2005-09-26 14:04:21 +08:00
|
|
|
/*
|
|
|
|
|
* Derived from "arch/i386/kernel/process.c"
|
|
|
|
|
* Copyright (C) 1995 Linus Torvalds
|
|
|
|
|
*
|
|
|
|
|
* Updated and modified by Cort Dougan (cort@cs.nmt.edu) and
|
|
|
|
|
* Paul Mackerras (paulus@cs.anu.edu.au)
|
|
|
|
|
*
|
|
|
|
|
* PowerPC version
|
|
|
|
|
* Copyright (C) 1995-1996 Gary Thomas (gdt@linuxppc.org)
|
|
|
|
|
*
|
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
|
* as published by the Free Software Foundation; either version
|
|
|
|
|
* 2 of the License, or (at your option) any later version.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#include <linux/errno.h>
|
|
|
|
|
#include <linux/sched.h>
|
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
|
#include <linux/mm.h>
|
|
|
|
|
#include <linux/smp.h>
|
|
|
|
|
#include <linux/stddef.h>
|
|
|
|
|
#include <linux/unistd.h>
|
|
|
|
|
#include <linux/ptrace.h>
|
|
|
|
|
#include <linux/slab.h>
|
|
|
|
|
#include <linux/user.h>
|
|
|
|
|
#include <linux/elf.h>
|
|
|
|
|
#include <linux/prctl.h>
|
|
|
|
|
#include <linux/init_task.h>
|
2011-07-23 06:24:23 +08:00
|
|
|
#include <linux/export.h>
|
2005-09-26 14:04:21 +08:00
|
|
|
#include <linux/kallsyms.h>
|
|
|
|
|
#include <linux/mqueue.h>
|
|
|
|
|
#include <linux/hardirq.h>
|
2005-10-10 20:29:05 +08:00
|
|
|
#include <linux/utsname.h>
|
2009-02-10 13:10:27 +08:00
|
|
|
#include <linux/ftrace.h>
|
2008-12-31 22:11:38 +08:00
|
|
|
#include <linux/kernel_stat.h>
|
2009-02-22 09:50:03 +08:00
|
|
|
#include <linux/personality.h>
|
|
|
|
|
#include <linux/random.h>
|
2010-06-15 14:05:19 +08:00
|
|
|
#include <linux/hw_breakpoint.h>
|
2014-10-13 17:27:15 +08:00
|
|
|
#include <linux/uaccess.h>
|
2016-01-06 08:45:51 +08:00
|
|
|
#include <linux/elf-randomize.h>
|
2005-09-26 14:04:21 +08:00
|
|
|
|
|
|
|
|
#include <asm/pgtable.h>
|
|
|
|
|
#include <asm/io.h>
|
|
|
|
|
#include <asm/processor.h>
|
|
|
|
|
#include <asm/mmu.h>
|
|
|
|
|
#include <asm/prom.h>
|
2005-11-07 10:12:03 +08:00
|
|
|
#include <asm/machdep.h>
|
powerpc: Implement accurate task and CPU time accounting
This implements accurate task and cpu time accounting for 64-bit
powerpc kernels. Instead of accounting a whole jiffy of time to a
task on a timer interrupt because that task happened to be running at
the time, we now account time in units of timebase ticks according to
the actual time spent by the task in user mode and kernel mode. We
also count the time spent processing hardware and software interrupts
accurately. This is conditional on CONFIG_VIRT_CPU_ACCOUNTING. If
that is not set, we do tick-based approximate accounting as before.
To get this accurate information, we read either the PURR (processor
utilization of resources register) on POWER5 machines, or the timebase
on other machines on
* each entry to the kernel from usermode
* each exit to usermode
* transitions between process context, hard irq context and soft irq
context in kernel mode
* context switches.
On POWER5 systems with shared-processor logical partitioning we also
read both the PURR and the timebase at each timer interrupt and
context switch in order to determine how much time has been taken by
the hypervisor to run other partitions ("steal" time). Unfortunately,
since we need values of the PURR on both threads at the same time to
accurately calculate the steal time, and since we can only calculate
steal time on a per-core basis, the apportioning of the steal time
between idle time (time which we ceded to the hypervisor in the idle
loop) and actual stolen time is somewhat approximate at the moment.
This is all based quite heavily on what s390 does, and it uses the
generic interfaces that were added by the s390 developers,
i.e. account_system_time(), account_user_time(), etc.
This patch doesn't add any new interfaces between the kernel and
userspace, and doesn't change the units in which time is reported to
userspace by things such as /proc/stat, /proc/<pid>/stat, getrusage(),
times(), etc. Internally the various task and cpu times are stored in
timebase units, but they are converted to USER_HZ units (1/100th of a
second) when reported to userspace. Some precision is therefore lost
but there should not be any accumulating error, since the internal
accumulation is at full precision.
Signed-off-by: Paul Mackerras <paulus@samba.org>
2006-02-24 07:06:59 +08:00
|
|
|
#include <asm/time.h>
|
2012-03-29 01:30:02 +08:00
|
|
|
#include <asm/runlatch.h>
|
2006-03-23 07:00:08 +08:00
|
|
|
#include <asm/syscalls.h>
|
2012-03-29 01:30:02 +08:00
|
|
|
#include <asm/switch_to.h>
|
2013-02-14 00:21:37 +08:00
|
|
|
#include <asm/tm.h>
|
2012-03-29 01:30:02 +08:00
|
|
|
#include <asm/debug.h>
|
2005-10-10 20:29:05 +08:00
|
|
|
#ifdef CONFIG_PPC64
|
|
|
|
|
#include <asm/firmware.h>
|
|
|
|
|
#endif
|
2014-02-04 13:08:51 +08:00
|
|
|
#include <asm/code-patching.h>
|
2016-01-06 08:45:51 +08:00
|
|
|
#include <asm/exec.h>
|
2016-03-24 19:04:04 +08:00
|
|
|
#include <asm/livepatch.h>
|
2016-07-23 17:12:40 +08:00
|
|
|
#include <asm/cpu_has_feature.h>
|
2016-09-06 13:32:43 +08:00
|
|
|
#include <asm/asm-prototypes.h>
|
2016-03-24 19:04:04 +08:00
|
|
|
|
2008-07-24 00:10:41 +08:00
|
|
|
#include <linux/kprobes.h>
|
|
|
|
|
#include <linux/kdebug.h>
|
2005-09-26 14:04:21 +08:00
|
|
|
|
2013-02-14 00:21:32 +08:00
|
|
|
/* Transactional Memory debug */
|
|
|
|
|
#ifdef TM_DEBUG_SW
|
|
|
|
|
#define TM_DEBUG(x...) printk(KERN_INFO x)
|
|
|
|
|
#else
|
|
|
|
|
#define TM_DEBUG(x...) do { } while(0)
|
|
|
|
|
#endif
|
|
|
|
|
|
2005-09-26 14:04:21 +08:00
|
|
|
extern unsigned long _get_SP(void);
|
|
|
|
|
|
powerpc: Don't corrupt transactional state when using FP/VMX in kernel
Currently, when we have a process using the transactional memory
facilities on POWER8 (that is, the processor is in transactional
or suspended state), and the process enters the kernel and the
kernel then uses the floating-point or vector (VMX/Altivec) facility,
we end up corrupting the user-visible FP/VMX/VSX state. This
happens, for example, if a page fault causes a copy-on-write
operation, because the copy_page function will use VMX to do the
copy on POWER8. The test program below demonstrates the bug.
The bug happens because when FP/VMX state for a transactional process
is stored in the thread_struct, we store the checkpointed state in
.fp_state/.vr_state and the transactional (current) state in
.transact_fp/.transact_vr. However, when the kernel wants to use
FP/VMX, it calls enable_kernel_fp() or enable_kernel_altivec(),
which saves the current state in .fp_state/.vr_state. Furthermore,
when we return to the user process we return with FP/VMX/VSX
disabled. The next time the process uses FP/VMX/VSX, we don't know
which set of state (the current register values, .fp_state/.vr_state,
or .transact_fp/.transact_vr) we should be using, since we have no
way to tell if we are still in the same transaction, and if not,
whether the previous transaction succeeded or failed.
Thus it is necessary to strictly adhere to the rule that if FP has
been enabled at any point in a transaction, we must keep FP enabled
for the user process with the current transactional state in the
FP registers, until we detect that it is no longer in a transaction.
Similarly for VMX; once enabled it must stay enabled until the
process is no longer transactional.
In order to keep this rule, we add a new thread_info flag which we
test when returning from the kernel to userspace, called TIF_RESTORE_TM.
This flag indicates that there is FP/VMX/VSX state to be restored
before entering userspace, and when it is set the .tm_orig_msr field
in the thread_struct indicates what state needs to be restored.
The restoration is done by restore_tm_state(). The TIF_RESTORE_TM
bit is set by new giveup_fpu/altivec_maybe_transactional helpers,
which are called from enable_kernel_fp/altivec, giveup_vsx, and
flush_fp/altivec_to_thread instead of giveup_fpu/altivec.
The other thing to be done is to get the transactional FP/VMX/VSX
state from .fp_state/.vr_state when doing reclaim, if that state
has been saved there by giveup_fpu/altivec_maybe_transactional.
Having done this, we set the FP/VMX bit in the thread's MSR after
reclaim to indicate that that part of the state is now valid
(having been reclaimed from the processor's checkpointed state).
Finally, in the signal handling code, we move the clearing of the
transactional state bits in the thread's MSR a bit earlier, before
calling flush_fp_to_thread(), so that we don't unnecessarily set
the TIF_RESTORE_TM bit.
This is the test program:
/* Michael Neuling 4/12/2013
*
* See if the altivec state is leaked out of an aborted transaction due to
* kernel vmx copy loops.
*
* gcc -m64 htm_vmxcopy.c -o htm_vmxcopy
*
*/
/* We don't use all of these, but for reference: */
int main(int argc, char *argv[])
{
long double vecin = 1.3;
long double vecout;
unsigned long pgsize = getpagesize();
int i;
int fd;
int size = pgsize*16;
char tmpfile[] = "/tmp/page_faultXXXXXX";
char buf[pgsize];
char *a;
uint64_t aborted = 0;
fd = mkstemp(tmpfile);
assert(fd >= 0);
memset(buf, 0, pgsize);
for (i = 0; i < size; i += pgsize)
assert(write(fd, buf, pgsize) == pgsize);
unlink(tmpfile);
a = mmap(NULL, size, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd, 0);
assert(a != MAP_FAILED);
asm __volatile__(
"lxvd2x 40,0,%[vecinptr] ; " // set 40 to initial value
TBEGIN
"beq 3f ;"
TSUSPEND
"xxlxor 40,40,40 ; " // set 40 to 0
"std 5, 0(%[map]) ;" // cause kernel vmx copy page
TABORT
TRESUME
TEND
"li %[res], 0 ;"
"b 5f ;"
"3: ;" // Abort handler
"li %[res], 1 ;"
"5: ;"
"stxvd2x 40,0,%[vecoutptr] ; "
: [res]"=r"(aborted)
: [vecinptr]"r"(&vecin),
[vecoutptr]"r"(&vecout),
[map]"r"(a)
: "memory", "r0", "r3", "r4", "r5", "r6", "r7");
if (aborted && (vecin != vecout)){
printf("FAILED: vector state leaked on abort %f != %f\n",
(double)vecin, (double)vecout);
exit(1);
}
munmap(a, size);
close(fd);
printf("PASSED!\n");
return 0;
}
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2014-01-13 12:56:29 +08:00
|
|
|
#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
|
2015-10-29 08:43:58 +08:00
|
|
|
static void check_if_tm_restore_required(struct task_struct *tsk)
|
powerpc: Don't corrupt transactional state when using FP/VMX in kernel
Currently, when we have a process using the transactional memory
facilities on POWER8 (that is, the processor is in transactional
or suspended state), and the process enters the kernel and the
kernel then uses the floating-point or vector (VMX/Altivec) facility,
we end up corrupting the user-visible FP/VMX/VSX state. This
happens, for example, if a page fault causes a copy-on-write
operation, because the copy_page function will use VMX to do the
copy on POWER8. The test program below demonstrates the bug.
The bug happens because when FP/VMX state for a transactional process
is stored in the thread_struct, we store the checkpointed state in
.fp_state/.vr_state and the transactional (current) state in
.transact_fp/.transact_vr. However, when the kernel wants to use
FP/VMX, it calls enable_kernel_fp() or enable_kernel_altivec(),
which saves the current state in .fp_state/.vr_state. Furthermore,
when we return to the user process we return with FP/VMX/VSX
disabled. The next time the process uses FP/VMX/VSX, we don't know
which set of state (the current register values, .fp_state/.vr_state,
or .transact_fp/.transact_vr) we should be using, since we have no
way to tell if we are still in the same transaction, and if not,
whether the previous transaction succeeded or failed.
Thus it is necessary to strictly adhere to the rule that if FP has
been enabled at any point in a transaction, we must keep FP enabled
for the user process with the current transactional state in the
FP registers, until we detect that it is no longer in a transaction.
Similarly for VMX; once enabled it must stay enabled until the
process is no longer transactional.
In order to keep this rule, we add a new thread_info flag which we
test when returning from the kernel to userspace, called TIF_RESTORE_TM.
This flag indicates that there is FP/VMX/VSX state to be restored
before entering userspace, and when it is set the .tm_orig_msr field
in the thread_struct indicates what state needs to be restored.
The restoration is done by restore_tm_state(). The TIF_RESTORE_TM
bit is set by new giveup_fpu/altivec_maybe_transactional helpers,
which are called from enable_kernel_fp/altivec, giveup_vsx, and
flush_fp/altivec_to_thread instead of giveup_fpu/altivec.
The other thing to be done is to get the transactional FP/VMX/VSX
state from .fp_state/.vr_state when doing reclaim, if that state
has been saved there by giveup_fpu/altivec_maybe_transactional.
Having done this, we set the FP/VMX bit in the thread's MSR after
reclaim to indicate that that part of the state is now valid
(having been reclaimed from the processor's checkpointed state).
Finally, in the signal handling code, we move the clearing of the
transactional state bits in the thread's MSR a bit earlier, before
calling flush_fp_to_thread(), so that we don't unnecessarily set
the TIF_RESTORE_TM bit.
This is the test program:
/* Michael Neuling 4/12/2013
*
* See if the altivec state is leaked out of an aborted transaction due to
* kernel vmx copy loops.
*
* gcc -m64 htm_vmxcopy.c -o htm_vmxcopy
*
*/
/* We don't use all of these, but for reference: */
int main(int argc, char *argv[])
{
long double vecin = 1.3;
long double vecout;
unsigned long pgsize = getpagesize();
int i;
int fd;
int size = pgsize*16;
char tmpfile[] = "/tmp/page_faultXXXXXX";
char buf[pgsize];
char *a;
uint64_t aborted = 0;
fd = mkstemp(tmpfile);
assert(fd >= 0);
memset(buf, 0, pgsize);
for (i = 0; i < size; i += pgsize)
assert(write(fd, buf, pgsize) == pgsize);
unlink(tmpfile);
a = mmap(NULL, size, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd, 0);
assert(a != MAP_FAILED);
asm __volatile__(
"lxvd2x 40,0,%[vecinptr] ; " // set 40 to initial value
TBEGIN
"beq 3f ;"
TSUSPEND
"xxlxor 40,40,40 ; " // set 40 to 0
"std 5, 0(%[map]) ;" // cause kernel vmx copy page
TABORT
TRESUME
TEND
"li %[res], 0 ;"
"b 5f ;"
"3: ;" // Abort handler
"li %[res], 1 ;"
"5: ;"
"stxvd2x 40,0,%[vecoutptr] ; "
: [res]"=r"(aborted)
: [vecinptr]"r"(&vecin),
[vecoutptr]"r"(&vecout),
[map]"r"(a)
: "memory", "r0", "r3", "r4", "r5", "r6", "r7");
if (aborted && (vecin != vecout)){
printf("FAILED: vector state leaked on abort %f != %f\n",
(double)vecin, (double)vecout);
exit(1);
}
munmap(a, size);
close(fd);
printf("PASSED!\n");
return 0;
}
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2014-01-13 12:56:29 +08:00
|
|
|
{
|
|
|
|
|
/*
|
|
|
|
|
* If we are saving the current thread's registers, and the
|
|
|
|
|
* thread is in a transactional state, set the TIF_RESTORE_TM
|
|
|
|
|
* bit so that we know to restore the registers before
|
|
|
|
|
* returning to userspace.
|
|
|
|
|
*/
|
|
|
|
|
if (tsk == current && tsk->thread.regs &&
|
|
|
|
|
MSR_TM_ACTIVE(tsk->thread.regs->msr) &&
|
|
|
|
|
!test_thread_flag(TIF_RESTORE_TM)) {
|
2015-07-06 18:54:10 +08:00
|
|
|
tsk->thread.ckpt_regs.msr = tsk->thread.regs->msr;
|
powerpc: Don't corrupt transactional state when using FP/VMX in kernel
Currently, when we have a process using the transactional memory
facilities on POWER8 (that is, the processor is in transactional
or suspended state), and the process enters the kernel and the
kernel then uses the floating-point or vector (VMX/Altivec) facility,
we end up corrupting the user-visible FP/VMX/VSX state. This
happens, for example, if a page fault causes a copy-on-write
operation, because the copy_page function will use VMX to do the
copy on POWER8. The test program below demonstrates the bug.
The bug happens because when FP/VMX state for a transactional process
is stored in the thread_struct, we store the checkpointed state in
.fp_state/.vr_state and the transactional (current) state in
.transact_fp/.transact_vr. However, when the kernel wants to use
FP/VMX, it calls enable_kernel_fp() or enable_kernel_altivec(),
which saves the current state in .fp_state/.vr_state. Furthermore,
when we return to the user process we return with FP/VMX/VSX
disabled. The next time the process uses FP/VMX/VSX, we don't know
which set of state (the current register values, .fp_state/.vr_state,
or .transact_fp/.transact_vr) we should be using, since we have no
way to tell if we are still in the same transaction, and if not,
whether the previous transaction succeeded or failed.
Thus it is necessary to strictly adhere to the rule that if FP has
been enabled at any point in a transaction, we must keep FP enabled
for the user process with the current transactional state in the
FP registers, until we detect that it is no longer in a transaction.
Similarly for VMX; once enabled it must stay enabled until the
process is no longer transactional.
In order to keep this rule, we add a new thread_info flag which we
test when returning from the kernel to userspace, called TIF_RESTORE_TM.
This flag indicates that there is FP/VMX/VSX state to be restored
before entering userspace, and when it is set the .tm_orig_msr field
in the thread_struct indicates what state needs to be restored.
The restoration is done by restore_tm_state(). The TIF_RESTORE_TM
bit is set by new giveup_fpu/altivec_maybe_transactional helpers,
which are called from enable_kernel_fp/altivec, giveup_vsx, and
flush_fp/altivec_to_thread instead of giveup_fpu/altivec.
The other thing to be done is to get the transactional FP/VMX/VSX
state from .fp_state/.vr_state when doing reclaim, if that state
has been saved there by giveup_fpu/altivec_maybe_transactional.
Having done this, we set the FP/VMX bit in the thread's MSR after
reclaim to indicate that that part of the state is now valid
(having been reclaimed from the processor's checkpointed state).
Finally, in the signal handling code, we move the clearing of the
transactional state bits in the thread's MSR a bit earlier, before
calling flush_fp_to_thread(), so that we don't unnecessarily set
the TIF_RESTORE_TM bit.
This is the test program:
/* Michael Neuling 4/12/2013
*
* See if the altivec state is leaked out of an aborted transaction due to
* kernel vmx copy loops.
*
* gcc -m64 htm_vmxcopy.c -o htm_vmxcopy
*
*/
/* We don't use all of these, but for reference: */
int main(int argc, char *argv[])
{
long double vecin = 1.3;
long double vecout;
unsigned long pgsize = getpagesize();
int i;
int fd;
int size = pgsize*16;
char tmpfile[] = "/tmp/page_faultXXXXXX";
char buf[pgsize];
char *a;
uint64_t aborted = 0;
fd = mkstemp(tmpfile);
assert(fd >= 0);
memset(buf, 0, pgsize);
for (i = 0; i < size; i += pgsize)
assert(write(fd, buf, pgsize) == pgsize);
unlink(tmpfile);
a = mmap(NULL, size, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd, 0);
assert(a != MAP_FAILED);
asm __volatile__(
"lxvd2x 40,0,%[vecinptr] ; " // set 40 to initial value
TBEGIN
"beq 3f ;"
TSUSPEND
"xxlxor 40,40,40 ; " // set 40 to 0
"std 5, 0(%[map]) ;" // cause kernel vmx copy page
TABORT
TRESUME
TEND
"li %[res], 0 ;"
"b 5f ;"
"3: ;" // Abort handler
"li %[res], 1 ;"
"5: ;"
"stxvd2x 40,0,%[vecoutptr] ; "
: [res]"=r"(aborted)
: [vecinptr]"r"(&vecin),
[vecoutptr]"r"(&vecout),
[map]"r"(a)
: "memory", "r0", "r3", "r4", "r5", "r6", "r7");
if (aborted && (vecin != vecout)){
printf("FAILED: vector state leaked on abort %f != %f\n",
(double)vecin, (double)vecout);
exit(1);
}
munmap(a, size);
close(fd);
printf("PASSED!\n");
return 0;
}
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2014-01-13 12:56:29 +08:00
|
|
|
set_thread_flag(TIF_RESTORE_TM);
|
|
|
|
|
}
|
|
|
|
|
}
|
2016-09-23 14:18:08 +08:00
|
|
|
|
|
|
|
|
static inline bool msr_tm_active(unsigned long msr)
|
|
|
|
|
{
|
|
|
|
|
return MSR_TM_ACTIVE(msr);
|
|
|
|
|
}
|
powerpc: Don't corrupt transactional state when using FP/VMX in kernel
Currently, when we have a process using the transactional memory
facilities on POWER8 (that is, the processor is in transactional
or suspended state), and the process enters the kernel and the
kernel then uses the floating-point or vector (VMX/Altivec) facility,
we end up corrupting the user-visible FP/VMX/VSX state. This
happens, for example, if a page fault causes a copy-on-write
operation, because the copy_page function will use VMX to do the
copy on POWER8. The test program below demonstrates the bug.
The bug happens because when FP/VMX state for a transactional process
is stored in the thread_struct, we store the checkpointed state in
.fp_state/.vr_state and the transactional (current) state in
.transact_fp/.transact_vr. However, when the kernel wants to use
FP/VMX, it calls enable_kernel_fp() or enable_kernel_altivec(),
which saves the current state in .fp_state/.vr_state. Furthermore,
when we return to the user process we return with FP/VMX/VSX
disabled. The next time the process uses FP/VMX/VSX, we don't know
which set of state (the current register values, .fp_state/.vr_state,
or .transact_fp/.transact_vr) we should be using, since we have no
way to tell if we are still in the same transaction, and if not,
whether the previous transaction succeeded or failed.
Thus it is necessary to strictly adhere to the rule that if FP has
been enabled at any point in a transaction, we must keep FP enabled
for the user process with the current transactional state in the
FP registers, until we detect that it is no longer in a transaction.
Similarly for VMX; once enabled it must stay enabled until the
process is no longer transactional.
In order to keep this rule, we add a new thread_info flag which we
test when returning from the kernel to userspace, called TIF_RESTORE_TM.
This flag indicates that there is FP/VMX/VSX state to be restored
before entering userspace, and when it is set the .tm_orig_msr field
in the thread_struct indicates what state needs to be restored.
The restoration is done by restore_tm_state(). The TIF_RESTORE_TM
bit is set by new giveup_fpu/altivec_maybe_transactional helpers,
which are called from enable_kernel_fp/altivec, giveup_vsx, and
flush_fp/altivec_to_thread instead of giveup_fpu/altivec.
The other thing to be done is to get the transactional FP/VMX/VSX
state from .fp_state/.vr_state when doing reclaim, if that state
has been saved there by giveup_fpu/altivec_maybe_transactional.
Having done this, we set the FP/VMX bit in the thread's MSR after
reclaim to indicate that that part of the state is now valid
(having been reclaimed from the processor's checkpointed state).
Finally, in the signal handling code, we move the clearing of the
transactional state bits in the thread's MSR a bit earlier, before
calling flush_fp_to_thread(), so that we don't unnecessarily set
the TIF_RESTORE_TM bit.
This is the test program:
/* Michael Neuling 4/12/2013
*
* See if the altivec state is leaked out of an aborted transaction due to
* kernel vmx copy loops.
*
* gcc -m64 htm_vmxcopy.c -o htm_vmxcopy
*
*/
/* We don't use all of these, but for reference: */
int main(int argc, char *argv[])
{
long double vecin = 1.3;
long double vecout;
unsigned long pgsize = getpagesize();
int i;
int fd;
int size = pgsize*16;
char tmpfile[] = "/tmp/page_faultXXXXXX";
char buf[pgsize];
char *a;
uint64_t aborted = 0;
fd = mkstemp(tmpfile);
assert(fd >= 0);
memset(buf, 0, pgsize);
for (i = 0; i < size; i += pgsize)
assert(write(fd, buf, pgsize) == pgsize);
unlink(tmpfile);
a = mmap(NULL, size, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd, 0);
assert(a != MAP_FAILED);
asm __volatile__(
"lxvd2x 40,0,%[vecinptr] ; " // set 40 to initial value
TBEGIN
"beq 3f ;"
TSUSPEND
"xxlxor 40,40,40 ; " // set 40 to 0
"std 5, 0(%[map]) ;" // cause kernel vmx copy page
TABORT
TRESUME
TEND
"li %[res], 0 ;"
"b 5f ;"
"3: ;" // Abort handler
"li %[res], 1 ;"
"5: ;"
"stxvd2x 40,0,%[vecoutptr] ; "
: [res]"=r"(aborted)
: [vecinptr]"r"(&vecin),
[vecoutptr]"r"(&vecout),
[map]"r"(a)
: "memory", "r0", "r3", "r4", "r5", "r6", "r7");
if (aborted && (vecin != vecout)){
printf("FAILED: vector state leaked on abort %f != %f\n",
(double)vecin, (double)vecout);
exit(1);
}
munmap(a, size);
close(fd);
printf("PASSED!\n");
return 0;
}
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2014-01-13 12:56:29 +08:00
|
|
|
#else
|
2016-09-23 14:18:08 +08:00
|
|
|
static inline bool msr_tm_active(unsigned long msr) { return false; }
|
2015-10-29 08:43:58 +08:00
|
|
|
static inline void check_if_tm_restore_required(struct task_struct *tsk) { }
|
powerpc: Don't corrupt transactional state when using FP/VMX in kernel
Currently, when we have a process using the transactional memory
facilities on POWER8 (that is, the processor is in transactional
or suspended state), and the process enters the kernel and the
kernel then uses the floating-point or vector (VMX/Altivec) facility,
we end up corrupting the user-visible FP/VMX/VSX state. This
happens, for example, if a page fault causes a copy-on-write
operation, because the copy_page function will use VMX to do the
copy on POWER8. The test program below demonstrates the bug.
The bug happens because when FP/VMX state for a transactional process
is stored in the thread_struct, we store the checkpointed state in
.fp_state/.vr_state and the transactional (current) state in
.transact_fp/.transact_vr. However, when the kernel wants to use
FP/VMX, it calls enable_kernel_fp() or enable_kernel_altivec(),
which saves the current state in .fp_state/.vr_state. Furthermore,
when we return to the user process we return with FP/VMX/VSX
disabled. The next time the process uses FP/VMX/VSX, we don't know
which set of state (the current register values, .fp_state/.vr_state,
or .transact_fp/.transact_vr) we should be using, since we have no
way to tell if we are still in the same transaction, and if not,
whether the previous transaction succeeded or failed.
Thus it is necessary to strictly adhere to the rule that if FP has
been enabled at any point in a transaction, we must keep FP enabled
for the user process with the current transactional state in the
FP registers, until we detect that it is no longer in a transaction.
Similarly for VMX; once enabled it must stay enabled until the
process is no longer transactional.
In order to keep this rule, we add a new thread_info flag which we
test when returning from the kernel to userspace, called TIF_RESTORE_TM.
This flag indicates that there is FP/VMX/VSX state to be restored
before entering userspace, and when it is set the .tm_orig_msr field
in the thread_struct indicates what state needs to be restored.
The restoration is done by restore_tm_state(). The TIF_RESTORE_TM
bit is set by new giveup_fpu/altivec_maybe_transactional helpers,
which are called from enable_kernel_fp/altivec, giveup_vsx, and
flush_fp/altivec_to_thread instead of giveup_fpu/altivec.
The other thing to be done is to get the transactional FP/VMX/VSX
state from .fp_state/.vr_state when doing reclaim, if that state
has been saved there by giveup_fpu/altivec_maybe_transactional.
Having done this, we set the FP/VMX bit in the thread's MSR after
reclaim to indicate that that part of the state is now valid
(having been reclaimed from the processor's checkpointed state).
Finally, in the signal handling code, we move the clearing of the
transactional state bits in the thread's MSR a bit earlier, before
calling flush_fp_to_thread(), so that we don't unnecessarily set
the TIF_RESTORE_TM bit.
This is the test program:
/* Michael Neuling 4/12/2013
*
* See if the altivec state is leaked out of an aborted transaction due to
* kernel vmx copy loops.
