linux.git/arch/arm/mm, branch v4.14.82

ARM: 8809/1: proc-v7: fix Thumb annotation of cpu_v7_hvc_switch_mm

2018-11-21T08:24:09+00:00

commit 6282e916f774e37845c65d1eae9f8c649004f033 upstream.

Due to what appears to be a copy/paste error, the opening ENTRY()
of cpu_v7_hvc_switch_mm() lacks a matching ENDPROC(), and instead,
the one for cpu_v7_smc_switch_mm() is duplicated.

Given that it is ENDPROC() that emits the Thumb annotation, the
cpu_v7_hvc_switch_mm() routine will be called in ARM mode on a
Thumb2 kernel, resulting in the following splat:

  Internal error: Oops - undefined instruction: 0 [#1] SMP THUMB2
  Modules linked in:
  CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.18.0-rc1-00030-g4d28ad89189d-dirty #488
  Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
  PC is at cpu_v7_hvc_switch_mm+0x12/0x18
  LR is at flush_old_exec+0x31b/0x570
  pc : []    lr : []    psr: 00000013
  sp : ee899e50  ip : 00000000  fp : 00000001
  r10: eda28f34  r9 : eda31800  r8 : c12470e0
  r7 : eda1fc00  r6 : eda53000  r5 : 00000000  r4 : ee88c000
  r3 : c0316eec  r2 : 00000001  r1 : eda53000  r0 : 6da6c000
  Flags: nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none

Note the 'ISA ARM' in the last line.

Fix this by using the correct name in ENDPROC().

Cc: 
Fixes: 10115105cb3a ("ARM: spectre-v2: add firmware based hardening")
Reviewed-by: Dave Martin 
Acked-by: Marc Zyngier 
Signed-off-by: Ard Biesheuvel 
Signed-off-by: Russell King 
Signed-off-by: Greg Kroah-Hartman

ARM: 8799/1: mm: fix pci_ioremap_io() offset check

2018-11-04T13:52:38+00:00

[ Upstream commit 3a58ac65e2d7969bcdf1b6acb70fa4d12a88e53e ]

IO_SPACE_LIMIT is the ending address of the PCI IO space, i.e
something like 0xfffff (and not 0x100000).

Therefore, when offset = 0xf0000 is passed as argument, this function
fails even though the offset + SZ_64K fits below the
IO_SPACE_LIMIT. This makes the last chunk of 64 KB of the I/O space
not usable as it cannot be mapped.

This patch fixes that by substracing 1 to offset + SZ_64K, so that we
compare the addrss of the last byte of the I/O space against
IO_SPACE_LIMIT instead of the address of the first byte of what is
after the I/O space.

Fixes: c2794437091a4 ("ARM: Add fixed PCI i/o mapping")
Signed-off-by: Thomas Petazzoni 
Acked-by: Nicolas Pitre 
Signed-off-by: Russell King 
Signed-off-by: Sasha Levin

ARM: spectre-v2: warn about incorrect context switching functions

2018-10-18T07:16:26+00:00

Commit c44f366ea7c85e1be27d08f2f0880f4120698125 upstream.

Warn at error level if the context switching function is not what we
are expecting.  This can happen with big.Little systems, which we
currently do not support.

Signed-off-by: Russell King 
Boot-tested-by: Tony Lindgren 
Reviewed-by: Tony Lindgren 
Acked-by: Marc Zyngier 
Signed-off-by: David A. Long 
Signed-off-by: Greg Kroah-Hartman

ARM: spectre-v2: add firmware based hardening

2018-10-18T07:16:26+00:00

Commit 10115105cb3aa17b5da1cb726ae8dd5f6854bd93 upstream.

Add firmware based hardening for cores that require more complex
handling in firmware.

Signed-off-by: Russell King 
Boot-tested-by: Tony Lindgren 
Reviewed-by: Tony Lindgren 
Reviewed-by: Marc Zyngier 
Signed-off-by: David A. Long 
Signed-off-by: Greg Kroah-Hartman

ARM: spectre-v2: harden user aborts in kernel space

2018-10-18T07:16:26+00:00

Commit f5fe12b1eaee220ce62ff9afb8b90929c396595f upstream.

In order to prevent aliasing attacks on the branch predictor,
invalidate the BTB or instruction cache on CPUs that are known to be
affected when taking an abort on a address that is outside of a user
task limit:

Cortex A8, A9, A12, A17, A73, A75: flush BTB.
Cortex A15, Brahma B15: invalidate icache.

If the IBE bit is not set, then there is little point to enabling the
workaround.

