9 files changed, 385 insertions, 39 deletions

diff --git a/arch/ia64/kernel/Makefile b/arch/ia64/kernel/Makefile
index 098ee605bf5e..33e5a598672d 100644
--- a/arch/ia64/kernel/Makefile
+++ b/arch/ia64/kernel/Makefile
@@ -34,6 +34,7 @@ obj-$(CONFIG_IA64_UNCACHED_ALLOCATOR)	+= uncached.o
 obj-$(CONFIG_AUDIT)             += audit.o
 obj-$(CONFIG_PCI_MSI)           += msi_ia64.o
 mca_recovery-y                  += mca_drv.o mca_drv_asm.o
+obj-$(CONFIG_IA64_MC_ERR_INJECT)+= err_inject.o
 
 obj-$(CONFIG_IA64_ESI)          += esi.o
 ifneq ($(CONFIG_IA64_ESI),)
diff --git a/arch/ia64/kernel/efi.c b/arch/ia64/kernel/efi.c
index f45f91d38cab..78d29b79947d 100644
--- a/arch/ia64/kernel/efi.c
+++ b/arch/ia64/kernel/efi.c
@@ -660,6 +660,29 @@ efi_memory_descriptor (unsigned long phys_addr)
         return NULL;
 }
 
+static int
+efi_memmap_intersects (unsigned long phys_addr, unsigned long size)
+{
+        void *efi_map_start, *efi_map_end, *p;
+        efi_memory_desc_t *md;
+        u64 efi_desc_size;
+        unsigned long end;
+
+        efi_map_start = __va(ia64_boot_param->efi_memmap);
+        efi_map_end   = efi_map_start + ia64_boot_param->efi_memmap_size;
+        efi_desc_size = ia64_boot_param->efi_memdesc_size;
+
+        end = phys_addr + size;
+
+        for (p = efi_map_start; p < efi_map_end; p += efi_desc_size) {
+                md = p;
+
+                if (md->phys_addr < end && efi_md_end(md) > phys_addr)
+                        return 1;
+        }
+        return 0;
+}
+
 u32
 efi_mem_type (unsigned long phys_addr)
 {
@@ -766,11 +789,28 @@ valid_phys_addr_range (unsigned long phys_addr, unsigned long size)
 int
 valid_mmap_phys_addr_range (unsigned long pfn, unsigned long size)
 {
+        unsigned long phys_addr = pfn << PAGE_SHIFT;
+        u64 attr;
+
+        attr = efi_mem_attribute(phys_addr, size);
+
         /*
-         * MMIO regions are often missing from the EFI memory map.
-         * We must allow mmap of them for programs like X, so we
-         * currently can't do any useful validation.
+         * /dev/mem mmap uses normal user pages, so we don't need the entire
+         * granule, but the entire region we're mapping must support the same
+         * attribute.
          */
+        if (attr & EFI_MEMORY_WB || attr & EFI_MEMORY_UC)
+                return 1;
+
+        /*
+         * Intel firmware doesn't tell us about all the MMIO regions, so
+         * in general we have to allow mmap requests.  But if EFI *does*
+         * tell us about anything inside this region, we should deny it.
+         * The user can always map a smaller region to avoid the overlap.
+         */
+        if (efi_memmap_intersects(phys_addr, size))
+                return 0;
+
         return 1;
 }
 
diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
index e7873eeae448..55fd2d5471e1 100644
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -767,7 +767,7 @@ ENTRY(ia64_leave_syscall)
         ld8.fill r15=[r3]                       // M0|1 restore r15
         mov b6=r18                              // I0   restore b6
 
-        addl r17=THIS_CPU(ia64_phys_stacked_size_p8),r0 // A
+        LOAD_PHYS_STACK_REG_SIZE(r17)
         mov f9=f0                                       // F    clear f9
 (pKStk) br.cond.dpnt.many skip_rbs_switch               // B
 
