From 7d19273cd0408f8520539d5d6b1f695cd311b109 Mon Sep 17 00:00:00 2001 From: Christian Ruppert Date: Fri, 10 May 2013 16:05:50 +0200 Subject: ARC: [TB10x] Remove redundant abilis,simple-pinctrl mechanism The TB10x platform port includes a custom mechanism using to set up default pin controller configurations using abilis,simple-default pin configurations of nodes compatible with abilis,simple-pinctrl. This mechanism is redundant with the Linux standard "default" pin configuration, see commit ab78029ecc347debbd737f06688d788bd9d60c1d "drivers/pinctrl: grab default handles from device core". This patch removes the TB10x custom mechanism in favour of the Linux standard. Signed-off-by: Christian Ruppert Reviewed-by: Stephen Warren Reviewed-by: Linus Walleij Signed-off-by: Vineet Gupta --- arch/arc/boot/dts/abilis_tb100_dvk.dts | 2 +- arch/arc/boot/dts/abilis_tb101_dvk.dts | 2 +- arch/arc/boot/dts/abilis_tb10x.dtsi | 6 ++---- arch/arc/plat-tb10x/tb10x.c | 26 -------------------------- 4 files changed, 4 insertions(+), 32 deletions(-) (limited to 'arch') diff --git a/arch/arc/boot/dts/abilis_tb100_dvk.dts b/arch/arc/boot/dts/abilis_tb100_dvk.dts index c0fd3623c39..0fa0d4abe79 100644 --- a/arch/arc/boot/dts/abilis_tb100_dvk.dts +++ b/arch/arc/boot/dts/abilis_tb100_dvk.dts @@ -37,7 +37,7 @@ soc100 { uart@FF100000 { - pinctrl-names = "abilis,simple-default"; + pinctrl-names = "default"; pinctrl-0 = <&pctl_uart0>; }; ethernet@FE100000 { diff --git a/arch/arc/boot/dts/abilis_tb101_dvk.dts b/arch/arc/boot/dts/abilis_tb101_dvk.dts index 6f8c381f626..a4d80ce283a 100644 --- a/arch/arc/boot/dts/abilis_tb101_dvk.dts +++ b/arch/arc/boot/dts/abilis_tb101_dvk.dts @@ -37,7 +37,7 @@ soc100 { uart@FF100000 { - pinctrl-names = "abilis,simple-default"; + pinctrl-names = "default"; pinctrl-0 = <&pctl_uart0>; }; ethernet@FE100000 { diff --git a/arch/arc/boot/dts/abilis_tb10x.dtsi b/arch/arc/boot/dts/abilis_tb10x.dtsi index a6139fc5aaa..b97e3051ba4 100644 --- a/arch/arc/boot/dts/abilis_tb10x.dtsi +++ b/arch/arc/boot/dts/abilis_tb10x.dtsi @@ -88,8 +88,7 @@ }; uart@FF100000 { - compatible = "snps,dw-apb-uart", - "abilis,simple-pinctrl"; + compatible = "snps,dw-apb-uart"; reg = <0xFF100000 0x100>; clock-frequency = <166666666>; interrupts = <25 1>; @@ -184,8 +183,7 @@ #address-cells = <1>; #size-cells = <0>; cell-index = <1>; - compatible = "abilis,tb100-spi", - "abilis,simple-pinctrl"; + compatible = "abilis,tb100-spi"; num-cs = <2>; reg = <0xFE011000 0x20>; interrupt-parent = <&tb10x_ictl>; diff --git a/arch/arc/plat-tb10x/tb10x.c b/arch/arc/plat-tb10x/tb10x.c index d3567691c7e..06cb3092946 100644 --- a/arch/arc/plat-tb10x/tb10x.c +++ b/arch/arc/plat-tb10x/tb10x.c @@ -34,31 +34,6 @@ static void __init tb10x_platform_init(void) of_platform_populate(NULL, of_default_bus_match_table, NULL, NULL); } -static void __init tb10x_platform_late_init(void) -{ - struct device_node *dn; - - /* - * Pinctrl documentation recommends setting up the iomux here for - * all modules which don't require control over the pins themselves. - * Modules which need this kind of assistance are compatible with - * "abilis,simple-pinctrl", i.e. we can easily iterate