]> git.proxmox.com Git - mirror_ubuntu-eoan-kernel.git/blob - arch/mips/kernel/process.c
MIPS: Prevent unaligned accesses during stack unwinding
[mirror_ubuntu-eoan-kernel.git] / arch / mips / kernel / process.c
1 /*
2 * This file is subject to the terms and conditions of the GNU General Public
3 * License. See the file "COPYING" in the main directory of this archive
4 * for more details.
5 *
6 * Copyright (C) 1994 - 1999, 2000 by Ralf Baechle and others.
7 * Copyright (C) 2005, 2006 by Ralf Baechle (ralf@linux-mips.org)
8 * Copyright (C) 1999, 2000 Silicon Graphics, Inc.
9 * Copyright (C) 2004 Thiemo Seufer
10 * Copyright (C) 2013 Imagination Technologies Ltd.
11 */
12 #include <linux/errno.h>
13 #include <linux/sched.h>
14 #include <linux/tick.h>
15 #include <linux/kernel.h>
16 #include <linux/mm.h>
17 #include <linux/stddef.h>
18 #include <linux/unistd.h>
19 #include <linux/export.h>
20 #include <linux/ptrace.h>
21 #include <linux/mman.h>
22 #include <linux/personality.h>
23 #include <linux/sys.h>
24 #include <linux/init.h>
25 #include <linux/completion.h>
26 #include <linux/kallsyms.h>
27 #include <linux/random.h>
28 #include <linux/prctl.h>
29
30 #include <asm/asm.h>
31 #include <asm/bootinfo.h>
32 #include <asm/cpu.h>
33 #include <asm/dsemul.h>
34 #include <asm/dsp.h>
35 #include <asm/fpu.h>
36 #include <asm/irq.h>
37 #include <asm/msa.h>
38 #include <asm/pgtable.h>
39 #include <asm/mipsregs.h>
40 #include <asm/processor.h>
41 #include <asm/reg.h>
42 #include <linux/uaccess.h>
43 #include <asm/io.h>
44 #include <asm/elf.h>
45 #include <asm/isadep.h>
46 #include <asm/inst.h>
47 #include <asm/stacktrace.h>
48 #include <asm/irq_regs.h>
49
50 #ifdef CONFIG_HOTPLUG_CPU
51 void arch_cpu_idle_dead(void)
52 {
53 /* What the heck is this check doing ? */
54 if (!cpumask_test_cpu(smp_processor_id(), &cpu_callin_map))
55 play_dead();
56 }
57 #endif
58
59 asmlinkage void ret_from_fork(void);
60 asmlinkage void ret_from_kernel_thread(void);
61
62 void start_thread(struct pt_regs * regs, unsigned long pc, unsigned long sp)
63 {
64 unsigned long status;
65
66 /* New thread loses kernel privileges. */
67 status = regs->cp0_status & ~(ST0_CU0|ST0_CU1|ST0_FR|KU_MASK);
68 status |= KU_USER;
69 regs->cp0_status = status;
70 lose_fpu(0);
71 clear_thread_flag(TIF_MSA_CTX_LIVE);
72 clear_used_math();
73 atomic_set(&current->thread.bd_emu_frame, BD_EMUFRAME_NONE);
74 init_dsp();
75 regs->cp0_epc = pc;
76 regs->regs[29] = sp;
77 }
78
79 void exit_thread(struct task_struct *tsk)
80 {
81 /*
82 * User threads may have allocated a delay slot emulation frame.
83 * If so, clean up that allocation.
84 */
85 if (!(current->flags & PF_KTHREAD))
86 dsemul_thread_cleanup(tsk);
87 }
88
89 int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
90 {
91 /*
92 * Save any process state which is live in hardware registers to the
93 * parent context prior to duplication. This prevents the new child
94 * state becoming stale if the parent is preempted before copy_thread()
95 * gets a chance to save the parent's live hardware registers to the
96 * child context.
