linux-stable.git/arch/mips/kernel/cpu-probe.c, branch v5.12.2 Linux kernel stable tree MIPS: kernel: Reserve exception base early to prevent corruption 2021-03-09T10:22:59+00:00 Thomas Bogendoerfer tsbogend@alpha.franken.de 2021-03-08T09:24:47+00:00 bd67b711bfaa02cf19e88aa2d9edae5c1c1d2739 BMIPS is one of the few platforms that do change the exception base. After commit 2dcb39645441 ("memblock: do not start bottom-up allocations with kernel_end") we started seeing BMIPS boards fail to boot with the built-in FDT being corrupted. Before the cited commit, early allocations would be in the [kernel_end, RAM_END] range, but after commit they would be within [RAM_START + PAGE_SIZE, RAM_END]. The custom exception base handler that is installed by bmips_ebase_setup() done for BMIPS5000 CPUs ends-up trampling on the memory region allocated by unflatten_and_copy_device_tree() thus corrupting the FDT used by the kernel. To fix this, we need to perform an early reservation of the custom exception space. Additional we reserve the first 4k (1k for R3k) for either normal exception vector space (legacy CPUs) or special vectors like cache exceptions. Huge thanks to Serge for analysing and proposing a solution to this issue. Fixes: 2dcb39645441 ("memblock: do not start bottom-up allocations with kernel_end") Reported-by: Kamal Dasu <kdasu.kdev@gmail.com> Debugged-by: Serge Semin <Sergey.Semin@baikalelectronics.ru> Acked-by: Mike Rapoport <rppt@linux.ibm.com> Tested-by: Florian Fainelli <f.fainelli@gmail.com> Reviewed-by: Serge Semin <fancer.lancer@gmail.com> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> 
BMIPS is one of the few platforms that do change the exception base.
After commit 2dcb39645441 ("memblock: do not start bottom-up allocations
with kernel_end") we started seeing BMIPS boards fail to boot with the
built-in FDT being corrupted.

Before the cited commit, early allocations would be in the [kernel_end,
RAM_END] range, but after commit they would be within [RAM_START +
PAGE_SIZE, RAM_END].

The custom exception base handler that is installed by
bmips_ebase_setup() done for BMIPS5000 CPUs ends-up trampling on the
memory region allocated by unflatten_and_copy_device_tree() thus
corrupting the FDT used by the kernel.

To fix this, we need to perform an early reservation of the custom
exception space. Additional we reserve the first 4k (1k for R3k) for
either normal exception vector space (legacy CPUs) or special vectors
like cache exceptions.

Huge thanks to Serge for analysing and proposing a solution to this
issue.

Fixes: 2dcb39645441 ("memblock: do not start bottom-up allocations with kernel_end")
Reported-by: Kamal Dasu <kdasu.kdev@gmail.com>
Debugged-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
Acked-by: Mike Rapoport <rppt@linux.ibm.com>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Revert "MIPS: Remove unused R4300 CPU support" 2021-01-22T10:39:45+00:00 Lauri Kasanen cand@gmx.com 2021-01-13T15:10:07+00:00 65ce6197ed403b14f4efc70d509e07ac608a1ac5 This reverts commit f9065b54d437c4660e3d974ad9ce5188c068cd76. We're adding Nintendo 64 support, so the VR4300 is no longer unused. Signed-off-by: Lauri Kasanen <cand@gmx.com> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> 
This reverts commit f9065b54d437c4660e3d974ad9ce5188c068cd76.

We're adding Nintendo 64 support, so the VR4300 is no longer unused.

Signed-off-by: Lauri Kasanen <cand@gmx.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
MIPS: Ingenic: Disable HPTLB for D0 XBurst CPUs too 2021-01-18T14:24:02+00:00 Paul Cercueil paul@crapouillou.net 2020-12-12T00:03:54+00:00 a5360958a3cd1d876aae1f504ae014658513e1af The JZ4760 has the HPTLB as well, but has a XBurst CPU with a D0 CPUID. Disable the HPTLB for all XBurst CPUs with a D0 CPUID. In the case where there is no HPTLB (e.g. for older SoCs), this won't have any side effect. Fixes: b02efeb05699 ("MIPS: Ingenic: Disable abandoned HPTLB function.") Cc: <stable@vger.kernel.org> # 5.4 Signed-off-by: Paul Cercueil <paul@crapouillou.net> Reviewed-by: 周琰杰 (Zhou Yanjie) <zhouyanjie@wanyeetech.com> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> 
The JZ4760 has the HPTLB as well, but has a XBurst CPU with a D0 CPUID.

Disable the HPTLB for all XBurst CPUs with a D0 CPUID. In the case where
there is no HPTLB (e.g. for older SoCs), this won't have any side
effect.

