linux.git/arch/mips/kernel/traps.c, branch v6.6

MIPS: fix fortify panic when copying asm exception handlers

2022-03-07T12:09:28+00:00

With KCFLAGS="-O3", I was able to trigger a fortify-source
memcpy() overflow panic on set_vi_srs_handler().
Although O3 level is not supported in the mainline, under some
conditions that may've happened with any optimization settings,
it's just a matter of inlining luck. The panic itself is correct,
more precisely, 50/50 false-positive and not at the same time.
From the one side, no real overflow happens. Exception handler
defined in asm just gets copied to some reserved places in the
memory.
But the reason behind is that C code refers to that exception
handler declares it as `char`, i.e. something of 1 byte length.
It's obvious that the asm function itself is way more than 1 byte,
so fortify logics thought we are going to past the symbol declared.
The standard way to refer to asm symbols from C code which is not
supposed to be called from C is to declare them as
`extern const u8[]`. This is fully correct from any point of view,
as any code itself is just a bunch of bytes (including 0 as it is
for syms like _stext/_etext/etc.), and the exact size is not known
at the moment of compilation.
Adjust the type of the except_vec_vi_*() and related variables.
Make set_handler() take `const` as a second argument to avoid
cast-away warnings and give a little more room for optimization.

Signed-off-by: Alexander Lobakin 
Signed-off-by: Thomas Bogendoerfer

exit: Add and use make_task_dead.

2021-12-13T18:04:45+00:00

There are two big uses of do_exit.  The first is it's design use to be
the guts of the exit(2) system call.  The second use is to terminate
a task after something catastrophic has happened like a NULL pointer
in kernel code.

Add a function make_task_dead that is initialy exactly the same as
do_exit to cover the cases where do_exit is called to handle
catastrophic failure.  In time this can probably be reduced to just a
light wrapper around do_task_dead. For now keep it exactly the same so
that there will be no behavioral differences introducing this new
concept.

Replace all of the uses of do_exit that use it for catastraphic
task cleanup with make_task_dead to make it clear what the code
is doing.

As part of this rename rewind_stack_do_exit
rewind_stack_and_make_dead.

Signed-off-by: "Eric W. Biederman"

MIPS: Allow modules to set board_be_handler

2021-11-09T15:07:26+00:00

After making the brcmstb_gisb driver modular with 707a4cdf86e5 ("bus:
brcmstb_gisb: Allow building as module") Guenter reported that mips
allmodconfig failed to link because board_be_handler was referenced.

Thomas indicated that if we were to continue making the brcmstb_gisb
driver modular for MIPS we would need to introduce a function that
allows setting the board_be_handler and export that function towards
modules.

This is what is being done here: board_be_handler is made static and is
now settable with a mips_set_be_handler() function which is exported.

Reported-by: Guenter Roeck 
Suggested-by: Thomas Bogendoerfer 
Fixes: 707a4cdf86e5 ("bus: brcmstb_gisb: Allow building as module")
Signed-off-by: Florian Fainelli 
Tested-by: Guenter Roeck 
Signed-off-by: Thomas Bogendoerfer

arch/mips/kernel/traps: use vma_lookup() instead of find_vma()

2021-06-29T17:53:51+00:00

Use vma_lookup() to find the VMA at a specific address.  As vma_lookup()
will return NULL if the address is not within any VMA, the start address
no longer needs to be validated.

Link: https://lkml.kernel.org/r/20210521174745.2219620-8-Liam.Howlett@Oracle.com
Signed-off-by: Liam R. Howlett 
Reviewed-by: Laurent Dufour 
Acked-by: David Hildenbrand 
Acked-by: Davidlohr Bueso 
Cc: Geert Uytterhoeven 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

MIPS: uaccess: Remove get_fs/set_fs call sites

2021-04-06T12:36:56+00:00

Use new helpers to access user/kernel for functions, which are used with
user/kernel pointers. Instead of dealing with get_fs/set_fs select
user/kernel access via parameter.

Signed-off-by: Thomas Bogendoerfer 
Reviewed-by: Christoph Hellwig

MIPS: kernel: Reserve exception base early to prevent corruption

2021-03-09T10:22:59+00:00

BMIPS is one of the few platforms that do change the exception base.
After commit 2dcb39645441 ("memblock: do not start bottom-up allocations
with kernel_end") we started seeing BMIPS boards fail to boot with the
built-in FDT being corrupted.

Before the cited commit, early allocations would be in the [kernel_end,
RAM_END] range, but after commit they would be within [RAM_START +
PAGE_SIZE, RAM_END].

The custom exception base handler that is installed by
bmips_ebase_setup() done for BMIPS5000 CPUs ends-up trampling on the
memory region allocated by unflatten_and_copy_device_tree() thus
corrupting the FDT used by the kernel.

To fix this, we need to perform an early reservation of the custom
exception space. Additional we reserve the first 4k (1k for R3k) for
either normal exception vector space (legacy CPUs) or special vectors
like cache exceptions.

Huge thanks to Serge for analysing and proposing a solution to this
issue.