97 */
98 preempt_disable();
99
100 if (is_msa_enabled())
101 save_msa(current);
102 else if (is_fpu_owner())
103 _save_fp(current);
104
105 save_dsp(current);
106
107 preempt_enable();
108
109 *dst = *src;
110 return 0;
111 }
112
113 /*
114 * Copy architecture-specific thread state
115 */
116 int copy_thread(unsigned long clone_flags, unsigned long usp,
117 unsigned long kthread_arg, struct task_struct *p)
118 {
119 struct thread_info *ti = task_thread_info(p);
120 struct pt_regs *childregs, *regs = current_pt_regs();
121 unsigned long childksp;
122 p->set_child_tid = p->clear_child_tid = NULL;
123
124 childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE - 32;
125
126 /* set up new TSS. */
127 childregs = (struct pt_regs *) childksp - 1;
128 /* Put the stack after the struct pt_regs. */
129 childksp = (unsigned long) childregs;
130 p->thread.cp0_status = read_c0_status() & ~(ST0_CU2|ST0_CU1);
131 if (unlikely(p->flags & PF_KTHREAD)) {
132 /* kernel thread */
133 unsigned long status = p->thread.cp0_status;
134 memset(childregs, 0, sizeof(struct pt_regs));
135 ti->addr_limit = KERNEL_DS;
136 p->thread.reg16 = usp; /* fn */
137 p->thread.reg17 = kthread_arg;
138 p->thread.reg29 = childksp;
139 p->thread.reg31 = (unsigned long) ret_from_kernel_thread;
140 #if defined(CONFIG_CPU_R3000) || defined(CONFIG_CPU_TX39XX)
141 status = (status & ~(ST0_KUP | ST0_IEP | ST0_IEC)) |
142 ((status & (ST0_KUC | ST0_IEC)) << 2);
143 #else
144 status |= ST0_EXL;
145 #endif
146 childregs->cp0_status = status;
147 return 0;
148 }
149
150 /* user thread */
151 *childregs = *regs;
152 childregs->regs[7] = 0; /* Clear error flag */
153 childregs->regs[2] = 0; /* Child gets zero as return value */
154 if (usp)
155 childregs->regs[29] = usp;
156 ti->addr_limit = USER_DS;
157
158 p->thread.reg29 = (unsigned long) childregs;
159 p->thread.reg31 = (unsigned long) ret_from_fork;
160
161 /*
162 * New tasks lose permission to use the fpu. This accelerates context
163 * switching for most programs since they don't use the fpu.
164 */
165 childregs->cp0_status &= ~(ST0_CU2|ST0_CU1);
166
167 clear_tsk_thread_flag(p, TIF_USEDFPU);
168 clear_tsk_thread_flag(p, TIF_USEDMSA);
169 clear_tsk_thread_flag(p, TIF_MSA_CTX_LIVE);
170
171 #ifdef CONFIG_MIPS_MT_FPAFF
172 clear_tsk_thread_flag(p, TIF_FPUBOUND);
173 #endif /* CONFIG_MIPS_MT_FPAFF */
174
175 atomic_set(&p->thread.bd_emu_frame, BD_EMUFRAME_NONE);
176
177 if (clone_flags & CLONE_SETTLS)
178 ti->tp_value = regs->regs[7];
179
180 return 0;
181 }
182
183 #ifdef CONFIG_CC_STACKPROTECTOR
184 #include <linux/stackprotector.h>
185 unsigned long __stack_chk_guard __read_mostly;
186 EXPORT_SYMBOL(__stack_chk_guard);
187 #endif
188
189 struct mips_frame_info {
190 void *func;
191 unsigned long func_size;
192 int frame_size;
193 int pc_offset;
194 };
195
196 #define J_TARGET(pc,target) \
197 (((unsigned long)(pc) & 0xf0000000) | ((target) << 2))
198
199 static inline int is_ra_save_ins(union mips_instruction *ip)
200 {
201 #ifdef CONFIG_CPU_MICROMIPS
202 /*
203 * swsp ra,offset
204 * swm16 reglist,offset(sp)
205 * swm32 reglist,offset(sp)
206 * sw32 ra,offset(sp)
207 * jradiussp - NOT SUPPORTED
208 *
209 * microMIPS is way more fun...
