exynos-linux-stable/include/linux/arm-smccc.h

318 lines
11 KiB
C
Raw Permalink Normal View History

/*
* Copyright (c) 2015, Linaro Limited
*
* This software is licensed under the terms of the GNU General Public
* License version 2, as published by the Free Software Foundation, and
* may be copied, distributed, and modified under those terms.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
*/
#ifndef __LINUX_ARM_SMCCC_H
#define __LINUX_ARM_SMCCC_H
#include <uapi/linux/const.h>
/*
* This file provides common defines for ARM SMC Calling Convention as
* specified in
* http://infocenter.arm.com/help/topic/com.arm.doc.den0028a/index.html
*/
#define ARM_SMCCC_STD_CALL _AC(0,U)
#define ARM_SMCCC_FAST_CALL _AC(1,U)
#define ARM_SMCCC_TYPE_SHIFT 31
#define ARM_SMCCC_SMC_32 0
#define ARM_SMCCC_SMC_64 1
#define ARM_SMCCC_CALL_CONV_SHIFT 30
#define ARM_SMCCC_OWNER_MASK 0x3F
#define ARM_SMCCC_OWNER_SHIFT 24
#define ARM_SMCCC_FUNC_MASK 0xFFFF
#define ARM_SMCCC_IS_FAST_CALL(smc_val) \
((smc_val) & (ARM_SMCCC_FAST_CALL << ARM_SMCCC_TYPE_SHIFT))
#define ARM_SMCCC_IS_64(smc_val) \
((smc_val) & (ARM_SMCCC_SMC_64 << ARM_SMCCC_CALL_CONV_SHIFT))
#define ARM_SMCCC_FUNC_NUM(smc_val) ((smc_val) & ARM_SMCCC_FUNC_MASK)
#define ARM_SMCCC_OWNER_NUM(smc_val) \
(((smc_val) >> ARM_SMCCC_OWNER_SHIFT) & ARM_SMCCC_OWNER_MASK)
#define ARM_SMCCC_CALL_VAL(type, calling_convention, owner, func_num) \
(((type) << ARM_SMCCC_TYPE_SHIFT) | \
((calling_convention) << ARM_SMCCC_CALL_CONV_SHIFT) | \
(((owner) & ARM_SMCCC_OWNER_MASK) << ARM_SMCCC_OWNER_SHIFT) | \
((func_num) & ARM_SMCCC_FUNC_MASK))
#define ARM_SMCCC_OWNER_ARCH 0
#define ARM_SMCCC_OWNER_CPU 1
#define ARM_SMCCC_OWNER_SIP 2
#define ARM_SMCCC_OWNER_OEM 3
#define ARM_SMCCC_OWNER_STANDARD 4
#define ARM_SMCCC_OWNER_TRUSTED_APP 48
#define ARM_SMCCC_OWNER_TRUSTED_APP_END 49
#define ARM_SMCCC_OWNER_TRUSTED_OS 50
#define ARM_SMCCC_OWNER_TRUSTED_OS_END 63
#define ARM_SMCCC_QUIRK_NONE 0
#define ARM_SMCCC_QUIRK_QCOM_A6 1 /* Save/restore register a6 */
#define ARM_SMCCC_VERSION_1_0 0x10000
#define ARM_SMCCC_VERSION_1_1 0x10001
#define ARM_SMCCC_VERSION_FUNC_ID \
ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \
ARM_SMCCC_SMC_32, \
0, 0)
#define ARM_SMCCC_ARCH_FEATURES_FUNC_ID \
ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \
ARM_SMCCC_SMC_32, \
0, 1)
#define ARM_SMCCC_ARCH_WORKAROUND_1 \
ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \
ARM_SMCCC_SMC_32, \
0, 0x8000)
#define ARM_SMCCC_ARCH_WORKAROUND_2 \
ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \
ARM_SMCCC_SMC_32, \
0, 0x7fff)
#ifndef __ASSEMBLY__
#include <linux/linkage.h>
#include <linux/types.h>
/**
* struct arm_smccc_res - Result from SMC/HVC call
* @a0-a3 result values from registers 0 to 3
*/
struct arm_smccc_res {
unsigned long a0;
unsigned long a1;
unsigned long a2;
unsigned long a3;
};
/**
* struct arm_smccc_quirk - Contains quirk information
* @id: quirk identification
* @state: quirk specific information
* @a6: Qualcomm quirk entry for returning post-smc call contents of a6
*/
struct arm_smccc_quirk {
int id;
union {
unsigned long a6;
} state;
};
/**
* __arm_smccc_smc() - make SMC calls
* @a0-a7: arguments passed in registers 0 to 7
* @res: result values from registers 0 to 3
* @quirk: points to an arm_smccc_quirk, or NULL when no quirks are required.
*
* This function is used to make SMC calls following SMC Calling Convention.
* The content of the supplied param are copied to registers 0 to 7 prior
* to the SMC instruction. The return values are updated with the content
* from register 0 to 3 on return from the SMC instruction. An optional
* quirk structure provides vendor specific behavior.
*/
asmlinkage void __arm_smccc_smc(unsigned long a0, unsigned long a1,
unsigned long a2, unsigned long a3, unsigned long a4,
unsigned long a5, unsigned long a6, unsigned long a7,
struct arm_smccc_res *res, struct arm_smccc_quirk *quirk);
/**
* __arm_smccc_hvc() - make HVC calls
* @a0-a7: arguments passed in registers 0 to 7
* @res: result values from registers 0 to 3
* @quirk: points to an arm_smccc_quirk, or NULL when no quirks are required.
*
* This function is used to make HVC calls following SMC Calling
* Convention. The content of the supplied param are copied to registers 0
* to 7 prior to the HVC instruction. The return values are updated with
* the content from register 0 to 3 on return from the HVC instruction. An
* optional quirk structure provides vendor specific behavior.
*/
asmlinkage void __arm_smccc_hvc(unsigned long a0, unsigned long a1,
unsigned long a2, unsigned long a3, unsigned long a4,
unsigned long a5, unsigned long a6, unsigned long a7,
struct arm_smccc_res *res, struct arm_smccc_quirk *quirk);
#define arm_smccc_smc(...) __arm_smccc_smc(__VA_ARGS__, NULL)
#define arm_smccc_smc_quirk(...) __arm_smccc_smc(__VA_ARGS__)
#define arm_smccc_hvc(...) __arm_smccc_hvc(__VA_ARGS__, NULL)
#define arm_smccc_hvc_quirk(...) __arm_smccc_hvc(__VA_ARGS__)
/* SMCCC v1.1 implementation madness follows */
#ifdef CONFIG_ARM64
#define SMCCC_SMC_INST "smc #0"
#define SMCCC_HVC_INST "hvc #0"
#define SMCCC_REG(n) asm("x" # n)
#elif defined(CONFIG_ARM)
#include <asm/opcodes-sec.h>
#include <asm/opcodes-virt.h>
#define SMCCC_SMC_INST __SMC(0)
#define SMCCC_HVC_INST __HVC(0)
#define SMCCC_REG(n) asm("r" # n)
#endif
#define ___count_args(_0, _1, _2, _3, _4, _5, _6, _7, _8, x, ...) x
#define __count_args(...) \
___count_args(__VA_ARGS__, 7, 6, 5, 4, 3, 2, 1, 0)
#define __constraint_write_0 \
"+r" (r0), "=&r" (r1), "=&r" (r2), "=&r" (r3)
#define __constraint_write_1 \
"+r" (r0), "+r" (r1), "=&r" (r2), "=&r" (r3)
#define __constraint_write_2 \
"+r" (r0), "+r" (r1), "+r" (r2), "=&r" (r3)
#define __constraint_write_3 \
"+r" (r0), "+r" (r1), "+r" (r2), "+r" (r3)
#define __constraint_write_4 __constraint_write_3
#define __constraint_write_5 __constraint_write_4
#define __constraint_write_6 __constraint_write_5
#define __constraint_write_7 __constraint_write_6
#define __constraint_read_0
#define __constraint_read_1
#define __constraint_read_2
#define __constraint_read_3
#define __constraint_read_4 "r" (r4)
#define __constraint_read_5 __constraint_read_4, "r" (r5)
#define __constraint_read_6 __constraint_read_5, "r" (r6)
#define __constraint_read_7 __constraint_read_6, "r" (r7)
#define __declare_arg_0(a0, res) \
struct arm_smccc_res *___res = res; \
This is the 4.9.131 stable release -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlu1WHMACgkQONu9yGCS aT4hyBAAzcHneF2/PsUfSfmkGFh9djX0Nyev3g3DgreVCcRJMok5Gbz4c0W2U0FN 0CdLA0XWqdjyzuSbzFr1itcaska4Vly6CSrsMJLNJcQr7rriL1Ov4AHXI+8bWAXV 81Ph7m9GGagl5SpMJOOPAghMvurp0YIiZGm8ME/tzOzTmtIwuy0iftXW/VKwQWTY hXMmHk7pm/rkldbEdKnsuDcdx7x4HvdZJDe8opvHXZ00W90RMSbfE4geIzSQQf3y G8eXkK6krT+dxvcaJGDyUuXPkbO97oirp2GIWAF0RTBBHH/eeHYCBXmiE8dmkisv nvZdQrZ1wAf8IpN7iyH/CbsvTM38lFPz+gqiU9TVAlX8BPPkHrJxYJ4GYkwmQvIY 7npcHPBfAgG9fL27uCZMq63uoNh2I5kShVJHQTBTNKxoG6yoHi6utNyCWzrpK75c EMHQL4w4ygv1dyE01NV3Cr1Pig5l+dEpE6FKoLYSyI7vPS8P3K92IArdM+TjXn96 9tm3MbeDmZTr5RJyv2j+7r55aFR2Ad43E7NHTxN92rfyZfSUw7/Egrk/3mzMivXj kQqwrj9edta86lI9fmmMW5AywbOvVIVnG89vKk21Q7n1xnXMKwdEoJnw65yJFvTu X0stqUubJ3U3g/WkdFcHCZFy6m3hQDCPBkyxAs/09qUIFAqKfp8= =GmzY -----END PGP SIGNATURE----- Merge 4.9.131 into android-4.9 Changes in 4.9.131 crypto: skcipher - Fix -Wstringop-truncation warnings tsl2550: fix lux1_input error in low light vmci: type promotion bug in qp_host_get_user_memory() x86/numa_emulation: Fix emulated-to-physical node mapping staging: rts5208: fix missing error check on call to rtsx_write_register uwb: hwa-rc: fix memory leak at probe power: vexpress: fix corruption in notifier registration iommu/amd: make sure TLB to be flushed before IOVA freed Bluetooth: Add a new Realtek 8723DE ID 0bda:b009 USB: serial: kobil_sct: fix modem-status error handling 6lowpan: iphc: reset mac_header after decompress to fix panic s390/mm: correct allocate_pgste proc_handler callback power: remove possible deadlock when unregistering power_supply md-cluster: clear another node's suspend_area after the copy is finished IB/core: type promotion bug in rdma_rw_init_one_mr() media: exynos4-is: Prevent NULL pointer dereference in __isp_video_try_fmt() powerpc/kdump: Handle crashkernel memory reservation failure media: fsl-viu: fix error handling in viu_of_probe() x86/tsc: Add missing header to tsc_msr.c ARM: hwmod: RTC: Don't assume lock/unlock will be called with irq enabled x86/entry/64: Add two more instruction suffixes scsi: target/iscsi: Make iscsit_ta_authentication() respect the output buffer size scsi: klist: Make it safe to use klists in atomic context scsi: ibmvscsi: Improve strings handling usb: wusbcore: security: cast sizeof to int for comparison powerpc/powernv/ioda2: Reduce upper limit for DMA window size alarmtimer: Prevent overflow for relative nanosleep s390/extmem: fix gcc 8 stringop-overflow warning ALSA: snd-aoa: add of_node_put() in error path media: s3c-camif: ignore -ENOIOCTLCMD from v4l2_subdev_call for s_power media: soc_camera: ov772x: correct setting of banding filter media: omap3isp: zero-initialize the isp cam_xclk{a,b} initial data staging: android: ashmem: Fix mmap size validation drivers/tty: add