Commit 1400eb6 (MIPS: r4k,octeon,r2300: stack protector: change canary
per task) was merged in v3.11 and introduced assembly in the MIPS resume
functions to update the value of the current canary in
__stack_chk_guard. However it used PTR_L resulting in a load of the
canary value, instead of PTR_LA to construct its address. The value is
intended to be random but is then treated as an address in the
subsequent LONG_S (store).
This was observed to cause a fault and panic:
CPU 0 Unable to handle kernel paging request at virtual address 139fea20, epc == 8000cc0c, ra == 8034f2a4
Oops[#1]:
...
$24 : 139fea20 1e1f7cb6
...
Call Trace:
[<8000cc0c>] resume+0xac/0x118
[<8034f2a4>] __schedule+0x5f8/0x78c
[<8034f4e0>] schedule_preempt_disabled+0x20/0x2c
[<80348eec>] rest_init+0x74/0x84
[<804dc990>] start_kernel+0x43c/0x454
Code: 3c18804b 8f184030 8cb901f8 <af190000> 00c0e021 8cb002f0 8cb102f4 8cb202f8 8cb302fc
This can also be forced by modifying
arch/mips/include/asm/stackprotector.h so that the default
__stack_chk_guard value is more likely to be a bad (or unaligned)
pointer.
Fix it to use PTR_LA instead, to load the address of the canary value,
which the LONG_S can then use to write into it.
Reported-by: bobjones (via #mipslinux on IRC)
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Gregory Fong <gregory.0xf0@gmail.com>
Cc: linux-mips@linux-mips.org
Cc: stable@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/6026/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Currently the kernel will always use the FR=0 register model for O32. If
an O32 application did enable FR=1 mode, some data from another application
might be leaked in the extra registers becoming visible.
Iow, this patch is meant to make the kernel MIPS R5 tolerant but leaves
proper MIPS R5 support to a future patchset.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
o Move current_cpu_type() to a separate header file
o #ifdefing on supported CPU types lets modern GCC know that certain
code in callers may be discarded ideally turning current_cpu_type() into
a function returning a constant.
o Use current_cpu_type() rather than direct access to struct cpuinfo_mips.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Cc: Steven J. Hill <Steven.Hill@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/5833/
Not all I/O ASIC versions have the free-running counter implemented, an
early revision used in the 5000/1xx models aka 3MIN and 4MIN did not have
it. Therefore we cannot unconditionally use it as a clock source.
Fortunately if not implemented its register slot has a fixed value so it
is enough if we check for the value at the end of the calibration period
being the same as at the beginning.
This also means we need to look for another high-precision clock source on
the systems affected. The 5000/1xx can have an R4000SC processor
installed where the CP0 Count register can be used as a clock source.
Unfortunately all the R4k DECstations suffer from the missed timer
interrupt on CP0 Count reads erratum, so we cannot use the CP0 timer as a
clock source and a clock event both at a time. However we never need an
R4k clock event device because all DECstations have a DS1287A RTC chip
whose periodic interrupt can be used as a clock source.
This gives us the following four configuration possibilities for I/O ASIC
DECstations:
1. No I/O ASIC counter and no CP0 timer, e.g. R3k 5000/1xx (3MIN).
2. No I/O ASIC counter but the CP0 timer, i.e. R4k 5000/150 (4MIN).
3. The I/O ASIC counter but no CP0 timer, e.g. R3k 5000/240 (3MAX+).
4. The I/O ASIC counter and the CP0 timer, e.g. R4k 5000/260 (4MAX+).
For #1 and #2 this change stops the I/O ASIC free-running counter from
being installed as a clock source of a 0Hz frequency. For #2 it also
arranges for the CP0 timer to be used as a clock source rather than a
clock event device, because having an accurate wall clock is more
important than a high-precision interval timer. For #3 there is no
change. For #4 the change makes the I/O ASIC free-running counter
installed as a clock source so that the CP0 timer can be used as a clock
event device.
Unfortunately the use of the CP0 timer as a clock event device relies on a
succesful completion of c0_compare_interrupt. That never happens, because
while waiting for a CP0 Compare interrupt to happen the function spins in
a loop reading the CP0 Count register. This makes the CP0 Count erratum
trigger reliably causing the interrupt waited for to be lost in all cases.
As a result #4 resorts to using the CP0 timer as a clock source as well,
just as #2. However we want to keep this separate arrangement in case
(hope) c0_compare_interrupt is eventually rewritten such that it avoids
the erratum.
Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/5825/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Pull MIPS updates from Ralf Baechle:
"This has been sitting in -next for a while with no objections and all
MIPS defconfigs except one are building fine; that one platform got
broken by another patch in your tree and I'm going to submit a patch
separately.