210 */
211 if (mm_insn_16bit(ip->halfword[1])) {
212 return (ip->mm16_r5_format.opcode == mm_swsp16_op &&
213 ip->mm16_r5_format.rt == 31) ||
214 (ip->mm16_m_format.opcode == mm_pool16c_op &&
215 ip->mm16_m_format.func == mm_swm16_op);
216 }
217 else {
218 return (ip->mm_m_format.opcode == mm_pool32b_op &&
219 ip->mm_m_format.rd > 9 &&
220 ip->mm_m_format.base == 29 &&
221 ip->mm_m_format.func == mm_swm32_func) ||
222 (ip->i_format.opcode == mm_sw32_op &&
223 ip->i_format.rs == 29 &&
224 ip->i_format.rt == 31);
225 }
226 #else
227 /* sw / sd $ra, offset($sp) */
228 return (ip->i_format.opcode == sw_op || ip->i_format.opcode == sd_op) &&
229 ip->i_format.rs == 29 &&
230 ip->i_format.rt == 31;
231 #endif
232 }
233
234 static inline int is_jump_ins(union mips_instruction *ip)
235 {
236 #ifdef CONFIG_CPU_MICROMIPS
237 /*
238 * jr16,jrc,jalr16,jalr16
239 * jal
240 * jalr/jr,jalr.hb/jr.hb,jalrs,jalrs.hb
241 * jraddiusp - NOT SUPPORTED
242 *
243 * microMIPS is kind of more fun...
244 */
245 if ((ip->mm16_r5_format.opcode == mm_pool16c_op &&
246 (ip->mm16_r5_format.rt & mm_jr16_op) == mm_jr16_op) ||
247 ip->j_format.opcode == mm_jal32_op)
248 return 1;
249 if (ip->r_format.opcode != mm_pool32a_op ||
250 ip->r_format.func != mm_pool32axf_op)
251 return 0;
252 return ((ip->u_format.uimmediate >> 6) & mm_jalr_op) == mm_jalr_op;
253 #else
254 if (ip->j_format.opcode == j_op)
255 return 1;
256 if (ip->j_format.opcode == jal_op)
257 return 1;
258 if (ip->r_format.opcode != spec_op)
259 return 0;
260 return ip->r_format.func == jalr_op || ip->r_format.func == jr_op;
261 #endif
262 }
263
264 static inline int is_sp_move_ins(union mips_instruction *ip)
265 {
266 #ifdef CONFIG_CPU_MICROMIPS
267 /*
268 * addiusp -imm
269 * addius5 sp,-imm
270 * addiu32 sp,sp,-imm
271 * jradiussp - NOT SUPPORTED
272 *
273 * microMIPS is not more fun...
274 */
275 if (mm_insn_16bit(ip->halfword[1])) {
276 return (ip->mm16_r3_format.opcode == mm_pool16d_op &&
277 ip->mm16_r3_format.simmediate && mm_addiusp_func) ||
278 (ip->mm16_r5_format.opcode == mm_pool16d_op &&
279 ip->mm16_r5_format.rt == 29);
280 }
281
282 return ip->mm_i_format.opcode == mm_addiu32_op &&
283 ip->mm_i_format.rt == 29 && ip->mm_i_format.rs == 29;
284 #else
285 /* addiu/daddiu sp,sp,-imm */
286 if (ip->i_format.rs != 29 || ip->i_format.rt != 29)
287 return 0;
288 if (ip->i_format.opcode == addiu_op || ip->i_format.opcode == daddiu_op)
289 return 1;
290 #endif
291 return 0;
292 }
293
294 static int get_frame_info(struct mips_frame_info *info)
295 {
296 bool is_mmips = IS_ENABLED(CONFIG_CPU_MICROMIPS);
297 union mips_instruction insn, *ip;
298 unsigned max_insns = info->func_size / sizeof(union mips_instruction);
299 unsigned i;
300
301 info->pc_offset = -1;
302 info->frame_size = 0;
303
304 ip = (void *)msk_isa16_mode((ulong)info->func);
305 if (!ip)
306 goto err;
307
308 if (max_insns == 0)
309 max_insns = 128U; /* unknown function size */
310 max_insns = min(128U, max_insns);
311
312 for (i = 0; i < max_insns; i++, ip++) {
313 if (is_mmips && mm_insn_16bit(ip->halfword[0])) {
314 insn.halfword[0] = 0;
315 insn.halfword[1] = ip->halfword[0];
316 } else if (is_mmips) {
317 insn.halfword[0] = ip->halfword[1];
318 insn.halfword[1] = ip->halfword[0];
