1
0
Files
kernel-49/arch/sh/kernel/entry-common.S
Greg Kroah-Hartman e51ef120e8 Merge 4.9.233 into android-4.9-q
Changes in 4.9.233
	xfs: catch inode allocation state mismatch corruption
	xfs: validate cached inodes are free when allocated
	xfs: don't call xfs_da_shrink_inode with NULL bp
	net: phy: mdio-bcm-unimac: fix potential NULL dereference in unimac_mdio_probe()
	crypto: ccp - Release all allocated memory if sha type is invalid
	media: rc: prevent memory leak in cx23888_ir_probe
	ath9k_htc: release allocated buffer if timed out
	ath9k: release allocated buffer if timed out
	PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge
	ARM: 8986/1: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints
	drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()
	drm: hold gem reference until object is no longer accessed
	f2fs: check memory boundary by insane namelen
	f2fs: check if file namelen exceeds max value
	9p/trans_fd: abort p9_read_work if req status changed
	9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work
	x86/build/lto: Fix truncated .bss with -fdata-sections
	x86, vmlinux.lds: Page-align end of ..page_aligned sections
	fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.
	rds: Prevent kernel-infoleak in rds_notify_queue_get()
	xfs: fix missed wakeup on l_flush_wait
	uapi: includes linux/types.h before exporting files
	install several missing uapi headers
	net/x25: Fix x25_neigh refcnt leak when x25 disconnect
	net/x25: Fix null-ptr-deref in x25_disconnect
	sh: Fix validation of system call number
	net: lan78xx: add missing endpoint sanity check
	net: lan78xx: fix transfer-buffer memory leak
	mlx4: disable device on shutdown
	mlxsw: core: Increase scope of RCU read-side critical section
	mlxsw: core: Free EMAD transactions using kfree_rcu()
	ibmvnic: Fix IRQ mapping disposal in error path
	mac80211: mesh: Free ie data when leaving mesh
	mac80211: mesh: Free pending skb when destroying a mpath
	arm64: csum: Fix handling of bad packets
	usb: hso: Fix debug compile warning on sparc32
	qed: Disable "MFW indication via attention" SPAM every 5 minutes
	nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame
	parisc: add support for cmpxchg on u8 pointers
	net: ethernet: ravb: exit if re-initialization fails in tx timeout
	Revert "i2c: cadence: Fix the hold bit setting"
	xen-netfront: fix potential deadlock in xennet_remove()
	KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled
	x86/i8259: Use printk_deferred() to prevent deadlock
	random32: update the net random state on interrupt and activity
	ARM: percpu.h: fix build error
	random: fix circular include dependency on arm64 after addition of percpu.h
	random32: remove net_rand_state from the latent entropy gcc plugin
	random32: move the pseudo-random 32-bit definitions to prandom.h
	ext4: fix direct I/O read error
	USB: serial: qcserial: add EM7305 QDL product ID
	net/mlx5e: Don't support phys switch id if not in switchdev mode
	ALSA: seq: oss: Serialize ioctls
	Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt()
	Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt()
	Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt()
	omapfb: dss: Fix max fclk divider for omap36xx
	vgacon: Fix for missing check in scrollback handling
	mtd: properly check all write ioctls for permissions
	leds: wm831x-status: fix use-after-free on unbind
	leds: da903x: fix use-after-free on unbind
	leds: lm3533: fix use-after-free on unbind
	leds: 88pm860x: fix use-after-free on unbind
	net/9p: validate fds in p9_fd_open
	drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason
	cfg80211: check vendor command doit pointer before use
	igb: reinit_locked() should be called with rtnl_lock
	atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent
	tools lib traceevent: Fix memory leak in process_dynamic_array_len
	xattr: break delegations in {set,remove}xattr
	binder: Prevent context manager from incrementing ref 0
	ipv4: Silence suspicious RCU usage warning
	ipv6: fix memory leaks on IPV6_ADDRFORM path
	vxlan: Ensure FDB dump is performed under RCU
	net: lan78xx: replace bogus endpoint lookup
	Revert "vxlan: fix tos value before xmit"
	usb: hso: check for return value in hso_serial_common_create()
	Smack: fix use-after-free in smk_write_relabel_self()
	tracepoint: Mark __tracepoint_string's __used
	gpio: fix oops resulting from calling of_get_named_gpio(NULL, ...)