error handling for pcmcia_loop_config media: tm6000: add error handling for dvb_register_adapter ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge net: phy: xgmiitorgmii: Check read_status results ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock net: phy: xgmiitorgmii: Check phy_driver ready before accessing drm/sun4i: Fix releasing node when enumerating enpoints rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication() wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout() ARM: mvebu: declare asm symbols as character arrays in pmsu.c HID: hid-ntrig: add error handling for sysfs_create_group perf/x86/intel/lbr: Fix incomplete LBR call stack scsi: bnx2i: add error handling for ioremap_nocache scsi: megaraid_sas: Update controller info during resume EDAC, i7core: Fix memleaks and use-after-free on probe and remove ASoC: dapm: Fix potential DAI widget pointer deref when linking DAIs module: exclude SHN_UNDEF symbols from kallsyms api gpio: Fix wrong rounding in gpio-menz127 nfsd: fix corrupted reply to badly ordered compound EDAC: Fix memleak in module init error path ARM: dts: dra7: fix DCAN node addresses floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl tty: serial: lpuart: avoid leaking struct tty_struct serial: cpm_uart: return immediately from console poll spi: tegra20-slink: explicitly enable/disable clock spi: sh-msiof: Fix invalid SPI use during system suspend spi: sh-msiof: Fix handling of write value for SISTR register spi: rspi: Fix invalid SPI use during system suspend spi: rspi: Fix interrupted DMA transfers regulator: fix crash caused by null driver data USB: fix error handling in usb_driver_claim_interface() USB: handle NULL config in usb_find_alt_setting() slub: make ->cpu_partial unsigned int media: uvcvideo: Support realtek's UVC 1.5 device USB: usbdevfs: sanitize flags more USB: usbdevfs: restore warning for nonsensical flags Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()" USB: remove LPM management from usb_driver_claim_interface() Input: elantech - enable middle button of touchpad on ThinkPad P72 IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop IB/hfi1: Invalid user input can result in crash IB/hfi1: Fix context recovery when PBC has an UnsupportedVL scsi: target: iscsi: Use bin2hex instead of a re-implementation serial: imx: restore handshaking irq for imx1 IB/hfi1: Fix SL array bounds check arm64: KVM: Tighten guest core register access from userspace ext4: never move the system.data xattr out of the inode body qed: Wait for ready indication before rereading the shmem qed: Wait for MCP halt and resume commands to take place thermal: of-thermal: disable passive polling when thermal zone is disabled net: hns: fix length and page_offset overflow when CONFIG_ARM64_64K_PAGES net: hns: fix skb->truesize underestimation e1000: check on netif_running() before calling e1000_up() e1000: ensure to free old tx/rx rings in set_ringparam() hwmon: (ina2xx) fix sysfs shunt resistor read access hwmon: (adt7475) Make adt7475_read_word() return errors drm/amdgpu: Enable/disable gfx PG feature in rlc safe mode drm/amdgpu: Update power state at the end of smu hw_init. arm/arm64: smccc-1.1: Make return values unsigned long arm/arm64: smccc-1.1: Handle function result as parameters i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus arm64: KVM: Sanitize PSTATE.M when being set from userspace media: v4l: event: Prevent freeing event subscriptions while accessed Linux 4.9.131 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-10-04 13:43:03 -07:00
register unsigned long r0 SMCCC_REG(0) = (u32)a0; \
register unsigned long r1 SMCCC_REG(1); \
register unsigned long r2 SMCCC_REG(2); \
register unsigned long r3 SMCCC_REG(3)
#define __declare_arg_1(a0, a1, res) \
arm/arm64: smccc-1.1: Handle function result as parameters [ Upstream commit 755a8bf5579d22eb5636685c516d8dede799e27b ] If someone has the silly idea to write something along those lines: extern u64 foo(void); void bar(struct arm_smccc_res *res) { arm_smccc_1_1_smc(0xbad, foo(), res); } they are in for a surprise, as this gets compiled as: 0000000000000588 <bar>: 588: a9be7bfd stp x29, x30, [sp, #-32]! 58c: 910003fd mov x29, sp 590: f9000bf3 str x19, [sp, #16] 594: aa0003f3 mov x19, x0 598: aa1e03e0 mov x0, x30 59c: 94000000 bl 0 <_mcount> 5a0: 94000000 bl 0 <foo> 5a4: aa0003e1 mov x1, x0 5a8: d4000003 smc #0x0 5ac: b4000073 cbz x19, 5b8 <bar+0x30> 5b0: a9000660 stp x0, x1, [x19] 5b4: a9010e62 stp x2, x3, [x19, #16] 5b8: f9400bf3 ldr x19, [sp, #16] 5bc: a8c27bfd ldp x29, x30, [sp], #32 5c0: d65f03c0 ret 5c4: d503201f nop The call to foo "overwrites" the x0 register for the return value, and we end up calling the wrong secure service. A solution is to evaluate all the parameters before assigning anything to specific registers, leading to the expected result: 0000000000000588 <bar>: 588: a9be7bfd stp x29, x30, [sp, #-32]! 58c: 910003fd mov x29, sp 590: f9000bf3 str x19, [sp, #16] 594: aa0003f3 mov x19, x0 598: aa1e03e0 mov x0, x30 59c: 94000000 bl 0 <_mcount> 5a0: 94000000 bl 0 <foo> 5a4: aa0003e1 mov x1, x0 5a8: d28175a0 mov x0, #0xbad 5ac: d4000003 smc #0x0 5b0: b4000073 cbz x19, 5bc <bar+0x34> 5b4: a9000660 stp x0, x1, [x19] 5b8: a9010e62 stp x2, x3, [x19, #16] 5bc: f9400bf3 ldr x19, [sp, #16] 5c0: a8c27bfd ldp x29, x30, [sp], #32 5c4: d65f03c0 ret Reported-by: Julien Grall <julien.grall@arm.com> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-24 15:08:30 +01:00
typeof(a1) __a1 = a1; \
struct arm_smccc_res *___res = res; \
This is the 4.9.131 stable release -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlu1WHMACgkQONu9yGCS aT4hyBAAzcHneF2/PsUfSfmkGFh9djX0Nyev3g3DgreVCcRJMok5Gbz4c0W2U0FN 0CdLA0XWqdjyzuSbzFr1itcaska4Vly6CSrsMJLNJcQr7rriL1Ov4AHXI+8bWAXV 81Ph7m9GGagl5SpMJOOPAghMvurp0YIiZGm8ME/tzOzTmtIwuy0iftXW/VKwQWTY hXMmHk7pm/rkldbEdKnsuDcdx7x4HvdZJDe8opvHXZ00W90RMSbfE4geIzSQQf3y G8eXkK6krT+dxvcaJGDyUuXPkbO97oirp2GIWAF0RTBBHH/eeHYCBXmiE8dmkisv nvZdQrZ1wAf8IpN7iyH/CbsvTM38lFPz+gqiU9TVAlX8BPPkHrJxYJ4GYkwmQvIY 7npcHPBfAgG9fL27uCZMq63uoNh2I5kShVJHQTBTNKxoG6yoHi6utNyCWzrpK75c EMHQL4w4ygv1dyE01NV3Cr1Pig5l+dEpE6FKoLYSyI7vPS8P3K92IArdM+TjXn96 9tm3MbeDmZTr5RJyv2j+7r55aFR2Ad43E7NHTxN92rfyZfSUw7/Egrk/3mzMivXj kQqwrj9edta86lI9fmmMW5AywbOvVIVnG89vKk21Q7n1xnXMKwdEoJnw65yJFvTu X0stqUubJ3U3g/WkdFcHCZFy6m3hQDCPBkyxAs/09qUIFAqKfp8= =GmzY -----END PGP SIGNATURE----- Merge 4.9.131 into android-4.9 Changes in 4.9.131 crypto: skcipher - Fix -Wstringop-truncation warnings tsl2550: fix lux1_input error in low light vmci: type promotion bug in qp_host_get_user_memory() x86/numa_emulation: Fix emulated-to-physical node mapping staging: rts5208: fix missing error check on call to rtsx_write_register uwb: hwa-rc: fix memory leak at probe power: vexpress: fix corruption in notifier registration iommu/amd: make sure TLB to be flushed before IOVA freed Bluetooth: Add a new Realtek 8723DE ID 0bda:b009 USB: serial: kobil_sct: fix modem-status error handling 6lowpan: iphc: reset mac_header after decompress to fix panic s390/mm: correct allocate_pgste proc_handler callback power: remove possible deadlock when unregistering power_supply md-cluster: clear another node's suspend_area after the copy is finished IB/core: type promotion bug in rdma_rw_init_one_mr() media: exynos4-is: Prevent NULL pointer dereference in __isp_video_try_fmt() powerpc/kdump: Handle crashkernel memory reservation failure media: fsl-viu: fix error handling in viu_of_probe() x86/tsc: Add missing header to tsc_msr.c ARM: hwmod: RTC: Don't assume lock/unlock will be called with irq enabled x86/entry/64: Add two more instruction suffixes scsi: target/iscsi: Make iscsit_ta_authentication() respect the output buffer size scsi: klist: Make it safe to use klists in atomic context scsi: ibmvscsi: Improve strings handling usb: wusbcore: security: cast sizeof to int for comparison powerpc/powernv/ioda2: Reduce upper limit for DMA window size alarmtimer: Prevent overflow for relative nanosleep s390/extmem: fix gcc 8 stringop-overflow warning ALSA: snd-aoa: add of_node_put() in error path media: s3c-camif: ignore -ENOIOCTLCMD from v4l2_subdev_call for s_power media: soc_camera: ov772x: correct setting of banding filter media: omap3isp: zero-initialize the isp cam_xclk{a,b} initial data staging: android: ashmem: Fix mmap size validation drivers/tty: add error handling for pcmcia_loop_config media: tm6000: add error handling for dvb_register_adapter ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge net: phy: xgmiitorgmii: Check read_status results ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock net: phy: xgmiitorgmii: Check phy_driver ready before accessing drm/sun4i: Fix releasing node when enumerating enpoints rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication() wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout() ARM: mvebu: declare asm symbols as character arrays in pmsu.c HID: hid-ntrig: add error handling for sysfs_create_group perf/x86/intel/lbr: Fix incomplete LBR call stack scsi: bnx2i: add error handling for ioremap_nocache scsi: megaraid_sas: Update controller info during resume EDAC, i7core: Fix