linux-stable.git/arch/arc/include, branch linux-4.0.y

ARC: add compiler barrier to LLSC based cmpxchg

2015-07-21T17:10:12+00:00

commit d57f727264f1425a94689bafc7e99e502cb135b5 upstream.

When auditing cmpxchg call sites, Chuck noted that gcc was optimizing
away some of the desired LDs.

|	do {
|		new = old = *ipi_data_ptr;
|		new |= 1U << msg;
|	} while (cmpxchg(ipi_data_ptr, old, new) != old);

was generating to below

| 8015cef8:	ld         r2,[r4,0]  <-- First LD
| 8015cefc:	bset       r1,r2,r1
|
| 8015cf00:	llock      r3,[r4]  <-- atomic op
| 8015cf04:	brne       r3,r2,8015cf10
| 8015cf08:	scond      r1,[r4]
| 8015cf0c:	bnz        8015cf00
|
| 8015cf10:	brne       r3,r2,8015cf00  <-- Branch doesn't go to orig LD

Although this was fixed by adding a ACCESS_ONCE in this call site, it
seems safer (for now at least) to add compiler barrier to LLSC based
cmpxchg

Reported-by: Chuck Jordan 
Acked-by: Peter Zijlstra (Intel) 
Signed-off-by: Vineet Gupta 
Signed-off-by: Greg Kroah-Hartman

ARC: add smp barriers around atomics per Documentation/atomic_ops.txt

2015-07-21T17:10:12+00:00

commit 2576c28e3f623ed401db7e6197241865328620ef upstream.

 - arch_spin_lock/unlock were lacking the ACQUIRE/RELEASE barriers
   Since ARCv2 only provides load/load, store/store and all/all, we need
   the full barrier

 - LLOCK/SCOND based atomics, bitops, cmpxchg, which return modified
   values were lacking the explicit smp barriers.

 - Non LLOCK/SCOND varaints don't need the explicit barriers since that
   is implicity provided by the spin locks used to implement the
   critical section (the spin lock barriers in turn are also fixed in
   this commit as explained above

Cc: Paul E. McKenney 
Acked-by: Peter Zijlstra (Intel) 
Signed-off-by: Vineet Gupta 
Signed-off-by: Greg Kroah-Hartman

ARC: unbork !LLSC build

2015-06-06T15:21:09+00:00

commit daaf40e53b5dbdf75255d58a45ce8ac65ca511a8 upstream.

Fixes: f7d11e93ee97a locking,arch,arc: Fold atomic_ops
Signed-off-by: Vineet Gupta 
Signed-off-by: Greg Kroah-Hartman

ARC: Fix thread_saved_pc()

2015-02-27T05:29:34+00:00

The old implementation assumed that SP at the time of __switch_to() is
right above pt_regs which is almost certainly not the case as there will
be some stack build up between entry into kernel and leading up to
__switch_to

Signed-off-by: Vineet Gupta

ARC: Fix KSTK_ESP()

2015-02-27T05:18:23+00:00

/proc//maps currently don't annotate stack vma with "[stack]"
This is because KSTK_ESP ie expected to return usermode SP of tsk while
currently it returns the kernel mode SP of a sleeping tsk.

While the fix is trivial, we also need to adjust the ARC kernel stack
unwinder to not use KSTK_SP and friends any more.

Cc: 
Reported-and-suggested-by: Alexey Brodkin 
Signed-off-by: Vineet Gupta

ARC: Make arc_unwind_core accessible externally

2015-02-27T04:45:00+00:00

The arc unwinder can also be used for perf callchains.

Signed-off-by: Mischa Jonker 
Signed-off-by: Vineet Gupta

Merge tag 'arc-3.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc

2015-02-16T22:56:52+00:00

Pull ARC updates from Vineet Gupta:
 "Some fixes, nothing too exciting this time as well..."