	cgroup: add missing skcd->no_refcnt check in cgroup_sk_clone()
	EDAC: Fix reference count leaks
	arm64: dts: qcom: msm8916: Replace invalid bias-pull-none property
	arm64: dts: exynos: Fix silent hang after boot on Espresso
	m68k: mac: Don't send IOP message until channel is idle
	m68k: mac: Fix IOP status/control register writes
	platform/x86: intel-hid: Fix return value check in check_acpi_dev()
	platform/x86: intel-vbtn: Fix return value check in check_acpi_dev()
	ARM: at91: pm: add missing put_device() call in at91_pm_sram_init()
	ARM: socfpga: PM: add missing put_device() call in socfpga_setup_ocram_self_refresh()
	drm/tilcdc: fix leak & null ref in panel_connector_get_modes
	Bluetooth: add a mutex lock to avoid UAF in do_enale_set
	fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls
	drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync
	video: fbdev: neofb: fix memory leak in neo_scan_monitor()
	md-cluster: fix wild pointer of unlock_all_bitmaps()
	drm/nouveau: fix multiple instances of reference count leaks
	drm/debugfs: fix plain echo to connector "force" attribute
	mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls
	brcmfmac: To fix Bss Info flag definition Bug
	iwlegacy: Check the return value of pcie_capability_read_*()
	usb: gadget: net2280: fix memory leak on probe error handling paths
	bdc: Fix bug causing crash after multiple disconnects
	dyndbg: fix a BUG_ON in ddebug_describe_flags
	bcache: fix super block seq numbers comparision in register_cache_set()
	ACPICA: Do not increment operation_region reference counts for field units
	agp/intel: Fix a memory leak on module initialisation failure
	video: fbdev: sm712fb: fix an issue about iounmap for a wrong address
	console: newport_con: fix an issue about leak related system resources
	video: pxafb: Fix the function used to balance a 'dma_alloc_coherent()' call
	iio: improve IIO_CONCENTRATION channel type description
	leds: lm355x: avoid enum conversion warning
	media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities()
	scsi: cumana_2: Fix different dev_id between request_irq() and free_irq()
	drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline
	cxl: Fix kobject memleak
	drm/radeon: fix array out-of-bounds read and write issues
	scsi: powertec: Fix different dev_id between request_irq() and free_irq()
	scsi: eesox: Fix different dev_id between request_irq() and free_irq()
	media: firewire: Using uninitialized values in node_probe()
	media: exynos4-is: Add missed check for pinctrl_lookup_state()
	xfs: fix reflink quota reservation accounting error
	PCI: Fix pci_cfg_wait queue locking problem
	leds: core: Flush scheduled work for system suspend
	drm: panel: simple: Fix bpc for LG LB070WV8 panel
	scsi: scsi_debug: Add check for sdebug_max_queue during module init
	mwifiex: Prevent memory corruption handling keys
	powerpc/vdso: Fix vdso cpu truncation
	staging: rtl8192u: fix a dubious looking mask before a shift
	PCI/ASPM: Add missing newline in sysfs 'policy'
	drm/imx: tve: fix regulator_disable error path
	USB: serial: iuu_phoenix: fix led-activity helpers
	usb: dwc2: Fix error path in gadget registration
	scsi: mesh: Fix panic after host or bus reset
	Smack: fix another vsscanf out of bounds
	Smack: prevent underflow in smk_set_cipso()
	power: supply: check if calc_soc succeeded in pm860x_init_battery
	selftests/powerpc: Fix CPU affinity for child process
	selftests/powerpc: Fix online CPU selection
	s390/qeth: don't process empty bridge port events
	wl1251: fix always return 0 error
	net: spider_net: Fix the size used in a 'dma_free_coherent()' call
	fsl/fman: use 32-bit unsigned integer
	fsl/fman: fix dereference null return value
	fsl/fman: fix unreachable code
	fsl/fman: check dereferencing null pointer
	fsl/fman: fix eth hash table allocation
	dlm: Fix kobject memleak
	pinctrl-single: fix pcs_parse_pinconf() return value
	drivers/net/wan/lapbether: Added needed_headroom and a skb->len check
	net/nfc/rawsock.c: add CAP_NET_RAW check.
