summaryrefslogtreecommitdiff
path: root/arch/mips/kernel
AgeCommit message (Collapse)Author
2015-02-17MIPS: kernel: process: Do not allow FR=0 on MIPS R6Markos Chandras
A prctl() call to set FR=0 for MIPS R6 should not be allowed since FR=1 is the only option for R6 cores. Cc: Paul Burton <paul.burton@imgtec.com> Cc: Matthew Fortune <matthew.fortune@imgtec.com> Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: Make use of the ERETNC instruction on MIPS R6Markos Chandras
The ERETNC instruction, introduced in MIPS R5, is similar to the ERET one, except it does not clear the LLB bit in the LLADDR register. This feature is necessary to safely emulate R2 LL/SC instructions. However, on context switches, we need to clear the LLAddr/LLB bit in order to make sure that an SC instruction from the new thread will never succeed if it happens to interrupt an LL operation on the same address from the previous thread. Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: kernel: mips-r2-to-r6-emul: Add R2 emulator for MIPS R6Leonid Yegoshin
MIPS R6 removed quite a few R2 instructions. However, there is plenty of <R6 userland code so we add an in-kernel emulator so we can still be able to execute all R2 userland out there. The emulator comes with a handy debugfs under /mips/ directory (r2-emul-stats) to provide some basic statistics of the instructions that are being emulated. Below are some statistics from booting a minimal buildroot image: Instruction Total BDslot ------------------------------ movs 236969 0 hilo 56686 0 muls 55279 0 divs 10941 0 dsps 0 0 bops 1 0 traps 0 0 fpus 0 0 loads 214981 17 stores 103364 0 llsc 56898 0 dsemul 150418 0 jr 370158 bltzl 43 bgezl 1594 bltzll 0 bgezll 0 bltzal 39 bgezal 39 beql 14503 bnel 138741 blezl 0 bgtzl 3988 Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com> Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: Add LLB bit and related feature for the Config 5 CP0 registerMarkos Chandras
The LLBIT (bit 4) in the Config5 CP0 register indicates the software availability of the Load-Linked bit. This bit is only set by hardware and it has the following meaning: 0: LLB functionality is not supported 1: LLB functionality is supported. The following feature are also supported: - ERETNC instruction. Similar to ERET but it does not clear the LLB bit in the LLAddr register. - CP0 LLAddr/LLB bit must be set - LLbit is software accessible through the LLAddr[0] This will be used later on to emulate R2 LL/SC instructions. Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: Emulate the new MIPS R6 BNEZC and JIALC instructionsMarkos Chandras
MIPS R6 uses the <R6 sdc2 opcode for the new BNEZC and JIALC instructions Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: Emulate the new MIPS R6 BEQZC and JIC instructionsMarkos Chandras
MIPS R6 uses the <R6 ldc2 opcode for the new BEQZC and JIC instructions Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: Emulate the new MIPS R6 BALC instructionMarkos Chandras
MIPS R6 uses the <R6 swc2 opcode for the new BALC instructions. Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: Emulate the new MIPS R6 BNVC, BNEC and BNEZLAC instructionsMarkos Chandras
MIPS R6 uses the <R6 DADDI opcode for the new BNVC, BNEC and BNEZLAC instructions. Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: Emulate the new MIPS R6 BOVC, BEQC and BEQZALC instructionsMarkos Chandras
MIPS R6 uses the <R6 ADDI opcode for the new BOVC, BEQC and BEQZALC instructions. Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: Emulate the new MIPS R6 branch compact (BC) instructionMarkos Chandras
MIPS R6 uses the <R6 LWC2 opcode for the new BC instruction. Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: Emulate the new MIPS R6 B{L,G}T{Z,}{AL,}C instructionsMarkos Chandras
MIPS R6 added the following four instructions which share the BGTZ and BGTZL opcode: BLTZALC: Compact branch-and-link if GPR rt is < to zero BGTZALC: Compact branch-and-link if GPR rt is > to zero BLTZL : Compact branch if GPR rt is < to zero BGTZL : Compact branch if GPR rt is > to zero BLTC : Compact branch if GPR rs is less than GPR rt BLTUC : Similar to BLTC but unsigned Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: Emulate the new MIPS R6 B{L,G}Ε{Z,}{AL,}C instructionsMarkos Chandras
MIPS R6 added the following four instructions which share the BLEZ and BLEZL opcodes: BLEZALC: Compact branch-and-link if GPR rt is <= to zero BGEZALC: Compact branch-and-link if GPR rt is >= to zero BLEZC : Compact branch if GPR rt is <= to zero BGEZC : Compact branch if GPR rt is >= to zero BGEC : Compact branch if GPR rs is less than or equal to GPR rt BGEUC : Similar to BGEC but unsigned. Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: Emulate the BC1{EQ,NE}Z FPU instructionsMarkos Chandras