Fixes: b02efeb05699 ("MIPS: Ingenic: Disable abandoned HPTLB function.")
Cc: <stable@vger.kernel.org> # 5.4
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Reviewed-by: 周琰杰 (Zhou Yanjie) <zhouyanjie@wanyeetech.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
MIPS: cpu-probe: remove MIPS_CPU_BP_GHIST option bit 2020-10-12T10:05:40+00:00 Thomas Bogendoerfer tsbogend@alpha.franken.de 2020-10-09T12:26:48+00:00 20cc5b649d9978494fb29259763c2505f6acc3c0 MIPS_CPU_BP_GHIST is only set two times and more or less immediately used in cpu-probe.c itself. Remove this option to make room in options word. Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> 
MIPS_CPU_BP_GHIST is only set two times and more or less immediately
used in cpu-probe.c itself. Remove this option to make room in options
word.

Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
MIPS: cpu-probe: move fpu probing/handling into its own file 2020-10-12T10:04:50+00:00 Thomas Bogendoerfer tsbogend@alpha.franken.de 2020-10-08T21:33:25+00:00 a616c0617aa36ea0bd51af90adfb87e8d3e9cb72 cpu-probe.c has grown when supporting more and more CPUs and there are use cases where probing for all the CPUs isn't useful like running on a R3k system. But still the fpu handling is nearly the same. For sharing put the fpu code into it's own file. Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> 
cpu-probe.c has grown when supporting more and more CPUs and there
are use cases where probing for all the CPUs isn't useful like
running on a R3k system. But still the fpu handling is nearly
the same. For sharing put the fpu code into it's own file.

Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
MIPS: cpu-probe: ingenic: Fix broken BUG_ON 2020-09-18T14:27:32+00:00 Paul Cercueil paul@crapouillou.net 2020-09-06T19:29:24+00:00 5f5ed0ebcf84c7479c93a28c5c0e1b0b6926883b The previous code was doing: BUG_ON(!__builtin_constant_p(cpu_has_counter) || cpu_has_counter); This only worked as the "cpu_has_counter" macro was overridden in <cpu-feature-overrides.h>. The default "cpu_has_counter" macro is non-constant, which triggered the BUG_ON() independently of the value returned by the macro. What we want to check here, is that *if* the macro was overridden to a compile-time constant, then must be defined to zero, otherwise it's a bug. So the correct check is: BUG_ON(__builtin_constant_p(cpu_has_counter) && cpu_has_counter); Signed-off-by: Paul Cercueil <paul@crapouillou.net> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> 
The previous code was doing:
BUG_ON(!__builtin_constant_p(cpu_has_counter) || cpu_has_counter);

This only worked as the "cpu_has_counter" macro was overridden in
<cpu-feature-overrides.h>. The default "cpu_has_counter" macro is
non-constant, which triggered the BUG_ON() independently of the value
returned by the macro.

What we want to check here, is that *if* the macro was overridden to a
compile-time constant, then must be defined to zero, otherwise it's a
bug.

So the correct check is:
BUG_ON(__builtin_constant_p(cpu_has_counter) && cpu_has_counter);

Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
MIPS: cpu-probe: Mark XBurst CPU as having vtagged caches 2020-09-18T14:27:00+00:00 Paul Cercueil paul@crapouillou.net 2020-09-06T19:29:23+00:00 5ef415107dfd42a334d62a9b7be9754817df92ed XBurst CPUs present in Ingenic SoCs have virtually tagged caches, according to the <cpu-features-override.h> header. Add that information to cpu_probe_ingenic(). Signed-off-by: Paul Cercueil <paul@crapouillou.net> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> 
XBurst CPUs present in Ingenic SoCs have virtually tagged caches,
according to the <cpu-features-override.h> header.

Add that information to cpu_probe_ingenic().

Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
MIPS: cpu-probe: Set Ingenic's writecombine to _CACHE_CACHABLE_WA 2020-09-18T14:26:36+00:00 Paul Cercueil paul@crapouillou.net 2020-09-06T19:29:22+00:00 95b1f6db67aea9135b018497f7ed4446a060cba2 Previously, in cpu_probe_ingenic(), c->writecombine was set to _CACHE_UNCACHED_ACCELERATED, but this macro was defined differently when CONFIG_MACH_INGENIC was set. This made it impossible to support multiple CPUs. Address this issue by setting c->writecombine to _CACHE_CACHABLE_WA directly and removing the dependency on CONFIG_MACH_INGENIC. Signed-off-by: Paul Cercueil <paul@crapouillou.net> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> 
Previously, in cpu_probe_ingenic(), c->writecombine was set to
_CACHE_UNCACHED_ACCELERATED, but this macro was defined differently when
CONFIG_MACH_INGENIC was set. This made it impossible to support multiple
CPUs.

Address this issue by setting c->writecombine to _CACHE_CACHABLE_WA
directly and removing the dependency on CONFIG_MACH_INGENIC.

Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
MIPS: handle Loongson-specific GSExc exception 2020-07-31T15:52:47+00:00 WANG Xuerui git@xen0n.name 2020-07-29T13:14:17+00:00 bc6e8dc112133a60efbede8acde36dd5d1e748a1 Newer Loongson cores (Loongson-3A R2 and newer) use the implementation-dependent ExcCode 16 to signal Loongson-specific exceptions. The extended cause is put in the non-standard CP0.Diag1 register which is CP0 Register 22 Select 1, called GSCause in Loongson manuals. Inside is an exception code bitfield called GSExcCode, only codes 0 to 6 inclusive are documented (so far, in the Loongson 3A3000 User Manual, Volume 2). During experiments, it was found that some undocumented unprivileged instructions can trigger the also-undocumented GSExcCode 8 on Loongson 3A4000. Processor state is not corrupted, but we cannot continue without further knowledge, and Loongson is not providing that information as of this writing. So we send SIGILL on seeing this exception code to thwart easy local DoS attacks. Other exception codes are made fatal, partly because of insufficient knowledge, also partly because they are not as easily reproduced. None of them are encountered in the wild with upstream kernels and userspace so far. Some older cores (Loongson-3A1000 and Loongson-3B1500) have ExcCode 16 too, but the semantic is equivalent to GSExcCode 0. Because the respective manuals did not mention the CP0.Diag1 register or its read behavior, these cores are not covered in this patch, as MFC0 from non-existent CP0 registers is UNDEFINED according to the MIPS architecture spec. Reviewed-by: Huacai Chen <chenhc@lemote.com> Signed-off-by: WANG Xuerui <git@xen0n.name> Cc: Huacai Chen <chenhc@lemote.com> Cc: Jiaxun Yang <jiaxun.yang@flygoat.com> Cc: Tiezhu Yang <yangtiezhu@loongson.cn> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> 
Newer Loongson cores (Loongson-3A R2 and newer) use the
implementation-dependent ExcCode 16 to signal Loongson-specific
exceptions. The extended cause is put in the non-standard CP0.Diag1
register which is CP0 Register 22 Select 1, called GSCause in Loongson
manuals. Inside is an exception code bitfield called GSExcCode, only
codes 0 to 6 inclusive are documented (so far, in the Loongson 3A3000
User Manual, Volume 2).

During experiments, it was found that some undocumented unprivileged
instructions can trigger the also-undocumented GSExcCode 8 on Loongson
3A4000. Processor state is not corrupted, but we cannot continue without
further knowledge, and Loongson is not providing that information as of
this writing. So we send SIGILL on seeing this exception code to thwart
easy local DoS attacks.

Other exception codes are made fatal, partly because of insufficient
knowledge, also partly because they are not as easily reproduced. None
of them are encountered in the wild with upstream kernels and userspace
so far.

Some older cores (Loongson-3A1000 and Loongson-3B1500) have ExcCode 16
too, but the semantic is equivalent to GSExcCode 0. Because the
respective manuals did not mention the CP0.Diag1 register or its read
behavior, these cores are not covered in this patch, as MFC0 from
non-existent CP0 registers is UNDEFINED according to the MIPS
architecture spec.

Reviewed-by: Huacai Chen <chenhc@lemote.com>
Signed-off-by: WANG Xuerui <git@xen0n.name>
Cc: Huacai Chen <chenhc@lemote.com>
Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
Cc: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
MIPS: only register FTLBPar exception handler for supported models 2020-07-31T15:52:10+00:00 WANG Xuerui git@xen0n.name 2020-07-29T13:14:15+00:00 efd1b4ad3d5178a74387bc5ff69a2d4585f586c6 Previously ExcCode 16 is unconditionally treated as the FTLB parity exception (FTLBPar), but in fact its semantic is implementation- dependent. Looking at various manuals it seems the FTLBPar exception is only present on some recent MIPS Technologies cores, so only register the handler on these. Fixes: 75b5b5e0a262790f ("MIPS: Add support for FTLBs") Reviewed-by: Huacai Chen <chenhc@lemote.com> Signed-off-by: WANG Xuerui <git@xen0n.name> Cc: Paul Burton <paulburton@kernel.org> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> 
Previously ExcCode 16 is unconditionally treated as the FTLB parity
exception (FTLBPar), but in fact its semantic is implementation-
dependent. Looking at various manuals it seems the FTLBPar exception is
only present on some recent MIPS Technologies cores, so only register
the handler on these.

Fixes: 75b5b5e0a262790f ("MIPS: Add support for FTLBs")
Reviewed-by: Huacai Chen <chenhc@lemote.com>
Signed-off-by: WANG Xuerui <git@xen0n.name>
Cc: Paul Burton <paulburton@kernel.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>