	net: Set fput_needed iff FDPUT_FPUT is set
	USB: serial: cp210x: re-enable auto-RTS on open
	USB: serial: cp210x: enable usb generic throttle/unthrottle
	ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support
	ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109
	ALSA: usb-audio: add quirk for Pioneer DDJ-RB
	crypto: qat - fix double free in qat_uclo_create_batch_init_list
	crypto: ccp - Fix use of merged scatterlists
	fs/minix: check return value of sb_getblk()
	fs/minix: don't allow getting deleted inodes
	fs/minix: reject too-large maximum file size
	ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109
	9p: Fix memory leak in v9fs_mount
	parisc: mask out enable and reserved bits from sba imask
	ARM: 8992/1: Fix unwind_frame for clang-built kernels
	xen/balloon: fix accounting in alloc_xenballooned_pages error path
	xen/balloon: make the balloon wait interruptible
	smb3: warn on confusing error scenario with sec=krb5
	PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context()
	btrfs: don't allocate anonymous block device for user invisible roots
	btrfs: only search for left_info if there is no right_info in try_merge_free_space
	btrfs: fix memory leaks after failure to lookup checksums during inode logging
	iio: dac: ad5592r: fix unbalanced mutex unlocks in ad5592r_read_raw()
	xtensa: fix xtensa_pmu_setup prototype
	powerpc: Fix circular dependency between percpu.h and mmu.h
	net: ethernet: stmmac: Disable hardware multicast filter
	net: stmmac: dwmac1000: provide multicast filter fallback
	net/compat: Add missing sock updates for SCM_RIGHTS
	md/raid5: Fix Force reconstruct-write io stuck in degraded raid5
	bcache: allocate meta data pages as compound pages
	mac80211: fix misplaced while instead of if
	MIPS: CPU#0 is not hotpluggable
	ext2: fix missing percpu_counter_inc
	ocfs2: change slot number type s16 to u16
	ftrace: Setup correct FTRACE_FL_REGS flags for module
	kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler
	watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in watchdog_info.options
	watchdog: f71808e_wdt: remove use of wrong watchdog_info option
	watchdog: f71808e_wdt: clear watchdog timeout occurred flag
	pseries: Fix 64 bit logical memory block panic
	mfd: arizona: Ensure 32k clock is put on driver unbind and error
	USB: serial: ftdi_sio: make process-packet buffer unsigned
	USB: serial: ftdi_sio: clean up receive processing
	gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq handlers
	iommu/omap: Check for failure of a call to omap_iommu_dump_ctx
	iommu/vt-d: Enforce PASID devTLB field mask
	i2c: rcar: slave: only send STOP event when we have been addressed
	clk: clk-atlas6: fix return value check in atlas6_clk_init()
	pwm: bcm-iproc: handle clk_get_rate() return
	Input: sentelic - fix error return when fsp_reg_write fails
	drm/vmwgfx: Fix two list_for_each loop exit tests
	net: qcom/emac: add missed clk_disable_unprepare in error path of emac_clks_phase1_init
	nfs: Fix getxattr kernel panic and memory overflow
	fs/ufs: avoid potential u32 multiplication overflow
	mfd: dln2: Run event handler loop under spinlock
	ALSA: echoaudio: Fix potential Oops in snd_echo_resume()
	sh: landisk: Add missing initialization of sh_io_port_base
	khugepaged: retract_page_tables() remember to test exit
	mm: Avoid calling build_all_zonelists_init under hotplug context
	Linux 4.9.233

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ied62cb0768f5bd8e989d75e7c2ccf6f1e6f2efd4
2020-09-09 21:39:13 +03:00

403 lines
8.7 KiB
ArmAsm

/*
* Copyright (C) 1999, 2000, 2002 Niibe Yutaka
* Copyright (C) 2003 - 2008 Paul Mundt
*
* This file is subject to the terms and conditions of the GNU General Public
* License. See the file "COPYING" in the main directory of this archive
* for more details.
