The problem occurs [1] when a kernel-mode task returns from a system
call with a pending signal.

A real-life scenario is a child of 'khelper' returning from a failed
kernel_execve() in ____call_usermodehelper() [ kernel/kmod.c ].
kernel_execve() fails due to a pending SIGKILL, which is the result of
"kill -9 -1" (at least, busybox's init does it upon reboot).

The loop is as follows:

* syscall_exit_work:
 - work_pending:            // start_of_the_loop
 - work_notifysig:
   - do_notify_resume()
     - do_signal()
       - if (!user_mode(regs)) return;
 - resume_userspace         // TIF_SIGPENDING is still set
 - work_pending             // so we call work_pending => goto
                            // start_of_the_loop

More information can be found in another LKML thread:
http://www.serverphorums.com/read.php?12,457826

[1] The problem was also reproduced on !CONFIG_VM86 x86, and the
following fix was accepted.

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=29a2e2836ff9ea65a603c89df217f4198973a74fSigned-off-by: NDmitry Adamushko <dmitry.adamushko@gmail.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/3571/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Broken since e05ea74fc56f347f872ef9946d27c53e8bf20864 (lmo) rsp.
cea7e2df (kernel.org) [MIPS: Sort out CPU
type to name translation.]  These CPUs are no longer very popular to say
the least ...
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
Reported-by: NMurphy McCauley <murphy.mccauley@gmail.com>

This needs to use the compat entry point or it's going to fail on big
endian systems.

Noticed by Al Viro.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

By using the native syscall entry point the kernel was also expecting
64-bit iovec structures.

This is broken since ddd9e91b [preadv/
pwritev: MIPS: Add preadv(2) and pwritev(2) syscalls.] which originally
added these two syscalls.  I walked through piles of code, including
libc and couldn't find anything that would have worked around the issue
so this change the API to what it should always have been.

Noticed and patch suggested by Al Viro.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Problem:

1) Huge page mapping of anonymous memory is initially invalid.  Will be
   faulted in by copy-on-write mechanism.

2) Userspace attempts store at the end of the huge mapping.

3) TLB Refill exception handler fill TLB with a normal (4K sized)
   invalid page at the end of the huge mapping virtual address range.

4) Userspace restarted, and re-attempts the store at the end of the
   huge mapping.

5) Page from #3 is invalid, we get a fault and go to the hugepage
   fault handler.  This tries to map a huge page and calls
   huge_ptep_set_access_flags() to install the mapping.

6) We just call the generic ptep_set_access_flags() to set up the page
   tables, but the flush there assumes a normal (4K sized) page and
   only tries to flush the first part of the huge page virtual address
   out of the TLB, since the existing entry from step #3 doesn't
   conflict, nothing is flushed.

7) We attempt to load the mapping into the TLB, but because it
   conflicts with the entry from step #3, we get a Machine Check
   exception.

The fix: Flush the entire rage covered by the huge page in
huge_ptep_set_access_flags(), and remove the optimization in
local_flush_tlb_range() so that the flush actually does the correct
thing.
Signed-off-by: NDavid Daney <david.daney@cavium.com>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Cc: Hillf Danton <dhillf@gmail.com>
Patchwork: https://patchwork.linux-mips.org/patch/4661/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
(cherry picked from commit dd617f258cc39d36be26afee9912624a2d23112c)

All architectures that use cmd_dtc do so in almost the same way. Create
a central build rule to avoid duplication. The one difference is that
most current uses of dtc build $(obj)/%.dtb from $(src)/dts/%.dts rather
than building the .dtb in the same directory as the .dts file. This
difference will be eliminated arch-by-arch in future patches.

MIPS is the exception here; it already uses the exact same rule as the
new common rule, so the duplicate is removed in this patch to avoid any
conflict. arch/mips changes courtesy of Ralf Baechle.

Update Documentation/kbuild to remove the explicit call to cmd_dtc from
the example, now that the rule exists in a centralized location.

