linux-stable.git/arch/alpha/mm, branch linux-3.16.y

alpha: fix page fault handling for r16-r18 targets

2019-05-02T20:41:51+00:00

commit 491af60ffb848b59e82f7c9145833222e0bf27a5 upstream.

Fix page fault handling code to fixup r16-r18 registers.
Before the patch code had off-by-two registers bug.
This bug caused overwriting of ps,pc,gp registers instead
of fixing intended r16,r17,r18 (see `struct pt_regs`).

More details:

Initially Dmitry noticed a kernel bug as a failure
on strace test suite. Test passes unmapped userspace
pointer to io_submit:

```c
    #include 
    #include 
    #include 
    #include 
    int main(void)
    {
        unsigned long ctx = 0;
        if (syscall(__NR_io_setup, 1, &ctx))
            err(1, "io_setup");
        const size_t page_size = sysconf(_SC_PAGESIZE);
        const size_t size = page_size * 2;
        void *ptr = mmap(NULL, size, PROT_READ | PROT_WRITE,
                         MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
        if (MAP_FAILED == ptr)
            err(1, "mmap(%zu)", size);
        if (munmap(ptr, size))
            err(1, "munmap");
        syscall(__NR_io_submit, ctx, 1, ptr + page_size);
        syscall(__NR_io_destroy, ctx);
        return 0;
    }
```

Running this test causes kernel to crash when handling page fault:

```
    Unable to handle kernel paging request at virtual address ffffffffffff9468
    CPU 3
    aio(26027): Oops 0
    pc = []  ra = []  ps = 0000    Not tainted
    pc is at sys_io_submit+0x108/0x200
    ra is at sys_io_submit+0x6c/0x200
    v0 = fffffc00c58e6300  t0 = fffffffffffffff2  t1 = 000002000025e000
    t2 = fffffc01f159fef8  t3 = fffffc0001009640  t4 = fffffc0000e0f6e0
    t5 = 0000020001002e9e  t6 = 4c41564e49452031  t7 = fffffc01f159c000
    s0 = 0000000000000002  s1 = 000002000025e000  s2 = 0000000000000000
    s3 = 0000000000000000  s4 = 0000000000000000  s5 = fffffffffffffff2
    s6 = fffffc00c58e6300
    a0 = fffffc00c58e6300  a1 = 0000000000000000  a2 = 000002000025e000
    a3 = 00000200001ac260  a4 = 00000200001ac1e8  a5 = 0000000000000001
    t8 = 0000000000000008  t9 = 000000011f8bce30  t10= 00000200001ac440
    t11= 0000000000000000  pv = fffffc00006fd320  at = 0000000000000000
    gp = 0000000000000000  sp = 00000000265fd174
    Disabling lock debugging due to kernel taint
    Trace:
    [] entSys+0xa4/0xc0
```

Here `gp` has invalid value. `gp is s overwritten by a fixup for the
following page fault handler in `io_submit` syscall handler:

```
    __se_sys_io_submit
    ...
        ldq     a1,0(t1)
        bne     t0,4280 <__se_sys_io_submit+0x180>
```

After a page fault `t0` should contain -EFALUT and `a1` is 0.
Instead `gp` was overwritten in place of `a1`.

This happens due to a off-by-two bug in `dpf_reg()` for `r16-r18`
(aka `a0-a2`).

I think the bug went unnoticed for a long time as `gp` is one
of scratch registers. Any kernel function call would re-calculate `gp`.

Dmitry tracked down the bug origin back to 2.1.32 kernel version
where trap_a{0,1,2} fields were inserted into struct pt_regs.
And even before that `dpf_reg()` contained off-by-one error.

Cc: Richard Henderson 
Cc: Ivan Kokshaysky 
Cc: linux-alpha@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Reported-and-reviewed-by: "Dmitry V. Levin" 
Bug: https://bugs.gentoo.org/672040
Signed-off-by: Sergei Trofimovich 
Signed-off-by: Matt Turner 
Signed-off-by: Ben Hutchings

vm: add VM_FAULT_SIGSEGV handling support

2015-02-04T10:58:27+00:00

commit 33692f27597fcab536d7cbbcc8f52905133e4aa7 upstream.

The core VM already knows about VM_FAULT_SIGBUS, but cannot return a
"you should SIGSEGV" error, because the SIGSEGV case was generally
handled by the caller - usually the architecture fault handler.

That results in lots of duplication - all the architecture fault
handlers end up doing very similar "look up vma, check permissions, do
retries etc" - but it generally works.  However, there are cases where
the VM actually wants to SIGSEGV, and applications _expect_ SIGSEGV.

In particular, when accessing the stack guard page, libsigsegv expects a
SIGSEGV.  And it usually got one, because the stack growth is handled by
that duplicated architecture fault handler.