*
*/
! NOTE:
! GNU as (as of 2.9.1) changes bf/s into bt/s and bra, when the address
! to be jumped is too far, but it causes illegal slot exception.
/*
* entry.S contains the system-call and fault low-level handling routines.
* This also contains the timer-interrupt handler, as well as all interrupts
* and faults that can result in a task-switch.
*
* NOTE: This code handles signal-recognition, which happens every time
* after a timer-interrupt and after each system call.
*
* NOTE: This code uses a convention that instructions in the delay slot
* of a transfer-control instruction are indented by an extra space, thus:
*
* jmp @k0 ! control-transfer instruction
* ldc k1, ssr ! delay slot
*
* Stack layout in 'ret_from_syscall':
* ptrace needs to have all regs on the stack.
* if the order here is changed, it needs to be
* updated in ptrace.c and ptrace.h
*
* r0
* ...
* r15 = stack pointer
* spc
* pr
* ssr
* gbr
* mach
* macl
* syscall #
*
*/
#include <asm/dwarf.h>
#if defined(CONFIG_PREEMPT)
# define preempt_stop() cli ; TRACE_IRQS_OFF
#else
# define preempt_stop()
# define resume_kernel __restore_all
#endif
.align 2
ENTRY(exception_error)
!
TRACE_IRQS_ON
sti
mov.l 1f, r0
jmp @r0
nop
.align 2
1: .long do_exception_error
.align 2
ret_from_exception:
CFI_STARTPROC simple
CFI_DEF_CFA r14, 0
CFI_REL_OFFSET 17, 64
CFI_REL_OFFSET 15, 60
CFI_REL_OFFSET 14, 56
CFI_REL_OFFSET 13, 52
CFI_REL_OFFSET 12, 48
CFI_REL_OFFSET 11, 44
CFI_REL_OFFSET 10, 40
CFI_REL_OFFSET 9, 36
CFI_REL_OFFSET 8, 32
preempt_stop()
ENTRY(ret_from_irq)
!
mov #OFF_SR, r0
mov.l @(r0,r15), r0 ! get status register
shll r0
shll r0 ! kernel space?
get_current_thread_info r8, r0
bt resume_kernel ! Yes, it's from kernel, go back soon
#ifdef CONFIG_PREEMPT
bra resume_userspace
nop
ENTRY(resume_kernel)
cli
TRACE_IRQS_OFF
mov.l @(TI_PRE_COUNT,r8), r0 ! current_thread_info->preempt_count
tst r0, r0
bf noresched
need_resched:
mov.l @(TI_FLAGS,r8), r0 ! current_thread_info->flags
tst #_TIF_NEED_RESCHED, r0 ! need_resched set?
bt noresched
mov #OFF_SR, r0
mov.l @(r0,r15), r0 ! get status register
shlr r0
and #(0xf0>>1), r0 ! interrupts off (exception path)?