Cc: Arnd Bergmann <arnd@arndb.de>
Cc: linux-arm-kernel@lists.infradead.org
Cc: Olof Johansson <olof@lixom.net>
Cc: Russell King <linux@arm.linux.org.uk>
Acked-by: NCatalin Marinas <catalin.marinas@arm.com>
Cc: Jonas Bonn <jonas@southpole.se>
Cc: linux@lists.openrisc.net
Cc: Aurelien Jacquiot <a-jacquiot@ti.com>
Cc: linux-c6x-dev@linux-c6x.org
Cc: Mark Salter <msalter@redhat.com>
Cc: Michal Simek <monstr@monstr.eu>
Cc: microblaze-uclinux@itee.uq.edu.au
Cc: Chris Zankel <chris@zankel.net>
Cc: linux-xtensa@linux-xtensa.org
Cc: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
Signed-off-by: NStephen Warren <swarren@nvidia.com>
Signed-off-by: NRob Herring <rob.herring@calxeda.com>

A recent patch changed some irq routines from inlines to functions.
These routines are called by the tracer code. Now that they're functions,
if they are compiled for function tracing they will call the tracer
and crash the system due to infinite recursion. The fix disables
tracing in these functions by using "notrace" in the function
definition.
Signed-off-by: NAl Cooper <alcooperx@gmail.com>
Reviewed-by: NDavid Daney <david.daney@cavium.com>
Pathchwork: https://patchwork.linux-mips.org/patch/4564/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Without this, we may end up with something like this in /proc/iomem:

01100000-014fffff : System RAM
  01100000-013bf48f : Kernel code
  013bf490-0149e01f : Kernel data
01500000-0c0fffff : System RAM

but the two System RAM ranges should be one single range.  This particular
case will result in kexec failure on Octeon systems if the kernel being
loaded by kexec is bigger than the already running kernel.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Using a cross-compiler to fix another issue, the following build error
occurred for mips defconfig:

  arch/mips/fw/arc/misc.c: In function 'ArcHalt':
  arch/mips/fw/arc/misc.c:25:2: error: implicit declaration of function 'local_irq_disable'

Fix it up by including irqflags.h.
Signed-off-by: NDavid Rientjes <rientjes@google.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The CBUS UART's interrupt number was wrong conflicting with the interrupt
being tied to the Intel PIIX4.  Since the PIIX4's interrupt is registered
before the CBUS UART which is not being used on most systems this would
not be noticed.

Attempts to open the ttyS2 CBUS UART would result in:

genirq: Flags mismatch irq 18. 00000000 (serial) vs. 00010000 (XT-PIC cascade)
serial_link_irq_chain: request failed: -16 for irq: 18

Qemu was written to match the kernel so will need to be fixed also.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

For non MIPSr2 processors, such as the BMIPS 5000, calls to
arch_local_irq_disable() and others may be preempted, and in doing
so a stale value may be restored to c0_status.  This fix disables
preemption for such processors prior to the call and enables it
after the call.

Those functions that needed this fix have been "outlined" to
mips-atomic.c, as they are no longer good candidates for inlining.

This bug was observed in a BMIPS 5000, occuring once every few hours
in a continuous reboot test.  It was traced to the write_lock_irq()
function which was being invoked in release_task() in exit.c.
By placing a number of "nops" inbetween the mfc0/mtc0 pair in
arch_local_irq_disable(), which is called by write_lock_irq(), we
were able to greatly increase the occurance of this bug.  Similarly,
the application of this commit silenced the bug.
Signed-off-by: NJim Quinlan <jim2101024@gmail.com>
Cc: linux-mips@linux-mips.org
Cc: David Daney <ddaney.cavm@gmail.com>
Cc: Kevin Cernekee cernekee@gmail.com
Cc: Jim Quinlan <jim2101024@gmail.com>
Patchwork: https://patchwork.linux-mips.org/patch/4321/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

