* [PATCH v2 0/3] Refactor FTLBPar exception handling and add GSExc handler
@ 2020-07-21 18:37 WANG Xuerui
2020-07-21 18:37 ` [PATCH v2 1/3] MIPS: only register FTLBPar exception handler for supported models WANG Xuerui
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: WANG Xuerui @ 2020-07-21 18:37 UTC (permalink / raw)
To: linux-mips; +Cc: WANG Xuerui
It was found that some undocumented unprivileged instructions could
crash the kernel with a "FTLB parity error" on Loongson-3A4000, but the
error registers were garbage:
[ 896.970419] FTLB error exception, cp0_ecc=0x00000002:
[ 896.975446] cp0_errorepc == ffffffffffffffff
[ 896.979755] c0_cacheerr == 00000000
[ 896.983277] Decoded c0_cacheerr: primary cache fault in insn reference.
[ 896.989963] Cache error exception:
[ 896.993396] cp0_errorepc == ffffffffffffffff
[ 896.997707] c0_cacheerr == 00000000
[ 897.001228] Decoded c0_cacheerr: primary cache fault in insn reference.
[ 897.007916] Error bits:
[ 897.010467] IDX: 0x00000000
[ 897.013284] Kernel panic - not syncing: Can't handle the cache error!
[ 897.019807] ---[ end Kernel panic - not syncing: Can't handle the cache error! ]---
Turns out the FTLBPar exception code is actually implementation-specific.
On Loongson cores the exception is "GSExc" instead, and is non-fatal in
Loongson's linux-3.10 fork. So we dynamically register the correct handler
for the exception, and do not panic on the specific undocumented case.
P.S. There is not much space left in the cpuinfo_mips.options flag. We
should consider moving to something like x86's feature flags that is
extensible.
v2:
- Removed stray GSExc logic in cpu_probe_legacy, pointed out by Huacai
WANG Xuerui (3):
MIPS: only register FTLBPar exception handler for supported models
MIPS: add definitions for Loongson-specific CP0.Diag1 register
MIPS: handle Loongson-specific GSExc exception
arch/mips/include/asm/cpu-features.h | 10 ++++++++
arch/mips/include/asm/cpu.h | 2 ++
arch/mips/include/asm/mipsregs.h | 11 ++++++++
arch/mips/kernel/cpu-probe.c | 16 ++++++++++++
arch/mips/kernel/genex.S | 7 +++++
arch/mips/kernel/traps.c | 38 +++++++++++++++++++++++++++-
6 files changed, 83 insertions(+), 1 deletion(-)
--
2.25.1
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH v2 1/3] MIPS: only register FTLBPar exception handler for supported models 2020-07-21 18:37 [PATCH v2 0/3] Refactor FTLBPar exception handling and add GSExc handler WANG Xuerui @ 2020-07-21 18:37 ` WANG Xuerui 2020-07-21 18:37 ` [PATCH v2 2/3] MIPS: add definitions for Loongson-specific CP0.Diag1 register WANG Xuerui 2020-07-21 18:37 ` [PATCH v2 3/3] MIPS: handle Loongson-specific GSExc exception WANG Xuerui 2 siblings, 0 replies; 6+ messages in thread From: WANG Xuerui @ 2020-07-21 18:37 UTC (permalink / raw) To: linux-mips Cc: WANG Xuerui, Leonid Yegoshin, Markos Chandras, John Crispin, Paul Burton Previously ExcCode 16 is unconditionally treated as the FTLB parity exception (FTLBPar), but in fact its semantic is implementation- dependent. Looking at various manuals it seems the FTLBPar exception is only present on some recent MIPS Technologies cores, so only register the handler on these. Fixes: 75b5b5e0a262790f ("MIPS: Add support for FTLBs") Signed-off-by: WANG Xuerui <git@xen0n.name> Cc: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com> Cc: Markos Chandras <markos.chandras@imgtec.com> Cc: John Crispin <blogic@openwrt.org> Cc: Paul Burton <paulburton@kernel.org> --- arch/mips/include/asm/cpu-features.h | 4 ++++ arch/mips/include/asm/cpu.h | 1 + arch/mips/kernel/cpu-probe.c | 13 +++++++++++++ arch/mips/kernel/traps.c | 3 ++- 4 files changed, 20 insertions(+), 1 deletion(-) diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h index 724dfddcab92..0b1bc7ed913b 100644 --- a/arch/mips/include/asm/cpu-features.h +++ b/arch/mips/include/asm/cpu-features.h @@ -568,6 +568,10 @@ # define