https://source.android.com/docs/security/bulletin/2023-02-01 CVE-2022-39189 CVE-2022-39842 CVE-2022-41222 CVE-2023-20937 CVE-2023-20938 CVE-2022-0850 * tag 'ASB-2023-02-05_4.19-stable' of https://android.googlesource.com/kernel/common: Linux 4.19.272 usb: host: xhci-plat: add wakeup entry at sysfs ipv6: ensure sane device mtu in tunnels exit: Use READ_ONCE() for all oops/warn limit reads docs: Fix path paste-o for /sys/kernel/warn_count panic: Expose "warn_count" to sysfs panic: Introduce warn_limit panic: Consolidate open-coded panic_on_warn checks exit: Allow oops_limit to be disabled exit: Expose "oops_count" to sysfs exit: Put an upper limit on how often we can oops ia64: make IA64_MCA_RECOVERY bool instead of tristate h8300: Fix build errors from do_exit() to make_task_dead() transition hexagon: Fix function name in die() objtool: Add a missing comma to avoid string concatenation exit: Add and use make_task_dead. panic: unset panic_on_warn inside panic() sysctl: add a new register_sysctl_init() interface dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init ARM: dts: imx: Fix pca9547 i2c-mux node name x86/entry/64: Add instruction suffix to SYSRET x86/asm: Fix an assembler warning with current binutils drm/i915/display: fix compiler warning about array overrun x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode" net/tg3: resolve deadlock in tg3_reset_task() during EEH net: ravb: Fix possible hang if RIS2_QFF1 happen sctp: fail if no bound addresses can be used for a given scope netrom: Fix use-after-free of a listening socket. netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() netlink: annotate data races around sk_state netlink: annotate data races around dst_portid and dst_group netlink: annotate data races around nlk->portid netlink: remove hash::nelems check in netlink_insert netfilter: nft_set_rbtree: skip elements in transaction from garbage collection net: fix UaF in netns ops registration error path EDAC/device: Respect any driver-supplied workqueue polling value ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment cifs: Fix oops due to uncleared server->smbd_conn in reconnect smbd: Make upper layer decide when to destroy the transport trace_events_hist: add check for return value of 'create_hist_field' tracing: Make sure trace_printk() can output as soon as it can be used module: Don't wait for GOING modules scsi: hpsa: Fix allocation size for scsi_host_alloc() Bluetooth: hci_sync: cancel cmd_timer if hci_open failed fs: reiserfs: remove useless new_opts in reiserfs_remount perf env: Do not return pointers to local variables block: fix and cleanup bio_check_ro netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state w1: fix WARNING after calling w1_process() w1: fix deadloop in __w1_remove_master_device() tcp: avoid the lookup process failing to get sk in ehash table dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node() dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error handling dmaengine: xilinx_dma: program hardware supported buffer length dmaengine: xilinx_dma: commonize DMA copy size calculation HID: betop: check shape of output reports net: macb: fix PTP TX timestamp failure due to packet padding dmaengine: Fix double increment of client_count in dma_chan_get() net: mlx5: eliminate anonymous module_init & module_exit usb: gadget: f_fs: Ensure ep0req is dequeued before free_request usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait HID: check empty report_list in hid_validate_values() net: mdio: validate parameter addr in mdiobus_get_phy() net: usb: sr9700: Handle negative len wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid net: nfc: Fix use-after-free in local_cleanup() phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on() bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation amd-xgbe: Delay AN timeout during KR training amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent affs: initialize fsdata in affs_truncate() IB/hfi1: Fix expected receive setup error exit issues IB/hfi1: Reserve user expected TIDs IB/hfi1: Reject a zero-length user expected buffer tomoyo: fix broken dependency on *.conf.default EDAC/highbank: Fix memory leak in highbank_mc_probe() HID: intel_ish-hid: Add check for ishtp_dma_tx_map ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' UPSTREAM: tcp: fix tcp_rmem documentation UPSTREAM: nvmem: core: skip child nodes not matching binding BACKPORT: nvmem: core: Fix a resource leak on error in nvmem_add_cells_from_of() UPSTREAM: sched/eas: Don't update misfit status if the task is pinned BACKPORT: arm64: link with -z norelro for LLD or aarch64-elf UPSTREAM: driver: core: Fix list corruption after device_del() UPSTREAM: coresight: tmc-etr: Fix barrier packet insertion for perf buffer UPSTREAM: f2fs: fix double free of unicode map BACKPORT: net: xfrm: fix memory leak in xfrm_user_policy() UPSTREAM: xfrm/compat: Don't allocate memory with __GFP_ZERO UPSTREAM: xfrm/compat: memset(0) 64-bit padding at right place UPSTREAM: xfrm/compat: Translate by copying XFRMA_UNSPEC attribute UPSTREAM: scsi: ufs: Fix missing brace warning for old compilers UPSTREAM: arm64: vdso32: make vdso32 install conditional UPSTREAM: loop: unset GENHD_FL_NO_PART_SCAN on LOOP_CONFIGURE BACKPORT: drm/virtio: fix missing dma_fence_put() in virtio_gpu_execbuffer_ioctl() BACKPORT: sched/uclamp: Protect uclamp fast path code with static key BACKPORT: sched/uclamp: Fix initialization of struct uclamp_rq UPSTREAM: coresight: etmv4: Fix CPU power management setup in probe() function UPSTREAM: arm64: vdso: Add --eh-frame-hdr to ldflags BACKPORT: arm64: vdso: Add '-Bsymbolic' to ldflags UPSTREAM: drm/virtio: fix a wait_event condition BACKPORT: sched/topology: Don't try to build empty sched domains BACKPORT: binder: prevent UAF read in print_binder_transaction_log_entry() BACKPORT: copy_process(): don't use ksys_close() on cleanups BACKPORT: arm64: vdso: Remove unnecessary asm-offsets.c definitions UPSTREAM: locking/lockdep, cpu/hotplug: Annotate AP thread Revert "xhci: Add a flag to disable USB3 lpm on a xhci root port level." BACKPORT: mac80211_hwsim: add concurrent channels scanning support over virtio BACKPORT: mac80211_hwsim: add frame transmission support over virtio This allows communication with external entities. BACKPORT: driver core: Skip unnecessary work when device doesn't have sync_state() Linux 4.19.271 x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN Revert "ext4: generalize extents status tree search functions" Revert "ext4: add new pending reservation mechanism" Revert "ext4: fix reserved cluster accounting at delayed write time" Revert "ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline" gsmi: fix null-deref in gsmi_get_variable serial: atmel: fix incorrect baudrate setup serial: pch_uart: Pass correct sg to dma_unmap_sg() usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210 usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() usb: gadget: g_webcam: Send color matching descriptor per frame usb: typec: altmodes/displayport: Fix pin assignment calculation usb: typec: altmodes/displayport: Add pin assignment helper usb: host: ehci-fsl: Fix module alias USB: serial: cp210x: add SCALANCE LPE-9000 device id cifs: do not include page data when checking signature mmc: sunxi-mmc: Fix clock refcount imbalance during unbind comedi: adv_pci1760: Fix PWM instruction handling usb: core: hub: disable autosuspend for TI TUSB8041 USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100 USB: serial: option: add Quectel EM05CN modem USB: serial: option: add Quectel EM05CN (SG) modem USB: serial: option: add Quectel EC200U modem USB: serial: option: add Quectel EM05-G (RS) modem USB: serial: option: add Quectel EM05-G (CS) modem USB: serial: option: add Quectel EM05-G (GR) modem prlimit: do_prlimit needs to have a speculation check xhci: Add a flag to disable USB3 lpm on a xhci root port level. xhci: Fix null pointer dereference when host dies usb: xhci: Check endpoint is valid before dereferencing it xhci-pci: set the dma max_seg_size nilfs2: fix general protection fault in nilfs_btree_insert() Add exception protection processing for vd in axi_chan_handle_err function f2fs: let's avoid panic if extent_tree is not created RDMA/srp: Move large values to a new enum for gcc13 net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats pNFS/filelayout: Fix coalescing test for single DS ANDROID: usb: f_accessory: Check buffer size when initialised via composite Linux 4.19.270 serial: tegra: Change lower tolerance baud rate limit for tegra20 and tegra30 serial: tegra: Only print FIFO error message when an error occurs tty: serial: tegra: Handle RX transfer in PIO mode if DMA wasn't started Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout" efi: fix NULL-deref in init error path arm64: cmpxchg_double*: hazard against entire exchange variable drm/virtio: Fix GEM handle creation UAF