*
* gcc -m64 htm_vmxcopy.c -o htm_vmxcopy
*
*/
/* We don't use all of these, but for reference: */
int main(int argc, char *argv[])
{
long double vecin = 1.3;
long double vecout;
unsigned long pgsize = getpagesize();
int i;
int fd;
int size = pgsize*16;
char tmpfile[] = "/tmp/page_faultXXXXXX";
char buf[pgsize];
char *a;
uint64_t aborted = 0;
fd = mkstemp(tmpfile);
assert(fd >= 0);
memset(buf, 0, pgsize);
for (i = 0; i < size; i += pgsize)
assert(write(fd, buf, pgsize) == pgsize);
unlink(tmpfile);
a = mmap(NULL, size, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd, 0);
assert(a != MAP_FAILED);
asm __volatile__(
"lxvd2x 40,0,%[vecinptr] ; " // set 40 to initial value
TBEGIN
"beq 3f ;"
TSUSPEND
"xxlxor 40,40,40 ; " // set 40 to 0
"std 5, 0(%[map]) ;" // cause kernel vmx copy page
TABORT
TRESUME
TEND
"li %[res], 0 ;"
"b 5f ;"
"3: ;" // Abort handler
"li %[res], 1 ;"
"5: ;"
"stxvd2x 40,0,%[vecoutptr] ; "
: [res]"=r"(aborted)
: [vecinptr]"r"(&vecin),
[vecoutptr]"r"(&vecout),
[map]"r"(a)
: "memory", "r0", "r3", "r4", "r5", "r6", "r7");
if (aborted && (vecin != vecout)){
printf("FAILED: vector state leaked on abort %f != %f\n",
(double)vecin, (double)vecout);
exit(1);
}
munmap(a, size);
close(fd);
printf("PASSED!\n");
return 0;
}
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2014-01-13 12:56:29 +08:00
|
|
|
#endif /* CONFIG_PPC_TRANSACTIONAL_MEM */
|
|
|
|
|
|
2015-10-29 08:44:06 +08:00
|
|
|
bool strict_msr_control;
|
|
|
|
|
EXPORT_SYMBOL(strict_msr_control);
|
|
|
|
|
|
|
|
|
|
static int __init enable_strict_msr_control(char *str)
|
|
|
|
|
{
|
|
|
|
|
strict_msr_control = true;
|
|
|
|
|
pr_info("Enabling strict facility control\n");
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
early_param("ppc_strict_facility_enable", enable_strict_msr_control);
|
|
|
|
|
|
2016-09-23 14:18:10 +08:00
|
|
|
unsigned long msr_check_and_set(unsigned long bits)
|
2015-10-29 08:44:01 +08:00
|
|
|
{
|
2015-10-29 08:44:04 +08:00
|
|
|
unsigned long oldmsr = mfmsr();
|
|
|
|
|
unsigned long newmsr;
|
2015-10-29 08:44:01 +08:00
|
|
|
|
2015-10-29 08:44:04 +08:00
|
|
|
newmsr = oldmsr | bits;
|
2015-10-29 08:44:01 +08:00
|
|
|
|
|
|
|
|
#ifdef CONFIG_VSX
|
2015-10-29 08:44:04 +08:00
|
|
|
if (cpu_has_feature(CPU_FTR_VSX) && (bits & MSR_FP))
|
2015-10-29 08:44:01 +08:00
|
|
|
newmsr |= MSR_VSX;
|
|
|
|
|
#endif
|
2015-10-29 08:44:04 +08:00
|
|
|
|
2015-10-29 08:44:01 +08:00
|
|
|
if (oldmsr != newmsr)
|
|
|
|
|
mtmsr_isync(newmsr);
|
2016-09-23 14:18:10 +08:00
|
|
|
|
|
|
|
|
return newmsr;
|
2015-10-29 08:44:04 +08:00
|
|
|
}
|
2015-10-29 08:44:01 +08:00
|
|
|
|
2015-10-29 08:44:06 +08:00
|
|
|
void __msr_check_and_clear(unsigned long bits)
|
2015-10-29 08:44:04 +08:00
|
|
|
{
|
|
|
|
|
unsigned long oldmsr = mfmsr();
|
|
|
|
|
unsigned long newmsr;
|
|
|
|
|
|
|
|
|
|
newmsr = oldmsr & ~bits;
|
|
|
|
|
|
|
|
|
|
#ifdef CONFIG_VSX
|
|
|
|
|
if (cpu_has_feature(CPU_FTR_VSX) && (bits & MSR_FP))
|
|
|
|
|
newmsr &= ~MSR_VSX;
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
if (oldmsr != newmsr)
|
|
|
|
|
mtmsr_isync(newmsr);
|
|
|
|
|
}
|
2015-10-29 08:44:06 +08:00
|
|
|
EXPORT_SYMBOL(__msr_check_and_clear);
|
2015-10-29 08:44:04 +08:00
|
|
|
|
|
|
|
|
#ifdef CONFIG_PPC_FPU
|
2016-02-29 14:53:49 +08:00
|
|
|
void __giveup_fpu(struct task_struct *tsk)
|
|
|
|
|
{
|
powerpc: Avoid load hit store in __giveup_fpu() and __giveup_altivec()
In both __giveup_fpu() and __giveup_altivec() we make two modifications
to tsk->thread.regs->msr. gcc decides to do a read/modify/write of
each change, so we end up with a load hit store:
ld r9,264(r10)
rldicl r9,r9,50,1
rotldi r9,r9,14
std r9,264(r10)
...
ld r9,264(r10)
rldicl r9,r9,40,1
rotldi r9,r9,24
std r9,264(r10)
Fix this by using a temporary.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2016-05-29 20:03:50 +08:00
|
|
|
unsigned long msr;
|
|
|
|
|
|
2016-02-29 14:53:49 +08:00
|
|
|
save_fpu(tsk);
|
powerpc: Avoid load hit store in __giveup_fpu() and __giveup_altivec()
In both __giveup_fpu() and __giveup_altivec() we make two modifications
to tsk->thread.regs->msr. gcc decides to do a read/modify/write of
each change, so we end up with a load hit store:
ld r9,264(r10)
rldicl r9,r9,50,1
rotldi r9,r9,14
std r9,264(r10)
...
ld r9,264(r10)
rldicl r9,r9,40,1
rotldi r9,r9,24
std r9,264(r10)
Fix this by using a temporary.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2016-05-29 20:03:50 +08:00
|
|
|
msr = tsk->thread.regs->msr;
|
|
|
|
|
msr &= ~MSR_FP;
|
2016-02-29 14:53:49 +08:00
|
|
|
#ifdef CONFIG_VSX
|
|
|
|
|
if (cpu_has_feature(CPU_FTR_VSX))
|
powerpc: Avoid load hit store in __giveup_fpu() and __giveup_altivec()
In both __giveup_fpu() and __giveup_altivec() we make two modifications
to tsk->thread.regs->msr. gcc decides to do a read/modify/write of
each change, so we end up with a load hit store:
ld r9,264(r10)
rldicl r9,r9,50,1
rotldi r9,r9,14
std r9,264(r10)
...
ld r9,264(r10)
rldicl r9,r9,40,1
rotldi r9,r9,24
std r9,264(r10)
Fix this by using a temporary.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2016-05-29 20:03:50 +08:00
|
|
|
msr &= ~MSR_VSX;
|
2016-02-29 14:53:49 +08:00
|
|
|
#endif
|
powerpc: Avoid load hit store in __giveup_fpu() and __giveup_altivec()
In both __giveup_fpu() and __giveup_altivec() we make two modifications
to tsk->thread.regs->msr. gcc decides to do a read/modify/write of
each change, so we end up with a load hit store:
ld r9,264(r10)
rldicl r9,r9,50,1
rotldi r9,r9,14
std r9,264(r10)
...
ld r9,264(r10)
rldicl r9,r9,40,1
rotldi r9,r9,24
std r9,264(r10)
Fix this by using a temporary.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2016-05-29 20:03:50 +08:00
|
|
|
tsk->thread.regs->msr = msr;
|
2016-02-29 14:53:49 +08:00
|
|
|
}
|
|
|
|
|
|
2015-10-29 08:44:04 +08:00
|
|
|
void giveup_fpu(struct task_struct *tsk)
|
|
|
|
|
{
|
|
|
|
|
check_if_tm_restore_required(tsk);
|
|
|
|
|
|
|
|
|
|
msr_check_and_set(MSR_FP);
|
2015-10-29 08:44:01 +08:00
|
|
|
__giveup_fpu(tsk);
|
2015-10-29 08:44:04 +08:00
|
|
|
msr_check_and_clear(MSR_FP);
|
2015-10-29 08:44:01 +08:00
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL(giveup_fpu);
|
|
|
|
|
|
2005-09-26 14:04:21 +08:00
|
|
|
/*
|
|
|
|
|
* Make sure the floating-point register state in the
|
|
|
|
|
* the thread_struct is up to date for task tsk.
|
|
|
|
|
*/
|
|
|
|
|
void flush_fp_to_thread(struct task_struct *tsk)
|
|
|
|
|
{
|
|
|
|
|
if (tsk->thread.regs) {
|
|
|
|
|
/*
|
|
|
|
|
* We need to disable preemption here because if we didn't,
|
|
|
|
|
* another process could get scheduled after the regs->msr
|
|
|
|
|
* test but before we have finished saving the FP registers
|
|
|
|
|
* to the thread_struct. That process could take over the
|
|
|
|
|
* FPU, and then when we get scheduled again we would store
|
|
|
|
|
* bogus values for the remaining FP registers.
|
|
|
|
|
*/
|
|
|
|
|
preempt_disable();
|
|
|
|
|
if (tsk->thread.regs->msr & MSR_FP) {
|
|
|
|
|
/*
|
|
|
|
|
* This should only ever be called for current or
|
|
|
|
|
* for a stopped child process. Since we save away
|
2015-10-29 08:43:57 +08:00
|
|
|
* the FP register state on context switch,
|
2005-09-26 14:04:21 +08:00
|
|
|
* there is something wrong if a stopped child appears
|
|
|
|
|
* to still have its FP state in the CPU registers.
|
|
|
|
|
*/
|
|
|
|
|
BUG_ON(tsk != current);
|
2015-10-29 08:43:58 +08:00
|
|
|
giveup_fpu(tsk);
|
2005-09-26 14:04:21 +08:00
|
|
|
}
|
|
|
|
|
preempt_enable();
|
|
|
|
|
}
|
|
|
|
|
}
|
KVM: PPC: Add support for Book3S processors in hypervisor mode
This adds support for KVM running on 64-bit Book 3S processors,
specifically POWER7, in hypervisor mode. Using hypervisor mode means
that the guest can use the processor's supervisor mode. That means
that the guest can execute privileged instructions and access privileged
registers itself without trapping to the host. This gives excellent
performance, but does mean that KVM cannot emulate a processor
architecture other than the one that the hardware implements.
This code assumes that the guest is running paravirtualized using the
PAPR (Power Architecture Platform Requirements) interface, which is the
interface that IBM's PowerVM hypervisor uses. That means that existing
Linux distributions that run on IBM pSeries machines will also run
under KVM without modification. In order to communicate the PAPR
hypercalls to qemu, this adds a new KVM_EXIT_PAPR_HCALL exit code
to include/linux/kvm.h.
Currently the choice between book3s_hv support and book3s_pr support
(i.e. the existing code, which runs the guest in user mode) has to be
made at kernel configuration time, so a given kernel binary can only
do one or the other.
This new book3s_hv code doesn't support MMIO emulation at present.
Since we are running paravirtualized guests, this isn't a serious
restriction.
With the guest running in supervisor mode, most exceptions go straight
to the guest. We will never get data or instruction storage or segment
interrupts, alignment interrupts, decrementer interrupts, program
interrupts, single-step interrupts, etc., coming to the hypervisor from
the guest. Therefore this introduces a new KVMTEST_NONHV macro for the
exception entry path so that we don't have to do the KVM test on entry
to those exception handlers.
We do however get hypervisor decrementer, hypervisor data storage,
hypervisor instruction storage, and hypervisor emulation assist
interrupts, so we have to handle those.
In hypervisor mode, real-mode accesses can access all of RAM, not just
a limited amount. Therefore we put all the guest state in the vcpu.arch
and use the shadow_vcpu in the PACA only for temporary scratch space.
We allocate the vcpu with kzalloc rather than vzalloc, and we don't use
anything in the kvmppc_vcpu_book3s struct, so we don't allocate it.
We don't have a shared page with the guest, but we still need a
kvm_vcpu_arch_shared struct to store the values of various registers,
so we include one in the vcpu_arch struct.
The POWER7 processor has a restriction that all threads in a core have
to be in the same partition. MMU-on kernel code counts as a partition
(partition 0), so we have to do a partition switch on every entry to and
exit from the guest. At present we require the host and guest to run
in single-thread mode because of this hardware restriction.
This code allocates a hashed page table for the guest and initializes
it with HPTEs for the guest's Virtual Real Memory Area (VRMA). We
require that the guest memory is allocated using 16MB huge pages, in
order to simplify the low-level memory management. This also means that
we can get away without tracking paging activity in the host for now,
since huge pages can't be paged or swapped.
This also adds a few new exports needed by the book3s_hv code.
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Alexander Graf <agraf@suse.de>
2011-06-29 08:21:34 +08:00
|
|
|
EXPORT_SYMBOL_GPL(flush_fp_to_thread);
|
2005-09-26 14:04:21 +08:00
|
|
|
|
|
|
|
|
void enable_kernel_fp(void)
|
|
|
|
|
{
|
2016-09-23 14:18:11 +08:00
|
|
|
unsigned long cpumsr;
|
|
|
|
|
|
2005-09-26 14:04:21 +08:00
|
|
|
WARN_ON(preemptible());
|
|
|
|
|
|
2016-09-23 14:18:11 +08:00
|
|
|
cpumsr = msr_check_and_set(MSR_FP);
|
2015-10-29 08:43:59 +08:00
|
|
|
|
2015-12-10 17:04:05 +08:00
|
|
|
if (current->thread.regs && (current->thread.regs->msr & MSR_FP)) {
|
|
|
|
|
check_if_tm_restore_required(current);
|
2016-09-23 14:18:11 +08:00
|
|
|
/*
|
|
|
|
|
* If a thread has already been reclaimed then the
|
|
|
|
|
* checkpointed registers are on the CPU but have definitely
|
|
|
|
|
* been saved by the reclaim code. Don't need to and *cannot*
|
|
|
|
|
* giveup as this would save to the 'live' structure not the
|
|
|
|
|
* checkpointed structure.
|
|
|
|
|
*/
|
|
|
|
|
if(!msr_tm_active(cpumsr) && msr_tm_active(current->thread.regs->msr))
|
|
|
|
|
return;
|
2015-10-29 08:44:04 +08:00
|
|
|
__giveup_fpu(current);
|
2015-12-10 17:04:05 +08:00
|
|
|
}
|
2005-09-26 14:04:21 +08:00
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL(enable_kernel_fp);
|
2016-02-29 14:53:47 +08:00
|
|
|
|
|
|
|
|
static int restore_fp(struct task_struct *tsk) {
|
2016-09-23 14:18:08 +08:00
|
|
|
if (tsk->thread.load_fp || msr_tm_active(tsk->thread.regs->msr)) {
|
2016-02-29 14:53:47 +08:00
|
|
|
load_fp_state(¤t->thread.fp_state);
|
|
|
|
|
current->thread.load_fp++;
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
#else
|
|
|
|
|
static int restore_fp(struct task_struct *tsk) { return 0; }
|
2015-10-29 08:44:11 +08:00
|
|
|
#endif /* CONFIG_PPC_FPU */
|
2005-09-26 14:04:21 +08:00
|
|
|
|
|
|
|
|
#ifdef CONFIG_ALTIVEC
|
2016-02-29 14:53:47 +08:00
|
|
|
#define loadvec(thr) ((thr).load_vec)
|
|
|
|
|
|
2016-02-29 14:53:50 +08:00
|
|
|
static void __giveup_altivec(struct task_struct *tsk)
|
|
|
|
|
{
|
powerpc: Avoid load hit store in __giveup_fpu() and __giveup_altivec()
In both __giveup_fpu() and __giveup_altivec() we make two modifications
to tsk->thread.regs->msr. gcc decides to do a read/modify/write of
each change, so we end up with a load hit store:
ld r9,264(r10)
rldicl r9,r9,50,1
rotldi r9,r9,14
std r9,264(r10)
...
ld r9,264(r10)
rldicl r9,r9,40,1
rotldi r9,r9,24
std r9,264(r10)
Fix this by using a temporary.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2016-05-29 20:03:50 +08:00
|
|
|
unsigned long msr;
|
|
|
|
|
|
2016-02-29 14:53:50 +08:00
|
|
|
save_altivec(tsk);
|
powerpc: Avoid load hit store in __giveup_fpu() and __giveup_altivec()
In both __giveup_fpu() and __giveup_altivec() we make two modifications
to tsk->thread.regs->msr. gcc decides to do a read/modify/write of
each change, so we end up with a load hit store:
ld r9,264(r10)
rldicl r9,r9,50,1
rotldi r9,r9,14
std r9,264(r10)
...
ld r9,264(r10)
rldicl r9,r9,40,1
rotldi r9,r9,24
std r9,264(r10)
Fix this by using a temporary.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2016-05-29 20:03:50 +08:00
|
|
|
msr = tsk->thread.regs->msr;
|
|
|
|
|
msr &= ~MSR_VEC;
|
2016-02-29 14:53:50 +08:00
|
|
|
#ifdef CONFIG_VSX
|
|
|
|
|
if (cpu_has_feature(CPU_FTR_VSX))
|
powerpc: Avoid load hit store in __giveup_fpu() and __giveup_altivec()
In both __giveup_fpu() and __giveup_altivec() we make two modifications
to tsk->thread.regs->msr. gcc decides to do a read/modify/write of
each change, so we end up with a load hit store:
ld r9,264(r10)
rldicl r9,r9,50,1
rotldi r9,r9,14
std r9,264(r10)
...
ld r9,264(r10)
rldicl r9,r9,40,1
rotldi r9,r9,24
std r9,264(r10)
Fix this by using a temporary.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2016-05-29 20:03:50 +08:00
|
|
|
msr &= ~MSR_VSX;
|
2016-02-29 14:53:50 +08:00
|
|
|
#endif
|
powerpc: Avoid load hit store in __giveup_fpu() and __giveup_altivec()
In both __giveup_fpu() and __giveup_altivec() we make two modifications
to tsk->thread.regs->msr. gcc decides to do a read/modify/write of
each change, so we end up with a load hit store:
ld r9,264(r10)
rldicl r9,r9,50,1
rotldi r9,r9,14
std r9,264(r10)
...
ld r9,264(r10)
rldicl r9,r9,40,1
rotldi r9,r9,24
std r9,264(r10)
Fix this by using a temporary.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2016-05-29 20:03:50 +08:00
|
|
|
tsk->thread.regs->msr = msr;
|
2016-02-29 14:53:50 +08:00
|
|
|
}
|
|
|
|
|
|
2015-10-29 08:44:01 +08:00
|
|
|
void giveup_altivec(struct task_struct *tsk)
|
|
|
|
|
{
|
|
|
|
|
check_if_tm_restore_required(tsk);
|
|
|
|
|
|
2015-10-29 08:44:04 +08:00
|
|
|
msr_check_and_set(MSR_VEC);
|
2015-10-29 08:44:01 +08:00
|
|
|
__giveup_altivec(tsk);
|
2015-10-29 08:44:04 +08:00
|
|
|
msr_check_and_clear(MSR_VEC);
|
2015-10-29 08:44:01 +08:00
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL(giveup_altivec);
|
|
|
|
|
|
2005-09-26 14:04:21 +08:00
|
|
|
void enable_kernel_altivec(void)
|
|
|
|
|
{
|
2016-09-23 14:18:11 +08:00
|
|
|
unsigned long cpumsr;
|
|
|
|
|
|
2005-09-26 14:04:21 +08:00
|
|
|
WARN_ON(preemptible());
|
|
|
|
|
|
2016-09-23 14:18:11 +08:00
|
|
|
cpumsr = msr_check_and_set(MSR_VEC);
|
2015-10-29 08:43:59 +08:00
|
|
|
|
2015-12-10 17:04:05 +08:00
|
|
|
if (current->thread.regs && (current->thread.regs->msr & MSR_VEC)) {
|
|
|
|
|
check_if_tm_restore_required(current);
|
2016-09-23 14:18:11 +08:00
|
|
|
/*
|
|
|
|
|
* If a thread has already been reclaimed then the
|
|
|
|
|
* checkpointed registers are on the CPU but have definitely
|
|
|
|
|
* been saved by the reclaim code. Don't need to and *cannot*
|
|
|
|
|
* giveup as this would save to the 'live' structure not the
|
|
|
|
|
* checkpointed structure.
|
|
|
|
|
*/
|
|
|
|
|
if(!msr_tm_active(cpumsr) && msr_tm_active(current->thread.regs->msr))
|
|
|
|
|
return;
|
2015-10-29 08:44:04 +08:00
|
|
|
__giveup_altivec(current);
|
2015-12-10 17:04:05 +08:00
|
|
|
}
|
2005-09-26 14:04:21 +08:00
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL(enable_kernel_altivec);
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Make sure the VMX/Altivec register state in the
|
|
|
|
|
* the thread_struct is up to date for task tsk.
|
|
|
|
|
*/
|
|
|
|
|
void flush_altivec_to_thread(struct task_struct *tsk)
|
|
|
|
|
{
|
|
|
|
|
if (tsk->thread.regs) {
|
|
|
|
|
preempt_disable();
|
|
|
|
|
if (tsk->thread.regs->msr & MSR_VEC) {
|
|
|
|
|
BUG_ON(tsk != current);
|
2015-10-29 08:43:58 +08:00
|
|
|
giveup_altivec(tsk);
|
2005-09-26 14:04:21 +08:00
|
|
|
}
|
|
|
|
|
preempt_enable();
|
|
|
|
|
}
|
|
|
|
|
}
|
KVM: PPC: Add support for Book3S processors in hypervisor mode
This adds support for KVM running on 64-bit Book 3S processors,
specifically POWER7, in hypervisor mode. Using hypervisor mode means
that the guest can use the processor's supervisor mode. That means
that the guest can execute privileged instructions and access privileged
registers itself without trapping to the host. This gives excellent
performance, but does mean that KVM cannot emulate a processor
architecture other than the one that the hardware implements.
This code assumes that the guest is running paravirtualized using the
PAPR (Power Architecture Platform Requirements) interface, which is the
interface that IBM's PowerVM hypervisor uses. That means that existing
Linux distributions that run on IBM pSeries machines will also run
under KVM without modification. In order to communicate the PAPR
hypercalls to qemu, this adds a new KVM_EXIT_PAPR_HCALL exit code
to include/linux/kvm.h.
Currently the choice between book3s_hv support and book3s_pr support
(i.e. the existing code, which runs the guest in user mode) has to be
made at kernel configuration time, so a given kernel binary can only
do one or the other.
This new book3s_hv code doesn't support MMIO emulation at present.
Since we are running paravirtualized guests, this isn't a serious
restriction.
With the guest running in supervisor mode, most exceptions go straight
to the guest. We will never get data or instruction storage or segment
interrupts, alignment interrupts, decrementer interrupts, program
interrupts, single-step interrupts, etc., coming to the hypervisor from
the guest. Therefore this introduces a new KVMTEST_NONHV macro for the
exception entry path so that we don't have to do the KVM test on entry
to those exception handlers.
We do however get hypervisor decrementer, hypervisor data storage,
hypervisor instruction storage, and hypervisor emulation assist
interrupts, so we have to handle those.
In hypervisor mode, real-mode accesses can access all of RAM, not just
a limited amount. Therefore we put all the guest state in the vcpu.arch
and use the shadow_vcpu in the PACA only for temporary scratch space.
We allocate the vcpu with kzalloc rather than vzalloc, and we don't use
anything in the kvmppc_vcpu_book3s struct, so we don't allocate it.
We don't have a shared page with the guest, but we still need a
kvm_vcpu_arch_shared struct to store the values of various registers,
so we include one in the vcpu_arch struct.
The POWER7 processor has a restriction that all threads in a core have
to be in the same partition. MMU-on kernel code counts as a partition
(partition 0), so we have to do a partition switch on every entry to and
exit from the guest. At present we require the host and guest to run
in single-thread mode because of this hardware restriction.
This code allocates a hashed page table for the guest and initializes
it with HPTEs for the guest's Virtual Real Memory Area (VRMA). We
require that the guest memory is allocated using 16MB huge pages, in
order to simplify the low-level memory management. This also means that
we can get away without tracking paging activity in the host for now,
since huge pages can't be paged or swapped.
This also adds a few new exports needed by the book3s_hv code.
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Alexander Graf <agraf@suse.de>
2011-06-29 08:21:34 +08:00
|
|
|
EXPORT_SYMBOL_GPL(flush_altivec_to_thread);
|
2016-02-29 14:53:47 +08:00
|
|
|
|
|
|
|
|
static int restore_altivec(struct task_struct *tsk)
|
|
|
|
|
{
|
2016-09-23 14:18:08 +08:00
|
|
|
if (cpu_has_feature(CPU_FTR_ALTIVEC) &&
|
|
|
|
|
(tsk->thread.load_vec || msr_tm_active(tsk->thread.regs->msr))) {
|
2016-02-29 14:53:47 +08:00
|
|
|
load_vr_state(&tsk->thread.vr_state);
|
|
|
|
|
tsk->thread.used_vr = 1;
|
|
|
|
|
tsk->thread.load_vec++;
|
|
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
#else
|
|
|
|
|
#define loadvec(thr) 0
|
|
|
|
|
static inline int restore_altivec(struct task_struct *tsk) { return 0; }
|
2005-09-26 14:04:21 +08:00
|
|
|
#endif /* CONFIG_ALTIVEC */
|
|
|
|
|
|
2008-06-25 12:07:18 +08:00
|
|
|
#ifdef CONFIG_VSX
|
2016-02-29 14:53:51 +08:00
|
|
|
static void __giveup_vsx(struct task_struct *tsk)
|
2015-10-29 08:44:02 +08:00
|
|
|
{
|
|
|
|
|
if (tsk->thread.regs->msr & MSR_FP)
|
|
|
|
|
__giveup_fpu(tsk);
|
|
|
|
|
if (tsk->thread.regs->msr & MSR_VEC)
|
|
|
|
|
__giveup_altivec(tsk);
|
2016-02-29 14:53:51 +08:00
|
|
|
tsk->thread.regs->msr &= ~MSR_VSX;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void giveup_vsx(struct task_struct *tsk)
|
|
|
|
|
{
|
|
|
|
|
check_if_tm_restore_required(tsk);
|
|
|
|
|
|
|
|
|
|
msr_check_and_set(MSR_FP|MSR_VEC|MSR_VSX);
|
2015-10-29 08:44:02 +08:00
|
|
|
__giveup_vsx(tsk);
|
2015-10-29 08:44:04 +08:00
|
|
|
msr_check_and_clear(MSR_FP|MSR_VEC|MSR_VSX);
|
2015-10-29 08:44:02 +08:00
|
|
|
}
|
2016-02-29 14:53:51 +08:00
|
|
|
|
|
|
|
|
static void save_vsx(struct task_struct *tsk)
|
|
|
|
|
{
|
|
|
|
|
if (tsk->thread.regs->msr & MSR_FP)
|
|
|
|
|
save_fpu(tsk);
|
|
|
|
|
if (tsk->thread.regs->msr & MSR_VEC)
|
|
|
|
|
save_altivec(tsk);
|
|
|
|
|
}
|
2015-10-29 08:44:02 +08:00
|
|
|
|
2008-06-25 12:07:18 +08:00
|
|
|
void enable_kernel_vsx(void)
|
|
|
|
|
{
|
2016-09-23 14:18:11 +08:00
|
|
|
unsigned long cpumsr;
|
|
|
|
|
|
2008-06-25 12:07:18 +08:00
|
|
|
WARN_ON(preemptible());
|
|
|
|
|
|
2016-09-23 14:18:11 +08:00
|
|
|
cpumsr = msr_check_and_set(MSR_FP|MSR_VEC|MSR_VSX);
|
2015-10-29 08:43:59 +08:00
|
|
|
|
2015-10-29 08:44:04 +08:00
|
|
|
if (current->thread.regs && (current->thread.regs->msr & MSR_VSX)) {
|
2015-12-10 17:04:05 +08:00
|
|
|
check_if_tm_restore_required(current);
|
2016-09-23 14:18:11 +08:00
|
|
|
/*
|
|
|
|
|
* If a thread has already been reclaimed then the
|
|
|
|
|
* checkpointed registers are on the CPU but have definitely
|
|
|
|
|
* been saved by the reclaim code. Don't need to and *cannot*
|
|
|
|
|
* giveup as this would save to the 'live' structure not the
|
|
|
|
|
* checkpointed structure.
|
|
|
|
|
*/
|
|
|
|
|
if(!msr_tm_active(cpumsr) && msr_tm_active(current->thread.regs->msr))
|
|
|
|
|
return;
|
2015-10-29 08:44:04 +08:00
|
|
|
if (current->thread.regs->msr & MSR_FP)
|
|
|
|
|
__giveup_fpu(current);
|
|
|
|
|
if (current->thread.regs->msr & MSR_VEC)
|
|
|
|
|
__giveup_altivec(current);
|
|
|
|
|
__giveup_vsx(current);
|
2015-10-29 08:43:59 +08:00
|
|
|
}
|
2008-06-25 12:07:18 +08:00
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL(enable_kernel_vsx);
|
|
|
|
|
|
|
|
|
|
void flush_vsx_to_thread(struct task_struct *tsk)
|
|
|
|
|
{
|
|
|
|
|
if (tsk->thread.regs) {
|
|
|
|
|
preempt_disable();
|
|
|
|
|
if (tsk->thread.regs->msr & MSR_VSX) {
|
|
|
|
|
BUG_ON(tsk != current);
|
|
|
|
|
giveup_vsx(tsk);
|
|
|
|
|
}
|
|
|
|
|
preempt_enable();
|
|
|
|
|
}
|
|
|
|
|
}
|
KVM: PPC: Add support for Book3S processors in hypervisor mode
This adds support for KVM running on 64-bit Book 3S processors,
specifically POWER7, in hypervisor mode. Using hypervisor mode means
that the guest can use the processor's supervisor mode. That means
that the guest can execute privileged instructions and access privileged
registers itself without trapping to the host. This gives excellent
performance, but does mean that KVM cannot emulate a processor
architecture other than the one that the hardware implements.