memleaks and use-after-free on probe and remove ASoC: dapm: Fix potential DAI widget pointer deref when linking DAIs module: exclude SHN_UNDEF symbols from kallsyms api gpio: Fix wrong rounding in gpio-menz127 nfsd: fix corrupted reply to badly ordered compound EDAC: Fix memleak in module init error path ARM: dts: dra7: fix DCAN node addresses floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl tty: serial: lpuart: avoid leaking struct tty_struct serial: cpm_uart: return immediately from console poll spi: tegra20-slink: explicitly enable/disable clock spi: sh-msiof: Fix invalid SPI use during system suspend spi: sh-msiof: Fix handling of write value for SISTR register spi: rspi: Fix invalid SPI use during system suspend spi: rspi: Fix interrupted DMA transfers regulator: fix crash caused by null driver data USB: fix error handling in usb_driver_claim_interface() USB: handle NULL config in usb_find_alt_setting() slub: make ->cpu_partial unsigned int media: uvcvideo: Support realtek's UVC 1.5 device USB: usbdevfs: sanitize flags more USB: usbdevfs: restore warning for nonsensical flags Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()" USB: remove LPM management from usb_driver_claim_interface() Input: elantech - enable middle button of touchpad on ThinkPad P72 IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop IB/hfi1: Invalid user input can result in crash IB/hfi1: Fix context recovery when PBC has an UnsupportedVL scsi: target: iscsi: Use bin2hex instead of a re-implementation serial: imx: restore handshaking irq for imx1 IB/hfi1: Fix SL array bounds check arm64: KVM: Tighten guest core register access from userspace ext4: never move the system.data xattr out of the inode body qed: Wait for ready indication before rereading the shmem qed: Wait for MCP halt and resume commands to take place thermal: of-thermal: disable passive polling when thermal zone is disabled net: hns: fix length and page_offset overflow when CONFIG_ARM64_64K_PAGES net: hns: fix skb->truesize underestimation e1000: check on netif_running() before calling e1000_up() e1000: ensure to free old tx/rx rings in set_ringparam() hwmon: (ina2xx) fix sysfs shunt resistor read access hwmon: (adt7475) Make adt7475_read_word() return errors drm/amdgpu: Enable/disable gfx PG feature in rlc safe mode drm/amdgpu: Update power state at the end of smu hw_init. arm/arm64: smccc-1.1: Make return values unsigned long arm/arm64: smccc-1.1: Handle function result as parameters i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus arm64: KVM: Sanitize PSTATE.M when being set from userspace media: v4l: event: Prevent freeing event subscriptions while accessed Linux 4.9.131 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-10-04 13:43:03 -07:00
register unsigned long r0 SMCCC_REG(0) = (u32)a0; \
register unsigned long r1 SMCCC_REG(1) = __a1; \
register unsigned long r2 SMCCC_REG(2); \
register unsigned long r3 SMCCC_REG(3)
#define __declare_arg_2(a0, a1, a2, res) \
arm/arm64: smccc-1.1: Handle function result as parameters [ Upstream commit 755a8bf5579d22eb5636685c516d8dede799e27b ] If someone has the silly idea to write something along those lines: extern u64 foo(void); void bar(struct arm_smccc_res *res) { arm_smccc_1_1_smc(0xbad, foo(), res); } they are in for a surprise, as this gets compiled as: 0000000000000588 <bar>: 588: a9be7bfd stp x29, x30, [sp, #-32]! 58c: 910003fd mov x29, sp 590: f9000bf3 str x19, [sp, #16] 594: aa0003f3 mov x19, x0 598: aa1e03e0 mov x0, x30 59c: 94000000 bl 0 <_mcount> 5a0: 94000000 bl 0 <foo> 5a4: aa0003e1 mov x1, x0 5a8: d4000003 smc #0x0 5ac: b4000073 cbz x19, 5b8 <bar+0x30> 5b0: a9000660 stp x0, x1, [x19] 5b4: a9010e62 stp x2, x3, [x19, #16] 5b8: f9400bf3 ldr x19, [sp, #16] 5bc: a8c27bfd ldp x29, x30, [sp], #32 5c0: d65f03c0 ret 5c4: d503201f nop The call to foo "overwrites" the x0 register for the return value, and we end up calling the wrong secure service. A solution is to evaluate all the parameters before assigning anything to specific registers, leading to the expected result: 0000000000000588 <bar>: 588: a9be7bfd stp x29, x30, [sp, #-32]! 58c: 910003fd mov x29, sp 590: f9000bf3 str x19, [sp, #16] 594: aa0003f3 mov x19, x0 598: aa1e03e0 mov x0, x30 59c: 94000000 bl 0 <_mcount> 5a0: 94000000 bl 0 <foo> 5a4: aa0003e1 mov x1, x0 5a8: d28175a0 mov x0, #0xbad 5ac: d4000003 smc #0x0 5b0: b4000073 cbz x19, 5bc <bar+0x34> 5b4: a9000660 stp x0, x1, [x19] 5b8: a9010e62 stp x2, x3, [x19, #16] 5bc: f9400bf3 ldr x19, [sp, #16] 5c0: a8c27bfd ldp x29, x30, [sp], #32 5c4: d65f03c0 ret Reported-by: Julien Grall <julien.grall@arm.com> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-24 15:08:30 +01:00
typeof(a1) __a1 = a1; \
typeof(a2) __a2 = a2; \
struct arm_smccc_res *___res = res; \
This is the 4.9.131 stable release -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlu1WHMACgkQONu9yGCS aT4hyBAAzcHneF2/PsUfSfmkGFh9djX0Nyev3g3DgreVCcRJMok5Gbz4c0W2U0FN 0CdLA0XWqdjyzuSbzFr1itcaska4Vly6CSrsMJLNJcQr7rriL1Ov4AHXI+8bWAXV 81Ph7m9GGagl5SpMJOOPAghMvurp0YIiZGm8ME/tzOzTmtIwuy0iftXW/VKwQWTY hXMmHk7pm/rkldbEdKnsuDcdx7x4HvdZJDe8opvHXZ00W90RMSbfE4geIzSQQf3y G8eXkK6krT+dxvcaJGDyUuXPkbO97oirp2GIWAF0RTBBHH/eeHYCBXmiE8dmkisv nvZdQrZ1wAf8IpN7iyH/CbsvTM38lFPz+gqiU9TVAlX8BPPkHrJxYJ4GYkwmQvIY 7npcHPBfAgG9fL27uCZMq63uoNh2I5kShVJHQTBTNKxoG6yoHi6utNyCWzrpK75c EMHQL4w4ygv1dyE01NV3Cr1Pig5l+dEpE6FKoLYSyI7vPS8P3K92IArdM+TjXn96 9tm3MbeDmZTr5RJyv2j+7r55aFR2Ad43E7NHTxN92rfyZfSUw7/Egrk/3mzMivXj kQqwrj9edta86lI9fmmMW5AywbOvVIVnG89vKk21Q7n1xnXMKwdEoJnw65yJFvTu X0stqUubJ3U3g/WkdFcHCZFy6m3hQDCPBkyxAs/09qUIFAqKfp8= =GmzY -----END PGP SIGNATURE----- Merge 4.9.131 into android-4.9 Changes in 4.9.131 crypto: skcipher - Fix -Wstringop-truncation warnings tsl2550: fix lux1_input error in low light vmci: type promotion bug in qp_host_get_user_memory() x86/numa_emulation: Fix emulated-to-physical node mapping staging: rts5208: fix missing error check on call to rtsx_write_register uwb: hwa-rc: fix memory leak at probe power: vexpress: fix corruption in notifier registration iommu/amd: make sure TLB to be flushed before IOVA freed Bluetooth: Add a new Realtek 8723DE ID 0bda:b009 USB: serial: kobil_sct: fix modem-status error handling 6lowpan: iphc: reset mac_header after decompress to fix panic s390/mm: correct allocate_pgste proc_handler callback power: remove possible deadlock when unregistering power_supply md-cluster: clear another node's suspend_area after the copy is finished IB/core: type promotion bug in rdma_rw_init_one_mr() media: exynos4-is: Prevent NULL pointer dereference in __isp_video_try_fmt() powerpc/kdump: Handle crashkernel memory reservation failure media: fsl-viu: fix error handling in viu_of_probe() x86/tsc: Add missing header to tsc_msr.c ARM: hwmod: RTC: Don't assume lock/unlock will be called with irq enabled x86/entry/64: Add two more instruction suffixes scsi: target/iscsi: Make iscsit_ta_authentication() respect the output buffer size scsi: klist: Make it safe to use klists in atomic context scsi: ibmvscsi: Improve strings handling usb: wusbcore: security: cast sizeof to int for comparison powerpc/powernv/ioda2: Reduce upper limit for DMA window size alarmtimer: Prevent overflow for relative nanosleep s390/extmem: fix gcc 8 stringop-overflow warning ALSA: snd-aoa: add of_node_put() in error path media: s3c-camif: ignore -ENOIOCTLCMD from v4l2_subdev_call for s_power media: soc_camera: ov772x: correct setting of banding filter media: omap3isp: zero-initialize the isp cam_xclk{a,b} initial data staging: android: ashmem: Fix mmap size validation drivers/tty: add error handling for pcmcia_loop_config media: tm6000: add error handling for dvb_register_adapter ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge net: phy: xgmiitorgmii: Check read_status results ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock net: phy: xgmiitorgmii: Check phy_driver ready before accessing drm/sun4i: Fix releasing node when enumerating enpoints rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication() wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout() ARM: mvebu: declare asm symbols as character arrays in pmsu.c HID: hid-ntrig: add error handling for sysfs_create_group perf/x86/intel/lbr: Fix incomplete LBR call stack scsi: bnx2i: add error handling for ioremap_nocache scsi: megaraid_sas: Update controller info during resume EDAC, i7core: Fix memleaks and use-after-free on probe and remove ASoC: dapm: Fix potential DAI widget pointer deref when linking DAIs module: exclude SHN_UNDEF symbols from kallsyms api gpio: Fix wrong rounding in gpio-menz127 nfsd: fix corrupted reply to badly ordered compound EDAC: Fix memleak in module init error path ARM: dts: dra7: fix DCAN node addresses floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl tty: serial: lpuart: avoid leaking struct tty_struct serial: cpm_uart: return immediately from console poll spi: tegra20-slink: explicitly enable/disable clock spi: sh-msiof: Fix invalid SPI use during system suspend spi: sh-msiof: Fix handling of write value for SISTR register spi: rspi: Fix invalid SPI use during system suspend spi: rspi: Fix interrupted DMA