cmp/eq #(0xf0>>1), r0
bt noresched
mov.l 1f, r0
jsr @r0 ! call preempt_schedule_irq
nop
bra need_resched
nop
noresched:
bra __restore_all
nop
.align 2
1: .long preempt_schedule_irq
#endif
ENTRY(resume_userspace)
! r8: current_thread_info
cli
TRACE_IRQS_OFF
mov.l @(TI_FLAGS,r8), r0 ! current_thread_info->flags
tst #(_TIF_WORK_MASK & 0xff), r0
bt/s __restore_all
tst #_TIF_NEED_RESCHED, r0
.align 2
work_pending:
! r0: current_thread_info->flags
! r8: current_thread_info
! t: result of "tst #_TIF_NEED_RESCHED, r0"
bf/s work_resched
tst #(_TIF_SIGPENDING | _TIF_NOTIFY_RESUME), r0
work_notifysig:
bt/s __restore_all
mov r15, r4
mov r12, r5 ! set arg1(save_r0)
mov r0, r6
sti
mov.l 2f, r1
mov.l 3f, r0
jmp @r1
lds r0, pr
work_resched:
mov.l 1f, r1
jsr @r1 ! schedule
nop
cli
TRACE_IRQS_OFF
!
mov.l @(TI_FLAGS,r8), r0 ! current_thread_info->flags
tst #(_TIF_WORK_MASK & 0xff), r0
bt __restore_all
bra work_pending
tst #_TIF_NEED_RESCHED, r0
.align 2
1: .long schedule
2: .long do_notify_resume
3: .long resume_userspace
.align 2
syscall_exit_work:
! r0: current_thread_info->flags
! r8: current_thread_info
tst #(_TIF_WORK_SYSCALL_MASK & 0xff), r0
bt/s work_pending
tst #_TIF_NEED_RESCHED, r0
TRACE_IRQS_ON
sti
mov r15, r4
mov.l 8f, r0 ! do_syscall_trace_leave
jsr @r0
nop
bra resume_userspace
nop
.align 2
syscall_trace_entry:
! Yes it is traced.
mov r15, r4
mov.l 7f, r11 ! Call do_syscall_trace_enter which notifies
jsr @r11 ! superior (will chomp R[0-7])
nop
mov.l r0, @(OFF_R0,r15) ! Save return value
! Reload R0-R4 from kernel stack, where the
! parent may have modified them using
! ptrace(POKEUSR). (Note that R0-R2 are
! reloaded from the kernel stack by syscall_call
! below, so don't need to be reloaded here.)
! This allows the parent to rewrite system calls
! and args on the fly.
mov.l @(OFF_R4,r15), r4 ! arg0
mov.l @(OFF_R5,r15), r5
mov.l @(OFF_R6,r15), r6
mov.l @(OFF_R7,r15), r7 ! arg3
mov.l @(OFF_R3,r15), r3 ! syscall_nr
!
mov.l 6f, r10 ! Number of syscalls
cmp/hs r10, r3
bf syscall_call
mov #-ENOSYS, r0
bra syscall_exit
mov.l r0, @(OFF_R0,r15) ! Return value
__restore_all:
mov #OFF_SR, r0
mov.l @(r0,r15), r0 ! get status register
shlr2 r0
and #0x3c, r0
cmp/eq #0x3c, r0
bt 1f
TRACE_IRQS_ON
bra 2f
nop
1:
TRACE_IRQS_OFF
2:
mov.l 3f, r0
jmp @r0
nop
.align 2
3: .long restore_all
.align 2
syscall_badsys: ! Bad syscall number
get_current_thread_info r8, r0
mov #-ENOSYS, r0
bra resume_userspace
mov.l r0, @(OFF_R0,r15) ! Return value
/*
* The main debug trap handler.
*
* r8=TRA (not the trap number!)
*
* Note: This assumes that the trapa value is left in its original
* form (without the shlr2 shift) so the calculation for the jump
* call table offset remains a simple in place mask.
*/
debug_trap:
mov r8, r0
and #(0xf << 2), r0
mov.l 1f, r8
add r0, r8
mov.l @r8, r8
jsr @r8
nop
bra ret_from_exception
nop
CFI_ENDPROC
.align 2
1: .long debug_trap_table
/*
* Syscall interface:
*
* Syscall #: R3
* Arguments #0 to #3: R4--R7
* Arguments #4 to #6: R0, R1, R2
* TRA: See following table.