This code assumes that the guest is running paravirtualized using the
PAPR (Power Architecture Platform Requirements) interface, which is the
interface that IBM's PowerVM hypervisor uses. That means that existing
Linux distributions that run on IBM pSeries machines will also run
under KVM without modification. In order to communicate the PAPR
hypercalls to qemu, this adds a new KVM_EXIT_PAPR_HCALL exit code
to include/linux/kvm.h.
Currently the choice between book3s_hv support and book3s_pr support
(i.e. the existing code, which runs the guest in user mode) has to be
made at kernel configuration time, so a given kernel binary can only
do one or the other.
This new book3s_hv code doesn't support MMIO emulation at present.
Since we are running paravirtualized guests, this isn't a serious
restriction.
With the guest running in supervisor mode, most exceptions go straight
to the guest. We will never get data or instruction storage or segment
interrupts, alignment interrupts, decrementer interrupts, program
interrupts, single-step interrupts, etc., coming to the hypervisor from
the guest. Therefore this introduces a new KVMTEST_NONHV macro for the
exception entry path so that we don't have to do the KVM test on entry
to those exception handlers.
We do however get hypervisor decrementer, hypervisor data storage,
hypervisor instruction storage, and hypervisor emulation assist
interrupts, so we have to handle those.
In hypervisor mode, real-mode accesses can access all of RAM, not just
a limited amount. Therefore we put all the guest state in the vcpu.arch
and use the shadow_vcpu in the PACA only for temporary scratch space.
We allocate the vcpu with kzalloc rather than vzalloc, and we don't use
anything in the kvmppc_vcpu_book3s struct, so we don't allocate it.
We don't have a shared page with the guest, but we still need a
kvm_vcpu_arch_shared struct to store the values of various registers,
so we include one in the vcpu_arch struct.
The POWER7 processor has a restriction that all threads in a core have
to be in the same partition. MMU-on kernel code counts as a partition
(partition 0), so we have to do a partition switch on every entry to and
exit from the guest. At present we require the host and guest to run
in single-thread mode because of this hardware restriction.
This code allocates a hashed page table for the guest and initializes
it with HPTEs for the guest's Virtual Real Memory Area (VRMA). We
require that the guest memory is allocated using 16MB huge pages, in
order to simplify the low-level memory management. This also means that
we can get away without tracking paging activity in the host for now,
since huge pages can't be paged or swapped.
This also adds a few new exports needed by the book3s_hv code.
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Alexander Graf <agraf@suse.de>
2011-06-29 08:21:34 +08:00
|
|
|
EXPORT_SYMBOL_GPL(flush_vsx_to_thread);
|
2016-02-29 14:53:47 +08:00
|
|
|
|
|
|
|
|
static int restore_vsx(struct task_struct *tsk)
|
|
|
|
|
{
|
|
|
|
|
if (cpu_has_feature(CPU_FTR_VSX)) {
|
|
|
|
|
tsk->thread.used_vsr = 1;
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
#else
|
|
|
|
|
static inline int restore_vsx(struct task_struct *tsk) { return 0; }
|
2016-02-29 14:53:51 +08:00
|
|
|
static inline void save_vsx(struct task_struct *tsk) { }
|
2008-06-25 12:07:18 +08:00
|
|
|
#endif /* CONFIG_VSX */
|
|
|
|
|
|
2005-09-26 14:04:21 +08:00
|
|
|
#ifdef CONFIG_SPE
|
2015-10-29 08:44:01 +08:00
|
|
|
void giveup_spe(struct task_struct *tsk)
|
|
|
|
|
{
|
|
|
|
|
check_if_tm_restore_required(tsk);
|
|
|
|
|
|
2015-10-29 08:44:04 +08:00
|
|
|
msr_check_and_set(MSR_SPE);
|
2015-10-29 08:44:01 +08:00
|
|
|
__giveup_spe(tsk);
|
2015-10-29 08:44:04 +08:00
|
|
|
msr_check_and_clear(MSR_SPE);
|
2015-10-29 08:44:01 +08:00
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL(giveup_spe);
|
2005-09-26 14:04:21 +08:00
|
|
|
|
|
|
|
|
void enable_kernel_spe(void)
|
|
|
|
|
{
|
|
|
|
|
WARN_ON(preemptible());
|
|
|
|
|
|
2015-10-29 08:44:04 +08:00
|
|
|
msr_check_and_set(MSR_SPE);
|
2015-10-29 08:43:59 +08:00
|
|
|
|
2015-12-10 17:04:05 +08:00
|
|
|
if (current->thread.regs && (current->thread.regs->msr & MSR_SPE)) {
|
|
|
|
|
check_if_tm_restore_required(current);
|
2015-10-29 08:44:04 +08:00
|
|
|
__giveup_spe(current);
|
2015-12-10 17:04:05 +08:00
|
|
|
}
|
2005-09-26 14:04:21 +08:00
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL(enable_kernel_spe);
|
|
|
|
|
|
|
|
|
|
void flush_spe_to_thread(struct task_struct *tsk)
|
|
|
|
|
{
|
|
|
|
|
if (tsk->thread.regs) {
|
|
|
|
|
preempt_disable();
|
|
|
|
|
if (tsk->thread.regs->msr & MSR_SPE) {
|
|
|
|
|
BUG_ON(tsk != current);
|
2011-06-15 07:34:25 +08:00
|
|
|
tsk->thread.spefscr = mfspr(SPRN_SPEFSCR);
|
2007-08-29 10:15:53 +08:00
|
|
|
giveup_spe(tsk);
|
2005-09-26 14:04:21 +08:00
|
|
|
}
|
|
|
|
|
preempt_enable();
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
#endif /* CONFIG_SPE */
|
|
|
|
|
|
2015-10-29 08:44:08 +08:00
|
|
|
static unsigned long msr_all_available;
|
|
|
|
|
|
|
|
|
|
static int __init init_msr_all_available(void)
|
|
|
|
|
{
|
|
|
|
|
#ifdef CONFIG_PPC_FPU
|
|
|
|
|
msr_all_available |= MSR_FP;
|
|
|
|
|
#endif
|
|
|
|
|
#ifdef CONFIG_ALTIVEC
|
|
|
|
|
if (cpu_has_feature(CPU_FTR_ALTIVEC))
|
|
|
|
|
msr_all_available |= MSR_VEC;
|
|
|
|
|
#endif
|
|
|
|
|
#ifdef CONFIG_VSX
|
|
|
|
|
if (cpu_has_feature(CPU_FTR_VSX))
|
|
|
|
|
msr_all_available |= MSR_VSX;
|
|
|
|
|
#endif
|
|
|
|
|
#ifdef CONFIG_SPE
|
|
|
|
|
if (cpu_has_feature(CPU_FTR_SPE))
|
|
|
|
|
msr_all_available |= MSR_SPE;
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
early_initcall(init_msr_all_available);
|
|
|
|
|
|
|
|
|
|
void giveup_all(struct task_struct *tsk)
|
|
|
|
|
{
|
|
|
|
|
unsigned long usermsr;
|
|
|
|
|
|
|
|
|
|
if (!tsk->thread.regs)
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
usermsr = tsk->thread.regs->msr;
|
|
|
|
|
|
|
|
|
|
if ((usermsr & msr_all_available) == 0)
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
msr_check_and_set(msr_all_available);
|
2016-09-23 14:18:09 +08:00
|
|
|
check_if_tm_restore_required(tsk);
|
2015-10-29 08:44:08 +08:00
|
|
|
|
|
|
|
|
#ifdef CONFIG_PPC_FPU
|
|
|
|
|
if (usermsr & MSR_FP)
|
|
|
|
|
__giveup_fpu(tsk);
|
|
|
|
|
#endif
|
|
|
|
|
#ifdef CONFIG_ALTIVEC
|
|
|
|
|
if (usermsr & MSR_VEC)
|
|
|
|
|
__giveup_altivec(tsk);
|
|
|
|
|
#endif
|
|
|
|
|
#ifdef CONFIG_VSX
|
|
|
|
|
if (usermsr & MSR_VSX)
|
|
|
|
|
__giveup_vsx(tsk);
|
|
|
|
|
#endif
|
|
|
|
|
#ifdef CONFIG_SPE
|
|
|
|
|
if (usermsr & MSR_SPE)
|
|
|
|
|
__giveup_spe(tsk);
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
msr_check_and_clear(msr_all_available);
|
|
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL(giveup_all);
|
|
|
|
|
|
2016-02-29 14:53:47 +08:00
|
|
|
void restore_math(struct pt_regs *regs)
|
|
|
|
|
{
|
|
|
|
|
unsigned long msr;
|
|
|
|
|
|
2016-09-23 14:18:08 +08:00
|
|
|
if (!msr_tm_active(regs->msr) &&
|
|
|
|
|
!current->thread.load_fp && !loadvec(current->thread))
|
2016-02-29 14:53:47 +08:00
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
msr = regs->msr;
|
|
|
|
|
msr_check_and_set(msr_all_available);
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Only reload if the bit is not set in the user MSR, the bit BEING set
|
|
|
|
|
* indicates that the registers are hot
|
|
|
|
|
*/
|
|
|
|
|
if ((!(msr & MSR_FP)) && restore_fp(current))
|
|
|
|
|
msr |= MSR_FP | current->thread.fpexc_mode;
|
|
|
|
|
|
|
|
|
|
if ((!(msr & MSR_VEC)) && restore_altivec(current))
|
|
|
|
|
msr |= MSR_VEC;
|
|
|
|
|
|
|
|
|
|
if ((msr & (MSR_FP | MSR_VEC)) == (MSR_FP | MSR_VEC) &&
|
|
|
|
|
restore_vsx(current)) {
|
|
|
|
|
msr |= MSR_VSX;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
msr_check_and_clear(msr_all_available);
|
|
|
|
|
|
|
|
|
|
regs->msr = msr;
|
|
|
|
|
}
|
|
|
|
|
|
2016-02-29 14:53:48 +08:00
|
|
|
void save_all(struct task_struct *tsk)
|
|
|
|
|
{
|
|
|
|
|
unsigned long usermsr;
|
|
|
|
|
|
|
|
|
|
if (!tsk->thread.regs)
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
usermsr = tsk->thread.regs->msr;
|
|
|
|
|
|
|
|
|
|
if ((usermsr & msr_all_available) == 0)
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
msr_check_and_set(msr_all_available);
|
|
|
|
|
|
2016-02-29 14:53:51 +08:00
|
|
|
/*
|
|
|
|
|
* Saving the way the register space is in hardware, save_vsx boils
|
|
|
|
|
* down to a save_fpu() and save_altivec()
|
|
|
|
|
*/
|
|
|
|
|
if (usermsr & MSR_VSX) {
|
|
|
|
|
save_vsx(tsk);
|
|
|
|
|
} else {
|
|
|
|
|
if (usermsr & MSR_FP)
|
|
|
|
|
save_fpu(tsk);
|
|
|
|
|
|
|
|
|
|
if (usermsr & MSR_VEC)
|
|
|
|
|
save_altivec(tsk);
|
|
|
|
|
}
|
2016-02-29 14:53:48 +08:00
|
|
|
|
|
|
|
|
if (usermsr & MSR_SPE)
|
|
|
|
|
__giveup_spe(tsk);
|
|
|
|
|
|
|
|
|
|
msr_check_and_clear(msr_all_available);
|
|
|
|
|
}
|
|
|
|
|
|
2015-10-29 08:44:09 +08:00
|
|
|
void flush_all_to_thread(struct task_struct *tsk)
|
|
|
|
|
{
|
|
|
|
|
if (tsk->thread.regs) {
|
|
|
|
|
preempt_disable();
|
|
|
|
|
BUG_ON(tsk != current);
|
2016-02-29 14:53:48 +08:00
|
|
|
save_all(tsk);
|
2015-10-29 08:44:09 +08:00
|
|
|
|
|
|
|
|
#ifdef CONFIG_SPE
|
|
|
|
|
if (tsk->thread.regs->msr & MSR_SPE)
|
|
|
|
|
tsk->thread.spefscr = mfspr(SPRN_SPEFSCR);
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
preempt_enable();
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL(flush_all_to_thread);
|
|
|
|
|
|
2010-02-08 19:51:18 +08:00
|
|
|
#ifdef CONFIG_PPC_ADV_DEBUG_REGS
|
|
|
|
|
void do_send_trap(struct pt_regs *regs, unsigned long address,
|
|
|
|
|
unsigned long error_code, int signal_code, int breakpt)
|
|
|
|
|
{
|
|
|
|
|
siginfo_t info;
|
|
|
|
|
|
2012-08-24 05:27:09 +08:00
|
|
|
current->thread.trap_nr = signal_code;
|
2010-02-08 19:51:18 +08:00
|
|
|
if (notify_die(DIE_DABR_MATCH, "dabr_match", regs, error_code,
|
|
|
|
|
11, SIGSEGV) == NOTIFY_STOP)
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
/* Deliver the signal to userspace */
|
|
|
|
|
info.si_signo = SIGTRAP;
|
|
|
|
|
info.si_errno = breakpt; /* breakpoint or watchpoint id */
|
|
|
|
|
info.si_code = signal_code;
|
|
|
|
|
info.si_addr = (void __user *)address;
|
|
|
|
|
force_sig_info(SIGTRAP, &info, current);
|
|
|
|
|
}
|
|
|
|
|
#else /* !CONFIG_PPC_ADV_DEBUG_REGS */
|
2012-12-20 22:06:44 +08:00
|
|
|
void do_break (struct pt_regs *regs, unsigned long address,
|
2008-07-24 00:10:41 +08:00
|
|
|
unsigned long error_code)
|
|
|
|
|
{
|
|
|
|
|
siginfo_t info;
|
|
|
|
|
|
2012-08-24 05:27:09 +08:00
|
|
|
current->thread.trap_nr = TRAP_HWBKPT;
|
2008-07-24 00:10:41 +08:00
|
|
|
if (notify_die(DIE_DABR_MATCH, "dabr_match", regs, error_code,
|
|
|
|
|
11, SIGSEGV) == NOTIFY_STOP)
|
|
|
|
|
return;
|
|
|
|
|
|
2012-12-20 22:06:44 +08:00
|
|
|
if (debugger_break_match(regs))
|
2008-07-24 00:10:41 +08:00
|
|
|
return;
|
|
|
|
|
|
2012-12-20 22:06:44 +08:00
|
|
|
/* Clear the breakpoint */
|
|
|
|
|
hw_breakpoint_disable();
|
2008-07-24 00:10:41 +08:00
|
|
|
|
|
|
|
|
/* Deliver the signal to userspace */
|
|
|
|
|
info.si_signo = SIGTRAP;
|
|
|
|
|
info.si_errno = 0;
|
|
|
|
|
info.si_code = TRAP_HWBKPT;
|
|
|
|
|
info.si_addr = (void __user *)address;
|
|
|
|
|
force_sig_info(SIGTRAP, &info, current);
|
|
|
|
|
}
|
2010-02-08 19:51:18 +08:00
|
|
|
#endif /* CONFIG_PPC_ADV_DEBUG_REGS */
|
2008-07-24 00:10:41 +08:00
|
|
|
|
2012-12-20 22:06:44 +08:00
|
|
|
static DEFINE_PER_CPU(struct arch_hw_breakpoint, current_brk);
|
2008-03-28 16:11:48 +08:00
|
|
|
|
2010-02-08 19:51:18 +08:00
|
|
|
#ifdef CONFIG_PPC_ADV_DEBUG_REGS
|
|
|
|
|
/*
|
|
|
|
|
* Set the debug registers back to their default "safe" values.
|
|
|
|
|
*/
|
|
|
|
|
static void set_debug_reg_defaults(struct thread_struct *thread)
|
|
|
|
|
{
|
2013-07-04 14:15:46 +08:00
|
|
|
thread->debug.iac1 = thread->debug.iac2 = 0;
|
2010-02-08 19:51:18 +08:00
|
|
|
#if CONFIG_PPC_ADV_DEBUG_IACS > 2
|
2013-07-04 14:15:46 +08:00
|
|
|
thread->debug.iac3 = thread->debug.iac4 = 0;
|
2010-02-08 19:51:18 +08:00
|
|
|
#endif
|
2013-07-04 14:15:46 +08:00
|
|
|
thread->debug.dac1 = thread->debug.dac2 = 0;
|
2010-02-08 19:51:18 +08:00
|
|
|
#if CONFIG_PPC_ADV_DEBUG_DVCS > 0
|
2013-07-04 14:15:46 +08:00
|
|
|
thread->debug.dvc1 = thread->debug.dvc2 = 0;
|
2010-02-08 19:51:18 +08:00
|
|
|
#endif
|
2013-07-04 14:15:46 +08:00
|
|
|
thread->debug.dbcr0 = 0;
|
2010-02-08 19:51:18 +08:00
|
|
|
#ifdef CONFIG_BOOKE
|
|
|
|
|
/*
|
|
|
|
|
* Force User/Supervisor bits to b11 (user-only MSR[PR]=1)
|
|
|
|
|
*/
|
2013-07-04 14:15:46 +08:00
|
|
|
thread->debug.dbcr1 = DBCR1_IAC1US | DBCR1_IAC2US |
|
2010-02-08 19:51:18 +08:00
|
|
|
DBCR1_IAC3US | DBCR1_IAC4US;
|
|
|
|
|
/*
|
|
|
|
|
* Force Data Address Compare User/Supervisor bits to be User-only
|
|
|
|
|
* (0b11 MSR[PR]=1) and set all other bits in DBCR2 register to be 0.
|
|
|
|
|
*/
|
2013-07-04 14:15:46 +08:00
|
|
|
thread->debug.dbcr2 = DBCR2_DAC1US | DBCR2_DAC2US;
|
2010-02-08 19:51:18 +08:00
|
|
|
#else
|
2013-07-04 14:15:46 +08:00
|
|
|
thread->debug.dbcr1 = 0;
|
2010-02-08 19:51:18 +08:00
|
|
|
#endif
|
|
|
|
|
}
|
|
|
|
|
|
2013-11-23 05:52:29 +08:00
|
|
|
static void prime_debug_regs(struct debug_reg *debug)
|
2010-02-08 19:51:18 +08:00
|
|
|
{
|
2013-05-13 22:14:53 +08:00
|
|
|
/*
|
|
|
|
|
* We could have inherited MSR_DE from userspace, since
|
|
|
|
|
* it doesn't get cleared on exception entry. Make sure
|
|
|
|
|
* MSR_DE is clear before we enable any debug events.
|
|
|
|
|
*/
|
|
|
|
|
mtmsr(mfmsr() & ~MSR_DE);
|
|
|
|
|
|
2013-11-23 05:52:29 +08:00
|
|
|
mtspr(SPRN_IAC1, debug->iac1);
|
|
|
|
|
mtspr(SPRN_IAC2, debug->iac2);
|
2010-02-08 19:51:18 +08:00
|
|
|
#if CONFIG_PPC_ADV_DEBUG_IACS > 2
|
2013-11-23 05:52:29 +08:00
|
|
|
mtspr(SPRN_IAC3, debug->iac3);
|
|
|
|
|
mtspr(SPRN_IAC4, debug->iac4);
|
2010-02-08 19:51:18 +08:00
|
|
|
#endif
|
2013-11-23 05:52:29 +08:00
|
|
|
mtspr(SPRN_DAC1, debug->dac1);
|
|
|
|
|
mtspr(SPRN_DAC2, debug->dac2);
|
2010-02-08 19:51:18 +08:00
|
|
|
#if CONFIG_PPC_ADV_DEBUG_DVCS > 0
|
2013-11-23 05:52:29 +08:00
|
|
|
mtspr(SPRN_DVC1, debug->dvc1);
|
|
|
|
|
mtspr(SPRN_DVC2, debug->dvc2);
|
2010-02-08 19:51:18 +08:00
|
|
|
#endif
|
2013-11-23 05:52:29 +08:00
|
|
|
mtspr(SPRN_DBCR0, debug->dbcr0);
|
|
|
|
|
mtspr(SPRN_DBCR1, debug->dbcr1);
|
2010-02-08 19:51:18 +08:00
|
|
|
#ifdef CONFIG_BOOKE
|
2013-11-23 05:52:29 +08:00
|
|
|
mtspr(SPRN_DBCR2, debug->dbcr2);
|
2010-02-08 19:51:18 +08:00
|
|
|
#endif
|
|
|
|
|
}
|
|
|
|
|
/*
|
|
|
|
|
* Unless neither the old or new thread are making use of the
|
|
|
|
|
* debug registers, set the debug registers from the values
|
|
|
|
|
* stored in the new thread.
|
|
|
|
|
*/
|
2013-11-23 05:52:29 +08:00
|
|
|
void switch_booke_debug_regs(struct debug_reg *new_debug)
|
2010-02-08 19:51:18 +08:00
|
|
|
{
|
2013-07-04 14:15:46 +08:00
|
|
|
if ((current->thread.debug.dbcr0 & DBCR0_IDM)
|
2013-11-23 05:52:29 +08:00
|
|
|
|| (new_debug->dbcr0 & DBCR0_IDM))
|
|
|
|
|
prime_debug_regs(new_debug);
|
2010-02-08 19:51:18 +08:00
|
|
|
}
|
2013-07-04 14:57:44 +08:00
|
|
|
EXPORT_SYMBOL_GPL(switch_booke_debug_regs);
|
2010-02-08 19:51:18 +08:00
|
|
|
#else /* !CONFIG_PPC_ADV_DEBUG_REGS */
|
2011-02-10 12:44:35 +08:00
|
|
|
#ifndef CONFIG_HAVE_HW_BREAKPOINT
|
2010-02-08 19:51:18 +08:00
|
|
|
static void set_debug_reg_defaults(struct thread_struct *thread)
|
|
|
|
|
{
|
2012-12-20 22:06:44 +08:00
|
|
|
thread->hw_brk.address = 0;
|
|
|
|
|
thread->hw_brk.type = 0;
|
2013-01-10 22:25:34 +08:00
|
|
|
set_breakpoint(&thread->hw_brk);
|
2010-02-08 19:51:18 +08:00
|
|
|
}
|
2011-02-10 12:44:35 +08:00
|
|
|
#endif /* !CONFIG_HAVE_HW_BREAKPOINT */
|
2010-02-08 19:51:18 +08:00
|
|
|
#endif /* CONFIG_PPC_ADV_DEBUG_REGS */
|
|
|
|
|
|
2010-02-08 19:50:57 +08:00
|
|
|
#ifdef CONFIG_PPC_ADV_DEBUG_REGS
|
2012-12-20 22:06:44 +08:00
|
|
|
static inline int __set_dabr(unsigned long dabr, unsigned long dabrx)
|
|
|
|
|
{
|
2008-07-24 00:10:41 +08:00
|
|
|
mtspr(SPRN_DAC1, dabr);
|
2010-03-05 18:43:24 +08:00
|
|
|
#ifdef CONFIG_PPC_47x
|
|
|
|
|
isync();
|
|
|
|
|
#endif
|
2012-12-20 22:06:44 +08:00
|
|
|
return 0;
|
|
|
|
|
}
|
2009-09-08 22:16:58 +08:00
|
|
|
#elif defined(CONFIG_PPC_BOOK3S)
|
2012-12-20 22:06:44 +08:00
|
|
|
static inline int __set_dabr(unsigned long dabr, unsigned long dabrx)
|
|
|
|
|
{
|
2009-09-08 22:16:58 +08:00
|
|
|
mtspr(SPRN_DABR, dabr);
|
2013-05-17 04:27:31 +08:00
|
|
|
if (cpu_has_feature(CPU_FTR_DABRX))
|
|
|
|
|
mtspr(SPRN_DABRX, dabrx);
|
2005-11-03 12:30:49 +08:00
|
|
|
return 0;
|
2005-09-26 14:04:21 +08:00
|
|
|
}
|
powerpc/8xx: Implement hw_breakpoint
This patch implements HW breakpoint on the 8xx. The 8xx has
capability to manage HW breakpoints, which is slightly different
than BOOK3S:
1/ The breakpoint match doesn't trigger a DSI exception but a
dedicated data breakpoint exception.
2/ The breakpoint happens after the instruction has completed,
no need to single step or emulate the instruction,
3/ Matched address is not set in DAR but in BAR,
4/ DABR register doesn't exist, instead we have registers
LCTRL1, LCTRL2 and CMPx registers,
5/ The match on one comparator is not on a double word but
on a single word.
The patch does:
1/ Prepare the dedicated registers in call to __set_dabr(). In order
to emulate the double word handling of BOOK3S, comparator E is set to
DABR address value and comparator F to address + 4. Then breakpoint 1
is set to match comparator E or F,
2/ Skip the singlestepping stage when compiled for CONFIG_PPC_8xx,
3/ Implement the exception. In that exception, the matched address
is taken from SPRN_BAR and manage as if it was from SPRN_DAR.
4/ I/D TLB error exception routines perform a tlbie on bad TLBs. That
tlbie triggers the breakpoint exception when performed on the
breakpoint address. For this reason, the routine returns if the match
is from one of those two tlbie.
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Scott Wood <oss@buserror.net>
2016-11-29 16:52:15 +08:00
|
|
|
#elif defined(CONFIG_PPC_8xx)
|
|
|
|
|
static inline int __set_dabr(unsigned long dabr, unsigned long dabrx)
|
|
|
|
|
{
|
|
|
|
|
unsigned long addr = dabr & ~HW_BRK_TYPE_DABR;
|
|
|
|
|
unsigned long lctrl1 = 0x90000000; /* compare type: equal on E & F */
|
|
|
|
|
unsigned long lctrl2 = 0x8e000002; /* watchpoint 1 on cmp E | F */
|
|
|
|
|
|
|
|
|
|
if ((dabr & HW_BRK_TYPE_RDWR) == HW_BRK_TYPE_READ)
|
|
|
|
|
lctrl1 |= 0xa0000;
|
|
|
|
|
else if ((dabr & HW_BRK_TYPE_RDWR) == HW_BRK_TYPE_WRITE)
|
|
|
|
|
lctrl1 |= 0xf0000;
|
|
|
|
|
else if ((dabr & HW_BRK_TYPE_RDWR) == 0)
|
|
|
|
|
lctrl2 = 0;
|
|
|
|
|
|
|
|
|
|
mtspr(SPRN_LCTRL2, 0);
|
|
|
|
|
mtspr(SPRN_CMPE, addr);
|
|
|
|
|
mtspr(SPRN_CMPF, addr + 4);
|
|
|
|
|
mtspr(SPRN_LCTRL1, lctrl1);
|
|
|
|
|
mtspr(SPRN_LCTRL2, lctrl2);
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
2012-12-20 22:06:44 +08:00
|
|
|
#else
|
|
|
|
|
static inline int __set_dabr(unsigned long dabr, unsigned long dabrx)
|
|
|
|
|
{
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
}
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
static inline int set_dabr(struct arch_hw_breakpoint *brk)
|
|
|
|
|
{
|
|
|
|
|
unsigned long dabr, dabrx;
|
|
|
|
|
|
|
|
|
|
dabr = brk->address | (brk->type & HW_BRK_TYPE_DABR);
|
|
|
|
|
dabrx = ((brk->type >> 3) & 0x7);
|
|
|
|
|
|
|
|
|
|
if (ppc_md.set_dabr)
|
|
|
|
|
return ppc_md.set_dabr(dabr, dabrx);
|
|
|
|
|
|
|
|
|
|
return __set_dabr(dabr, dabrx);
|
|
|
|
|
}
|
|
|
|
|
|
2012-12-20 22:06:45 +08:00
|
|
|
static inline int set_dawr(struct arch_hw_breakpoint *brk)
|
|
|
|
|
{
|
2013-01-24 23:02:58 +08:00
|
|
|
unsigned long dawr, dawrx, mrd;
|
2012-12-20 22:06:45 +08:00
|
|
|
|
|
|
|
|
dawr = brk->address;
|
|
|
|
|
|
|
|
|
|
dawrx = (brk->type & (HW_BRK_TYPE_READ | HW_BRK_TYPE_WRITE)) \
|
|
|
|
|
<< (63 - 58); //* read/write bits */
|
|
|
|
|
dawrx |= ((brk->type & (HW_BRK_TYPE_TRANSLATE)) >> 2) \
|
|
|
|
|
<< (63 - 59); //* translate */
|
|
|
|
|
dawrx |= (brk->type & (HW_BRK_TYPE_PRIV_ALL)) \
|
|
|
|
|
>> 3; //* PRIM bits */
|
2013-01-24 23:02:58 +08:00
|
|
|
/* dawr length is stored in field MDR bits 48:53. Matches range in
|
|
|
|
|
doublewords (64 bits) baised by -1 eg. 0b000000=1DW and
|
|
|
|
|
0b111111=64DW.
|
|
|
|
|
brk->len is in bytes.
|
|
|
|
|
This aligns up to double word size, shifts and does the bias.
|
|
|
|
|
*/
|
|
|
|
|
mrd = ((brk->len + 7) >> 3) - 1;
|
|
|
|
|
dawrx |= (mrd & 0x3f) << (63 - 53);
|
2012-12-20 22:06:45 +08:00
|
|
|
|
|
|
|
|
if (ppc_md.set_dawr)
|
|
|
|
|
return ppc_md.set_dawr(dawr, dawrx);
|
|
|
|
|
mtspr(SPRN_DAWR, dawr);
|
|
|
|
|
mtspr(SPRN_DAWRX, dawrx);
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
2014-04-30 03:25:17 +08:00
|
|
|
void __set_breakpoint(struct arch_hw_breakpoint *brk)
|
2012-12-20 22:06:44 +08:00
|
|
|
{
|
powerpc: Replace __get_cpu_var uses
This still has not been merged and now powerpc is the only arch that does
not have this change. Sorry about missing linuxppc-dev before.
V2->V2
- Fix up to work against 3.18-rc1
__get_cpu_var() is used for multiple purposes in the kernel source. One of
them is address calculation via the form &__get_cpu_var(x). This calculates
the address for the instance of the percpu variable of the current processor
based on an offset.
Other use cases are for storing and retrieving data from the current
processors percpu area. __get_cpu_var() can be used as an lvalue when
writing data or on the right side of an assignment.
__get_cpu_var() is defined as :
__get_cpu_var() always only does an address determination. However, store
and retrieve operations could use a segment prefix (or global register on
other platforms) to avoid the address calculation.
this_cpu_write() and this_cpu_read() can directly take an offset into a
percpu area and use optimized assembly code to read and write per cpu
variables.