cpu_has_mac2008_only __opt(MIPS_CPU_MAC_2008_ONLY) #endif +#ifndef cpu_has_ftlbparex +# define cpu_has_ftlbparex __opt(MIPS_CPU_FTLBPAREX) +#endif + #ifdef CONFIG_SMP /* * Some systems share FTLB RAMs between threads within a core (siblings in diff --git a/arch/mips/include/asm/cpu.h b/arch/mips/include/asm/cpu.h index 104a509312b3..3a4773714b29 100644 --- a/arch/mips/include/asm/cpu.h +++ b/arch/mips/include/asm/cpu.h @@ -425,6 +425,7 @@ enum cpu_type_enum { #define MIPS_CPU_MM_SYSAD BIT_ULL(58) /* CPU supports write-through SysAD Valid merge */ #define MIPS_CPU_MM_FULL BIT_ULL(59) /* CPU supports write-through full merge */ #define MIPS_CPU_MAC_2008_ONLY BIT_ULL(60) /* CPU Only support MAC2008 Fused multiply-add instruction */ +#define MIPS_CPU_FTLBPAREX BIT_ULL(61) /* CPU has FTLB parity exception */ /* * CPU ASE encodings diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c index c231c1b67889..9e325862e810 100644 --- a/arch/mips/kernel/cpu-probe.c +++ b/arch/mips/kernel/cpu-probe.c @@ -1827,6 +1827,19 @@ static inline void cpu_probe_mips(struct cpuinfo_mips *c, unsigned int cpu) default: break; } + + /* Recent MIPS cores use the implementation-dependent ExcCode 16 for + * cache/FTLB parity exceptions. + */ + switch (__get_cpu_type(c->cputype)) { + case CPU_PROAPTIV: + case CPU_P5600: + case CPU_P6600: + case CPU_I6400: + case CPU_I6500: + c->options |= MIPS_CPU_FTLBPAREX; + break; + } } static inline void cpu_probe_alchemy(struct cpuinfo_mips *c, unsigned int cpu) diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c index 7c32c956156a..25a8a0d441be 100644 --- a/arch/mips/kernel/traps.c +++ b/arch/mips/kernel/traps.c @@ -2454,7 +2454,8 @@ void __init trap_init(void) if (cpu_has_fpu && !cpu_has_nofpuex) set_except_vector(EXCCODE_FPE, handle_fpe); - set_except_vector(MIPS_EXCCODE_TLBPAR, handle_ftlb); + if (cpu_has_ftlbparex) + set_except_vector(MIPS_EXCCODE_TLBPAR, handle_ftlb); if (cpu_has_rixiex) { set_except_vector(EXCCODE_TLBRI, tlb_do_page_fault_0); -- 2.25.1 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH v2 2/3] MIPS: add definitions for Loongson-specific CP0.Diag1 register 2020-07-21 18:37 [PATCH v2 0/3] Refactor FTLBPar exception handling and add GSExc handler WANG Xuerui 2020-07-21 18:37 ` [PATCH v2 1/3] MIPS: only register FTLBPar exception handler for supported models WANG Xuerui @ 2020-07-21 18:37 ` WANG Xuerui 2020-07-21 18:37 ` [PATCH v2 3/3] MIPS: handle Loongson-specific GSExc exception WANG Xuerui 2 siblings, 0 replies; 6+ messages in thread From: WANG Xuerui @ 2020-07-21 18:37 UTC (permalink / raw) To: linux-mips; +Cc: WANG Xuerui, Huacai Chen, Jiaxun Yang, Tiezhu Yang This register is named GSCause in Loongson manuals. It carries Loongson extended exception information. Signed-off-by: WANG Xuerui <git@xen0n.name> Cc: Huacai Chen <chenhc@lemote.com> Cc: Jiaxun Yang <jiaxun.yang@flygoat.com> Cc: Tiezhu Yang <yangtiezhu@loongson.cn> --- arch/mips/include/asm/mipsregs.h | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h index 11094d857b92..5ba268266d16 100644 --- a/arch/mips/include/asm/mipsregs.h +++ b/arch/mips/include/asm/mipsregs.h @@ -86,6 +86,7 @@ #define CP0_XCONTEXT $20 #define CP0_FRAMEMASK $21 #define CP0_DIAGNOSTIC $22 +#define CP0_DIAGNOSTIC1 $22, 1 #define CP0_DEBUG $23 #define CP0_DEPC $24 #define CP0_PERFORMANCE $25 @@ -1051,6 +1052,13 @@ /* Flush FTLB */ #define LOONGSON_DIAG_FTLB (_ULCAST_(1) << 13) +/* + * Diag1 (GSCause in Loongson-speak) fields + */ +/* Loongson-specific exception code (GSExcCode) */ +#define LOONGSON_DIAG1_EXCCODE_SHIFT 2 +#define LOONGSON_DIAG1_EXCCODE GENMASK(6, 2) + /* CvmCtl register field definitions */ #define CVMCTL_IPPCI_SHIFT 7 #define CVMCTL_IPPCI (_U64CAST_(0x7) << CVMCTL_IPPCI_SHIFT) -- 2.25.1 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH v2 3/3] MIPS: handle Loongson-specific GSExc exception 2020-07-21 18:37 [PATCH v2 0/3] Refactor FTLBPar exception handling and add GSExc handler WANG Xuerui 2020-07-21 18:37 ` [PATCH v2 1/3] MIPS: only register FTLBPar exception handler for supported models WANG Xuerui 2020-07-21 18:37 ` [PATCH v2 2/3] MIPS: add definitions for Loongson-specific CP0.Diag1 register WANG Xuerui @ 2020-07-21 18:37 ` WANG Xuerui 2020-07-22 4:20 ` Huacai Chen 2 siblings, 1 reply; 6+ messages in thread From: WANG Xuerui @ 2020-07-21 18:37 UTC (permalink / raw) To: linux-mips; +Cc: WANG Xuerui, Huacai Chen, Jiaxun Yang, Tiezhu Yang Newer Loongson cores (Loongson-3A R2 and newer) use the implementation-dependent ExcCode 16 to signal Loongson-specific exceptions. The extended cause is put in the non-standard CP0.Diag1 register which is CP0 Register 22 Select 1, called GSCause in Loongson manuals. Inside is an exception code bitfield called GSExcCode, only codes 0 to 6 inclusive are documented (so far, in the Loongson 3A3000 User Manual, Volume 2). During experiments, it was found that some undocumented unprivileged instructions can trigger the also-undocumented GSExcCode 8 on Loongson 3A4000. Processor state is not corrupted, but we cannot continue without further knowledge, and Loongson is not providing that information as of this writing. So we send SIGILL on seeing this exception code to thwart easy local DoS attacks. Other exception codes are made fatal, partly because of insufficient knowledge, also partly because they are not as easily reproduced. None of them are encountered in the wild with upstream kernels and userspace so far. Some older cores (Loongson-3A1000 and Loongson-3B1500) have ExcCode 16 too, but the semantic is equivalent to GSExcCode 0. Because the respective manuals did not mention the CP0.Diag1 register or its read behavior, these cores are not covered in this patch, as MFC0 from non-existent CP0 registers is UNDEFINED according to the MIPS architecture spec. Signed-off-by: WANG Xuerui <git@xen0n.name> Cc: Huacai Chen <chenhc@lemote.com> Cc: Jiaxun Yang <jiaxun.yang@flygoat.com> Cc: Tiezhu Yang <yangtiezhu@loongson.cn> --- arch/mips/include/asm/cpu-features.h | 6 +++++ arch/mips/include/asm/cpu.h | 1 + arch/mips/include/asm/mipsregs.h | 3 +++ arch/mips/kernel/cpu-probe.c | 3 +++ arch/mips/kernel/genex.S | 7 ++++++ arch/mips/kernel/traps.c | 35 ++++++++++++++++++++++++++++ 6 files changed, 55 insertions(+) diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h index 0b1bc7ed913b..1e8794b39759 100644 --- a/arch/mips/include/asm/cpu-features.h +++ b/arch/mips/include/asm/cpu-features.h @@ -572,6 +572,12 @@ # define cpu_has_ftlbparex __opt(MIPS_CPU_FTLBPAREX) #endif +#if defined(CONFIG_CPU_LOONGSON64) && !defined(cpu_has_gsexcex) +# define cpu_has_gsexcex __opt(MIPS_CPU_GSEXCEX) +#elif !defined(cpu_has_gsexcex) +# define cpu_has_gsexcex 0 +#endif + #ifdef CONFIG_SMP /* * Some systems share FTLB RAMs between threads within a core (siblings in diff --git a/arch/mips/include/asm/cpu.h b/arch/mips/include/asm/cpu.h index 3a4773714b29..1b4a67c84538 100644 --- a/arch/mips/include/asm/cpu.h +++ b/arch/mips/include/asm/cpu.h @@ -426,6 +426,7 @@ enum cpu_type_enum { #define MIPS_CPU_MM_FULL BIT_ULL(59) /* CPU supports write-through full merge */ #define MIPS_CPU_MAC_2008_ONLY BIT_ULL(60) /* CPU Only support MAC2008 Fused multiply-add instruction */ #define MIPS_CPU_FTLBPAREX BIT_ULL(61) /* CPU has FTLB parity exception */ +#define MIPS_CPU_GSEXCEX BIT_ULL(62) /* CPU has GSExc exception */ /* * CPU ASE encodings diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h index 5ba268266d16..4ddc12e4444a 100644 --- a/arch/mips/include/asm/mipsregs.h +++ b/arch/mips/include/asm/mipsregs.h @@ -474,6 +474,9 @@ /* Implementation specific trap codes used by MIPS cores */ #define MIPS_EXCCODE_TLBPAR 16 /* TLB parity error exception */ +/* Implementation specific trap codes used by Loongson cores */ +#define LOONGSON_EXCCODE_GSEXC 16 /* Loongson-specific exception */ + /* * Bits in the coprocessor 0 config register. */ diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c index 9e325862e810..9bb4a8732847 100644 --- a/arch/mips/kernel/cpu-probe.c +++ b/arch/mips/kernel/cpu-probe.c @@ -2043,6 +2043,9 @@ static inline void cpu_probe_loongson(struct cpuinfo_mips *c, unsigned int cpu) { decode_configs(c); + /* All Loongson processors covered here define ExcCode 16 as GSExc. */ + c->options |= MIPS_CPU_GSEXCEX; + switch (c->processor_id & PRID_IMP_MASK) { case PRID_IMP_LOONGSON_64R: /* Loongson-64 Reduced */ switch (c->processor_id & PRID_REV_MASK) { diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S index a1b966f3578e..a7fe30363dda 100644 --- a/arch/mips/kernel/genex.S +++ b/arch/mips/kernel/genex.S @@ -498,6 +498,12 @@ NESTED(nmi_handler, PT_SIZE, sp) KMODE .endm + .macro __build_clear_gsexc + MFC0 a1, CP0_DIAGNOSTIC1 + TRACE_IRQS_ON + STI + .endm + .macro __BUILD_silent exception .endm @@ -556,6 +562,7 @@ NESTED(nmi_handler, PT_SIZE, sp) BUILD_HANDLER fpe fpe fpe silent /* #15 */ #endif BUILD_HANDLER ftlb ftlb none silent /* #16 */ + BUILD_HANDLER gsexc gsexc gsexc silent /* #16 */ BUILD_HANDLER msa msa sti silent /* #21 */ BUILD_HANDLER mdmx mdmx sti silent /* #22 */ #ifdef CONFIG_HARDWARE_WATCHPOINTS diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c index 25a8a0d441be..fdb51e1f5f84 100644 --- a/arch/mips/kernel/traps.c +++ b/arch/mips/kernel/traps.c @@ -90,6 +90,7 @@ extern asmlinkage void handle_tr(void); extern asmlinkage void handle_msa_fpe(void); extern asmlinkage void handle_fpe(void); extern asmlinkage void handle_ftlb(void); +extern asmlinkage void handle_gsexc(void); extern asmlinkage void handle_msa(void); extern asmlinkage void handle_mdmx(void); extern asmlinkage void handle_watch(void); @@ -1900,6 +1901,37 @@ asmlinkage void do_ftlb(void) cache_parity_error(); } +asmlinkage void do_gsexc(struct pt_regs *regs, u32 diag1) +{ + u32 exccode = (diag1 & LOONGSON_DIAG1_EXCCODE) >> + LOONGSON_DIAG1_EXCCODE_SHIFT; + enum ctx_state prev_state; + + prev_state = exception_enter(); + + switch (exccode) { + case 0x08: + /* Undocumented exception, will trigger on certain + * also-undocumented instructions accessible from userspace. + * Processor state is not otherwise corrupted, but currently + * we don't know how to proceed. Maybe there is some + * undocumented control flag to enable the instructions? + */ + force_sig(SIGILL); + break; + + default: + /* None of the other exceptions, documented or not, have + * further details given; none are encountered in the wild + * either. Panic in case some of them turn out to be fatal. + */ + show_regs(regs); + panic("Unhandled Loongson exception - GSCause = %08x", diag1); + } + + exception_exit(prev_state); +} + /* * SDBBP EJTAG debug exception handler. * We skip the instruction and return to the next instruction. @@ -2457,6 +2489,9 @@ void __init trap_init(void) if (cpu_has_ftlbparex) set_except_vector(MIPS_EXCCODE_TLBPAR, handle_ftlb); + if (cpu_has_gsexcex) + set_except_vector(LOONGSON_EXCCODE_GSEXC, handle_gsexc); + if (cpu_has_rixiex) { set_except_vector(EXCCODE_TLBRI, tlb_do_page_fault_0); set_except_vector(EXCCODE_TLBXI, tlb_do_page_fault_0); -- 2.25.1 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2 3/3] MIPS: handle Loongson-specific GSExc exception 2020-07-21 18:37 ` [PATCH v2 3/3] MIPS: handle Loongson-specific GSExc exception WANG Xuerui @ 2020-07-22 4:20 ` Huacai Chen 2020-07-22 6:17 ` WANG Xuerui 0 siblings, 1 reply; 6+ messages in thread From: Huacai Chen @ 2020-07-22 4:20 UTC (permalink / raw) To: WANG Xuerui; +Cc: open list:MIPS, Jiaxun Yang, Tiezhu Yang Hi, Xuerui, On Wed, Jul 22, 2020 at 2:38 AM WANG Xuerui <git@xen0n.name> wrote: > > Newer Loongson cores (Loongson-3A R2 and newer) use the > implementation-dependent ExcCode 16 to signal Loongson-specific > exceptions. The extended cause is put in the non-standard CP0.Diag1 > register which is CP0 Register 22 Select 1, called GSCause in Loongson > manuals. Inside is an exception code bitfield called GSExcCode, only > codes 0 to 6 inclusive are documented (so far, in the Loongson 3A3000 > User Manual, Volume 2). > > During experiments, it was found that some undocumented unprivileged > instructions can trigger the also-undocumented GSExcCode 8 on Loongson > 3A4000. Processor state is not corrupted, but we cannot continue without > further knowledge, and Loongson is not providing that information as of > this writing. So we send SIGILL on seeing this exception code to thwart > easy local DoS attacks. > > Other exception codes are made fatal, partly because of insufficient > knowledge, also partly because they are not as easily reproduced. None > of them are encountered in the wild with upstream kernels and userspace > so far. > > Some older cores (Loongson-3A1000 and Loongson-3B1500) have ExcCode 16 > too, but the semantic is equivalent to GSExcCode 0. Because the > respective manuals did not mention the CP0.Diag1 register or its read > behavior, these cores are not covered in this patch, as MFC0 from > non-existent CP0 registers is UNDEFINED according to the MIPS > architecture spec. > > Signed-off-by: WANG Xuerui <git@xen0n.name> > Cc: Huacai Chen <chenhc@lemote.com> > Cc: Jiaxun Yang <jiaxun.yang@flygoat.com> > Cc: Tiezhu Yang <yangtiezhu@loongson.cn> > --- > arch/mips/include/asm/cpu-features.h | 6 +++++ > arch/mips/include/asm/cpu.h | 1 + > arch/mips/include/asm/mipsregs.h | 3 +++ > arch/mips/kernel/cpu-probe.c | 3 +++ > arch/mips/kernel/genex.S | 7 ++++++ > arch/mips/kernel/traps.c | 35 ++++++++++++++++++++++++++++ > 6 files changed, 55 insertions(+) > > diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h > index 0b1bc7ed913b..1e8794b39759 100644 > --- a/arch/mips/include/asm/cpu-features.h > +++ b/arch/mips/include/asm/cpu-features.h > @@ -572,6 +572,12 @@ > # define cpu_has_ftlbparex __opt(MIPS_CPU_FTLBPAREX) > #endif > > +#if defined(CONFIG_CPU_LOONGSON64) && !defined(cpu_has_gsexcex) > +# define cpu_has_gsexcex __opt(MIPS_CPU_GSEXCEX) > +#elif !defined(cpu_has_gsexcex) > +# define cpu_has_gsexcex 0 > +#endif Still, I don't see any obvious benefit from this complecated definition. > + > #ifdef CONFIG_SMP > /* > * Some systems share FTLB RAMs between threads within a core (siblings in > diff --git a/arch/mips/include/asm/cpu.h b/arch/mips/include/asm/cpu.h > index 3a4773714b29..1b4a67c84538 100644 > --- a/arch/mips/include/asm/cpu.h > +++ b/arch/mips/include/asm/cpu.h > @@ -426,6 +426,7 @@ enum cpu_type_enum { > #define MIPS_CPU_MM_FULL BIT_ULL(59) /* CPU supports write-through full merge */ > #define MIPS_CPU_MAC_2008_ONLY BIT_ULL(60) /* CPU Only support MAC2008 Fused multiply-add instruction */ > #define MIPS_CPU_FTLBPAREX BIT_ULL(61) /* CPU has FTLB parity exception */ > +#define MIPS_CPU_GSEXCEX BIT_ULL(62) /* CPU has GSExc exception */ > > /* > * CPU ASE encodings > diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h > index 5ba268266d16..4ddc12e4444a 100644 > --- a/arch/mips/include/asm/mipsregs.h > +++ b/arch/mips/include/asm/mipsregs.h > @@ -474,6 +474,9 @@ > /* Implementation specific trap codes used by MIPS cores */ > #define MIPS_EXCCODE_TLBPAR 16 /* TLB parity error exception */ > > +/* Implementation specific trap codes used by Loongson cores */ > +#define LOONGSON_EXCCODE_GSEXC 16 /* Loongson-specific exception */ > + > /* > * Bits in the coprocessor 0 config register. > */ > diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c > index 9e325862e810..9bb4a8732847 100644 > --- a/arch/mips/kernel/cpu-probe.c > +++ b/arch/mips/kernel/cpu-probe.c > @@ -2043,6 +2043,9 @@ static inline void cpu_probe_loongson(struct cpuinfo_mips *c, unsigned int cpu) > { > decode_configs(c); > > + /* All