*
* (TRA>>2) Purpose
* -------- -------
* 0x00-0x0f original SH-3/4 syscall ABI (not in general use).
* 0x10-0x1f general SH-3/4 syscall ABI.
* 0x1f unified SH-2/3/4 syscall ABI (preferred).
* 0x20-0x2f original SH-2 syscall ABI.
* 0x30-0x3f debug traps used by the kernel.
* 0x40-0xff Not supported by all parts, so left unhandled.
*
* For making system calls, any trap number in the range for the
* given cpu model may be used, but the unified trap number 0x1f is
* preferred for compatibility with all models.
*
* The low bits of the trap number were once documented as matching
* the number of arguments, but they were never actually used as such
* by the kernel. SH-2 originally used its own separate trap range
* because several hardware exceptions fell in the range used for the
* SH-3/4 syscall ABI.
*
* This code also handles delegating other traps to the BIOS/gdb stub.
*
* Note: When we're first called, the TRA value must be shifted
* right 2 bits in order to get the value that was used as the "trapa"
* argument.
*/
.align 2
.globl ret_from_fork
ret_from_fork:
mov.l 1f, r8
jsr @r8
mov r0, r4
bra syscall_exit
nop
.align 2
.globl ret_from_kernel_thread
ret_from_kernel_thread:
mov.l 1f, r8
jsr @r8
mov r0, r4
mov.l @(OFF_R5,r15), r5 ! fn
jsr @r5
mov.l @(OFF_R4,r15), r4 ! arg
bra syscall_exit
nop
.align 2
1: .long schedule_tail
/*
* The poorly named main trapa decode and dispatch routine, for
* system calls and debug traps through their respective jump tables.
*/
ENTRY(system_call)
setup_frame_reg
#if !defined(CONFIG_CPU_SH2)
mov.l 1f, r9
mov.l @r9, r8 ! Read from TRA (Trap Address) Register
#endif
mov #OFF_TRA, r10
add r15, r10
mov.l r8, @r10 ! set TRA value to tra
/*
* Check the trap type
*/
mov #((0x20 << 2) - 1), r9
cmp/hi r9, r8
bt/s debug_trap ! it's a debug trap..
nop
TRACE_IRQS_ON
sti
!
get_current_thread_info r8, r10
mov.l @(TI_FLAGS,r8), r8
mov #(_TIF_WORK_SYSCALL_MASK & 0xff), r10
mov #(_TIF_WORK_SYSCALL_MASK >> 8), r9
tst r10, r8
shll8 r9
bf syscall_trace_entry
tst r9, r8
bf syscall_trace_entry
!
mov.l 6f, r8 ! Number of syscalls
cmp/hs r8, r3
bt syscall_badsys
!
syscall_call:
shll2 r3 ! x4
mov.l 3f, r8 ! Load the address of sys_call_table
add r8, r3
mov.l @r3, r8
mov.l @(OFF_R2,r15), r2
mov.l @(OFF_R1,r15), r1
mov.l @(OFF_R0,r15), r0
mov.l r2, @-r15
mov.l r1, @-r15
mov.l r0, @-r15
jsr @r8 ! jump to specific syscall handler
nop
add #12, r15
mov.l @(OFF_R0,r15), r12 ! save r0
mov.l r0, @(OFF_R0,r15) ! save the return value
!
syscall_exit:
cli
TRACE_IRQS_OFF
!
get_current_thread_info r8, r0
mov.l @(TI_FLAGS,r8), r0 ! current_thread_info->flags
tst #(_TIF_ALLWORK_MASK & 0xff), r0
mov #(_TIF_ALLWORK_MASK >> 8), r1
bf syscall_exit_work
shlr8 r0
tst r0, r1
bf syscall_exit_work
bra __restore_all
nop
.align 2
#if !defined(CONFIG_CPU_SH2)
1: .long TRA
#endif
6: .long NR_syscalls
3: .long sys_call_table
7: .long do_syscall_trace_enter
8: .long do_syscall_trace_leave