319 } else {
320 insn.word = ip->word;
321 }
322
323 if (is_jump_ins(&insn))
324 break;
325
326 if (!info->frame_size) {
327 if (is_sp_move_ins(&insn))
328 {
329 #ifdef CONFIG_CPU_MICROMIPS
330 if (mm_insn_16bit(ip->halfword[0]))
331 {
332 unsigned short tmp;
333
334 if (ip->halfword[0] & mm_addiusp_func)
335 {
336 tmp = (((ip->halfword[0] >> 1) & 0x1ff) << 2);
337 info->frame_size = -(signed short)(tmp | ((tmp & 0x100) ? 0xfe00 : 0));
338 } else {
339 tmp = (ip->halfword[0] >> 1);
340 info->frame_size = -(signed short)(tmp & 0xf);
341 }
342 ip = (void *) &ip->halfword[1];
343 ip--;
344 } else
345 #endif
346 info->frame_size = - ip->i_format.simmediate;
347 }
348 continue;
349 }
350 if (info->pc_offset == -1 && is_ra_save_ins(&insn)) {
351 info->pc_offset =
352 ip->i_format.simmediate / sizeof(long);
353 break;
354 }
355 }
356 if (info->frame_size && info->pc_offset >= 0) /* nested */
357 return 0;
358 if (info->pc_offset < 0) /* leaf */
359 return 1;
360 /* prologue seems bogus... */
361 err:
362 return -1;
363 }
364
365 static struct mips_frame_info schedule_mfi __read_mostly;
366
367 #ifdef CONFIG_KALLSYMS
368 static unsigned long get___schedule_addr(void)
369 {
370 return kallsyms_lookup_name("__schedule");
371 }
372 #else
373 static unsigned long get___schedule_addr(void)
374 {
375 union mips_instruction *ip = (void *)schedule;
376 int max_insns = 8;
377 int i;
378
379 for (i = 0; i < max_insns; i++, ip++) {
380 if (ip->j_format.opcode == j_op)
381 return J_TARGET(ip, ip->j_format.target);
382 }
383 return 0;
384 }
385 #endif
386
387 static int __init frame_info_init(void)
388 {
389 unsigned long size = 0;
390 #ifdef CONFIG_KALLSYMS
391 unsigned long ofs;
392 #endif
393 unsigned long addr;
394
395 addr = get___schedule_addr();
396 if (!addr)
397 addr = (unsigned long)schedule;
398
399 #ifdef CONFIG_KALLSYMS
400 kallsyms_lookup_size_offset(addr, &size, &ofs);
401 #endif
402 schedule_mfi.func = (void *)addr;
403 schedule_mfi.func_size = size;
404
405 get_frame_info(&schedule_mfi);
406
407 /*
408 * Without schedule() frame info, result given by
409 * thread_saved_pc() and get_wchan() are not reliable.
410 */
411 if (schedule_mfi.pc_offset < 0)
412 printk("Can't analyze schedule() prologue at %p\n", schedule);
413
414 return 0;
415 }
416
417 arch_initcall(frame_info_init);
418
419 /*
420 * Return saved PC of a blocked thread.
421 */
422 unsigned long thread_saved_pc(struct task_struct *tsk)
423 {
424 struct thread_struct *t = &tsk->thread;
425
426 /* New born processes are a special case */
427 if (t->reg31 == (unsigned long) ret_from_fork)
428 return t->reg31;
429 if (schedule_mfi.pc_offset < 0)
430 return 0;
431 return ((unsigned long *)t->reg29)[schedule_mfi.pc_offset];
432 }
433
434
435 #ifdef CONFIG_KALLSYMS
436 /* generic stack unwinding function */
437 unsigned long notrace unwind_stack_by_address(unsigned long stack_page,
438 unsigned long *sp,
439 unsigned long pc,
440 unsigned long *ra)
441 {
442 struct mips_frame_info info;
443 unsigned long size, ofs;
444 int leaf;
445 extern void ret_from_irq(void);
446 extern void ret_from_exception(void);
447
448 if (!stack_page)
449 return 0;
450
451 /*
452 * If we reached the bottom of interrupt context,
453 * return saved pc in pt_regs.