MIPS R6 introduced the following two branch instructions for COP1: BC1EQZ: Branch if Cop1 (FPR) Register Bit 0 is Equal to Zero BC1NEZ: Branch if Cop1 (FPR) Register Bit 0 is Not Equal to Zero Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: kernel: branch: Do not emulate the branch likelies on MIPS R6Markos Chandras
MIPS R6 removed the BLTZL, BGEZL, BLTZAL, BGEZAL, BEQL, BNEL, BLEZL, BGTZL branch likely instructions so we must not try to emulate them on MIPS R6 if the R2-to-R6 emulator is not present. Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: kernel: Prepare the JR instruction for emulation on MIPS R6Markos Chandras
The MIPS R6 JR instruction is an alias to the JALR one, so it may need emulation for non-R6 userlands. Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: kernel: syscall: Set the appropriate ISA level for MIPS R6Markos Chandras
MIPS R6 changed the opcodes for LL/SC instructions so we need to set the appropriate ISA level. Cc: Matthew Fortune <Matthew.Fortune@imgtec.com> Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: kernel: unaligned: Add support for the MIPS R6Leonid Yegoshin
The load/store unaligned instructions have been removed in MIPS R6 so we need to re-implement the related macros using the regular load/store instructions. Moreover, the load/store from coprocessor 2 instructions have been reallocated in Release 6 so we will handle them in the emulator instead. Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com> Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: kernel: cps-vec: Replace "addi" with "addiu"Markos Chandras
The "addi" instruction will trap on overflows which is not something we need in this code, so we replace that with "addiu". Link: http://www.linux-mips.org/archives/linux-mips/2015-01/msg00430.html Cc: Maciej W. Rozycki <macro@linux-mips.org> Cc: <stable@vger.kernel.org> # v3.15+ Cc: Paul Burton <paul.burton@imgtec.com> Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: kernel: genex: Set correct ISA levelMarkos Chandras
The jr instruction opcode has changed in R6 so make sure the correct ISA level is set prior using that instruction. Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: kernel: r4k_fpu: Add support for MIPS R6Leonid Yegoshin
Add the MIPS R6 related preprocessor definitions for FPU signal related functions. MIPS R6 only has FR=1 so avoid checking that bit on the C0/Status register. Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com> Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: kernel: r4k_switch: Add support for MIPS R6Leonid Yegoshin
Add the MIPS R6 related preprocessor definitions for save/restore FPU related functions. We also set the appropriate ISA level so the final return instruction "jr ra" will produce the correct opcode on R6. Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com> Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: kernel: traps: Add MIPS R6 related definitionsLeonid Yegoshin
Add MIPS R6 support to cache and ftlb exceptions, as well as to the hwrena and ebase register configuration. Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com> Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: kernel: proc: Add MIPS R6 support to /proc/cpuinfoMarkos Chandras
Print 'mips64r6' and/or 'mips32r6' if the kernel is running on a MIPS R6 core. Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: kernel: entry.S: Add MIPS R6 related definitionsMarkos Chandras
The instruction hazard barrier in the form of: jr.hb ra nop is valid on MIPS R6 as well. Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: kernel: cpu-probe.c: Add support for MIPS R6Leonid Yegoshin
Add MIPS R6 support when decoding the config0 c0 register. Also add MIPS R6 support when examining the ebase c0 register to get the core number and when getting the shadow set number from the srsctl c0 register. Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com> Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: kernel: cevt-r4k: Add MIPS R6 to the c0_compare_interrupt handlerLeonid Yegoshin
Just like MIPS R2, in MIPS R6 it is possible to determine if a timer interrupt has happened or not. Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com> Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: kernel: cpu-bugs64: Do not check R6 cores for existing 64-bit bugsLeonid Yegoshin
