linux-stable.git/arch/arm, branch linux-3.4.y

ARM: 8471/1: need to save/restore arm register(r11) when it is corrupted

2016-10-26T15:15:38+00:00

commit fa0708b320f6da4c1104fe56e01b7abf66fd16ad upstream.

In cpu_v7_do_suspend routine, r11 is used while it is NOT
saved/restored, different compiler may have different usage
of ARM general registers, so it may cause issues during
calling cpu_v7_do_suspend.

We meet kernel fault occurs when using GCC 4.8.3, r11 contains
valid value before calling into cpu_v7_do_suspend, but when returned
from this routine, r11 is corrupted and lead to kernel fault.
Doing save/restore for those corrupted registers is a must in
assemble code.

Signed-off-by: Anson Huang 
Reviewed-by: Nicolas Pitre 
Signed-off-by: Russell King 
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li

ARM: pxa: remove incorrect __init annotation on pxa27x_set_pwrmode

2016-10-26T15:15:23+00:00

commit 54c09889bff6d99c8733eed4a26c9391b177c88b upstream.

The z2 machine calls pxa27x_set_pwrmode() in order to power off
the machine, but this function gets discarded early at boot because
it is marked __init, as pointed out by kbuild:

WARNING: vmlinux.o(.text+0x145c4): Section mismatch in reference from the function z2_power_off() to the function .init.text:pxa27x_set_pwrmode()
The function z2_power_off() references
the function __init pxa27x_set_pwrmode().
This is often because z2_power_off lacks a __init
annotation or the annotation of pxa27x_set_pwrmode is wrong.

This removes the __init section modifier to fix rebooting and the
build error.

Signed-off-by: Arnd Bergmann 
Fixes: ba4a90a6d86a ("ARM: pxa/z2: fix building error of pxa27x_cpu_suspend() no longer available")
Signed-off-by: Robert Jarzmik 
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li

ARM: fix Thumb2 signal handling when ARMv6 is enabled

2016-04-27T10:55:19+00:00

commit 9b55613f42e8d40d5c9ccb8970bde6af4764b2ab upstream.

When a kernel is built covering ARMv6 to ARMv7, we omit to clear the
IT state when entering a signal handler.  This can cause the first
few instructions to be conditionally executed depending on the parent
context.

In any case, the original test for >= ARMv7 is broken - ARMv6 can have
Thumb-2 support as well, and an ARMv6T2 specific build would omit this
code too.

Relax the test back to ARMv6 or greater.  This results in us always
clearing the IT state bits in the PSR, even on CPUs where these bits
are reserved.  However, they're reserved for the IT state, so this
should cause no harm.

Fixes: d71e1352e240 ("Clear the IT state when invoking a Thumb-2 signal handler")
Acked-by: Tony Lindgren 
Tested-by: H. Nikolaus Schaller 
Tested-by: Grazvydas Ignotas 
Signed-off-by: Russell King 
Signed-off-by: Zefan Li

ARM: 7880/1: Clear the IT state independent of the Thumb-2 mode

2016-04-27T10:55:19+00:00

commit 6ecf830e5029598732e04067e325d946097519cb upstream.

The ARM architecture reference specifies that the IT state bits in the
PSR must be all zeros in ARM mode or behavior is unspecified.  On the
Qualcomm Snapdragon S4/Krait architecture CPUs the processor continues
to consider the IT state bits while in ARM mode.  This makes it so
that some instructions are skipped by the CPU.

Signed-off-by: T.J. Purtell 
[rmk+kernel@arm.linux.org.uk: fixed whitespace formatting in patch]
Signed-off-by: Russell King 
Signed-off-by: Zefan Li

ARM: 8429/1: disable GCC SRA optimization

2016-04-27T10:55:18+00:00

commit a077224fd35b2f7fbc93f14cf67074fc792fbac2 upstream.

While working on the 32-bit ARM port of UEFI, I noticed a strange
corruption in the kernel log. The following snprintf() statement
(in drivers/firmware/efi/efi.c:efi_md_typeattr_format())

	snprintf(pos, size, "|%3s|%2s|%2s|%2s|%3s|%2s|%2s|%2s|%2s]",

was producing the following output in the log:

	|    |   |   |   |    |WB|WT|WC|UC]
	|    |   |   |   |    |WB|WT|WC|UC]
	|    |   |   |   |    |WB|WT|WC|UC]
	|RUN|   |   |   |    |WB|WT|WC|UC]*
	|RUN|   |   |   |    |WB|WT|WC|UC]*
	|    |   |   |   |    |WB|WT|WC|UC]
	|RUN|   |   |   |    |WB|WT|WC|UC]*
	|    |   |   |   |    |WB|WT|WC|UC]
	|RUN|   |   |   |    |   |   |   |UC]
	|RUN|   |   |   |    |   |   |   |UC]