454 */
455 if (pc == (unsigned long)ret_from_irq ||
456 pc == (unsigned long)ret_from_exception) {
457 struct pt_regs *regs;
458 if (*sp >= stack_page &&
459 *sp + sizeof(*regs) <= stack_page + THREAD_SIZE - 32) {
460 regs = (struct pt_regs *)*sp;
461 pc = regs->cp0_epc;
462 if (!user_mode(regs) && __kernel_text_address(pc)) {
463 *sp = regs->regs[29];
464 *ra = regs->regs[31];
465 return pc;
466 }
467 }
468 return 0;
469 }
470 if (!kallsyms_lookup_size_offset(pc, &size, &ofs))
471 return 0;
472 /*
473 * Return ra if an exception occurred at the first instruction
474 */
475 if (unlikely(ofs == 0)) {
476 pc = *ra;
477 *ra = 0;
478 return pc;
479 }
480
481 info.func = (void *)(pc - ofs);
482 info.func_size = ofs; /* analyze from start to ofs */
483 leaf = get_frame_info(&info);
484 if (leaf < 0)
485 return 0;
486
487 if (*sp < stack_page ||
488 *sp + info.frame_size > stack_page + THREAD_SIZE - 32)
489 return 0;
490
491 if (leaf)
492 /*
493 * For some extreme cases, get_frame_info() can
494 * consider wrongly a nested function as a leaf
495 * one. In that cases avoid to return always the
496 * same value.
497 */
498 pc = pc != *ra ? *ra : 0;
499 else
500 pc = ((unsigned long *)(*sp))[info.pc_offset];
501
502 *sp += info.frame_size;
503 *ra = 0;
504 return __kernel_text_address(pc) ? pc : 0;
505 }
506 EXPORT_SYMBOL(unwind_stack_by_address);
507
508 /* used by show_backtrace() */
509 unsigned long unwind_stack(struct task_struct *task, unsigned long *sp,
510 unsigned long pc, unsigned long *ra)
511 {
512 unsigned long stack_page = 0;
513 int cpu;
514
515 for_each_possible_cpu(cpu) {
516 if (on_irq_stack(cpu, *sp)) {
517 stack_page = (unsigned long)irq_stack[cpu];
518 break;
519 }
520 }
521
522 if (!stack_page)
523 stack_page = (unsigned long)task_stack_page(task);
524
525 return unwind_stack_by_address(stack_page, sp, pc, ra);
526 }
527 #endif
528
529 /*
530 * get_wchan - a maintenance nightmare^W^Wpain in the ass ...