x86/resctrl: Fix task CLOSID/RMID update race x86/resctrl: Use task_curr() instead of task_struct->on_cpu to prevent unnecessary IPI iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe() iommu/mediatek-v1: Add error handle for mtk_iommu_probe net/mlx5: Fix ptp max frequency adjustment range net/mlx5: Rename ptp clock info nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() hvc/xen: lock console list traversal regulator: da9211: Use irq handler when ready EDAC/device: Fix period calculation in edac_device_reset_delay_period() x86/boot: Avoid using Intel mnemonics in AT&T syntax asm netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline ext4: fix reserved cluster accounting at delayed write time ext4: add new pending reservation mechanism ext4: generalize extents status tree search functions ext4: fix uninititialized value in 'ext4_evict_inode' ext4: fix use-after-free in ext4_orphan_cleanup ext4: lost matching-pair of trace in ext4_truncate ext4: fix bug_on in __es_tree_search caused by bad quota inode quota: Factor out setup of quota inode usb: ulpi: defer ulpi_register on ulpi_read_id timeout kest.pl: Fix grub2 menu handling for rebooting ktest.pl: Fix incorrect reboot for grub2bls ktest: introduce grub2bls REBOOT_TYPE option ktest: cleanup get_grub_index ktest: introduce _get_grub_index ktest: Add support for meta characters in GRUB_MENU ALSA: hda/hdmi: fix failures at PCM open on Intel ICL and later wifi: wilc1000: sdio: fix module autoloading ipv6: raw: Deduct extension header length in rawv6_push_pending_frames platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe cifs: Fix uninitialized memory read for smb311 posix symlink create ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF net/ulp: prevent ULP without clone op from entering the LISTEN status s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple() perf auxtrace: Fix address filter duplicate symbol selection docs: Fix the docs build with Sphinx 6.0 net: sched: disallow noqueue for qdisc classes driver core: Fix bus_type.match() error handling in __driver_attach() parisc: Align parisc MADV_XXX constants with all other architectures mbcache: Avoid nesting of cache->c_list_lock under bit locks hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling hfs/hfsplus: use WARN_ON for sanity check ext4: don't allow journal inode to have encrypt flag riscv: uaccess: fix type of 0 variable on error in get_user() nfsd: fix handling of readdir in v4root vs. mount upcall timeout x86/bugs: Flush IBP in ib_prctl_set() ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet udf: Fix extension of the last extent in the file caif: fix memory leak in cfctrl_linkup_request() usb: rndis_host: Secure rndis_query check against int overflow net: sched: atm: dont intepret cls results when asked to drop RDMA/mlx5: Fix validation of max_rd_atomic caps for DC net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe net: amd-xgbe: add missed tasklet_kill nfc: Fix potential resource leaks qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure bpf: pull before calling skb_postpull_rcsum() SUNRPC: ensure the matching upcall is in-flight upon downcall ext4: fix deadlock due to mbcache entry corruption mbcache: automatically delete entries from cache on freeing ext4: fix race when reusing xattr blocks ext4: unindent codeblock in ext4_xattr_block_set() ext4: remove EA inode entry from mbcache on inode eviction mbcache: add functions to delete entry if unused mbcache: don't reclaim used entries ext4: use kmemdup() to replace kmalloc + memcpy ext4: correct inconsistent error msg in nojournal mode ext4: goto right label 'failed_mount3a' driver core: Set deferred_probe_timeout to a longer default if CONFIG_MODULES is set ravb: Fix "failed to switch device to config mode" message during unbind perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged data perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor dm thin: resume even if in FAIL mode media: s5p-mfc: Fix in register read and write for H264 media: s5p-mfc: Clear workbit to handle error condition media: s5p-mfc: Fix to handle reference queue during finishing btrfs: replace strncpy() with strscpy() btrfs: send: avoid unnecessary backref lookups when finding clone source ext4: allocate extended attribute value in vmalloc area ext4: avoid unaccounted block allocation when expanding inode ext4: initialize quota before expanding inode in setproject ioctl ext4: fix inode leak in ext4_xattr_inode_create() on an error path ext4: avoid BUG_ON when creating xattrs ext4: fix error code return to user-space in ext4_get_branch() ext4: fix corruption when online resizing a 1K bigalloc fs ext4: init quota for 'old.inode' in 'ext4_rename' ext4: fix bug_on in __es_tree_search caused by bad boot loader inode ext4: add helper to check quota inums ext4: fix undefined behavior in bit shift for ext4_check_flag_values ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop drm/vmwgfx: Validate the box size for the snooped cursor drm/connector: send hotplug uevent on connector cleanup device_cgroup: Roll back to original exceptions after copy failure parisc: led: Fix potential null-ptr-deref in start_task() iommu/amd: Fix ivrs_acpihid cmdline parsing code crypto: n2 - add missing hash statesize PCI/sysfs: Fix double free in error path PCI: Fix pci_device_is_present() for VFs by checking PF ipmi: fix use after free in _ipmi_destroy_user() ima: Fix a potential NULL pointer access in ima_restore_measurement_list ipmi: fix long wait in unload when IPMI disconnect md/bitmap: Fix bitmap chunk size overflow issues cifs: fix confusing debug message media: dvb-core: Fix UAF due to refcount races at releasing media: dvb-core: Fix double free in dvb_register_device() ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line x86/microcode/intel: Do not retry microcode reloading on the APs dm cache: set needs_check flag after aborting metadata dm cache: Fix UAF in destroy() dm thin: Fix UAF in run_timer_softirq() dm thin: Use last transaction's pmd->root when commit failed dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort binfmt: Fix error return code in load_elf_fdpic_binary() binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf selftests: Use optional USERCFLAGS and USERLDFLAGS ARM: ux500: do not directly dereference __iomem ktest.pl minconfig: Unset configs instead of just removing them soc: qcom: Select REMAP_MMIO for LLCC driver media: stv0288: use explicitly signed char SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING md: fix a crash in mempool_free pnode: terminate at peers of source ALSA: line6: fix stack overflow in line6_midi_transmit ALSA: line6: correct midi status byte when receiving data from podxt ovl: Use ovl mounter's fsuid and fsgid in ovl_link() hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount HID: plantronics: Additional PIDs for double volume key presses quirk powerpc/rtas: avoid scheduling in rtas_os_term() powerpc/rtas: avoid device tree lookups in rtas_os_term() ata: ahci: Fix PCS quirk application for suspend media: dvbdev: fix refcnt bug media: dvbdev: fix build warning due to comments gcov: add support for checksum field iio: adc: ad_sigma_delta: do not use internal iio_dev lock reiserfs: Add missing calls to reiserfs_security_free() HID: wacom: Ensure bootloader PID is usable in hidraw mode usb: dwc3: core: defer probe on ulpi_read_id timeout pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion ASoC: rt5670: Remove unbalanced pm_runtime_put() ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() ASoC: wm8994: Fix potential deadlock ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume() ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe() orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid() clk: st: Fix memory leak in st_of_quadfs_setup() media: si470x: Fix use-after-free in si470x_int_in_callback() mmc: f-sdh30: Add quirks for broken timeout clock capability regulator: core: fix use_count leakage when handling boot-on blk-mq: fix possible memleak when register 'hctx' failed media: dvb-usb: fix memory leak in dvb_usb_adapter_init() media: dvbdev: adopts refcnt to avoid UAF media: dvb-frontends: fix leak of memory fw ppp: associate skb with a device at tx mrp: introduce active flags to prevent UAF when applicant uninit md/raid1: stop mdx_raid1 thread when raid1 array run failed drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() drm/sti: Use drm_mode_copy() s390/lcs: Fix return type of lcs_start_xmit() s390/netiucv: Fix return type of netiucv_tx() s390/ctcm: Fix return type of ctc{mp,}m_tx() drm/amdgpu: Fix type of second parameter in trans_msg() callback igb: Do not free q_vector unless new one was allocated wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() hamradio: baycom_epp: Fix return type of baycom_send_packet() net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() bpf: make sure skb->len != 0 