The current HW bugs checked in cpu-bugs64, do not apply to R6 cores and they cause compilation problems due to removed <R6 instructions, so do not check for them for the time being. Reviewed-by: Maciej W. Rozycki <macro@linux-mips.org> Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com> Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: asm: spram: Add new symbol for MIPS scratch pad storageMarkos Chandras
MIPS R6, just like MIPS R2, have scratch pad storage, so add a new symbol which is selected by MIPS R2 and R6. Link: http://www.linux-mips.org/archives/linux-mips/2015-01/msg00389.html Cc: Maciej W. Rozycki <macro@linux-mips.org> Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-17MIPS: Use generic checksum functions for MIPS R6Markos Chandras
The following instructions have been removed from MIPS R6 ulw, ulh, swl, lwr, lwl, swr. However, all of them are used in the MIPS specific checksum implementation. As a result of which, we will use the generic checksum on MIPS R6 Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-16MIPS: Add MIPS generic QEMU probe supportLeonid Yegoshin
Add a case in cpu_probe_mips for the MIPS generic QEMU processor ID. Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com> Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-16MIPS: Add cases for CPU_QEMU_GENERICLeonid Yegoshin
Add a CPU_QEMU_GENERIC case to various switch statements. Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com> Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
2015-02-16MIPS: HTW: Prevent accidental HTW start due to nested htw_{start, stop}Markos Chandras
activate_mm() and switch_mm() call get_new_mmu_context() which in turn can enable the HTW before the entryhi is changed with the new ASID. Since the latter will enable the HTW in local_flush_tlb_all(), then there is a small timing window where the HTW is running with the new ASID but with an old pgd since the TLBMISS_HANDLER_SETUP_PGD hasn't assigned a new one yet. In order to prevent that, we introduce a simple htw counter to avoid starting HTW accidentally due to nested htw_{start,stop}() sequences. Moreover, since various IPI calls can enforce TLB flushing operations on a different core, such an operation may interrupt another htw_{stop,start} in progress leading inconsistent updates of the htw_seq variable. In order to avoid that, we disable the interrupts whenever we update that variable. Signed-off-by: Markos Chandras <markos.chandras@imgtec.com> Cc: <stable@vger.kernel.org> # 3.17+ Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/9118/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2015-02-13mm: vmalloc: pass additional vm_flags to __vmalloc_node_range()Andrey Ryabinin
For instrumenting global variables KASan will shadow memory backing memory for modules. So on module loading we will need to allocate memory for shadow and map it at address in shadow that corresponds to the address allocated in module_alloc(). __vmalloc_node_range() could be used for this purpose, except it puts a guard hole after allocated area. Guard hole in shadow memory should be a problem because at some future point we might need to have a shadow memory at address occupied by guard hole. So we could fail to allocate shadow for module_alloc(). Now we have VM_NO_GUARD flag disabling guard page, so we need to pass into __vmalloc_node_range(). Add new parameter 'vm_flags' to __vmalloc_node_range() function. Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Konstantin Serebryany <kcc@google.com> Cc: Dmitry Chernenkov <dmitryc@google.com> Signed-off-by: Andrey Konovalov <adech.fo@gmail.com> Cc: Yuri Gribov <tetra2005@gmail.com> Cc: Konstantin Khlebnikov <koct9i@gmail.com> Cc: Sasha Levin <sasha.levin@oracle.com> Cc: Christoph Lameter <cl@linux.com> Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com> Cc: Dave Hansen <dave.hansen@intel.com> Cc: Andi Kleen <andi@firstfloor.org> Cc: Ingo Molnar <mingo@elte.hu> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Christoph Lameter <cl@linux.com> Cc: Pekka Enberg <penberg@kernel.org> Cc: David Rientjes <rientjes@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-02-12all arches, signal: move restart_block to struct task_structAndy Lutomirski