@@ -775,7 +775,6 @@ ENTRY(ia64_leave_syscall)
         shr.u r18=r19,16                // I0|1 get byte size of existing "dirty" partition
         cover                           // B    add current frame into dirty partition & set cr.ifs
         ;;
-(pUStk) ld4 r17=[r17]                   // M0|1 r17 = cpu_data->phys_stacked_size_p8
         mov r19=ar.bsp                  // M2   get new backing store pointer
         mov f10=f0                      // F    clear f10
 
@@ -953,9 +952,7 @@ GLOBAL_ENTRY(ia64_leave_kernel)
         shr.u r18=r19,16        // get byte size of existing "dirty" partition
         ;;
         mov r16=ar.bsp          // get existing backing store pointer
-        addl r17=THIS_CPU(ia64_phys_stacked_size_p8),r0
-        ;;
-        ld4 r17=[r17]           // r17 = cpu_data->phys_stacked_size_p8
+        LOAD_PHYS_STACK_REG_SIZE(r17)
 (pKStk) br.cond.dpnt skip_rbs_switch
 
         /*
diff --git a/arch/ia64/kernel/err_inject.c b/arch/ia64/kernel/err_inject.c
new file mode 100644
index 000000000000..d3e9f33e8bdd
--- /dev/null
+++ b/arch/ia64/kernel/err_inject.c
@@ -0,0 +1,293 @@
+/*
+ * err_inject.c -
+ *      1.) Inject errors to a processor.
+ *      2.) Query error injection capabilities.
+ * This driver along with user space code can be acting as an error
+ * injection tool.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ * NON INFRINGEMENT.  See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ * Written by: Fenghua Yu <fenghua.yu@intel.com>, Intel Corporation
+ * Copyright (C) 2006, Intel Corp.  All rights reserved.
+ *
+ */
+#include <linux/sysdev.h>
+#include <linux/init.h>
+#include <linux/mm.h>
+#include <linux/cpu.h>
+#include <linux/module.h>
+
+#define ERR_INJ_DEBUG
+
+#define ERR_DATA_BUFFER_SIZE 3          // Three 8-byte;
+
+#define define_one_ro(name)                                             \
+static SYSDEV_ATTR(name, 0444, show_##name, NULL)
+
+#define define_one_rw(name)                                             \
+static SYSDEV_ATTR(name, 0644, show_##name, store_##name)
+
+static u64 call_start[NR_CPUS];
+static u64 phys_addr[NR_CPUS];
+static u64 err_type_info[NR_CPUS];
+static u64 err_struct_info[NR_CPUS];
+static struct {
+        u64 data1;
+        u64 data2;
+        u64 data3;
+} __attribute__((__aligned__(16))) err_data_buffer[NR_CPUS];
+static s64 status[NR_CPUS];
+static u64 capabilities[NR_CPUS];
+static u64 resources[NR_CPUS];
+
+#define show(name)                                                      \
+static ssize_t                                                          \
+show_##name(struct sys_device *dev, char *buf)                          \
+{                                                                       \
+        u32 cpu=dev->id;                                                \
+        return sprintf(buf, "%lx\n", name[cpu]);                        \
+}
+
+#define store(name)                                                     \
+static ssize_t                                                          \
+store_##name(struct sys_device *dev, const char *buf, size_t size)      \
+{                                                                       \
+        unsigned int cpu=dev->id;                                       \
+        name[cpu] = simple_strtoull(buf, NULL, 16);                     \
+        return size;                                                    \
+}
+
+show(call_start)
+
+/* It's user's responsibility to call the PAL procedure on a specific
+ * processor. The cpu number in driver is only used for storing data.
+ */
+static ssize_t
+store_call_start(struct sys_device *dev, const char *buf, size_t size)
+{
+        unsigned int cpu=dev->id;
+        unsigned long call_start = simple_strtoull(buf, NULL, 16);
+
+#ifdef ERR_INJ_DEBUG
+        printk(KERN_DEBUG "pal_mc_err_inject for cpu%d:\n", cpu);
+        printk(KERN_DEBUG "err_type_info=%lx,\n", err_type_info[cpu]);
+        printk(KERN_DEBUG "err_struct_info=%lx,\n", err_struct_info[cpu]);
