Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
  [MIPS] Fix wrong checksum for split TCP packets on 64-bit MIPS
  [MIPS] Fix BUG(), BUG_ON() handling
  [MIPS] Retry {save,restore}_fp_context if failed in atomic context.
  [MIPS] Disallow CpU exception in kernel again.
  [MIPS] Add missing silicon revisions for BCM112x

7 files changed, 120 insertions, 50 deletions

diff --git a/arch/mips/kernel/r2300_switch.S b/arch/mips/kernel/r2300_switch.S
index 28c2e2e6af73..656bde2e11b1 100644
--- a/arch/mips/kernel/r2300_switch.S
+++ b/arch/mips/kernel/r2300_switch.S
@@ -49,7 +49,8 @@ LEAF(resume)
 #ifndef CONFIG_CPU_HAS_LLSC
         sw      zero, ll_bit
 #endif
-        mfc0    t2, CP0_STATUS
+        mfc0    t1, CP0_STATUS
+        sw      t1, THREAD_STATUS(a0)
         cpu_save_nonscratch a0
         sw      ra, THREAD_REG31(a0)
 
@@ -59,8 +60,8 @@ LEAF(resume)
         lw      t3, TASK_THREAD_INFO(a0)
         lw      t0, TI_FLAGS(t3)
         li      t1, _TIF_USEDFPU
-        and     t1, t0
-        beqz    t1, 1f
+        and     t2, t0, t1
+        beqz    t2, 1f
         nor     t1, zero, t1
 
         and     t0, t0, t1
@@ -73,13 +74,10 @@ LEAF(resume)
         li      t1, ~ST0_CU1
         and     t0, t0, t1
         sw      t0, ST_OFF(t3)
-        /* clear thread_struct CU1 bit */
-        and     t2, t1
 
         fpu_save_single a0, t0                  # clobbers t0
 
 1:
-        sw      t2, THREAD_STATUS(a0)
         /*
          * The order of restoring the registers takes care of the race
          * updating $28, $29 and kernelsp without disabling ints.
diff --git a/arch/mips/kernel/r4k_switch.S b/arch/mips/kernel/r4k_switch.S
index c7698fd9955c..cc566cf12246 100644
--- a/arch/mips/kernel/r4k_switch.S
+++ b/arch/mips/kernel/r4k_switch.S
@@ -48,7 +48,8 @@
 #ifndef CONFIG_CPU_HAS_LLSC
         sw      zero, ll_bit
 #endif
-        mfc0    t2, CP0_STATUS
+        mfc0    t1, CP0_STATUS
+        LONG_S  t1, THREAD_STATUS(a0)
         cpu_save_nonscratch a0
         LONG_S  ra, THREAD_REG31(a0)
 
@@ -58,8 +59,8 @@
         PTR_L   t3, TASK_THREAD_INFO(a0)
         LONG_L  t0, TI_FLAGS(t3)
         li      t1, _TIF_USEDFPU
-        and     t1, t0
-        beqz    t1, 1f
+        and     t2, t0, t1
+        beqz    t2, 1f
         nor     t1, zero, t1
 
         and     t0, t0, t1
@@ -72,13 +73,10 @@
         li      t1, ~ST0_CU1
         and     t0, t0, t1
         LONG_S  t0, ST_OFF(t3)
-        /* clear thread_struct CU1 bit */
-        and     t2, t1
 
         fpu_save_double a0 t0 t1                # c0_status passed in t0
                                                 # clobbers t1
 1:
-        LONG_S  t2, THREAD_STATUS(a0)
 
         /*
          * The order of restoring the registers takes care of the race
diff --git a/arch/mips/kernel/signal-common.h b/arch/mips/kernel/signal-common.h
index 297dfcb97524..c0faabd52010 100644
--- a/arch/mips/kernel/signal-common.h
+++ b/arch/mips/kernel/signal-common.h
@@ -34,4 +34,13 @@ extern int install_sigtramp(unsigned int __user *tramp, unsigned int syscall);
 /* Check and clear pending FPU exceptions in saved CSR */
 extern int fpcsr_pending(unsigned int __user *fpcsr);
 
+/* Make sure we will not lose FPU ownership */
+#ifdef CONFIG_PREEMPT
+#define lock_fpu_owner()        preempt_disable()
+#define unlock_fpu_owner()      preempt_enable()
+#else
+#define lock_fpu_owner()        pagefault_disable()
+#define unlock_fpu_owner()      pagefault_enable()
+#endif
+
 #endif  /* __SIGNAL_COMMON_H */
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index 8c3c5a5789b0..07d67309451a 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -20,6 +20,7 @@
 #include <linux/ptrace.h>
 #include <linux/unistd.h>
 #include <linux/compiler.h>
+#include <linux/uaccess.h>
 
 #include <asm/abi.h>
 #include <asm/asm.h>
@@ -27,7 +28,6 @@
 #include <asm/cacheflush.h>
 #include <asm/fpu.h>
 #include <asm/sim.h>
-#include <asm/uaccess.h>
 #include <asm/ucontext.h>
 #include <asm/cpu-features.h>
 #include <asm/war.h>
@@ -78,6 +78,46 @@ struct rt_sigframe {
 /*
  * Helper routines
  */
+static int protected_save_fp_context(struct sigcontext __user *sc)
+{
+        int err;
+        while (1) {
+                lock_fpu_owner();
+                own_fpu_inatomic(1);
+                err = save_fp_context(sc); /* this might fail */
+                unlock_fpu_owner();
+                if (likely(!err))
+                        break;
+                /* touch the sigcontext and try again */
+                err = __put_user(0, &sc->sc_fpregs[0]) |
+                        __put_user(0, &sc->sc_fpregs[31]) |
+                        __put_user(0, &sc->sc_fpc_csr);
+                if (err)
+                        break;  /* really bad sigcontext */
+        }
+        return err;
+}
+
+static int protected_restore_fp_context(struct sigcontext __user *sc)
+{
+        int err, tmp;
+        while (1) {
+                lock_fpu_owner();
+                own_fpu_inatomic(0);
+                err = restore_fp_context(sc); /* this might fail */
+                unlock_fpu_owner();
+                if (likely(!err))
+                        break;
+                /* touch the sigcontext and try again */
+                err = __get_user(tmp, &sc->sc_fpregs[0]) |
+                        __get_user(tmp, &sc->sc_fpregs[31]) |
+                        __get_user(tmp, &sc->sc_fpc_csr);
+                if (err)
+                        break;  /* really bad sigcontext */
+        }
+        return err;
+}
+
 int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
 {
         int err = 0;
@@ -113,10 +153,7 @@ int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
                  * Save FPU state to signal context. Signal handler
                  * will "inherit" current FPU state.
                  */
-                own_fpu(1);
-                enable_fp_in_kernel();
-                err |= save_fp_context(sc);
-                disable_fp_in_kernel();
+                err |= protected_save_fp_context(sc);
         }
         return err;
 }
@@ -148,7 +185,7 @@ check_and_restore_fp_context(struct sigcontext __user *sc)
         err = sig = fpcsr_pending(&sc->sc_fpc_csr);
         if (err > 0)
                 err = 0;
-        err |= restore_fp_context(sc);
+        err |= protected_restore_fp_context(sc);
         return err ?: sig;
 }
 
@@ -187,11 +224,8 @@ int restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
 
         if (used_math) {
                 /* restore fpu context if we have used it before */
-                own_fpu(0);
-                enable_fp_in_kernel();
                 if (!err)
                         err = check_and_restore_fp_context(sc);
-                disable_fp_in_kernel();
         } else {
                 /* signal handler may have used FPU.  Give it up. */
                 lose_fpu(0);
diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c
index 151fd2f0893a..b9a014411f83 100644
--- a/arch/mips/kernel/signal32.c
+++ b/arch/mips/kernel/signal32.c
@@ -22,6 +22,7 @@
 #include <linux/compat.h>
 #include <linux/suspend.h>
 #include <linux/compiler.h>
+#include <linux/uaccess.h>
 
 #include <asm/abi.h>
 #include <asm/asm.h>
@@ -29,7 +30,6 @@
 #include <linux/bitops.h>
 #include <asm/cacheflush.h>
 #include <asm/sim.h>
-#include <asm/uaccess.h>
 #include <asm/ucontext.h>
 #include <asm/system.h>
 #include <asm/fpu.h>
@@ -176,6 +176,46 @@ struct rt_sigframe32 {
 /*
  * sigcontext handlers
  */
+static int protected_save_fp_context32(struct sigcontext32 __user *sc)
+{
+        int err;
+        while (1) {
+                lock_fpu_owner();
+                own_fpu_inatomic(1);
+                err = save_fp_context32(sc); /* this might fail */
+                unlock_fpu_owner();
+                if (likely(!err))
+                        break;
+                /* touch the sigcontext and try again */
+                err = __put_user(0, &sc->sc_fpregs[0]) |
+                        __put_user(0, &sc->sc_fpregs[31]) |
+                        __put_user(0, &sc->sc_fpc_csr);
+                if (err)
+                        break;  /* really bad sigcontext */
+        }
+        return err;
+}
+
+static int protected_restore_fp_context32(struct sigcontext32 __user *sc)
+{
+        int err, tmp;
+        while (1) {
+                lock_fpu_owner();
+                own_fpu_inatomic(0);
+                err = restore_fp_context32(sc); /* this might fail */
+                unlock_fpu_owner();
+                if (likely(!err))
+                        break;
+                /* touch the sigcontext and try again */
+                err = __get_user(tmp, &sc->sc_fpregs[0]) |
+                        __get_user(tmp, &sc->sc_fpregs[31]) |
+                        __get_user(tmp, &sc->sc_fpc_csr);
+                if (err)
+                        break;  /* really bad sigcontext */
+        }
+        return err;
+}
+
 static int setup_sigcontext32(struct pt_regs *regs,
                               struct sigcontext32 __user *sc)
 {
@@ -209,10 +249,7 @@ static int setup_sigcontext32(struct pt_regs *regs,
                  * Save FPU state to signal context.  Signal handler
                  * will "inherit" current FPU state.
                  */
-                own_fpu(1);
-                enable_fp_in_kernel();
-                err |= save_fp_context32(sc);
-                disable_fp_in_kernel();
+                err |= protected_save_fp_context32(sc);
         }
         return err;
 }
@@ -225,7 +262,7 @@ check_and_restore_fp_context32(struct sigcontext32 __user *sc)
         err = sig = fpcsr_pending(&sc->sc_fpc_csr);
         if (err > 0)
                 err = 0;
-        err |= restore_fp_context32(sc);
+        err |= protected_restore_fp_context32(sc);
         return err ?: sig;
 }
 