If an attacker can cause a controlled kernel stack overflow, overwriting the restart block is a very juicy exploit target. This is because the restart_block is held in the same memory allocation as the kernel stack. Moving the restart block to struct task_struct prevents this exploit by making the restart_block harder to locate. Note that there are other fields in thread_info that are also easy targets, at least on some architectures. It's also a decent simplification, since the restart code is more or less identical on all architectures. [james.hogan@imgtec.com: metag: align thread_info::supervisor_stack] Signed-off-by: Andy Lutomirski <luto@amacapital.net> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Ingo Molnar <mingo@kernel.org> Cc: Kees Cook <keescook@chromium.org> Cc: David Miller <davem@davemloft.net> Acked-by: Richard Weinberger <richard@nod.at> Cc: Richard Henderson <rth@twiddle.net> Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Cc: Matt Turner <mattst88@gmail.com> Cc: Vineet Gupta <vgupta@synopsys.com> Cc: Russell King <rmk@arm.linux.org.uk> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <will.deacon@arm.com> Cc: Haavard Skinnemoen <hskinnemoen@gmail.com> Cc: Hans-Christian Egtvedt <egtvedt@samfundet.no> Cc: Steven Miao <realmz6@gmail.com> Cc: Mark Salter <msalter@redhat.com> Cc: Aurelien Jacquiot <a-jacquiot@ti.com> Cc: Mikael Starvik <starvik@axis.com> Cc: Jesper Nilsson <jesper.nilsson@axis.com> Cc: David Howells <dhowells@redhat.com> Cc: Richard Kuo <rkuo@codeaurora.org> Cc: "Luck, Tony" <tony.luck@intel.com> Cc: Geert Uytterhoeven <geert@linux-m68k.org> Cc: Michal Simek <monstr@monstr.eu> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Jonas Bonn <jonas@southpole.se> Cc: "James E.J. Bottomley" <jejb@parisc-linux.org> Cc: Helge Deller <deller@gmx.de> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Acked-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc) Tested-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc) Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Chen Liqin <liqin.linux@gmail.com> Cc: Lennox Wu <lennox.wu@gmail.com> Cc: Chris Metcalf <cmetcalf@ezchip.com> Cc: Guan Xuetao <gxt@mprc.pku.edu.cn> Cc: Chris Zankel <chris@zankel.net> Cc: Max Filippov <jcmvbkbc@gmail.com> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Guenter Roeck <linux@roeck-us.net> Signed-off-by: James Hogan <james.hogan@imgtec.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-02-12MIPS,prctl: add PR_[GS]ET_FP_MODE prctl options for MIPSPaul Burton
Userland code may be built using an ABI which permits linking to objects that have more restrictive floating point requirements. For example, userland code may be built to target the O32 FPXX ABI. Such code may be linked with other FPXX code, or code built for either one of the more restrictive FP32 or FP64. When linking with more restrictive code, the overall requirement of the process becomes that of the more restrictive code. The kernel has no way to know in advance which mode the process will need to be executed in, and indeed it may need to change during execution. The dynamic loader is the only code which will know the overall required mode, and so it needs to have a means to instruct the kernel to switch the FP mode of the process. This patch introduces 2 new options to the prctl syscall which provide such a capability. The FP mode of the process is represented as a simple bitmask combining a number of mode bits mirroring those present in the hardware. Userland can either retrieve the current FP mode of the process: mode = prctl(PR_GET_FP_MODE); or modify the current FP mode of the process: err = prctl(PR_SET_FP_MODE, new_mode); Signed-off-by: Paul Burton <paul.burton@imgtec.com> Cc: Matthew Fortune <matthew.fortune@imgtec.com> Cc: Markos Chandras <markos.chandras@imgtec.com> Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/8899/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2015-02-05MIPS: cevt-r4k: Drop GIC special caseJames Hogan
The cevt-r4k driver used to call into the GIC driver to find whether the timer was pending, but only with External Interrupt Controller (EIC) mode, where the Cause.IP bits can't be used as they encode the interrupt priority level (Cause.RIPL) instead. However commit e9de688dac65 ("irqchip: mips-gic: Support local interrupts") changed the condition from cpu_has_veic to gic_present. This fails on cores such as P5600 which have a GIC but the local interrupts aren't routable by the GIC, causing c0_compare_int_usable() to consider the interrupt unusable so r4k_clockevent_init() fails. The previous behaviour, added in commit 98b67c37db33 ("MIPS: Add EIC support for GIC."), wasn't really correct either as far as I can tell, since P5600 apparently supports EIC mode too, and in any case the use of Cause.TI with r2 should have been sufficient anyway since commit 010c108d7af7 ("MIPS: PowerTV: Fix support for timer interrupts with > 64 external IRQs"). Therefore drop the call into the gic driver altogether, and add a comment in c0_compare_int_pending() to clarify that Cause.TI does get checked since MIPS r2. Signed-off-by: James Hogan <james.hogan@imgtec.com> Fixes: e9de688dac65 ("irqchip: mips-gic: Support local interrupts") Reviewed-by: Andrew Bresticker <abrestic@chromium.org> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Steven J. Hill <steven.hill@imgtec.com> Cc: Qais Yousef <qais.yousef@imgtec.com> Cc: Jason Cooper <jason@lakedaemon.net> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/9077/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2015-02-04MIPS: Fix syscall_get_nr for the syscall exit tracing.Lars Persson