- a handful of fixes that didn't make 3.11
- a few bits of Octeon 3 support with more to come for a later
release
- platform enhancements for Octeon, ath79, Lantiq, Netlogic and
Ralink SOCs
- a GPIO driver for the Octeon
- some dusting off of the DECstation code
- the usual dose of cleanups"
* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: (65 commits)
MIPS: DMA: Fix BUG due to smp_processor_id() in preemptible code
MIPS: kexec: Fix random crashes while loading crashkernel
MIPS: kdump: Skip walking indirection page for crashkernels
MIPS: DECstation HRT calibration bug fixes
MIPS: Export copy_from_user_page() (needed by lustre)
MIPS: Add driver for the built-in PCI controller of the RT3883 SoC
MIPS: DMA: For BMIPS5000 cores flush region just like non-coherent R10000
MIPS: ralink: Add support for reset-controller API
MIPS: ralink: mt7620: Add cpu-feature-override header
MIPS: ralink: mt7620: Add spi clock definition
MIPS: ralink: mt7620: Add wdt clock definition
MIPS: ralink: mt7620: Improve clock frequency detection
MIPS: ralink: mt7620: This SoC has EHCI and OHCI hosts
MIPS: ralink: mt7620: Add verbose ram info
MIPS: ralink: Probe clocksources from OF
MIPS: ralink: Add support for systick timer found on newer ralink SoC
MIPS: ralink: Add support for periodic timer irq
MIPS: Netlogic: Built-in DTB for XLP2xx SoC boards
MIPS: Netlogic: Add support for USB on XLP2xx
MIPS: Netlogic: XLP2xx update for I2C controller
...
Pull device tree core updates from Grant Likely:
"Generally minor changes. A bunch of bug fixes, particularly for
initialization and some refactoring. Most notable change if feeding
the entire flattened tree into the random pool at boot. May not be
significant, but shouldn't hurt either"
Tim Bird questions whether the boot time cost of the random feeding may
be noticeable. And "add_device_randomness()" is definitely not some
speed deamon of a function.
* tag 'devicetree-for-linus' of git://git.secretlab.ca/git/linux:
of/platform: add error reporting to of_amba_device_create()
irq/of: Fix comment typo for irq_of_parse_and_map
of: Feed entire flattened device tree into the random pool
of/fdt: Clean up casting in unflattening path
of/fdt: Remove duplicate memory clearing on FDT unflattening
gpio: implement gpio-ranges binding document fix
of: call __of_parse_phandle_with_args from of_parse_phandle
of: introduce of_parse_phandle_with_fixed_args
of: move of_parse_phandle()
of: move documentation of of_parse_phandle_with_args
of: Fix missing memory initialization on FDT unflattening
of: consolidate definition of early_init_dt_alloc_memory_arch()
of: Make of_get_phy_mode() return int i.s.o. const int
include: dt-binding: input: create a DT header defining key codes.
of/platform: Staticize of_platform_device_create_pdata()
of: Specify initrd location using 64-bit
dt: Typo fix
OF: make of_property_for_each_{u32|string}() use parameters if OF is not enabled
Fixed compilation errors in case of non-KEXEC kernel
Rearranging code so that crashk_res gets updated.
- crashk_res is updated after mips_parse_crashkernel(),
after resource_init(), which is after arch_mem_init().
- The reserved memory is actually treated as Usable memory,
Unless we load the crash kernel, everything works.
Signed-off-by: Prem Mallappa <pmallappa@caviumnetworks.com>
Cc: linux-mips <linux-mips@linux-mips.org>
Patchwork: http://patchwork.linux-mips.org/patch/5805/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
This change corrects DECstation HRT calibration, by removing the following
bugs:
1. Calibration period selection -- HZ / 10 has been chosen, however on
DECstation computers, HZ never divides by 10, as the choice for HZ is
among 128, 256 and 1024. The choice therefore results in a systematic
calibration error, e.g. 6.25% for the usual choice of 128 for HZ:
128 / 10 * 10 = 120
(128 - 120) / 128 -> 6.25%
The change therefore makes calibration use HZ / 8 that is always
accurate for the HZ values available, getting rid of the systematic
error.
2. Calibration starting point synchronisation -- the duration of a number
of intervals between DS1287A periodic interrupt assertions is measured,
however code does not ensure at the beginning that the interrupt has
not been previously asserted. This results in a variable error of e.g.
up to another 6.25% for the period of HZ / 8 (8.(3)% with the original
HZ / 10 period) and the usual choice of 128 for HZ:
1 / 16 -> 6.25%
1 / 12 -> 8.(3)%
The change therefore adds an initial call to ds1287_timer_state that
clears any previous periodic interrupt pending.
The same issue applies to both I/O ASIC counter and R4k CP0 timer
calibration on DECstation systems as similar code is used in both cases
and both pieces of code are covered by this fix.
On an R3400 test system used this fix results in a change of the I/O ASIC
clock frequency reported from values like:
I/O ASIC clock frequency 23185830Hz
to:
I/O ASIC clock frequency 24999288Hz
removing the miscalculation by 6.25% from the systematic error and (for
the individual sample provided) a further 1.00% from the variable error,
accordingly. The nominal I/O ASIC clock frequency is 25MHz on this
system.
Here's another result, with the fix applied, from a system that has both
HRTs available (using an R4400 at 60MHz nominal):
MIPS counter frequency 59999328Hz
I/O ASIC clock frequency 24999432Hz
Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/5807/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
XLP2XX is first in the series of 28nm XLPII processors.