The "else clause" of most functions in bitops.h invoked
raw_local_irq_{save,restore}() and in doing so had a dependency on
irqflags.h.  This fix moves said code to bitops.c, removing the
dependency.
Signed-off-by: NJim Quinlan <jim2101024@gmail.com>
Cc: linux-mips@linux-mips.org
Cc: David Daney <ddaney.cavm@gmail.com>
Cc: Kevin Cernekee cernekee@gmail.com
Cc: Jim Quinlan <jim2101024@gmail.com>
Patchwork: https://patchwork.linux-mips.org/patch/4320/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

[ralf@linux-mips.org: No functional change but it's consistent with how
use types elsewhere in the code.]
Signed-off-by: NJim Quinlan <jim2101024@gmail.com>
Cc: linux-mips@linux-mips.org
Cc: David Daney <ddaney.cavm@gmail.com>
Cc: Kevin Cernekee cernekee@gmail.com
Cc: Jim Quinlan <jim2101024@gmail.com>
Patchwork: https://patchwork.linux-mips.org/patch/4319/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

So far is_compat_task() was testing for 32-bit registers if O32 support
was enabled and if O32 support was disabled but N32 enabled it was testing
for 32-bit address space.  So if both O32 and N32 were enabled a N32
task was not considered a compat task, whops.

This still leaves potential cases where O32 and N32 need different treatment
unsolved.  But that's another commit.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

The CPUNum Field in EBase register is 10bit wide, so after 1 bit right
shift, the mask value should be 0x1ff.
Signed-off-by: Njerin jacob <jerinjacobk@gmail.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/4420/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

As suggested by Geert Uytterhoeven <geert@linux-m68k.org>.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
Cc: Antony Pavlov <antonynpavlov@gmail.com>
Cc: linux-mips@linux-mips.org
Cc: Lars-Peter Clausen <lars@metafoo.de>

Signed-off-by: NAntony Pavlov <antonynpavlov@gmail.com>
Cc: linux-mips@linux-mips.org
Cc: Lars-Peter Clausen <lars@metafoo.de>
Patchwork: https://patchwork.linux-mips.org/patch/4424/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Place comments in:

	arch/mips/include/asm/Kbuild
	arch/tile/include/arch/Kbuild

to make them non-empty so that the patch program doesn't remove them when it
reduces them to nothing.

Possibly they should be just deleted, but it's possible that they'll acquire
generic-y or genhdr-y lines in future, so I'm keeping them around for the
moment.

Note that MIPS will compile happily if the file is deleted instead.  I haven't
tested TILE, but I suspect it will be the same there.
Signed-off-by: NDavid Howells <dhowells@redhat.com>
cc: Ralf Baechle <ralf@linux-mips.org>
cc: Chris Metcalf <cmetcalf@tilera.com>

On some CPU the write to pagemask might complete before the TLB write
instruction reads from the pagemask register.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Or bad things might happen if the last TLB entry isn't a basic size page.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

R5000 and the Nevada CPUs (RM5230, RM5231, RM5260, RM5261, RM5270 and
RM5271) are basically the same CPU core and all are documented to require
two instructions separating a write to c0_pagemask, c0_entryhi, c0_entrylo0,
c0_entrylo1 or c0_index.

So far we were only providing on cycle before / after a TLBR/TLBWI
for R5000 but 3 cycles before and 1 cycles after for the Nevadas.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

The microassembler used in tlbex.c does not notice if a label is redefined
resulting in relocations against such labels silently missrelocated.
The issues exists since commit add6eb04776db4189ea89f596cbcde31b899be9d
[Synthesize TLB exception handlers at runtime.] in 2.6.10 and went unnoticed
for so long because the relocations for the affected branches got computed
to do something *almost* sensible.

The issue affects R4000, R4400, QED/IDT RM5230, RM5231, RM5260, RM5261,
RM5270 and RM5271 processors.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

At some recent point arch/mips/include/asm/delay.h has started being
included into csrc-octeon.c where the __?delay() functions are defined.
This causes a compile failure due to conflicting declarations and
definitions of the functions.

It turns out that the generic definitions in arch/mips/lib/delay.c also
conflict.

Proposed fix: Declare the functions to take unsigned long parameters
just like asm-generic (and x86) does.  Update __delay to agree
(__ndelay and __udelay need no change).

Bonus: Get rid of 'inline' from __delay() definition, as it is globally
visible, and the compiler should be making this decision itself (it does
in fact inline the function without being told to).
Signed-off-by: NDavid Daney <david.daney@cavium.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/4354/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

getname() is intended to copy pathname strings from userspace into a
kernel buffer. The result is just a string in kernel space. It would
however be quite helpful to be able to attach some ancillary info to
the string.

For instance, we could attach some audit-related info to reduce the
amount of audit-related processing needed. When auditing is enabled,
we could also call getname() on the string more than once and not
need to recopy it from userspace.

This patchset converts the getname()/putname() interfaces to return
a struct instead of a string. For now, the struct just tracks the
string in kernel space and the original userland pointer for it.

Later, we'll add other information to the struct as it becomes
convenient.
Signed-off-by: NJeff Layton <jlayton@redhat.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

This fault was detected using the kgdb test suite on boot and it
crashes recursively due to the fact that CONFIG_KPROBES on mips adds
an extra die notifier in the page fault handler.  The crash signature
looks like this:

kgdbts:RUN bad memory access test
KGDB: re-enter exception: ALL breakpoints killed
Call Trace:
[<807b7548>] dump_stack+0x20/0x54
[<807b7548>] dump_stack+0x20/0x54

The fix for now is to have kgdb return immediately if the fault type
is DIE_PAGE_FAULT and allow the kprobe code to decide what is supposed
to happen.

Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: NJason Wessel <jason.wessel@windriver.com>

The new SCCNXP driver supports the SC2681 chips used in RM400 machines.
We now use the new driver instead of the old SC26xx driver.
Signed-off-by: NThomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/4417/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

  LD      arch/mips/pci/built-in.o
WARNING: arch/mips/pci/built-in.o(.devinit.text+0x2a0): Section mismatch in reference from the function malta_piix_func0_fixup() to the variable .init.data:pci_irq
The function __devinit malta_piix_func0_fixup() references
a variable __initdata pci_irq.
If pci_irq is only used by malta_piix_func0_fixup then
annotate pci_irq with a matching annotation.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Originally added in 05b541489c48e7fbeec19a92acf8683230750d0a [Merge with
Linux 2.5.5.] over 10 years ago but never been used.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

The PB1100/1500 are similar to their DB-cousins but with a few
more devices on the bus.

This patch adds PB1100/1500 support to the existing DB1100/1500
code.
Signed-off-by: NManuel Lauss <manuel.lauss@gmail.com>
Cc: lnux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/4338/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

The PB1550 is more or less a DB1550 without the PCI IDE controller,
a more complicated (read: configurable) Flash setup and some other
minor changes.  Like the DB1550 it can be automatically detected by
reading the CPLD ID register bits.

This patch adds PB1550 detection and setup to the DB1550 code.
Signed-off-by: NManuel Lauss <manuel.lauss@gmail.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/4337/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Combine support for the DB1200/PB1200, DB1300 and DB1550 boards into
a single kernel image.

defconfig-generated image verified on DB1200, DB1300 and DB1550.
Signed-off-by: NManuel Lauss <manuel.lauss@gmail.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/4335/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

We don't have to do a separate shift to eliminate the software bits,
just rotate them into the fill and they will be ignored.
Signed-off-by: NDavid Daney <ddaney@caviumnetworks.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/4294/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

The number of %s was just getting ridiculous.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Most supported systems currently hardwire cpu_has_dsp to 0, so we also
can disable support for cpu_has_dsp2 resulting in a slightly smaller
kernel.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

[ralf@linux-mips.org: This patch really only detects the ASE and passes its
existence on to userland via /proc/cpuinfo.  The DSP ASE Rev 2. adds new
resources but no resources that would need management by the kernel.]
Signed-off-by: NSteven J. Hill <sjhill@mips.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/4165/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>