Register 2 is alredy overwritten by the return value when syscall_trace_leave() is called. Signed-off-by: Lars Persson <larper@axis.com> Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/9187/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2015-01-31MIPS: fork: Fix MSA/FPU/DSP context duplication raceJames Hogan
There is a race in the MIPS fork code which allows the child to get a stale copy of parent MSA/FPU/DSP state that is active in hardware registers when the fork() is called. This is because copy_thread() saves the live register state into the child context only if the hardware is currently in use, apparently on the assumption that the hardware state cannot have been saved and disabled since the initial duplication of the task_struct. However preemption is certainly possible during this window. An example sequence of events is as follows: 1) The parent userland process puts important data into saved floating point registers ($f20-$f31), which are then dirty compared to the process' stored context. 2) The parent process calls fork() which does a clone system call. 3) In the kernel, do_fork() -> copy_process() -> dup_task_struct() -> arch_dup_task_struct() (which uses the weakly defined default implementation). This duplicates the parent process' task context, which includes a stale version of its FP context from when it was last saved, probably some time before (1). 4) At some point before copy_process() calls copy_thread(), such as when duplicating the memory map, the process is desceduled. Perhaps it is preempted asynchronously, or perhaps it sleeps while blocked on a mutex. The dirty FP state in the FP registers is saved to the parent process' context and the FPU is disabled. 5) When the process is rescheduled again it continues copying state until it gets to copy_thread(), which checks whether the FPU is in use, so that it can copy that dirty state to the child process' task context. Because of the deschedule however the FPU is not in use, so the child process' context is left with stale FP context from the last time the parent saved it (some time before (1)). 6) When the new child process is scheduled it reads the important data from the saved floating point register, and ends up doing a NULL pointer dereference as a result of the stale data. This use of saved floating point registers across function calls can be triggered fairly easily by explicitly using inline asm with a current (MIPS R2) compiler, but is far more likely to happen unintentionally with a MIPS R6 compiler where the FP registers are more likely to get used as scratch registers for storing non-fp data. It is easily fixed, in the same way that other architectures do it, by overriding the implementation of arch_dup_task_struct() to sync the dirty hardware state to the parent process' task context *prior* to duplicating it, rather than copying straight to the child process' task context in copy_thread(). Note, the FPU hardware is not disabled so the parent process may continue executing with the live register context, but now the child process is guaranteed to have an identical copy of it at that point. Signed-off-by: James Hogan <james.hogan@imgtec.com> Reported-by: Matthew Fortune <matthew.fortune@imgtec.com> Tested-by: Markos Chandras <markos.chandras@imgtec.com> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Paul Burton <paul.burton@imgtec.com> Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/9075/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2015-01-30MIPS: traps: Fix inline asm ctc1 missing .set hardfloatJames Hogan