over them. - * TODO: Does this recommended method work cleanly with pins required - * by modules? - */ - for_each_compatible_node(dn, NULL, "abilis,simple-pinctrl") { - struct platform_device *pd = of_find_device_by_node(dn); - struct pinctrl *pctl; - - pctl = pinctrl_get_select(&pd->dev, "abilis,simple-default"); - if (IS_ERR(pctl)) { - int ret = PTR_ERR(pctl); - dev_err(&pd->dev, "Could not set up pinctrl: %d\n", - ret); - } - } -} - static const char *tb10x_compat[] __initdata = { "abilis,arc-tb10x", NULL, @@ -67,5 +42,4 @@ static const char *tb10x_compat[] __initdata = { MACHINE_START(TB10x, "tb10x") .dt_compat = tb10x_compat, .init_machine = tb10x_platform_init, - .init_late = tb10x_platform_late_init, MACHINE_END -- cgit v1.2.3 From f538881cc672c1b049aa0a34a792d0953fcecba5 Mon Sep 17 00:00:00 2001 From: Vineet Gupta Date: Thu, 16 May 2013 12:19:29 +0530 Subject: ARC: [mm] Prevent stray dcache lines after__sync_icache_dcach() Flush and INVALIDATE the dcache page. This helper is only used for writeback of CODE pages to memory. So there's no value in keeping the dcache lines around. Infact it is risky as a writeback on natural eviction under pressure can cause un-needed writeback with weird issues on aliasing dcache configurations. Signed-off-by: Vineet Gupta --- arch/arc/mm/cache_arc700.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'arch') diff --git a/arch/arc/mm/cache_arc700.c b/arch/arc/mm/cache_arc700.c index 2f12bca8aef..d4b7bb61684 100644 --- a/arch/arc/mm/cache_arc700.c +++ b/arch/arc/mm/cache_arc700.c @@ -610,7 +610,7 @@ void __sync_icache_dcache(unsigned long paddr, unsigned long vaddr, int len) local_irq_save(flags); __ic_line_inv_vaddr(paddr, vaddr, len); - __dc_line_op(paddr, vaddr, len, OP_FLUSH); + __dc_line_op(paddr, vaddr, len, OP_FLUSH_N_INV); local_irq_restore(flags); } -- cgit v1.2.3 From a950549c675f2c8c504469dec7d780da8a6433dc Mon Sep 17 00:00:00 2001 From: Vineet Gupta Date: Tue, 21 May 2013 15:25:11 +0530 Subject: ARC: copy_(to|from)_user() to honor usermode-access permissions This manifested as grep failing psuedo-randomly: -------------->8--------------------- [ARCLinux]$ ip address show lo | grep inet [ARCLinux]$ ip address show lo | grep inet [ARCLinux]$ ip address show lo | grep inet [ARCLinux]$ [ARCLinux]$ ip address show lo | grep inet inet 127.0.0.1/8 scope host lo -------------->8--------------------- ARC700 MMU provides fully orthogonal permission bits per page: Ur, Uw, Ux, Kr, Kw, Kx The user mode page permission templates used to have all Kernel mode access bits enabled. This caused a tricky race condition observed with uClibc buffered file read and UNIX pipes. 1. Read access to an anon mapped page in libc .bss: write-protected zero_page mapped: TLB Entry installed with Ur + K[rwx] 2. grep calls libc:getc() -> buffered read layer calls read(2) with the internal read buffer in same .bss page. The read() call is on STDIN which has been redirected to a pipe. read(2) => sys_read() => pipe_read() => copy_to_user() 3. Since page has Kernel-write permission (despite being user-mode write-protected), copy_to_user() suceeds w/o taking a MMU TLB-Miss Exception (page-fault