linux/arch/alpha/kernel, branch v3.13

alpha: perf: fix out-of-bounds array access triggered from raw event

2013-11-17T00:37:10Z

Vince's perf fuzzer uncovered the following issue on Alpha: Unable to handle kernel paging request at virtual address fffffbfe4e46a0e8 CPU 0 perf_fuzzer(1278): Oops 0 pc = [] ra = [] ps = 0007 Not tainted pc is at alpha_perf_event_set_period+0x60/0xf0 ra is at alpha_pmu_enable+0x1a4/0x1c0 v0 = 0000000000000000 t0 = 00000000000fffff t1 = fffffc007b3f5800 t2 = fffffbff275faa94 t3 = ffffffffc9b9bd89 t4 = fffffbfe4e46a098 t5 = 0000000000000020 t6 = fffffbfe4e46a0b8 t7 = fffffc007f4c8000 s0 = 0000000000000000 s1 = fffffc0001b0c018 s2 = fffffc0001b0c020 s3 = fffffc007b3f5800 s4 = 0000000000000001 s5 = ffffffffc9b9bd85 s6 = 0000000000000001 a0 = 0000000000000006 a1 = fffffc007b3f5908 a2 = fffffbfe4e46a098 a3 = 00000005000108c0 a4 = 0000000000000000 a5 = 0000000000000000 t8 = 0000000000000001 t9 = 0000000000000001 t10= 0000000027829f6f t11= 0000000000000020 pv = fffffc000031fb60 at = fffffc0000950900 gp = fffffc0000940900 sp = fffffc007f4cbca8 Disabling lock debugging due to kernel taint Trace: [] alpha_pmu_enable+0x1a4/0x1c0 [] perf_pmu_enable+0x48/0x60 [] __perf_install_in_context+0x15c/0x230 [] remote_function+0x80/0xa0 [] __perf_install_in_context+0x0/0x230 [] smp_call_function_single+0x1b4/0x1d0 [] task_function_call+0x60/0x80 [] __perf_install_in_context+0x0/0x230 [] task_function_call+0x34/0x80 [] perf_install_in_context+0x9c/0x150 [] __perf_install_in_context+0x0/0x230 [] SYSC_perf_event_open+0x360/0xac0 [] entSys+0xa4/0xc0 This is due to the raw event encoding being used as an index directly into the ev67_mapping array, rather than being validated against the ev67_pmc_event_type enumeration instead. Unlike other architectures, which allow raw events to propagate into the hardware counters with little interference, the limited number of events on Alpha and the strict event <-> counter relationships mean that raw events actually correspond to the Linux-specific Alpha events, rather than anything defined by the architecture. This patch adds a new callback to alpha_pmu_t for validating the raw event encoding with the Linux event types for the PMU, preventing the out-of-bounds array access. Cc: Peter Zijlstra Acked-by: Michael Cree Acked-by: Matt Turner Signed-off-by: Will Deacon

alpha: Use qemu+cserve provided high-res clock and alarm.

2013-11-17T00:33:21Z

QEMU provides a high-resolution timer and alarm; use this for a clock source and clock event source when available. Signed-off-by: Richard Henderson

alpha: Switch to GENERIC_CLOCKEVENTS

2013-11-17T00:33:19Z

This allows us to get rid of some hacky code for SMP. Get rid of some cycle counter hackery that's now handled by generic code via clocksource + clock_event_device objects. Signed-off-by: Richard Henderson

alpha: Enable the rpcc clocksource for single processor

2013-11-17T00:33:18Z

Don't depend on SMP, just check the number of processors online. This allows a single distribution kernel to use the clocksource when run on a single processor machine. Do depend on whether or not we're using WTINT. Signed-off-by: Richard Henderson

alpha: Reorganize rtc handling

2013-11-17T00:33:16Z

Discontinue use of GENERIC_CMOS_UPDATE; rely on the RTC subsystem. The marvel platform requires that the rtc only be touched from the boot cpu. This had been partially implemented with hooks for get/set_rtc_time, but read/update_persistent_clock were not handled. Move the hooks from the machine_vec to a special rtc_class_ops struct. We had read_persistent_clock managing the epoch against which the rtc hw is based, but this didn't apply to get_rtc_time or set_rtc_time. This resulted in incorrect values when hwclock(8) gets involved. Allow the epoch to be set from the kernel command-line, overriding the autodetection, which is doomed to fail in 2020. Further, by implementing the rtc ioctl function, we can expose this epoch to userland. Elide the alarm functions that RTC_DRV_CMOS implements. This was highly questionable on Alpha, since the interrupt is used by the system timer. Signed-off-by: Richard Henderson

alpha: Primitive support for CPU power down.

2013-11-17T00:33:15Z

Use WTINT to wait for the next interrupt. Squash the WTINT call if the PALcode doesn't support it (e.g. MILO). No attempt is yet made to skip clock ticks during normal scheduling in order to stay in power down mode longer. Signed-off-by: Richard Henderson

alpha: Allow HZ to be configured

2013-11-17T00:33:13Z

With the 1024Hz default, we spend 50% of QEMU emulation processing timer interrupts. Signed-off-by: Richard Henderson

alpha: Notice if we're being run under QEMU

2013-11-17T00:33:12Z

When building a generic kernel, do a run-time check on the serial number, like we do for MILO. When building a custom kernel, make this a configure-time check. Signed-off-by: Richard Henderson

alpha: Eliminate compiler warning from memset macro

2013-11-17T00:33:09Z

Compiling with GCC 4.8 yields several instances of crypto/vmac.c: In function ‘vmac_final’: crypto/vmac.c:616:9: warning: value computed is not used [-Wunused-value] memset(&mac, 0, sizeof(vmac_t)); ^ arch/alpha/include/asm/string.h:31:25: note: in definition of macro ‘memset’ ? __builtin_memset((s),0,(n)) \ ^ Converting the macro to an inline function eliminates this problem. However, doing only that causes problems with the GCC 3.x series. The inline function cannot be named "memset", as otherwise we wind up with recursion via __builtin_memset. Solve this by adjusting the symbols such that __memset is the inline, and ___memset is the real function. Signed-off-by: Richard Henderson

alpha: Use handle_percpu_irq for the timer interrupt

2013-07-19T20:54:26Z

Signed-off-by: Matt Turner Signed-off-by: Richard Henderson