when redirecting to a tunneling device ipmi: fix memleak when unload ipmi driver ASoC: codecs: rt298: Add quirk for KBL-R RVP platform wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out wifi: ath9k: verify the expected usb_endpoints are present hfs: fix OOB Read in __hfs_brec_find acct: fix potential integer overflow in encode_comp_t() nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() ACPICA: Fix error code path in acpi_ds_call_control_method() fs: jfs: fix shift-out-of-bounds in dbDiscardAG udf: Avoid double brelse() in udf_rename() fs: jfs: fix shift-out-of-bounds in dbAllocAG binfmt_misc: fix shift-out-of-bounds in check_special_flags net: stream: purge sk_error_queue in sk_stream_kill_queues() myri10ge: Fix an error handling path in myri10ge_probe() rxrpc: Fix missing unlock in rxrpc_do_sendmsg() net_sched: reject TCF_EM_SIMPLE case for complex ematch module skbuff: Account for tail adjustment during pull operations openvswitch: Fix flow lookup to use unmasked key rtc: mxc_v2: Add missing clk_disable_unprepare() r6040: Fix kmemleak in probe and remove nfc: pn533: Clear nfc_target before being used mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() selftests/powerpc: Fix resource leaks powerpc/hv-gpci: Fix hv_gpci event list powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe() powerpc/perf: callchain validate kernel stack pointer bounds powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data() cxl: Fix refcount leak in cxl_calc_capp_routing powerpc/52xx: Fix a resource leak in an error handling path macintosh/macio-adb: check the return value of ioremap() macintosh: fix possible memory leak in macio_add_one_device() iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() iommu/amd: Fix pci device refcount leak in ppr_notifier() rtc: snvs: Allow a time difference on clock register read include/uapi/linux/swab: Fix potentially missing __always_inline HSI: omap_ssi_core: Fix error handling in ssi_init() perf symbol: correction while adjusting symbol power: supply: fix residue sysfs file in error handle route of __power_supply_register() HSI: omap_ssi_core: fix possible memory leak in ssi_probe() HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() fbdev: vermilion: decrease reference count in error path fbdev: via: Fix error in via_core_init() fbdev: pm2fb: fix missing pci_disable_device() fbdev: ssd1307fb: Drop optional dependency samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe() tracing/hist: Fix issue of losting command info in error_log usb: storage: Add check for kcalloc i2c: ismt: Fix an out-of-bounds bug in ismt_access() vme: Fix error not catched in fake_init() staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor() staging: rtl8192u: Fix use after free in ieee80211_rx() i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe chardev: fix error handling in cdev_device_add() mcb: mcb-parse: fix error handing in chameleon_parse_gdd() drivers: mcb: fix resource leak in mcb_probe() usb: gadget: f_hid: fix refcount leak on error path usb: gadget: f_hid: fix f_hidg lifetime vs cdev usb: gadget: f_hid: optional SETUP/SET_REPORT mode cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() test_firmware: fix memory leak in test_firmware_init() serial: sunsab: Fix error handling in sunsab_init() serial: altera_uart: fix locking in polling mode tty: serial: altera_uart_{r,t}x_chars() need only uart_port tty: serial: clean up stop-tx part in altera_uart_tx_chars() serial: pch: Fix PCI device refcount leak in pch_request_dma() serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle. serial: amba-pl011: avoid SBSA UART accessing DMACR register usb: typec: Check for ops->exit instead of ops->enter in altmode_exit staging: vme_user: Fix possible UAF in tsi148_dma_list_add usb: fotg210-udc: Fix ages old endianness issues uio: uio_dmem_genirq: Fix deadlock between irq config and handling uio: uio_dmem_genirq: Fix missing unlock in irq configuration vfio: platform: Do not pass return buffer to ACPI _RST method class: fix possible memory leak in __class_register() serial: tegra: Read DMA status before terminating tty: serial: tegra: Activate RX DMA transfer by request serial: tegra: Add PIO mode support serial: tegra: report clk rate errors serial: tegra: add support to adjust baud rate serial: tegra: add support to use 8 bytes trigger serial: tegra: set maximum num of uart ports to 8 serial: tegra: check for FIFO mode enabled status serial: tegra: avoid reg access when clk disabled drivers: dio: fix possible memory leak in dio_init() IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces hwrng: geode - Fix PCI device refcount leak hwrng: amd - Fix PCI device refcount leak crypto: img-hash - Fix variable dereferenced before check 'hdev->req' orangefs: Fix sysfs not cleanup when dev init failed RDMA/hfi1: Fix error return code in parse_platform_config() scsi: snic: Fix possible UAF in snic_tgt_create() scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails scsi: ipr: Fix WARNING in ipr_init() scsi: fcoe: Fix possible name leak when device_register() fails scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device() scsi: hpsa: Fix error handling in hpsa_add_sas_host() crypto: tcrypt - Fix multibuffer skcipher speed test mem leak scsi: hpsa: Fix possible memory leak in hpsa_init_one() scsi: hpsa: use local workqueues instead of system workqueues RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed crypto: ccree - Make cc_debugfs_global_fini() available for module init function RDMA/hfi: Decrease PCI device reference count in error path PCI: Check for alloc failure in pci_request_irq() scsi: scsi_debug: Fix a warning in resp_write_scat() RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port f2fs: fix normal discard process apparmor: Fix abi check to include v8 abi apparmor: fix lockdep warning when removing a namespace apparmor: fix a memleak in multi_transaction_new() stmmac: fix potential division by 0 Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() ntb_netdev: Use dev_kfree_skb_any() in interrupt context net: lan9303: Fix read error execution path net: amd-xgbe: Check only the minimum speed for active/passive cables net: amd-xgbe: Fix logic around active and passive cables net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave() net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave() net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave() net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave() net/tunnel: wait until all sk_user_data reader finish before releasing the sock net: farsync: Fix kmemleak when rmmods farsync ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() net: defxx: Fix missing err handling in dfx_init() net: vmw_vsock: vmci: Check memcpy_from_msg() clk: socfpga: use clk_hw_register for a5/c5 clk: socfpga: clk-pll: Remove unused variable 'rc' blktrace: Fix output non-blktrace event when blk_classic option enabled wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware() rtl8xxxu: add enumeration for channel bandwidth wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h clk: samsung: Fix memory leak in _samsung_clk_register_pll() media: coda: Add check for kmalloc media: coda: Add check for dcoda_iram_alloc media: c8sectpfe: Add of_node_put() when breaking out of loop mmc: mmci: fix return value check of mmc_add_host() mmc: wbsd: fix return value check of mmc_add_host() mmc: via-sdmmc: fix return value check of mmc_add_host() mmc: meson-gx: fix return value check of mmc_add_host() mmc: atmel-mci: fix return value check of mmc_add_host() mmc: wmt-sdmmc: fix return value check of mmc_add_host() mmc: vub300: fix return value check of mmc_add_host() mmc: toshsd: fix return value check of mmc_add_host() mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() mmc: mxcmmc: fix return value check of mmc_add_host() mmc: moxart: fix return value check of mmc_add_host() NFSv4.x: Fail client initialisation if state manager thread can't run SUNRPC: Fix missing release socket in rpc_sockname() ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt media: saa7164: fix missing pci_disable_device() regulator: core: fix module refcount leak in set_supply() wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails bonding: uninitialized variable in bond_miimon_inspect() ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() ALSA: asihpi: fix missing pci_disable_device() NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn NFSv4.2: Fix a memory stomp in decode_attr_security_label drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe() media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() media: dvb-core: Fix ignored return value in dvb_register_frontend() pinctrl: pinconf-generic: add missing of_node_put() media: imon: fix a race condition in send_packet() drbd: remove call to memset before free device/resource/connection mtd: maps: pxa2xx-flash: fix memory leak in probe