This patch converts __get_cpu_var into either an explicit address
calculation using this_cpu_ptr() or into a use of this_cpu operations that
use the offset. Thereby address calculations are avoided and less registers
are used when code is generated.
At the end of the patch set all uses of __get_cpu_var have been removed so
the macro is removed too.
The patch set includes passes over all arches as well. Once these operations
are used throughout then specialized macros can be defined in non -x86
arches as well in order to optimize per cpu access by f.e. using a global
register that may be set to the per cpu base.
Transformations done to __get_cpu_var()
1. Determine the address of the percpu instance of the current processor.
DEFINE_PER_CPU(int, y);
int *x = &__get_cpu_var(y);
Converts to
int *x = this_cpu_ptr(&y);
2. Same as #1 but this time an array structure is involved.
DEFINE_PER_CPU(int, y[20]);
int *x = __get_cpu_var(y);
Converts to
int *x = this_cpu_ptr(y);
3. Retrieve the content of the current processors instance of a per cpu
variable.
DEFINE_PER_CPU(int, y);
int x = __get_cpu_var(y)
Converts to
int x = __this_cpu_read(y);
4. Retrieve the content of a percpu struct
DEFINE_PER_CPU(struct mystruct, y);
struct mystruct x = __get_cpu_var(y);
Converts to
memcpy(&x, this_cpu_ptr(&y), sizeof(x));
5. Assignment to a per cpu variable
DEFINE_PER_CPU(int, y)
__get_cpu_var(y) = x;
Converts to
__this_cpu_write(y, x);
6. Increment/Decrement etc of a per cpu variable
DEFINE_PER_CPU(int, y);
__get_cpu_var(y)++
Converts to
__this_cpu_inc(y)
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
CC: Paul Mackerras <paulus@samba.org>
Signed-off-by: Christoph Lameter <cl@linux.com>
[mpe: Fix build errors caused by set/or_softirq_pending(), and rework
assignment in __set_breakpoint() to use memcpy().]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2014-10-22 04:23:25 +08:00
|
|
|
memcpy(this_cpu_ptr(¤t_brk), brk, sizeof(*brk));
|
2012-12-20 22:06:44 +08:00
|
|
|
|
2012-12-20 22:06:45 +08:00
|
|
|
if (cpu_has_feature(CPU_FTR_DAWR))
|
2014-04-30 03:25:16 +08:00
|
|
|
set_dawr(brk);
|
|
|
|
|
else
|
|
|
|
|
set_dabr(brk);
|
2012-12-20 22:06:44 +08:00
|
|
|
}
|
2005-09-26 14:04:21 +08:00
|
|
|
|
2014-04-30 03:25:17 +08:00
|
|
|
void set_breakpoint(struct arch_hw_breakpoint *brk)
|
|
|
|
|
{
|
|
|
|
|
preempt_disable();
|
|
|
|
|
__set_breakpoint(brk);
|
|
|
|
|
preempt_enable();
|
|
|
|
|
}
|
|
|
|
|
|
2005-10-10 20:29:05 +08:00
|
|
|
#ifdef CONFIG_PPC64
|
|
|
|
|
DEFINE_PER_CPU(struct cpu_usage, cpu_usage_array);
|
|
|
|
|
#endif
|
2005-09-26 14:04:21 +08:00
|
|
|
|
2012-12-20 22:06:44 +08:00
|
|
|
static inline bool hw_brk_match(struct arch_hw_breakpoint *a,
|
|
|
|
|
struct arch_hw_breakpoint *b)
|
|
|
|
|
{
|
|
|
|
|
if (a->address != b->address)
|
|
|
|
|
return false;
|
|
|
|
|
if (a->type != b->type)
|
|
|
|
|
return false;
|
|
|
|
|
if (a->len != b->len)
|
|
|
|
|
return false;
|
|
|
|
|
return true;
|
|
|
|
|
}
|
powerpc: Don't corrupt transactional state when using FP/VMX in kernel
Currently, when we have a process using the transactional memory
facilities on POWER8 (that is, the processor is in transactional
or suspended state), and the process enters the kernel and the
kernel then uses the floating-point or vector (VMX/Altivec) facility,
we end up corrupting the user-visible FP/VMX/VSX state. This
happens, for example, if a page fault causes a copy-on-write
operation, because the copy_page function will use VMX to do the
copy on POWER8. The test program below demonstrates the bug.
The bug happens because when FP/VMX state for a transactional process
is stored in the thread_struct, we store the checkpointed state in
.fp_state/.vr_state and the transactional (current) state in
.transact_fp/.transact_vr. However, when the kernel wants to use
FP/VMX, it calls enable_kernel_fp() or enable_kernel_altivec(),
which saves the current state in .fp_state/.vr_state. Furthermore,
when we return to the user process we return with FP/VMX/VSX
disabled. The next time the process uses FP/VMX/VSX, we don't know
which set of state (the current register values, .fp_state/.vr_state,
or .transact_fp/.transact_vr) we should be using, since we have no
way to tell if we are still in the same transaction, and if not,
whether the previous transaction succeeded or failed.
Thus it is necessary to strictly adhere to the rule that if FP has
been enabled at any point in a transaction, we must keep FP enabled
for the user process with the current transactional state in the
FP registers, until we detect that it is no longer in a transaction.
Similarly for VMX; once enabled it must stay enabled until the
process is no longer transactional.
In order to keep this rule, we add a new thread_info flag which we
test when returning from the kernel to userspace, called TIF_RESTORE_TM.
This flag indicates that there is FP/VMX/VSX state to be restored
before entering userspace, and when it is set the .tm_orig_msr field
in the thread_struct indicates what state needs to be restored.
The restoration is done by restore_tm_state(). The TIF_RESTORE_TM
bit is set by new giveup_fpu/altivec_maybe_transactional helpers,
which are called from enable_kernel_fp/altivec, giveup_vsx, and
flush_fp/altivec_to_thread instead of giveup_fpu/altivec.
The other thing to be done is to get the transactional FP/VMX/VSX
state from .fp_state/.vr_state when doing reclaim, if that state
has been saved there by giveup_fpu/altivec_maybe_transactional.
Having done this, we set the FP/VMX bit in the thread's MSR after
reclaim to indicate that that part of the state is now valid
(having been reclaimed from the processor's checkpointed state).
Finally, in the signal handling code, we move the clearing of the
transactional state bits in the thread's MSR a bit earlier, before
calling flush_fp_to_thread(), so that we don't unnecessarily set
the TIF_RESTORE_TM bit.
This is the test program:
/* Michael Neuling 4/12/2013
*
* See if the altivec state is leaked out of an aborted transaction due to
* kernel vmx copy loops.
*
* gcc -m64 htm_vmxcopy.c -o htm_vmxcopy
*
*/
/* We don't use all of these, but for reference: */
int main(int argc, char *argv[])
{
long double vecin = 1.3;
long double vecout;
unsigned long pgsize = getpagesize();
int i;
int fd;
int size = pgsize*16;
char tmpfile[] = "/tmp/page_faultXXXXXX";
char buf[pgsize];
char *a;
uint64_t aborted = 0;
fd = mkstemp(tmpfile);
assert(fd >= 0);
memset(buf, 0, pgsize);
for (i = 0; i < size; i += pgsize)
assert(write(fd, buf, pgsize) == pgsize);
unlink(tmpfile);
a = mmap(NULL, size, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd, 0);
assert(a != MAP_FAILED);
asm __volatile__(
"lxvd2x 40,0,%[vecinptr] ; " // set 40 to initial value
TBEGIN
"beq 3f ;"
TSUSPEND
"xxlxor 40,40,40 ; " // set 40 to 0
"std 5, 0(%[map]) ;" // cause kernel vmx copy page
TABORT
TRESUME
TEND
"li %[res], 0 ;"
"b 5f ;"
"3: ;" // Abort handler
"li %[res], 1 ;"
"5: ;"
"stxvd2x 40,0,%[vecoutptr] ; "
: [res]"=r"(aborted)
: [vecinptr]"r"(&vecin),
[vecoutptr]"r"(&vecout),
[map]"r"(a)
: "memory", "r0", "r3", "r4", "r5", "r6", "r7");
if (aborted && (vecin != vecout)){
printf("FAILED: vector state leaked on abort %f != %f\n",
(double)vecin, (double)vecout);
exit(1);
}
munmap(a, size);
close(fd);
printf("PASSED!\n");
return 0;
}
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2014-01-13 12:56:29 +08:00
|
|
|
|
2013-02-14 00:21:37 +08:00
|
|
|
#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
|
2016-09-14 16:02:16 +08:00
|
|
|
|
|
|
|
|
static inline bool tm_enabled(struct task_struct *tsk)
|
|
|
|
|
{
|
|
|
|
|
return tsk && tsk->thread.regs && (tsk->thread.regs->msr & MSR_TM);
|
|
|
|
|
}
|
|
|
|
|
|
powerpc: Don't corrupt transactional state when using FP/VMX in kernel
Currently, when we have a process using the transactional memory
facilities on POWER8 (that is, the processor is in transactional
or suspended state), and the process enters the kernel and the
kernel then uses the floating-point or vector (VMX/Altivec) facility,
we end up corrupting the user-visible FP/VMX/VSX state. This
happens, for example, if a page fault causes a copy-on-write
operation, because the copy_page function will use VMX to do the
copy on POWER8. The test program below demonstrates the bug.
The bug happens because when FP/VMX state for a transactional process
is stored in the thread_struct, we store the checkpointed state in
.fp_state/.vr_state and the transactional (current) state in
.transact_fp/.transact_vr. However, when the kernel wants to use
FP/VMX, it calls enable_kernel_fp() or enable_kernel_altivec(),
which saves the current state in .fp_state/.vr_state. Furthermore,
when we return to the user process we return with FP/VMX/VSX
disabled. The next time the process uses FP/VMX/VSX, we don't know
which set of state (the current register values, .fp_state/.vr_state,
or .transact_fp/.transact_vr) we should be using, since we have no
way to tell if we are still in the same transaction, and if not,
whether the previous transaction succeeded or failed.
Thus it is necessary to strictly adhere to the rule that if FP has
been enabled at any point in a transaction, we must keep FP enabled
for the user process with the current transactional state in the
FP registers, until we detect that it is no longer in a transaction.
Similarly for VMX; once enabled it must stay enabled until the
process is no longer transactional.
In order to keep this rule, we add a new thread_info flag which we
test when returning from the kernel to userspace, called TIF_RESTORE_TM.
This flag indicates that there is FP/VMX/VSX state to be restored
before entering userspace, and when it is set the .tm_orig_msr field
in the thread_struct indicates what state needs to be restored.
The restoration is done by restore_tm_state(). The TIF_RESTORE_TM
bit is set by new giveup_fpu/altivec_maybe_transactional helpers,
which are called from enable_kernel_fp/altivec, giveup_vsx, and
flush_fp/altivec_to_thread instead of giveup_fpu/altivec.
The other thing to be done is to get the transactional FP/VMX/VSX
state from .fp_state/.vr_state when doing reclaim, if that state
has been saved there by giveup_fpu/altivec_maybe_transactional.
Having done this, we set the FP/VMX bit in the thread's MSR after
reclaim to indicate that that part of the state is now valid
(having been reclaimed from the processor's checkpointed state).
Finally, in the signal handling code, we move the clearing of the
transactional state bits in the thread's MSR a bit earlier, before
calling flush_fp_to_thread(), so that we don't unnecessarily set
the TIF_RESTORE_TM bit.
This is the test program:
/* Michael Neuling 4/12/2013
*
* See if the altivec state is leaked out of an aborted transaction due to
* kernel vmx copy loops.
*
* gcc -m64 htm_vmxcopy.c -o htm_vmxcopy
*
*/
/* We don't use all of these, but for reference: */
int main(int argc, char *argv[])
{
long double vecin = 1.3;
long double vecout;
unsigned long pgsize = getpagesize();
int i;
int fd;
int size = pgsize*16;
char tmpfile[] = "/tmp/page_faultXXXXXX";
char buf[pgsize];
char *a;
uint64_t aborted = 0;
fd = mkstemp(tmpfile);
assert(fd >= 0);
memset(buf, 0, pgsize);
for (i = 0; i < size; i += pgsize)
assert(write(fd, buf, pgsize) == pgsize);
unlink(tmpfile);
a = mmap(NULL, size, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd, 0);
assert(a != MAP_FAILED);
asm __volatile__(
"lxvd2x 40,0,%[vecinptr] ; " // set 40 to initial value
TBEGIN
"beq 3f ;"
TSUSPEND
"xxlxor 40,40,40 ; " // set 40 to 0
"std 5, 0(%[map]) ;" // cause kernel vmx copy page
TABORT
TRESUME
TEND
"li %[res], 0 ;"
"b 5f ;"
"3: ;" // Abort handler
"li %[res], 1 ;"
"5: ;"
"stxvd2x 40,0,%[vecoutptr] ; "
: [res]"=r"(aborted)
: [vecinptr]"r"(&vecin),
[vecoutptr]"r"(&vecout),
[map]"r"(a)
: "memory", "r0", "r3", "r4", "r5", "r6", "r7");
if (aborted && (vecin != vecout)){
printf("FAILED: vector state leaked on abort %f != %f\n",
(double)vecin, (double)vecout);
exit(1);
}
munmap(a, size);
close(fd);
printf("PASSED!\n");
return 0;
}
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2014-01-13 12:56:29 +08:00
|
|
|
static void tm_reclaim_thread(struct thread_struct *thr,
|
|
|
|
|
struct thread_info *ti, uint8_t cause)
|
|
|
|
|
{
|
2015-11-19 12:44:45 +08:00
|
|
|
/*
|
|
|
|
|
* Use the current MSR TM suspended bit to track if we have
|
|
|
|
|
* checkpointed state outstanding.
|
|
|
|
|
* On signal delivery, we'd normally reclaim the checkpointed
|
|
|
|
|
* state to obtain stack pointer (see:get_tm_stackpointer()).
|
|
|
|
|
* This will then directly return to userspace without going
|
|
|
|
|
* through __switch_to(). However, if the stack frame is bad,
|
|
|
|
|
* we need to exit this thread which calls __switch_to() which
|
|
|
|
|
* will again attempt to reclaim the already saved tm state.
|
|
|
|
|
* Hence we need to check that we've not already reclaimed
|
|
|
|
|
* this state.
|
|
|
|
|
* We do this using the current MSR, rather tracking it in
|
|
|
|
|
* some specific thread_struct bit, as it has the additional
|
2016-06-01 14:34:37 +08:00
|
|
|
* benefit of checking for a potential TM bad thing exception.
|
2015-11-19 12:44:45 +08:00
|
|
|
*/
|
|
|
|
|
if (!MSR_TM_SUSPENDED(mfmsr()))
|
|
|
|
|
return;
|
|
|
|
|
|
2016-09-23 14:18:24 +08:00
|
|
|
giveup_all(container_of(thr, struct task_struct, thread));
|
powerpc: Don't corrupt transactional state when using FP/VMX in kernel
Currently, when we have a process using the transactional memory
facilities on POWER8 (that is, the processor is in transactional
or suspended state), and the process enters the kernel and the
kernel then uses the floating-point or vector (VMX/Altivec) facility,
we end up corrupting the user-visible FP/VMX/VSX state. This
happens, for example, if a page fault causes a copy-on-write
operation, because the copy_page function will use VMX to do the
copy on POWER8. The test program below demonstrates the bug.
The bug happens because when FP/VMX state for a transactional process
is stored in the thread_struct, we store the checkpointed state in
.fp_state/.vr_state and the transactional (current) state in
.transact_fp/.transact_vr. However, when the kernel wants to use
FP/VMX, it calls enable_kernel_fp() or enable_kernel_altivec(),
which saves the current state in .fp_state/.vr_state. Furthermore,
when we return to the user process we return with FP/VMX/VSX
disabled. The next time the process uses FP/VMX/VSX, we don't know
which set of state (the current register values, .fp_state/.vr_state,
or .transact_fp/.transact_vr) we should be using, since we have no
way to tell if we are still in the same transaction, and if not,
whether the previous transaction succeeded or failed.
Thus it is necessary to strictly adhere to the rule that if FP has
been enabled at any point in a transaction, we must keep FP enabled
for the user process with the current transactional state in the
FP registers, until we detect that it is no longer in a transaction.
Similarly for VMX; once enabled it must stay enabled until the
process is no longer transactional.
In order to keep this rule, we add a new thread_info flag which we
test when returning from the kernel to userspace, called TIF_RESTORE_TM.
This flag indicates that there is FP/VMX/VSX state to be restored
before entering userspace, and when it is set the .tm_orig_msr field
in the thread_struct indicates what state needs to be restored.
The restoration is done by restore_tm_state(). The TIF_RESTORE_TM
bit is set by new giveup_fpu/altivec_maybe_transactional helpers,
which are called from enable_kernel_fp/altivec, giveup_vsx, and
flush_fp/altivec_to_thread instead of giveup_fpu/altivec.
The other thing to be done is to get the transactional FP/VMX/VSX
state from .fp_state/.vr_state when doing reclaim, if that state
has been saved there by giveup_fpu/altivec_maybe_transactional.
Having done this, we set the FP/VMX bit in the thread's MSR after
reclaim to indicate that that part of the state is now valid
(having been reclaimed from the processor's checkpointed state).
Finally, in the signal handling code, we move the clearing of the
transactional state bits in the thread's MSR a bit earlier, before
calling flush_fp_to_thread(), so that we don't unnecessarily set
the TIF_RESTORE_TM bit.
This is the test program:
/* Michael Neuling 4/12/2013
*
* See if the altivec state is leaked out of an aborted transaction due to
* kernel vmx copy loops.
*
* gcc -m64 htm_vmxcopy.c -o htm_vmxcopy
*
*/
/* We don't use all of these, but for reference: */
int main(int argc, char *argv[])
{
long double vecin = 1.3;
long double vecout;
unsigned long pgsize = getpagesize();
int i;
int fd;
int size = pgsize*16;
char tmpfile[] = "/tmp/page_faultXXXXXX";
char buf[pgsize];
char *a;
uint64_t aborted = 0;
fd = mkstemp(tmpfile);
assert(fd >= 0);
memset(buf, 0, pgsize);
for (i = 0; i < size; i += pgsize)
assert(write(fd, buf, pgsize) == pgsize);
unlink(tmpfile);
a = mmap(NULL, size, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd, 0);
assert(a != MAP_FAILED);
asm __volatile__(
"lxvd2x 40,0,%[vecinptr] ; " // set 40 to initial value
TBEGIN
"beq 3f ;"
TSUSPEND
"xxlxor 40,40,40 ; " // set 40 to 0
"std 5, 0(%[map]) ;" // cause kernel vmx copy page
TABORT
TRESUME
TEND
"li %[res], 0 ;"
"b 5f ;"
"3: ;" // Abort handler
"li %[res], 1 ;"
"5: ;"
"stxvd2x 40,0,%[vecoutptr] ; "
: [res]"=r"(aborted)
: [vecinptr]"r"(&vecin),
[vecoutptr]"r"(&vecout),
[map]"r"(a)
: "memory", "r0", "r3", "r4", "r5", "r6", "r7");
if (aborted && (vecin != vecout)){
printf("FAILED: vector state leaked on abort %f != %f\n",
(double)vecin, (double)vecout);
exit(1);
}
munmap(a, size);
close(fd);
printf("PASSED!\n");
return 0;
}
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2014-01-13 12:56:29 +08:00
|
|
|
|
2016-09-23 14:18:24 +08:00
|
|
|
tm_reclaim(thr, thr->ckpt_regs.msr, cause);
|
powerpc: Don't corrupt transactional state when using FP/VMX in kernel
Currently, when we have a process using the transactional memory
facilities on POWER8 (that is, the processor is in transactional
or suspended state), and the process enters the kernel and the
kernel then uses the floating-point or vector (VMX/Altivec) facility,
we end up corrupting the user-visible FP/VMX/VSX state. This
happens, for example, if a page fault causes a copy-on-write
operation, because the copy_page function will use VMX to do the
copy on POWER8. The test program below demonstrates the bug.
The bug happens because when FP/VMX state for a transactional process
is stored in the thread_struct, we store the checkpointed state in
.fp_state/.vr_state and the transactional (current) state in
.transact_fp/.transact_vr. However, when the kernel wants to use
FP/VMX, it calls enable_kernel_fp() or enable_kernel_altivec(),
which saves the current state in .fp_state/.vr_state. Furthermore,
when we return to the user process we return with FP/VMX/VSX
disabled. The next time the process uses FP/VMX/VSX, we don't know
which set of state (the current register values, .fp_state/.vr_state,
or .transact_fp/.transact_vr) we should be using, since we have no
way to tell if we are still in the same transaction, and if not,
whether the previous transaction succeeded or failed.
Thus it is necessary to strictly adhere to the rule that if FP has
been enabled at any point in a transaction, we must keep FP enabled
for the user process with the current transactional state in the
FP registers, until we detect that it is no longer in a transaction.
Similarly for VMX; once enabled it must stay enabled until the
process is no longer transactional.
In order to keep this rule, we add a new thread_info flag which we
test when returning from the kernel to userspace, called TIF_RESTORE_TM.
This flag indicates that there is FP/VMX/VSX state to be restored
before entering userspace, and when it is set the .tm_orig_msr field
in the thread_struct indicates what state needs to be restored.
The restoration is done by restore_tm_state(). The TIF_RESTORE_TM
bit is set by new giveup_fpu/altivec_maybe_transactional helpers,
which are called from enable_kernel_fp/altivec, giveup_vsx, and
flush_fp/altivec_to_thread instead of giveup_fpu/altivec.
The other thing to be done is to get the transactional FP/VMX/VSX
state from .fp_state/.vr_state when doing reclaim, if that state
has been saved there by giveup_fpu/altivec_maybe_transactional.
Having done this, we set the FP/VMX bit in the thread's MSR after
reclaim to indicate that that part of the state is now valid
(having been reclaimed from the processor's checkpointed state).
Finally, in the signal handling code, we move the clearing of the
transactional state bits in the thread's MSR a bit earlier, before
calling flush_fp_to_thread(), so that we don't unnecessarily set
the TIF_RESTORE_TM bit.
This is the test program:
/* Michael Neuling 4/12/2013
*
* See if the altivec state is leaked out of an aborted transaction due to
* kernel vmx copy loops.
*
* gcc -m64 htm_vmxcopy.c -o htm_vmxcopy
*
*/
/* We don't use all of these, but for reference: */
int main(int argc, char *argv[])
{
long double vecin = 1.3;
long double vecout;
unsigned long pgsize = getpagesize();
int i;
int fd;
int size = pgsize*16;
char tmpfile[] = "/tmp/page_faultXXXXXX";
char buf[pgsize];
char *a;
uint64_t aborted = 0;
fd = mkstemp(tmpfile);
assert(fd >= 0);
memset(buf, 0, pgsize);
for (i = 0; i < size; i += pgsize)
assert(write(fd, buf, pgsize) == pgsize);
unlink(tmpfile);
a = mmap(NULL, size, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd, 0);
assert(a != MAP_FAILED);
asm __volatile__(
"lxvd2x 40,0,%[vecinptr] ; " // set 40 to initial value
TBEGIN
"beq 3f ;"
TSUSPEND
"xxlxor 40,40,40 ; " // set 40 to 0
"std 5, 0(%[map]) ;" // cause kernel vmx copy page
TABORT
TRESUME
TEND
"li %[res], 0 ;"
"b 5f ;"
"3: ;" // Abort handler
"li %[res], 1 ;"
"5: ;"
"stxvd2x 40,0,%[vecoutptr] ; "
: [res]"=r"(aborted)
: [vecinptr]"r"(&vecin),
[vecoutptr]"r"(&vecout),
[map]"r"(a)
: "memory", "r0", "r3", "r4", "r5", "r6", "r7");
if (aborted && (vecin != vecout)){
printf("FAILED: vector state leaked on abort %f != %f\n",
(double)vecin, (double)vecout);
exit(1);
}
munmap(a, size);
close(fd);
printf("PASSED!\n");
return 0;
}
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2014-01-13 12:56:29 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void tm_reclaim_current(uint8_t cause)
|
|
|
|
|
{
|
|
|
|
|
tm_enable();
|
|
|
|
|
tm_reclaim_thread(¤t->thread, current_thread_info(), cause);
|
|
|
|
|
}
|
|
|
|
|
|
2013-02-14 00:21:37 +08:00
|
|
|
static inline void tm_reclaim_task(struct task_struct *tsk)
|
|
|
|
|
{
|
|
|
|
|
/* We have to work out if we're switching from/to a task that's in the
|
|
|
|
|
* middle of a transaction.
|
|
|
|
|
*
|
|
|
|
|
* In switching we need to maintain a 2nd register state as
|
|
|
|
|
* oldtask->thread.ckpt_regs. We tm_reclaim(oldproc); this saves the
|
2016-09-23 14:18:25 +08:00
|
|
|
* checkpointed (tbegin) state in ckpt_regs, ckfp_state and
|
|
|
|
|
* ckvr_state
|
2013-02-14 00:21:37 +08:00
|
|
|
*
|
|
|
|
|
* We also context switch (save) TFHAR/TEXASR/TFIAR in here.
|
|
|
|
|
*/
|
|
|
|
|
struct thread_struct *thr = &tsk->thread;
|
|
|
|
|
|
|
|
|
|
if (!thr->regs)
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
if (!MSR_TM_ACTIVE(thr->regs->msr))
|
|
|
|
|
goto out_and_saveregs;
|
|
|
|
|
|
|
|
|
|
TM_DEBUG("--- tm_reclaim on pid %d (NIP=%lx, "
|
|
|
|
|
"ccr=%lx, msr=%lx, trap=%lx)\n",
|
|
|
|
|
tsk->pid, thr->regs->nip,
|
|
|
|
|
thr->regs->ccr, thr->regs->msr,
|
|
|
|
|
thr->regs->trap);
|
|
|
|
|
|
powerpc: Don't corrupt transactional state when using FP/VMX in kernel
Currently, when we have a process using the transactional memory
facilities on POWER8 (that is, the processor is in transactional
or suspended state), and the process enters the kernel and the
kernel then uses the floating-point or vector (VMX/Altivec) facility,
we end up corrupting the user-visible FP/VMX/VSX state. This
happens, for example, if a page fault causes a copy-on-write
operation, because the copy_page function will use VMX to do the
copy on POWER8. The test program below demonstrates the bug.
The bug happens because when FP/VMX state for a transactional process
is stored in the thread_struct, we store the checkpointed state in
.fp_state/.vr_state and the transactional (current) state in
.transact_fp/.transact_vr. However, when the kernel wants to use
FP/VMX, it calls enable_kernel_fp() or enable_kernel_altivec(),
which saves the current state in .fp_state/.vr_state. Furthermore,
when we return to the user process we return with FP/VMX/VSX
disabled. The next time the process uses FP/VMX/VSX, we don't know
which set of state (the current register values, .fp_state/.vr_state,
or .transact_fp/.transact_vr) we should be using, since we have no
way to tell if we are still in the same transaction, and if not,
whether the previous transaction succeeded or failed.
Thus it is necessary to strictly adhere to the rule that if FP has
been enabled at any point in a transaction, we must keep FP enabled
for the user process with the current transactional state in the
FP registers, until we detect that it is no longer in a transaction.
Similarly for VMX; once enabled it must stay enabled until the
process is no longer transactional.
In order to keep this rule, we add a new thread_info flag which we
test when returning from the kernel to userspace, called TIF_RESTORE_TM.
This flag indicates that there is FP/VMX/VSX state to be restored
before entering userspace, and when it is set the .tm_orig_msr field
in the thread_struct indicates what state needs to be restored.
The restoration is done by restore_tm_state(). The TIF_RESTORE_TM
bit is set by new giveup_fpu/altivec_maybe_transactional helpers,
which are called from enable_kernel_fp/altivec, giveup_vsx, and
flush_fp/altivec_to_thread instead of giveup_fpu/altivec.
The other thing to be done is to get the transactional FP/VMX/VSX
state from .fp_state/.vr_state when doing reclaim, if that state
has been saved there by giveup_fpu/altivec_maybe_transactional.
Having done this, we set the FP/VMX bit in the thread's MSR after
reclaim to indicate that that part of the state is now valid
(having been reclaimed from the processor's checkpointed state).
Finally, in the signal handling code, we move the clearing of the
transactional state bits in the thread's MSR a bit earlier, before
calling flush_fp_to_thread(), so that we don't unnecessarily set
the TIF_RESTORE_TM bit.
This is the test program:
/* Michael Neuling 4/12/2013
*
* See if the altivec state is leaked out of an aborted transaction due to
* kernel vmx copy loops.
