MIPS R2 emulation doesn't take into account that BLEZL and BGTZL instructions
require register RT = 0. If it is not zero it can be some legitimate MIPS R6
instruction.

Problem happens after emulation optimization then emulation routine tries
to pipeline emulation and after emulation of one instruction it picks up
a next candidate. In single pass strategy it does not happen because CPU
doesn't trap on branch-compacts which share opcode space with BLEZL/BGTZL
(but has RT != 0, of course).

Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com>
Reported-by: Douglas Leung <Douglas.Leung@imgtec.com>

Patch d5bdd1d2edc95 "MIPS: Setup an instruction emulation in VDSO
protected page instead of user stack" misses a case then a debugger
uses ptrace() syscall to get access into VDSO page. In this case
a kernel installs PTE bypassing page-fault scheme and that
corrupts an FPU/MIPS R2 emulation of debugged process.

Android uses ptrace() to get code of signal handlers stabs from VDSO page
pretty often.

Fixed via a special handling of ptrace() from/to VDSO page to avoid
installation of VDSO PTE.

Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com>
Reported-by: Miodrag Dinic <Miodrag.Dinic@imgtec.com>

commit 74f1077b5b783e7bf4fa3007cefdc8dbd6c07518 upstream.

Currently regs_return_value always negates reg[2] if it determines
the syscall has failed, but when called in kernel context this check is
invalid and may result in returning a wrong value.

This fixes errors reported by CONFIG_KPROBES_SANITY_TEST

Fixes: d7e7528bcd45 ("Audit: push audit success and retcode into arch ptrace.h")
Signed-off-by: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/14381/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

It is needed to prevent an aggressive speculative IFETCH from that pages.
That allows removing I-CACHE flush during page fault for HIGHMEM pages.

This fix was overlooked in "MIPS: ICache speculative load management" patch.

Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com>

During VMA release the cache flush strategy attempts to avoid D-cache flushes
taking into account an aggressive speculative load/ifetch capability.
It was done in series of patches:

    MIPS: ICache speculative load management
    MIPS: skip L1D cache flush at page release
    MIPS: flush_cache_vma is introduced

This patch completely removes D-cache flush at VMA release basing on fact
that this cache flush is NOT needed if page will be picked up again from cache
and D-cache will be definitely flushed in case of page read during page fault
(cache aliasing case is a separate).

Function flush_icache_vma is introduced to support this.

Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com>

Some new patches past commit e0455c0e031a0936543a5bcded451aa641ba6ef8
"MIPS: bugfix of a D-I cache sequences" miss the required mb() memory barrier
after ICACHE flush.

This memory barrier is required due to some time delay after CACHE instruction
and the real cache line eviction in ICACHE (see an original commit).

However, the bug was not seen in life, it's probability is low.

Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com>

MIPS instructions MULTU, MADDU and MSUBU emulation requires registers HI/LO
to be converted to signed 32bits before 64bit sign extension on MIPS64.

Bug was found on running MIPS32 R2 test application on MIPS64 R6 kernel.

Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com>
Reported-by: Nikola.Veljkovic@imgtec.com

The following testcase may result in a page table entries with a invalid
CCA field being generated:

static void *bindstack;

static int sysrqfd;

static void protect_low(int protect)
{
    mprotect(bindstack, BINDSTACK_SIZE, protect);
}

static void sigbus_handler(int signal, siginfo_t * info, void *context)
{
    void *addr = info->si_addr;

    write(sysrqfd, "x", 1);

    printf("sigbus, fault address %p (should not happen, but might)\n",
	   addr);
    abort();
}

static void run_bind_test(void)
{
    unsigned int *p = bindstack;

    p[0] = 0xf001f001;

    write(sysrqfd, "x", 1);

    /* Set trap on access to p[0] */
    protect_low(PROT_NONE);

    write(sysrqfd, "x", 1);

    /* Clear trap on access to p[0] */
    protect_low(PROT_READ | PROT_WRITE | PROT_EXEC);

    write(sysrqfd, "x", 1);

    /* Check the contents of p[0] */
    if (p[0] != 0xf001f001) {
	write(sysrqfd, "x", 1);

	/* Reached, but shouldn't be */
	printf("badness, shouldn't happen but does\n");
	abort();
    }
}

int main(void)
{
    struct sigaction sa;

    sysrqfd = open("/proc/sysrq-trigger", O_WRONLY);

    if (sigprocmask(SIG_BLOCK, NULL, &sa.sa_mask)) {
	perror("sigprocmask");
	return 0;
    }

    sa.sa_sigaction = sigbus_handler;
    sa.sa_flags = SA_SIGINFO | SA_NODEFER | SA_RESTART;
    if (sigaction(SIGBUS, &sa, NULL)) {
	perror("sigaction");
	return 0;
    }

    bindstack = mmap(NULL,
	     BINDSTACK_SIZE,
	     PROT_READ | PROT_WRITE | PROT_EXEC,
	     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    if (bindstack == MAP_FAILED) {
	perror("mmap bindstack");
	return 0;
    }

    printf("bindstack: %p\n", bindstack);

    run_bind_test();

    printf("done\n");

    return 0;
}

There are multiple ingredients for this:

 1) PAGE_NONE is defined to _CACHE_CACHABLE_NONCOHERENT, which is CCA 3
    on all platforms except SB1 where it's CCA 5.
 2) _page_cachable_default must have bits set which are not set
    _CACHE_CACHABLE_NONCOHERENT.
 3) Either the defective version of pte_modify for XPA or the standard
    version must be in used.  However pte_modify for the 36 bit address
    space support is no affected.

In that case additional bits in the final CCA mode may generate an invalid
value for the CCA field.  On the R10000 system where this was tracked
down for example a CCA 7 has been observed, which is Uncached Accelerated.

Fixed by:

 1) Using the proper CCA mode for PAGE_NONE just like for all the other
    PAGE_* pte/pmd bits.
 2) Fix the two affected variants of pte_modify.

Further code inspection also shows the same issue to exist in pmd_modify
which would affect huge page systems.

Issue in pte_modify tracked down by Alastair Bridgewater, PAGE_NONE
and pmd_issue issue found by me.

The history of this goes back beyond Linus' git history.  Chris Dearman's
commit 351336929ccf222ae38ff0cb7a8dd5fd5c6236a0 ("[MIPS] Allow setting of
the cache attribute at run time.") missed the opportunity to fix this
but it was originally introduced in lmo commit
d523832cf12007b3242e50bb77d0c9e63e0b6518 ("Missing from last commit.")
and 32cc38229ac7538f2346918a09e75413e8861f87 ("New configuration option
CONFIG_MIPS_UNCACHED.")

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Reported-by: Alastair Bridgewater <alastair.bridgewater@gmail.com>
(cherry picked from commit 8824144e2e8e67e237dd6cf3387df1ec76dbc57c)

When emulating a jalr instruction with rd == $0, the code in
isBranchInstr was incorrectly writing to GPR $0 which should actually
always remain zeroed. This would lead to any further instructions
emulated which use $0 operating on a bogus value until the task is next
context switched, at which point the value of $0 in the task context
would be restored to the correct zero by a store in SAVE_SOME. Fix this
by not writing to rd if it is $0.

Signed-off-by: Paul Burton <paul.burton@imgtec.com>

commit ea1688573426adc2587ed52d086b51c7c62eaca3 upstream.

The MSA ld_*/st_* assembler macros for when the toolchain doesn't
support MSA use addu to offset the base address. However it is a virtual
memory pointer so fix it to use PTR_ADDU which expands to daddu for
64-bit kernels.

Signed-off-by: James Hogan <james.hogan@imgtec.com>