* tag 'arc-3.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
  ARC: fix page address calculation if PAGE_OFFSET != LINUX_LINK_BASE
  ARC: Fix earlycon build breakage
  ARC: Dynamically determine BASE_BAUD from DeviceTree
  arc: Remove unused prepare_to_copy()
  ARC: use ACCESS_ONCE in cmpxchg loop
  ARC: add some more comments to ret_from_fork
  ARC: fix /proc/cpuinfo for offline cpus

ARC: fix page address calculation if PAGE_OFFSET != LINUX_LINK_BASE

2015-02-13T12:31:12+00:00

We used to calculate page address differently in 2 cases:

1. In virt_to_page(x) we do
 --->8---
 mem_map + (x - CONFIG_LINUX_LINK_BASE) >> PAGE_SHIFT
 --->8---

2. In in pte_page(x) we do
 --->8---
 mem_map + (pte_val(x) - PAGE_OFFSET) >> PAGE_SHIFT
 --->8---

That leads to problems in case PAGE_OFFSET != CONFIG_LINUX_LINK_BASE -
different pages will be selected depending on where and how we calculate
page address.

In particular in the STAR 9000853582 when gdb attempted to read memory
of another process it got improper page in get_user_pages() because this
is exactly one of the places where we search for a page by pte_page().

The fix is trivial - we need to calculate page address similarly in both
cases.

Cc: 
Signed-off-by: Alexey Brodkin 
Signed-off-by: Vineet Gupta

all arches, signal: move restart_block to struct task_struct

2015-02-13T02:54:12+00:00

If an attacker can cause a controlled kernel stack overflow, overwriting
the restart block is a very juicy exploit target.  This is because the
restart_block is held in the same memory allocation as the kernel stack.

Moving the restart block to struct task_struct prevents this exploit by
making the restart_block harder to locate.

Note that there are other fields in thread_info that are also easy
targets, at least on some architectures.

It's also a decent simplification, since the restart code is more or less
identical on all architectures.

[james.hogan@imgtec.com: metag: align thread_info::supervisor_stack]
Signed-off-by: Andy Lutomirski 
Cc: Thomas Gleixner 
Cc: Al Viro 
Cc: "H. Peter Anvin" 
Cc: Ingo Molnar 
Cc: Kees Cook 
Cc: David Miller 
Acked-by: Richard Weinberger 
Cc: Richard Henderson 
Cc: Ivan Kokshaysky 
Cc: Matt Turner 
Cc: Vineet Gupta 
Cc: Russell King 
Cc: Catalin Marinas 
Cc: Will Deacon 
Cc: Haavard Skinnemoen 
Cc: Hans-Christian Egtvedt 
Cc: Steven Miao 
Cc: Mark Salter 
Cc: Aurelien Jacquiot 
Cc: Mikael Starvik 
Cc: Jesper Nilsson 
Cc: David Howells 
Cc: Richard Kuo 
Cc: "Luck, Tony" 
Cc: Geert Uytterhoeven 
Cc: Michal Simek 
Cc: Ralf Baechle 
Cc: Jonas Bonn 
Cc: "James E.J. Bottomley" 
Cc: Helge Deller 
Cc: Benjamin Herrenschmidt 
Cc: Paul Mackerras 
Acked-by: Michael Ellerman  (powerpc)
Tested-by: Michael Ellerman  (powerpc)
Cc: Martin Schwidefsky 
Cc: Heiko Carstens 
Cc: Chen Liqin 
Cc: Lennox Wu 
Cc: Chris Metcalf 
Cc: Guan Xuetao 
Cc: Chris Zankel 
Cc: Max Filippov 
Cc: Oleg Nesterov 
Cc: Guenter Roeck 
Signed-off-by: James Hogan 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

mm: make FIRST_USER_ADDRESS unsigned long on all archs

2015-02-12T01:06:03+00:00

LKP has triggered a compiler warning after my recent patch "mm: account
pmd page tables to the process":

    mm/mmap.c: In function 'exit_mmap':
 >> mm/mmap.c:2857:2: warning: right shift count >= width of type [enabled by default]

The code:

 > 2857                WARN_ON(mm_nr_pmds(mm) >
   2858                                round_up(FIRST_USER_ADDRESS, PUD_SIZE) >> PUD_SHIFT);

In this, on tile, we have FIRST_USER_ADDRESS defined as 0.  round_up() has
the same type -- int.  PUD_SHIFT.

I think the best way to fix it is to define FIRST_USER_ADDRESS as unsigned
long.  On every arch for consistency.

Signed-off-by: Kirill A. Shutemov 
Reported-by: Wu Fengguang 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds