1 files changed, 190 insertions, 35 deletions

diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index a0c74bbf3454..bfdd783e3916 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -77,6 +77,13 @@
 extern unsigned long _get_SP(void);
 
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+/*
+ * Are we running in "Suspend disabled" mode? If so we have to block any
+ * sigreturn that would get us into suspended state, and we also warn in some
+ * other paths that we should never reach with suspend disabled.
+ */
+bool tm_suspend_disabled __ro_after_init = false;
+
 static void check_if_tm_restore_required(struct task_struct *tsk)
 {
         /*
@@ -97,9 +104,23 @@ static inline bool msr_tm_active(unsigned long msr)
 {
         return MSR_TM_ACTIVE(msr);
 }
+
+static bool tm_active_with_fp(struct task_struct *tsk)
+{
+        return msr_tm_active(tsk->thread.regs->msr) &&
+                (tsk->thread.ckpt_regs.msr & MSR_FP);
+}
+
+static bool tm_active_with_altivec(struct task_struct *tsk)
+{
+        return msr_tm_active(tsk->thread.regs->msr) &&
+                (tsk->thread.ckpt_regs.msr & MSR_VEC);
+}
 #else
 static inline bool msr_tm_active(unsigned long msr) { return false; }
 static inline void check_if_tm_restore_required(struct task_struct *tsk) { }
+static inline bool tm_active_with_fp(struct task_struct *tsk) { return false; }
+static inline bool tm_active_with_altivec(struct task_struct *tsk) { return false; }
 #endif /* CONFIG_PPC_TRANSACTIONAL_MEM */
 
 bool strict_msr_control;
@@ -232,7 +253,7 @@ EXPORT_SYMBOL(enable_kernel_fp);
 
 static int restore_fp(struct task_struct *tsk)
 {
-        if (tsk->thread.load_fp || msr_tm_active(tsk->thread.regs->msr)) {
+        if (tsk->thread.load_fp || tm_active_with_fp(tsk)) {
                 load_fp_state(&current->thread.fp_state);
                 current->thread.load_fp++;
                 return 1;
@@ -314,7 +335,7 @@ EXPORT_SYMBOL_GPL(flush_altivec_to_thread);
 static int restore_altivec(struct task_struct *tsk)
 {
         if (cpu_has_feature(CPU_FTR_ALTIVEC) &&
-                (tsk->thread.load_vec || msr_tm_active(tsk->thread.regs->msr))) {
+                (tsk->thread.load_vec || tm_active_with_altivec(tsk))) {
                 load_vr_state(&tsk->thread.vr_state);
                 tsk->thread.used_vr = 1;
                 tsk->thread.load_vec++;
@@ -853,6 +874,10 @@ static void tm_reclaim_thread(struct thread_struct *thr,
         if (!MSR_TM_SUSPENDED(mfmsr()))
                 return;
 
+        giveup_all(container_of(thr, struct task_struct, thread));
+
+        tm_reclaim(thr, cause);
+
         /*
          * If we are in a transaction and FP is off then we can't have
          * used FP inside that transaction. Hence the checkpointed
@@ -871,10 +896,6 @@ static void tm_reclaim_thread(struct thread_struct *thr,
         if ((thr->ckpt_regs.msr & MSR_VEC) == 0)
                 memcpy(&thr->ckvr_state, &thr->vr_state,
                        sizeof(struct thread_vr_state));
-
-        giveup_all(container_of(thr, struct task_struct, thread));
-
-        tm_reclaim(thr, thr->ckpt_regs.msr, cause);
 }
 
 void tm_reclaim_current(uint8_t cause)
@@ -903,6 +924,8 @@ static inline void tm_reclaim_task(struct task_struct *tsk)
         if (!MSR_TM_ACTIVE(thr->regs->msr))
                 goto out_and_saveregs;
 
+        WARN_ON(tm_suspend_disabled);
+
         TM_DEBUG("--- tm_reclaim on pid %d (NIP=%lx, "
                  "ccr=%lx, msr=%lx, trap=%lx)\n",
                  tsk->pid, thr->regs->nip,
@@ -923,11 +946,9 @@ out_and_saveregs:
         tm_save_sprs(thr);
 }
 
-extern void __tm_recheckpoint(struct thread_struct *thread,
-                              unsigned long orig_msr);
+extern void __tm_recheckpoint(struct thread_struct *thread);
 
-void tm_recheckpoint(struct thread_struct *thread,
-                     unsigned long orig_msr)
+void tm_recheckpoint(struct thread_struct *thread)
 {
         unsigned long flags;
 
@@ -946,15 +967,13 @@ void tm_recheckpoint(struct thread_struct *thread,
          */
         tm_restore_sprs(thread);
 
-        __tm_recheckpoint(thread, orig_msr);
+        __tm_recheckpoint(thread);
 
         local_irq_restore(flags);
 }
 
 static inline void tm_recheckpoint_new_task(struct task_struct *new)
 {
-        unsigned long msr;
-
         if (!cpu_has_feature(CPU_FTR_TM))
                 return;
 
@@ -973,13 +992,11 @@ static inline void tm_recheckpoint_new_task(struct task_struct *new)
                 tm_restore_sprs(&new->thread);
                 return;
         }
-        msr = new->thread.ckpt_regs.msr;
         /* Recheckpoint to restore original checkpointed register state. */
-        TM_DEBUG("*** tm_recheckpoint of pid %d "
-                 "(new->msr 0x%lx, new->origmsr 0x%lx)\n",
-                 new->pid, new->thread.regs->msr, msr);
+        TM_DEBUG("*** tm_recheckpoint of pid %d (new->msr 0x%lx)\n",
+                 new->pid, new->thread.regs->msr);
 
-        tm_recheckpoint(&new->thread, msr);
+        tm_recheckpoint(&new->thread);
 
         /*
          * The checkpointed state has been restored but the live state has
@@ -1119,6 +1136,10 @@ static inline void restore_sprs(struct thread_struct *old_thread,
                 if (old_thread->tar != new_thread->tar)
                         mtspr(SPRN_TAR, new_thread->tar);
         }
+
+        if (cpu_has_feature(CPU_FTR_ARCH_300) &&
+            old_thread->tidr != new_thread->tidr)
+                mtspr(SPRN_TIDR, new_thread->tidr);
 #endif
 }
 
@@ -1155,7 +1176,7 @@ struct task_struct *__switch_to(struct task_struct *prev,
         }
 #endif /* CONFIG_PPC64 */
 
-#ifdef CONFIG_PPC_STD_MMU_64
+#ifdef CONFIG_PPC_BOOK3S_64
         batch = this_cpu_ptr(&ppc64_tlb_batch);
         if (batch->active) {
                 current_thread_info()->local_flags |= _TLF_LAZY_MMU;
@@ -1163,7 +1184,7 @@ struct task_struct *__switch_to(struct task_struct *prev,
                         __flush_tlb_pending(batch);
                 batch->active = 0;
         }
-#endif /* CONFIG_PPC_STD_MMU_64 */
+#endif /* CONFIG_PPC_BOOK3S_64 */
 
 #ifdef CONFIG_PPC_ADV_DEBUG_REGS
         switch_booke_debug_regs(&new->thread.debug);
@@ -1209,7 +1230,7 @@ struct task_struct *__switch_to(struct task_struct *prev,
 
         last = _switch(old_thread, new_thread);
 
-#ifdef CONFIG_PPC_STD_MMU_64
+#ifdef CONFIG_PPC_BOOK3S_64
         if (current_thread_info()->local_flags & _TLF_LAZY_MMU) {
                 current_thread_info()->local_flags &= ~_TLF_LAZY_MMU;
                 batch = this_cpu_ptr(&ppc64_tlb_batch);
@@ -1223,22 +1244,22 @@ struct task_struct *__switch_to(struct task_struct *prev,
                  * The copy-paste buffer can only store into foreign real
                  * addresses, so unprivileged processes can not see the
                  * data or use it in any way unless they have foreign real
-                 * mappings. We don't have a VAS driver that allocates those
-                 * yet, so no cpabort is required.
+                 * mappings. If the new process has the foreign real address
+                 * mappings, we must issue a cp_abort to clear any state and
+                 * prevent snooping, corruption or a covert channel.
+                 *
+                 * DD1 allows paste into normal system memory so we do an
+                 * unpaired copy, rather than cp_abort, to clear the buffer,
+                 * since cp_abort is quite expensive.
                  */
-                if (cpu_has_feature(CPU_FTR_POWER9_DD1)) {
-                        /*
-                         * DD1 allows paste into normal system memory, so we
-                         * do an unpaired copy here to clear the buffer and
-                         * prevent a covert channel being set up.
-                         *
-                         * cpabort is not used because it is quite expensive.
-                         */
+                if (current_thread_info()->task->thread.used_vas) {
+                        asm volatile(PPC_CP_ABORT);
+                } else if (cpu_has_feature(CPU_FTR_POWER9_DD1)) {
                         asm volatile(PPC_COPY(%0, %1)
                                         : : "r"(dummy_copy_buffer), "r"(0));
                 }
         }
-#endif /* CONFIG_PPC_STD_MMU_64 */
+#endif /* CONFIG_PPC_BOOK3S_64 */
 
         return last;
 }
@@ -1434,6 +1455,137 @@ void flush_thread(void)
 #endif /* CONFIG_HAVE_HW_BREAKPOINT */
 }
 