Loongson processors covered here define ExcCode 16 as GSExc. */ > + c->options |= MIPS_CPU_GSEXCEX; > + > switch (c->processor_id & PRID_IMP_MASK) { > case PRID_IMP_LOONGSON_64R: /* Loongson-64 Reduced */ > switch (c->processor_id & PRID_REV_MASK) { > diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S > index a1b966f3578e..a7fe30363dda 100644 > --- a/arch/mips/kernel/genex.S > +++ b/arch/mips/kernel/genex.S > @@ -498,6 +498,12 @@ NESTED(nmi_handler, PT_SIZE, sp) > KMODE > .endm > > + .macro __build_clear_gsexc > + MFC0 a1, CP0_DIAGNOSTIC1 > + TRACE_IRQS_ON > + STI > + .endm > + > .macro __BUILD_silent exception > .endm > > @@ -556,6 +562,7 @@ NESTED(nmi_handler, PT_SIZE, sp) > BUILD_HANDLER fpe fpe fpe silent /* #15 */ > #endif > BUILD_HANDLER ftlb ftlb none silent /* #16 */ > + BUILD_HANDLER gsexc gsexc gsexc silent /* #16 */ > BUILD_HANDLER msa msa sti silent /* #21 */ > BUILD_HANDLER mdmx mdmx sti silent /* #22 */ > #ifdef CONFIG_HARDWARE_WATCHPOINTS > diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c > index 25a8a0d441be..fdb51e1f5f84 100644 > --- a/arch/mips/kernel/traps.c > +++ b/arch/mips/kernel/traps.c > @@ -90,6 +90,7 @@ extern asmlinkage void handle_tr(void); > extern asmlinkage void handle_msa_fpe(void); > extern asmlinkage void handle_fpe(void); > extern asmlinkage void handle_ftlb(void); > +extern asmlinkage void handle_gsexc(void); > extern asmlinkage void handle_msa(void); > extern asmlinkage void handle_mdmx(void); > extern asmlinkage void handle_watch(void); > @@ -1900,6 +1901,37 @@ asmlinkage void do_ftlb(void) > cache_parity_error(); > } > > +asmlinkage void do_gsexc(struct pt_regs *regs, u32 diag1) > +{ > + u32 exccode = (diag1 & LOONGSON_DIAG1_EXCCODE) >> > + LOONGSON_DIAG1_EXCCODE_SHIFT; > + enum ctx_state prev_state; > + > + prev_state = exception_enter(); > + > + switch (exccode) { > + case 0x08: > + /* Undocumented exception, will trigger on certain > + * also-undocumented instructions accessible from userspace. > + * Processor state is not otherwise corrupted, but currently > + * we don't know how to proceed. Maybe there is some > + * undocumented control flag to enable the instructions? > + */ > + force_sig(SIGILL); > + break; > + > + default: > + /* None of the other exceptions, documented or not, have > + * further details given; none are encountered in the wild > + * either. Panic in case some of them turn out to be fatal. > + */ > + show_regs(regs); > + panic("Unhandled Loongson exception - GSCause = %08x", diag1); > + } > + > + exception_exit(prev_state); > +} > + > /* > * SDBBP EJTAG debug exception handler. > * We skip the instruction and return to the next instruction. > @@ -2457,6 +2489,9 @@ void __init trap_init(void) > if (cpu_has_ftlbparex) > set_except_vector(MIPS_EXCCODE_TLBPAR, handle_ftlb); > > + if (cpu_has_gsexcex) > + set_except_vector(LOONGSON_EXCCODE_GSEXC, handle_gsexc); > + > if (cpu_has_rixiex) { > set_except_vector(EXCCODE_TLBRI, tlb_do_page_fault_0); > set_except_vector(EXCCODE_TLBXI, tlb_do_page_fault_0); > -- > 2.25.1 > ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2 3/3] MIPS: handle Loongson-specific GSExc exception 2020-07-22 4:20 ` Huacai Chen @ 2020-07-22 6:17 ` WANG Xuerui 0 siblings, 0 replies; 6+ messages in thread From: WANG Xuerui @ 2020-07-22 6:17 UTC (permalink / raw) To: Huacai Chen, WANG Xuerui; +Cc: open list:MIPS, Jiaxun Yang, Tiezhu Yang On 2020/7/22 12:20, Huacai Chen wrote: > Hi, Xuerui, > > On Wed, Jul 22, 2020 at 2:38 AM WANG Xuerui <git@xen0n.name> wrote: >> Newer Loongson cores (Loongson-3A R2 and newer) use the >> implementation-dependent ExcCode 16 to signal Loongson-specific >> exceptions. The extended cause is put in the non-standard CP0.Diag1 >> register which is CP0 Register 22 Select 1, called GSCause in Loongson >> manuals. Inside is an exception code bitfield called GSExcCode, only >> codes 0 to 