bonding: Export skip slave logic to function clk: rockchip: Fix memory leak in rockchip_clk_register_pll() ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT HID: hid-sensor-custom: set fixed size for custom attributes media: platform: exynos4-is: Fix error handling in fimc_md_init() media: solo6x10: fix possible memory leak in solo_sysfs_init() Input: elants_i2c - properly handle the reset GPIO when power is off mtd: lpddr2_nvm: Fix possible null-ptr-deref wifi: ath10k: Fix return value in ath10k_pci_init() ima: Fix misuse of dereference of pointer in template_desc_init_fields() regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() ASoC: pxa: fix null-pointer dereference in filter() drm/radeon: Add the missed acpi_put_table() to fix memory leak net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write() media: camss: Clean up received buffers on failed start of streaming wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port mtd: Fix device name leak when register device failed in add_mtd_device() media: vivid: fix compose size exceed boundary spi: Update reference to struct spi_controller can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming can: kvaser_usb: Add struct kvaser_usb_busparams can: kvaser_usb_leaf: Fix bogus restart events can: kvaser_usb_leaf: Fix wrong CAN state after stopping can: kvaser_usb_leaf: Fix improved state not being reported can: kvaser_usb_leaf: Set Warning state even without bus errors can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device can: kvaser_usb: do not increase tx statistics when sending error message frames media: i2c: ad5820: Fix error path pata_ipx4xx_cf: Fix unsigned comparison with less than zero wifi: rtl8xxxu: Fix reading the vendor of combo chips wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() rapidio: devices: fix missing put_device in mport_cdev_open hfs: Fix OOB Write in hfs_asc2mac relay: fix type mismatch when allocating memory in relay_create_buf() eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD rapidio: fix possible UAF when kfifo_alloc() fails fs: sysv: Fix sysv_nblocks() returns wrong value MIPS: BCM63xx: Add check for NULL for clk in clk_enable platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() PM: runtime: Do not call __rpm_callback() from rpm_idle() PM: runtime: Improve path in rpm_idle() when no callback xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() x86/xen: Fix memory leak in xen_init_lock_cpu() x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() xen/events: only register debug interrupt for 2-level events uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() clocksource/drivers/sh_cmt: Make sure channel clock supply is enabled rapidio: rio: fix possible name leak in rio_register_mport() rapidio: fix possible name leaks when rio_add_device() fails debugfs: fix error when writing negative value to atomic_t debugfs file lib/notifier-error-inject: fix error when writing -errno to debugfs file libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value cpufreq: amd_freq_sensitivity: Add missing pci_dev_put() irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() PNP: fix name memory leak in pnp_alloc_dev() MIPS: vpe-cmp: fix possible memory leak while module exiting MIPS: vpe-mt: fix possible memory leak while module exiting ocfs2: fix memory leak in ocfs2_stack_glue_init() proc: fixup uptime selftest timerqueue: Use rb_entry_safe() in timerqueue_getnext() perf: Fix possible memleak in pmu_dev_alloc() selftests/ftrace: event_triggers: wait longer for test_event_enable fs: don't audit the capability check in simple_xattr_list() alpha: fix syscall entry in !AUDUT_SYSCALL case cpuidle: dt: Return the correct numbers of parsed idle states tpm/tpm_crb: Fix error message in __crb_relinquish_locality() pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP ARM: mmp: fix timer_read delay pstore/ram: Fix error return code in ramoops_probe() ARM: dts: turris-omnia: Add switch port 6 node ARM: dts: turris-omnia: Add ethernet aliases ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names arm64: dts: mt2712e: Fix unit address for pinctrl node arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init() soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe arm: dts: spear600: Fix clcd interrupt drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static ARM: dts: qcom: apq8064: fix coresight compatible usb: musb: remove extra check in musb_gadget_vbus_draw net: loopback: use NET_NAME_PREDICTABLE for name_assign_type Bluetooth: L2CAP: Fix u8 overflow igb: Initialize mailbox message for VF reset USB: serial: f81534: fix division by zero on line-speed change USB: serial: cp210x: add Kamstrup RF sniffer PIDs USB: serial: option: add Quectel EM05-G modem usb: gadget: uvc: Prevent buffer overflow in setup handler udf: Fix extending file within last block udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size udf: Fix preallocation discarding at indirect extent boundary udf: Discard preallocation before extending file with a hole perf script python: Remove explicit shebang from tests/attr.c ASoC: ops: Correct bounds check for second channel on SX controls can: mcba_usb: Fix termination command argument can: sja1000: fix size of OCR_MODE_MASK define pinctrl: meditatek: Startup with the IRQs disabled ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() nfp: fix use-after-free in area_cache_get() block: unhash blkdev part inode when the part is deleted mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths mm/khugepaged: fix GUP-fast interaction by sending IPI ANDROID: Add more hvc devices for virtio-console. Conflicts: drivers/base/core.c drivers/edac/edac_device.c drivers/hwtracing/coresight/coresight-etm4x.c drivers/net/wireless/mac80211_hwsim.c drivers/scsi/ufs/ufshcd-crypto.c drivers/usb/gadget/function/f_fs.c drivers/usb/gadget/function/f_hid.c Change-Id: Ied998db07e927ccb3376a78f044df36088d9e3b8
996 lines
23 KiB
C
996 lines
23 KiB
C
/*
|
|
* linux/arch/arm/kernel/traps.c
|
|
*
|
|
* Copyright (C) 1995-2009 Russell King
|
|
* Fragments that appear the same as linux/arch/i386/kernel/traps.c (C) Linus Torvalds
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*
|
|
* 'traps.c' handles hardware exceptions after we have saved some state in
|
|
* 'linux/arch/arm/lib/traps.S'. Mostly a debugging aid, but will probably
|
|
* kill the offending process.
|
|
*/
|
|
#include <linux/signal.h>
|
|
#include <linux/personality.h>
|
|
#include <linux/kallsyms.h>
|
|
#include <linux/spinlock.h>
|
|
#include <linux/uaccess.h>
|
|
#include <linux/hardirq.h>
|
|
#include <linux/kdebug.h>
|
|
#include <linux/kprobes.h>
|
|
#include <linux/module.h>
|
|
#include <linux/kexec.h>
|
|
#include <linux/bug.h>
|
|
#include <linux/delay.h>
|
|
#include <linux/init.h>
|
|
#include <linux/sched/signal.h>
|
|
#include <linux/sched/debug.h>
|
|
#include <linux/sched/task_stack.h>
|
|
#include <linux/irq.h>
|
|
|
|
#include <linux/atomic.h>
|
|
#include <asm/arch_timer.h>
|
|
#include <asm/cacheflush.h>
|
|
#include <asm/exception.h>
|
|
#include <asm/spectre.h>
|
|
#include <asm/unistd.h>
|
|
#include <asm/traps.h>
|
|
#include <asm/ptrace.h>
|
|
#include <asm/unwind.h>
|
|
#include <asm/tls.h>
|
|
#include <asm/system_misc.h>
|
|
#include <asm/opcodes.h>
|
|
|
|
|
|
static const char *handler[]= {
|
|
"prefetch abort",
|
|
"data abort",
|
|
"address exception",
|
|
"interrupt",
|
|
"undefined instruction",
|
|
};
|
|
|
|
void *vectors_page;
|
|
|
|
#ifdef CONFIG_DEBUG_USER
|
|
unsigned int user_debug;
|
|
|
|
static int __init user_debug_setup(char *str)
|
|
{
|
|
get_option(&str, &user_debug);
|
|
return 1;
|
|
}
|
|
__setup("user_debug=", user_debug_setup);
|
|
#endif
|
|
|
|
static void dump_mem(const char *, const char *, unsigned long, unsigned long);
|
|
|
|
void dump_backtrace_entry(unsigned long where, unsigned long from, unsigned long frame)
|
|
{
|
|
unsigned long end = frame + 4 + sizeof(struct pt_regs);
|
|
|
|
#ifdef CONFIG_KALLSYMS
|
|
printk("[<%08lx>] (%ps) from [<%08lx>] (%pS)\n", where, (void *)where, from, (void *)from);
|
|
#else
|
|
printk("Function entered at [<%08lx>] from [<%08lx>]\n", where, from);
|
|
#endif
|
|
|
|
if (in_entry_text(from) && end <= ALIGN(frame, THREAD_SIZE))
|
|
dump_mem("", "Exception stack", frame + 4, end);
|
|
}
|
|
|
|
void dump_backtrace_stm(u32 *stack, u32 instruction)
|
|
{
|
|
char str[80], *p;
|
|
unsigned int x;
|
|
int reg;
|
|
|
|
for (reg = 10, x = 0, p = str; reg >= 0; reg--) {
|
|
if (instruction & BIT(reg)) {
|
|
p += sprintf(p, " r%d:%08x", reg, *stack--);
|
|
if (++x == 6) {
|
|
x = 0;
|
|
p = str;
|
|
printk("%s\n", str);
|
|
}
|
|
}
|
|
}
|
|
if (p != str)
|
|
printk("%s\n", str);
|
|
}
|
|
|
|
#ifndef CONFIG_ARM_UNWIND
|
|
/*
|
|
* Stack pointers should always be within the kernels view of
|
|
* physical memory. If it is not there, then we can't dump
|
|
* out any information relating to the stack.