Commit 842dfc11ea9a ("MIPS: Fix build with binutils 2.24.51+") in v3.18 enabled -msoft-float and sprinkled ".set hardfloat" where necessary to use FP instructions. However it missed enable_restore_fp_context() which since v3.17 does a ctc1 with inline assembly, causing the following assembler errors on Mentor's 2014.05 toolchain: {standard input}: Assembler messages: {standard input}:2913: Error: opcode not supported on this processor: mips32r2 (mips32r2) `ctc1 $2,$31' scripts/Makefile.build:257: recipe for target 'arch/mips/kernel/traps.o' failed Fix that to use the new write_32bit_cp1_register() macro so that ".set hardfloat" is automatically added when -msoft-float is in use. Fixes 842dfc11ea9a ("MIPS: Fix build with binutils 2.24.51+") Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Paul Burton <paul.burton@imgtec.com> Cc: linux-mips@linux-mips.org Cc: <stable@vger.kernel.org> # 3.18+, depends on "MIPS: mipsregs.h: Add write_32bit_cp1_register()" Patchwork: https://patchwork.linux-mips.org/patch/9173/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2015-01-29MIPS: Fix kernel lockup or crash after CPU offline/onlineHemmo Nieminen
As printk() invocation can cause e.g. a TLB miss, printk() cannot be called before the exception handlers have been properly initialized. This can happen e.g. when netconsole has been loaded as a kernel module and the TLB table has been cleared when a CPU was offline. Call cpu_report() in start_secondary() only after the exception handlers have been initialized to fix this. Without the patch the kernel will randomly either lockup or crash after a CPU is onlined and the console driver is a module. Signed-off-by: Hemmo Nieminen <hemmo.nieminen@iki.fi> Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi> Cc: stable@vger.kernel.org Cc: David Daney <david.daney@cavium.com> Cc: linux-mips@linux-mips.org Cc: linux-kernel@vger.kernel.org Patchwork: https://patchwork.linux-mips.org/patch/8953/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2015-01-16MIPS: IRQ: Fix disable_irq on CPU IRQsFelix Fietkau
If the irq_chip does not define .irq_disable, any call to disable_irq will defer disabling the IRQ until it fires while marked as disabled. This assumes that the handler function checks for this condition, which handle_percpu_irq does not. In this case, calling disable_irq leads to an IRQ storm, if the interrupt fires while disabled. This optimization is only useful when disabling the IRQ is slow, which is not true for the MIPS CPU IRQ. Disable this optimization by implementing .irq_disable and .irq_enable Signed-off-by: Felix Fietkau <nbd@openwrt.org> Cc: stable@vger.kernel.org Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/8949/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2015-01-16MIPS: smp-mt,smp-cmp: Enable all HW IRQs on secondary CPUsJames Hogan
Commit 18743d2781d0 ("irqchip: mips-gic: Stop using per-platform mapping tables") in v3.19-rc1 changed the routing of IPIs through the GIC to go to the HW0 IRQ pin along with the rest of the GIC interrupts, rather than to HW1 and HW2 pins. This breaks SMP boot using the CMP or MT SMP implementations because HW0 doesn't get unmasked when secondary CPUs are initialised so the IPIs will never interrupt secondary CPUs (nor any other interrupts routed through the GIC). Commit ff1e29ade4c6 ("MIPS: smp-cps: Enable all hardware interrupts on secondary CPUs") fixed this in advance for the CPS SMP implementation by unmasking all hardware interrupt lines for secondary CPUs, so lets do the same for the CMP and MT implementations. Fixes: 18743d2781d0 ("irqchip: mips-gic: Stop using per-platform mapping tables") Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: Andrew Bresticker <abrestic@chromium.org> Cc: Qais Yousef <qais.yousef@imgtec.com> Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/9025/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2015-01-16MIPS: Fix restart of indirect syscallsEd Swierk
When 32-bit MIPS userspace invokes a syscall indirectly via syscall(number, arg1, ..., arg7), the kernel looks up the actual syscall based on the given number, shifts the other arguments to the left, and jumps to the syscall. If the syscall is interrupted by a signal and indicates it needs to be restarted by the kernel (by returning ERESTARTNOINTR for example), the syscall must be called directly, since the number is no longer the first argument, and the other arguments are now staged for a direct call. Before shifting the arguments, store the syscall number in pt_regs->regs[2]. This gets copied temporarily into pt_regs->regs[0] after the syscall returns. If the syscall needs to be restarted, handle_signal()/do_signal() copies the number back to pt_regs->reg[2], which ends up in $v0 once control returns to userspace. Signed-off-by: Ed Swierk <eswierk@skyportsystems.com> Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/8929/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2015-01-15MIPS: ELF: fix loading o32 binaries on 64-bit kernelsJames Cowgill