+int set_thread_uses_vas(void)
+{
+#ifdef CONFIG_PPC_BOOK3S_64
+        if (!cpu_has_feature(CPU_FTR_ARCH_300))
+                return -EINVAL;
+
+        current->thread.used_vas = 1;
+
+        /*
+         * Even a process that has no foreign real address mapping can use
+         * an unpaired COPY instruction (to no real effect). Issue CP_ABORT
+         * to clear any pending COPY and prevent a covert channel.
+         *
+         * __switch_to() will issue CP_ABORT on future context switches.
+         */
+        asm volatile(PPC_CP_ABORT);
+
+#endif /* CONFIG_PPC_BOOK3S_64 */
+        return 0;
+}
+
+#ifdef CONFIG_PPC64
+static DEFINE_SPINLOCK(vas_thread_id_lock);
+static DEFINE_IDA(vas_thread_ida);
+
+/*
+ * We need to assign a unique thread id to each thread in a process.
+ *
+ * This thread id, referred to as TIDR, and separate from the Linux's tgid,
+ * is intended to be used to direct an ASB_Notify from the hardware to the
+ * thread, when a suitable event occurs in the system.
+ *
+ * One such event is a "paste" instruction in the context of Fast Thread
+ * Wakeup (aka Core-to-core wake up in the Virtual Accelerator Switchboard
+ * (VAS) in POWER9.
+ *
+ * To get a unique TIDR per process we could simply reuse task_pid_nr() but
+ * the problem is that task_pid_nr() is not yet available copy_thread() is
+ * called. Fixing that would require changing more intrusive arch-neutral
+ * code in code path in copy_process()?.
+ *
+ * Further, to assign unique TIDRs within each process, we need an atomic
+ * field (or an IDR) in task_struct, which again intrudes into the arch-
+ * neutral code. So try to assign globally unique TIDRs for now.
+ *
+ * NOTE: TIDR 0 indicates that the thread does not need a TIDR value.
+ *       For now, only threads that expect to be notified by the VAS
+ *       hardware need a TIDR value and we assign values > 0 for those.
+ */
+#define MAX_THREAD_CONTEXT      ((1 << 16) - 1)
+static int assign_thread_tidr(void)
+{
+        int index;
+        int err;
+
+again:
+        if (!ida_pre_get(&vas_thread_ida, GFP_KERNEL))
+                return -ENOMEM;
+
+        spin_lock(&vas_thread_id_lock);
+        err = ida_get_new_above(&vas_thread_ida, 1, &index);
+        spin_unlock(&vas_thread_id_lock);
+
+        if (err == -EAGAIN)
+                goto again;
+        else if (err)
+                return err;
+
+        if (index > MAX_THREAD_CONTEXT) {
+                spin_lock(&vas_thread_id_lock);
+                ida_remove(&vas_thread_ida, index);
+                spin_unlock(&vas_thread_id_lock);
+                return -ENOMEM;
+        }
+
+        return index;
+}
+
+static void free_thread_tidr(int id)
+{
+        spin_lock(&vas_thread_id_lock);
+        ida_remove(&vas_thread_ida, id);
+        spin_unlock(&vas_thread_id_lock);
+}
+
+/*
+ * Clear any TIDR value assigned to this thread.
+ */
+void clear_thread_tidr(struct task_struct *t)
+{
+        if (!t->thread.tidr)
+                return;
+
+        if (!cpu_has_feature(CPU_FTR_ARCH_300)) {
+                WARN_ON_ONCE(1);
+                return;
+        }
+
+        mtspr(SPRN_TIDR, 0);
+        free_thread_tidr(t->thread.tidr);
+        t->thread.tidr = 0;
+}
+
+void arch_release_task_struct(struct task_struct *t)
+{
+        clear_thread_tidr(t);
+}
+
+/*
+ * Assign a unique TIDR (thread id) for task @t and set it in the thread
+ * structure. For now, we only support setting TIDR for 'current' task.
+ */
+int set_thread_tidr(struct task_struct *t)
+{
+        if (!cpu_has_feature(CPU_FTR_ARCH_300))
+                return -EINVAL;
+
+        if (t != current)
+                return -EINVAL;
+
+        t->thread.tidr = assign_thread_tidr();
+        if (t->thread.tidr < 0)
+                return t->thread.tidr;
+
+        mtspr(SPRN_TIDR, t->thread.tidr);
+
+        return 0;
+}
+
+#endif /* CONFIG_PPC64 */
+
 void
 release_thread(struct task_struct *t)
 {
@@ -1467,7 +1619,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
 
 static void setup_ksp_vsid(struct task_struct *p, unsigned long sp)
 {
-#ifdef CONFIG_PPC_STD_MMU_64
+#ifdef CONFIG_PPC_BOOK3S_64
         unsigned long sp_vsid;
         unsigned long llp = mmu_psize_defs[mmu_linear_psize].sllp;
 
@@ -1580,6 +1732,8 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
         }
         if (cpu_has_feature(CPU_FTR_HAS_PPR))
                 p->thread.ppr = INIT_PPR;
+
+        p->thread.tidr = 0;
 #endif
         kregs->nip = ppc_function_entry(f);
         return 0;
@@ -1898,7 +2052,8 @@ unsigned long get_wchan(struct task_struct *p)
 
         do {
                 sp = *(unsigned long *)sp;
-                if (!validate_sp(sp, p, STACK_FRAME_OVERHEAD))
+                if (!validate_sp(sp, p, STACK_FRAME_OVERHEAD) ||
+                    p->state == TASK_RUNNING)
                         return 0;
                 if (count > 0) {
                         ip = ((unsigned long *)sp)[STACK_FRAME_LR_SAVE];
@@ -2046,7 +2201,7 @@ unsigned long arch_randomize_brk(struct mm_struct *mm)
         unsigned long base = mm->brk;
         unsigned long ret;
 
-#ifdef CONFIG_PPC_STD_MMU_64
+#ifdef CONFIG_PPC_BOOK3S_64
         /*
          * If we are using 1TB segments and we are allowed to randomise
          * the heap, we can put it above 1TB so it is backed by a 1TB