|
|
*/
|
|
static int verify_stack(unsigned long sp)
|
|
{
|
|
if (sp < PAGE_OFFSET ||
|
|
(sp > (unsigned long)high_memory && high_memory != NULL))
|
|
return -EFAULT;
|
|
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
/*
|
|
* Dump out the contents of some memory nicely...
|
|
*/
|
|
static void dump_mem(const char *lvl, const char *str, unsigned long bottom,
|
|
unsigned long top)
|
|
{
|
|
unsigned long first;
|
|
mm_segment_t fs;
|
|
int i;
|
|
|
|
/*
|
|
* We need to switch to kernel mode so that we can use __get_user
|
|
* to safely read from kernel space. Note that we now dump the
|
|
* code first, just in case the backtrace kills us.
|
|
*/
|
|
fs = get_fs();
|
|
set_fs(KERNEL_DS);
|
|
|
|
printk("%s%s(0x%08lx to 0x%08lx)\n", lvl, str, bottom, top);
|
|
|
|
for (first = bottom & ~31; first < top; first += 32) {
|
|
unsigned long p;
|
|
char str[sizeof(" 12345678") * 8 + 1];
|
|
|
|
memset(str, ' ', sizeof(str));
|
|
str[sizeof(str) - 1] = '\0';
|
|
|
|
for (p = first, i = 0; i < 8 && p < top; i++, p += 4) {
|
|
if (p >= bottom && p < top) {
|
|
unsigned long val;
|
|
if (__get_user(val, (unsigned long *)p) == 0)
|
|
sprintf(str + i * 9, " %08lx", val);
|
|
else
|
|
sprintf(str + i * 9, " ????????");
|
|
}
|
|
}
|
|
printk("%s%04lx:%s\n", lvl, first & 0xffff, str);
|
|
}
|
|
|
|
set_fs(fs);
|
|
}
|
|
|
|
static void __dump_instr(const char *lvl, struct pt_regs *regs)
|
|
{
|
|
unsigned long addr = instruction_pointer(regs);
|
|
const int thumb = thumb_mode(regs);
|
|
const int width = thumb ? 4 : 8;
|
|
char str[sizeof("00000000 ") * 5 + 2 + 1], *p = str;
|
|
int i;
|
|
|
|
/*
|
|
* Note that we now dump the code first, just in case the backtrace
|
|
* kills us.
|
|
*/
|
|
|
|
for (i = -4; i < 1 + !!thumb; i++) {
|
|
unsigned int val, bad;
|
|
|
|
if (thumb)
|
|
bad = get_user(val, &((u16 *)addr)[i]);
|
|
else
|
|
bad = get_user(val, &((u32 *)addr)[i]);
|
|
|
|
if (!bad)
|
|
p += sprintf(p, i == 0 ? "(%0*x) " : "%0*x ",
|
|
width, val);
|
|
else {
|
|
p += sprintf(p, "bad PC value");
|
|
break;
|
|
}
|
|
}
|
|
printk("%sCode: %s\n", lvl, str);
|
|
}
|
|
|
|
static void dump_instr(const char *lvl, struct pt_regs *regs)
|
|
{
|
|
mm_segment_t fs;
|
|
|
|
if (!user_mode(regs)) {
|
|
fs = get_fs();
|
|
set_fs(KERNEL_DS);
|
|
__dump_instr(lvl, regs);
|
|
set_fs(fs);
|
|
} else {
|
|
__dump_instr(lvl, regs);
|
|
}
|
|
}
|
|
|
|
#ifdef CONFIG_ARM_UNWIND
|
|
static inline void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
|
|
{
|
|
unwind_backtrace(regs, tsk);
|
|
}
|
|
#else
|
|
static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
|
|
{
|
|
unsigned int fp, mode;
|
|
int ok = 1;
|
|
|
|
printk("Backtrace: ");
|
|
|
|
if (!tsk)
|
|
tsk = current;
|
|
|
|
if (regs) {
|
|
fp = frame_pointer(regs);
|
|
mode = processor_mode(regs);
|
|
} else if (tsk != current) {
|
|
fp = thread_saved_fp(tsk);
|
|
mode = 0x10;
|
|
} else {
|
|
asm("mov %0, fp" : "=r" (fp) : : "cc");
|
|
mode = 0x10;
|
|
}
|
|
|
|
if (!fp) {
|
|
pr_cont("no frame pointer");
|
|
ok = 0;
|
|
} else if (verify_stack(fp)) {
|
|
pr_cont("invalid frame pointer 0x%08x", fp);
|
|
ok = 0;
|
|
} else if (fp < (unsigned long)end_of_stack(tsk))
|
|
pr_cont("frame pointer underflow");
|
|
pr_cont("\n");
|
|
|
|
if (ok)
|
|
c_backtrace(fp, mode);
|
|
}
|
|
#endif
|
|
|
|
void show_stack(struct task_struct *tsk, unsigned long *sp)
|
|
{
|
|
dump_backtrace(NULL, tsk);
|
|
barrier();
|
|
}
|
|
|
|
#ifdef CONFIG_PREEMPT
|
|
#define S_PREEMPT " PREEMPT"
|
|
#else
|
|
#define S_PREEMPT ""
|
|
#endif
|
|
#ifdef CONFIG_SMP
|
|
#define S_SMP " SMP"
|
|
#else
|
|
#define S_SMP ""
|
|
#endif
|
|
#ifdef CONFIG_THUMB2_KERNEL
|
|
#define S_ISA " THUMB2"
|
|
#else
|
|
#define S_ISA " ARM"
|
|
#endif
|
|
|
|
static int __die(const char *str, int err, struct pt_regs *regs)
|
|
{
|
|
struct task_struct *tsk = current;
|
|
static int die_counter;
|
|
int ret;
|
|
|
|
pr_emerg("Internal error: %s: %x [#%d]" S_PREEMPT S_SMP S_ISA "\n",
|
|
str, err, ++die_counter);
|
|
|
|
/* trap and error numbers are mostly meaningless on ARM */
|
|
ret = notify_die(DIE_OOPS, str, regs, err, tsk->thread.trap_no, SIGSEGV);
|
|
if (ret == NOTIFY_STOP)
|
|
return 1;
|
|
|
|
print_modules();
|
|
__show_regs(regs);
|
|
pr_emerg("Process %.*s (pid: %d, stack limit = 0x%p)\n",
|
|
TASK_COMM_LEN, tsk->comm, task_pid_nr(tsk), end_of_stack(tsk));
|
|
|
|
if (!user_mode(regs) || in_interrupt()) {
|
|
dump_mem(KERN_EMERG, "Stack: ", regs->ARM_sp,
|
|
THREAD_SIZE + (unsigned long)task_stack_page(tsk));
|
|
dump_backtrace(regs, tsk);
|
|
dump_instr(KERN_EMERG, regs);
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static arch_spinlock_t die_lock = __ARCH_SPIN_LOCK_UNLOCKED;
|
|
static int die_owner = -1;
|
|
static unsigned int die_nest_count;
|
|
|
|
static unsigned long oops_begin(void)
|
|
{
|
|
int cpu;
|
|
unsigned long flags;
|
|
|
|
oops_enter();
|
|
|
|
/* racy, but better than risking deadlock. */
|
|
raw_local_irq_save(flags);
|
|
cpu = smp_processor_id();
|
|
if (!arch_spin_trylock(&die_lock)) {
|
|
if (cpu == die_owner)
|
|
/* nested oops. should stop eventually */;
|
|
else
|
|
arch_spin_lock(&die_lock);
|
|
}
|
|
die_nest_count++;
|
|
die_owner = cpu;
|
|
console_verbose();
|
|
bust_spinlocks(1);
|
|
return flags;
|
|
}
|
|
|
|
static void oops_end(unsigned long flags, struct pt_regs *regs, int signr)
|
|
{
|
|
if (regs && kexec_should_crash(current))
|
|
crash_kexec(regs);
|
|
|
|
bust_spinlocks(0);
|
|
die_owner = -1;
|
|
add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
|
|
die_nest_count--;
|
|
if (!die_nest_count)
|
|
/* Nest count reaches zero, release the lock. */
|
|
arch_spin_unlock(&die_lock);
|
|
raw_local_irq_restore(flags);
|
|
oops_exit();
|
|
|
|
if (in_interrupt())
|
|
panic("Fatal exception in interrupt");
|
|
if (panic_on_oops)
|
|
panic("Fatal exception");
|
|
if (signr)
|
|
make_task_dead(signr);
|
|
}
|
|
|
|
/*
|
|
* This function is protected against re-entrancy.