Signed-off-by: Russell King 
Boot-tested-by: Tony Lindgren 
Reviewed-by: Tony Lindgren 
Signed-off-by: David A. Long 
Signed-off-by: Greg Kroah-Hartman

ARM: spectre-v2: add Cortex A8 and A15 validation of the IBE bit

2018-10-18T07:16:26+00:00

Commit e388b80288aade31135aca23d32eee93dd106795 upstream.

When the branch predictor hardening is enabled, firmware must have set
the IBE bit in the auxiliary control register.  If this bit has not
been set, the Spectre workarounds will not be functional.

Add validation that this bit is set, and print a warning at alert level
if this is not the case.

Signed-off-by: Russell King 
Reviewed-by: Florian Fainelli 
Boot-tested-by: Tony Lindgren 
Reviewed-by: Tony Lindgren 
Signed-off-by: David A. Long 
Signed-off-by: Greg Kroah-Hartman

ARM: spectre-v2: harden branch predictor on context switches

2018-10-18T07:16:26+00:00

Commit 06c23f5ffe7ad45b908d0fff604dae08a7e334b9 upstream.

Required manual merge of arch/arm/mm/proc-v7.S.

Harden the branch predictor against Spectre v2 attacks on context
switches for ARMv7 and later CPUs.  We do this by:

Cortex A9, A12, A17, A73, A75: invalidating the BTB.
Cortex A15, Brahma B15: invalidating the instruction cache.

Cortex A57 and Cortex A72 are not addressed in this patch.

Cortex R7 and Cortex R8 are also not addressed as we do not enforce
memory protection on these cores.

Signed-off-by: Russell King 
Boot-tested-by: Tony Lindgren 
Reviewed-by: Tony Lindgren 
Acked-by: Marc Zyngier 
Signed-off-by: David A. Long 
Signed-off-by: Greg Kroah-Hartman

ARM: spectre: add Kconfig symbol for CPUs vulnerable to Spectre

2018-10-18T07:16:26+00:00

Commit c58d237d0852a57fde9bc2c310972e8f4e3d155d upstream.

Add a Kconfig symbol for CPUs which are vulnerable to the Spectre
attacks.

Signed-off-by: Russell King 
Reviewed-by: Florian Fainelli 
Boot-tested-by: Tony Lindgren 
Reviewed-by: Tony Lindgren 
Acked-by: Marc Zyngier 
Signed-off-by: David A. Long 
Signed-off-by: Greg Kroah-Hartman

ARM: bugs: add support for per-processor bug checking

2018-10-18T07:16:26+00:00

Commit 9d3a04925deeabb97c8e26d940b501a2873e8af3 upstream.

Add support for per-processor bug checking - each processor function
descriptor gains a function pointer for this check, which must not be
an __init function.  If non-NULL, this will be called whenever a CPU
enters the kernel via which ever path (boot CPU, secondary CPU startup,
CPU resuming, etc.)

This allows processor specific bug checks to validate that workaround
bits are properly enabled by firmware via all entry paths to the kernel.

Signed-off-by: Russell King 
Reviewed-by: Florian Fainelli 
Boot-tested-by: Tony Lindgren 
Reviewed-by: Tony Lindgren 
Acked-by: Marc Zyngier 
Signed-off-by: David A. Long 
Signed-off-by: Greg Kroah-Hartman

ARM: 8780/1: ftrace: Only set kernel memory back to read-only after boot

2018-08-24T11:09:16+00:00

[ Upstream commit b4c7e2bd2eb4764afe3af9409ff3b1b87116fa30 ]

Dynamic ftrace requires modifying the code segments that are usually
set to read-only. To do this, a per arch function is called both before
and after the ftrace modifications are performed. The "before" function
will set kernel code text to read-write to allow for ftrace to make the
modifications, and the "after" function will set the kernel code text
back to "read-only" to keep the kernel code text protected.

The issue happens when dynamic ftrace is tested at boot up. The test is
done before the kernel code text has been set to read-only. But the
"before" and "after" calls are still performed. The "after" call will
change the kernel code text to read-only prematurely, and other boot
code that expects this code to be read-write will fail.

The solution is to add a variable that is set when the kernel code text
is expected to be converted to read-only, and make the ftrace "before"
and "after" calls do nothing if that variable is not yet set. This is
similar to the x86 solution from commit 162396309745 ("ftrace, x86:
make kernel text writable only for conversions").

Link: http://lkml.kernel.org/r/20180620212906.24b7b66e@vmware.local.home

Reported-by: Stefan Agner 
Tested-by: Stefan Agner 
Signed-off-by: Steven Rostedt (VMware) 
Signed-off-by: Russell King 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman