7 files changed, 81 insertions, 18 deletions

diff --git a/arch/ppc/Kconfig b/arch/ppc/Kconfig
index 6e6377a69d5b..54ce6da22644 100644
--- a/arch/ppc/Kconfig
+++ b/arch/ppc/Kconfig
@@ -1083,6 +1083,23 @@ source "drivers/zorro/Kconfig"
 
 source kernel/power/Kconfig
 
+config SECCOMP
+        bool "Enable seccomp to safely compute untrusted bytecode"
+        depends on PROC_FS
+        default y
+        help
+          This kernel feature is useful for number crunching applications
+          that may need to compute untrusted bytecode during their
+          execution. By using pipes or other transports made available to
+          the process as file descriptors supporting the read/write
+          syscalls, it's possible to isolate those applications in
+          their own address space using seccomp. Once seccomp is
+          enabled via /proc/<pid>/seccomp, it cannot be disabled
+          and the task is only allowed to execute a few safe syscalls
+          defined by each seccomp mode.
+
+          If unsure, say Y. Only embedded should say N here.
+
 endmenu
 
 config ISA_DMA_API
diff --git a/arch/ppc/kernel/cputable.c b/arch/ppc/kernel/cputable.c
index 8aa5e8c69009..d44b7dc5390a 100644
--- a/arch/ppc/kernel/cputable.c
+++ b/arch/ppc/kernel/cputable.c
@@ -838,6 +838,17 @@ struct cpu_spec	cpu_specs[] = {
                 .icache_bsize           = 32,
                 .dcache_bsize           = 32,
         },
+        {       /* 405EP */
+                .pvr_mask               = 0xffff0000,
+                .pvr_value              = 0x51210000,
+                .cpu_name               = "405EP",
+                .cpu_features           = CPU_FTR_SPLIT_ID_CACHE |
+                        CPU_FTR_USE_TB,
+                .cpu_user_features      = PPC_FEATURE_32 |
+                        PPC_FEATURE_HAS_MMU | PPC_FEATURE_HAS_4xxMAC,
+                .icache_bsize           = 32,
+                .dcache_bsize           = 32,
+        },
 
 #endif /* CONFIG_40x */
 #ifdef CONFIG_44x
diff --git a/arch/ppc/kernel/entry.S b/arch/ppc/kernel/entry.S
index 5f075dbc4ee7..661523707e8c 100644
--- a/arch/ppc/kernel/entry.S
+++ b/arch/ppc/kernel/entry.S
@@ -202,7 +202,7 @@ _GLOBAL(DoSyscall)
         rlwinm  r11,r11,0,~_TIFL_FORCE_NOERROR
         stw     r11,TI_LOCAL_FLAGS(r10)
         lwz     r11,TI_FLAGS(r10)
-        andi.   r11,r11,_TIF_SYSCALL_TRACE
+        andi.   r11,r11,_TIF_SYSCALL_T_OR_A
         bne-    syscall_dotrace
 syscall_dotrace_cont:
         cmplwi  0,r0,NR_syscalls
@@ -237,7 +237,7 @@ ret_from_syscall:
         SYNC
         MTMSRD(r10)
         lwz     r9,TI_FLAGS(r12)
-        andi.   r0,r9,(_TIF_SYSCALL_TRACE|_TIF_SIGPENDING|_TIF_NEED_RESCHED)
+        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SIGPENDING|_TIF_NEED_RESCHED)
         bne-    syscall_exit_work
 syscall_exit_cont:
 #if defined(CONFIG_4xx) || defined(CONFIG_BOOKE)
@@ -277,7 +277,8 @@ syscall_dotrace:
         SAVE_NVGPRS(r1)
         li      r0,0xc00
         stw     r0,TRAP(r1)
-        bl      do_syscall_trace
+        addi    r3,r1,STACK_FRAME_OVERHEAD
+        bl      do_syscall_trace_enter
         lwz     r0,GPR0(r1)     /* Restore original registers */
         lwz     r3,GPR3(r1)
         lwz     r4,GPR4(r1)
@@ -291,7 +292,7 @@ syscall_dotrace:
 syscall_exit_work:
         stw     r6,RESULT(r1)   /* Save result */
         stw     r3,GPR3(r1)     /* Update return value */
-        andi.   r0,r9,_TIF_SYSCALL_TRACE
+        andi.   r0,r9,_TIF_SYSCALL_T_OR_A
         beq     5f
         ori     r10,r10,MSR_EE
         SYNC
@@ -303,7 +304,8 @@ syscall_exit_work:
         li      r4,0xc00
         stw     r4,TRAP(r1)
 4:
-        bl      do_syscall_trace
+        addi    r3,r1,STACK_FRAME_OVERHEAD
+        bl      do_syscall_trace_leave
         REST_NVGPRS(r1)
 2:
         lwz     r3,GPR3(r1)
@@ -627,8 +629,8 @@ sigreturn_exit:
         subi    r1,r3,STACK_FRAME_OVERHEAD
         rlwinm  r12,r1,0,0,18   /* current_thread_info() */
         lwz     r9,TI_FLAGS(r12)
-        andi.   r0,r9,_TIF_SYSCALL_TRACE
-        bnel-   do_syscall_trace
+        andi.   r0,r9,_TIF_SYSCALL_T_OR_A
+        bnel-   do_syscall_trace_leave
         /* fall through */
 
         .globl  ret_from_except_full
diff --git a/arch/ppc/kernel/misc.S b/arch/ppc/kernel/misc.S
index e4f1615ec13f..7329ef177a18 100644
--- a/arch/ppc/kernel/misc.S
+++ b/arch/ppc/kernel/misc.S
@@ -619,7 +619,7 @@ _GLOBAL(flush_instruction_cache)
 _GLOBAL(flush_icache_range)
 BEGIN_FTR_SECTION
         blr                             /* for 601, do nothing */
-END_FTR_SECTION_IFSET(PPC_FEATURE_UNIFIED_CACHE)
+END_FTR_SECTION_IFCLR(CPU_FTR_SPLIT_ID_CACHE)
         li      r5,L1_CACHE_LINE_SIZE-1
         andc    r3,r3,r5
         subf    r4,r3,r4
@@ -736,7 +736,7 @@ _GLOBAL(flush_dcache_all)
 _GLOBAL(__flush_dcache_icache)
 BEGIN_FTR_SECTION
         blr                                     /* for 601, do nothing */
-END_FTR_SECTION_IFSET(PPC_FEATURE_UNIFIED_CACHE)
+END_FTR_SECTION_IFCLR(CPU_FTR_SPLIT_ID_CACHE)
         rlwinm  r3,r3,0,0,19                    /* Get page base address */
         li      r4,4096/L1_CACHE_LINE_SIZE      /* Number of lines in a page */
         mtctr   r4
@@ -764,7 +764,7 @@ END_FTR_SECTION_IFSET(PPC_FEATURE_UNIFIED_CACHE)
 _GLOBAL(__flush_dcache_icache_phys)
 BEGIN_FTR_SECTION
         blr                                     /* for 601, do nothing */
-END_FTR_SECTION_IFSET(PPC_FEATURE_UNIFIED_CACHE)
+END_FTR_SECTION_IFCLR(CPU_FTR_SPLIT_ID_CACHE)
         mfmsr   r10
         rlwinm  r0,r10,0,28,26                  /* clear DR */
         mtmsr   r0
diff --git a/arch/ppc/kernel/ppc_ksyms.c b/arch/ppc/kernel/ppc_ksyms.c
index 2ccb58fe4fc3..d59ad07de8e7 100644
--- a/arch/ppc/kernel/ppc_ksyms.c
+++ b/arch/ppc/kernel/ppc_ksyms.c
@@ -55,7 +55,6 @@
 #define EXPORT_SYMTAB_STROPS
 
 extern void transfer_to_handler(void);
-extern void do_syscall_trace(void);
 extern void do_IRQ(struct pt_regs *regs);
 extern void MachineCheckException(struct pt_regs *regs);
 extern void AlignmentException(struct pt_regs *regs);
@@ -74,7 +73,6 @@ extern unsigned long mm_ptov (unsigned long paddr);
 EXPORT_SYMBOL(clear_pages);
 EXPORT_SYMBOL(clear_user_page);
 EXPORT_SYMBOL(do_signal);
-EXPORT_SYMBOL(do_syscall_trace);
 EXPORT_SYMBOL(transfer_to_handler);
 EXPORT_SYMBOL(do_IRQ);
 EXPORT_SYMBOL(MachineCheckException);
diff --git a/arch/ppc/kernel/ptrace.c b/arch/ppc/kernel/ptrace.c
index 59d59a8dc249..e7aee4108dea 100644
--- a/arch/ppc/kernel/ptrace.c
+++ b/arch/ppc/kernel/ptrace.c
@@ -27,6 +27,9 @@
 #include <linux/user.h>
 #include <linux/security.h>
 #include <linux/signal.h>
+#include <linux/seccomp.h>
+#include <linux/audit.h>
+#include <linux/module.h>
 
 #include <asm/uaccess.h>
 #include <asm/page.h>
@@ -455,11 +458,10 @@ out:
         return ret;
 }
 
-void do_syscall_trace(void)
+static void do_syscall_trace(void)
 {
-        if (!test_thread_flag(TIF_SYSCALL_TRACE)
-            || !(current->ptrace & PT_PTRACED))
-                return;
+        /* the 0x80 provides a way for the tracing parent to distinguish
+           between a syscall stop and SIGTRAP delivery */
         ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD)
                                  ? 0x80 : 0));
 
@@ -473,3 +475,33 @@ void do_syscall_trace(void)
                 current->exit_code = 0;
         }
 }
+
+void do_syscall_trace_enter(struct pt_regs *regs)
+{
+        if (test_thread_flag(TIF_SYSCALL_TRACE)
+            && (current->ptrace & PT_PTRACED))
+                do_syscall_trace();
+
+        if (unlikely(current->audit_context))
+                audit_syscall_entry(current, AUDIT_ARCH_PPC,
+                                    regs->gpr[0],
+                                    regs->gpr[3], regs->gpr[4],
+                                    regs->gpr[5], regs->gpr[6]);
+}
+
+void do_syscall_trace_leave(struct pt_regs *regs)
+{
+        secure_computing(regs->gpr[0]);
+
+        if (unlikely(current->audit_context))
+                audit_syscall_exit(current,
+                                   (regs->ccr&0x1000)?AUDITSC_FAILURE:AUDITSC_SUCCESS,
+                                   regs->result);
+
+        if ((test_thread_flag(TIF_SYSCALL_TRACE))
+            && (current->ptrace & PT_PTRACED))
+                do_syscall_trace();
+}
+
+EXPORT_SYMBOL(do_syscall_trace_enter);
+EXPORT_SYMBOL(do_syscall_trace_leave);
diff --git a/arch/ppc/platforms/pmac_cpufreq.c b/arch/ppc/platforms/pmac_cpufreq.c
index 937f46df711e..5fdd4f607a40 100644
--- a/arch/ppc/platforms/pmac_cpufreq.c
+++ b/arch/ppc/platforms/pmac_cpufreq.c
@@ -83,7 +83,7 @@ static u32 frequency_gpio;
 static u32 slew_done_gpio;
 static int no_schedule;
 static int has_cpu_l2lve;
-
+static int is_pmu_based;
 
 /* There are only two frequency states for each processor. Values
  * are in kHz for the time being.
@@ -463,7 +463,7 @@ static int __pmac pmac_cpufreq_suspend(struct cpufreq_policy *policy, u32 state)
          */
         no_schedule = 1;
         sleep_freq = cur_freq;
-        if (cur_freq == low_freq)
+        if (cur_freq == low_freq && !is_pmu_based)
                 do_set_cpu_speed(CPUFREQ_HIGH, 0);
         return 0;
 }
@@ -588,6 +588,7 @@ static int __pmac pmac_cpufreq_init_MacRISC3(struct device_node *cpunode)
                 return 1;
         hi_freq = (*value) / 1000;
         set_speed_proc = pmu_set_cpu_speed;
+        is_pmu_based = 1;
 
         return 0;
 }
@@ -692,6 +693,7 @@ static int __init pmac_cpufreq_setup(void)
                 hi_freq = cur_freq;
                 low_freq = 400000;
                 set_speed_proc = pmu_set_cpu_speed;
+                is_pmu_based = 1;
         }
         /* Else check for TiPb 400 & 500 */
         else if (machine_is_compatible("PowerBook3,2")) {
@@ -703,6 +705,7 @@ static int __init pmac_cpufreq_setup(void)
                 hi_freq = cur_freq;
                 low_freq = 300000;
                 set_speed_proc = pmu_set_cpu_speed;
+                is_pmu_based = 1;
         }
         /* Else check for 750FX */
         else if (PVR_VER(mfspr(SPRN_PVR)) == 0x7000)