However, when the generic VM layer started propagating the error return
from the stack expansion in commit fee7e49d4514 ("mm: propagate error
from stack expansion even for guard page"), that now exposed the
existing VM_FAULT_SIGBUS result to user space.  And user space really
expected SIGSEGV, not SIGBUS.

To fix that case, we need to add a VM_FAULT_SIGSEGV, and teach all those
duplicate architecture fault handlers about it.  They all already have
the code to handle SIGSEGV, so it's about just tying that new return
value to the existing code, but it's all a bit annoying.

This is the mindless minimal patch to do this.  A more extensive patch
would be to try to gather up the mostly shared fault handling logic into
one generic helper routine, and long-term we really should do that
cleanup.

Just from this patch, you can generally see that most architectures just
copied (directly or indirectly) the old x86 way of doing things, but in
the meantime that original x86 model has been improved to hold the VM
semaphore for shorter times etc and to handle VM_FAULT_RETRY and other
"newer" things, so it would be a good idea to bring all those
improvements to the generic case and teach other architectures about
them too.

Reported-and-tested-by: Takashi Iwai 
Tested-by: Jan Engelhardt 
Acked-by: Heiko Carstens  # "s390 still compiles and boots"
Cc: linux-arch@vger.kernel.org
Signed-off-by: Linus Torvalds 
[ luis: backported to 3.16:
  - file renamed: arch/powerpc/mm/copro_fault.c ->
    arch/powerpc/platforms/cell/spu_fault.c
  - dropped changes to arch/nios2/mm/fault.c ]
Signed-off-by: Luis Henriques

arch: mm: pass userspace fault flag to generic fault handler

2013-09-12T22:38:01+00:00

Unlike global OOM handling, memory cgroup code will invoke the OOM killer
in any OOM situation because it has no way of telling faults occuring in
kernel context - which could be handled more gracefully - from
user-triggered faults.

Pass a flag that identifies faults originating in user space from the
architecture-specific fault handlers to generic code so that memcg OOM
handling can be improved.

Signed-off-by: Johannes Weiner 
Reviewed-by: Michal Hocko 
Cc: David Rientjes 
Cc: KAMEZAWA Hiroyuki 
Cc: azurIt 
Cc: KOSAKI Motohiro 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

mm/alpha: unify mem_init() for both UMA and NUMA architectures

2013-07-03T23:07:39+00:00

Now mem_init() for both Alpha UMA and Alpha NUMA are the same, so unify it
to reduce duplicated code.

Signed-off-by: Jiang Liu 
Cc: Richard Henderson 
Cc: Ivan Kokshaysky 
Cc: Matt Turner 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

mm/alpha: prepare for removing num_physpages and simplify mem_init()

2013-07-03T23:07:35+00:00

Prepare for removing num_physpages and simplify mem_init().

Signed-off-by: Jiang Liu 
Cc: Richard Henderson 
Cc: Ivan Kokshaysky 
Cc: Matt Turner 
Cc: David Howells 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

mm: concentrate modification of totalram_pages into the mm core

2013-07-03T23:07:33+00:00

Concentrate code to modify totalram_pages into the mm core, so the arch
memory initialized code doesn't need to take care of it.  With these
changes applied, only following functions from mm core modify global
variable totalram_pages: free_bootmem_late(), free_all_bootmem(),
free_all_bootmem_node(), adjust_managed_page_count().

With this patch applied, it will be much more easier for us to keep
totalram_pages and zone->managed_pages in consistence.

Signed-off-by: Jiang Liu 
Acked-by: David Howells 
Cc: "H. Peter Anvin" 
Cc: "Michael S. Tsirkin" 
Cc: 
Cc: Arnd Bergmann 
Cc: Catalin Marinas 
Cc: Chris Metcalf 
Cc: Geert Uytterhoeven 
Cc: Ingo Molnar 
Cc: Jeremy Fitzhardinge 
Cc: Jianguo Wu 
Cc: Joonsoo Kim 
Cc: Kamezawa Hiroyuki 
Cc: Konrad Rzeszutek Wilk 
Cc: Marek Szyprowski 
Cc: Mel Gorman 
Cc: Michel Lespinasse 
Cc: Minchan Kim 
Cc: Rik van Riel 
Cc: Rusty Russell 
Cc: Tang Chen 
Cc: Tejun Heo 
Cc: Thomas Gleixner 
Cc: Wen Congyang 
Cc: Will Deacon 
Cc: Yasuaki Ishimatsu 
Cc: Yinghai Lu 
Cc: Russell King 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

mm: enhance free_reserved_area() to support poisoning memory with zero

2013-07-03T23:07:32+00:00

Address more review comments from last round of code review.
1) Enhance free_reserved_area() to support poisoning freed memory with
   pattern '0'. This could be used to get rid of poison_init_mem()
   on ARM64.
2) A previous patch has disabled memory poison for initmem on s390
   by mistake, so restore to the original behavior.
3) Remove redundant PAGE_ALIGN() when calling free_reserved_area().