Commit 90cee759f08a ("MIPS: ELF: Set FP mode according to .MIPS.abiflags") introduced checking of the .MIPS.abiflags ELF section but did so through the native sized "elfhdr" and "elf_phdr" structures regardless whether the ELF was actually 32-bit or 64-bit. This produces wrong results when trying to use a 64-bit kernel to load o32 ELF files. Change the uses of the generic elf structures to their 32-bit versions. Since the code bails out on any 64-bit cases, this is OK until they are implemented. Fixes: 90cee759f08a ("MIPS: ELF: Set FP mode according to .MIPS.abiflags") Signed-off-by: James Cowgill <James.Cowgill@imgtec.com> Cc: linux-mips@linux-mips.org Cc: Paul Burton <paul.burton@imgtec.com> Reviewed-by: Maciej W. Rozycki <macro@linux-mips.org> Patchwork: https://patchwork.linux-mips.org/patch/8932/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2015-01-13MIPS: Wire up execveat(2).Ralf Baechle
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2014-12-12MIPS: Use phys_addr_t instead of phys_tJaedon Shin
Ralf Baechle says: "This should have been part of the merge commit c0222ac08666 (Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/- ralf/upstream-linus) but I forgot to mention the need for this in my pull request" Signed-off-by: Jaedon Shin <jaedon.shin@gmail.com> Signed-off-by: Ralf Baechle <ralf@linux-mips.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-12-11Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linusLinus Torvalds
Pull MIPS updates from Ralf Baechle: "This is an unusually large pull request for MIPS - in parts because lots of patches missed the 3.18 deadline but primarily because some folks opened the flood gates. - Retire the MIPS-specific phys_t with the generic phys_addr_t. - Improvments for the backtrace code used by oprofile. - Better backtraces on SMP systems. - Cleanups for the Octeon platform code. - Cleanups and fixes for the Loongson platform code. - Cleanups and fixes to the firmware library. - Switch ATH79 platform to use the firmware library. - Grand overhault to the SEAD3 and Malta interrupt code. - Move the GIC interrupt code to drivers/irqchip - Lots of GIC cleanups and updates to the GIC code to use modern IRQ infrastructures and features of the kernel. - OF documentation updates for the GIC bindings - Move GIC clocksource driver to drivers/clocksource - Merge GIC clocksource driver with clockevent driver. - Further updates to bring the GIC clocksource driver up to date. - R3000 TLB code cleanups - Improvments to the Loongson 3 platform code. - Convert pr_warning to pr_warn. - Merge a bunch of small lantiq and ralink fixes that have been staged/lingering inside the openwrt tree for a while. - Update archhelp for IP22/IP32 - Fix a number of issues for Loongson 1B. - New clocksource and clockevent driver for Loongson 1B. - Further work on clk handling for Loongson 1B. - Platform work for Broadcom BMIPS. - Error handling cleanups for TurboChannel. - Fixes and optimization to the microMIPS support. - Option to disable the FTLB. - Dump more relevant information on machine check exception - Change binfmt to allow arch to examine PT_*PROC headers - Support for new style FPU register model in O32 - VDSO randomization. - BCM47xx cleanups - BCM47xx reimplement the way the kernel accesses NVRAM information. - Random cleanups - Add support for ATH25 platforms - Remove pointless locking code in some PCI platforms. - Some improvments to EVA support - Minor Alchemy cleanup" * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: (185 commits) MIPS: Add MFHC0 and MTHC0 instructions to uasm. MIPS: Cosmetic cleanups of page table headers. MIPS: Add CP0 macros for extended EntryLo registers MIPS: Remove now unused definition of phys_t. MIPS: Replace use of phys_t with phys_addr_t. MIPS: Replace MIPS-specific 64BIT_PHYS_ADDR with generic PHYS_ADDR_T_64BIT PCMCIA: Alchemy Don't select 64BIT_PHYS_ADDR in Kconfig. MIPS: lib: memset: Clean up some MIPS{EL,EB} ifdefery MIPS: iomap: Use __mem_{read,write}{b,w,l} for MMIO MIPS: <asm/types.h> fix indentation. MAINTAINERS: Add entry for BMIPS multiplatform kernel MIPS: Enable VDSO randomization MIPS: Remove a temporary hack for debugging cache flushes in SMTC configuration MIPS: Remove declaration of obsolete arch_init_clk_ops() MIPS: atomic.h: Reformat to fit in 79 columns MIPS: Apply `.insn' to fixup labels throughout MIPS: Fix microMIPS LL/SC immediate offsets MIPS: Kconfig: Only allow 32-bit microMIPS builds MIPS: signal.c: Fix an invalid cast in ISA mode bit handling MIPS: mm: Only build one microassembler that is suitable ...