531 */
532 unsigned long get_wchan(struct task_struct *task)
533 {
534 unsigned long pc = 0;
535 #ifdef CONFIG_KALLSYMS
536 unsigned long sp;
537 unsigned long ra = 0;
538 #endif
539
540 if (!task || task == current || task->state == TASK_RUNNING)
541 goto out;
542 if (!task_stack_page(task))
543 goto out;
544
545 pc = thread_saved_pc(task);
546
547 #ifdef CONFIG_KALLSYMS
548 sp = task->thread.reg29 + schedule_mfi.frame_size;
549
550 while (in_sched_functions(pc))
551 pc = unwind_stack(task, &sp, pc, &ra);
552 #endif
553
554 out:
555 return pc;
556 }
557
558 /*
559 * Don't forget that the stack pointer must be aligned on a 8 bytes
560 * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
561 */
562 unsigned long arch_align_stack(unsigned long sp)
563 {
564 if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
565 sp -= get_random_int() & ~PAGE_MASK;
566
567 return sp & ALMASK;
568 }
569
570 static void arch_dump_stack(void *info)
571 {
572 struct pt_regs *regs;
573
574 regs = get_irq_regs();
575
576 if (regs)
577 show_regs(regs);
578
579 dump_stack();
580 }
581
582 void arch_trigger_cpumask_backtrace(const cpumask_t *mask, bool exclude_self)
583 {
584 long this_cpu = get_cpu();
585
586 if (cpumask_test_cpu(this_cpu, mask) && !exclude_self)
587 dump_stack();
588
589 smp_call_function_many(mask, arch_dump_stack, NULL, 1);
590
591 put_cpu();
592 }
593
594 int mips_get_process_fp_mode(struct task_struct *task)
595 {
596 int value = 0;
597
598 if (!test_tsk_thread_flag(task, TIF_32BIT_FPREGS))
599 value |= PR_FP_MODE_FR;
600 if (test_tsk_thread_flag(task, TIF_HYBRID_FPREGS))
601 value |= PR_FP_MODE_FRE;
602
603 return value;
604 }
605
606 static void prepare_for_fp_mode_switch(void *info)
607 {
608 struct mm_struct *mm = info;
609
610 if (current->mm == mm)
611 lose_fpu(1);
612 }
613
614 int mips_set_process_fp_mode(struct task_struct *task, unsigned int value)
615 {
616 const unsigned int known_bits = PR_FP_MODE_FR | PR_FP_MODE_FRE;
617 struct task_struct *t;
618 int max_users;
619
620 /* Check the value is valid */
621 if (value & ~known_bits)
622 return -EOPNOTSUPP;
623
624 /* Avoid inadvertently triggering emulation */
625 if ((value & PR_FP_MODE_FR) && raw_cpu_has_fpu &&
626 !(raw_current_cpu_data.fpu_id & MIPS_FPIR_F64))
627 return -EOPNOTSUPP;
628 if ((value & PR_FP_MODE_FRE) && raw_cpu_has_fpu && !cpu_has_fre)
629 return -EOPNOTSUPP;
630
631 /* FR = 0 not supported in MIPS R6 */
632 if (!(value & PR_FP_MODE_FR) && raw_cpu_has_fpu && cpu_has_mips_r6)
633 return -EOPNOTSUPP;
634
635 /* Proceed with the mode switch */
636 preempt_disable();
637
638 /* Save FP & vector context, then disable FPU & MSA */
639 if (task->signal == current->signal)
640 lose_fpu(1);
641
642 /* Prevent any threads from obtaining live FP context */
643 atomic_set(&task->mm->context.fp_mode_switching, 1);
644 smp_mb__after_atomic();
645
646 /*
647 * If there are multiple online CPUs then force any which are running
648 * threads in this process to lose their FPU context, which they can't
649 * regain until fp_mode_switching is cleared later.
650 */
651 if (num_online_cpus() > 1) {
652 /* No need to send an IPI for the local CPU */
653 max_users = (task->mm == current->mm) ? 1 : 0;
654
655 if (atomic_read(&current->mm->mm_users) > max_users)
656 smp_call_function(prepare_for_fp_mode_switch,
657 (void *)current->mm, 1);
658 }
659
660 /*
661 * There are now no threads of the process with live FP context, so it
662 * is safe to proceed with the FP mode switch.
663 */
664 for_each_thread(task, t) {
665 /* Update desired FP register width */
666 if (value & PR_FP_MODE_FR) {
667 clear_tsk_thread_flag(t, TIF_32BIT_FPREGS);
668 } else {
669 set_tsk_thread_flag(t, TIF_32BIT_FPREGS);
670 clear_tsk_thread_flag(t, TIF_MSA_CTX_LIVE);
671 }
672
673 /* Update desired FP single layout */
674 if (value & PR_FP_MODE_FRE)
675 set_tsk_thread_flag(t, TIF_HYBRID_FPREGS);
676 else
677 clear_tsk_thread_flag(t, TIF_HYBRID_FPREGS);
678 }
679
680 /* Allow threads to use FP again */
681 atomic_set(&task->mm->context.fp_mode_switching, 0);
682 preempt_enable();
683
684 return 0;
685 }