Fixes: 2dcb39645441 ("memblock: do not start bottom-up allocations with kernel_end")
Reported-by: Kamal Dasu 
Debugged-by: Serge Semin 
Acked-by: Mike Rapoport 
Tested-by: Florian Fainelli 
Reviewed-by: Serge Semin 
Signed-off-by: Thomas Bogendoerfer

Merge tag 'mips_5.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux

2020-10-16T19:40:55+00:00

Pull MIPS updates from Thomas Bogendoerfer:

 - removed support for PNX833x alias NXT_STB22x

 - included Ingenic SoC support into generic MIPS kernels

 - added support for new Ingenic SoCs

 - converted workaround selection to use Kconfig

 - replaced old boot mem functions by memblock_*

 - enabled COP2 usage in kernel for Loongson64 to make use
   of 16byte load/stores possible

 - cleanups and fixes

* tag 'mips_5.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (92 commits)
  MIPS: DEC: Restore bootmem reservation for firmware working memory area
  MIPS: dec: fix section mismatch
  bcm963xx_tag.h: fix duplicated word
  mips: ralink: enable zboot support
  MIPS: ingenic: Remove CPU_SUPPORTS_HUGEPAGES
  MIPS: cpu-probe: remove MIPS_CPU_BP_GHIST option bit
  MIPS: cpu-probe: introduce exclusive R3k CPU probe
  MIPS: cpu-probe: move fpu probing/handling into its own file
  MIPS: replace add_memory_region with memblock
  MIPS: Loongson64: Clean up numa.c
  MIPS: Loongson64: Select SMP in Kconfig to avoid build error
  mips: octeon: Add Ubiquiti E200 and E220 boards
  MIPS: SGI-IP28: disable use of ll/sc in kernel
  MIPS: tx49xx: move tx4939_add_memory_regions into only user
  MIPS: pgtable: Remove used PAGE_USERIO define
  MIPS: alchemy: Share prom_init implementation
  MIPS: alchemy: Fix build breakage, if TOUCHSCREEN_WM97XX is disabled
  MIPS: process: include exec.h header in process.c
  MIPS: process: Add prototype for function arch_dup_task_struct
  MIPS: idle: Add prototype for function check_wait
  ...

MIPS: Loongson-3: Enable COP2 usage in kernel

2020-09-21T20:15:03+00:00

Loongson-3's COP2 is Multi-Media coprocessor, it is disabled in kernel
mode by default. However, gslq/gssq (16-bytes load/store instructions)
overrides the instruction format of lwc2/swc2. If we wan't to use gslq/
gssq for optimization in kernel, we should enable COP2 usage in kernel.

Please pay attention that in this patch we only enable COP2 in kernel,
which means it will lose ST0_CU2 when a process go to user space (try
to use COP2 in user space will trigger an exception and then grab COP2,
which is similar to FPU). And as a result, we need to modify the context
switching code because the new scheduled process doesn't contain ST0_CU2
in its THERAD_STATUS probably.

For zboot, we disable gslq/gssq be generated by toolchain.

Signed-off-by: Huacai Chen 
Signed-off-by: Thomas Bogendoerfer

MIPS: add missing MSACSR and upper MSA initialization

2020-09-03T10:00:03+00:00

In cc97ab235f3f ("MIPS: Simplify FP context initialization), init_fp_ctx
just initialize the fp/msa context, and own_fp_inatomic just restore
FCSR and 64bit FP regs from it, but miss MSACSR and upper MSA regs for
MSA, so MSACSR and MSA upper regs's value from previous task on current
cpu can leak into current task and cause unpredictable behavior when MSA
context not initialized.

Fixes: cc97ab235f3f ("MIPS: Simplify FP context initialization")
Signed-off-by: Huang Pei 
Signed-off-by: Thomas Bogendoerfer

Merge tag 'mips_5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux

2020-08-06T17:54:07+00:00

Pull MIPS upates from Thomas Bogendoerfer:

 - improvements for Loongson64

 - extended ingenic support

 - removal of not maintained paravirt system type

 - cleanups and fixes

* tag 'mips_5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (81 commits)
  MIPS: SGI-IP27: always enable NUMA in Kconfig
  MAINTAINERS: Update KVM/MIPS maintainers
  MIPS: Update default config file for Loongson-3
  MIPS: KVM: Add kvm guest support for Loongson-3
  dt-bindings: mips: Document Loongson kvm guest board
  MIPS: handle Loongson-specific GSExc exception
  MIPS: add definitions for Loongson-specific CP0.Diag1 register
  MIPS: only register FTLBPar exception handler for supported models
  MIPS: ingenic: Hardcode mem size for qi,lb60 board
  MIPS: DTS: ingenic/qi,lb60: Add model and memory node
  MIPS: ingenic: Use fw_passed_dtb even if CONFIG_BUILTIN_DTB
  MIPS: head.S: Init fw_passed_dtb to builtin DTB
  of: address: Fix parser address/size cells initialization
  of_address: Guard of_bus_pci_get_flags with CONFIG_PCI
  MIPS: DTS: Fix number of msi vectors for Loongson64G
  MIPS: Loongson64: Add ISA node for LS7A PCH
  MIPS: Loongson64: DTS: Fix ISA and PCI I/O ranges for RS780E PCH
  MIPS: Loongson64: Enlarge IO_SPACE_LIMIT
  MIPS: Loongson64: Process ISA Node in DeviceTree
  of_address: Add bus type match for pci ranges parser
  ...