transfers regulator: fix crash caused by null driver data USB: fix error handling in usb_driver_claim_interface() USB: handle NULL config in usb_find_alt_setting() slub: make ->cpu_partial unsigned int media: uvcvideo: Support realtek's UVC 1.5 device USB: usbdevfs: sanitize flags more USB: usbdevfs: restore warning for nonsensical flags Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()" USB: remove LPM management from usb_driver_claim_interface() Input: elantech - enable middle button of touchpad on ThinkPad P72 IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop IB/hfi1: Invalid user input can result in crash IB/hfi1: Fix context recovery when PBC has an UnsupportedVL scsi: target: iscsi: Use bin2hex instead of a re-implementation serial: imx: restore handshaking irq for imx1 IB/hfi1: Fix SL array bounds check arm64: KVM: Tighten guest core register access from userspace ext4: never move the system.data xattr out of the inode body qed: Wait for ready indication before rereading the shmem qed: Wait for MCP halt and resume commands to take place thermal: of-thermal: disable passive polling when thermal zone is disabled net: hns: fix length and page_offset overflow when CONFIG_ARM64_64K_PAGES net: hns: fix skb->truesize underestimation e1000: check on netif_running() before calling e1000_up() e1000: ensure to free old tx/rx rings in set_ringparam() hwmon: (ina2xx) fix sysfs shunt resistor read access hwmon: (adt7475) Make adt7475_read_word() return errors drm/amdgpu: Enable/disable gfx PG feature in rlc safe mode drm/amdgpu: Update power state at the end of smu hw_init. arm/arm64: smccc-1.1: Make return values unsigned long arm/arm64: smccc-1.1: Handle function result as parameters i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus arm64: KVM: Sanitize PSTATE.M when being set from userspace media: v4l: event: Prevent freeing event subscriptions while accessed Linux 4.9.131 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-10-04 13:43:03 -07:00
register unsigned long r0 SMCCC_REG(0) = (u32)a0; \
register unsigned long r1 SMCCC_REG(1) = __a1; \
register unsigned long r2 SMCCC_REG(2) = __a2; \
register unsigned long r3 SMCCC_REG(3)
#define __declare_arg_3(a0, a1, a2, a3, res) \
arm/arm64: smccc-1.1: Handle function result as parameters [ Upstream commit 755a8bf5579d22eb5636685c516d8dede799e27b ] If someone has the silly idea to write something along those lines: extern u64 foo(void); void bar(struct arm_smccc_res *res) { arm_smccc_1_1_smc(0xbad, foo(), res); } they are in for a surprise, as this gets compiled as: 0000000000000588 <bar>: 588: a9be7bfd stp x29, x30, [sp, #-32]! 58c: 910003fd mov x29, sp 590: f9000bf3 str x19, [sp, #16] 594: aa0003f3 mov x19, x0 598: aa1e03e0 mov x0, x30 59c: 94000000 bl 0 <_mcount> 5a0: 94000000 bl 0 <foo> 5a4: aa0003e1 mov x1, x0 5a8: d4000003 smc #0x0 5ac: b4000073 cbz x19, 5b8 <bar+0x30> 5b0: a9000660 stp x0, x1, [x19] 5b4: a9010e62 stp x2, x3, [x19, #16] 5b8: f9400bf3 ldr x19, [sp, #16] 5bc: a8c27bfd ldp x29, x30, [sp], #32 5c0: d65f03c0 ret 5c4: d503201f nop The call to foo "overwrites" the x0 register for the return value, and we end up calling the wrong secure service. A solution is to evaluate all the parameters before assigning anything to specific registers, leading to the expected result: 0000000000000588 <bar>: 588: a9be7bfd stp x29, x30, [sp, #-32]! 58c: 910003fd mov x29, sp 590: f9000bf3 str x19, [sp, #16] 594: aa0003f3 mov x19, x0 598: aa1e03e0 mov x0, x30 59c: 94000000 bl 0 <_mcount> 5a0: 94000000 bl 0 <foo> 5a4: aa0003e1 mov x1, x0 5a8: d28175a0 mov x0, #0xbad 5ac: d4000003 smc #0x0 5b0: b4000073 cbz x19, 5bc <bar+0x34> 5b4: a9000660 stp x0, x1, [x19] 5b8: a9010e62 stp x2, x3, [x19, #16] 5bc: f9400bf3 ldr x19, [sp, #16] 5c0: a8c27bfd ldp x29, x30, [sp], #32 5c4: d65f03c0 ret Reported-by: Julien Grall <julien.grall@arm.com> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-24 15:08:30 +01:00
typeof(a1) __a1 = a1; \
typeof(a2) __a2 = a2; \
typeof(a3) __a3 = a3; \
struct arm_smccc_res *___res = res; \
This is the 4.9.131 stable release -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlu1WHMACgkQONu9yGCS aT4hyBAAzcHneF2/PsUfSfmkGFh9djX0Nyev3g3DgreVCcRJMok5Gbz4c0W2U0FN 0CdLA0XWqdjyzuSbzFr1itcaska4Vly6CSrsMJLNJcQr7rriL1Ov4AHXI+8bWAXV 81Ph7m9GGagl5SpMJOOPAghMvurp0YIiZGm8ME/tzOzTmtIwuy0iftXW/VKwQWTY hXMmHk7pm/rkldbEdKnsuDcdx7x4HvdZJDe8opvHXZ00W90RMSbfE4geIzSQQf3y G8eXkK6krT+dxvcaJGDyUuXPkbO97oirp2GIWAF0RTBBHH/eeHYCBXmiE8dmkisv nvZdQrZ1wAf8IpN7iyH/CbsvTM38lFPz+gqiU9TVAlX8BPPkHrJxYJ4GYkwmQvIY 7npcHPBfAgG9fL27uCZMq63uoNh2I5kShVJHQTBTNKxoG6yoHi6utNyCWzrpK75c EMHQL4w4ygv1dyE01NV3Cr1Pig5l+dEpE6FKoLYSyI7vPS8P3K92IArdM+TjXn96 9tm3MbeDmZTr5RJyv2j+7r55aFR2Ad43E7NHTxN92rfyZfSUw7/Egrk/3mzMivXj kQqwrj9edta86lI9fmmMW5AywbOvVIVnG89vKk21Q7n1xnXMKwdEoJnw65yJFvTu X0stqUubJ3U3g/WkdFcHCZFy6m3hQDCPBkyxAs/09qUIFAqKfp8= =GmzY -----END PGP SIGNATURE----- Merge 4.9.131 into android-4.9 Changes in 4.9.131 crypto: skcipher - Fix -Wstringop-truncation warnings tsl2550: fix lux1_input error in low light vmci: type promotion bug in qp_host_get_user_memory() x86/numa_emulation: Fix emulated-to-physical node mapping staging: rts5208: fix missing error check on call to rtsx_write_register uwb: hwa-rc: fix memory leak at probe power: vexpress: fix corruption in notifier registration iommu/amd: make sure TLB to be flushed before IOVA freed Bluetooth: Add a new Realtek 8723DE ID 0bda:b009 USB: serial: kobil_sct: fix modem-status error handling 6lowpan: iphc: reset mac_header after decompress to fix panic s390/mm: correct allocate_pgste proc_handler callback power: remove possible deadlock when unregistering power_supply md-cluster: clear another node's suspend_area after the copy is finished IB/core: type promotion bug in rdma_rw_init_one_mr() media: exynos4-is: Prevent NULL pointer dereference in __isp_video_try_fmt() powerpc/kdump: Handle crashkernel memory reservation failure media: fsl-viu: fix error handling in viu_of_probe() x86/tsc: Add missing header to tsc_msr.c ARM: hwmod: RTC: Don't assume lock/unlock will be called with irq enabled x86/entry/64: Add two more instruction suffixes scsi: target/iscsi: Make iscsit_ta_authentication() respect the output buffer size scsi: klist: Make it safe to use klists in atomic context scsi: ibmvscsi: Improve strings handling usb: wusbcore: security: cast sizeof to int for comparison powerpc/powernv/ioda2: Reduce upper limit for DMA window size alarmtimer: Prevent overflow for relative nanosleep s390/extmem: fix gcc 8 stringop-overflow warning ALSA: snd-aoa: add of_node_put() in error path media: s3c-camif: ignore -ENOIOCTLCMD from v4l2_subdev_call for s_power media: soc_camera: ov772x: correct setting of banding filter media: omap3isp: zero-initialize the isp cam_xclk{a,b} initial data staging: android: ashmem: Fix mmap size validation drivers/tty: add error handling for pcmcia_loop_config media: tm6000: add error handling for dvb_register_adapter ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge net: phy: xgmiitorgmii: Check read_status results ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock net: phy: xgmiitorgmii: Check phy_driver ready before accessing drm/sun4i: Fix releasing node when enumerating enpoints rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication() wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout() ARM: mvebu: declare asm symbols as character arrays in pmsu.c HID: hid-ntrig: add error handling for sysfs_create_group perf/x86/intel/lbr: Fix incomplete LBR call stack scsi: bnx2i: add error handling for ioremap_nocache scsi: megaraid_sas: Update controller info during resume EDAC, i7core: Fix memleaks and use-after-free on probe and remove ASoC: dapm: Fix potential DAI widget pointer deref when linking DAIs module: exclude SHN_UNDEF symbols from kallsyms api gpio: Fix wrong rounding in gpio-menz127 nfsd: fix corrupted reply to badly ordered compound EDAC: Fix memleak in module init error path ARM: dts: dra7: fix DCAN node addresses floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl tty: serial: lpuart: avoid leaking struct tty_struct serial: cpm_uart: return immediately from console poll spi: tegra20-slink: explicitly enable/disable clock spi: sh-msiof: Fix invalid SPI use during system suspend spi: sh-msiof: Fix handling of write value for SISTR register spi: rspi: Fix invalid SPI use during system suspend spi: rspi: Fix interrupted DMA transfers regulator: fix crash caused by null driver data USB: fix error handling in usb_driver_claim_interface() USB: handle NULL config in usb_find_alt_setting() slub: make ->cpu_partial unsigned int media: uvcvideo: Support realtek's UVC 1.5 device USB: usbdevfs: sanitize flags more USB: usbdevfs: restore warning for nonsensical flags Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()" USB: remove LPM management from usb_driver_claim_interface() Input: elantech - enable middle button of touchpad on ThinkPad P72 IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop IB/hfi1: Invalid user input can result in crash IB/hfi1: Fix context recovery when PBC has an UnsupportedVL scsi: target: iscsi: Use bin2hex instead of a re-implementation serial: imx: restore handshaking irq for imx1 IB/hfi1: Fix SL array bounds check arm64: KVM: Tighten guest core register access from userspace ext4: never move the system.data xattr out of the inode body qed: Wait for ready indication before rereading the shmem qed: Wait for MCP halt and resume commands to take place thermal: of-thermal: disable passive polling when thermal zone is disabled net: hns: fix length and page_offset overflow when CONFIG_ARM64_64K_PAGES net: hns: fix skb->truesize underestimation e1000: check on netif_running() before calling e1000_up() e1000: ensure to free old tx/rx rings in set_ringparam() hwmon: (ina2xx) fix sysfs shunt resistor read access hwmon: (adt7475) Make adt7475_read_word() return errors drm/amdgpu: Enable/disable gfx PG feature in rlc safe mode drm/amdgpu: Update power state at the end of smu hw_init. arm/arm64: smccc-1.1: Make return values unsigned long arm/arm64: smccc-1.1: Handle function result as parameters i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus arm64: KVM: Sanitize PSTATE.M when being set from userspace media: v4l: event: Prevent freeing event subscriptions while accessed Linux 4.9.131 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-10-04 13:43:03 -07:00