|
|
*/
|
|
void die(const char *str, struct pt_regs *regs, int err)
|
|
{
|
|
enum bug_trap_type bug_type = BUG_TRAP_TYPE_NONE;
|
|
unsigned long flags = oops_begin();
|
|
int sig = SIGSEGV;
|
|
|
|
if (!user_mode(regs))
|
|
bug_type = report_bug(regs->ARM_pc, regs);
|
|
if (bug_type != BUG_TRAP_TYPE_NONE)
|
|
str = "Oops - BUG";
|
|
|
|
if (__die(str, err, regs))
|
|
sig = 0;
|
|
|
|
oops_end(flags, regs, sig);
|
|
}
|
|
|
|
void arm_notify_die(const char *str, struct pt_regs *regs,
|
|
struct siginfo *info, unsigned long err, unsigned long trap)
|
|
{
|
|
if (user_mode(regs)) {
|
|
current->thread.error_code = err;
|
|
current->thread.trap_no = trap;
|
|
|
|
force_sig_info(info->si_signo, info, current);
|
|
} else {
|
|
die(str, regs, err);
|
|
}
|
|
}
|
|
|
|
#ifdef CONFIG_GENERIC_BUG
|
|
|
|
int is_valid_bugaddr(unsigned long pc)
|
|
{
|
|
#ifdef CONFIG_THUMB2_KERNEL
|
|
u16 bkpt;
|
|
u16 insn = __opcode_to_mem_thumb16(BUG_INSTR_VALUE);
|
|
#else
|
|
u32 bkpt;
|
|
u32 insn = __opcode_to_mem_arm(BUG_INSTR_VALUE);
|
|
#endif
|
|
|
|
if (probe_kernel_address((unsigned *)pc, bkpt))
|
|
return 0;
|
|
|
|
return bkpt == insn;
|
|
}
|
|
|
|
#endif
|
|
|
|
static LIST_HEAD(undef_hook);
|
|
static DEFINE_RAW_SPINLOCK(undef_lock);
|
|
|
|
void register_undef_hook(struct undef_hook *hook)
|
|
{
|
|
unsigned long flags;
|
|
|
|
raw_spin_lock_irqsave(&undef_lock, flags);
|
|
list_add(&hook->node, &undef_hook);
|
|
raw_spin_unlock_irqrestore(&undef_lock, flags);
|
|
}
|
|
|
|
void unregister_undef_hook(struct undef_hook *hook)
|
|
{
|
|
unsigned long flags;
|
|
|
|
raw_spin_lock_irqsave(&undef_lock, flags);
|
|
list_del(&hook->node);
|
|
raw_spin_unlock_irqrestore(&undef_lock, flags);
|
|
}
|
|
|
|
static nokprobe_inline
|
|
int call_undef_hook(struct pt_regs *regs, unsigned int instr)
|
|
{
|
|
struct undef_hook *hook;
|
|
unsigned long flags;
|
|
int (*fn)(struct pt_regs *regs, unsigned int instr) = NULL;
|
|
|
|
raw_spin_lock_irqsave(&undef_lock, flags);
|
|
list_for_each_entry(hook, &undef_hook, node)
|
|
if ((instr & hook->instr_mask) == hook->instr_val &&
|
|
(regs->ARM_cpsr & hook->cpsr_mask) == hook->cpsr_val)
|
|
fn = hook->fn;
|
|
raw_spin_unlock_irqrestore(&undef_lock, flags);
|
|
|
|
return fn ? fn(regs, instr) : 1;
|
|
}
|
|
|
|
asmlinkage void do_undefinstr(struct pt_regs *regs)
|
|
{
|
|
unsigned int instr;
|
|
siginfo_t info;
|
|
void __user *pc;
|
|
|
|
clear_siginfo(&info);
|
|
pc = (void __user *)instruction_pointer(regs);
|
|
|
|
if (processor_mode(regs) == SVC_MODE) {
|
|
#ifdef CONFIG_THUMB2_KERNEL
|
|
if (thumb_mode(regs)) {
|
|
instr = __mem_to_opcode_thumb16(((u16 *)pc)[0]);
|
|
if (is_wide_instruction(instr)) {
|
|
u16 inst2;
|
|
inst2 = __mem_to_opcode_thumb16(((u16 *)pc)[1]);
|
|
instr = __opcode_thumb32_compose(instr, inst2);
|
|
}
|
|
} else
|
|
#endif
|
|
instr = __mem_to_opcode_arm(*(u32 *) pc);
|
|
} else if (thumb_mode(regs)) {
|
|
if (get_user(instr, (u16 __user *)pc))
|
|
goto die_sig;
|
|
instr = __mem_to_opcode_thumb16(instr);
|
|
if (is_wide_instruction(instr)) {
|
|
unsigned int instr2;
|
|
if (get_user(instr2, (u16 __user *)pc+1))
|
|
goto die_sig;
|
|
instr2 = __mem_to_opcode_thumb16(instr2);
|
|
instr = __opcode_thumb32_compose(instr, instr2);
|
|
}
|
|
} else {
|
|
if (get_user(instr, (u32 __user *)pc))
|
|
goto die_sig;
|
|
instr = __mem_to_opcode_arm(instr);
|
|
}
|
|
|
|
if (call_undef_hook(regs, instr) == 0)
|
|
return;
|
|
|
|
die_sig:
|
|
#ifdef CONFIG_DEBUG_USER
|
|
if (user_debug & UDBG_UNDEFINED) {
|
|
pr_info("%s (%d): undefined instruction: pc=%p\n",
|
|
current->comm, task_pid_nr(current), pc);
|
|
__show_regs(regs);
|
|
dump_instr(KERN_INFO, regs);
|
|
}
|
|
#endif
|
|
|
|
info.si_signo = SIGILL;
|
|
info.si_errno = 0;
|
|
info.si_code = ILL_ILLOPC;
|
|
info.si_addr = pc;
|
|
|
|
arm_notify_die("Oops - undefined instruction", regs, &info, 0, 6);
|
|
}
|
|
NOKPROBE_SYMBOL(do_undefinstr)
|
|
|
|
/*
|
|
* Handle FIQ similarly to NMI on x86 systems.
|
|
*
|
|
* The runtime environment for NMIs is extremely restrictive
|
|
* (NMIs can pre-empt critical sections meaning almost all locking is
|
|
* forbidden) meaning this default FIQ handling must only be used in
|
|
* circumstances where non-maskability improves robustness, such as
|
|
* watchdog or debug logic.
|
|
*
|
|
* This handler is not appropriate for general purpose use in drivers
|
|
* platform code and can be overrideen using set_fiq_handler.
|
|
*/
|
|
asmlinkage void __exception_irq_entry handle_fiq_as_nmi(struct pt_regs *regs)
|
|
{
|
|
struct pt_regs *old_regs = set_irq_regs(regs);
|
|
|
|
nmi_enter();
|
|
|
|
/* nop. FIQ handlers for special arch/arm features can be added here. */
|
|
|
|
nmi_exit();
|
|
|
|
set_irq_regs(old_regs);
|
|
}
|
|
|
|
/*
|
|
* bad_mode handles the impossible case in the vectors. If you see one of
|
|
* these, then it's extremely serious, and could mean you have buggy hardware.
|
|
* It never returns, and never tries to sync. We hope that we can at least
|
|
* dump out some state information...