+        printk(KERN_DEBUG "err_data_buffer=%lx, %lx, %lx.\n",
+                          err_data_buffer[cpu].data1,
+                          err_data_buffer[cpu].data2,
+                          err_data_buffer[cpu].data3);
+#endif
+        switch (call_start) {
+            case 0: /* Do nothing. */
+                break;
+            case 1: /* Call pal_mc_error_inject in physical mode. */
+                status[cpu]=ia64_pal_mc_error_inject_phys(err_type_info[cpu],
+                                        err_struct_info[cpu],
+                                        ia64_tpa(&err_data_buffer[cpu]),
+                                        &capabilities[cpu],
+                                        &resources[cpu]);
+                break;
+            case 2: /* Call pal_mc_error_inject in virtual mode. */
+                status[cpu]=ia64_pal_mc_error_inject_virt(err_type_info[cpu],
+                                        err_struct_info[cpu],
+                                        ia64_tpa(&err_data_buffer[cpu]),
+                                        &capabilities[cpu],
+                                        &resources[cpu]);
+                break;
+            default:
+                status[cpu] = -EINVAL;
+                break;
+        }
+
+#ifdef ERR_INJ_DEBUG
+        printk(KERN_DEBUG "Returns: status=%d,\n", (int)status[cpu]);
+        printk(KERN_DEBUG "capapbilities=%lx,\n", capabilities[cpu]);
+        printk(KERN_DEBUG "resources=%lx\n", resources[cpu]);
+#endif
+        return size;
+}
+
+show(err_type_info)
+store(err_type_info)
+
+static ssize_t
+show_virtual_to_phys(struct sys_device *dev, char *buf)
+{
+        unsigned int cpu=dev->id;
+        return sprintf(buf, "%lx\n", phys_addr[cpu]);
+}
+
+static ssize_t
+store_virtual_to_phys(struct sys_device *dev, const char *buf, size_t size)
+{
+        unsigned int cpu=dev->id;
+        u64 virt_addr=simple_strtoull(buf, NULL, 16);
+        int ret;
+
+        ret = get_user_pages(current, current->mm, virt_addr,
+                        1, VM_READ, 0, NULL, NULL);
+        if (ret<=0) {
+#ifdef ERR_INJ_DEBUG
+                printk("Virtual address %lx is not existing.\n",virt_addr);
+#endif
+                return -EINVAL;
+        }
+
+        phys_addr[cpu] = ia64_tpa(virt_addr);
+        return size;
+}
+
+show(err_struct_info)
+store(err_struct_info)
+
+static ssize_t
+show_err_data_buffer(struct sys_device *dev, char *buf)
+{
+        unsigned int cpu=dev->id;
+
+        return sprintf(buf, "%lx, %lx, %lx\n",
+                        err_data_buffer[cpu].data1,
+                        err_data_buffer[cpu].data2,
+                        err_data_buffer[cpu].data3);
+}
+
+static ssize_t
+store_err_data_buffer(struct sys_device *dev, const char *buf, size_t size)
+{
+        unsigned int cpu=dev->id;
+        int ret;
+
+#ifdef ERR_INJ_DEBUG
+        printk("write err_data_buffer=[%lx,%lx,%lx] on cpu%d\n",
+                 err_data_buffer[cpu].data1,
+                 err_data_buffer[cpu].data2,
+                 err_data_buffer[cpu].data3,
+                 cpu);
+#endif
+        ret=sscanf(buf, "%lx, %lx, %lx",
+                        &err_data_buffer[cpu].data1,
+                        &err_data_buffer[cpu].data2,
+                        &err_data_buffer[cpu].data3);
+        if (ret!=ERR_DATA_BUFFER_SIZE)
+                return -EINVAL;
+
+        return size;
+}
+
+show(status)
+show(capabilities)
+show(resources)
+
+define_one_rw(call_start);
+define_one_rw(err_type_info);
+define_one_rw(err_struct_info);
+define_one_rw(err_data_buffer);
+define_one_rw(virtual_to_phys);
+define_one_ro(status);
+define_one_ro(capabilities);
+define_one_ro(resources);
+
+static struct attribute *default_attrs[] = {
+        &attr_call_start.attr,
+        &attr_virtual_to_phys.attr,
+        &attr_err_type_info.attr,
+        &attr_err_struct_info.attr,
+        &attr_err_data_buffer.attr,
+        &attr_status.attr,
+        &attr_capabilities.attr,
+        &attr_resources.attr,
