{"push_id":835489730,"size":1,"distinct_size":1,"ref":"refs/heads/android-4.4","head":"6de09198a733ca351f71c0fb1e14a20ff337fbd8","before":"806d25a95f04bf8143dea28e5cdb92ef25a7a9e6","commits":[{"sha":"6de09198a733ca351f71c0fb1e14a20ff337fbd8","author":{"email":"feca23b3ae4a60fef538f28252c4665e4a95e740@parrot.com","name":"Ivan Djelic"},"message":"ARM: 7668/1: fix memset-related crashes caused by recent GCC (4.7.2) optimizations\n\nRecent GCC versions (e.g. GCC-4.7.2) perform optimizations based on\nassumptions about the implementation of memset and similar functions.\nThe current ARM optimized memset code does not return the value of\nits first argument, as is usually expected from standard implementations.\n\nFor instance in the following function:\n\nvoid debug_mutex_lock_common(struct mutex *lock, struct mutex_waiter *waiter)\n{\n\tmemset(waiter, MUTEX_DEBUG_INIT, sizeof(*waiter));\n\twaiter->magic = waiter;\n\tINIT_LIST_HEAD(&waiter->list);\n}\n\ncompiled as:\n\n800554d0 <debug_mutex_lock_common>:\n800554d0:       e92d4008        push    {r3, lr}\n800554d4:       e1a00001        mov     r0, r1\n800554d8:       e3a02010        mov     r2, #16 ; 0x10\n800554dc:       e3a01011        mov     r1, #17 ; 0x11\n800554e0:       eb04426e        bl      80165ea0 <memset>\n800554e4:       e1a03000        mov     r3, r0\n800554e8:       e583000c        str     r0, [r3, #12]\n800554ec:       e5830000        str     r0, [r3]\n800554f0:       e5830004        str     r0, [r3, #4]\n800554f4:       e8bd8008        pop     {r3, pc}\n\nGCC assumes memset returns the value of pointer 'waiter' in register r0; causing\nregister/memory corruptions.\n\nThis patch fixes the return value of the assembly version of memset.\nIt adds a 'mov' instruction and merges an additional load+store into\nexisting load/store instructions.\nFor ease of review, here is a breakdown of the patch into 4 simple steps:\n\nStep 1\n======\nPerform the following substitutions:\nip -> r8, then\nr0 -> ip,\nand insert 'mov ip, r0' as the first statement of the function.\nAt this point, we have a memset() implementation returning the proper result,\nbut corrupting r8 on some paths (the ones that were using ip).\n\nStep 2\n======\nMake sure r8 is saved and restored when (! CALGN(1)+0) == 1:\n\nsave r8:\n-       str     lr, [sp, #-4]!\n+       stmfd   sp!, {r8, lr}\n\nand restore r8 on both exit paths:\n-       ldmeqfd sp!, {pc}               @ Now <64 bytes to go.\n+       ldmeqfd sp!, {r8, pc}           @ Now <64 bytes to go.\n(...)\n        tst     r2, #16\n        stmneia ip!, {r1, r3, r8, lr}\n-       ldr     lr, [sp], #4\n+       ldmfd   sp!, {r8, lr}\n\nStep 3\n======\nMake sure r8 is saved and restored when (! CALGN(1)+0) == 0:\n\nsave r8:\n-       stmfd   sp!, {r4-r7, lr}\n+       stmfd   sp!, {r4-r8, lr}\n\nand restore r8 on both exit paths:\n        bgt     3b\n-       ldmeqfd sp!, {r4-r7, pc}\n+       ldmeqfd sp!, {r4-r8, pc}\n(...)\n        tst     r2, #16\n        stmneia ip!, {r4-r7}\n-       ldmfd   sp!, {r4-r7, lr}\n+       ldmfd   sp!, {r4-r8, lr}\n\nStep 4\n======\nRewrite register list \"r4-r7, r8\" as \"r4-r8\".\n\nChange-Id: I68561de7228bcdc0e61ecbbcf023f42b9d1fb9f9\nSigned-off-by: Ivan Djelic <ivan.djelic@parrot.com>\nReviewed-by: Nicolas Pitre <nico@linaro.org>\nSigned-off-by: Dirk Behme <dirk.behme@gmail.com>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>","distinct":true,"url":"https://api.github.com/repos/omnirom/android_kernel_samsung_espresso10/commits/6de09198a733ca351f71c0fb1e14a20ff337fbd8"}]}