|
|
*/
|
|
asmlinkage void bad_mode(struct pt_regs *regs, int reason)
|
|
{
|
|
console_verbose();
|
|
|
|
pr_crit("Bad mode in %s handler detected\n", handler[reason]);
|
|
|
|
die("Oops - bad mode", regs, 0);
|
|
local_irq_disable();
|
|
panic("bad mode");
|
|
}
|
|
|
|
static int bad_syscall(int n, struct pt_regs *regs)
|
|
{
|
|
siginfo_t info;
|
|
|
|
clear_siginfo(&info);
|
|
if ((current->personality & PER_MASK) != PER_LINUX) {
|
|
send_sig(SIGSEGV, current, 1);
|
|
return regs->ARM_r0;
|
|
}
|
|
|
|
#ifdef CONFIG_DEBUG_USER
|
|
if (user_debug & UDBG_SYSCALL) {
|
|
pr_err("[%d] %s: obsolete system call %08x.\n",
|
|
task_pid_nr(current), current->comm, n);
|
|
dump_instr(KERN_ERR, regs);
|
|
}
|
|
#endif
|
|
|
|
info.si_signo = SIGILL;
|
|
info.si_errno = 0;
|
|
info.si_code = ILL_ILLTRP;
|
|
info.si_addr = (void __user *)instruction_pointer(regs) -
|
|
(thumb_mode(regs) ? 2 : 4);
|
|
|
|
arm_notify_die("Oops - bad syscall", regs, &info, n, 0);
|
|
|
|
return regs->ARM_r0;
|
|
}
|
|
|
|
static inline int
|
|
__do_cache_op(unsigned long start, unsigned long end)
|
|
{
|
|
int ret;
|
|
|
|
do {
|
|
unsigned long chunk = min(PAGE_SIZE, end - start);
|
|
|
|
if (fatal_signal_pending(current))
|
|
return 0;
|
|
|
|
ret = flush_cache_user_range(start, start + chunk);
|
|
if (ret)
|
|
return ret;
|
|
|
|
cond_resched();
|
|
start += chunk;
|
|
} while (start < end);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static inline int
|
|
do_cache_op(unsigned long start, unsigned long end, int flags)
|
|
{
|
|
if (end < start || flags)
|
|
return -EINVAL;
|
|
|
|
if (!access_ok(VERIFY_READ, start, end - start))
|
|
return -EFAULT;
|
|
|
|
return __do_cache_op(start, end);
|
|
}
|
|
|
|
/*
|
|
* Handle all unrecognised system calls.
|
|
* 0x9f0000 - 0x9fffff are some more esoteric system calls
|
|
*/
|
|
#define NR(x) ((__ARM_NR_##x) - __ARM_NR_BASE)
|
|
asmlinkage int arm_syscall(int no, struct pt_regs *regs)
|
|
{
|
|
siginfo_t info;
|
|
|
|
clear_siginfo(&info);
|
|
if ((no >> 16) != (__ARM_NR_BASE>> 16))
|
|
return bad_syscall(no, regs);
|
|
|
|
switch (no & 0xffff) {
|
|
case 0: /* branch through 0 */
|
|
info.si_signo = SIGSEGV;
|
|
info.si_errno = 0;
|
|
info.si_code = SEGV_MAPERR;
|
|
info.si_addr = NULL;
|
|
|
|
arm_notify_die("branch through zero", regs, &info, 0, 0);
|
|
return 0;
|
|
|
|
case NR(breakpoint): /* SWI BREAK_POINT */
|
|
regs->ARM_pc -= thumb_mode(regs) ? 2 : 4;
|
|
ptrace_break(current, regs);
|
|
return regs->ARM_r0;
|
|
|
|
/*
|
|
* Flush a region from virtual address 'r0' to virtual address 'r1'
|
|
* _exclusive_. There is no alignment requirement on either address;
|
|
* user space does not need to know the hardware cache layout.
|
|
*
|
|
* r2 contains flags. It should ALWAYS be passed as ZERO until it
|
|
* is defined to be something else. For now we ignore it, but may
|
|
* the fires of hell burn in your belly if you break this rule. ;)
|
|
*
|
|
* (at a later date, we may want to allow this call to not flush
|
|
* various aspects of the cache. Passing '0' will guarantee that
|
|
* everything necessary gets flushed to maintain consistency in
|
|
* the specified region).
|
|
*/
|
|
case NR(cacheflush):
|
|
return do_cache_op(regs->ARM_r0, regs->ARM_r1, regs->ARM_r2);
|
|
|
|
case NR(usr26):
|
|
if (!(elf_hwcap & HWCAP_26BIT))
|
|
break;
|
|
regs->ARM_cpsr &= ~MODE32_BIT;
|
|
return regs->ARM_r0;
|
|
|
|
case NR(usr32):
|
|
if (!(elf_hwcap & HWCAP_26BIT))
|
|
break;
|
|
regs->ARM_cpsr |= MODE32_BIT;
|
|
return regs->ARM_r0;
|
|
|
|
case NR(set_tls):
|
|
set_tls(regs->ARM_r0);
|
|
return 0;
|
|
|
|
case NR(get_tls):
|
|
return current_thread_info()->tp_value[0];
|
|
|
|
default:
|
|
/* Calls 9f00xx..9f07ff are defined to return -ENOSYS
|
|
if not implemented, rather than raising SIGILL. This
|
|
way the calling program can gracefully determine whether
|
|
a feature is supported. */
|
|
if ((no & 0xffff) <= 0x7ff)
|
|
return -ENOSYS;
|
|
break;
|
|
}
|
|
#ifdef CONFIG_DEBUG_USER
|
|
/*
|
|
* experience shows that these seem to indicate that
|
|
* something catastrophic has happened
|
|
*/
|
|
if (user_debug & UDBG_SYSCALL) {
|
|
pr_err("[%d] %s: arm syscall %d\n",
|
|
task_pid_nr(current), current->comm, no);
|
|
dump_instr("", regs);
|
|
if (user_mode(regs)) {
|
|
__show_regs(regs);
|
|
c_backtrace(frame_pointer(regs), processor_mode(regs));
|
|
}
|
|
}
|
|
#endif
|
|
info.si_signo = SIGILL;
|
|
info.si_errno = 0;
|
|
info.si_code = ILL_ILLTRP;
|
|
info.si_addr = (void __user *)instruction_pointer(regs) -
|
|
(thumb_mode(regs) ? 2 : 4);
|
|
|
|
arm_notify_die("Oops - bad syscall(2)", regs, &info, no, 0);
|
|
return 0;
|
|
}
|
|
|
|
#ifdef CONFIG_TLS_REG_EMUL
|
|
|
|
/*
|
|
* We might be running on an ARMv6+ processor which should have the TLS
|
|
* register but for some reason we can't use it, or maybe an SMP system
|
|
* using a pre-ARMv6 processor (there are apparently a few prototypes like
|
|
* that in existence) and therefore access to that register must be
|
|
* emulated.
|
|
*/
|
|
|
|
static int get_tp_trap(struct pt_regs *regs, unsigned int instr)
|
|
{
|
|
int reg = (instr >> 12) & 15;
|
|
if (reg == 15)
|
|
return 1;
|
|
regs->uregs[reg] = current_thread_info()->tp_value[0];
|
|
regs->ARM_pc += 4;
|
|
return 0;
|
|
}
|
|
|
|
static struct undef_hook arm_mrc_hook = {
|
|
.instr_mask = 0x0fff0fff,
|
|
.instr_val = 0x0e1d0f70,
|
|
.cpsr_mask = PSR_T_BIT,
|
|
.cpsr_val = 0,
|
|
.fn = get_tp_trap,
|
|
};
|
|
|
|
static int __init arm_mrc_hook_init(void)
|
|
{
|
|
register_undef_hook(&arm_mrc_hook);
|
|
return 0;
|
|
}
|
|
|
|
late_initcall(arm_mrc_hook_init);
|
|
|
|
#endif
|
|
|
|
static int get_timer_count_trap(struct pt_regs *regs, unsigned int instr)
|
|
{
|
|
u64 cval;
|
|
unsigned int res;
|
|
int rd = (instr >> 12) & 0xF;
|
|
int rn = (instr >> 16) & 0xF;
|
|
|
|
res = arm_check_condition(instr, regs->ARM_cpsr);
|
|
if (res == ARM_OPCODE_CONDTEST_FAIL) {
|
|
regs->ARM_pc += 4;
|
|
return 0;
|
|
}
|
|
|
|
if (rd == 15 || rn == 15)
|
|
return 1;
|
|
cval = arch_counter_get_cntvct();
|
|
regs->uregs[rd] = cval;
|
|
regs->uregs[rn] = cval >> 32;
|
|
regs->ARM_pc += 4;
|
|
return 0;
|
|
}
|
|
|
|
static struct undef_hook get_timer_count_hook = {
|
|
.instr_mask = 0x0ff00fff,
|
|
.instr_val = 0x0c500f1e,
|
|
.cpsr_mask = MODE_MASK,
|
|
.cpsr_val = USR_MODE,
|
|
.fn = get_timer_count_trap,
|
|
};
|
|
|
|
void get_timer_count_hook_init(void)
|
|
{
|
|
register_undef_hook(&get_timer_count_hook);
|
|
}
|
|
EXPORT_SYMBOL(get_timer_count_hook_init);
|
|
|
|
static int get_freq_trap(struct pt_regs *regs, unsigned int instr)
|
|
{
|
|
u32 fval;
|
|
unsigned int res;
|
|
int rd = (instr >> 12) & 0xF;
|
|
|
|
res = arm_check_condition(instr, regs->ARM_cpsr);
|
|
if (res == ARM_OPCODE_CONDTEST_FAIL) {
|
|
regs->ARM_pc += 4;
|
|
return 0;
|
|
}
|
|
|
|
if (rd == 15)
|
|
return 1;
|
|
|
|
fval = arch_timer_get_cntfrq();
|
|
regs->uregs[rd] = fval;
|
|
regs->ARM_pc += 4;
|
|
return 0;
|
|
}
|
|
|
|
static struct undef_hook get_freq_hook = {
|
|
.instr_mask = 0x0fff0fff,
|
|
.instr_val = 0x0e1e0f10,
|
|
.cpsr_mask = MODE_MASK,
|
|
.cpsr_val = USR_MODE,
|
|
.fn = get_freq_trap,
|
|
};
|
|
|
|
void get_timer_freq_hook_init(void)
|
|
{
|
|
register_undef_hook(&get_freq_hook);
|
|
}
|
|
EXPORT_SYMBOL(get_timer_freq_hook_init);
|
|
|
|
/*
|
|
* A data abort trap was taken, but we did not handle the instruction.