+        NULL
+};
+
+static struct attribute_group err_inject_attr_group = {
+        .attrs = default_attrs,
+        .name = "err_inject"
+};
+/* Add/Remove err_inject interface for CPU device */
+static int __cpuinit err_inject_add_dev(struct sys_device * sys_dev)
+{
+        return sysfs_create_group(&sys_dev->kobj, &err_inject_attr_group);
+}
+
+static int __cpuinit err_inject_remove_dev(struct sys_device * sys_dev)
+{
+        sysfs_remove_group(&sys_dev->kobj, &err_inject_attr_group);
+        return 0;
+}
+static int __cpuinit err_inject_cpu_callback(struct notifier_block *nfb,
+                unsigned long action, void *hcpu)
+{
+        unsigned int cpu = (unsigned long)hcpu;
+        struct sys_device *sys_dev;
+
+        sys_dev = get_cpu_sysdev(cpu);
+        switch (action) {
+        case CPU_ONLINE:
+                err_inject_add_dev(sys_dev);
+                break;
+        case CPU_DEAD:
+                err_inject_remove_dev(sys_dev);
+                break;
+        }
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block __cpuinitdata err_inject_cpu_notifier =
+{
+        .notifier_call = err_inject_cpu_callback,
+};
+
+static int __init
+err_inject_init(void)
+{
+        int i;
+
+#ifdef ERR_INJ_DEBUG
+        printk(KERN_INFO "Enter error injection driver.\n");
+#endif
+        for_each_online_cpu(i) {
+                err_inject_cpu_callback(&err_inject_cpu_notifier, CPU_ONLINE,
+                                (void *)(long)i);
+        }
+
+        register_hotcpu_notifier(&err_inject_cpu_notifier);
+
+        return 0;
+}
+
+static void __exit
+err_inject_exit(void)
+{
+        int i;
+        struct sys_device *sys_dev;
+
+#ifdef ERR_INJ_DEBUG
+        printk(KERN_INFO "Exit error injection driver.\n");
+#endif
+        for_each_online_cpu(i) {
+                sys_dev = get_cpu_sysdev(i);
+                sysfs_remove_group(&sys_dev->kobj, &err_inject_attr_group);
+        }
+        unregister_hotcpu_notifier(&err_inject_cpu_notifier);
+}
+
+module_init(err_inject_init);
+module_exit(err_inject_exit);
+
+MODULE_AUTHOR("Fenghua Yu <fenghua.yu@intel.com>");
+MODULE_DESCRIPTION("MC error injection kenrel sysfs interface");
+MODULE_LICENSE("GPL");
diff --git a/arch/ia64/kernel/ivt.S b/arch/ia64/kernel/ivt.S
index 6b7fcbd3f6f1..34f44d8be00d 100644
--- a/arch/ia64/kernel/ivt.S
+++ b/arch/ia64/kernel/ivt.S
@@ -374,6 +374,7 @@ ENTRY(alt_dtlb_miss)
         movl r19=(((1 << IA64_MAX_PHYS_BITS) - 1) & ~0xfff)
         mov r21=cr.ipsr
         mov r31=pr
+        mov r24=PERCPU_ADDR
         ;;
 #ifdef CONFIG_DISABLE_VHPT
         shr.u r22=r16,61                        // get the region number into r21
@@ -386,22 +387,30 @@ ENTRY(alt_dtlb_miss)
 (p8)    mov r29=b0                              // save b0
 (p8)    br.cond.dptk dtlb_fault
 #endif
+        cmp.ge p10,p11=r16,r24                  // access to per_cpu_data?
+        tbit.z p12,p0=r16,61                    // access to region 6?
+        mov r25=PERCPU_PAGE_SHIFT << 2
+        mov r26=PERCPU_PAGE_SIZE
+        nop.m 0
+        nop.b 0
+        ;;
+(p10)   mov r19=IA64_KR(PER_CPU_DATA)
+(p11)   and r19=r19,r16                         // clear non-ppn fields
         extr.u r23=r21,IA64_PSR_CPL0_BIT,2      // extract psr.cpl
         and r22=IA64_ISR_CODE_MASK,r20          // get the isr.code field
         tbit.nz p6,p7=r20,IA64_ISR_SP_BIT       // is speculation bit on?
-        shr.u r18=r16,57                        // move address bit 61 to bit 4
-        and r19=r19,r16                         // clear ed, reserved bits, and PTE control bits
         tbit.nz p9,p0=r20,IA64_ISR_NA_BIT       // is non-access bit on?
         ;;
-        andcm r18=0x10,r18      // bit 4=~address-bit(61)
+(p10)   sub r19=r19,r26
+(p10)   mov cr.itir=r25
         cmp.ne p8,p0=r0,r23
 (p9)    cmp.eq.or.andcm p6,p7=IA64_ISR_CODE_LFETCH,r22  // check isr.code field
+(p12)   dep r17=-1,r17,4,1                      // set ma=UC for region 6 addr
 (p8)    br.cond.spnt page_fault
 
