ARM: Convert VFP/Crunch/XscaleCP thread_release() to exit_thread()

This avoids races in the VFP code where the dead thread may have
state on another CPU.  By moving this code to exit_thread(), we
will be running as the thread, and therefore be running on the
current CPU.

This means that we can ensure that the only local state is accessed
in the thread notifiers.

Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

diff --git a/arch/arm/include/asm/thread_notify.h b/arch/arm/include/asm/thread_notify.h
index f27379d7f72a670b01e2e70b2b09b97cc9c98862..c4391ba203507a2b1c34a9634ad6fb9c4ff7eb64 100644 (file)
--- a/arch/arm/include/asm/thread_notify.h
+++ b/arch/arm/include/asm/thread_notify.h
@@ -41,7 +41,7 @@ static inline void thread_notify(unsigned long rc, struct thread_info *thread)
  * These are the reason codes for the thread notifier.
  */
 #define THREAD_NOTIFY_FLUSH    0
-#define THREAD_NOTIFY_RELEASE  1
+#define THREAD_NOTIFY_EXIT     1
 #define THREAD_NOTIFY_SWITCH   2
 
 #endif

diff --git a/arch/arm/kernel/crunch.c b/arch/arm/kernel/crunch.c
index 769abe15cf91d280425a95bf7042642c2214e68b..25ef223ba7f34e945bc490f23eef4dc0df424677 100644 (file)
--- a/arch/arm/kernel/crunch.c
+++ b/arch/arm/kernel/crunch.c
@@ -51,7 +51,7 @@ static int crunch_do(struct notifier_block *self, unsigned long cmd, void *t)
                 * initialised state information on the first fault.
                 */
 
-       case THREAD_NOTIFY_RELEASE:
+       case THREAD_NOTIFY_EXIT:
                crunch_task_release(thread);
                break;
 

diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 0d96d0171c05601bf59a5e44c579cd7f59e9af23..67304138a2ca025d0ef494e40d3d513fd3bb3b8b 100644 (file)
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -274,17 +274,18 @@ void show_regs(struct pt_regs * regs)
        __backtrace();
 }
 
+ATOMIC_NOTIFIER_HEAD(thread_notify_head);
+
+EXPORT_SYMBOL_GPL(thread_notify_head);
+
 /*
  * Free current thread data structures etc..
  */
 void exit_thread(void)
 {
+       thread_notify(THREAD_NOTIFY_EXIT, current_thread_info());
 }
 
-ATOMIC_NOTIFIER_HEAD(thread_notify_head);
-
-EXPORT_SYMBOL_GPL(thread_notify_head);
-
 void flush_thread(void)
 {
        struct thread_info *thread = current_thread_info();
@@ -299,9 +300,6 @@ void flush_thread(void)
 
 void release_thread(struct task_struct *dead_task)
 {
-       struct thread_info *thread = task_thread_info(dead_task);
-
-       thread_notify(THREAD_NOTIFY_RELEASE, thread);
 }
 
 asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");

diff --git a/arch/arm/kernel/xscale-cp0.c b/arch/arm/kernel/xscale-cp0.c
index 17127db906faf331cd21bd6d33c47dceaa8a6e65..1796157e3dd540dcb3772867a43d2018f10eef11 100644 (file)
--- a/arch/arm/kernel/xscale-cp0.c
+++ b/arch/arm/kernel/xscale-cp0.c
@@ -70,7 +70,7 @@ static int iwmmxt_do(struct notifier_block *self, unsigned long cmd, void *t)
                 * initialised state information on the first fault.
                 */
 
-       case THREAD_NOTIFY_RELEASE:
+       case THREAD_NOTIFY_EXIT:
                iwmmxt_task_release(thread);
                break;
 

diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index aed05bc3c2eaecf29ddd63c1aabf1842d8f9440f..f60a5400a25b055919621d572bf31fa45c2a94bb 100644 (file)
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -63,14 +63,15 @@ static void vfp_thread_flush(struct thread_info *thread)
        put_cpu();
 }
 
-static void vfp_thread_release(struct thread_info *thread)
+static void vfp_thread_exit(struct thread_info *thread)
 {
        /* release case: Per-thread VFP cleanup. */
        union vfp_state *vfp = &thread->vfpstate;
-       unsigned int cpu = thread->cpu;
+       unsigned int cpu = get_cpu();
 
        if (last_VFP_context[cpu] == vfp)
                last_VFP_context[cpu] = NULL;
+       put_cpu();
 }
 
 /*
@@ -88,11 +89,13 @@ static void vfp_thread_release(struct thread_info *thread)
  *     but may change at any time.
  *   - we could be preempted if tree preempt rcu is enabled, so
  *     it is unsafe to use thread->cpu.
- *  THREAD_NOTIFY_RELEASE:
- *   - the thread (v) will not be running on any CPU; it is a dead thread.
- *   - thread->cpu will be the last CPU the thread ran on, which may not
- *     be the current CPU.
- *   - we could be preempted if tree preempt rcu is enabled.
+ *  THREAD_NOTIFY_EXIT
+ *   - the thread (v) will be running on the local CPU, so
+ *     v === current_thread_info()
+ *   - thread->cpu is the local CPU number at the time it is accessed,
+ *     but may change at any time.
+ *   - we could be preempted if tree preempt rcu is enabled, so
+ *     it is unsafe to use thread->cpu.
  */
 static int vfp_notifier(struct notifier_block *self, unsigned long cmd, void *v)
 {
@@ -133,7 +136,7 @@ static int vfp_notifier(struct notifier_block *self, unsigned long cmd, void *v)
        if (cmd == THREAD_NOTIFY_FLUSH)
                vfp_thread_flush(thread);
        else
-               vfp_thread_release(thread);
+               vfp_thread_exit(thread);
 
        return NOTIFY_DONE;
 }