As it turns out, this is caused by incorrect code being emitted for
the string() function in lib/vsprintf.c. The following code

	if (!(spec.flags & LEFT)) {
		while (len < spec.field_width--) {
			if (buf < end)
				*buf = ' ';
			++buf;
		}
	}
	for (i = 0; i < len; ++i) {
		if (buf < end)
			*buf = *s;
		++buf; ++s;
	}
	while (len < spec.field_width--) {
		if (buf < end)
			*buf = ' ';
		++buf;
	}

when called with len == 0, triggers an issue in the GCC SRA optimization
pass (Scalar Replacement of Aggregates), which handles promotion of signed
struct members incorrectly. This is a known but as yet unresolved issue.
(https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65932). In this particular
case, it is causing the second while loop to be executed erroneously a
single time, causing the additional space characters to be printed.

So disable the optimization by passing -fno-ipa-sra.

Acked-by: Nicolas Pitre 
Signed-off-by: Ard Biesheuvel 
Signed-off-by: Russell King 
Signed-off-by: Zefan Li

ARM: Fix incorrect backport of 0b59d8806a31

2015-10-22T01:20:08+00:00

Reported-by: Jim Faulkner 
Fixed-by: Nicolas Schichan 
Signed-off-by: Zefan Li

ARM: dts: imx27: only map 4 Kbyte for fec registers

2015-09-18T01:20:42+00:00

commit a29ef819f3f34f89a1b9b6a939b4c1cdfe1e85ce upstream.

According to the imx27 documentation, fec has a 4 Kbyte
memory space map. Moreover, the actual 16 Kbyte mapping
overlaps the SCC (Security Controller) memory register
space. So, we reduce the memory register space to 4 Kbyte.

Signed-off-by: Philippe Reynes 
Acked-by: Uwe Kleine-König 
Fixes: 9f0749e3eb88 ("ARM i.MX27: Add devicetree support")
Signed-off-by: Shawn Guo 
Signed-off-by: Zefan Li

ARM: net: delegate filter to kernel interpreter when imm_offset() return value can't fit into 12bits.

2015-09-18T01:20:39+00:00

commit 0b59d8806a31bb0267b3a461e8fef20c727bdbf6 upstream.

The ARM JIT code emits "ldr rX, [pc, #offset]" to access the literal
pool. #offset maximum value is 4095 and if the generated code is too
large, the #offset value can overflow and not point to the expected
slot in the literal pool. Additionally, when overflow occurs, bits of
the overflow can end up changing the destination register of the ldr
instruction.

Fix that by detecting the overflow in imm_offset() and setting a flag
that is checked for each BPF instructions converted in
build_body(). As of now it can only be detected in the second pass. As
a result the second build_body() call can now fail, so add the
corresponding cleanup code in that case.

Using multiple literal pools in the JITed code is going to require
lots of intrusive changes to the JIT code (which would better be done
as a feature instead of fix), just delegating to the kernel BPF
interpreter in that case is a more straight forward, minimal fix and
easy to backport.

Fixes: ddecdfcea0ae ("ARM: 7259/3: net: JIT compiler for packet filters")
Signed-off-by: Nicolas Schichan 
Acked-by: Daniel Borkmann 
Signed-off-by: David S. Miller 
Signed-off-by: Zefan Li

ARM: pxa: lubbock: use new pxa_cplds driver

2015-09-18T01:20:35+00:00

commit fc9e38c0f4d38bfc68b405cf48365d65f7b6319e upstream.

As the interrupt handling was transferred to the pxa_cplds driver,
make the switch in lubbock platform code.

Fixes: 157d2644cb0c ("ARM: pxa: change gpio to platform device")
Signed-off-by: Robert Jarzmik 
Acked-by: Arnd Bergmann 
Signed-off-by: Zefan Li

ARM: pxa: mainstone: use new pxa_cplds driver

2015-09-18T01:20:35+00:00

commit 277688639f98a9e34a6f109f9cd6129f92e718c1 upstream.

As the interrupt handling was transferred to the pxa_cplds driver,
make the switch in mainstone platform code.

Fixes: 157d2644cb0c ("ARM: pxa: change gpio to platform device")
Signed-off-by: Robert Jarzmik 
Acked-by: Arnd Bergmann 
Signed-off-by: Zefan Li