for ARC). core-MM is unaware that kernel erroneously wrote to the reserved read-only zero-page (BUG #1) 4. Control returns to userspace which now does a write to same .bss page Since Linux MM is not aware that page has been modified by kernel, it simply reassigns a new writable zero-init page to mapping, loosing the prior write by kernel - effectively zero'ing out the libc read buffer under the hood - hence grep doesn't see right data (BUG #2) The fix is to make all kernel-mode access permissions mirror the user-mode ones. Note that the kernel still has full access to pages, when accessed directly (w/o MMU) - this fix ensures that kernel-mode access in copy_to_from() path uses the same faulting access model as for pure user accesses to keep MM fully aware of page state. The issue is peudo-random because it only shows up if the TLB entry installed in #1 is present at the time of #3. If it is evicted out, due to TLB pressure or some-such, then copy_to_user() does take a TLB Miss Exception, with a routine write-to-anon COW processing installing a fresh page for kernel writes and also usable as it is in userspace. Further the issue was dormant for so long as it depends on where the libc internal read buffer (in .bss) is mapped at runtime. If it happens to reside in file-backed data mapping of libc (in the page-aligned slack space trailing the file backed data), loader zero padding the slack space, does the early cow page replacement, setting things up at the very beginning itself. With gcc 4.8 based builds, the libc buffer got pushed out to a real anon mapping which triggers the issue. Reported-by: Anton Kolesov Cc: # 3.9 Signed-off-by: Vineet Gupta --- arch/arc/include/asm/pgtable.h | 26 +++++++++++++++----------- arch/arc/include/asm/tlb.h | 2 +- arch/arc/mm/tlbex.S | 6 +++--- 3 files changed, 19 insertions(+), 15 deletions(-) (limited to 'arch') diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h index 1cc4720facc..95b1522212a 100644 --- a/arch/arc/include/asm/pgtable.h +++ b/arch/arc/include/asm/pgtable.h @@ -57,9 +57,9 @@ #define _PAGE_ACCESSED (1<<1) /* Page is accessed (S) */ #define _PAGE_CACHEABLE (1<<2) /* Page is cached (H) */ -#define _PAGE_EXECUTE (1<<3) /* Page has user execute perm (H) */ -#define _PAGE_WRITE (1<<4) /* Page has user write perm (H) */ -#define _PAGE_READ (1<<5) /* Page has user read perm (H) */ +#define _PAGE_U_EXECUTE (1<<3) /* Page has user execute perm (H) */ +#define _PAGE_U_WRITE (1<<4) /* Page has user write perm (H) */ +#define _PAGE_U_READ (1<<5) /* Page has user read perm (H) */ #define _PAGE_K_EXECUTE (1<<6) /* Page has kernel execute perm (H) */ #define _PAGE_K_WRITE (1<<7) /* Page has kernel write perm (H) */ #define _PAGE_K_READ (1<<8) /* Page has kernel perm (H) */ @@ -72,9 +72,9 @@ /* PD1 */ #define _PAGE_CACHEABLE (1<<0) /* Page is cached (H) */ -#define _PAGE_EXECUTE (1<<1) /* Page has user execute perm (H) */ -#define _PAGE_WRITE (1<<2) /* Page has user write perm (H) */ -#define _PAGE_READ (1<<3) /* Page has user read perm (H) */ +#define _PAGE_U_EXECUTE (1<<1) /* Page has user execute perm (H) */ +#define _PAGE_U_WRITE (1<<2) /* Page has user write