6 inclusive are documented (so far, in the Loongson 3A3000 >> User Manual, Volume 2). >> >> During experiments, it was found that some undocumented unprivileged >> instructions can trigger the also-undocumented GSExcCode 8 on Loongson >> 3A4000. Processor state is not corrupted, but we cannot continue without >> further knowledge, and Loongson is not providing that information as of >> this writing. So we send SIGILL on seeing this exception code to thwart >> easy local DoS attacks. >> >> Other exception codes are made fatal, partly because of insufficient >> knowledge, also partly because they are not as easily reproduced. None >> of them are encountered in the wild with upstream kernels and userspace >> so far. >> >> Some older cores (Loongson-3A1000 and Loongson-3B1500) have ExcCode 16 >> too, but the semantic is equivalent to GSExcCode 0. Because the >> respective manuals did not mention the CP0.Diag1 register or its read >> behavior, these cores are not covered in this patch, as MFC0 from >> non-existent CP0 registers is UNDEFINED according to the MIPS >> architecture spec. >> >> Signed-off-by: WANG Xuerui <git@xen0n.name> >> Cc: Huacai Chen <chenhc@lemote.com> >> Cc: Jiaxun Yang <jiaxun.yang@flygoat.com> >> Cc: Tiezhu Yang <yangtiezhu@loongson.cn> >> --- >> arch/mips/include/asm/cpu-features.h | 6 +++++ >> arch/mips/include/asm/cpu.h | 1 + >> arch/mips/include/asm/mipsregs.h | 3 +++ >> arch/mips/kernel/cpu-probe.c | 3 +++ >> arch/mips/kernel/genex.S | 7 ++++++ >> arch/mips/kernel/traps.c | 35 ++++++++++++++++++++++++++++ >> 6 files changed, 55 insertions(+) >> >> diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h >> index 0b1bc7ed913b..1e8794b39759 100644 >> --- a/arch/mips/include/asm/cpu-features.h >> +++ b/arch/mips/include/asm/cpu-features.h >> @@ -572,6 +572,12 @@ >> # define cpu_has_ftlbparex __opt(MIPS_CPU_FTLBPAREX) >> #endif >> >> +#if defined(CONFIG_CPU_LOONGSON64) && !defined(cpu_has_gsexcex) >> +# define cpu_has_gsexcex __opt(MIPS_CPU_GSEXCEX) >> +#elif !defined(cpu_has_gsexcex) >> +# define cpu_has_gsexcex 0 >> +#endif > Still, I don't see any obvious benefit from this complecated definition. On a closer look it seems even more ifdef's are needed to actually "optimize everything out" on !CONFIG_CPU_LOONGSON64 configs. I'll fix and send v3 then. (side note: if anything, don't code at 3 am or things like this will happen!) >> + >> #ifdef CONFIG_SMP >> /* >> * Some systems share FTLB RAMs between threads within a core (siblings in >> diff --git a/arch/mips/include/asm/cpu.h b/arch/mips/include/asm/cpu.h >> index 3a4773714b29..1b4a67c84538 100644 >> --- a/arch/mips/include/asm/cpu.h >> +++ b/arch/mips/include/asm/cpu.h >> @@ -426,6 +426,7 @@ enum cpu_type_enum { >> #define MIPS_CPU_MM_FULL BIT_ULL(59) /* CPU supports write-through full merge */ >> #define MIPS_CPU_MAC_2008_ONLY BIT_ULL(60) /* CPU Only support MAC2008 Fused multiply-add instruction */ >> #define MIPS_CPU_FTLBPAREX BIT_ULL(61) /* CPU has FTLB parity exception */ >> +#define MIPS_CPU_GSEXCEX BIT_ULL(62) /* CPU has GSExc exception */ >> >> /* >> * CPU ASE encodings >> diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h >> index 5ba268266d16..4ddc12e4444a 100644 >> --- a/arch/mips/include/asm/mipsregs.h >> +++ b/arch/mips/include/asm/mipsregs.h >> @@ -474,6 +474,9 @@ >> /* Implementation specific trap codes used by MIPS cores */ >> #define MIPS_EXCCODE_TLBPAR 16 /* TLB parity error exception */ >> >> +/* Implementation specific trap codes used by Loongson cores */ >> +#define LOONGSON_EXCCODE_GSEXC 16 /* Loongson-specific exception */ >> + >> /* >> * Bits in the coprocessor 0 config register. >> */ >> diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c >> index 9e325862e810..9bb4a8732847 100644 >> --- a/arch/mips/kernel/cpu-probe.c >> +++ b/arch/mips/kernel/cpu-probe.c >> @@ -2043,6 +2043,9 @@ static inline void