When CONFIG_OABI_COMPAT is set, the wrapper for semtimedop does not
bound the nsops argument.  A sufficiently large value will cause an
integer overflow in allocation size, followed by copying too much data
into the allocated buffer.  Fix this by restricting nsops to SEMOPM.
Untested.

Cc: stable@kernel.org
Signed-off-by: NDan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

- Remove coding standard violations reported by checkpatch.pl
- Delete comment about handling of conditional branches which is no
  longer true.
- Delete comment at end of file which lists all ARM instructions. This
  duplicates data available in the ARM ARM and seems like an
  unnecessary maintenance burden to keep this up to date and accurate.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

Being able to probe NOP instructions is useful for hard-coding probeable
locations and is used by the kprobes test code.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

These bit field manipulation instructions occur several thousand
times in an ARMv7 kernel.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

The MOVW and MOVT instructions account for approximately 7% of all
instructions in a ARMv7 kernel as GCC uses them instead of a literal
pool.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

The instruction decoding in space_cccc_000x needs to reject probing of
instructions with undefined patterns as they may in future become
defined and then emulated faultily - as has already happened with the
SMC instruction.

This fix is achieved by testing for the instruction patterns we want to
probe and making the the default fall-through paths reject probes. This
also allows us to remove some explicit tests for instructions that we
wish to reject, as that is now the default action.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

The tests to explicitly reject probing CPS, RFE and SRS instructions
are redundant as the default case is now to reject undecoded patterns.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

The PLD instructions wasn't being decoded correctly and the emulation
code wasn't adjusting PC correctly.

As the PLD instruction is only a performance hint we emulate it as a
simple nop, and we can broaden the instruction decoding to take into
account newer PLI and PLDW instructions.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

The emulation of SETEND was broken as it changed the endianess for
the running kprobes handling code. Rather than adding a new simulation
routine to fix this we'll just reject probing of SETEND as these should
be very rare in the kernel.

Note, the function emulate_none is now unused but it is left in the
source code as future patches will use it.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

Following the change to remove support for coprocessor instructions
we are left with three stub functions which can be consolidated.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

The kernel doesn't currently support VFP or Neon code, and probing of
code with CP15 operations is fraught with bad consequences. Therefore we
don't need the ability to probe coprocessor instructions and the code to
support this can be removed.

The removed code also had at least two bugs:
 - MRC into R15 should set CPSR not trash PC
 - LDC and STC which use PC as base register needed the address offset by 8
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

The USAD8 instruction wasn't being explicitly decoded leading
to the incorrect emulation routine being called. It can be correctly
decoded in the same way as the signed multiply instructions so we move
the decoding there.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

The signed multiply instructions were being decoded incorrectly.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

These sign extension instructions are encoded as extend-and-add
instructions where the register to add is specified as r15. The decoding
routines weren't checking for this and were using the incorrect
emulation code, giving incorrect results.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

The instructions space for media instructions contains some undefined
patterns. We need to reject probing of these because they may in future
become defined and the kprobes code may then emulate them faultily.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

The v6T2 RBIT instruction was accidentally being emulated correctly,
this patch adds correct decoding for the instruction.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

These instructions are specified as UNPREDICTABLE.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

The decoding of these instructions got the register indexed and
immediate indexed forms the wrong way around, causing incorrect
emulation.

Instructions like "LDRD Rx, [Rx]" were corrupting Rx because the base
register writeback was being performed unconditionally, overwriting the
value just loaded from memory. The fix is to only writeback the base
register when that form of the instruction is used. Note, now that we
reject probing writeback with PC the emulation code doesn't need the
check rn!=15.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

Using PC as an base register with writeback is UNPREDICTABLE, as is non
word-sized loads or stores of PC. (We only really care about preventing
loads to PC but it keeps the code simpler if we also exclude stores.)
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

The decoding of these instructions got the register indexed and
immediate indexed forms the wrong way around, causing incorrect
emulation.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

The emulation code for STREX and LDREX instructions is faulty, however,
rather than attempting to fix this we reject probes of these
instructions. We do this because they can never succeed in gaining
exclusive access as the exception framework clears the exclusivity
monitor when a probes breakpoint is hit. (This is a general problem
when probing all instructions executing between a LDREX and its
corresponding STREX and can lead to infinite retry loops.)
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

The instructions space for 'Multiply and multiply-accumulate'
instructions contains some undefined patterns. We need to reject
probing of these because they may in future become defined and the
kprobes code may then emulate them faultily.