*
* gcc -m64 htm_vmxcopy.c -o htm_vmxcopy
*
*/
/* We don't use all of these, but for reference: */
int main(int argc, char *argv[])
{
long double vecin = 1.3;
long double vecout;
unsigned long pgsize = getpagesize();
int i;
int fd;
int size = pgsize*16;
char tmpfile[] = "/tmp/page_faultXXXXXX";
char buf[pgsize];
char *a;
uint64_t aborted = 0;
fd = mkstemp(tmpfile);
assert(fd >= 0);
memset(buf, 0, pgsize);
for (i = 0; i < size; i += pgsize)
assert(write(fd, buf, pgsize) == pgsize);
unlink(tmpfile);
a = mmap(NULL, size, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd, 0);
assert(a != MAP_FAILED);
asm __volatile__(
"lxvd2x 40,0,%[vecinptr] ; " // set 40 to initial value
TBEGIN
"beq 3f ;"
TSUSPEND
"xxlxor 40,40,40 ; " // set 40 to 0
"std 5, 0(%[map]) ;" // cause kernel vmx copy page
TABORT
TRESUME
TEND
"li %[res], 0 ;"
"b 5f ;"
"3: ;" // Abort handler
"li %[res], 1 ;"
"5: ;"
"stxvd2x 40,0,%[vecoutptr] ; "
: [res]"=r"(aborted)
: [vecinptr]"r"(&vecin),
[vecoutptr]"r"(&vecout),
[map]"r"(a)
: "memory", "r0", "r3", "r4", "r5", "r6", "r7");
if (aborted && (vecin != vecout)){
printf("FAILED: vector state leaked on abort %f != %f\n",
(double)vecin, (double)vecout);
exit(1);
}
munmap(a, size);
close(fd);
printf("PASSED!\n");
return 0;
}
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2014-01-13 12:56:29 +08:00
|
|
|
tm_reclaim_thread(thr, task_thread_info(tsk), TM_CAUSE_RESCHED);
|
2013-02-14 00:21:37 +08:00
|
|
|
|
|
|
|
|
TM_DEBUG("--- tm_reclaim on pid %d complete\n",
|
|
|
|
|
tsk->pid);
|
|
|
|
|
|
|
|
|
|
out_and_saveregs:
|
|
|
|
|
/* Always save the regs here, even if a transaction's not active.
|
|
|
|
|
* This context-switches a thread's TM info SPRs. We do it here to
|
|
|
|
|
* be consistent with the restore path (in recheckpoint) which
|
|
|
|
|
* cannot happen later in _switch().
|
|
|
|
|
*/
|
|
|
|
|
tm_save_sprs(thr);
|
|
|
|
|
}
|
|
|
|
|
|
2014-04-04 17:19:48 +08:00
|
|
|
extern void __tm_recheckpoint(struct thread_struct *thread,
|
|
|
|
|
unsigned long orig_msr);
|
|
|
|
|
|
|
|
|
|
void tm_recheckpoint(struct thread_struct *thread,
|
|
|
|
|
unsigned long orig_msr)
|
|
|
|
|
{
|
|
|
|
|
unsigned long flags;
|
|
|
|
|
|
2016-09-14 16:02:16 +08:00
|
|
|
if (!(thread->regs->msr & MSR_TM))
|
|
|
|
|
return;
|
|
|
|
|
|
2014-04-04 17:19:48 +08:00
|
|
|
/* We really can't be interrupted here as the TEXASR registers can't
|
|
|
|
|
* change and later in the trecheckpoint code, we have a userspace R1.
|
|
|
|
|
* So let's hard disable over this region.
|
|
|
|
|
*/
|
|
|
|
|
local_irq_save(flags);
|
|
|
|
|
hard_irq_disable();
|
|
|
|
|
|
|
|
|
|
/* The TM SPRs are restored here, so that TEXASR.FS can be set
|
|
|
|
|
* before the trecheckpoint and no explosion occurs.
|
|
|
|
|
*/
|
|
|
|
|
tm_restore_sprs(thread);
|
|
|
|
|
|
|
|
|
|
__tm_recheckpoint(thread, orig_msr);
|
|
|
|
|
|
|
|
|
|
local_irq_restore(flags);
|
|
|
|
|
}
|
|
|
|
|
|
2013-02-14 00:21:40 +08:00
|
|
|
static inline void tm_recheckpoint_new_task(struct task_struct *new)
|
2013-02-14 00:21:37 +08:00
|
|
|
{
|
|
|
|
|
unsigned long msr;
|
|
|
|
|
|
|
|
|
|
if (!cpu_has_feature(CPU_FTR_TM))
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
/* Recheckpoint the registers of the thread we're about to switch to.
|
|
|
|
|
*
|
|
|
|
|
* If the task was using FP, we non-lazily reload both the original and
|
|
|
|
|
* the speculative FP register states. This is because the kernel
|
|
|
|
|
* doesn't see if/when a TM rollback occurs, so if we take an FP
|
2016-09-23 14:18:24 +08:00
|
|
|
* unavailable later, we are unable to determine which set of FP regs
|
2013-02-14 00:21:37 +08:00
|
|
|
* need to be restored.
|
|
|
|
|
*/
|
2016-09-14 16:02:16 +08:00
|
|
|
if (!tm_enabled(new))
|
2013-02-14 00:21:37 +08:00
|
|
|
return;
|
|
|
|
|
|
2014-04-04 17:19:48 +08:00
|
|
|
if (!MSR_TM_ACTIVE(new->thread.regs->msr)){
|
|
|
|
|
tm_restore_sprs(&new->thread);
|
2013-02-14 00:21:37 +08:00
|
|
|
return;
|
2014-04-04 17:19:48 +08:00
|
|
|
}
|
2015-07-06 18:54:10 +08:00
|
|
|
msr = new->thread.ckpt_regs.msr;
|
2013-02-14 00:21:37 +08:00
|
|
|
/* Recheckpoint to restore original checkpointed register state. */
|
|
|
|
|
TM_DEBUG("*** tm_recheckpoint of pid %d "
|
|
|
|
|
"(new->msr 0x%lx, new->origmsr 0x%lx)\n",
|
|
|
|
|
new->pid, new->thread.regs->msr, msr);
|
|
|
|
|
|
|
|
|
|
tm_recheckpoint(&new->thread, msr);
|
|
|
|
|
|
2016-09-23 14:18:24 +08:00
|
|
|
/*
|
|
|
|
|
* The checkpointed state has been restored but the live state has
|
|
|
|
|
* not, ensure all the math functionality is turned off to trigger
|
|
|
|
|
* restore_math() to reload.
|
|
|
|
|
*/
|
|
|
|
|
new->thread.regs->msr &= ~(MSR_FP | MSR_VEC | MSR_VSX);
|
2013-02-14 00:21:37 +08:00
|
|
|
|
|
|
|
|
TM_DEBUG("*** tm_recheckpoint of pid %d complete "
|
|
|
|
|
"(kernel msr 0x%lx)\n",
|
|
|
|
|
new->pid, mfmsr());
|
|
|
|
|
}
|
|
|
|
|
|
2016-09-23 14:18:24 +08:00
|
|
|
static inline void __switch_to_tm(struct task_struct *prev,
|
|
|
|
|
struct task_struct *new)
|
2013-02-14 00:21:37 +08:00
|
|
|
{
|
|
|
|
|
if (cpu_has_feature(CPU_FTR_TM)) {
|
2016-09-14 16:02:16 +08:00
|
|
|
if (tm_enabled(prev) || tm_enabled(new))
|
|
|
|
|
tm_enable();
|
|
|
|
|
|
|
|
|
|
if (tm_enabled(prev)) {
|
|
|
|
|
prev->thread.load_tm++;
|
|
|
|
|
tm_reclaim_task(prev);
|
|
|
|
|
if (!MSR_TM_ACTIVE(prev->thread.regs->msr) && prev->thread.load_tm == 0)
|
|
|
|
|
prev->thread.regs->msr &= ~MSR_TM;
|
|
|
|
|
}
|
|
|
|
|
|
2016-09-23 14:18:24 +08:00
|
|
|
tm_recheckpoint_new_task(new);
|
2013-02-14 00:21:37 +08:00
|
|
|
}
|
|
|
|
|
}
|
powerpc: Don't corrupt transactional state when using FP/VMX in kernel
Currently, when we have a process using the transactional memory
facilities on POWER8 (that is, the processor is in transactional
or suspended state), and the process enters the kernel and the
kernel then uses the floating-point or vector (VMX/Altivec) facility,
we end up corrupting the user-visible FP/VMX/VSX state. This
happens, for example, if a page fault causes a copy-on-write
operation, because the copy_page function will use VMX to do the
copy on POWER8. The test program below demonstrates the bug.
The bug happens because when FP/VMX state for a transactional process
is stored in the thread_struct, we store the checkpointed state in
.fp_state/.vr_state and the transactional (current) state in
.transact_fp/.transact_vr. However, when the kernel wants to use
FP/VMX, it calls enable_kernel_fp() or enable_kernel_altivec(),
which saves the current state in .fp_state/.vr_state. Furthermore,
when we return to the user process we return with FP/VMX/VSX
disabled. The next time the process uses FP/VMX/VSX, we don't know
which set of state (the current register values, .fp_state/.vr_state,
or .transact_fp/.transact_vr) we should be using, since we have no
way to tell if we are still in the same transaction, and if not,
whether the previous transaction succeeded or failed.
Thus it is necessary to strictly adhere to the rule that if FP has
been enabled at any point in a transaction, we must keep FP enabled
for the user process with the current transactional state in the
FP registers, until we detect that it is no longer in a transaction.
Similarly for VMX; once enabled it must stay enabled until the
process is no longer transactional.
In order to keep this rule, we add a new thread_info flag which we
test when returning from the kernel to userspace, called TIF_RESTORE_TM.
This flag indicates that there is FP/VMX/VSX state to be restored
before entering userspace, and when it is set the .tm_orig_msr field
in the thread_struct indicates what state needs to be restored.
The restoration is done by restore_tm_state(). The TIF_RESTORE_TM
bit is set by new giveup_fpu/altivec_maybe_transactional helpers,
which are called from enable_kernel_fp/altivec, giveup_vsx, and
flush_fp/altivec_to_thread instead of giveup_fpu/altivec.
The other thing to be done is to get the transactional FP/VMX/VSX
state from .fp_state/.vr_state when doing reclaim, if that state
has been saved there by giveup_fpu/altivec_maybe_transactional.
Having done this, we set the FP/VMX bit in the thread's MSR after
reclaim to indicate that that part of the state is now valid
(having been reclaimed from the processor's checkpointed state).
Finally, in the signal handling code, we move the clearing of the
transactional state bits in the thread's MSR a bit earlier, before
calling flush_fp_to_thread(), so that we don't unnecessarily set
the TIF_RESTORE_TM bit.
This is the test program:
/* Michael Neuling 4/12/2013
*
* See if the altivec state is leaked out of an aborted transaction due to
* kernel vmx copy loops.
*
* gcc -m64 htm_vmxcopy.c -o htm_vmxcopy
*
*/
/* We don't use all of these, but for reference: */
int main(int argc, char *argv[])
{
long double vecin = 1.3;
long double vecout;
unsigned long pgsize = getpagesize();
int i;
int fd;
int size = pgsize*16;
char tmpfile[] = "/tmp/page_faultXXXXXX";
char buf[pgsize];
char *a;
uint64_t aborted = 0;
fd = mkstemp(tmpfile);
assert(fd >= 0);
memset(buf, 0, pgsize);
for (i = 0; i < size; i += pgsize)
assert(write(fd, buf, pgsize) == pgsize);
unlink(tmpfile);
a = mmap(NULL, size, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd, 0);
assert(a != MAP_FAILED);
asm __volatile__(
"lxvd2x 40,0,%[vecinptr] ; " // set 40 to initial value
TBEGIN
"beq 3f ;"
TSUSPEND
"xxlxor 40,40,40 ; " // set 40 to 0
"std 5, 0(%[map]) ;" // cause kernel vmx copy page
TABORT
TRESUME
TEND
"li %[res], 0 ;"
"b 5f ;"
"3: ;" // Abort handler
"li %[res], 1 ;"
"5: ;"
"stxvd2x 40,0,%[vecoutptr] ; "
: [res]"=r"(aborted)
: [vecinptr]"r"(&vecin),
[vecoutptr]"r"(&vecout),
[map]"r"(a)
: "memory", "r0", "r3", "r4", "r5", "r6", "r7");
if (aborted && (vecin != vecout)){
printf("FAILED: vector state leaked on abort %f != %f\n",
(double)vecin, (double)vecout);
exit(1);
}
munmap(a, size);
close(fd);
printf("PASSED!\n");
return 0;
}
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2014-01-13 12:56:29 +08:00
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* This is called if we are on the way out to userspace and the
|
|
|
|
|
* TIF_RESTORE_TM flag is set. It checks if we need to reload
|
|
|
|
|
* FP and/or vector state and does so if necessary.
|
|
|
|
|
* If userspace is inside a transaction (whether active or
|
|
|
|
|
* suspended) and FP/VMX/VSX instructions have ever been enabled
|
|
|
|
|
* inside that transaction, then we have to keep them enabled
|
|
|
|
|
* and keep the FP/VMX/VSX state loaded while ever the transaction
|
|
|
|
|
* continues. The reason is that if we didn't, and subsequently
|
|
|
|
|
* got a FP/VMX/VSX unavailable interrupt inside a transaction,
|
|
|
|
|
* we don't know whether it's the same transaction, and thus we
|
|
|
|
|
* don't know which of the checkpointed state and the transactional
|
|
|
|
|
* state to use.
|
|
|
|
|
*/
|
|
|
|
|
void restore_tm_state(struct pt_regs *regs)
|
|
|
|
|
{
|
|
|
|
|
unsigned long msr_diff;
|
|
|
|
|
|
2016-09-23 14:18:24 +08:00
|
|
|
/*
|
|
|
|
|
* This is the only moment we should clear TIF_RESTORE_TM as
|
|
|
|
|
* it is here that ckpt_regs.msr and pt_regs.msr become the same
|
|
|
|
|
* again, anything else could lead to an incorrect ckpt_msr being
|
|
|
|
|
* saved and therefore incorrect signal contexts.
|
|
|
|
|
*/
|
powerpc: Don't corrupt transactional state when using FP/VMX in kernel
Currently, when we have a process using the transactional memory
facilities on POWER8 (that is, the processor is in transactional
or suspended state), and the process enters the kernel and the
kernel then uses the floating-point or vector (VMX/Altivec) facility,
we end up corrupting the user-visible FP/VMX/VSX state. This
happens, for example, if a page fault causes a copy-on-write
operation, because the copy_page function will use VMX to do the
copy on POWER8. The test program below demonstrates the bug.
The bug happens because when FP/VMX state for a transactional process
is stored in the thread_struct, we store the checkpointed state in
.fp_state/.vr_state and the transactional (current) state in
.transact_fp/.transact_vr. However, when the kernel wants to use
FP/VMX, it calls enable_kernel_fp() or enable_kernel_altivec(),
which saves the current state in .fp_state/.vr_state. Furthermore,
when we return to the user process we return with FP/VMX/VSX
disabled. The next time the process uses FP/VMX/VSX, we don't know
which set of state (the current register values, .fp_state/.vr_state,
or .transact_fp/.transact_vr) we should be using, since we have no
way to tell if we are still in the same transaction, and if not,
whether the previous transaction succeeded or failed.
Thus it is necessary to strictly adhere to the rule that if FP has
been enabled at any point in a transaction, we must keep FP enabled
for the user process with the current transactional state in the
FP registers, until we detect that it is no longer in a transaction.
Similarly for VMX; once enabled it must stay enabled until the
process is no longer transactional.
In order to keep this rule, we add a new thread_info flag which we
test when returning from the kernel to userspace, called TIF_RESTORE_TM.
This flag indicates that there is FP/VMX/VSX state to be restored
before entering userspace, and when it is set the .tm_orig_msr field
in the thread_struct indicates what state needs to be restored.
The restoration is done by restore_tm_state(). The TIF_RESTORE_TM
bit is set by new giveup_fpu/altivec_maybe_transactional helpers,
which are called from enable_kernel_fp/altivec, giveup_vsx, and
flush_fp/altivec_to_thread instead of giveup_fpu/altivec.
The other thing to be done is to get the transactional FP/VMX/VSX
state from .fp_state/.vr_state when doing reclaim, if that state
has been saved there by giveup_fpu/altivec_maybe_transactional.
Having done this, we set the FP/VMX bit in the thread's MSR after
reclaim to indicate that that part of the state is now valid
(having been reclaimed from the processor's checkpointed state).
Finally, in the signal handling code, we move the clearing of the
transactional state bits in the thread's MSR a bit earlier, before
calling flush_fp_to_thread(), so that we don't unnecessarily set
the TIF_RESTORE_TM bit.
This is the test program:
/* Michael Neuling 4/12/2013
*
* See if the altivec state is leaked out of an aborted transaction due to
* kernel vmx copy loops.
*
* gcc -m64 htm_vmxcopy.c -o htm_vmxcopy
*
*/
/* We don't use all of these, but for reference: */
int main(int argc, char *argv[])
{
long double vecin = 1.3;
long double vecout;
unsigned long pgsize = getpagesize();
int i;
int fd;
int size = pgsize*16;
char tmpfile[] = "/tmp/page_faultXXXXXX";
char buf[pgsize];
char *a;
uint64_t aborted = 0;
fd = mkstemp(tmpfile);
assert(fd >= 0);
memset(buf, 0, pgsize);
for (i = 0; i < size; i += pgsize)
assert(write(fd, buf, pgsize) == pgsize);
unlink(tmpfile);
a = mmap(NULL, size, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd, 0);
assert(a != MAP_FAILED);
asm __volatile__(
"lxvd2x 40,0,%[vecinptr] ; " // set 40 to initial value
TBEGIN
"beq 3f ;"
TSUSPEND
"xxlxor 40,40,40 ; " // set 40 to 0
"std 5, 0(%[map]) ;" // cause kernel vmx copy page
TABORT
TRESUME
TEND
"li %[res], 0 ;"
"b 5f ;"
"3: ;" // Abort handler
"li %[res], 1 ;"
"5: ;"
"stxvd2x 40,0,%[vecoutptr] ; "
: [res]"=r"(aborted)
: [vecinptr]"r"(&vecin),
[vecoutptr]"r"(&vecout),
[map]"r"(a)
: "memory", "r0", "r3", "r4", "r5", "r6", "r7");
if (aborted && (vecin != vecout)){
printf("FAILED: vector state leaked on abort %f != %f\n",
(double)vecin, (double)vecout);
exit(1);
}
munmap(a, size);
close(fd);
printf("PASSED!\n");
return 0;
}
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2014-01-13 12:56:29 +08:00
|
|
|
clear_thread_flag(TIF_RESTORE_TM);
|
|
|
|
|
if (!MSR_TM_ACTIVE(regs->msr))
|
|
|
|
|
return;
|
|
|
|
|
|
2015-07-06 18:54:10 +08:00
|
|
|
msr_diff = current->thread.ckpt_regs.msr & ~regs->msr;
|
powerpc: Don't corrupt transactional state when using FP/VMX in kernel
Currently, when we have a process using the transactional memory
facilities on POWER8 (that is, the processor is in transactional
or suspended state), and the process enters the kernel and the
kernel then uses the floating-point or vector (VMX/Altivec) facility,
we end up corrupting the user-visible FP/VMX/VSX state. This
happens, for example, if a page fault causes a copy-on-write
operation, because the copy_page function will use VMX to do the
copy on POWER8. The test program below demonstrates the bug.
The bug happens because when FP/VMX state for a transactional process
is stored in the thread_struct, we store the checkpointed state in
.fp_state/.vr_state and the transactional (current) state in
.transact_fp/.transact_vr. However, when the kernel wants to use
FP/VMX, it calls enable_kernel_fp() or enable_kernel_altivec(),
which saves the current state in .fp_state/.vr_state. Furthermore,
when we return to the user process we return with FP/VMX/VSX
disabled. The next time the process uses FP/VMX/VSX, we don't know
which set of state (the current register values, .fp_state/.vr_state,
or .transact_fp/.transact_vr) we should be using, since we have no
way to tell if we are still in the same transaction, and if not,
whether the previous transaction succeeded or failed.
Thus it is necessary to strictly adhere to the rule that if FP has
been enabled at any point in a transaction, we must keep FP enabled
for the user process with the current transactional state in the
FP registers, until we detect that it is no longer in a transaction.
Similarly for VMX; once enabled it must stay enabled until the
process is no longer transactional.
In order to keep this rule, we add a new thread_info flag which we
test when returning from the kernel to userspace, called TIF_RESTORE_TM.
This flag indicates that there is FP/VMX/VSX state to be restored
before entering userspace, and when it is set the .tm_orig_msr field
in the thread_struct indicates what state needs to be restored.
The restoration is done by restore_tm_state(). The TIF_RESTORE_TM
bit is set by new giveup_fpu/altivec_maybe_transactional helpers,
which are called from enable_kernel_fp/altivec, giveup_vsx, and
flush_fp/altivec_to_thread instead of giveup_fpu/altivec.
The other thing to be done is to get the transactional FP/VMX/VSX
state from .fp_state/.vr_state when doing reclaim, if that state
has been saved there by giveup_fpu/altivec_maybe_transactional.
Having done this, we set the FP/VMX bit in the thread's MSR after
reclaim to indicate that that part of the state is now valid
(having been reclaimed from the processor's checkpointed state).
Finally, in the signal handling code, we move the clearing of the
transactional state bits in the thread's MSR a bit earlier, before
calling flush_fp_to_thread(), so that we don't unnecessarily set
the TIF_RESTORE_TM bit.
This is the test program:
/* Michael Neuling 4/12/2013
*
* See if the altivec state is leaked out of an aborted transaction due to
* kernel vmx copy loops.
*
* gcc -m64 htm_vmxcopy.c -o htm_vmxcopy
*
*/
/* We don't use all of these, but for reference: */
int main(int argc, char *argv[])
{
long double vecin = 1.3;
long double vecout;
unsigned long pgsize = getpagesize();
int i;
int fd;
int size = pgsize*16;
char tmpfile[] = "/tmp/page_faultXXXXXX";
char buf[pgsize];
char *a;
uint64_t aborted = 0;
fd = mkstemp(tmpfile);
assert(fd >= 0);
memset(buf, 0, pgsize);
for (i = 0; i < size; i += pgsize)
assert(write(fd, buf, pgsize) == pgsize);
unlink(tmpfile);
a = mmap(NULL, size, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd, 0);
assert(a != MAP_FAILED);
asm __volatile__(
"lxvd2x 40,0,%[vecinptr] ; " // set 40 to initial value
TBEGIN
"beq 3f ;"
TSUSPEND
"xxlxor 40,40,40 ; " // set 40 to 0
"std 5, 0(%[map]) ;" // cause kernel vmx copy page
TABORT
TRESUME
TEND
"li %[res], 0 ;"
"b 5f ;"
"3: ;" // Abort handler
"li %[res], 1 ;"
"5: ;"
"stxvd2x 40,0,%[vecoutptr] ; "
: [res]"=r"(aborted)
: [vecinptr]"r"(&vecin),
[vecoutptr]"r"(&vecout),
[map]"r"(a)
: "memory", "r0", "r3", "r4", "r5", "r6", "r7");
if (aborted && (vecin != vecout)){
printf("FAILED: vector state leaked on abort %f != %f\n",
(double)vecin, (double)vecout);
exit(1);
}
munmap(a, size);
close(fd);
printf("PASSED!\n");
return 0;
}
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2014-01-13 12:56:29 +08:00
|
|
|
msr_diff &= MSR_FP | MSR_VEC | MSR_VSX;
|
2016-02-29 14:53:47 +08:00
|
|
|
|
2016-09-23 14:18:08 +08:00
|
|
|
/* Ensure that restore_math() will restore */
|
|
|
|
|
if (msr_diff & MSR_FP)
|
|
|
|
|
current->thread.load_fp = 1;
|
2016-10-05 13:57:26 +08:00
|
|
|
#ifdef CONFIG_ALTIVEC
|
2016-09-23 14:18:08 +08:00
|
|
|
if (cpu_has_feature(CPU_FTR_ALTIVEC) && msr_diff & MSR_VEC)
|
|
|
|
|
current->thread.load_vec = 1;
|
|
|
|
|
#endif
|
2016-02-29 14:53:47 +08:00
|
|
|
restore_math(regs);
|
|
|
|
|
|
powerpc: Don't corrupt transactional state when using FP/VMX in kernel
Currently, when we have a process using the transactional memory
facilities on POWER8 (that is, the processor is in transactional
or suspended state), and the process enters the kernel and the
kernel then uses the floating-point or vector (VMX/Altivec) facility,
we end up corrupting the user-visible FP/VMX/VSX state. This
happens, for example, if a page fault causes a copy-on-write
operation, because the copy_page function will use VMX to do the
copy on POWER8. The test program below demonstrates the bug.
The bug happens because when FP/VMX state for a transactional process
is stored in the thread_struct, we store the checkpointed state in
.fp_state/.vr_state and the transactional (current) state in
.transact_fp/.transact_vr. However, when the kernel wants to use
FP/VMX, it calls enable_kernel_fp() or enable_kernel_altivec(),
which saves the current state in .fp_state/.vr_state. Furthermore,
when we return to the user process we return with FP/VMX/VSX
disabled. The next time the process uses FP/VMX/VSX, we don't know
which set of state (the current register values, .fp_state/.vr_state,
or .transact_fp/.transact_vr) we should be using, since we have no
way to tell if we are still in the same transaction, and if not,
whether the previous transaction succeeded or failed.
Thus it is necessary to strictly adhere to the rule that if FP has
been enabled at any point in a transaction, we must keep FP enabled
for the user process with the current transactional state in the
FP registers, until we detect that it is no longer in a transaction.
Similarly for VMX; once enabled it must stay enabled until the
process is no longer transactional.
In order to keep this rule, we add a new thread_info flag which we
test when returning from the kernel to userspace, called TIF_RESTORE_TM.
This flag indicates that there is FP/VMX/VSX state to be restored
before entering userspace, and when it is set the .tm_orig_msr field
in the thread_struct indicates what state needs to be restored.
The restoration is done by restore_tm_state(). The TIF_RESTORE_TM
bit is set by new giveup_fpu/altivec_maybe_transactional helpers,
which are called from enable_kernel_fp/altivec, giveup_vsx, and
flush_fp/altivec_to_thread instead of giveup_fpu/altivec.
The other thing to be done is to get the transactional FP/VMX/VSX
state from .fp_state/.vr_state when doing reclaim, if that state
has been saved there by giveup_fpu/altivec_maybe_transactional.
Having done this, we set the FP/VMX bit in the thread's MSR after
reclaim to indicate that that part of the state is now valid
(having been reclaimed from the processor's checkpointed state).
Finally, in the signal handling code, we move the clearing of the
transactional state bits in the thread's MSR a bit earlier, before
calling flush_fp_to_thread(), so that we don't unnecessarily set
the TIF_RESTORE_TM bit.
This is the test program:
/* Michael Neuling 4/12/2013
*
* See if the altivec state is leaked out of an aborted transaction due to
* kernel vmx copy loops.
*
* gcc -m64 htm_vmxcopy.c -o htm_vmxcopy
*
*/
/* We don't use all of these, but for reference: */
int main(int argc, char *argv[])
{
long double vecin = 1.3;
long double vecout;
unsigned long pgsize = getpagesize();
int i;
int fd;
int size = pgsize*16;
char tmpfile[] = "/tmp/page_faultXXXXXX";
char buf[pgsize];
char *a;
uint64_t aborted = 0;
fd = mkstemp(tmpfile);
assert(fd >= 0);
memset(buf, 0, pgsize);
for (i = 0; i < size; i += pgsize)
assert(write(fd, buf, pgsize) == pgsize);
unlink(tmpfile);
a = mmap(NULL, size, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd, 0);
assert(a != MAP_FAILED);
asm __volatile__(
"lxvd2x 40,0,%[vecinptr] ; " // set 40 to initial value
TBEGIN
"beq 3f ;"
TSUSPEND
"xxlxor 40,40,40 ; " // set 40 to 0
"std 5, 0(%[map]) ;" // cause kernel vmx copy page
TABORT
TRESUME
TEND
"li %[res], 0 ;"
"b 5f ;"
"3: ;" // Abort handler
"li %[res], 1 ;"
"5: ;"
"stxvd2x 40,0,%[vecoutptr] ; "
: [res]"=r"(aborted)
: [vecinptr]"r"(&vecin),
[vecoutptr]"r"(&vecout),
[map]"r"(a)
: "memory", "r0", "r3", "r4", "r5", "r6", "r7");
if (aborted && (vecin != vecout)){
printf("FAILED: vector state leaked on abort %f != %f\n",
(double)vecin, (double)vecout);
exit(1);
}
munmap(a, size);
close(fd);
printf("PASSED!\n");
return 0;
}
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2014-01-13 12:56:29 +08:00
|
|
|
regs->msr |= msr_diff;
|
|
|
|
|
}
|
|
|
|
|
|
2013-02-14 00:21:37 +08:00
|
|
|
#else
|
|
|
|
|
#define tm_recheckpoint_new_task(new)
|
2016-09-23 14:18:24 +08:00
|
|
|
#define __switch_to_tm(prev, new)
|
2013-02-14 00:21:37 +08:00
|
|
|
#endif /* CONFIG_PPC_TRANSACTIONAL_MEM */
|
2012-12-20 22:06:44 +08:00
|
|
|
|
2015-10-29 08:43:55 +08:00
|
|
|
static inline void save_sprs(struct thread_struct *t)
|
|
|
|
|
{
|
|
|
|
|
#ifdef CONFIG_ALTIVEC
|
2016-03-08 06:08:47 +08:00
|
|
|
if (cpu_has_feature(CPU_FTR_ALTIVEC))
|
2015-10-29 08:43:55 +08:00
|
|
|
t->vrsave = mfspr(SPRN_VRSAVE);
|
|
|
|
|
#endif
|
|
|
|
|
#ifdef CONFIG_PPC_BOOK3S_64
|
|
|
|
|
if (cpu_has_feature(CPU_FTR_DSCR))
|
|
|
|
|
t->dscr = mfspr(SPRN_DSCR);
|
|
|
|
|
|
|
|
|
|
if (cpu_has_feature(CPU_FTR_ARCH_207S)) {
|
|
|
|
|
t->bescr = mfspr(SPRN_BESCR);
|
|
|
|
|
t->ebbhr = mfspr(SPRN_EBBHR);
|
|
|
|
|
t->ebbrr = mfspr(SPRN_EBBRR);
|
|
|
|
|
|
|
|
|
|
t->fscr = mfspr(SPRN_FSCR);
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Note that the TAR is not available for use in the kernel.
|
|
|
|
|
* (To provide this, the TAR should be backed up/restored on
|
|
|
|
|
* exception entry/exit instead, and be in pt_regs. FIXME,
|
|
|
|
|
* this should be in pt_regs anyway (for debug).)
|
|
|
|
|
*/
|
|
|
|
|
t->tar = mfspr(SPRN_TAR);
|
|
|
|
|
}
|
|
|
|
|
#endif
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static inline void restore_sprs(struct thread_struct *old_thread,
|
|
|
|
|
struct thread_struct *new_thread)
|
|
|
|
|
{
|
|
|
|
|
#ifdef CONFIG_ALTIVEC
|
|
|
|
|
if (cpu_has_feature(CPU_FTR_ALTIVEC) &&
|
|
|
|
|
old_thread->vrsave != new_thread->vrsave)
|
|
|
|
|
mtspr(SPRN_VRSAVE, new_thread->vrsave);
|
|
|
|
|
#endif
|
|
|
|
|
#ifdef CONFIG_PPC_BOOK3S_64
|
|
|
|
|
if (cpu_has_feature(CPU_FTR_DSCR)) {
|
|
|
|
|
u64 dscr = get_paca()->dscr_default;
|
2016-06-09 10:31:08 +08:00
|
|
|
if (new_thread->dscr_inherit)
|
2015-10-29 08:43:55 +08:00
|
|
|
dscr = new_thread->dscr;
|
|
|
|
|
|
|
|
|
|
if (old_thread->dscr != dscr)
|
|
|
|
|
mtspr(SPRN_DSCR, dscr);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (cpu_has_feature(CPU_FTR_ARCH_207S)) {
|
|
|
|
|
if (old_thread->bescr != new_thread->bescr)
|
|
|
|
|
mtspr(SPRN_BESCR, new_thread->bescr);
|
|
|
|
|
if (old_thread->ebbhr != new_thread->ebbhr)
|
|
|
|
|
mtspr(SPRN_EBBHR, new_thread->ebbhr);
|
|
|
|
|
if (old_thread->ebbrr != new_thread->ebbrr)
|
|
|
|
|
mtspr(SPRN_EBBRR, new_thread->ebbrr);
|
|
|
|
|
|
2016-06-09 10:31:08 +08:00
|
|
|
if (old_thread->fscr != new_thread->fscr)
|
|
|
|
|
mtspr(SPRN_FSCR, new_thread->fscr);
|
|
|
|
|
|
2015-10-29 08:43:55 +08:00
|
|
|
if (old_thread->tar != new_thread->tar)
|
|
|
|
|
mtspr(SPRN_TAR, new_thread->tar);
|
|
|
|
|
}
|
|
|
|
|
#endif
|
|
|
|
|
}
|
|
|
|
|
|
2005-09-26 14:04:21 +08:00
|
|
|
struct task_struct *__switch_to(struct task_struct *prev,
|
|
|
|
|
struct task_struct *new)
|
|
|
|
|
{
|
|
|
|
|
struct thread_struct *new_thread, *old_thread;
|
|
|
|
|
struct task_struct *last;
|
2011-05-25 08:11:48 +08:00
|
|
|
#ifdef CONFIG_PPC_BOOK3S_64
|
|
|
|
|
struct ppc64_tlb_batch *batch;
|
|
|
|
|
#endif
|
2005-09-26 14:04:21 +08:00
|
|
|
|
2015-10-29 08:43:55 +08:00
|
|
|
new_thread = &new->thread;
|
|
|
|
|
old_thread = ¤t->thread;
|
|
|
|
|
|
2013-10-02 15:15:14 +08:00
|
|
|
WARN_ON(!irqs_disabled());
|
|
|
|
|
|
2005-10-10 20:29:05 +08:00
|
|
|
#ifdef CONFIG_PPC64
|
|
|
|
|
/*
|
|
|
|
|
* Collect processor utilization data per process
|
|
|
|
|
*/
|
|
|
|
|
if (firmware_has_feature(FW_FEATURE_SPLPAR)) {
|
powerpc: Replace __get_cpu_var uses
This still has not been merged and now powerpc is the only arch that does
not have this change. Sorry about missing linuxppc-dev before.