The changes are to:
* Add processor ID for XLP2XX to asm/cpu.h and kernel/cpu-probe.c.
* Add a cpu_is_xlpii() function to check for XLPII processors.
* Update xlp_mmu_init() to use config4 to enable extended TLB.
Signed-off-by: Jayachandran C <jchandra@broadcom.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/5698/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Pull driver core patches from Greg KH:
"Here's the big driver core pull request for 3.12-rc1.
Lots of tiny changes here fixing up the way sysfs attributes are
created, to try to make drivers simpler, and fix a whole class race
conditions with creations of device attributes after the device was
announced to userspace.
All the various pieces are acked by the different subsystem
maintainers"
* tag 'driver-core-3.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (119 commits)
firmware loader: fix pending_fw_head list corruption
drivers/base/memory.c: introduce help macro to_memory_block
dynamic debug: line queries failing due to uninitialized local variable
sysfs: sysfs_create_groups returns a value.
debugfs: provide debugfs_create_x64() when disabled
rbd: convert bus code to use bus_groups
firmware: dcdbas: use binary attribute groups
sysfs: add sysfs_create/remove_groups for when SYSFS is not enabled
driver core: add #include <linux/sysfs.h> to core files.
HID: convert bus code to use dev_groups
Input: serio: convert bus code to use drv_groups
Input: gameport: convert bus code to use drv_groups
driver core: firmware: use __ATTR_RW()
driver core: core: use DEVICE_ATTR_RO
driver core: bus: use DRIVER_ATTR_WO()
driver core: create write-only attribute macros for devices and drivers
sysfs: create __ATTR_WO()
driver-core: platform: convert bus code to use dev_groups
workqueue: convert bus code to use dev_groups
MEI: convert bus code to use dev_groups
...
Dynamic function tracing was not working on MIPS. When doing dynamic
tracing, the tracer attempts to match up the passed in address with
the one the compiler creates in the mcount tables. The MIPS code was
passing in the return address from the tracing function call, but the
compiler tables were the address of the function call. So they
wouldn't match.
Just subtracting 8 from the return address will give the address of
the function call. Easy enough.
Signed-off-by: Corey Minyard <cminyard@mvista.com>
[david.daney@cavium.com: Adjusted code comment and patch Subject.]
Signed-off-by: David Daney <david.daney@cavium.com>
Cc: linux-mips@linux-mips.org
Cc: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Patchwork: https://patchwork.linux-mips.org/patch/5592/
This is a fix for a bug introduced with commit
447cdf2628, submitted as archived here:
http://www.linux-mips.org/cgi-bin/mesg.cgi?a=linux-mips&i=20080312235002.c717dde3.yoichi_yuasa%40tripeaks.co.jp
regrettably with no further explanation.
The issue is with the CP0 Count register read erratum present on R4000 and
some R4400 processors. If this erratum is present, then a read from this
register that happens around the time it reaches the value stored in the
CP0 Compare register causes a CP0 timer interrupt that is supposed to
happen when the values in the two registers match to be missed. The
implication for the chips affected is the CP0 timer can be used either as
a source of a timer interrupt (a clock event) or as a source of a
high-resolution counter (a clock source), but not both at a time.
The erratum does not affect timer interrupt operation itself, because in
this case the CP0 Count register is only read while the timer interrupt
has already been raised, while high-resolution counter references happen
at random times.
Additionally some systems apparently have issues with the timer interrupt
line being routed externally and not following the usual CP0 Count/Compare
semantics. In this case we don't want to use the R4k clock event.
We've meant to address the erratum and the timer interrupt routing issue
in time_init, however the commit referred to above broke our solution.
What we currently have is we enable the R4k clock source if the R4k clock
event initialization has succeeded (the timer is present and has no timer
interrupt routing issue) or there is no CP0 Count register read erratum.
Which gives the following boolean matrix:
clock event | count erratum => clock source
------------+---------------+--------------
0 | 0 | 1 (OK)
0 | 1 | 0 (bug!) -> no interference, could use
1 | 0 | 1 (OK)
1 | 1 | 1 (bug!) -> can't use, interference
What we want instead is to enable the R4k clock source if there is no CP0
Count register read erratum (obviously) or the R4k clock event
initialization has *failed* -- because in the latter case we won't be
using the timer interrupt anyway, so we don't care about any interference
CP0 Count reads might cause with the interrupt. This corresponds to the
following boolean matrix:
clock event | count erratum => clock source
------------+---------------+--------------
0 | 0 | 1
0 | 1 | 1
1 | 0 | 1
1 | 1 | 0
This is implemented here, effectively reverting the problematic commit,
and a short explanation is given next to code modified so that the
rationale is known to future readers and confusion is prevented from
happening here again.
It is worth noting that mips_clockevent_init returns 0 upon success while
cpu_has_mfc0_count_bug returns 0 upon failure. This is because the former
function returns an error code while the latter returns a boolean value.
To signify the difference I have therefore chosen to compare the result of
the former call explicitly against 0.
Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/5799/
The dev_attrs field of struct class is going away soon, dev_groups
should be used instead. This converts the MIPS vpe_class code to use
the correct field.
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: John Crispin <blogic@openwrt.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