cpu_probe_loongson(struct cpuinfo_mips *c, unsigned int cpu) >> { >> decode_configs(c); >> >> + /* All Loongson processors covered here define ExcCode 16 as GSExc. */ >> + c->options |= MIPS_CPU_GSEXCEX; >> + >> switch (c->processor_id & PRID_IMP_MASK) { >> case PRID_IMP_LOONGSON_64R: /* Loongson-64 Reduced */ >> switch (c->processor_id & PRID_REV_MASK) { >> diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S >> index a1b966f3578e..a7fe30363dda 100644 >> --- a/arch/mips/kernel/genex.S >> +++ b/arch/mips/kernel/genex.S >> @@ -498,6 +498,12 @@ NESTED(nmi_handler, PT_SIZE, sp) >> KMODE >> .endm >> >> + .macro __build_clear_gsexc >> + MFC0 a1, CP0_DIAGNOSTIC1 >> + TRACE_IRQS_ON >> + STI >> + .endm >> + >> .macro __BUILD_silent exception >> .endm >> >> @@ -556,6 +562,7 @@ NESTED(nmi_handler, PT_SIZE, sp) >> BUILD_HANDLER fpe fpe fpe silent /* #15 */ >> #endif >> BUILD_HANDLER ftlb ftlb none silent /* #16 */ >> + BUILD_HANDLER gsexc gsexc gsexc silent /* #16 */ >> BUILD_HANDLER msa msa sti silent /* #21 */ >> BUILD_HANDLER mdmx mdmx sti silent /* #22 */ >> #ifdef CONFIG_HARDWARE_WATCHPOINTS >> diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c >> index 25a8a0d441be..fdb51e1f5f84 100644 >> --- a/arch/mips/kernel/traps.c >> +++ b/arch/mips/kernel/traps.c >> @@ -90,6 +90,7 @@ extern asmlinkage void handle_tr(void); >> extern asmlinkage void handle_msa_fpe(void); >> extern asmlinkage void handle_fpe(void); >> extern asmlinkage void handle_ftlb(void); >> +extern asmlinkage void handle_gsexc(void); >> extern asmlinkage void handle_msa(void); >> extern asmlinkage void handle_mdmx(void); >> extern asmlinkage void handle_watch(void); >> @@ -1900,6 +1901,37 @@ asmlinkage void do_ftlb(void) >> cache_parity_error(); >> } >> >> +asmlinkage void do_gsexc(struct pt_regs *regs, u32 diag1) >> +{ >> + u32 exccode = (diag1 & LOONGSON_DIAG1_EXCCODE) >> >> + LOONGSON_DIAG1_EXCCODE_SHIFT; >> + enum ctx_state prev_state; >> + >> + prev_state = exception_enter(); >> + >> + switch (exccode) { >> + case 0x08: >> + /* Undocumented exception, will trigger on certain >> + * also-undocumented instructions accessible from userspace. >> + * Processor state is not otherwise corrupted, but currently >> + * we don't know how to proceed. Maybe there is some >> + * undocumented control flag to enable the instructions? >> + */ >> + force_sig(SIGILL); >> + break; >> + >> + default: >> + /* None of the other exceptions, documented or not, have >> + * further details given; none are encountered in the wild >> + * either. Panic in case some of them turn out to be fatal. >> + */ >> + show_regs(regs); >> + panic("Unhandled Loongson exception - GSCause = %08x", diag1); >> + } >> + >> + exception_exit(prev_state); >> +} >> + >> /* >> * SDBBP EJTAG debug exception handler. >> * We skip the instruction and return to the next instruction. >> @@ -2457,6 +2489,9 @@ void __init trap_init(void) >> if (cpu_has_ftlbparex) >> set_except_vector(MIPS_EXCCODE_TLBPAR, handle_ftlb); >> >> + if (cpu_has_gsexcex) >> + set_except_vector(LOONGSON_EXCCODE_GSEXC, handle_gsexc); >> + >> if (cpu_has_rixiex) { >> set_except_vector(EXCCODE_TLBRI, tlb_do_page_fault_0); >> set_except_vector(EXCCODE_TLBXI, tlb_do_page_fault_0); >> -- >> 2.25.1 >> ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-07-22 6:17 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2020-07-21 18:37 [PATCH v2 0/3] Refactor FTLBPar exception handling and add GSExc handler WANG Xuerui 2020-07-21 18:37 ` [PATCH v2 1/3] MIPS: only register FTLBPar exception handler for supported models WANG Xuerui 2020-07-21 18:37 ` [PATCH v2 2/3] MIPS: add definitions for Loongson-specific CP0.Diag1 register WANG Xuerui 2020-07-21 18:37 ` [PATCH v2 3/3] MIPS: handle Loongson-specific GSExc exception WANG Xuerui 2020-07-22 4:20 ` Huacai Chen 2020-07-22 6:17 ` WANG Xuerui
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).