V2->V2
- Fix up to work against 3.18-rc1
__get_cpu_var() is used for multiple purposes in the kernel source. One of
them is address calculation via the form &__get_cpu_var(x). This calculates
the address for the instance of the percpu variable of the current processor
based on an offset.
Other use cases are for storing and retrieving data from the current
processors percpu area. __get_cpu_var() can be used as an lvalue when
writing data or on the right side of an assignment.
__get_cpu_var() is defined as :
__get_cpu_var() always only does an address determination. However, store
and retrieve operations could use a segment prefix (or global register on
other platforms) to avoid the address calculation.
this_cpu_write() and this_cpu_read() can directly take an offset into a
percpu area and use optimized assembly code to read and write per cpu
variables.
This patch converts __get_cpu_var into either an explicit address
calculation using this_cpu_ptr() or into a use of this_cpu operations that
use the offset. Thereby address calculations are avoided and less registers
are used when code is generated.
At the end of the patch set all uses of __get_cpu_var have been removed so
the macro is removed too.
The patch set includes passes over all arches as well. Once these operations
are used throughout then specialized macros can be defined in non -x86
arches as well in order to optimize per cpu access by f.e. using a global
register that may be set to the per cpu base.
Transformations done to __get_cpu_var()
1. Determine the address of the percpu instance of the current processor.
DEFINE_PER_CPU(int, y);
int *x = &__get_cpu_var(y);
Converts to
int *x = this_cpu_ptr(&y);
2. Same as #1 but this time an array structure is involved.
DEFINE_PER_CPU(int, y[20]);
int *x = __get_cpu_var(y);
Converts to
int *x = this_cpu_ptr(y);
3. Retrieve the content of the current processors instance of a per cpu
variable.
DEFINE_PER_CPU(int, y);
int x = __get_cpu_var(y)
Converts to
int x = __this_cpu_read(y);
4. Retrieve the content of a percpu struct
DEFINE_PER_CPU(struct mystruct, y);
struct mystruct x = __get_cpu_var(y);
Converts to
memcpy(&x, this_cpu_ptr(&y), sizeof(x));
5. Assignment to a per cpu variable
DEFINE_PER_CPU(int, y)
__get_cpu_var(y) = x;
Converts to
__this_cpu_write(y, x);
6. Increment/Decrement etc of a per cpu variable
DEFINE_PER_CPU(int, y);
__get_cpu_var(y)++
Converts to
__this_cpu_inc(y)
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
CC: Paul Mackerras <paulus@samba.org>
Signed-off-by: Christoph Lameter <cl@linux.com>
[mpe: Fix build errors caused by set/or_softirq_pending(), and rework
assignment in __set_breakpoint() to use memcpy().]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2014-10-22 04:23:25 +08:00
|
|
|
struct cpu_usage *cu = this_cpu_ptr(&cpu_usage_array);
|
2005-10-10 20:29:05 +08:00
|
|
|
long unsigned start_tb, current_tb;
|
|
|
|
|
start_tb = old_thread->start_tb;
|
|
|
|
|
cu->current_tb = current_tb = mfspr(SPRN_PURR);
|
|
|
|
|
old_thread->accum_tb += (current_tb - start_tb);
|
|
|
|
|
new_thread->start_tb = current_tb;
|
|
|
|
|
}
|
2011-05-25 08:11:48 +08:00
|
|
|
#endif /* CONFIG_PPC64 */
|
|
|
|
|
|
2016-04-29 21:26:07 +08:00
|
|
|
#ifdef CONFIG_PPC_STD_MMU_64
|
powerpc: Replace __get_cpu_var uses
This still has not been merged and now powerpc is the only arch that does
not have this change. Sorry about missing linuxppc-dev before.
V2->V2
- Fix up to work against 3.18-rc1
__get_cpu_var() is used for multiple purposes in the kernel source. One of
them is address calculation via the form &__get_cpu_var(x). This calculates
the address for the instance of the percpu variable of the current processor
based on an offset.
Other use cases are for storing and retrieving data from the current
processors percpu area. __get_cpu_var() can be used as an lvalue when
writing data or on the right side of an assignment.
__get_cpu_var() is defined as :
__get_cpu_var() always only does an address determination. However, store
and retrieve operations could use a segment prefix (or global register on
other platforms) to avoid the address calculation.
this_cpu_write() and this_cpu_read() can directly take an offset into a
percpu area and use optimized assembly code to read and write per cpu
variables.
This patch converts __get_cpu_var into either an explicit address
calculation using this_cpu_ptr() or into a use of this_cpu operations that
use the offset. Thereby address calculations are avoided and less registers
are used when code is generated.
At the end of the patch set all uses of __get_cpu_var have been removed so
the macro is removed too.
The patch set includes passes over all arches as well. Once these operations
are used throughout then specialized macros can be defined in non -x86
arches as well in order to optimize per cpu access by f.e. using a global
register that may be set to the per cpu base.
Transformations done to __get_cpu_var()
1. Determine the address of the percpu instance of the current processor.
DEFINE_PER_CPU(int, y);
int *x = &__get_cpu_var(y);
Converts to
int *x = this_cpu_ptr(&y);
2. Same as #1 but this time an array structure is involved.
DEFINE_PER_CPU(int, y[20]);
int *x = __get_cpu_var(y);
Converts to
int *x = this_cpu_ptr(y);
3. Retrieve the content of the current processors instance of a per cpu
variable.
DEFINE_PER_CPU(int, y);
int x = __get_cpu_var(y)
Converts to
int x = __this_cpu_read(y);
4. Retrieve the content of a percpu struct
DEFINE_PER_CPU(struct mystruct, y);
struct mystruct x = __get_cpu_var(y);
Converts to
memcpy(&x, this_cpu_ptr(&y), sizeof(x));
5. Assignment to a per cpu variable
DEFINE_PER_CPU(int, y)
__get_cpu_var(y) = x;
Converts to
__this_cpu_write(y, x);
6. Increment/Decrement etc of a per cpu variable
DEFINE_PER_CPU(int, y);
__get_cpu_var(y)++
Converts to
__this_cpu_inc(y)
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
CC: Paul Mackerras <paulus@samba.org>
Signed-off-by: Christoph Lameter <cl@linux.com>
[mpe: Fix build errors caused by set/or_softirq_pending(), and rework
assignment in __set_breakpoint() to use memcpy().]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2014-10-22 04:23:25 +08:00
|
|
|
batch = this_cpu_ptr(&ppc64_tlb_batch);
|
2011-05-25 08:11:48 +08:00
|
|
|
if (batch->active) {
|
|
|
|
|
current_thread_info()->local_flags |= _TLF_LAZY_MMU;
|
|
|
|
|
if (batch->index)
|
|
|
|
|
__flush_tlb_pending(batch);
|
|
|
|
|
batch->active = 0;
|
|
|
|
|
}
|
2016-04-29 21:26:07 +08:00
|
|
|
#endif /* CONFIG_PPC_STD_MMU_64 */
|
2005-10-10 20:29:05 +08:00
|
|
|
|
2015-10-29 08:44:10 +08:00
|
|
|
#ifdef CONFIG_PPC_ADV_DEBUG_REGS
|
|
|
|
|
switch_booke_debug_regs(&new->thread.debug);
|
|
|
|
|
#else
|
|
|
|
|
/*
|
|
|
|
|
* For PPC_BOOK3S_64, we use the hw-breakpoint interfaces that would
|
|
|
|
|
* schedule DABR
|
|
|
|
|
*/
|
|
|
|
|
#ifndef CONFIG_HAVE_HW_BREAKPOINT
|
|
|
|
|
if (unlikely(!hw_brk_match(this_cpu_ptr(¤t_brk), &new->thread.hw_brk)))
|
|
|
|
|
__set_breakpoint(&new->thread.hw_brk);
|
|
|
|
|
#endif /* CONFIG_HAVE_HW_BREAKPOINT */
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* We need to save SPRs before treclaim/trecheckpoint as these will
|
|
|
|
|
* change a number of them.
|
|
|
|
|
*/
|
|
|
|
|
save_sprs(&prev->thread);
|
|
|
|
|
|
|
|
|
|
/* Save FPU, Altivec, VSX and SPE state */
|
|
|
|
|
giveup_all(prev);
|
|
|
|
|
|
2016-09-23 14:18:24 +08:00
|
|
|
__switch_to_tm(prev, new);
|
|
|
|
|
|
2008-03-17 12:27:09 +08:00
|
|
|
/*
|
|
|
|
|
* We can't take a PMU exception inside _switch() since there is a
|
|
|
|
|
* window where the kernel stack SLB and the kernel stack are out
|
|
|
|
|
* of sync. Hard disable here.
|
|
|
|
|
*/
|
|
|
|
|
hard_irq_disable();
|
2013-02-14 00:21:40 +08:00
|
|
|
|
2015-12-10 17:44:39 +08:00
|
|
|
/*
|
|
|
|
|
* Call restore_sprs() before calling _switch(). If we move it after
|
|
|
|
|
* _switch() then we miss out on calling it for new tasks. The reason
|
|
|
|
|
* for this is we manually create a stack frame for new tasks that
|
|
|
|
|
* directly returns through ret_from_fork() or
|
|
|
|
|
* ret_from_kernel_thread(). See copy_thread() for details.
|
|
|
|
|
*/
|
2015-10-29 08:44:10 +08:00
|
|
|
restore_sprs(old_thread, new_thread);
|
|
|
|
|
|
2015-12-10 17:44:39 +08:00
|
|
|
last = _switch(old_thread, new_thread);
|
|
|
|
|
|
2016-04-29 21:26:07 +08:00
|
|
|
#ifdef CONFIG_PPC_STD_MMU_64
|
2011-05-25 08:11:48 +08:00
|
|
|
if (current_thread_info()->local_flags & _TLF_LAZY_MMU) {
|
|
|
|
|
current_thread_info()->local_flags &= ~_TLF_LAZY_MMU;
|
powerpc: Replace __get_cpu_var uses
This still has not been merged and now powerpc is the only arch that does
not have this change. Sorry about missing linuxppc-dev before.
V2->V2
- Fix up to work against 3.18-rc1
__get_cpu_var() is used for multiple purposes in the kernel source. One of
them is address calculation via the form &__get_cpu_var(x). This calculates
the address for the instance of the percpu variable of the current processor
based on an offset.
Other use cases are for storing and retrieving data from the current
processors percpu area. __get_cpu_var() can be used as an lvalue when
writing data or on the right side of an assignment.
__get_cpu_var() is defined as :
__get_cpu_var() always only does an address determination. However, store
and retrieve operations could use a segment prefix (or global register on
other platforms) to avoid the address calculation.
this_cpu_write() and this_cpu_read() can directly take an offset into a
percpu area and use optimized assembly code to read and write per cpu
variables.
This patch converts __get_cpu_var into either an explicit address
calculation using this_cpu_ptr() or into a use of this_cpu operations that
use the offset. Thereby address calculations are avoided and less registers
are used when code is generated.
At the end of the patch set all uses of __get_cpu_var have been removed so
the macro is removed too.
The patch set includes passes over all arches as well. Once these operations
are used throughout then specialized macros can be defined in non -x86
arches as well in order to optimize per cpu access by f.e. using a global
register that may be set to the per cpu base.
Transformations done to __get_cpu_var()
1. Determine the address of the percpu instance of the current processor.
DEFINE_PER_CPU(int, y);
int *x = &__get_cpu_var(y);
Converts to
int *x = this_cpu_ptr(&y);
2. Same as #1 but this time an array structure is involved.
DEFINE_PER_CPU(int, y[20]);
int *x = __get_cpu_var(y);
Converts to
int *x = this_cpu_ptr(y);
3. Retrieve the content of the current processors instance of a per cpu
variable.
DEFINE_PER_CPU(int, y);
int x = __get_cpu_var(y)
Converts to
int x = __this_cpu_read(y);
4. Retrieve the content of a percpu struct
DEFINE_PER_CPU(struct mystruct, y);
struct mystruct x = __get_cpu_var(y);
Converts to
memcpy(&x, this_cpu_ptr(&y), sizeof(x));
5. Assignment to a per cpu variable
DEFINE_PER_CPU(int, y)
__get_cpu_var(y) = x;
Converts to
__this_cpu_write(y, x);
6. Increment/Decrement etc of a per cpu variable
DEFINE_PER_CPU(int, y);
__get_cpu_var(y)++
Converts to
__this_cpu_inc(y)
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
CC: Paul Mackerras <paulus@samba.org>
Signed-off-by: Christoph Lameter <cl@linux.com>
[mpe: Fix build errors caused by set/or_softirq_pending(), and rework
assignment in __set_breakpoint() to use memcpy().]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2014-10-22 04:23:25 +08:00
|
|
|
batch = this_cpu_ptr(&ppc64_tlb_batch);
|
2011-05-25 08:11:48 +08:00
|
|
|
batch->active = 1;
|
|
|
|
|
}
|
2016-02-29 14:53:47 +08:00
|
|
|
|
|
|
|
|
if (current_thread_info()->task->thread.regs)
|
|
|
|
|
restore_math(current_thread_info()->task->thread.regs);
|
2016-04-29 21:26:07 +08:00
|
|
|
#endif /* CONFIG_PPC_STD_MMU_64 */
|
2011-05-25 08:11:48 +08:00
|
|
|
|
2005-09-26 14:04:21 +08:00
|
|
|
return last;
|
|
|
|
|
}
|
|
|
|
|
|
2005-10-10 20:29:05 +08:00
|
|
|
static int instructions_to_print = 16;
|
|
|
|
|
|
|
|
|
|
static void show_instructions(struct pt_regs *regs)
|
|
|
|
|
{
|
|
|
|
|
int i;
|
|
|
|
|
unsigned long pc = regs->nip - (instructions_to_print * 3 / 4 *
|
|
|
|
|
sizeof(int));
|
|
|
|
|
|
|
|
|
|
printk("Instruction dump:");
|
|
|
|
|
|
|
|
|
|
for (i = 0; i < instructions_to_print; i++) {
|
|
|
|
|
int instr;
|
|
|
|
|
|
|
|
|
|
if (!(i % 8))
|
2016-11-04 14:20:40 +08:00
|
|
|
pr_cont("\n");
|
2005-10-10 20:29:05 +08:00
|
|
|
|
2007-09-28 02:38:55 +08:00
|
|
|
#if !defined(CONFIG_BOOKE)
|
|
|
|
|
/* If executing with the IMMU off, adjust pc rather
|
|
|
|
|
* than print XXXXXXXX.
|
|
|
|
|
*/
|
|
|
|
|
if (!(regs->msr & MSR_IR))
|
|
|
|
|
pc = (unsigned long)phys_to_virt(pc);
|
|
|
|
|
#endif
|
|
|
|
|
|
2006-10-13 10:17:16 +08:00
|
|
|
if (!__kernel_text_address(pc) ||
|
2014-10-13 17:27:15 +08:00
|
|
|
probe_kernel_address((unsigned int __user *)pc, instr)) {
|
2016-11-04 14:20:40 +08:00
|
|
|
pr_cont("XXXXXXXX ");
|
2005-10-10 20:29:05 +08:00
|
|
|
} else {
|
|
|
|
|
if (regs->nip == pc)
|
2016-11-04 14:20:40 +08:00
|
|
|
pr_cont("<%08x> ", instr);
|
2005-10-10 20:29:05 +08:00
|
|
|
else
|
2016-11-04 14:20:40 +08:00
|
|
|
pr_cont("%08x ", instr);
|
2005-10-10 20:29:05 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
pc += sizeof(int);
|
|
|
|
|
}
|
|
|
|
|
|
2016-11-04 14:20:40 +08:00
|
|
|
pr_cont("\n");
|
2005-10-10 20:29:05 +08:00
|
|
|
}
|
|
|
|
|
|
powerpc: Print MSR TM bits in oops messages
Print MSR TM bits in oops messages. This appends them to the end
like this:
MSR: 8000000502823031 <SF,VEC,VSX,FP,ME,IR,DR,LE,TM[TE]>
You get the TM[] only if at least one TM MSR bit is set. Inside the
TM[], E means Enabled (bit 32), S means Suspended (bit 33), and T
means Transactional (bit 34)
If no bits are set, you get no TM[] output.
Include rework of printbits() to handle this case.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2015-11-20 12:15:32 +08:00
|
|
|
struct regbit {
|
2005-10-10 20:29:05 +08:00
|
|
|
unsigned long bit;
|
|
|
|
|
const char *name;
|
powerpc: Print MSR TM bits in oops messages
Print MSR TM bits in oops messages. This appends them to the end
like this:
MSR: 8000000502823031 <SF,VEC,VSX,FP,ME,IR,DR,LE,TM[TE]>
You get the TM[] only if at least one TM MSR bit is set. Inside the
TM[], E means Enabled (bit 32), S means Suspended (bit 33), and T
means Transactional (bit 34)
If no bits are set, you get no TM[] output.
Include rework of printbits() to handle this case.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2015-11-20 12:15:32 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
static struct regbit msr_bits[] = {
|
2011-11-25 03:35:57 +08:00
|
|
|
#if defined(CONFIG_PPC64) && !defined(CONFIG_BOOKE)
|
|
|
|
|
{MSR_SF, "SF"},
|
|
|
|
|
{MSR_HV, "HV"},
|
|
|
|
|
#endif
|
|
|
|
|
{MSR_VEC, "VEC"},
|
|
|
|
|
{MSR_VSX, "VSX"},
|
|
|
|
|
#ifdef CONFIG_BOOKE
|
|
|
|
|
{MSR_CE, "CE"},
|
|
|
|
|
#endif
|
2005-10-10 20:29:05 +08:00
|
|
|
{MSR_EE, "EE"},
|
|
|
|
|
{MSR_PR, "PR"},
|
|
|
|
|
{MSR_FP, "FP"},
|
|
|
|
|
{MSR_ME, "ME"},
|
2011-11-25 03:35:57 +08:00
|
|
|
#ifdef CONFIG_BOOKE
|
2008-11-19 12:39:53 +08:00
|
|
|
{MSR_DE, "DE"},
|
2011-11-25 03:35:57 +08:00
|
|
|
#else
|
|
|
|
|
{MSR_SE, "SE"},
|
|
|
|
|
{MSR_BE, "BE"},
|
|
|
|
|
#endif
|
2005-10-10 20:29:05 +08:00
|
|
|
{MSR_IR, "IR"},
|
|
|
|
|
{MSR_DR, "DR"},
|
2011-11-25 03:35:57 +08:00
|
|
|
{MSR_PMM, "PMM"},
|
|
|
|
|
#ifndef CONFIG_BOOKE
|
|
|
|
|
{MSR_RI, "RI"},
|
|
|
|
|
{MSR_LE, "LE"},
|
|
|
|
|
#endif
|
2005-10-10 20:29:05 +08:00
|
|
|
{0, NULL}
|
|
|
|
|
};
|
|
|
|
|
|
powerpc: Print MSR TM bits in oops messages
Print MSR TM bits in oops messages. This appends them to the end
like this:
MSR: 8000000502823031 <SF,VEC,VSX,FP,ME,IR,DR,LE,TM[TE]>
You get the TM[] only if at least one TM MSR bit is set. Inside the
TM[], E means Enabled (bit 32), S means Suspended (bit 33), and T
means Transactional (bit 34)
If no bits are set, you get no TM[] output.
Include rework of printbits() to handle this case.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2015-11-20 12:15:32 +08:00
|
|
|
static void print_bits(unsigned long val, struct regbit *bits, const char *sep)
|
2005-10-10 20:29:05 +08:00
|
|
|
{
|
powerpc: Print MSR TM bits in oops messages
Print MSR TM bits in oops messages. This appends them to the end
like this:
MSR: 8000000502823031 <SF,VEC,VSX,FP,ME,IR,DR,LE,TM[TE]>
You get the TM[] only if at least one TM MSR bit is set. Inside the
TM[], E means Enabled (bit 32), S means Suspended (bit 33), and T
means Transactional (bit 34)
If no bits are set, you get no TM[] output.
Include rework of printbits() to handle this case.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2015-11-20 12:15:32 +08:00
|
|
|
const char *s = "";
|
2005-10-10 20:29:05 +08:00
|
|
|
|
|
|
|
|
for (; bits->bit; ++bits)
|
|
|
|
|
if (val & bits->bit) {
|
2016-11-02 19:20:47 +08:00
|
|
|
pr_cont("%s%s", s, bits->name);
|
powerpc: Print MSR TM bits in oops messages
Print MSR TM bits in oops messages. This appends them to the end
like this:
MSR: 8000000502823031 <SF,VEC,VSX,FP,ME,IR,DR,LE,TM[TE]>
You get the TM[] only if at least one TM MSR bit is set. Inside the
TM[], E means Enabled (bit 32), S means Suspended (bit 33), and T
means Transactional (bit 34)
If no bits are set, you get no TM[] output.
Include rework of printbits() to handle this case.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2015-11-20 12:15:32 +08:00
|
|
|
s = sep;
|
2005-10-10 20:29:05 +08:00
|
|
|
}
|
powerpc: Print MSR TM bits in oops messages
Print MSR TM bits in oops messages. This appends them to the end
like this:
MSR: 8000000502823031 <SF,VEC,VSX,FP,ME,IR,DR,LE,TM[TE]>
You get the TM[] only if at least one TM MSR bit is set. Inside the
TM[], E means Enabled (bit 32), S means Suspended (bit 33), and T
means Transactional (bit 34)
If no bits are set, you get no TM[] output.
Include rework of printbits() to handle this case.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2015-11-20 12:15:32 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
|
|
|
|
|
static struct regbit msr_tm_bits[] = {
|
|
|
|
|
{MSR_TS_T, "T"},
|
|
|
|
|
{MSR_TS_S, "S"},
|
|
|
|
|
{MSR_TM, "E"},
|
|
|
|
|
{0, NULL}
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
static void print_tm_bits(unsigned long val)
|
|
|
|
|
{
|
|
|
|
|
/*
|
|
|
|
|
* This only prints something if at least one of the TM bit is set.
|
|
|
|
|
* Inside the TM[], the output means:
|
|
|
|
|
* E: Enabled (bit 32)
|
|
|
|
|
* S: Suspended (bit 33)
|
|
|
|
|
* T: Transactional (bit 34)
|
|
|
|
|
*/
|
|
|
|
|
if (val & (MSR_TM | MSR_TS_S | MSR_TS_T)) {
|
2016-11-02 19:20:47 +08:00
|
|
|
pr_cont(",TM[");
|
powerpc: Print MSR TM bits in oops messages
Print MSR TM bits in oops messages. This appends them to the end
like this:
MSR: 8000000502823031 <SF,VEC,VSX,FP,ME,IR,DR,LE,TM[TE]>
You get the TM[] only if at least one TM MSR bit is set. Inside the
TM[], E means Enabled (bit 32), S means Suspended (bit 33), and T
means Transactional (bit 34)
If no bits are set, you get no TM[] output.
Include rework of printbits() to handle this case.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2015-11-20 12:15:32 +08:00
|
|
|
print_bits(val, msr_tm_bits, "");
|
2016-11-02 19:20:47 +08:00
|
|
|
pr_cont("]");
|
powerpc: Print MSR TM bits in oops messages
Print MSR TM bits in oops messages. This appends them to the end
like this:
MSR: 8000000502823031 <SF,VEC,VSX,FP,ME,IR,DR,LE,TM[TE]>
You get the TM[] only if at least one TM MSR bit is set. Inside the
TM[], E means Enabled (bit 32), S means Suspended (bit 33), and T
means Transactional (bit 34)
If no bits are set, you get no TM[] output.
Include rework of printbits() to handle this case.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2015-11-20 12:15:32 +08:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
#else
|
|
|
|
|
static void print_tm_bits(unsigned long val) {}
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
static void print_msr_bits(unsigned long val)
|
|
|
|
|
{
|
2016-11-02 19:20:47 +08:00
|
|
|
pr_cont("<");
|
powerpc: Print MSR TM bits in oops messages
Print MSR TM bits in oops messages. This appends them to the end
like this:
MSR: 8000000502823031 <SF,VEC,VSX,FP,ME,IR,DR,LE,TM[TE]>
You get the TM[] only if at least one TM MSR bit is set. Inside the
TM[], E means Enabled (bit 32), S means Suspended (bit 33), and T
means Transactional (bit 34)
If no bits are set, you get no TM[] output.
Include rework of printbits() to handle this case.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2015-11-20 12:15:32 +08:00
|
|
|
print_bits(val, msr_bits, ",");
|
|
|
|
|
print_tm_bits(val);
|
2016-11-02 19:20:47 +08:00
|
|
|
pr_cont(">");
|
2005-10-10 20:29:05 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#ifdef CONFIG_PPC64
|
2007-03-21 09:38:19 +08:00
|
|
|
#define REG "%016lx"
|
2005-10-10 20:29:05 +08:00
|
|
|
#define REGS_PER_LINE 4
|
|
|
|
|
#define LAST_VOLATILE 13
|
|
|
|
|
#else
|
2007-03-21 09:38:19 +08:00
|
|
|
#define REG "%08lx"
|
2005-10-10 20:29:05 +08:00
|
|
|
#define REGS_PER_LINE 8
|
|
|
|
|
#define LAST_VOLATILE 12
|
|
|
|
|
#endif
|
|
|
|
|
|
2005-09-26 14:04:21 +08:00
|
|
|
void show_regs(struct pt_regs * regs)
|
|
|
|
|
{
|
|
|
|
|
int i, trap;
|
|
|
|
|
|
dump_stack: unify debug information printed by show_regs()
show_regs() is inherently arch-dependent but it does make sense to print
generic debug information and some archs already do albeit in slightly
different forms. This patch introduces a generic function to print debug
information from show_regs() so that different archs print out the same
information and it's much easier to modify what's printed.
show_regs_print_info() prints out the same debug info as dump_stack()
does plus task and thread_info pointers.
* Archs which didn't print debug info now do.
alpha, arc, blackfin, c6x, cris, frv, h8300, hexagon, ia64, m32r,
metag, microblaze, mn10300, openrisc, parisc, score, sh64, sparc,
um, xtensa
* Already prints debug info. Replaced with show_regs_print_info().
The printed information is superset of what used to be there.
arm, arm64, avr32, mips, powerpc, sh32, tile, unicore32, x86
* s390 is special in that it used to print arch-specific information
along with generic debug info. Heiko and Martin think that the
arch-specific extra isn't worth keeping s390 specfic implementation.
Converted to use the generic version.
Note that now all archs print the debug info before actual register
dumps.