perm (H) */ +#define _PAGE_U_READ (1<<3) /* Page has user read perm (H) */ #define _PAGE_K_EXECUTE (1<<4) /* Page has kernel execute perm (H) */ #define _PAGE_K_WRITE (1<<5) /* Page has kernel write perm (H) */ #define _PAGE_K_READ (1<<6) /* Page has kernel perm (H) */ @@ -93,7 +93,8 @@ #endif /* Kernel allowed all permissions for all pages */ -#define _K_PAGE_PERMS (_PAGE_K_EXECUTE | _PAGE_K_WRITE | _PAGE_K_READ) +#define _K_PAGE_PERMS (_PAGE_K_EXECUTE | _PAGE_K_WRITE | _PAGE_K_READ | \ + _PAGE_GLOBAL | _PAGE_PRESENT) #ifdef CONFIG_ARC_CACHE_PAGES #define _PAGE_DEF_CACHEABLE _PAGE_CACHEABLE @@ -106,7 +107,11 @@ * -by default cached, unless config otherwise * -present in memory */ -#define ___DEF (_PAGE_PRESENT | _K_PAGE_PERMS | _PAGE_DEF_CACHEABLE) +#define ___DEF (_PAGE_PRESENT | _PAGE_DEF_CACHEABLE) + +#define _PAGE_READ (_PAGE_U_READ | _PAGE_K_READ) +#define _PAGE_WRITE (_PAGE_U_WRITE | _PAGE_K_WRITE) +#define _PAGE_EXECUTE (_PAGE_U_EXECUTE | _PAGE_K_EXECUTE) /* Set of bits not changed in pte_modify */ #define _PAGE_CHG_MASK (PAGE_MASK | _PAGE_ACCESSED | _PAGE_MODIFIED) @@ -125,11 +130,10 @@ * kernel vaddr space - visible in all addr spaces, but kernel mode only * Thus Global, all-kernel-access, no-user-access, cached */ -#define PAGE_KERNEL __pgprot(___DEF | _PAGE_GLOBAL) +#define PAGE_KERNEL __pgprot(_K_PAGE_PERMS | _PAGE_DEF_CACHEABLE) /* ioremap */ -#define PAGE_KERNEL_NO_CACHE __pgprot(_PAGE_PRESENT | _K_PAGE_PERMS | \ - _PAGE_GLOBAL) +#define PAGE_KERNEL_NO_CACHE __pgprot(_K_PAGE_PERMS) /************************************************************************** * Mapping of vm_flags (Generic VM) to PTE flags (arch specific) diff --git a/arch/arc/include/asm/tlb.h b/arch/arc/include/asm/tlb.h index 85b6df839bd..cb0c708ca66 100644 --- a/arch/arc/include/asm/tlb.h +++ b/arch/arc/include/asm/tlb.h @@ -16,7 +16,7 @@ /* Masks for actual TLB "PD"s */ #define PTE_BITS_IN_PD0 (_PAGE_GLOBAL | _PAGE_PRESENT) #define PTE_BITS_IN_PD1 (PAGE_MASK | _PAGE_CACHEABLE | \ - _PAGE_EXECUTE | _PAGE_WRITE | _PAGE_READ | \ + _PAGE_U_EXECUTE | _PAGE_U_WRITE | _PAGE_U_READ | \ _PAGE_K_EXECUTE | _PAGE_K_WRITE | _PAGE_K_READ) #ifndef __ASSEMBLY__ diff --git a/arch/arc/mm/tlbex.S b/arch/arc/mm/tlbex.S index 9df765dc7c3..3357d26ffe5 100644 --- a/arch/arc/mm/tlbex.S +++ b/arch/arc/mm/tlbex.S @@ -277,7 +277,7 @@ ARC_ENTRY EV_TLBMissI ;---------------------------------------------------------------- ; VERIFY_PTE: Check if PTE permissions approp for executing code cmp_s r2, VMALLOC_START - mov.lo r2, (_PAGE_PRESENT | _PAGE_READ | _PAGE_EXECUTE) + mov.lo r2, (_PAGE_PRESENT | _PAGE_U_READ | _PAGE_U_EXECUTE) mov.hs r2, (_PAGE_PRESENT | _PAGE_K_READ | _PAGE_K_EXECUTE) and r3, r0, r2 ; Mask out NON Flag bits from PTE @@ -320,9 +320,9 @@ ARC_ENTRY EV_TLBMissD mov_s r2, 0 lr r3, [ecr] btst_s r3, ECR_C_BIT_DTLB_LD_MISS ; Read Access - or.nz r2, r2, _PAGE_READ ; chk for Read flag in PTE + or.nz r2, r2, _PAGE_U_READ ; chk for Read flag in PTE btst_s r3, ECR_C_BIT_DTLB_ST_MISS ; Write Access - or.nz r2, r2, _PAGE_WRITE ; chk for Write flag in PTE + or.nz r2, r2, _PAGE_U_WRITE ; chk for Write flag in PTE ; Above laddering takes care of XCHG