2014-11-24MIPS: Replace use of phys_t with phys_addr_t.Ralf Baechle
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2014-11-24MIPS: Enable VDSO randomizationPrem Karat
Based on commit 1091458d09e1a (mmap randomization) For 32-bit address spaces randomize within a 16MB space, for 64-bit within a 256MB space. Test Results: ------------ Without Patch (VDSO is not randomized) --------------------------------------- root@Maleo:~# ./aslr vdso FAIL: ASLR not functional (vdso always at 0x7fff7000) root@Maleo:~# ./aslr rekey vdso pre_val==cur_val value=0x7fff7000 With patch:(VDSO is randmoized and doesn't interfere with stack) ---------------------------------------------------------------- root@cavium-octeon2:~# ./aslr rekey vdso pre_val!=cur_val previous_value=0x7f830ea2 current_value=0x776e2000 root@cavium-octeon2:~# ./aslr rekey vdso pre_val!=cur_val previous_value=0x7fb0cea2 current_value=0x77209000 root@cavium-octeon2:~# ./aslr rekey vdso pre_val!=cur_val previous_value=0x7f985ea2 current_value=0x7770c000 root@cavium-octeon2:~# ./aslr rekey vdso pre_val!=cur_val previous_value=0x7fbc6ea2 current_value=0x7fe25000 Maps file output: ------------------------- root@cavium-octeon2:~# ./aslr rekey maps 78584000-785a5000 rwxp 00000000 00:00 0 [heap] 7f9d0000-7f9f1000 rw-p 00000000 00:00 0 [stack] 7ffa5000-7ffa6000 r-xp 00000000 00:00 0 [vdso] root@cavium-octeon2:~# ./aslr rekey maps 77de0000-77e01000 rwxp 00000000 00:00 0 [heap] 7f91b000-7f93c000 rw-p 00000000 00:00 0 [stack] 7ff99000-7ff9a000 r-xp 00000000 00:00 0 [vdso] root@cavium-octeon2:~# ./aslr rekey maps 77d7f000-77da0000 rwxp 00000000 00:00 0 [heap] 7fc2a000-7fc4b000 rw-p 00000000 00:00 0 [stack] 7fe09000-7fe0a000 r-xp 00000000 00:00 0 [vdso] root@cavium-octeon2:~# ./aslr rekey maps 7794c000-7794d000 r-xp 00000000 00:00 0 [vdso] 77e4b000-77e6c000 rwxp 00000000 00:00 0 [heap] 7f6e7000-7f708000 rw-p 00000000 00:00 0 [stack] root@cavium-octeon2:~# Signed-off-by: Prem Karat <pkarat@mvista.com> Cc: linux-mips@linux-mips.org Cc: sergei.shtylyov@cogentembedded.com Cc: ddaney.cavm@gmail.com Patchwork: https://patchwork.linux-mips.org/patch/6812 Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2014-11-24MIPS: Apply `.insn' to fixup labels throughoutMaciej W. Rozycki
Fix the issue with the ISA bit being lost in fixups that jump to labels placed just before a section switch. Such a switch leads to the ISA bit being lost, because GAS concludes there is no code that follows and therefore the label refers to data. Use the `.insn' pseudo-op to convince the tool this is not the case. This lack of label annotation leads to microMIPS compilation errors like: mips-linux-gnu-ld: arch/mips/built-in.o: .fixup+0x3b8: Unsupported jump between ISA modes; consider recompiling with interlinking enabled. mips-linux-gnu-ld: final link failed: Bad value Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com> Signed-off-by: Steven J. Hill <Steven.Hill@imgtec.com> Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/8483/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>