An example BUG() dump follows.
kernel BUG at /work/os/work/kernel/workqueue.c:4841!
invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Modules linked in:
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.9.0-rc1-work+ #7
Hardware name: empty empty/S3992, BIOS 080011 10/26/2007
task: ffff88007c85e040 ti: ffff88007c860000 task.ti: ffff88007c860000
RIP: 0010:[<ffffffff8234a07e>] [<ffffffff8234a07e>] init_workqueues+0x4/0x6
RSP: 0000:ffff88007c861ec8 EFLAGS: 00010246
RAX: ffff88007c861fd8 RBX: ffffffff824466a8 RCX: 0000000000000001
RDX: 0000000000000046 RSI: 0000000000000001 RDI: ffffffff8234a07a
RBP: ffff88007c861ec8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff8234a07a
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88007dc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: ffff88015f7ff000 CR3: 00000000021f1000 CR4: 00000000000007f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Stack:
ffff88007c861ef8 ffffffff81000312 ffffffff824466a8 ffff88007c85e650
0000000000000003 0000000000000000 ffff88007c861f38 ffffffff82335e5d
ffff88007c862080 ffffffff8223d8c0 ffff88007c862080 ffffffff81c47760
Call Trace:
[<ffffffff81000312>] do_one_initcall+0x122/0x170
[<ffffffff82335e5d>] kernel_init_freeable+0x9b/0x1c8
[<ffffffff81c47760>] ? rest_init+0x140/0x140
[<ffffffff81c4776e>] kernel_init+0xe/0xf0
[<ffffffff81c6be9c>] ret_from_fork+0x7c/0xb0
[<ffffffff81c47760>] ? rest_init+0x140/0x140
...
v2: Typo fix in x86-32.
v3: CPU number dropped from show_regs_print_info() as
dump_stack_print_info() has been updated to print it. s390
specific implementation dropped as requested by s390 maintainers.
Signed-off-by: Tejun Heo <tj@kernel.org>
Acked-by: David S. Miller <davem@davemloft.net>
Acked-by: Jesper Nilsson <jesper.nilsson@axis.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: Fengguang Wu <fengguang.wu@intel.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Cc: Vineet Gupta <vgupta@synopsys.com>
Cc: Sam Ravnborg <sam@ravnborg.org>
Acked-by: Chris Metcalf <cmetcalf@tilera.com> [tile bits]
Acked-by: Richard Kuo <rkuo@codeaurora.org> [hexagon bits]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-05-01 06:27:17 +08:00
|
|
|
show_regs_print_info(KERN_DEFAULT);
|
|
|
|
|
|
2005-10-10 20:29:05 +08:00
|
|
|
printk("NIP: "REG" LR: "REG" CTR: "REG"\n",
|
|
|
|
|
regs->nip, regs->link, regs->ctr);
|
|
|
|
|
printk("REGS: %p TRAP: %04lx %s (%s)\n",
|
2006-10-02 17:18:13 +08:00
|
|
|
regs, regs->trap, print_tainted(), init_utsname()->release);
|
2005-10-10 20:29:05 +08:00
|
|
|
printk("MSR: "REG" ", regs->msr);
|
powerpc: Print MSR TM bits in oops messages
Print MSR TM bits in oops messages. This appends them to the end
like this:
MSR: 8000000502823031 <SF,VEC,VSX,FP,ME,IR,DR,LE,TM[TE]>
You get the TM[] only if at least one TM MSR bit is set. Inside the
TM[], E means Enabled (bit 32), S means Suspended (bit 33), and T
means Transactional (bit 34)
If no bits are set, you get no TM[] output.
Include rework of printbits() to handle this case.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2015-11-20 12:15:32 +08:00
|
|
|
print_msr_bits(regs->msr);
|
2007-03-21 09:38:19 +08:00
|
|
|
printk(" CR: %08lx XER: %08lx\n", regs->ccr, regs->xer);
|
2005-09-26 14:04:21 +08:00
|
|
|
trap = TRAP(regs);
|
2011-07-15 03:25:12 +08:00
|
|
|
if ((regs->trap != 0xc00) && cpu_has_feature(CPU_FTR_CFAR))
|
2016-11-03 17:45:26 +08:00
|
|
|
pr_cont("CFAR: "REG" ", regs->orig_gpr3);
|
2013-11-15 12:41:19 +08:00
|
|
|
if (trap == 0x200 || trap == 0x300 || trap == 0x600)
|
2011-10-06 10:53:38 +08:00
|
|
|
#if defined(CONFIG_4xx) || defined(CONFIG_BOOKE)
|
2016-11-03 17:45:26 +08:00
|
|
|
pr_cont("DEAR: "REG" ESR: "REG" ", regs->dar, regs->dsisr);
|
2007-07-26 13:46:15 +08:00
|
|
|
#else
|
2016-11-03 17:45:26 +08:00
|
|
|
pr_cont("DAR: "REG" DSISR: %08lx ", regs->dar, regs->dsisr);
|
powerpc: Remove a few lines of oops output
We waste quite a few lines in our oops output:
...
MSR: 8000000000009032 <SF,EE,ME,IR,DR,RI> CR: 28044024 XER: 00000000
SOFTE: 0
CFAR: 0000000000009088
DAR: 000000000000001c, DSISR: 40000000
GPR00: c0000000000c74f0 c00000037cc1b010 c000000000d2bb30 0000000000000000
...
We can do a better job here and remove 3 lines:
MSR: 8000000000009032 <SF,EE,ME,IR,DR,RI> CR: 28044024 XER: 00000000
CFAR: 0000000000009088 DAR: 0000000000000010, DSISR: 40000000 SOFTE: 1
GPR00: c0000000000e3d10 c00000037cc2fda0 c000000000d2c3a8 0000000000000001
Also move PACATMSCRATCH up, it doesn't really belong in the stack
trace section.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2013-11-15 12:48:38 +08:00
|
|
|
#endif
|
|
|
|
|
#ifdef CONFIG_PPC64
|
2016-11-03 17:45:26 +08:00
|
|
|
pr_cont("SOFTE: %ld ", regs->softe);
|
powerpc: Remove a few lines of oops output
We waste quite a few lines in our oops output:
...
MSR: 8000000000009032 <SF,EE,ME,IR,DR,RI> CR: 28044024 XER: 00000000
SOFTE: 0
CFAR: 0000000000009088
DAR: 000000000000001c, DSISR: 40000000
GPR00: c0000000000c74f0 c00000037cc1b010 c000000000d2bb30 0000000000000000
...
We can do a better job here and remove 3 lines:
MSR: 8000000000009032 <SF,EE,ME,IR,DR,RI> CR: 28044024 XER: 00000000
CFAR: 0000000000009088 DAR: 0000000000000010, DSISR: 40000000 SOFTE: 1
GPR00: c0000000000e3d10 c00000037cc2fda0 c000000000d2c3a8 0000000000000001
Also move PACATMSCRATCH up, it doesn't really belong in the stack
trace section.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2013-11-15 12:48:38 +08:00
|
|
|
#endif
|
|
|
|
|
#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
|
2013-11-18 10:19:17 +08:00
|
|
|
if (MSR_TM_ACTIVE(regs->msr))
|
2016-11-03 17:45:26 +08:00
|
|
|
pr_cont("\nPACATMSCRATCH: %016llx ", get_paca()->tm_scratch);
|
2007-07-26 13:46:15 +08:00
|
|
|
#endif
|
2005-09-26 14:04:21 +08:00
|
|
|
|
|
|
|
|
for (i = 0; i < 32; i++) {
|
2005-10-10 20:29:05 +08:00
|
|
|
if ((i % REGS_PER_LINE) == 0)
|
2016-11-03 17:45:26 +08:00
|
|
|
pr_cont("\nGPR%02d: ", i);
|
|
|
|
|
pr_cont(REG " ", regs->gpr[i]);
|
2005-10-10 20:29:05 +08:00
|
|
|
if (i == LAST_VOLATILE && !FULL_REGS(regs))
|
2005-09-26 14:04:21 +08:00
|
|
|
break;
|
|
|
|
|
}
|
2016-11-03 17:45:26 +08:00
|
|
|
pr_cont("\n");
|
2005-09-26 14:04:21 +08:00
|
|
|
#ifdef CONFIG_KALLSYMS
|
|
|
|
|
/*
|
|
|
|
|
* Lookup NIP late so we have the best change of getting the
|
|
|
|
|
* above info out without failing
|
|
|
|
|
*/
|
2008-07-07 11:44:31 +08:00
|
|
|
printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
|
|
|
|
|
printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
|
2013-02-14 00:21:34 +08:00
|
|
|
#endif
|
2005-09-26 14:04:21 +08:00
|
|
|
show_stack(current, (unsigned long *) regs->gpr[1]);
|
2005-10-10 20:29:05 +08:00
|
|
|
if (!user_mode(regs))
|
|
|
|
|
show_instructions(regs);
|
2005-09-26 14:04:21 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void flush_thread(void)
|
|
|
|
|
{
|
2011-02-10 12:44:35 +08:00
|
|
|
#ifdef CONFIG_HAVE_HW_BREAKPOINT
|
2010-06-15 14:05:19 +08:00
|
|
|
flush_ptrace_hw_breakpoint(current);
|
2011-02-10 12:44:35 +08:00
|
|
|
#else /* CONFIG_HAVE_HW_BREAKPOINT */
|
2010-02-08 19:51:18 +08:00
|
|
|
set_debug_reg_defaults(¤t->thread);
|
2011-02-10 12:44:35 +08:00
|
|
|
#endif /* CONFIG_HAVE_HW_BREAKPOINT */
|
2005-09-26 14:04:21 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void
|
|
|
|
|
release_thread(struct task_struct *t)
|
|
|
|
|
{
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/*
|
2012-05-17 06:03:51 +08:00
|
|
|
* this gets called so that we can store coprocessor state into memory and
|
|
|
|
|
* copy the current task into the new thread.
|
2005-09-26 14:04:21 +08:00
|
|
|
*/
|
2012-05-17 06:03:51 +08:00
|
|
|
int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
|
2005-09-26 14:04:21 +08:00
|
|
|
{
|
2015-10-29 08:44:09 +08:00
|
|
|
flush_all_to_thread(src);
|
2014-03-03 11:21:40 +08:00
|
|
|
/*
|
|
|
|
|
* Flush TM state out so we can copy it. __switch_to_tm() does this
|
|
|
|
|
* flush but it removes the checkpointed state from the current CPU and
|
|
|
|
|
* transitions the CPU out of TM mode. Hence we need to call
|
|
|
|
|
* tm_recheckpoint_new_task() (on the same task) to restore the
|
|
|
|
|
* checkpointed state back and the TM mode.
|
2016-09-14 16:02:16 +08:00
|
|
|
*
|
|
|
|
|
* Can't pass dst because it isn't ready. Doesn't matter, passing
|
|
|
|
|
* dst is only important for __switch_to()
|
2014-03-03 11:21:40 +08:00
|
|
|
*/
|
2016-09-23 14:18:24 +08:00
|
|
|
__switch_to_tm(src, src);
|
2013-06-28 16:15:16 +08:00
|
|
|
|
2012-05-17 06:03:51 +08:00
|
|
|
*dst = *src;
|
2013-06-28 16:15:16 +08:00
|
|
|
|
|
|
|
|
clear_task_ebb(dst);
|
|
|
|
|
|
2012-05-17 06:03:51 +08:00
|
|
|
return 0;
|
2005-09-26 14:04:21 +08:00
|
|
|
}
|
|
|
|
|
|
2014-07-10 10:29:21 +08:00
|
|
|
static void setup_ksp_vsid(struct task_struct *p, unsigned long sp)
|
|
|
|
|
{
|
|
|
|
|
#ifdef CONFIG_PPC_STD_MMU_64
|
|
|
|
|
unsigned long sp_vsid;
|
|
|
|
|
unsigned long llp = mmu_psize_defs[mmu_linear_psize].sllp;
|
|
|
|
|
|
2016-04-29 21:26:07 +08:00
|
|
|
if (radix_enabled())
|
|
|
|
|
return;
|
|
|
|
|
|
2014-07-10 10:29:21 +08:00
|
|
|
if (mmu_has_feature(MMU_FTR_1T_SEGMENT))
|
|
|
|
|
sp_vsid = get_kernel_vsid(sp, MMU_SEGSIZE_1T)
|
|
|
|
|
<< SLB_VSID_SHIFT_1T;
|
|
|
|
|
else
|
|
|
|
|
sp_vsid = get_kernel_vsid(sp, MMU_SEGSIZE_256M)
|
|
|
|
|
<< SLB_VSID_SHIFT;
|
|
|
|
|
sp_vsid |= SLB_VSID_KERNEL | llp;
|
|
|
|
|
p->thread.ksp_vsid = sp_vsid;
|
|
|
|
|
#endif
|
|
|
|
|
}
|
|
|
|
|
|
2005-09-26 14:04:21 +08:00
|
|
|
/*
|
|
|
|
|
* Copy a thread..
|
|
|
|
|
*/
|
2011-03-02 23:18:48 +08:00
|
|
|
|
2015-03-14 02:14:46 +08:00
|
|
|
/*
|
|
|
|
|
* Copy architecture-specific thread state
|
|
|
|
|
*/
|
2009-04-03 07:56:59 +08:00
|
|
|
int copy_thread(unsigned long clone_flags, unsigned long usp,
|
2015-03-14 02:14:46 +08:00
|
|
|
unsigned long kthread_arg, struct task_struct *p)
|
2005-09-26 14:04:21 +08:00
|
|
|
{
|
|
|
|
|
struct pt_regs *childregs, *kregs;
|
|
|
|
|
extern void ret_from_fork(void);
|
2012-09-13 06:32:42 +08:00
|
|
|
extern void ret_from_kernel_thread(void);
|
|
|
|
|
void (*f)(void);
|
2006-01-12 17:06:02 +08:00
|
|
|
unsigned long sp = (unsigned long)task_stack_page(p) + THREAD_SIZE;
|
2016-03-24 19:04:04 +08:00
|
|
|
struct thread_info *ti = task_thread_info(p);
|
|
|
|
|
|
|
|
|
|
klp_init_thread_info(ti);
|
2005-09-26 14:04:21 +08:00
|
|
|
|
|
|
|
|
/* Copy registers */
|
|
|
|
|
sp -= sizeof(struct pt_regs);
|
|
|
|
|
childregs = (struct pt_regs *) sp;
|
2012-10-22 10:33:39 +08:00
|
|
|
if (unlikely(p->flags & PF_KTHREAD)) {
|
2015-03-14 02:14:46 +08:00
|
|
|
/* kernel thread */
|
2012-09-13 06:32:42 +08:00
|
|
|
memset(childregs, 0, sizeof(struct pt_regs));
|
2005-09-26 14:04:21 +08:00
|
|
|
childregs->gpr[1] = sp + sizeof(struct pt_regs);
|
2014-02-04 13:08:51 +08:00
|
|
|
/* function */
|
|
|
|
|
if (usp)
|
|
|
|
|
childregs->gpr[14] = ppc_function_entry((void *)usp);
|
2012-09-13 06:32:42 +08:00
|
|
|
#ifdef CONFIG_PPC64
|
2006-01-12 17:06:01 +08:00
|
|
|
clear_tsk_thread_flag(p, TIF_32BIT);
|
2012-10-11 20:41:43 +08:00
|
|
|
childregs->softe = 1;
|
2005-10-10 20:29:05 +08:00
|
|
|
#endif
|
2015-03-14 02:14:46 +08:00
|
|
|
childregs->gpr[15] = kthread_arg;
|
2005-09-26 14:04:21 +08:00
|
|
|
p->thread.regs = NULL; /* no user register state */
|
2012-10-11 20:41:43 +08:00
|
|
|
ti->flags |= _TIF_RESTOREALL;
|
2012-09-13 06:32:42 +08:00
|
|
|
f = ret_from_kernel_thread;
|
2005-09-26 14:04:21 +08:00
|
|
|
} else {
|
2015-03-14 02:14:46 +08:00
|
|
|
/* user thread */
|
2012-10-23 10:51:14 +08:00
|
|
|
struct pt_regs *regs = current_pt_regs();
|
2012-09-13 06:32:42 +08:00
|
|
|
CHECK_FULL_REGS(regs);
|
|
|
|
|
*childregs = *regs;
|
2012-10-22 10:28:43 +08:00
|
|
|
if (usp)
|
|
|
|
|
childregs->gpr[1] = usp;
|
2005-09-26 14:04:21 +08:00
|
|
|
p->thread.regs = childregs;
|
2012-09-13 06:32:42 +08:00
|
|
|
childregs->gpr[3] = 0; /* Result from fork() */
|
2005-10-10 20:29:05 +08:00
|
|
|
if (clone_flags & CLONE_SETTLS) {
|
|
|
|
|
#ifdef CONFIG_PPC64
|
2010-07-30 06:04:39 +08:00
|
|
|
if (!is_32bit_task())
|
2005-10-10 20:29:05 +08:00
|
|
|
childregs->gpr[13] = childregs->gpr[6];
|
|
|
|
|
else
|
|
|
|
|
#endif
|
|
|
|
|
childregs->gpr[2] = childregs->gpr[6];
|
|
|
|
|
}
|
2012-09-13 06:32:42 +08:00
|
|
|
|
|
|
|
|
f = ret_from_fork;
|
2005-09-26 14:04:21 +08:00
|
|
|
}
|
2016-02-29 14:53:46 +08:00
|
|
|
childregs->msr &= ~(MSR_FP|MSR_VEC|MSR_VSX);
|
2005-09-26 14:04:21 +08:00
|
|
|
sp -= STACK_FRAME_OVERHEAD;
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* The way this works is that at some point in the future
|
|
|
|
|
* some task will call _switch to switch to the new task.
|
|
|
|
|
* That will pop off the stack frame created below and start
|
|
|
|
|
* the new task running at ret_from_fork. The new task will
|
|
|
|
|
* do some house keeping and then return from the fork or clone
|
|
|
|
|
* system call, using the stack frame created above.
|
|
|
|
|
*/
|
2013-05-07 06:44:41 +08:00
|
|
|
((unsigned long *)sp)[0] = 0;
|
2005-09-26 14:04:21 +08:00
|
|
|
sp -= sizeof(struct pt_regs);
|
|
|
|
|
kregs = (struct pt_regs *) sp;
|
|
|
|
|
sp -= STACK_FRAME_OVERHEAD;
|
|
|
|
|
p->thread.ksp = sp;
|
2013-09-24 13:17:21 +08:00
|
|
|
#ifdef CONFIG_PPC32
|
2008-04-28 14:21:22 +08:00
|
|
|
p->thread.ksp_limit = (unsigned long)task_stack_page(p) +
|
|
|
|
|
_ALIGN_UP(sizeof(struct thread_info), 16);
|
2013-09-24 13:17:21 +08:00
|
|
|
#endif
|
2013-04-21 14:47:59 +08:00
|
|
|
#ifdef CONFIG_HAVE_HW_BREAKPOINT
|
|
|
|
|
p->thread.ptrace_bps[0] = NULL;
|
|
|
|
|
#endif
|
|
|
|
|
|
2013-09-10 18:21:10 +08:00
|
|
|
p->thread.fp_save_area = NULL;
|
|
|
|
|
#ifdef CONFIG_ALTIVEC
|
|
|
|
|
p->thread.vr_save_area = NULL;
|
|
|
|
|
#endif
|
|
|
|
|
|
2014-07-10 10:29:21 +08:00
|
|
|
setup_ksp_vsid(p, sp);
|
|
|
|
|
|
2011-03-02 23:18:48 +08:00
|
|
|
#ifdef CONFIG_PPC64
|
|
|
|
|
if (cpu_has_feature(CPU_FTR_DSCR)) {
|
2012-09-04 00:49:47 +08:00
|
|
|
p->thread.dscr_inherit = current->thread.dscr_inherit;
|
2015-12-09 17:11:47 +08:00
|
|
|
p->thread.dscr = mfspr(SPRN_DSCR);
|
2011-03-02 23:18:48 +08:00
|
|
|
}
|
2012-12-07 05:49:56 +08:00
|
|
|
if (cpu_has_feature(CPU_FTR_HAS_PPR))
|
|
|
|
|
p->thread.ppr = INIT_PPR;
|
2011-03-02 23:18:48 +08:00
|
|
|
#endif
|
2014-02-04 13:08:51 +08:00
|
|
|
kregs->nip = ppc_function_entry(f);
|
2005-09-26 14:04:21 +08:00
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Set up a thread for executing a new program
|
|
|
|
|
*/
|
2005-10-10 20:29:05 +08:00
|
|
|
void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp)
|
2005-09-26 14:04:21 +08:00
|
|
|
{
|
2005-10-21 14:01:33 +08:00
|
|
|
#ifdef CONFIG_PPC64
|
|
|
|
|
unsigned long load_addr = regs->gpr[2]; /* saved by ELF_PLAT_INIT */
|
|
|
|
|
#endif
|
|
|
|
|
|
2005-10-10 20:29:05 +08:00
|
|
|
/*
|
|
|
|
|
* If we exec out of a kernel thread then thread.regs will not be
|
|
|
|
|
* set. Do it now.
|
|
|
|
|
*/
|
|
|
|
|
if (!current->thread.regs) {
|
2006-01-12 17:06:02 +08:00
|
|
|
struct pt_regs *regs = task_stack_page(current) + THREAD_SIZE;
|
|
|
|
|
current->thread.regs = regs - 1;
|
2005-10-10 20:29:05 +08:00
|
|
|
}
|
|
|
|
|
|
powerpc/tm: Always reclaim in start_thread() for exec() class syscalls
Userspace can quite legitimately perform an exec() syscall with a
suspended transaction. exec() does not return to the old process, rather
it load a new one and starts that, the expectation therefore is that the
new process starts not in a transaction. Currently exec() is not treated
any differently to any other syscall which creates problems.
Firstly it could allow a new process to start with a suspended
transaction for a binary that no longer exists. This means that the
checkpointed state won't be valid and if the suspended transaction were
ever to be resumed and subsequently aborted (a possibility which is
exceedingly likely as exec()ing will likely doom the transaction) the
new process will jump to invalid state.
Secondly the incorrect attempt to keep the transactional state while
still zeroing state for the new process creates at least two TM Bad
Things. The first triggers on the rfid to return to userspace as
start_thread() has given the new process a 'clean' MSR but the suspend
will still be set in the hardware MSR. The second TM Bad Thing triggers
in __switch_to() as the processor is still transactionally suspended but
__switch_to() wants to zero the TM sprs for the new process.
This is an example of the outcome of calling exec() with a suspended
transaction. Note the first 700 is likely the first TM bad thing
decsribed earlier only the kernel can't report it as we've loaded
userspace registers. c000000000009980 is the rfid in
fast_exception_return()
Bad kernel stack pointer 3fffcfa1a370 at c000000000009980
Oops: Bad kernel stack pointer, sig: 6 [#1]
CPU: 0 PID: 2006 Comm: tm-execed Not tainted
NIP: c000000000009980 LR: 0000000000000000 CTR: 0000000000000000
REGS: c00000003ffefd40 TRAP: 0700 Not tainted
MSR: 8000000300201031 <SF,ME,IR,DR,LE,TM[SE]> CR: 00000000 XER: 00000000
CFAR: c0000000000098b4 SOFTE: 0
PACATMSCRATCH: b00000010000d033
GPR00: 0000000000000000 00003fffcfa1a370 0000000000000000 0000000000000000
GPR04: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR12: 00003fff966611c0 0000000000000000 0000000000000000 0000000000000000
NIP [c000000000009980] fast_exception_return+0xb0/0xb8
LR [0000000000000000] (null)
Call Trace:
Instruction dump:
f84d0278 e9a100d8 7c7b03a6 e84101a0 7c4ff120 e8410170 7c5a03a6 e8010070
e8410080 e8610088 e8810090 e8210078 <4c000024> 48000000 e8610178 88ed023b
Kernel BUG at c000000000043e80 [verbose debug info unavailable]
Unexpected TM Bad Thing exception at c000000000043e80 (msr 0x201033)
Oops: Unrecoverable exception, sig: 6 [#2]
CPU: 0 PID: 2006 Comm: tm-execed Tainted: G D
task: c0000000fbea6d80 ti: c00000003ffec000 task.ti: c0000000fb7ec000
NIP: c000000000043e80 LR: c000000000015a24 CTR: 0000000000000000
REGS: c00000003ffef7e0 TRAP: 0700 Tainted: G D
MSR: 8000000300201033 <SF,ME,IR,DR,RI,LE,TM[SE]> CR: 28002828 XER: 00000000
CFAR: c000000000015a20 SOFTE: 0
PACATMSCRATCH: b00000010000d033
GPR00: 0000000000000000 c00000003ffefa60 c000000000db5500 c0000000fbead000
GPR04: 8000000300001033 2222222222222222 2222222222222222 00000000ff160000
GPR08: 0000000000000000 800000010000d033 c0000000fb7e3ea0 c00000000fe00004
GPR12: 0000000000002200 c00000000fe00000 0000000000000000 0000000000000000
GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR20: 0000000000000000 0000000000000000 c0000000fbea7410 00000000ff160000
GPR24: c0000000ffe1f600 c0000000fbea8700 c0000000fbea8700 c0000000fbead000
GPR28: c000000000e20198 c0000000fbea6d80 c0000000fbeab680 c0000000fbea6d80
NIP [c000000000043e80] tm_restore_sprs+0xc/0x1c
LR [c000000000015a24] __switch_to+0x1f4/0x420
Call Trace:
Instruction dump:
7c800164 4e800020 7c0022a6 f80304a8 7c0222a6 f80304b0 7c0122a6 f80304b8
4e800020 e80304a8 7c0023a6 e80304b0 <7c0223a6> e80304b8 7c0123a6 4e800020
This fixes CVE-2016-5828.
Fixes: bc2a9408fa65 ("powerpc: Hook in new transactional memory code")
Cc: stable@vger.kernel.org # v3.9+
Signed-off-by: Cyril Bur <cyrilbur@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2016-06-17 12:58:34 +08:00
|
|
|
#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
|
|
|
|
|
/*
|
|
|
|
|
* Clear any transactional state, we're exec()ing. The cause is
|
|
|
|
|
* not important as there will never be a recheckpoint so it's not
|
|
|
|
|
* user visible.
|
|
|
|
|
*/
|
|
|
|
|
if (MSR_TM_SUSPENDED(mfmsr()))
|
|
|
|
|
tm_reclaim_current(0);
|
|
|
|
|
#endif
|
|
|
|
|
|
2005-09-26 14:04:21 +08:00
|
|
|
memset(regs->gpr, 0, sizeof(regs->gpr));
|
|
|
|
|
regs->ctr = 0;
|
|
|
|
|
regs->link = 0;
|
|
|
|
|
regs->xer = 0;
|
|
|
|
|
regs->ccr = 0;
|
|
|
|
|
regs->gpr[1] = sp;
|
2005-10-10 20:29:05 +08:00
|
|
|
|
2007-09-25 07:52:44 +08:00
|
|
|
/*
|
|
|
|
|
* We have just cleared all the nonvolatile GPRs, so make
|
|
|
|
|
* FULL_REGS(regs) return true. This is necessary to allow
|
|
|
|
|
* ptrace to examine the thread immediately after exec.
|
|
|
|
|
*/
|
|
|
|
|
regs->trap &= ~1UL;
|
|
|
|
|
|
2005-10-10 20:29:05 +08:00
|
|
|
#ifdef CONFIG_PPC32
|
|
|
|
|
regs->mq = 0;
|
|
|
|
|
regs->nip = start;
|
2005-09-26 14:04:21 +08:00
|
|
|
regs->msr = MSR_USER;
|
2005-10-10 20:29:05 +08:00
|
|
|
#else
|
2010-07-30 06:04:39 +08:00
|
|
|
if (!is_32bit_task()) {
|
2013-11-20 19:15:02 +08:00
|
|
|
unsigned long entry;
|
2005-10-10 20:29:05 +08:00
|
|
|
|
2013-11-20 19:15:02 +08:00
|
|
|
if (is_elf2_task()) {
|
|
|
|
|
/* Look ma, no function descriptors! */
|
|
|
|
|
entry = start;
|
2005-10-10 20:29:05 +08:00
|
|
|
|
2013-11-20 19:15:02 +08:00
|
|
|
/*
|
|
|
|
|
* Ulrich says:
|
|
|
|
|
* The latest iteration of the ABI requires that when
|
|
|
|
|
* calling a function (at its global entry point),
|
|
|
|
|
* the caller must ensure r12 holds the entry point
|
|
|
|
|
* address (so that the function can quickly
|
|
|
|
|
* establish addressability).
|
|
|
|
|
*/
|
|
|
|
|
regs->gpr[12] = start;
|
|
|
|
|
/* Make sure that's restored on entry to userspace. */
|
|
|
|
|
set_thread_flag(TIF_RESTOREALL);
|
|
|
|
|
} else {
|
|
|
|
|
unsigned long toc;
|
|
|
|
|
|
|
|
|
|
/* start is a relocated pointer to the function
|
|
|
|
|
* descriptor for the elf _start routine. The first
|
|
|
|
|
* entry in the function descriptor is the entry
|
|
|
|
|
* address of _start and the second entry is the TOC
|
|
|
|
|
* value we need to use.
|
|
|
|
|
*/
|
|
|
|
|
__get_user(entry, (unsigned long __user *)start);
|
|
|
|
|
__get_user(toc, (unsigned long __user *)start+1);
|
|
|
|
|
|
|
|
|
|
/* Check whether the e_entry function descriptor entries
|
|
|
|
|
* need to be relocated before we can use them.
|
|
|
|
|
*/
|
|
|
|
|
if (load_addr != 0) {
|
|
|
|
|
entry += load_addr;
|
|
|
|
|
toc += load_addr;
|
|
|
|
|
}
|
|
|
|
|
regs->gpr[2] = toc;
|
2005-10-10 20:29:05 +08:00
|
|
|
}
|
|
|
|
|
regs->nip = entry;
|
|
|
|
|
regs->msr = MSR_USER64;
|
2005-10-13 11:40:54 +08:00
|
|
|
} else {
|
|
|
|
|
regs->nip = start;
|
|
|
|
|
regs->gpr[2] = 0;
|
|
|
|
|
regs->msr = MSR_USER32;
|
2005-10-10 20:29:05 +08:00
|
|
|
}
|
|
|
|
|
#endif
|
2008-06-25 12:07:18 +08:00
|
|
|
#ifdef CONFIG_VSX
|
|
|
|
|
current->thread.used_vsr = 0;
|
|
|
|
|
#endif
|
2013-09-10 18:20:42 +08:00
|
|
|
memset(¤t->thread.fp_state, 0, sizeof(current->thread.fp_state));
|
2013-09-10 18:21:10 +08:00
|
|
|
current->thread.fp_save_area = NULL;
|
2005-09-26 14:04:21 +08:00
|
|
|
#ifdef CONFIG_ALTIVEC
|
2013-09-10 18:20:42 +08:00
|
|
|
memset(¤t->thread.vr_state, 0, sizeof(current->thread.vr_state));
|
|
|
|
|
current->thread.vr_state.vscr.u[3] = 0x00010000; /* Java mode disabled */
|
2013-09-10 18:21:10 +08:00
|
|
|
current->thread.vr_save_area = NULL;
|
2005-09-26 14:04:21 +08:00
|
|
|
current->thread.vrsave = 0;
|
|
|
|
|
current->thread.used_vr = 0;
|
|
|
|
|
#endif /* CONFIG_ALTIVEC */
|
|
|
|
|
#ifdef CONFIG_SPE
|
|
|
|
|
memset(current->thread.evr, 0, sizeof(current->thread.evr));
|
|
|
|
|
current->thread.acc = 0;
|
|
|
|
|
current->thread.spefscr = 0;
|
|
|
|
|
current->thread.used_spe = 0;
|
|
|
|
|
#endif /* CONFIG_SPE */
|
2013-02-14 00:21:40 +08:00
|
|
|
#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
|
|
|
|
|
current->thread.tm_tfhar = 0;
|
|
|
|
|
current->thread.tm_texasr = 0;
|
|
|
|
|
current->thread.tm_tfiar = 0;
|
|
|
|
|
#endif /* CONFIG_PPC_TRANSACTIONAL_MEM */
|
2005-09-26 14:04:21 +08:00
|
|
|
}
|
2014-08-20 06:00:02 +08:00
|
|
|
EXPORT_SYMBOL(start_thread);
|
2005-09-26 14:04:21 +08:00
|
|
|
|
|
|
|
|
#define PR_FP_ALL_EXCEPT (PR_FP_EXC_DIV | PR_FP_EXC_OVF | PR_FP_EXC_UND \
|
|
|
|
|
| PR_FP_EXC_RES | PR_FP_EXC_INV)
|
|
|
|
|
|
|
|
|
|
int set_fpexc_mode(struct task_struct *tsk, unsigned int val)
|
|
|
|
|
{
|
|
|
|
|
struct pt_regs *regs = tsk->thread.regs;
|
|
|
|
|
|
|
|
|
|
/* This is a bit hairy. If we are an SPE enabled processor
|
|
|
|
|
* (have embedded fp) we store the IEEE exception enable flags in
|
|
|
|
|
* fpexc_mode. fpexc_mode is also used for setting FP exception
|
|
|
|
|
* mode (asyn, precise, disabled) for 'Classic' FP. */
|
|
|
|
|
if (val & PR_FP_EXC_SW_ENABLE) {
|
|
|
|
|
#ifdef CONFIG_SPE
|
2007-09-13 14:44:20 +08:00
|
|
|
if (cpu_has_feature(CPU_FTR_SPE)) {
|
powerpc: fix exception clearing in e500 SPE float emulation
The e500 SPE floating-point emulation code clears existing exceptions
(__FPU_FPSCR &= ~FP_EX_MASK;) before ORing in the exceptions from the
emulated operation. However, these exception bits are the "sticky",
cumulative exception bits, and should only be cleared by the user
program setting SPEFSCR, not implicitly by any floating-point
instruction (whether executed purely by the hardware or emulated).