register unsigned long r0 SMCCC_REG(0) = (u32)a0; \
register unsigned long r1 SMCCC_REG(1) = __a1; \
register unsigned long r2 SMCCC_REG(2) = __a2; \
register unsigned long r3 SMCCC_REG(3) = __a3
#define __declare_arg_4(a0, a1, a2, a3, a4, res) \
arm/arm64: smccc-1.1: Handle function result as parameters [ Upstream commit 755a8bf5579d22eb5636685c516d8dede799e27b ] If someone has the silly idea to write something along those lines: extern u64 foo(void); void bar(struct arm_smccc_res *res) { arm_smccc_1_1_smc(0xbad, foo(), res); } they are in for a surprise, as this gets compiled as: 0000000000000588 <bar>: 588: a9be7bfd stp x29, x30, [sp, #-32]! 58c: 910003fd mov x29, sp 590: f9000bf3 str x19, [sp, #16] 594: aa0003f3 mov x19, x0 598: aa1e03e0 mov x0, x30 59c: 94000000 bl 0 <_mcount> 5a0: 94000000 bl 0 <foo> 5a4: aa0003e1 mov x1, x0 5a8: d4000003 smc #0x0 5ac: b4000073 cbz x19, 5b8 <bar+0x30> 5b0: a9000660 stp x0, x1, [x19] 5b4: a9010e62 stp x2, x3, [x19, #16] 5b8: f9400bf3 ldr x19, [sp, #16] 5bc: a8c27bfd ldp x29, x30, [sp], #32 5c0: d65f03c0 ret 5c4: d503201f nop The call to foo "overwrites" the x0 register for the return value, and we end up calling the wrong secure service. A solution is to evaluate all the parameters before assigning anything to specific registers, leading to the expected result: 0000000000000588 <bar>: 588: a9be7bfd stp x29, x30, [sp, #-32]! 58c: 910003fd mov x29, sp 590: f9000bf3 str x19, [sp, #16] 594: aa0003f3 mov x19, x0 598: aa1e03e0 mov x0, x30 59c: 94000000 bl 0 <_mcount> 5a0: 94000000 bl 0 <foo> 5a4: aa0003e1 mov x1, x0 5a8: d28175a0 mov x0, #0xbad 5ac: d4000003 smc #0x0 5b0: b4000073 cbz x19, 5bc <bar+0x34> 5b4: a9000660 stp x0, x1, [x19] 5b8: a9010e62 stp x2, x3, [x19, #16] 5bc: f9400bf3 ldr x19, [sp, #16] 5c0: a8c27bfd ldp x29, x30, [sp], #32 5c4: d65f03c0 ret Reported-by: Julien Grall <julien.grall@arm.com> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-24 15:08:30 +01:00
typeof(a4) __a4 = a4; \
__declare_arg_3(a0, a1, a2, a3, res); \
This is the 4.9.131 stable release -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlu1WHMACgkQONu9yGCS aT4hyBAAzcHneF2/PsUfSfmkGFh9djX0Nyev3g3DgreVCcRJMok5Gbz4c0W2U0FN 0CdLA0XWqdjyzuSbzFr1itcaska4Vly6CSrsMJLNJcQr7rriL1Ov4AHXI+8bWAXV 81Ph7m9GGagl5SpMJOOPAghMvurp0YIiZGm8ME/tzOzTmtIwuy0iftXW/VKwQWTY hXMmHk7pm/rkldbEdKnsuDcdx7x4HvdZJDe8opvHXZ00W90RMSbfE4geIzSQQf3y G8eXkK6krT+dxvcaJGDyUuXPkbO97oirp2GIWAF0RTBBHH/eeHYCBXmiE8dmkisv nvZdQrZ1wAf8IpN7iyH/CbsvTM38lFPz+gqiU9TVAlX8BPPkHrJxYJ4GYkwmQvIY 7npcHPBfAgG9fL27uCZMq63uoNh2I5kShVJHQTBTNKxoG6yoHi6utNyCWzrpK75c EMHQL4w4ygv1dyE01NV3Cr1Pig5l+dEpE6FKoLYSyI7vPS8P3K92IArdM+TjXn96 9tm3MbeDmZTr5RJyv2j+7r55aFR2Ad43E7NHTxN92rfyZfSUw7/Egrk/3mzMivXj kQqwrj9edta86lI9fmmMW5AywbOvVIVnG89vKk21Q7n1xnXMKwdEoJnw65yJFvTu X0stqUubJ3U3g/WkdFcHCZFy6m3hQDCPBkyxAs/09qUIFAqKfp8= =GmzY -----END PGP SIGNATURE----- Merge 4.9.131 into android-4.9 Changes in 4.9.131 crypto: skcipher - Fix -Wstringop-truncation warnings tsl2550: fix lux1_input error in low light vmci: type promotion bug in qp_host_get_user_memory() x86/numa_emulation: Fix emulated-to-physical node mapping staging: rts5208: fix missing error check on call to rtsx_write_register uwb: hwa-rc: fix memory leak at probe power: vexpress: fix corruption in notifier registration iommu/amd: make sure TLB to be flushed before IOVA freed Bluetooth: Add a new Realtek 8723DE ID 0bda:b009 USB: serial: kobil_sct: fix modem-status error handling 6lowpan: iphc: reset mac_header after decompress to fix panic s390/mm: correct allocate_pgste proc_handler callback power: remove possible deadlock when unregistering power_supply md-cluster: clear another node's suspend_area after the copy is finished IB/core: type promotion bug in rdma_rw_init_one_mr() media: exynos4-is: Prevent NULL pointer dereference in __isp_video_try_fmt() powerpc/kdump: Handle crashkernel memory reservation failure media: fsl-viu: fix error handling in viu_of_probe() x86/tsc: Add missing header to tsc_msr.c ARM: hwmod: RTC: Don't assume lock/unlock will be called with irq enabled x86/entry/64: Add two more instruction suffixes scsi: target/iscsi: Make iscsit_ta_authentication() respect the output buffer size scsi: klist: Make it safe to use klists in atomic context scsi: ibmvscsi: Improve strings handling usb: wusbcore: security: cast sizeof to int for comparison powerpc/powernv/ioda2: Reduce upper limit for DMA window size alarmtimer: Prevent overflow for relative nanosleep s390/extmem: fix gcc 8 stringop-overflow warning ALSA: snd-aoa: add of_node_put() in error path media: s3c-camif: ignore -ENOIOCTLCMD from v4l2_subdev_call for s_power media: soc_camera: ov772x: correct setting of banding filter media: omap3isp: zero-initialize the isp cam_xclk{a,b} initial data staging: android: ashmem: Fix mmap size validation drivers/tty: add error handling for pcmcia_loop_config media: tm6000: add error handling for dvb_register_adapter ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge net: phy: xgmiitorgmii: Check read_status results ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock net: phy: xgmiitorgmii: Check phy_driver ready before accessing drm/sun4i: Fix releasing node when enumerating enpoints rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication() wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout() ARM: mvebu: declare asm symbols as character arrays in pmsu.c HID: hid-ntrig: add error handling for sysfs_create_group perf/x86/intel/lbr: Fix incomplete LBR call stack scsi: bnx2i: add error handling for ioremap_nocache scsi: megaraid_sas: Update controller info during resume EDAC, i7core: Fix memleaks and use-after-free on probe and remove ASoC: dapm: Fix potential DAI widget pointer deref when linking DAIs module: exclude SHN_UNDEF symbols from kallsyms api gpio: Fix wrong rounding in gpio-menz127 nfsd: fix corrupted reply to badly ordered compound EDAC: Fix memleak in module init error path ARM: dts: dra7: fix DCAN node addresses floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl tty: serial: lpuart: avoid leaking struct tty_struct serial: cpm_uart: return immediately from console poll spi: tegra20-slink: explicitly enable/disable clock spi: sh-msiof: Fix invalid SPI use during system suspend spi: sh-msiof: Fix handling of write value for SISTR register spi: rspi: Fix invalid SPI use during system suspend spi: rspi: Fix interrupted DMA transfers regulator: fix crash caused by null driver data USB: fix error handling in usb_driver_claim_interface() USB: handle NULL config in usb_find_alt_setting() slub: make ->cpu_partial unsigned int media: uvcvideo: Support realtek's UVC 1.5 device USB: usbdevfs: sanitize flags more USB: usbdevfs: restore warning for nonsensical flags Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()" USB: remove LPM management from usb_driver_claim_interface() Input: elantech - enable middle button of touchpad on ThinkPad P72 IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop IB/hfi1: Invalid user input can result in crash IB/hfi1: Fix context recovery when PBC has an UnsupportedVL scsi: target: iscsi: Use bin2hex instead of a re-implementation serial: imx: restore handshaking irq for imx1 IB/hfi1: Fix SL array bounds check arm64: KVM: Tighten guest core register access from userspace ext4: never move the system.data xattr out of the inode body qed: Wait for ready indication before rereading the shmem qed: Wait for MCP halt and resume commands to take place thermal: of-thermal: disable passive polling when thermal zone is disabled net: hns: fix length and page_offset overflow when CONFIG_ARM64_64K_PAGES net: hns: fix skb->truesize underestimation e1000: check on netif_running() before calling e1000_up() e1000: ensure to free old tx/rx rings in set_ringparam() hwmon: (ina2xx) fix sysfs shunt resistor read access hwmon: (adt7475) Make adt7475_read_word() return errors drm/amdgpu: Enable/disable gfx PG feature in rlc safe mode drm/amdgpu: Update power state at the end of smu hw_init. arm/arm64: smccc-1.1: Make return values unsigned long arm/arm64: smccc-1.1: Handle function result as parameters i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus arm64: KVM: Sanitize PSTATE.M when being set from userspace media: v4l: event: Prevent freeing event subscriptions while accessed Linux 4.9.131 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-10-04 13:43:03 -07:00
