Chen 
Tested-by: Miles Chen 
Cc: stable@vger.kernel.org
Reviewed-by: Nick Desaulniers 
Signed-off-by: Nathan Huckleberry 
Signed-off-by: Russell King 
Signed-off-by: Greg Kroah-Hartman

ARM: 8986/1: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints

2020-08-21T08:52:53+00:00

[ Upstream commit eec13b42d41b0f3339dcf0c4da43734427c68620 ]

Unprivileged memory accesses generated by the so-called "translated"
instructions (e.g. LDRT) in kernel mode can cause user watchpoints to fire
unexpectedly. In such cases, the hw_breakpoint logic will invoke the user
overflow handler which will typically raise a SIGTRAP back to the current
task. This is futile when returning back to the kernel because (a) the
signal won't have been delivered and (b) userspace can't handle the thing
anyway.

Avoid invoking the user overflow handler for watchpoints triggered by
kernel uaccess routines, and instead single-step over the faulting
instruction as we would if no overflow handler had been installed.

Cc: 
Fixes: f81ef4a920c8 ("ARM: 6356/1: hw-breakpoint: add ARM backend for the hw-breakpoint framework")
Reported-by: Luis Machado 
Tested-by: Luis Machado 
Signed-off-by: Will Deacon 
Signed-off-by: Russell King 
Signed-off-by: Sasha Levin

ARM: 8977/1: ptrace: Fix mask for thumb breakpoint hook

2020-06-20T08:23:15+00:00

[ Upstream commit 3866f217aaa81bf7165c7f27362eee5d7919c496 ]

call_undef_hook() in traps.c applies the same instr_mask for both 16-bit
and 32-bit thumb instructions. If instr_mask then is only 16 bits wide
(0xffff as opposed to 0xffffffff), the first half-word of 32-bit thumb
instructions will be masked out. This makes the function match 32-bit
thumb instructions where the second half-word is equal to instr_val,
regardless of the first half-word.

The result in this case is that all undefined 32-bit thumb instructions
with the second half-word equal to 0xde01 (udf #1) work as breakpoints
and will raise a SIGTRAP instead of a SIGILL, instead of just the one
intended 16-bit instruction. An example of such an instruction is
0xeaa0de01, which is unallocated according to Arm ARM and should raise a
SIGILL, but instead raises a SIGTRAP.

This patch fixes the issue by setting all the bits in instr_mask, which
will still match the intended 16-bit thumb instruction (where the
upper half is always 0), but not any 32-bit thumb instructions.

Cc: Oleg Nesterov 
Signed-off-by: Fredrik Strupe 
Signed-off-by: Russell King 
Signed-off-by: Sasha Levin

ARM: 8957/1: VDSO: Match ARMv8 timer in cntvct_functional()

2020-03-20T08:06:34+00:00

commit 45939ce292b4b11159719faaf60aba7d58d5fe33 upstream.

It is possible for a system with an ARMv8 timer to run a 32-bit kernel.
When this happens we will unconditionally have the vDSO code remove the
__vdso_gettimeofday and __vdso_clock_gettime symbols because
cntvct_functional() returns false since it does not match that
compatibility string.

Fixes: ecf99a439105 ("ARM: 8331/1: VDSO initialization, mapping, and synchronization")
Signed-off-by: Florian Fainelli 
Signed-off-by: Russell King 
Signed-off-by: Greg Kroah-Hartman

ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used

2020-01-29T09:21:40+00:00

[ Upstream commit ca70ea43f80c98582f5ffbbd1e6f4da2742da0c4 ]

MCPM does a soft reset of the CPUs and uses common cpu_resume() routine to
perform low-level platform initialization. This results in a try to install
HYP stubs for the second time for each CPU and results in false HYP/SVC
mode mismatch detection. The HYP stubs are already installed at the
beginning of the kernel initialization on the boot CPU (head.S) or in the
secondary_startup() for other CPUs. To fix this issue MCPM code should use
a cpu_resume() routine without HYP stubs installation.