This has already happened with the new MLS instruction which this patch
also adds correct decoding for as well as tightening up other decoding
tests. (Before this patch the wrong emulation routine was being called
for MLS though it still produced correct results.)
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

The MRS instruction should set mode and interrupt bits in the read value
so it is simpler to use a new simulation routine (simulate_mrs) rather
than some modified emulation.

prep_emulate_rd12 is now unused and removed.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

We need to reject probing of instructions which read SPSR because
we can't handle this as the value in SPSR is lost when the exception
handler for the probe breakpoint first runs.

This patch also fixes the bitmask for MRS instructions decoding to
include checking bits 5-7.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

Emulation of instructions like "ADD rd, rn, #<const>" would result in a
corrupted value for rd.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

Probing these instructions was corrupting R0 because the emulation code
didn't account for the fact that they don't write a result to a
register.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

Now we have the framework code handling conditionally executed
instructions we can remove redundant checks in individual simulation
routines.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

When a kprobe is placed onto conditionally executed ARM instructions,
many of the emulation routines used to single step them produce corrupt
register results. Rather than fix all of these cases we modify the
framework which calls them to test the relevant condition flags and, if
the test fails, skip calling the emulation code.
Signed-off-by: NJon Medhurst <tixy@yxit.co.uk>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

Currently emulate_ldrd and emulate_strd don't even have the adjustment
of the PC value, so in case of Rn == PC, it will not update the PC
incorrectly but instead load/store from the wrong address.  Let's add
both the adjustment of the PC value and the check for PC == PC.
Signed-off-by: NViktor Rosendahl <viktor.rosendahl@nokia.com>
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>

gas used to accept (and ignore?) .size directives which referred to
undefined symbols, as this does.  In binutils 2.21 these are treated
as fatal errors.
Signed-off-by: NBen Hutchings <ben@decadent.org.uk>
Signed-off-by: NEric Miao <eric.y.miao@gmail.com>

This function is only called by percpu_timer_setup() which is
also __cpuinit marked. Thus it's safe to mark this function as
__cpuinit as well.
Signed-off-by: NStephen Boyd <sboyd@codeaurora.org>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

The ARM user backtrace code can get into an infinite loop if it
runs into an invalid stack frame which points back to itself.
This situation has been observed in practice.  Fix it by capping
the number of entries in the backtrace.  This is also what other
architectures do in their backtrace code.
Signed-off-by: NSonny Rao <sonnyrao@chromium.org>
Acked-by: NJamie Iles <jamie@jamieiles.com>
Acked-by: NOlof Johansson <olof@lixom.net>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Several Davinci platforms select the I2C EEPROM support, but don't
select I2C support.  This causes I2C EEPROM support to be built into
the kernel, but I2C support may not be configured to be built in.
This leads to linker errors due to missing I2C symbols.

Arrange for I2C to be selected whenever EEPROM_AT24 is selected.
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: NSekhar Nori <nsekhar@ti.com>

Commit 54ce6883 (davinci: da8xx: add spi
resources and registration routine) wrongly assumed that SPI1 is mapped at
the same address on DA830/OMAP-L137 and DA850/OMAP-L138; actually, the base
address was valid only for the latter SoC. Teach the code to pass the correct
SPI1 memory resource for both SoCs...
Signed-off-by: NSergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: NSekhar Nori <nsekhar@ti.com>