@@ -261,11 +298,8 @@ static int restore_sigcontext32(struct pt_regs *regs,
 
         if (used_math) {
                 /* restore fpu context if we have used it before */
-                own_fpu(0);
-                enable_fp_in_kernel();
                 if (!err)
                         err = check_and_restore_fp_context32(sc);
-                disable_fp_in_kernel();
         } else {
                 /* signal handler may have used FPU.  Give it up. */
                 lose_fpu(0);
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 7d76a85422b2..493cb29b8a42 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -650,7 +650,7 @@ asmlinkage void do_bp(struct pt_regs *regs)
         unsigned int opcode, bcode;
         siginfo_t info;
 
-        if (get_user(opcode, (unsigned int __user *) exception_epc(regs)))
+        if (__get_user(opcode, (unsigned int __user *) exception_epc(regs)))
                 goto out_sigsegv;
 
         /*
@@ -700,7 +700,7 @@ asmlinkage void do_tr(struct pt_regs *regs)
         unsigned int opcode, tcode = 0;
         siginfo_t info;
 
-        if (get_user(opcode, (unsigned int __user *) exception_epc(regs)))
+        if (__get_user(opcode, (unsigned int __user *) exception_epc(regs)))
                 goto out_sigsegv;
 
         /* Immediate versions don't provide a code.  */
@@ -757,11 +757,12 @@ asmlinkage void do_cpu(struct pt_regs *regs)
 {
         unsigned int cpid;
 
+        die_if_kernel("do_cpu invoked from kernel context!", regs);
+
         cpid = (regs->cp0_cause >> CAUSEB_CE) & 3;
 
         switch (cpid) {
         case 0:
-                die_if_kernel("do_cpu invoked from kernel context!", regs);
                 if (!cpu_has_llsc)
                         if (!simulate_llsc(regs))
                                 return;
@@ -772,9 +773,6 @@ asmlinkage void do_cpu(struct pt_regs *regs)
                 break;
 
         case 1:
-                if (!test_thread_flag(TIF_ALLOW_FP_IN_KERNEL))
-                        die_if_kernel("do_cpu invoked from kernel context!",
-                                      regs);
                 if (used_math())        /* Using the FPU again.  */
                         own_fpu(1);
                 else {                  /* First time FPU user.  */
@@ -782,19 +780,7 @@ asmlinkage void do_cpu(struct pt_regs *regs)
                         set_used_math();
                 }
 
-                if (raw_cpu_has_fpu) {
-                        if (test_thread_flag(TIF_ALLOW_FP_IN_KERNEL)) {
-                                local_irq_disable();
-                                if (cpu_has_fpu)
-                                        regs->cp0_status |= ST0_CU1;
-                                /*
-                                 * We must return without enabling
-                                 * interrupts to ensure keep FPU
-                                 * ownership until resume.
-                                 */
-                                return;
-                        }
-                } else {
+                if (!raw_cpu_has_fpu) {
                         int sig;
                         sig = fpu_emulator_cop1Handler(regs,
                                                 &current->thread.fpu, 0);
@@ -836,7 +822,6 @@ asmlinkage void do_cpu(struct pt_regs *regs)
 
         case 2:
         case 3:
-                die_if_kernel("do_cpu invoked from kernel context!", regs);
                 break;
         }
 
diff --git a/arch/mips/sibyte/sb1250/setup.c b/arch/mips/sibyte/sb1250/setup.c
index 87188f0f6fbe..f4a6169aa0a4 100644
--- a/arch/mips/sibyte/sb1250/setup.c
+++ b/arch/mips/sibyte/sb1250/setup.c
@@ -141,6 +141,18 @@ static int __init setup_bcm112x(void)
                 periph_rev = 3;
                 pass_str = "A2";
                 break;
+        case K_SYS_REVISION_BCM112x_A3:
+                periph_rev = 3;
+                pass_str = "A3";
+                break;
+        case K_SYS_REVISION_BCM112x_A4:
+                periph_rev = 3;
+                pass_str = "A4";
+                break;
+        case K_SYS_REVISION_BCM112x_B0:
+                periph_rev = 3;
+                pass_str = "B0";
+                break;
         default:
                 printk("Unknown %s rev %x\n", soc_str, soc_pass);
                 ret = 1;