register unsigned long r4 SMCCC_REG(4) = __a4
#define __declare_arg_5(a0, a1, a2, a3, a4, a5, res) \
arm/arm64: smccc-1.1: Handle function result as parameters [ Upstream commit 755a8bf5579d22eb5636685c516d8dede799e27b ] If someone has the silly idea to write something along those lines: extern u64 foo(void); void bar(struct arm_smccc_res *res) { arm_smccc_1_1_smc(0xbad, foo(), res); } they are in for a surprise, as this gets compiled as: 0000000000000588 <bar>: 588: a9be7bfd stp x29, x30, [sp, #-32]! 58c: 910003fd mov x29, sp 590: f9000bf3 str x19, [sp, #16] 594: aa0003f3 mov x19, x0 598: aa1e03e0 mov x0, x30 59c: 94000000 bl 0 <_mcount> 5a0: 94000000 bl 0 <foo> 5a4: aa0003e1 mov x1, x0 5a8: d4000003 smc #0x0 5ac: b4000073 cbz x19, 5b8 <bar+0x30> 5b0: a9000660 stp x0, x1, [x19] 5b4: a9010e62 stp x2, x3, [x19, #16] 5b8: f9400bf3 ldr x19, [sp, #16] 5bc: a8c27bfd ldp x29, x30, [sp], #32 5c0: d65f03c0 ret 5c4: d503201f nop The call to foo "overwrites" the x0 register for the return value, and we end up calling the wrong secure service. A solution is to evaluate all the parameters before assigning anything to specific registers, leading to the expected result: 0000000000000588 <bar>: 588: a9be7bfd stp x29, x30, [sp, #-32]! 58c: 910003fd mov x29, sp 590: f9000bf3 str x19, [sp, #16] 594: aa0003f3 mov x19, x0 598: aa1e03e0 mov x0, x30 59c: 94000000 bl 0 <_mcount> 5a0: 94000000 bl 0 <foo> 5a4: aa0003e1 mov x1, x0 5a8: d28175a0 mov x0, #0xbad 5ac: d4000003 smc #0x0 5b0: b4000073 cbz x19, 5bc <bar+0x34> 5b4: a9000660 stp x0, x1, [x19] 5b8: a9010e62 stp x2, x3, [x19, #16] 5bc: f9400bf3 ldr x19, [sp, #16] 5c0: a8c27bfd ldp x29, x30, [sp], #32 5c4: d65f03c0 ret Reported-by: Julien Grall <julien.grall@arm.com> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-24 15:08:30 +01:00
typeof(a5) __a5 = a5; \
__declare_arg_4(a0, a1, a2, a3, a4, res); \
This is the 4.9.131 stable release -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlu1WHMACgkQONu9yGCS aT4hyBAAzcHneF2/PsUfSfmkGFh9djX0Nyev3g3DgreVCcRJMok5Gbz4c0W2U0FN 0CdLA0XWqdjyzuSbzFr1itcaska4Vly6CSrsMJLNJcQr7rriL1Ov4AHXI+8bWAXV 81Ph7m9GGagl5SpMJOOPAghMvurp0YIiZGm8ME/tzOzTmtIwuy0iftXW/VKwQWTY hXMmHk7pm/rkldbEdKnsuDcdx7x4HvdZJDe8opvHXZ00W90RMSbfE4geIzSQQf3y G8eXkK6krT+dxvcaJGDyUuXPkbO97oirp2GIWAF0RTBBHH/eeHYCBXmiE8dmkisv nvZdQrZ1wAf8IpN7iyH/CbsvTM38lFPz+gqiU9TVAlX8BPPkHrJxYJ4GYkwmQvIY 7npcHPBfAgG9fL27uCZMq63uoNh2I5kShVJHQTBTNKxoG6yoHi6utNyCWzrpK75c EMHQL4w4ygv1dyE01NV3Cr1Pig5l+dEpE6FKoLYSyI7vPS8P3K92IArdM+TjXn96 9tm3MbeDmZTr5RJyv2j+7r55aFR2Ad43E7NHTxN92rfyZfSUw7/Egrk/3mzMivXj kQqwrj9edta86lI9fmmMW5AywbOvVIVnG89vKk21Q7n1xnXMKwdEoJnw65yJFvTu X0stqUubJ3U3g/WkdFcHCZFy6m3hQDCPBkyxAs/09qUIFAqKfp8= =GmzY -----END PGP SIGNATURE----- Merge 4.9.131 into android-4.9 Changes in 4.9.131 crypto: skcipher - Fix -Wstringop-truncation warnings tsl2550: fix lux1_input error in low light vmci: type promotion bug in qp_host_get_user_memory() x86/numa_emulation: Fix emulated-to-physical node mapping staging: rts5208: fix missing error check on call to rtsx_write_register uwb: hwa-rc: fix memory leak at probe power: vexpress: fix corruption in notifier registration iommu/amd: make sure TLB to be flushed before IOVA freed Bluetooth: Add a new Realtek 8723DE ID 0bda:b009 USB: serial: kobil_sct: fix modem-status error handling 6lowpan: iphc: reset mac_header after decompress to fix panic s390/mm: correct allocate_pgste proc_handler callback power: remove possible deadlock when unregistering power_supply md-cluster: clear another node's suspend_area after the copy is finished IB/core: type promotion bug in rdma_rw_init_one_mr() media: exynos4-is: Prevent NULL pointer dereference in __isp_video_try_fmt() powerpc/kdump: Handle crashkernel memory reservation failure media: fsl-viu: fix error handling in viu_of_probe() x86/tsc: Add missing header to tsc_msr.c ARM: hwmod: RTC: Don't assume lock/unlock will be called with irq enabled x86/entry/64: Add two more instruction suffixes scsi: target/iscsi: Make iscsit_ta_authentication() respect the output buffer size scsi: klist: Make it safe to use klists in atomic context scsi: ibmvscsi: Improve strings handling usb: wusbcore: security: cast sizeof to int for comparison powerpc/powernv/ioda2: Reduce upper limit for DMA window size alarmtimer: Prevent overflow for relative nanosleep s390/extmem: fix gcc 8 stringop-overflow warning ALSA: snd-aoa: add of_node_put() in error path media: s3c-camif: ignore -ENOIOCTLCMD from v4l2_subdev_call for s_power media: soc_camera: ov772x: correct setting of banding filter media: omap3isp: zero-initialize the isp cam_xclk{a,b} initial data staging: android: ashmem: Fix mmap size validation drivers/tty: add error handling for pcmcia_loop_config media: tm6000: add error handling for dvb_register_adapter ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge net: phy: xgmiitorgmii: Check read_status results ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock net: phy: xgmiitorgmii: Check phy_driver ready before accessing drm/sun4i: Fix releasing node when enumerating enpoints rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication() wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout() ARM: mvebu: declare asm symbols as character arrays in pmsu.c HID: hid-ntrig: add error handling for sysfs_create_group perf/x86/intel/lbr: Fix incomplete LBR call stack scsi: bnx2i: add error handling for ioremap_nocache scsi: megaraid_sas: Update controller info during resume EDAC, i7core: Fix memleaks and use-after-free on probe and remove ASoC: dapm: Fix potential DAI widget pointer deref when linking DAIs module: exclude SHN_UNDEF symbols from kallsyms api gpio: Fix wrong rounding in gpio-menz127 nfsd: fix corrupted reply to badly ordered compound EDAC: Fix memleak in module init error path ARM: dts: dra7: fix DCAN node addresses floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl tty: serial: lpuart: avoid leaking struct tty_struct serial: cpm_uart: return immediately from console poll spi: tegra20-slink: explicitly enable/disable clock spi: sh-msiof: Fix invalid SPI use during system suspend spi: sh-msiof: Fix handling of write value for SISTR register spi: rspi: Fix invalid SPI use during system suspend spi: rspi: Fix interrupted DMA transfers regulator: fix crash caused by null driver data USB: fix error handling in usb_driver_claim_interface() USB: handle NULL config in usb_find_alt_setting() slub: make ->cpu_partial unsigned int media: uvcvideo: Support realtek's UVC 1.5 device USB: usbdevfs: sanitize flags more USB: usbdevfs: restore warning for nonsensical flags Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()" USB: remove LPM management from usb_driver_claim_interface() Input: elantech - enable middle button of touchpad on ThinkPad P72 IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop IB/hfi1: Invalid user input can result in crash IB/hfi1: Fix context recovery when PBC has an UnsupportedVL scsi: target: iscsi: Use bin2hex instead of a re-implementation serial: imx: restore handshaking irq for imx1 IB/hfi1: Fix SL array bounds check arm64: KVM: Tighten guest core register access from userspace ext4: never move the system.data xattr out of the inode body qed: Wait for ready indication before rereading the shmem qed: Wait for MCP halt and resume commands to take place thermal: of-thermal: disable passive polling when thermal zone is disabled net: hns: fix length and page_offset overflow when CONFIG_ARM64_64K_PAGES net: hns: fix skb->truesize underestimation e1000: check on netif_running() before calling e1000_up() e1000: ensure to free old tx/rx rings in set_ringparam() hwmon: (ina2xx) fix sysfs shunt resistor read access hwmon: (adt7475) Make adt7475_read_word() return errors drm/amdgpu: Enable/disable gfx PG feature in rlc safe mode drm/amdgpu: Update power state at the end of smu hw_init. arm/arm64: smccc-1.1: Make return values unsigned long arm/arm64: smccc-1.1: Handle function result as parameters i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus arm64: KVM: Sanitize PSTATE.M when being set from userspace media: v4l: event: Prevent freeing event subscriptions while accessed Linux 4.9.131 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-10-04 13:43:03 -07:00
register unsigned long r5 SMCCC_REG(5) = __a5
#define __declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res) \