Signed-off-by: Jiang Liu 
Cc: Geert Uytterhoeven 
Cc: "H. Peter Anvin" 
Cc: "Michael S. Tsirkin" 
Cc: 
Cc: Arnd Bergmann 
Cc: Catalin Marinas 
Cc: Chris Metcalf 
Cc: David Howells 
Cc: Ingo Molnar 
Cc: Jeremy Fitzhardinge 
Cc: Jianguo Wu 
Cc: Joonsoo Kim 
Cc: Kamezawa Hiroyuki 
Cc: Konrad Rzeszutek Wilk 
Cc: Marek Szyprowski 
Cc: Mel Gorman 
Cc: Michel Lespinasse 
Cc: Minchan Kim 
Cc: Rik van Riel 
Cc: Rusty Russell 
Cc: Tang Chen 
Cc: Tejun Heo 
Cc: Thomas Gleixner 
Cc: Wen Congyang 
Cc: Will Deacon 
Cc: Yasuaki Ishimatsu 
Cc: Yinghai Lu 
Cc: Russell King 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

mm: change signature of free_reserved_area() to fix building warnings

2013-07-03T23:07:32+00:00

Change signature of free_reserved_area() according to Russell King's
suggestion to fix following build warnings:

  arch/arm/mm/init.c: In function 'mem_init':
  arch/arm/mm/init.c:603:2: warning: passing argument 1 of 'free_reserved_area' makes integer from pointer without a cast [enabled by default]
    free_reserved_area(__va(PHYS_PFN_OFFSET), swapper_pg_dir, 0, NULL);
    ^
  In file included from include/linux/mman.h:4:0,
                   from arch/arm/mm/init.c:15:
  include/linux/mm.h:1301:22: note: expected 'long unsigned int' but argument is of type 'void *'
   extern unsigned long free_reserved_area(unsigned long start, unsigned long end,

   mm/page_alloc.c: In function 'free_reserved_area':
>> mm/page_alloc.c:5134:3: warning: passing argument 1 of 'virt_to_phys' makes pointer from integer without a cast [enabled by default]
   In file included from arch/mips/include/asm/page.h:49:0,
                    from include/linux/mmzone.h:20,
                    from include/linux/gfp.h:4,
                    from include/linux/mm.h:8,
                    from mm/page_alloc.c:18:
   arch/mips/include/asm/io.h:119:29: note: expected 'const volatile void *' but argument is of type 'long unsigned int'
   mm/page_alloc.c: In function 'free_area_init_nodes':
   mm/page_alloc.c:5030:34: warning: array subscript is below array bounds [-Warray-bounds]

Also address some minor code review comments.

Signed-off-by: Jiang Liu 
Reported-by: Arnd Bergmann 
Cc: "H. Peter Anvin" 
Cc: "Michael S. Tsirkin" 
Cc: 
Cc: Catalin Marinas 
Cc: Chris Metcalf 
Cc: David Howells 
Cc: Geert Uytterhoeven 
Cc: Ingo Molnar 
Cc: Jeremy Fitzhardinge 
Cc: Jianguo Wu 
Cc: Joonsoo Kim 
Cc: Kamezawa Hiroyuki 
Cc: Konrad Rzeszutek Wilk 
Cc: Marek Szyprowski 
Cc: Mel Gorman 
Cc: Michel Lespinasse 
Cc: Minchan Kim 
Cc: Rik van Riel 
Cc: Rusty Russell 
Cc: Tang Chen 
Cc: Tejun Heo 
Cc: Thomas Gleixner 
Cc: Wen Congyang 
Cc: Will Deacon 
Cc: Yasuaki Ishimatsu 
Cc: Yinghai Lu 
Cc: Russell King 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

mm/alpha: use common help functions to free reserved pages

2013-04-29T22:54:29+00:00

Use common help functions to free reserved pages.  Also include
 to avoid local declarations.

Signed-off-by: Jiang Liu 
Cc: Richard Henderson 
Cc: Ivan Kokshaysky 
Cc: Matt Turner 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

alpha/mm/fault.c: Port OOM changes to do_page_fault

2012-08-19T15:41:19+00:00

Commit d065bd810b6d ("mm: retry page fault when blocking on disk
transfer") and 37b23e0525d3 ("x86,mm: make pagefault killable")
introduced changes into the x86 pagefault handler for making the page
fault handler retryable as well as killable.

These changes reduce the mmap_sem hold time, which is crucial during OOM
killer invocation.

Port these changes to ALPHA.

Signed-off-by: Mohd. Faris 
Signed-off-by: Kautuk Consul 
Acked-by: Matt Turner 
Signed-off-by: Michael Cree 
Signed-off-by: Linus Torvalds