|
|
* Try to abort the user program, or panic if it was the kernel.
|
|
*/
|
|
asmlinkage void
|
|
baddataabort(int code, unsigned long instr, struct pt_regs *regs)
|
|
{
|
|
unsigned long addr = instruction_pointer(regs);
|
|
siginfo_t info;
|
|
|
|
clear_siginfo(&info);
|
|
|
|
#ifdef CONFIG_DEBUG_USER
|
|
if (user_debug & UDBG_BADABORT) {
|
|
pr_err("[%d] %s: bad data abort: code %d instr 0x%08lx\n",
|
|
task_pid_nr(current), current->comm, code, instr);
|
|
dump_instr(KERN_ERR, regs);
|
|
show_pte(current->mm, addr);
|
|
}
|
|
#endif
|
|
|
|
info.si_signo = SIGILL;
|
|
info.si_errno = 0;
|
|
info.si_code = ILL_ILLOPC;
|
|
info.si_addr = (void __user *)addr;
|
|
|
|
arm_notify_die("unknown data abort code", regs, &info, instr, 0);
|
|
}
|
|
|
|
void __readwrite_bug(const char *fn)
|
|
{
|
|
pr_err("%s called, but not implemented\n", fn);
|
|
BUG();
|
|
}
|
|
EXPORT_SYMBOL(__readwrite_bug);
|
|
|
|
void __pte_error(const char *file, int line, pte_t pte)
|
|
{
|
|
pr_err("%s:%d: bad pte %08llx.\n", file, line, (long long)pte_val(pte));
|
|
}
|
|
|
|
void __pmd_error(const char *file, int line, pmd_t pmd)
|
|
{
|
|
pr_err("%s:%d: bad pmd %08llx.\n", file, line, (long long)pmd_val(pmd));
|
|
}
|
|
|
|
void __pgd_error(const char *file, int line, pgd_t pgd)
|
|
{
|
|
pr_err("%s:%d: bad pgd %08llx.\n", file, line, (long long)pgd_val(pgd));
|
|
}
|
|
|
|
asmlinkage void __div0(void)
|
|
{
|
|
pr_err("Division by zero in kernel.\n");
|
|
dump_stack();
|
|
}
|
|
EXPORT_SYMBOL(__div0);
|
|
|
|
void abort(void)
|
|
{
|
|
BUG();
|
|
|
|
/* if that doesn't kill us, halt */
|
|
panic("Oops failed to kill thread");
|
|
}
|
|
|
|
void __init trap_init(void)
|
|
{
|
|
return;
|
|
}
|
|
|
|
#ifdef CONFIG_KUSER_HELPERS
|
|
static void __init kuser_init(void *vectors)
|
|
{
|
|
extern char __kuser_helper_start[], __kuser_helper_end[];
|
|
int kuser_sz = __kuser_helper_end - __kuser_helper_start;
|
|
|
|
memcpy(vectors + 0x1000 - kuser_sz, __kuser_helper_start, kuser_sz);
|
|
|
|
/*
|
|
* vectors + 0xfe0 = __kuser_get_tls
|
|
* vectors + 0xfe8 = hardware TLS instruction at 0xffff0fe8
|
|
*/
|
|
if (tls_emu || has_tls_reg)
|
|
memcpy(vectors + 0xfe0, vectors + 0xfe8, 4);
|
|
}
|
|
#else
|
|
static inline void __init kuser_init(void *vectors)
|
|
{
|
|
}
|
|
#endif
|
|
|
|
#ifndef CONFIG_CPU_V7M
|
|
static void copy_from_lma(void *vma, void *lma_start, void *lma_end)
|
|
{
|
|
memcpy(vma, lma_start, lma_end - lma_start);
|
|
}
|
|
|
|
static void flush_vectors(void *vma, size_t offset, size_t size)
|
|
{
|
|
unsigned long start = (unsigned long)vma + offset;
|
|
unsigned long end = start + size;
|
|
|
|
flush_icache_range(start, end);
|
|
}
|
|
|
|
#ifdef CONFIG_HARDEN_BRANCH_HISTORY
|
|
int spectre_bhb_update_vectors(unsigned int method)
|
|
{
|
|
extern char __vectors_bhb_bpiall_start[], __vectors_bhb_bpiall_end[];
|
|
extern char __vectors_bhb_loop8_start[], __vectors_bhb_loop8_end[];
|
|
void *vec_start, *vec_end;
|
|
|
|
if (system_state > SYSTEM_SCHEDULING) {
|
|
pr_err("CPU%u: Spectre BHB workaround too late - system vulnerable\n",
|
|
smp_processor_id());
|
|
return SPECTRE_VULNERABLE;
|
|
}
|
|
|
|
switch (method) {
|
|
case SPECTRE_V2_METHOD_LOOP8:
|
|
vec_start = __vectors_bhb_loop8_start;
|
|
vec_end = __vectors_bhb_loop8_end;
|
|
break;
|
|
|
|
case SPECTRE_V2_METHOD_BPIALL:
|
|
vec_start = __vectors_bhb_bpiall_start;
|
|
vec_end = __vectors_bhb_bpiall_end;
|
|
break;
|
|
|
|
default:
|
|
pr_err("CPU%u: unknown Spectre BHB state %d\n",
|
|
smp_processor_id(), method);
|
|
return SPECTRE_VULNERABLE;
|
|
}
|
|
|
|
copy_from_lma(vectors_page, vec_start, vec_end);
|
|
flush_vectors(vectors_page, 0, vec_end - vec_start);
|
|
|
|
return SPECTRE_MITIGATED;
|
|
}
|
|
#endif
|
|
|
|
void __init early_trap_init(void *vectors_base)
|
|
{
|
|
extern char __stubs_start[], __stubs_end[];
|
|
extern char __vectors_start[], __vectors_end[];
|
|
unsigned i;
|
|
|
|
vectors_page = vectors_base;
|
|
|
|
/*
|
|
* Poison the vectors page with an undefined instruction. This
|
|
* instruction is chosen to be undefined for both ARM and Thumb
|
|
* ISAs. The Thumb version is an undefined instruction with a
|
|
* branch back to the undefined instruction.
|
|
*/
|
|
for (i = 0; i < PAGE_SIZE / sizeof(u32); i++)
|
|
((u32 *)vectors_base)[i] = 0xe7fddef1;
|
|
|
|
/*
|
|
* Copy the vectors, stubs and kuser helpers (in entry-armv.S)
|
|
* into the vector page, mapped at 0xffff0000, and ensure these
|
|
* are visible to the instruction stream.
|
|
*/
|
|
copy_from_lma(vectors_base, __vectors_start, __vectors_end);
|
|
copy_from_lma(vectors_base + 0x1000, __stubs_start, __stubs_end);
|
|
|
|
kuser_init(vectors_base);
|
|
|
|
flush_vectors(vectors_base, 0, PAGE_SIZE * 2);
|
|
}
|
|
#else /* ifndef CONFIG_CPU_V7M */
|
|
void __init early_trap_init(void *vectors_base)
|
|
{
|
|
/*
|
|
* on V7-M there is no need to copy the vector table to a dedicated
|
|
* memory area. The address is configurable and so a table in the kernel
|
|
* image can be used.
|
|
*/
|
|
}
|
|
#endif
|