arm/arm64: smccc-1.1: Handle function result as parameters [ Upstream commit 755a8bf5579d22eb5636685c516d8dede799e27b ] If someone has the silly idea to write something along those lines: extern u64 foo(void); void bar(struct arm_smccc_res *res) { arm_smccc_1_1_smc(0xbad, foo(), res); } they are in for a surprise, as this gets compiled as: 0000000000000588 <bar>: 588: a9be7bfd stp x29, x30, [sp, #-32]! 58c: 910003fd mov x29, sp 590: f9000bf3 str x19, [sp, #16] 594: aa0003f3 mov x19, x0 598: aa1e03e0 mov x0, x30 59c: 94000000 bl 0 <_mcount> 5a0: 94000000 bl 0 <foo> 5a4: aa0003e1 mov x1, x0 5a8: d4000003 smc #0x0 5ac: b4000073 cbz x19, 5b8 <bar+0x30> 5b0: a9000660 stp x0, x1, [x19] 5b4: a9010e62 stp x2, x3, [x19, #16] 5b8: f9400bf3 ldr x19, [sp, #16] 5bc: a8c27bfd ldp x29, x30, [sp], #32 5c0: d65f03c0 ret 5c4: d503201f nop The call to foo "overwrites" the x0 register for the return value, and we end up calling the wrong secure service. A solution is to evaluate all the parameters before assigning anything to specific registers, leading to the expected result: 0000000000000588 <bar>: 588: a9be7bfd stp x29, x30, [sp, #-32]! 58c: 910003fd mov x29, sp 590: f9000bf3 str x19, [sp, #16] 594: aa0003f3 mov x19, x0 598: aa1e03e0 mov x0, x30 59c: 94000000 bl 0 <_mcount> 5a0: 94000000 bl 0 <foo> 5a4: aa0003e1 mov x1, x0 5a8: d28175a0 mov x0, #0xbad 5ac: d4000003 smc #0x0 5b0: b4000073 cbz x19, 5bc <bar+0x34> 5b4: a9000660 stp x0, x1, [x19] 5b8: a9010e62 stp x2, x3, [x19, #16] 5bc: f9400bf3 ldr x19, [sp, #16] 5c0: a8c27bfd ldp x29, x30, [sp], #32 5c4: d65f03c0 ret Reported-by: Julien Grall <julien.grall@arm.com> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-24 15:08:30 +01:00
typeof(a6) __a6 = a6; \
__declare_arg_5(a0, a1, a2, a3, a4, a5, res); \
This is the 4.9.131 stable release -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlu1WHMACgkQONu9yGCS aT4hyBAAzcHneF2/PsUfSfmkGFh9djX0Nyev3g3DgreVCcRJMok5Gbz4c0W2U0FN 0CdLA0XWqdjyzuSbzFr1itcaska4Vly6CSrsMJLNJcQr7rriL1Ov4AHXI+8bWAXV 81Ph7m9GGagl5SpMJOOPAghMvurp0YIiZGm8ME/tzOzTmtIwuy0iftXW/VKwQWTY hXMmHk7pm/rkldbEdKnsuDcdx7x4HvdZJDe8opvHXZ00W90RMSbfE4geIzSQQf3y G8eXkK6krT+dxvcaJGDyUuXPkbO97oirp2GIWAF0RTBBHH/eeHYCBXmiE8dmkisv nvZdQrZ1wAf8IpN7iyH/CbsvTM38lFPz+gqiU9TVAlX8BPPkHrJxYJ4GYkwmQvIY 7npcHPBfAgG9fL27uCZMq63uoNh2I5kShVJHQTBTNKxoG6yoHi6utNyCWzrpK75c EMHQL4w4ygv1dyE01NV3Cr1Pig5l+dEpE6FKoLYSyI7vPS8P3K92IArdM+TjXn96 9tm3MbeDmZTr5RJyv2j+7r55aFR2Ad43E7NHTxN92rfyZfSUw7/Egrk/3mzMivXj kQqwrj9edta86lI9fmmMW5AywbOvVIVnG89vKk21Q7n1xnXMKwdEoJnw65yJFvTu X0stqUubJ3U3g/WkdFcHCZFy6m3hQDCPBkyxAs/09qUIFAqKfp8= =GmzY -----END PGP SIGNATURE----- Merge 4.9.131 into android-4.9 Changes in 4.9.131 crypto: skcipher - Fix -Wstringop-truncation warnings tsl2550: fix lux1_input error in low light vmci: type promotion bug in qp_host_get_user_memory() x86/numa_emulation: Fix emulated-to-physical node mapping staging: rts5208: fix missing error check on call to rtsx_write_register uwb: hwa-rc: fix memory leak at probe power: vexpress: fix corruption in notifier registration iommu/amd: make sure TLB to be flushed before IOVA freed Bluetooth: Add a new Realtek 8723DE ID 0bda:b009 USB: serial: kobil_sct: fix modem-status error handling 6lowpan: iphc: reset mac_header after decompress to fix panic s390/mm: correct allocate_pgste proc_handler callback power: remove possible deadlock when unregistering power_supply md-cluster: clear another node's suspend_area after the copy is finished IB/core: type promotion bug in rdma_rw_init_one_mr() media: exynos4-is: Prevent NULL pointer dereference in __isp_video_try_fmt() powerpc/kdump: Handle crashkernel memory reservation failure media: fsl-viu: fix error handling in viu_of_probe() x86/tsc: Add missing header to tsc_msr.c ARM: hwmod: RTC: Don't assume lock/unlock will be called with irq enabled x86/entry/64: Add two more instruction suffixes scsi: target/iscsi: Make iscsit_ta_authentication() respect the output buffer size scsi: klist: Make it safe to use klists in atomic context scsi: ibmvscsi: Improve strings handling usb: wusbcore: security: cast sizeof to int for comparison powerpc/powernv/ioda2: Reduce upper limit for DMA window size alarmtimer: Prevent overflow for relative nanosleep s390/extmem: fix gcc 8 stringop-overflow warning ALSA: snd-aoa: add of_node_put() in error path media: s3c-camif: ignore -ENOIOCTLCMD from v4l2_subdev_call for s_power media: soc_camera: ov772x: correct setting of banding filter media: omap3isp: zero-initialize the isp cam_xclk{a,b} initial data staging: android: ashmem: Fix mmap size validation drivers/tty: add error handling for pcmcia_loop_config media: tm6000: add error handling for dvb_register_adapter ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge net: phy: xgmiitorgmii: Check read_status results ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock net: phy: xgmiitorgmii: Check phy_driver ready before accessing drm/sun4i: Fix releasing node when enumerating enpoints rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication() wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout() ARM: mvebu: declare asm symbols as character arrays in pmsu.c HID: hid-ntrig: add error handling for sysfs_create_group perf/x86/intel/lbr: Fix incomplete LBR call stack scsi: bnx2i: add error handling for ioremap_nocache scsi: megaraid_sas: Update controller info during resume EDAC, i7core: Fix memleaks and use-after-free on probe and remove ASoC: dapm: Fix potential DAI widget pointer deref when linking DAIs module: exclude SHN_UNDEF symbols from kallsyms api gpio: Fix wrong rounding in gpio-menz127 nfsd: fix corrupted reply to badly ordered compound EDAC: Fix memleak in module init error path ARM: dts: dra7: fix DCAN node addresses floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl tty: serial: lpuart: avoid leaking struct tty_struct serial: cpm_uart: return immediately from console poll spi: tegra20-slink: explicitly enable/disable clock spi: sh-msiof: Fix invalid SPI use during system suspend spi: sh-msiof: Fix handling of write value for SISTR register spi: rspi: Fix invalid SPI use during system suspend spi: rspi: Fix interrupted DMA transfers regulator: fix crash caused by null driver data USB: fix error handling in usb_driver_claim_interface() USB: handle NULL config in usb_find_alt_setting() slub: make ->cpu_partial unsigned int media: uvcvideo: Support realtek's UVC 1.5 device USB: usbdevfs: sanitize flags more USB: usbdevfs: restore warning for nonsensical flags Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()" USB: remove LPM management from usb_driver_claim_interface() Input: elantech - enable middle button of touchpad on ThinkPad P72 IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop IB/hfi1: Invalid user input can result in crash IB/hfi1: Fix context recovery when PBC has an UnsupportedVL scsi: target: iscsi: Use bin2hex instead of a re-implementation serial: imx: restore handshaking irq for imx1 IB/hfi1: Fix SL array bounds check arm64: KVM: Tighten guest core register access from userspace ext4: never move the system.data xattr out of the inode body qed: Wait for ready indication before rereading the shmem qed: Wait for MCP halt and resume commands to take place thermal: of-thermal: disable passive polling when thermal zone is disabled net: hns: fix length and page_offset overflow when CONFIG_ARM64_64K_PAGES net: hns: fix skb->truesize underestimation e1000: check on netif_running() before calling e1000_up() e1000: ensure to free old tx/rx rings in set_ringparam() hwmon: (ina2xx) fix sysfs shunt resistor read access hwmon: (adt7475) Make adt7475_read_word() return errors drm/amdgpu: Enable/disable gfx PG feature in rlc safe mode drm/amdgpu: Update power state at the end of smu hw_init. arm/arm64: smccc-1.1: Make return values unsigned long arm/arm64: smccc-1.1: Handle function result as parameters i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus arm64: KVM: Sanitize PSTATE.M when being set from userspace media: v4l: event: Prevent freeing event subscriptions while accessed Linux 4.9.131 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-10-04 13:43:03 -07:00
register unsigned long r6 SMCCC_REG(6) = __a6
#define __declare_arg_7(a0, a1, a2, a3, a4, a5, a6, a7, res) \
arm/arm64: smccc-1.1: Handle function result as parameters [ Upstream commit 755a8bf5579d22eb5636685c516d8dede799e27b ] If someone has the silly idea to write something along those lines: extern u64 foo(void); void bar(struct arm_smccc_res *res) { arm_smccc_1_1_smc(0xbad, foo(), res); } they are in for a surprise, as this gets compiled as: 0000000000000588 <bar>: 588: a9be7bfd stp x29, x30, [sp, #-32]! 58c: 910003fd mov x29, sp 590: f9000bf3 str x19, [sp, #16] 594: aa0003f3 mov x19, x0 598: aa1e03e0 mov x0, x30 59c: 94000000 bl 0 <_mcount> 5a0: 94000000 bl 0 <foo> 5a4: aa0003e1 mov x1, x0 5a8: d4000003 smc #0x0 5ac: b4000073 cbz x19, 5b8 <bar+0x30> 5b0: a9000660 stp x0, x1, [x19] 5b4: a9010e62 stp x2, x3, [x19, #16] 5b8: f9400bf3 ldr x19, [sp, #16] 5bc: a8c27bfd ldp x29, x30, [sp], #32 5c0: d65f03c0 ret 5c4: d503201f nop The call to foo "overwrites" the x0 register for the return value, and we end up calling the wrong secure service. A solution is to evaluate all the parameters before assigning anything to specific registers, leading to the expected result: 0000000000000588 <bar>: 588: a9be7bfd stp x29, x30, [sp, #-32]! 58c: 910003fd mov x29, sp 590: f9000bf3 str x19, [sp, #16] 594: aa0003f3 mov x19, x0 598: aa1e03e0 mov x0, x30 59c: 94000000 bl 0 <_mcount> 5a0: 94000000 bl 0 <foo> 5a4: aa0003e1 mov x1, x0 5a8: d28175a0 mov x0, #0xbad 5ac: d4000003 smc #0x0 5b0: b4000073 cbz x19, 5bc <bar+0x34> 5b4: a9000660 stp x0, x1, [x19] 5b8: a9010e62 stp x2, x3, [x19, #16] 5bc: f9400bf3 ldr x19, [sp, #16] 5c0: a8c27bfd ldp x29, x30, [sp], #32 5c4: d65f03c0 ret Reported-by: Julien Grall <julien.grall@arm.com> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-24 15:08:30 +01:00