The spurious clearing of these bits shows up as missing exceptions in
glibc testing.
Fixing this, however, is not as simple as just not clearing the bits,
because while the bits may be from previous floating-point operations
(in which case they should not be cleared), the processor can also set
the sticky bits itself before the interrupt for an exception occurs,
and this can happen in cases when IEEE 754 semantics are that the
sticky bit should not be set. Specifically, the "invalid" sticky bit
is set in various cases with non-finite operands, where IEEE 754
semantics do not involve raising such an exception, and the
"underflow" sticky bit is set in cases of exact underflow, whereas
IEEE 754 semantics are that this flag is set only for inexact
underflow. Thus, for correct emulation the kernel needs to know the
setting of these two sticky bits before the instruction being
emulated.
When a floating-point operation raises an exception, the kernel can
note the state of the sticky bits immediately afterwards. Some
<fenv.h> functions that affect the state of these bits, such as
fesetenv and feholdexcept, need to use prctl with PR_GET_FPEXC and
PR_SET_FPEXC anyway, and so it is natural to record the state of those
bits during that call into the kernel and so avoid any need for a
separate call into the kernel to inform it of a change to those bits.
Thus, the interface I chose to use (in this patch and the glibc port)
is that one of those prctl calls must be made after any userspace
change to those sticky bits, other than through a floating-point
operation that traps into the kernel anyway. feclearexcept and
fesetexceptflag duly make those calls, which would not be required
were it not for this issue.
The previous EGLIBC port, and the uClibc code copied from it, is
fundamentally broken as regards any use of prctl for floating-point
exceptions because it didn't use the PR_FP_EXC_SW_ENABLE bit in its
prctl calls (and did various worse things, such as passing a pointer
when prctl expected an integer). If you avoid anything where prctl is
used, the clearing of sticky bits still means it will never give
anything approximating correct exception semantics with existing
kernels. I don't believe the patch makes things any worse for
existing code that doesn't try to inform the kernel of changes to
sticky bits - such code may get incorrect exceptions in some cases,
but it would have done so anyway in other cases.
Signed-off-by: Joseph Myers <joseph@codesourcery.com>
Signed-off-by: Scott Wood <scottwood@freescale.com>
2013-12-11 07:07:45 +08:00
|
|
|
/*
|
|
|
|
|
* When the sticky exception bits are set
|
|
|
|
|
* directly by userspace, it must call prctl
|
|
|
|
|
* with PR_GET_FPEXC (with PR_FP_EXC_SW_ENABLE
|
|
|
|
|
* in the existing prctl settings) or
|
|
|
|
|
* PR_SET_FPEXC (with PR_FP_EXC_SW_ENABLE in
|
|
|
|
|
* the bits being set). <fenv.h> functions
|
|
|
|
|
* saving and restoring the whole
|
|
|
|
|
* floating-point environment need to do so
|
|
|
|
|
* anyway to restore the prctl settings from
|
|
|
|
|
* the saved environment.
|
|
|
|
|
*/
|
|
|
|
|
tsk->thread.spefscr_last = mfspr(SPRN_SPEFSCR);
|
2007-09-13 14:44:20 +08:00
|
|
|
tsk->thread.fpexc_mode = val &
|
|
|
|
|
(PR_FP_EXC_SW_ENABLE | PR_FP_ALL_EXCEPT);
|
|
|
|
|
return 0;
|
|
|
|
|
} else {
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
}
|
2005-09-26 14:04:21 +08:00
|
|
|
#else
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
#endif
|
|
|
|
|
}
|
2005-10-10 20:29:05 +08:00
|
|
|
|
|
|
|
|
/* on a CONFIG_SPE this does not hurt us. The bits that
|
|
|
|
|
* __pack_fe01 use do not overlap with bits used for
|
|
|
|
|
* PR_FP_EXC_SW_ENABLE. Additionally, the MSR[FE0,FE1] bits
|
|
|
|
|
* on CONFIG_SPE implementations are reserved so writing to
|
|
|
|
|
* them does not change anything */
|
|
|
|
|
if (val > PR_FP_EXC_PRECISE)
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
tsk->thread.fpexc_mode = __pack_fe01(val);
|
|
|
|
|
if (regs != NULL && (regs->msr & MSR_FP) != 0)
|
|
|
|
|
regs->msr = (regs->msr & ~(MSR_FE0|MSR_FE1))
|
|
|
|
|
| tsk->thread.fpexc_mode;
|
2005-09-26 14:04:21 +08:00
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
int get_fpexc_mode(struct task_struct *tsk, unsigned long adr)
|
|
|
|
|
{
|
|
|
|
|
unsigned int val;
|
|
|
|
|
|
|
|
|
|
if (tsk->thread.fpexc_mode & PR_FP_EXC_SW_ENABLE)
|
|
|
|
|
#ifdef CONFIG_SPE
|
powerpc: fix exception clearing in e500 SPE float emulation
The e500 SPE floating-point emulation code clears existing exceptions
(__FPU_FPSCR &= ~FP_EX_MASK;) before ORing in the exceptions from the
emulated operation. However, these exception bits are the "sticky",
cumulative exception bits, and should only be cleared by the user
program setting SPEFSCR, not implicitly by any floating-point
instruction (whether executed purely by the hardware or emulated).
The spurious clearing of these bits shows up as missing exceptions in
glibc testing.
Fixing this, however, is not as simple as just not clearing the bits,
because while the bits may be from previous floating-point operations
(in which case they should not be cleared), the processor can also set
the sticky bits itself before the interrupt for an exception occurs,
and this can happen in cases when IEEE 754 semantics are that the
sticky bit should not be set. Specifically, the "invalid" sticky bit
is set in various cases with non-finite operands, where IEEE 754
semantics do not involve raising such an exception, and the
"underflow" sticky bit is set in cases of exact underflow, whereas
IEEE 754 semantics are that this flag is set only for inexact
underflow. Thus, for correct emulation the kernel needs to know the
setting of these two sticky bits before the instruction being
emulated.
When a floating-point operation raises an exception, the kernel can
note the state of the sticky bits immediately afterwards. Some
<fenv.h> functions that affect the state of these bits, such as
fesetenv and feholdexcept, need to use prctl with PR_GET_FPEXC and
PR_SET_FPEXC anyway, and so it is natural to record the state of those
bits during that call into the kernel and so avoid any need for a
separate call into the kernel to inform it of a change to those bits.
Thus, the interface I chose to use (in this patch and the glibc port)
is that one of those prctl calls must be made after any userspace
change to those sticky bits, other than through a floating-point
operation that traps into the kernel anyway. feclearexcept and
fesetexceptflag duly make those calls, which would not be required
were it not for this issue.
The previous EGLIBC port, and the uClibc code copied from it, is
fundamentally broken as regards any use of prctl for floating-point
exceptions because it didn't use the PR_FP_EXC_SW_ENABLE bit in its
prctl calls (and did various worse things, such as passing a pointer
when prctl expected an integer). If you avoid anything where prctl is
used, the clearing of sticky bits still means it will never give
anything approximating correct exception semantics with existing
kernels. I don't believe the patch makes things any worse for
existing code that doesn't try to inform the kernel of changes to
sticky bits - such code may get incorrect exceptions in some cases,
but it would have done so anyway in other cases.
Signed-off-by: Joseph Myers <joseph@codesourcery.com>
Signed-off-by: Scott Wood <scottwood@freescale.com>
2013-12-11 07:07:45 +08:00
|
|
|
if (cpu_has_feature(CPU_FTR_SPE)) {
|
|
|
|
|
/*
|
|
|
|
|
* When the sticky exception bits are set
|
|
|
|
|
* directly by userspace, it must call prctl
|
|
|
|
|
* with PR_GET_FPEXC (with PR_FP_EXC_SW_ENABLE
|
|
|
|
|
* in the existing prctl settings) or
|
|
|
|
|
* PR_SET_FPEXC (with PR_FP_EXC_SW_ENABLE in
|
|
|
|
|
* the bits being set). <fenv.h> functions
|
|
|
|
|
* saving and restoring the whole
|
|
|
|
|
* floating-point environment need to do so
|
|
|
|
|
* anyway to restore the prctl settings from
|
|
|
|
|
* the saved environment.
|
|
|
|
|
*/
|
|
|
|
|
tsk->thread.spefscr_last = mfspr(SPRN_SPEFSCR);
|
2007-09-13 14:44:20 +08:00
|
|
|
val = tsk->thread.fpexc_mode;
|
powerpc: fix exception clearing in e500 SPE float emulation
The e500 SPE floating-point emulation code clears existing exceptions
(__FPU_FPSCR &= ~FP_EX_MASK;) before ORing in the exceptions from the
emulated operation. However, these exception bits are the "sticky",
cumulative exception bits, and should only be cleared by the user
program setting SPEFSCR, not implicitly by any floating-point
instruction (whether executed purely by the hardware or emulated).
The spurious clearing of these bits shows up as missing exceptions in
glibc testing.
Fixing this, however, is not as simple as just not clearing the bits,
because while the bits may be from previous floating-point operations
(in which case they should not be cleared), the processor can also set
the sticky bits itself before the interrupt for an exception occurs,
and this can happen in cases when IEEE 754 semantics are that the
sticky bit should not be set. Specifically, the "invalid" sticky bit
is set in various cases with non-finite operands, where IEEE 754
semantics do not involve raising such an exception, and the
"underflow" sticky bit is set in cases of exact underflow, whereas
IEEE 754 semantics are that this flag is set only for inexact
underflow. Thus, for correct emulation the kernel needs to know the
setting of these two sticky bits before the instruction being
emulated.
When a floating-point operation raises an exception, the kernel can
note the state of the sticky bits immediately afterwards. Some
<fenv.h> functions that affect the state of these bits, such as
fesetenv and feholdexcept, need to use prctl with PR_GET_FPEXC and
PR_SET_FPEXC anyway, and so it is natural to record the state of those
bits during that call into the kernel and so avoid any need for a
separate call into the kernel to inform it of a change to those bits.
Thus, the interface I chose to use (in this patch and the glibc port)
is that one of those prctl calls must be made after any userspace
change to those sticky bits, other than through a floating-point
operation that traps into the kernel anyway. feclearexcept and
fesetexceptflag duly make those calls, which would not be required
were it not for this issue.
The previous EGLIBC port, and the uClibc code copied from it, is
fundamentally broken as regards any use of prctl for floating-point
exceptions because it didn't use the PR_FP_EXC_SW_ENABLE bit in its
prctl calls (and did various worse things, such as passing a pointer
when prctl expected an integer). If you avoid anything where prctl is
used, the clearing of sticky bits still means it will never give
anything approximating correct exception semantics with existing
kernels. I don't believe the patch makes things any worse for
existing code that doesn't try to inform the kernel of changes to
sticky bits - such code may get incorrect exceptions in some cases,
but it would have done so anyway in other cases.
Signed-off-by: Joseph Myers <joseph@codesourcery.com>
Signed-off-by: Scott Wood <scottwood@freescale.com>
2013-12-11 07:07:45 +08:00
|
|
|
} else
|
2007-09-13 14:44:20 +08:00
|
|
|
return -EINVAL;
|
2005-09-26 14:04:21 +08:00
|
|
|
#else
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
#endif
|
|
|
|
|
else
|
|
|
|
|
val = __unpack_fe01(tsk->thread.fpexc_mode);
|
|
|
|
|
return put_user(val, (unsigned int __user *) adr);
|
|
|
|
|
}
|
|
|
|
|
|
2006-06-07 14:14:40 +08:00
|
|
|
int set_endian(struct task_struct *tsk, unsigned int val)
|
|
|
|
|
{
|
|
|
|
|
struct pt_regs *regs = tsk->thread.regs;
|
|
|
|
|
|
|
|
|
|
if ((val == PR_ENDIAN_LITTLE && !cpu_has_feature(CPU_FTR_REAL_LE)) ||
|
|
|
|
|
(val == PR_ENDIAN_PPC_LITTLE && !cpu_has_feature(CPU_FTR_PPC_LE)))
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
|
|
if (regs == NULL)
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
|
|
if (val == PR_ENDIAN_BIG)
|
|
|
|
|
regs->msr &= ~MSR_LE;
|
|
|
|
|
else if (val == PR_ENDIAN_LITTLE || val == PR_ENDIAN_PPC_LITTLE)
|
|
|
|
|
regs->msr |= MSR_LE;
|
|
|
|
|
else
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
int get_endian(struct task_struct *tsk, unsigned long adr)
|
|
|
|
|
{
|
|
|
|
|
struct pt_regs *regs = tsk->thread.regs;
|
|
|
|
|
unsigned int val;
|
|
|
|
|
|
|
|
|
|
if (!cpu_has_feature(CPU_FTR_PPC_LE) &&
|
|
|
|
|
!cpu_has_feature(CPU_FTR_REAL_LE))
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
|
|
if (regs == NULL)
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
|
|
if (regs->msr & MSR_LE) {
|
|
|
|
|
if (cpu_has_feature(CPU_FTR_REAL_LE))
|
|
|
|
|
val = PR_ENDIAN_LITTLE;
|
|
|
|
|
else
|
|
|
|
|
val = PR_ENDIAN_PPC_LITTLE;
|
|
|
|
|
} else
|
|
|
|
|
val = PR_ENDIAN_BIG;
|
|
|
|
|
|
|
|
|
|
return put_user(val, (unsigned int __user *)adr);
|
|
|
|
|
}
|
|
|
|
|
|
2006-06-07 14:15:39 +08:00
|
|
|
int set_unalign_ctl(struct task_struct *tsk, unsigned int val)
|
|
|
|
|
{
|
|
|
|
|
tsk->thread.align_ctl = val;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
int get_unalign_ctl(struct task_struct *tsk, unsigned long adr)
|
|
|
|
|
{
|
|
|
|
|
return put_user(tsk->thread.align_ctl, (unsigned int __user *)adr);
|
|
|
|
|
}
|
|
|
|
|
|
2007-02-19 08:42:42 +08:00
|
|
|
static inline int valid_irq_stack(unsigned long sp, struct task_struct *p,
|
|
|
|
|
unsigned long nbytes)
|
|
|
|
|
{
|
|
|
|
|
unsigned long stack_page;
|
|
|
|
|
unsigned long cpu = task_cpu(p);
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Avoid crashing if the stack has overflowed and corrupted
|
|
|
|
|
* task_cpu(p), which is in the thread_info struct.
|
|
|
|
|
*/
|
|
|
|
|
if (cpu < NR_CPUS && cpu_possible(cpu)) {
|
|
|
|
|
stack_page = (unsigned long) hardirq_ctx[cpu];
|
|
|
|
|
if (sp >= stack_page + sizeof(struct thread_struct)
|
|
|
|
|
&& sp <= stack_page + THREAD_SIZE - nbytes)
|
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
|
|
stack_page = (unsigned long) softirq_ctx[cpu];
|
|
|
|
|
if (sp >= stack_page + sizeof(struct thread_struct)
|
|
|
|
|
&& sp <= stack_page + THREAD_SIZE - nbytes)
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
2006-03-27 08:46:18 +08:00
|
|
|
int validate_sp(unsigned long sp, struct task_struct *p,
|
2005-09-26 14:04:21 +08:00
|
|
|
unsigned long nbytes)
|
|
|
|
|
{
|
2006-01-12 17:06:02 +08:00
|
|
|
unsigned long stack_page = (unsigned long)task_stack_page(p);
|
2005-09-26 14:04:21 +08:00
|
|
|
|
|
|
|
|
if (sp >= stack_page + sizeof(struct thread_struct)
|
|
|
|
|
&& sp <= stack_page + THREAD_SIZE - nbytes)
|
|
|
|
|
return 1;
|
|
|
|
|
|
2007-02-19 08:42:42 +08:00
|
|
|
return valid_irq_stack(sp, p, nbytes);
|
2005-09-26 14:04:21 +08:00
|
|
|
}
|
|
|
|
|
|
2006-03-27 08:46:18 +08:00
|
|
|
EXPORT_SYMBOL(validate_sp);
|
|
|
|
|
|
2005-09-26 14:04:21 +08:00
|
|
|
unsigned long get_wchan(struct task_struct *p)
|
|
|
|
|
{
|
|
|
|
|
unsigned long ip, sp;
|
|
|
|
|
int count = 0;
|
|
|
|
|
|
|
|
|
|
if (!p || p == current || p->state == TASK_RUNNING)
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
sp = p->thread.ksp;
|
2008-04-17 12:34:59 +08:00
|
|
|
if (!validate_sp(sp, p, STACK_FRAME_OVERHEAD))
|
2005-09-26 14:04:21 +08:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
do {
|
|
|
|
|
sp = *(unsigned long *)sp;
|
2008-04-17 12:34:59 +08:00
|
|
|
if (!validate_sp(sp, p, STACK_FRAME_OVERHEAD))
|
2005-09-26 14:04:21 +08:00
|
|
|
return 0;
|
|
|
|
|
if (count > 0) {
|
2008-04-17 12:34:59 +08:00
|
|
|
ip = ((unsigned long *)sp)[STACK_FRAME_LR_SAVE];
|
2005-09-26 14:04:21 +08:00
|
|
|
if (!in_sched_functions(ip))
|
|
|
|
|
return ip;
|
|
|
|
|
}
|
|
|
|
|
} while (count++ < 16);
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
2005-10-10 20:29:05 +08:00
|
|
|
|
2008-11-20 11:24:07 +08:00
|
|
|
static int kstack_depth_to_print = CONFIG_PRINT_STACK_DEPTH;
|
2005-10-10 20:29:05 +08:00
|
|
|
|
|
|
|
|
void show_stack(struct task_struct *tsk, unsigned long *stack)
|
|
|
|
|
{
|
|
|
|
|
unsigned long sp, ip, lr, newsp;
|
|
|
|
|
int count = 0;
|
|
|
|
|
int firstframe = 1;
|
2009-02-10 13:10:27 +08:00
|
|
|
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
|
|
|
|
|
int curr_frame = current->curr_ret_stack;
|
|
|
|
|
extern void return_to_handler(void);
|
2009-09-15 23:20:15 +08:00
|
|
|
unsigned long rth = (unsigned long)return_to_handler;
|
2009-02-10 13:10:27 +08:00
|
|
|
#endif
|
2005-10-10 20:29:05 +08:00
|
|
|
|
|
|
|
|
sp = (unsigned long) stack;
|
|
|
|
|
if (tsk == NULL)
|
|
|
|
|
tsk = current;
|
|
|
|
|
if (sp == 0) {
|
|
|
|
|
if (tsk == current)
|
2014-10-13 16:41:39 +08:00
|
|
|
sp = current_stack_pointer();
|
2005-10-10 20:29:05 +08:00
|
|
|
else
|
|
|
|
|
sp = tsk->thread.ksp;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
lr = 0;
|
|
|
|
|
printk("Call Trace:\n");
|
|
|
|
|
do {
|
2008-04-17 12:34:59 +08:00
|
|
|
if (!validate_sp(sp, tsk, STACK_FRAME_OVERHEAD))
|
2005-10-10 20:29:05 +08:00
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
stack = (unsigned long *) sp;
|
|
|
|
|
newsp = stack[0];
|
2008-04-17 12:34:59 +08:00
|
|
|
ip = stack[STACK_FRAME_LR_SAVE];
|
2005-10-10 20:29:05 +08:00
|
|
|
if (!firstframe || ip != lr) {
|
2008-07-07 11:44:31 +08:00
|
|
|
printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
|
2009-02-10 13:10:27 +08:00
|
|
|
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
|
2014-09-17 15:07:03 +08:00
|
|
|
if ((ip == rth) && curr_frame >= 0) {
|
2016-11-02 19:20:46 +08:00
|
|
|
pr_cont(" (%pS)",
|
2009-02-10 13:10:27 +08:00
|
|
|
(void *)current->ret_stack[curr_frame].ret);
|
|
|
|
|
curr_frame--;
|
|
|
|
|
}
|
|
|
|
|
#endif
|
2005-10-10 20:29:05 +08:00
|
|
|
if (firstframe)
|
2016-11-02 19:20:46 +08:00
|
|
|
pr_cont(" (unreliable)");
|
|
|
|
|
pr_cont("\n");
|
2005-10-10 20:29:05 +08:00
|
|
|
}
|
|
|
|
|
firstframe = 0;
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* See if this is an exception frame.
|
|
|
|
|
* We look for the "regshere" marker in the current frame.
|
|
|
|
|
*/
|
2008-04-17 12:34:59 +08:00
|
|
|
if (validate_sp(sp, tsk, STACK_INT_FRAME_SIZE)
|
|
|
|
|
&& stack[STACK_FRAME_MARKER] == STACK_FRAME_REGS_MARKER) {
|
2005-10-10 20:29:05 +08:00
|
|
|
struct pt_regs *regs = (struct pt_regs *)
|
|
|
|
|
(sp + STACK_FRAME_OVERHEAD);
|
|
|
|
|
lr = regs->link;
|
2014-06-12 14:53:08 +08:00
|
|
|
printk("--- interrupt: %lx at %pS\n LR = %pS\n",
|
2008-07-07 11:44:31 +08:00
|
|
|
regs->trap, (void *)regs->nip, (void *)lr);
|
2005-10-10 20:29:05 +08:00
|
|
|
firstframe = 1;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
sp = newsp;
|
|
|
|
|
} while (count++ < kstack_depth_to_print);
|
|
|
|
|
}
|
|
|
|
|
|
2006-02-13 11:48:35 +08:00
|
|
|
#ifdef CONFIG_PPC64
|
2012-03-01 09:45:27 +08:00
|
|
|
/* Called with hard IRQs off */
|
2013-06-13 19:04:56 +08:00
|
|
|
void notrace __ppc64_runlatch_on(void)
|
2006-02-13 11:48:35 +08:00
|
|
|
{
|
2012-03-01 09:45:27 +08:00
|
|
|
struct thread_info *ti = current_thread_info();
|
2006-02-13 11:48:35 +08:00
|
|
|
unsigned long ctrl;
|
|
|
|
|
|
2012-03-01 09:45:27 +08:00
|
|
|
ctrl = mfspr(SPRN_CTRLF);
|
|
|
|
|
ctrl |= CTRL_RUNLATCH;
|
|
|
|
|
mtspr(SPRN_CTRLT, ctrl);
|
2006-02-13 11:48:35 +08:00
|
|
|
|
2012-04-11 08:42:15 +08:00
|
|
|
ti->local_flags |= _TLF_RUNLATCH;
|
2006-02-13 11:48:35 +08:00
|
|
|
}
|
|
|
|
|
|
2012-03-01 09:45:27 +08:00
|
|
|
/* Called with hard IRQs off */
|
2013-06-13 19:04:56 +08:00
|
|
|
void notrace __ppc64_runlatch_off(void)
|
2006-02-13 11:48:35 +08:00
|
|
|
{
|
2012-03-01 09:45:27 +08:00
|
|
|
struct thread_info *ti = current_thread_info();
|
2006-02-13 11:48:35 +08:00
|
|
|
unsigned long ctrl;
|
|
|
|
|
|
2012-04-11 08:42:15 +08:00
|
|
|
ti->local_flags &= ~_TLF_RUNLATCH;
|
2006-02-13 11:48:35 +08:00
|
|
|
|
2010-08-06 11:28:19 +08:00
|
|
|
ctrl = mfspr(SPRN_CTRLF);
|
|
|
|
|
ctrl &= ~CTRL_RUNLATCH;
|
|
|
|
|
mtspr(SPRN_CTRLT, ctrl);
|
2006-02-13 11:48:35 +08:00
|
|
|
}
|
2012-03-01 09:45:27 +08:00
|
|
|
#endif /* CONFIG_PPC64 */
|
2008-04-18 14:56:17 +08:00
|
|
|
|
2009-02-22 09:50:03 +08:00
|
|
|
unsigned long arch_align_stack(unsigned long sp)
|
|
|
|
|
{
|
|
|
|
|
if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
|
|
|
|
|
sp -= get_random_int() & ~PAGE_MASK;
|
|
|
|
|
return sp & ~0xf;
|
|
|
|
|
}
|
2009-02-22 09:50:04 +08:00
|
|
|
|
|
|
|
|
static inline unsigned long brk_rnd(void)
|
|
|
|
|
{
|
|
|
|
|
unsigned long rnd = 0;
|
|
|
|
|
|
|
|
|
|
/* 8MB for 32bit, 1GB for 64bit */
|
|
|
|
|
if (is_32bit_task())
|
2016-02-27 07:19:37 +08:00
|
|
|
rnd = (get_random_long() % (1UL<<(23-PAGE_SHIFT)));
|
2009-02-22 09:50:04 +08:00
|
|
|
else
|
2016-02-27 07:19:37 +08:00
|
|
|
rnd = (get_random_long() % (1UL<<(30-PAGE_SHIFT)));
|
2009-02-22 09:50:04 +08:00
|
|
|
|
|
|
|
|
return rnd << PAGE_SHIFT;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
unsigned long arch_randomize_brk(struct mm_struct *mm)
|
|
|
|
|
{
|
2009-09-22 00:52:35 +08:00
|
|
|
unsigned long base = mm->brk;
|
|
|
|
|
unsigned long ret;
|
|
|
|
|
|
2009-10-16 15:05:17 +08:00
|
|
|
#ifdef CONFIG_PPC_STD_MMU_64
|
2009-09-22 00:52:35 +08:00
|
|
|
/*
|
|
|
|
|
* If we are using 1TB segments and we are allowed to randomise
|
|
|
|
|
* the heap, we can put it above 1TB so it is backed by a 1TB
|
|
|
|
|
* segment. Otherwise the heap will be in the bottom 1TB
|
|
|
|
|
* which always uses 256MB segments and this may result in a
|
2016-04-29 21:26:07 +08:00
|
|
|
* performance penalty. We don't need to worry about radix. For
|
|
|
|
|
* radix, mmu_highuser_ssize remains unchanged from 256MB.
|
2009-09-22 00:52:35 +08:00
|
|
|
*/
|
|
|
|
|
if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
|
|
|
|
|
base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
ret = PAGE_ALIGN(base + brk_rnd());
|
2009-02-22 09:50:04 +08:00
|
|
|
|
|
|
|
|
if (ret < mm->brk)
|
|
|
|
|
return mm->brk;
|
|
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
2009-02-22 09:50:07 +08:00
|
|
|
|