         dep r21=-1,r21,IA64_PSR_ED_BIT,1
-        or r19=r19,r17          // insert PTE control bits into r19
         ;;
-        or r19=r19,r18          // set bit 4 (uncached) if the access was to region 6
+        or r19=r19,r17          // insert PTE control bits into r19
 (p6)    mov cr.ipsr=r21
         ;;
 (p7)    itc.d r19               // insert the TLB entry
diff --git a/arch/ia64/kernel/mca_asm.S b/arch/ia64/kernel/mca_asm.S
index c6b607c00dee..8c9c26aa6ae0 100644
--- a/arch/ia64/kernel/mca_asm.S
+++ b/arch/ia64/kernel/mca_asm.S
@@ -101,14 +101,6 @@ ia64_do_tlb_purge:
         ;;
         srlz.d
         ;;
-        // 2. Purge DTR for PERCPU data.
-        movl r16=PERCPU_ADDR
-        mov r18=PERCPU_PAGE_SHIFT<<2
-        ;;
-        ptr.d r16,r18
-        ;;
-        srlz.d
-        ;;
         // 3. Purge ITR for PAL code.
         GET_THIS_PADDR(r2, ia64_mca_pal_base)
         ;;
@@ -196,22 +188,6 @@ ia64_reload_tr:
         srlz.i
         srlz.d
         ;;
-        // 2. Reload DTR register for PERCPU data.
-        GET_THIS_PADDR(r2, ia64_mca_per_cpu_pte)
-        ;;
-        movl r16=PERCPU_ADDR            // vaddr
-        movl r18=PERCPU_PAGE_SHIFT<<2
-        ;;
-        mov cr.itir=r18
-        mov cr.ifa=r16
-        ;;
-        ld8 r18=[r2]                    // load per-CPU PTE
-        mov r16=IA64_TR_PERCPU_DATA;
-        ;;
-        itr.d dtr[r16]=r18
-        ;;
-        srlz.d
-        ;;
         // 3. Reload ITR for PAL code.
         GET_THIS_PADDR(r2, ia64_mca_pal_pte)
         ;;
diff --git a/arch/ia64/kernel/patch.c b/arch/ia64/kernel/patch.c
index bc11bb096f58..e796e29f8e15 100644
--- a/arch/ia64/kernel/patch.c
+++ b/arch/ia64/kernel/patch.c
@@ -195,3 +195,23 @@ ia64_patch_gate (void)
         ia64_patch_vtop(START(vtop), END(vtop));
         ia64_patch_mckinley_e9(START(mckinley_e9), END(mckinley_e9));
 }
+
+void ia64_patch_phys_stack_reg(unsigned long val)
+{
+        s32 * offp = (s32 *) __start___phys_stack_reg_patchlist;
+        s32 * end = (s32 *) __end___phys_stack_reg_patchlist;
+        u64 ip, mask, imm;
+
+        /* see instruction format A4: adds r1 = imm13, r3 */
+        mask = (0x3fUL << 27) | (0x7f << 13);
+        imm = (((val >> 7) & 0x3f) << 27) | (val & 0x7f) << 13;
+
+        while (offp < end) {
+                ip = (u64) offp + *offp;
+                ia64_patch(ip, mask, imm);
+                ia64_fc(ip);
+                ++offp;
+        }
+        ia64_sync_i();
+        ia64_srlz_i();
+}
diff --git a/arch/ia64/kernel/setup.c b/arch/ia64/kernel/setup.c
index dc7dd7648ec5..6e19da122ae3 100644
--- a/arch/ia64/kernel/setup.c
+++ b/arch/ia64/kernel/setup.c
@@ -75,7 +75,6 @@ extern void ia64_setup_printk_clock(void);
 