typeof(a7) __a7 = a7; \
__declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res); \
This is the 4.9.131 stable release -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlu1WHMACgkQONu9yGCS aT4hyBAAzcHneF2/PsUfSfmkGFh9djX0Nyev3g3DgreVCcRJMok5Gbz4c0W2U0FN 0CdLA0XWqdjyzuSbzFr1itcaska4Vly6CSrsMJLNJcQr7rriL1Ov4AHXI+8bWAXV 81Ph7m9GGagl5SpMJOOPAghMvurp0YIiZGm8ME/tzOzTmtIwuy0iftXW/VKwQWTY hXMmHk7pm/rkldbEdKnsuDcdx7x4HvdZJDe8opvHXZ00W90RMSbfE4geIzSQQf3y G8eXkK6krT+dxvcaJGDyUuXPkbO97oirp2GIWAF0RTBBHH/eeHYCBXmiE8dmkisv nvZdQrZ1wAf8IpN7iyH/CbsvTM38lFPz+gqiU9TVAlX8BPPkHrJxYJ4GYkwmQvIY 7npcHPBfAgG9fL27uCZMq63uoNh2I5kShVJHQTBTNKxoG6yoHi6utNyCWzrpK75c EMHQL4w4ygv1dyE01NV3Cr1Pig5l+dEpE6FKoLYSyI7vPS8P3K92IArdM+TjXn96 9tm3MbeDmZTr5RJyv2j+7r55aFR2Ad43E7NHTxN92rfyZfSUw7/Egrk/3mzMivXj kQqwrj9edta86lI9fmmMW5AywbOvVIVnG89vKk21Q7n1xnXMKwdEoJnw65yJFvTu X0stqUubJ3U3g/WkdFcHCZFy6m3hQDCPBkyxAs/09qUIFAqKfp8= =GmzY -----END PGP SIGNATURE----- Merge 4.9.131 into android-4.9 Changes in 4.9.131 crypto: skcipher - Fix -Wstringop-truncation warnings tsl2550: fix lux1_input error in low light vmci: type promotion bug in qp_host_get_user_memory() x86/numa_emulation: Fix emulated-to-physical node mapping staging: rts5208: fix missing error check on call to rtsx_write_register uwb: hwa-rc: fix memory leak at probe power: vexpress: fix corruption in notifier registration iommu/amd: make sure TLB to be flushed before IOVA freed Bluetooth: Add a new Realtek 8723DE ID 0bda:b009 USB: serial: kobil_sct: fix modem-status error handling 6lowpan: iphc: reset mac_header after decompress to fix panic s390/mm: correct allocate_pgste proc_handler callback power: remove possible deadlock when unregistering power_supply md-cluster: clear another node's suspend_area after the copy is finished IB/core: type promotion bug in rdma_rw_init_one_mr() media: exynos4-is: Prevent NULL pointer dereference in __isp_video_try_fmt() powerpc/kdump: Handle crashkernel memory reservation failure media: fsl-viu: fix error handling in viu_of_probe() x86/tsc: Add missing header to tsc_msr.c ARM: hwmod: RTC: Don't assume lock/unlock will be called with irq enabled x86/entry/64: Add two more instruction suffixes scsi: target/iscsi: Make iscsit_ta_authentication() respect the output buffer size scsi: klist: Make it safe to use klists in atomic context scsi: ibmvscsi: Improve strings handling usb: wusbcore: security: cast sizeof to int for comparison powerpc/powernv/ioda2: Reduce upper limit for DMA window size alarmtimer: Prevent overflow for relative nanosleep s390/extmem: fix gcc 8 stringop-overflow warning ALSA: snd-aoa: add of_node_put() in error path media: s3c-camif: ignore -ENOIOCTLCMD from v4l2_subdev_call for s_power media: soc_camera: ov772x: correct setting of banding filter media: omap3isp: zero-initialize the isp cam_xclk{a,b} initial data staging: android: ashmem: Fix mmap size validation drivers/tty: add error handling for pcmcia_loop_config media: tm6000: add error handling for dvb_register_adapter ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge net: phy: xgmiitorgmii: Check read_status results ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock net: phy: xgmiitorgmii: Check phy_driver ready before accessing drm/sun4i: Fix releasing node when enumerating enpoints rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication() wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout() ARM: mvebu: declare asm symbols as character arrays in pmsu.c HID: hid-ntrig: add error handling for sysfs_create_group perf/x86/intel/lbr: Fix incomplete LBR call stack scsi: bnx2i: add error handling for ioremap_nocache scsi: megaraid_sas: Update controller info during resume EDAC, i7core: Fix memleaks and use-after-free on probe and remove ASoC: dapm: Fix potential DAI widget pointer deref when linking DAIs module: exclude SHN_UNDEF symbols from kallsyms api gpio: Fix wrong rounding in gpio-menz127 nfsd: fix corrupted reply to badly ordered compound EDAC: Fix memleak in module init error path ARM: dts: dra7: fix DCAN node addresses floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl tty: serial: lpuart: avoid leaking struct tty_struct serial: cpm_uart: return immediately from console poll spi: tegra20-slink: explicitly enable/disable clock spi: sh-msiof: Fix invalid SPI use during system suspend spi: sh-msiof: Fix handling of write value for SISTR register spi: rspi: Fix invalid SPI use during system suspend spi: rspi: Fix interrupted DMA transfers regulator: fix crash caused by null driver data USB: fix error handling in usb_driver_claim_interface() USB: handle NULL config in usb_find_alt_setting() slub: make ->cpu_partial unsigned int media: uvcvideo: Support realtek's UVC 1.5 device USB: usbdevfs: sanitize flags more USB: usbdevfs: restore warning for nonsensical flags Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()" USB: remove LPM management from usb_driver_claim_interface() Input: elantech - enable middle button of touchpad on ThinkPad P72 IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop IB/hfi1: Invalid user input can result in crash IB/hfi1: Fix context recovery when PBC has an UnsupportedVL scsi: target: iscsi: Use bin2hex instead of a re-implementation serial: imx: restore handshaking irq for imx1 IB/hfi1: Fix SL array bounds check arm64: KVM: Tighten guest core register access from userspace ext4: never move the system.data xattr out of the inode body qed: Wait for ready indication before rereading the shmem qed: Wait for MCP halt and resume commands to take place thermal: of-thermal: disable passive polling when thermal zone is disabled net: hns: fix length and page_offset overflow when CONFIG_ARM64_64K_PAGES net: hns: fix skb->truesize underestimation e1000: check on netif_running() before calling e1000_up() e1000: ensure to free old tx/rx rings in set_ringparam() hwmon: (ina2xx) fix sysfs shunt resistor read access hwmon: (adt7475) Make adt7475_read_word() return errors drm/amdgpu: Enable/disable gfx PG feature in rlc safe mode drm/amdgpu: Update power state at the end of smu hw_init. arm/arm64: smccc-1.1: Make return values unsigned long arm/arm64: smccc-1.1: Handle function result as parameters i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus arm64: KVM: Sanitize PSTATE.M when being set from userspace media: v4l: event: Prevent freeing event subscriptions while accessed Linux 4.9.131 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-10-04 13:43:03 -07:00
register unsigned long r7 SMCCC_REG(7) = __a7
#define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__)
#define __declare_args(count, ...) ___declare_args(count, __VA_ARGS__)
#define ___constraints(count) \
: __constraint_write_ ## count \
: __constraint_read_ ## count \
: "memory"
#define __constraints(count) ___constraints(count)
/*
* We have an output list that is not necessarily used, and GCC feels
* entitled to optimise the whole sequence away. "volatile" is what
* makes it stick.
*/
#define __arm_smccc_1_1(inst, ...) \
do { \
__declare_args(__count_args(__VA_ARGS__), __VA_ARGS__); \
asm volatile(inst "\n" \
__constraints(__count_args(__VA_ARGS__))); \
if (___res) \
*___res = (typeof(*___res)){r0, r1, r2, r3}; \
} while (0)
/*
* arm_smccc_1_1_smc() - make an SMCCC v1.1 compliant SMC call
*
* This is a variadic macro taking one to eight source arguments, and
* an optional return structure.
*
* @a0-a7: arguments passed in registers 0 to 7
* @res: result values from registers 0 to 3
*
* This macro is used to make SMC calls following SMC Calling Convention v1.1.
* The content of the supplied param are copied to registers 0 to 7 prior
* to the SMC instruction. The return values are updated with the content
* from register 0 to 3 on return from the SMC instruction if not NULL.
*/
#define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__)
/*
* arm_smccc_1_1_hvc() - make an SMCCC v1.1 compliant HVC call
*
* This is a variadic macro taking one to eight source arguments, and
* an optional return structure.
*
* @a0-a7: arguments passed in registers 0 to 7
* @res: result values from registers 0 to 3
*
* This macro is used to make HVC calls following SMC Calling Convention v1.1.
* The content of the supplied param are copied to registers 0 to 7 prior
* to the HVC instruction. The return values are updated with the content
* from register 0 to 3 on return from the HVC instruction if not NULL.
*/
#define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__)
/* Return codes defined in ARM DEN 0070A */
#define SMCCC_RET_SUCCESS 0
#define SMCCC_RET_NOT_SUPPORTED -1
#define SMCCC_RET_NOT_REQUIRED -2
#endif /*__ASSEMBLY__*/
#endif /*__LINUX_ARM_SMCCC_H*/