access ; which is both Read and Write -- cgit v1.2.3 From 3e87974dec5ec25a8a4852d9292db6be659164e6 Mon Sep 17 00:00:00 2001 From: Vineet Gupta Date: Wed, 22 May 2013 18:38:10 +0530 Subject: ARC: Brown paper bag bug in macro for checking cache color The VM_EXEC check in update_mmu_cache() was getting optimized away because of a stupid error in definition of macro addr_not_cache_congruent() The intention was to have the equivalent of following: if (a || (1 ? b : 0)) but we ended up with following: if (a || 1 ? b : 0) And because precedence of '||' is more that that of '?', gcc was optimizing away evaluation of Nasty Repercussions: 1. For non-aliasing configs it would mean some extraneous dcache flushes for non-code pages if U/K mappings were not congruent. 2. For aliasing config, some needed dcache flush for code pages might be missed if U/K mappings were congruent. Signed-off-by: Vineet Gupta --- arch/arc/include/asm/cacheflush.h | 4 +++- arch/arc/mm/tlb.c | 3 ++- 2 files changed, 5 insertions(+), 2 deletions(-) (limited to 'arch') diff --git a/arch/arc/include/asm/cacheflush.h b/arch/arc/include/asm/cacheflush.h index 9f841af4109..7d819749478 100644 --- a/arch/arc/include/asm/cacheflush.h +++ b/arch/arc/include/asm/cacheflush.h @@ -99,8 +99,10 @@ static inline int cache_is_vipt_aliasing(void) * checks if two addresses (after page aligning) index into same cache set */ #define addr_not_cache_congruent(addr1, addr2) \ +({ \ cache_is_vipt_aliasing() ? \ - (CACHE_COLOR(addr1) != CACHE_COLOR(addr2)) : 0 \ + (CACHE_COLOR(addr1) != CACHE_COLOR(addr2)) : 0; \ +}) #define copy_to_user_page(vma, page, vaddr, dst, src, len) \ do { \ diff --git a/arch/arc/mm/tlb.c b/arch/arc/mm/tlb.c index 066145b5f34..fe1c5a073af 100644 --- a/arch/arc/mm/tlb.c +++ b/arch/arc/mm/tlb.c @@ -444,7 +444,8 @@ void update_mmu_cache(struct vm_area_struct *vma, unsigned long vaddr_unaligned, * so userspace sees the right data. * (Avoids the flush for Non-exec + congruent mapping case) */ - if (vma->vm_flags & VM_EXEC || addr_not_cache_congruent(paddr, vaddr)) { + if ((vma->vm_flags & VM_EXEC) || + addr_not_cache_congruent(paddr, vaddr)) { struct page *page = pfn_to_page(pte_pfn(*ptep)); int dirty = test_and_clear_bit(PG_arch_1, &page->flags); -- cgit v1.2.3 From 006dfb3c9c44192f06093d65b3a876fa5ad1319a Mon Sep 17 00:00:00 2001 From: Vineet Gupta Date: Sun, 19 May 2013 14:06:44 +0530 Subject: ARC: Use enough bits for determining page's cache color The current code uses 2 bits for determining page's dcache color, thus sorting pages into 4 bins, whereas the aliasing dcache really has 2 bins (8k page, 64k dcache - 4 way-set-assoc). This can cause extraneous flushes - e.g. color 0 and 2. Signed-off-by: Vineet Gupta --- arch/arc/include/asm/cacheflush.