Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b1ef24a9 authored by Ard Biesheuvel's avatar Ard Biesheuvel Committed by Greg Kroah-Hartman
Browse files

ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction 



commit e5c46fde75e43c15a29b40e5fc5641727f97ae47 upstream.

After emulating a misaligned load or store issued in Thumb mode, we have
to advance the IT state by hand, or it will get out of sync with the
actual instruction stream, which means we'll end up applying the wrong
condition code to subsequent instructions. This might corrupt the
program state rather catastrophically.

So borrow the it_advance() helper from the probing code, and use it on
CPSR if the emulated instruction is Thumb.

Cc: <stable@vger.kernel.org>
Reviewed-by: default avatarLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
Signed-off-by: default avatarRussell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 6d80ac94

arch/arm/include/asm/ptrace.h

+26 −0
Original line number Diff line number Diff line
@@ -167,5 +167,31 @@ static inline unsigned long user_stack_pointer(struct pt_regs *regs) 
		((current_stack_pointer | (THREAD_SIZE - 1)) - 7) - 1;	\

})





/*

 * Update ITSTATE after normal execution of an IT block instruction.

 *

 * The 8 IT state bits are split into two parts in CPSR:

 *	ITSTATE<1:0> are in CPSR<26:25>

 *	ITSTATE<7:2> are in CPSR<15:10>

 */

static inline unsigned long it_advance(unsigned long cpsr)

{

	if ((cpsr & 0x06000400) == 0) {

		/* ITSTATE<2:0> == 0 means end of IT block, so clear IT state */

		cpsr &= ~PSR_IT_MASK;

	} else {

		/* We need to shift left ITSTATE<4:0> */

		const unsigned long mask = 0x06001c00;  /* Mask ITSTATE<4:0> */

		unsigned long it = cpsr & mask;

		it <<= 1;

		it |= it >> (27 - 10);  /* Carry ITSTATE<2> to correct place */

		it &= mask;

		cpsr &= ~mask;

		cpsr |= it;

	}

	return cpsr;

}



#endif /* __ASSEMBLY__ */

#endif

arch/arm/mm/alignment.c

+3 −0
Original line number Diff line number Diff line
@@ -936,6 +936,9 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs) 
	if (type == TYPE_LDST)

		do_alignment_finish_ldst(addr, instr, regs, offset);



	if (thumb_mode(regs))

		regs->ARM_cpsr = it_advance(regs->ARM_cpsr);



	return 0;



 bad_or_fault:

arch/arm/probes/decode.h

+1 −25
Original line number Diff line number Diff line
@@ -22,6 +22,7 @@ 
#include <linux/types.h>

#include <linux/stddef.h>

#include <asm/probes.h>

#include <asm/ptrace.h>

#include <asm/kprobes.h>



void __init arm_probes_decode_init(void);
@@ -43,31 +44,6 @@ void __init find_str_pc_offset(void); 
#endif





/*

 * Update ITSTATE after normal execution of an IT block instruction.

 *

 * The 8 IT state bits are split into two parts in CPSR:

 *	ITSTATE<1:0> are in CPSR<26:25>

 *	ITSTATE<7:2> are in CPSR<15:10>

 */

static inline unsigned long it_advance(unsigned long cpsr)

	{

	if ((cpsr & 0x06000400) == 0) {

		/* ITSTATE<2:0> == 0 means end of IT block, so clear IT state */

		cpsr &= ~PSR_IT_MASK;

	} else {

		/* We need to shift left ITSTATE<4:0> */

		const unsigned long mask = 0x06001c00;  /* Mask ITSTATE<4:0> */

		unsigned long it = cpsr & mask;

		it <<= 1;

		it |= it >> (27 - 10);  /* Carry ITSTATE<2> to correct place */

		it &= mask;

		cpsr &= ~mask;

		cpsr |= it;

	}

	return cpsr;

}



static inline void __kprobes bx_write_pc(long pcv, struct pt_regs *regs)

{

	long cpsr = regs->ARM_cpsr;