This change fixes HYP/SVC mode mismatch on Samsung Exynos5422-based Odroid
XU3/XU4/HC1 boards.

Fixes: 3721924c8154 ("ARM: 8081/1: MCPM: provide infrastructure to allow for MCPM loopback")
Signed-off-by: Marek Szyprowski 
Acked-by: Nicolas Pitre 
Tested-by: Anand Moon 
Signed-off-by: Russell King 
Signed-off-by: Sasha Levin

ARM: 8802/1: Call syscall_trace_exit even when system call skipped

2019-11-25T14:54:51+00:00

[ Upstream commit f18aef742c8fbd68e280dff0a63ba0ca6ee8ad85 ]

On at least x86 and ARM64, and as documented in the ptrace man page
a skipped system call will still cause a syscall exit ptrace stop.

Previous to this commit 32-bit ARM did not, resulting in strace
being confused when seccomp skips system calls.

This change also impacts programs that use ptrace to skip system calls.

Fixes: ad75b51459ae ("ARM: 7579/1: arch/allow a scno of -1 to not cause a SIGILL")
Signed-off-by: Timothy E Baldwin 
Signed-off-by: Eugene Syromyatnikov 
Reviewed-by: Kees Cook 
Tested-by: Kees Cook 
Tested-by: Eugene Syromyatnikov 
Signed-off-by: Russell King 
Signed-off-by: Sasha Levin

ARM: spectre-v2: per-CPU vtables to work around big.Little systems

2019-11-10T10:21:37+00:00

Commit 383fb3ee8024d596f488d2dbaf45e572897acbdb upstream.

In big.Little systems, some CPUs require the Spectre workarounds in
paths such as the context switch, but other CPUs do not.  In order
to handle these differences, we need per-CPU vtables.

We are unable to use the kernel's per-CPU variables to support this
as per-CPU is not initialised at times when we need access to the
vtables, so we have to use an array indexed by logical CPU number.

We use an array-of-pointers to avoid having function pointers in
the kernel's read/write .data section.

Note: Added include of linux/slab.h in arch/arm/smp.c.

Reviewed-by: Julien Thierry 
Signed-off-by: Russell King 
Signed-off-by: David A. Long 
Reviewed-by: Julien Thierry 
Signed-off-by: Sasha Levin 
Signed-off-by: Ard Biesheuvel 
Signed-off-by: Greg Kroah-Hartman

ARM: add PROC_VTABLE and PROC_TABLE macros

2019-11-10T10:21:37+00:00

Commit e209950fdd065d2cc46e6338e47e52841b830cba upstream.

Allow the way we access members of the processor vtable to be changed
at compile time.  We will need to move to per-CPU vtables to fix the
Spectre variant 2 issues on big.Little systems.

However, we have a couple of calls that do not need the vtable
treatment, and indeed cause a kernel warning due to the (later) use
of smp_processor_id(), so also introduce the PROC_TABLE macro for
these which always use CPU 0's function pointers.

Reviewed-by: Julien Thierry 
Signed-off-by: Russell King 
Signed-off-by: David A. Long 
Reviewed-by: Julien Thierry 
Signed-off-by: Sasha Levin 
Signed-off-by: Ard Biesheuvel 
Signed-off-by: Greg Kroah-Hartman

ARM: clean up per-processor check_bugs method call

2019-11-10T10:21:37+00:00

Commit 945aceb1db8885d3a35790cf2e810f681db52756 upstream.

Call the per-processor type check_bugs() method in the same way as we
do other per-processor functions - move the "processor." detail into
proc-fns.h.

Reviewed-by: Julien Thierry 
Signed-off-by: Russell King 
Signed-off-by: David A. Long 
Reviewed-by: Julien Thierry 
Signed-off-by: Sasha Levin 
Signed-off-by: Ard Biesheuvel 
Signed-off-by: Greg Kroah-Hartman