linux.git/arch/arm/mm, branch v4.19.149

ARM: 8978/1: mm: make act_mm() respect THREAD_SIZE

2020-06-22T07:05:12+00:00

[ Upstream commit e1de94380af588bdf6ad6f0cc1f75004c35bc096 ]

Recent work with KASan exposed the folling hard-coded bitmask
in arch/arm/mm/proc-macros.S:

  bic     rd, sp, #8128
  bic     rd, rd, #63

This forms the bitmask 0x1FFF that is coinciding with
(PAGE_SIZE << THREAD_SIZE_ORDER) - 1, this code was assuming
that THREAD_SIZE is always 8K (8192).

As KASan was increasing THREAD_SIZE_ORDER to 2, I ran into
this bug.

Fix it by this little oneline suggested by Ard:

  bic     rd, sp, #(THREAD_SIZE - 1) & ~63

Where THREAD_SIZE is defined using THREAD_SIZE_ORDER.

We have to also include  since the THREAD_SIZE
expands to use the _AC() macro.

Cc: Ard Biesheuvel 
Cc: Florian Fainelli 
Suggested-by: Ard Biesheuvel 
Signed-off-by: Linus Walleij 
Signed-off-by: Russell King 
Signed-off-by: Sasha Levin

ARM: 8949/1: mm: mark free_memmap as __init

2020-02-14T21:33:26+00:00

commit 31f3010e60522ede237fb145a63b4af5a41718c2 upstream.

As of commit ac7c3e4ff401 ("compiler: enable CONFIG_OPTIMIZE_INLINING
forcibly"), free_memmap() might not always be inlined, and thus is
triggering a section warning:

WARNING: vmlinux.o(.text.unlikely+0x904): Section mismatch in reference from the function free_memmap() to the function .meminit.text:memblock_free()

Mark it as __init, since the faller (free_unused_memmap) already is.

Fixes: ac7c3e4ff401 ("compiler: enable CONFIG_OPTIMIZE_INLINING forcibly")
Signed-off-by: Olof Johansson 
Signed-off-by: Russell King 
Signed-off-by: Greg Kroah-Hartman

ARM: 8937/1: spectre-v2: remove Brahma-B53 from hardening

2020-01-04T18:12:59+00:00

[ Upstream commit 4ae5061a19b550dfe25397843427ed2ebab16b16 ]

When the default processor handling was added to the function
cpu_v7_spectre_init() it only excluded other ARM implemented processor
cores. The Broadcom Brahma B53 core is not implemented by ARM so it
ended up falling through into the set of processors that attempt to use
the ARM_SMCCC_ARCH_WORKAROUND_1 service to harden the branch predictor.

Since this workaround is not necessary for the Brahma-B53 this commit
explicitly checks for it and prevents it from applying a branch
predictor hardening workaround.

Fixes: 10115105cb3a ("ARM: spectre-v2: add firmware based hardening")
Signed-off-by: Doug Berger 
Signed-off-by: Florian Fainelli 
Signed-off-by: Russell King 
Signed-off-by: Sasha Levin

ARM: 8904/1: skip nomap memblocks while finding the lowmem/highmem boundary

2019-12-01T08:17:37+00:00

commit 1d31999cf04c21709f72ceb17e65b54a401330da upstream.

adjust_lowmem_bounds() checks every memblocks in order to find the boundary
between lowmem and highmem. However some memblocks could be marked as NOMAP
so they are not used by kernel, which should be skipped while calculating
the boundary.

Signed-off-by: Chester Lin 
Reviewed-by: Mike Rapoport 
Signed-off-by: Russell King 
Signed-off-by: Lee Jones 
Signed-off-by: Greg Kroah-Hartman

ARM: 8926/1: v7m: remove register save to stack before svc

2019-11-10T10:27:29+00:00

[ Upstream commit 2ecb287998a47cc0a766f6071f63bc185f338540 ]

r0-r3 & r12 registers are saved & restored, before & after svc
respectively. Intention was to preserve those registers across thread to
handler mode switch.

On v7-M, hardware saves the register context upon exception in AAPCS
complaint way. Restoring r0-r3 & r12 is done from stack location where
hardware saves it, not from the location on stack where these registers
were saved.

To clarify, on stm32f429 discovery board:

1. before svc, sp - 0x90009ff8
2. r0-r3,r12 saved to 0x90009ff8 - 0x9000a00b
3. upon svc, h/w decrements sp by 32 & pushes registers onto stack
4. after svc, sp - 0x90009fd8
5. r0-r3,r12 restored from 0x90009fd8 - 0x90009feb

Above means r0-r3,r12 is not restored from the location where they are
saved, but since hardware pushes the registers onto stack, the registers
are restored correctly.

Note that during register saving to stack (step 2), it goes past
0x9000a000. And it seems, based on objdump, there are global symbols
residing there, and it perhaps can cause issues on a non-XIP Kernel
(on XIP, data section is setup later).