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'arch') diff --git a/arch/arc/include/asm/cacheflush.h b/arch/arc/include/asm/cacheflush.h index 7d819749478..ef62682e8d9 100644 --- a/arch/arc/include/asm/cacheflush.h +++ b/arch/arc/include/asm/cacheflush.h @@ -93,7 +93,7 @@ static inline int cache_is_vipt_aliasing(void) #endif } -#define CACHE_COLOR(addr) (((unsigned long)(addr) >> (PAGE_SHIFT)) & 3) +#define CACHE_COLOR(addr) (((unsigned long)(addr) >> (PAGE_SHIFT)) & 1) /* * checks if two addresses (after page aligning) index into same cache set -- cgit v1.2.3 From 7bb66f6e6eecdd8e10ed3a63bd28c1e9105adc79 Mon Sep 17 00:00:00 2001 From: Vineet Gupta Date: Sat, 25 May 2013 14:04:25 +0530 Subject: ARC: lazy dcache flush broke gdb in non-aliasing configs gdbserver inserting a breakpoint ends up calling copy_user_page() for a code page. The generic version of which (non-aliasing config) didn't set the PG_arch_1 bit hence update_mmu_cache() didn't sync dcache/icache for corresponding dynamic loader code page - causing garbade to be executed. So now aliasing versions of copy_user_highpage()/clear_page() are made default. There is no significant overhead since all of special alias handling code is compiled out for non-aliasing build Signed-off-by: Vineet Gupta --- arch/arc/include/asm/page.h | 9 --------- arch/arc/mm/cache_arc700.c | 21 +++++++++++---------- 2 files changed, 11 insertions(+), 19 deletions(-) (limited to 'arch') diff --git a/arch/arc/include/asm/page.h b/arch/arc/include/asm/page.h index 374a3551411..ab84bf131fe 100644 --- a/arch/arc/include/asm/page.h +++ b/arch/arc/include/asm/page.h @@ -19,13 +19,6 @@ #define clear_page(paddr) memset((paddr), 0, PAGE_SIZE) #define copy_page(to, from) memcpy((to), (from), PAGE_SIZE) -#ifndef CONFIG_ARC_CACHE_VIPT_ALIASING - -#define clear_user_page(addr, vaddr, pg) clear_page(addr) -#define copy_user_page(vto, vfrom, vaddr, pg) copy_page(vto, vfrom) - -#else /* VIPT aliasing dcache */ - struct vm_area_struct; struct page; @@ -35,8 +28,6 @@ void copy_user_highpage(struct page *to, struct page *from, unsigned long u_vaddr, struct vm_area_struct *vma); void clear_user_page(void *to, unsigned long u_vaddr, struct page *page); -#endif /* CONFIG_ARC_CACHE_VIPT_ALIASING */ - #undef STRICT_MM_TYPECHECKS #ifdef STRICT_MM_TYPECHECKS diff --git a/arch/arc/mm/cache_arc700.c b/arch/arc/mm/cache_arc700.c index d4b7bb61684..aedce190544 100644 --- a/arch/arc/mm/cache_arc700.c +++ b/arch/arc/mm/cache_arc700.c @@ -676,6 +676,17 @@ void flush_cache_range(struct vm_area_struct *vma, unsigned long start, flush_cache_all(); } +void flush_anon_page(struct vm_area_struct *vma, struct page *page, + unsigned long u_vaddr) +{ + /* TBD: do we really need to clear the kernel mapping */ + __flush_dcache_page(page_address(page), u_vaddr); + __flush_dcache_page(page_address(page), page_address(page)); + +} + +#endif + void copy_user_highpage(struct page *to, struct page *from, unsigned long u_vaddr, struct vm_area_struct *vma) { @@ -725,16 +736,6 @@ void clear_user_page(void *to, unsigned long u_vaddr, struct page *page) set_bit(PG_arch_1, &page->flags); } -void flush_anon_page(struct vm_area_struct *vma, struct page *page, - unsigned long u_vaddr) -{ - /* TBD: do we really need to clear the kernel mapping */ - __flush_dcache_page(page_address(page), u_vaddr); - __flush_dcache_page(page_address(page), page_address(page)); - -} - -#endif /********************************************************************** * Explicit Cache flush request from user space via syscall -- cgit v1.2.3