 DEFINE_PER_CPU(struct cpuinfo_ia64, cpu_info);
 DEFINE_PER_CPU(unsigned long, local_per_cpu_offset);
-DEFINE_PER_CPU(unsigned long, ia64_phys_stacked_size_p8);
 unsigned long ia64_cycles_per_usec;
 struct ia64_boot_param *ia64_boot_param;
 struct screen_info screen_info;
@@ -869,6 +868,7 @@ void __cpuinit
 cpu_init (void)
 {
         extern void __cpuinit ia64_mmu_init (void *);
+        static unsigned long max_num_phys_stacked = IA64_NUM_PHYS_STACK_REG;
         unsigned long num_phys_stacked;
         pal_vm_info_2_u_t vmi;
         unsigned int max_ctx;
@@ -982,7 +982,10 @@ cpu_init (void)
                 num_phys_stacked = 96;
         }
         /* size of physical stacked register partition plus 8 bytes: */
-        __get_cpu_var(ia64_phys_stacked_size_p8) = num_phys_stacked*8 + 8;
+        if (num_phys_stacked > max_num_phys_stacked) {
+                ia64_patch_phys_stack_reg(num_phys_stacked*8 + 8);
+                max_num_phys_stacked = num_phys_stacked;
+        }
         platform_cpu_init();
         pm_idle = default_idle;
 }
diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
index 25dd55e4db24..692382642118 100644
--- a/arch/ia64/kernel/vmlinux.lds.S
+++ b/arch/ia64/kernel/vmlinux.lds.S
@@ -78,6 +78,13 @@ SECTIONS
           __stop___mca_table = .;
         }
 
+  .data.patch.phys_stack_reg : AT(ADDR(.data.patch.phys_stack_reg) - LOAD_OFFSET)
+        {
+          __start___phys_stack_reg_patchlist = .;
+          *(.data.patch.phys_stack_reg)
+          __end___phys_stack_reg_patchlist = .;
+        }
+
   /* Global data */
   _data = .;