Based on the analysis above, manually saving registers onto stack is at
best no-op and at worst can cause data section corruption. Hence remove
storing of registers onto stack before svc.

Fixes: b70cd406d7fe ("ARM: 8671/1: V7M: Preserve registers across switch from Thread to Handler mode")
Signed-off-by: afzal mohammed
Acked-by: Vladimir Murzin
Signed-off-by: Russell King
Signed-off-by: Sasha Levin

ARM: mm: fix alignment handler faults under memory pressure

2019-11-10T10:27:18+00:00

[ Upstream commit 67e15fa5b487adb9b78a92789eeff2d6ec8f5cee ]

When the system has high memory pressure, the page containing the
instruction may be paged out.  Using probe_kernel_address() means that
if the page is swapped out, the resulting page fault will not be
handled because page faults are disabled by this function.

Use get_user() to read the instruction instead.

Reported-by: Jing Xiangfeng 
Fixes: b255188f90e2 ("ARM: fix scheduling while atomic warning in alignment handling code")
Signed-off-by: Russell King 
Signed-off-by: Sasha Levin

ARM: 8914/1: NOMMU: Fix exc_ret for XIP

2019-11-06T12:06:10+00:00

[ Upstream commit 4c0742f65b4ee466546fd24b71b56516cacd4613 ]

It was reported that 72cd4064fcca "NOMMU: Toggle only bits in
EXC_RETURN we are really care of" breaks NOMMU+XIP combination.
It happens because saved EXC_RETURN gets overwritten when data
section is relocated.

The fix is to propagate EXC_RETURN via register and let relocation
code to commit that value into memory.

Fixes: 72cd4064fcca ("ARM: 8830/1: NOMMU: Toggle only bits in EXC_RETURN we are really care of")
Reported-by: afzal mohammed 
Tested-by: afzal mohammed 
Signed-off-by: Vladimir Murzin 
Signed-off-by: Russell King 
Signed-off-by: Sasha Levin

arm: use STACK_TOP when computing mmap base address

2019-10-07T16:57:18+00:00

[ Upstream commit 86e568e9c0525fc40e76d827212d5e9721cf7504 ]

mmap base address must be computed wrt stack top address, using TASK_SIZE
is wrong since STACK_TOP and TASK_SIZE are not equivalent.

Link: http://lkml.kernel.org/r/20190730055113.23635-8-alex@ghiti.fr
Signed-off-by: Alexandre Ghiti 
Acked-by: Kees Cook 
Reviewed-by: Luis Chamberlain 
Cc: Albert Ou 
Cc: Alexander Viro 
Cc: Catalin Marinas 
Cc: Christoph Hellwig 
Cc: Christoph Hellwig 
Cc: James Hogan 
Cc: Palmer Dabbelt 
Cc: Paul Burton 
Cc: Ralf Baechle 
Cc: Russell King 
Cc: Will Deacon 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin

arm: properly account for stack randomization and stack guard gap

2019-10-07T16:57:18+00:00

[ Upstream commit af0f4297286f13a75edf93677b1fb2fc16c412a7 ]

This commit takes care of stack randomization and stack guard gap when
computing mmap base address and checks if the task asked for
randomization.  This fixes the problem uncovered and not fixed for arm
here: https://lkml.kernel.org/r/20170622200033.25714-1-riel@redhat.com

Link: http://lkml.kernel.org/r/20190730055113.23635-7-alex@ghiti.fr
Signed-off-by: Alexandre Ghiti 
Acked-by: Kees Cook 
Reviewed-by: Luis Chamberlain 
Cc: Albert Ou 
Cc: Alexander Viro 
Cc: Catalin Marinas 
Cc: Christoph Hellwig 
Cc: Christoph Hellwig 
Cc: James Hogan 
Cc: Palmer Dabbelt 
Cc: Paul Burton 
Cc: Ralf Baechle 
Cc: Russell King 
Cc: Will Deacon 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin

ARM: 8903/1: ensure that usable memory in bank 0 starts from a PMD-aligned address

2019-10-07T16:57:14+00:00

[ Upstream commit 00d2ec1e6bd82c0538e6dd3e4a4040de93ba4fef ]

The calculation of memblock_limit in adjust_lowmem_bounds() assumes that
bank 0 starts from a PMD-aligned address. However, the beginning of the
first bank may be NOMAP memory and the start of usable memory
will be not aligned to PMD boundary. In such case the memblock_limit will
be set to the end of the NOMAP region, which will prevent any memblock
allocations.

Mark the region between the end of the NOMAP area and the next PMD-aligned
address as NOMAP as well, so that the usable memory will start at
PMD-aligned address.

Signed-off-by: Mike Rapoport 
Signed-off-by: Russell King 
Signed-off-by: Sasha Levin