mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-23 09:09:36 +07:00
432c6bacbd
In some cases the kernel needs to execute an instruction from the delay
slot of an emulated branch instruction. These cases include:
- Emulated floating point branch instructions (bc1[ft]l?) for systems
which don't include an FPU, or upon which the kernel is run with the
"nofpu" parameter.
- MIPSr6 systems running binaries targeting older revisions of the
architecture, which may include branch instructions whose encodings
are no longer valid in MIPSr6.
Executing instructions from such delay slots is done by writing the
instruction to memory followed by a trap, as part of an "emuframe", and
executing it. This avoids the requirement of an emulator for the entire
MIPS instruction set. Prior to this patch such emuframes are written to
the user stack and executed from there.
This patch moves FP branch delay emuframes off of the user stack and
into a per-mm page. Allocating a page per-mm leaves userland with access
to only what it had access to previously, and compared to other
solutions is relatively simple.
When a thread requires a delay slot emulation, it is allocated a frame.
A thread may only have one frame allocated at any one time, since it may
only ever be executing one instruction at any one time. In order to
ensure that we can free up allocated frame later, its index is recorded
in struct thread_struct. In the typical case, after executing the delay
slot instruction we'll execute a break instruction with the BRK_MEMU
code. This traps back to the kernel & leads to a call to do_dsemulret
which frees the allocated frame & moves the user PC back to the
instruction that would have executed following the emulated branch.
In some cases the delay slot instruction may be invalid, such as a
branch, or may trigger an exception. In these cases the BRK_MEMU break
instruction will not be hit. In order to ensure that frames are freed
this patch introduces dsemul_thread_cleanup() and calls it to free any
allocated frame upon thread exit. If the instruction generated an
exception & leads to a signal being delivered to the thread, or indeed
if a signal simply happens to be delivered to the thread whilst it is
executing from the struct emuframe, then we need to take care to exit
the frame appropriately. This is done by either rolling back the user PC
to the branch or advancing it to the continuation PC prior to signal
delivery, using dsemul_thread_rollback(). If this were not done then a
sigreturn would return to the struct emuframe, and if that frame had
meanwhile been used in response to an emulated branch instruction within
the signal handler then we would execute the wrong user code.
Whilst a user could theoretically place something like a compact branch
to self in a delay slot and cause their thread to become stuck in an
infinite loop with the frame never being deallocated, this would:
- Only affect the users single process.
- Be architecturally invalid since there would be a branch in the
delay slot, which is forbidden.
- Be extremely unlikely to happen by mistake, and provide a program
with no more ability to harm the system than a simple infinite loop
would.
If a thread requires a delay slot emulation & no frame is available to
it (ie. the process has enough other threads that all frames are
currently in use) then the thread joins a waitqueue. It will sleep until
a frame is freed by another thread in the process.
Since we now know whether a thread has an allocated frame due to our
tracking of its index, the cookie field of struct emuframe is removed as
we can be more certain whether we have a valid frame. Since a thread may
only ever have a single frame at any given time, the epc field of struct
emuframe is also removed & the PC to continue from is instead stored in
struct thread_struct. Together these changes simplify & shrink struct
emuframe somewhat, allowing twice as many frames to fit into the page
allocated for them.
The primary benefit of this patch is that we are now free to mark the
user stack non-executable where that is possible.
Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Cc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>
Cc: Maciej Rozycki <maciej.rozycki@imgtec.com>
Cc: Faraz Shahbazker <faraz.shahbazker@imgtec.com>
Cc: Raghu Gandham <raghu.gandham@imgtec.com>
Cc: Matthew Fortune <matthew.fortune@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/13764/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
93 lines
3.2 KiB
C
93 lines
3.2 KiB
C
/*
|
|
* Copyright (C) 2016 Imagination Technologies
|
|
* Author: Paul Burton <paul.burton@imgtec.com>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License as published by the
|
|
* Free Software Foundation; either version 2 of the License, or (at your
|
|
* option) any later version.
|
|
*/
|
|
|
|
#ifndef __MIPS_ASM_DSEMUL_H__
|
|
#define __MIPS_ASM_DSEMUL_H__
|
|
|
|
#include <asm/break.h>
|
|
#include <asm/inst.h>
|
|
|
|
/* Break instruction with special math emu break code set */
|
|
#define BREAK_MATH(micromips) (((micromips) ? 0x7 : 0xd) | (BRK_MEMU << 16))
|
|
|
|
/* When used as a frame index, indicates the lack of a frame */
|
|
#define BD_EMUFRAME_NONE ((int)BIT(31))
|
|
|
|
struct mm_struct;
|
|
struct pt_regs;
|
|
struct task_struct;
|
|
|
|
/**
|
|
* mips_dsemul() - 'Emulate' an instruction from a branch delay slot
|
|
* @regs: User thread register context.
|
|
* @ir: The instruction to be 'emulated'.
|
|
* @branch_pc: The PC of the branch instruction.
|
|
* @cont_pc: The PC to continue at following 'emulation'.
|
|
*
|
|
* Emulate or execute an arbitrary MIPS instruction within the context of
|
|
* the current user thread. This is used primarily to handle instructions
|
|
* in the delay slots of emulated branch instructions, for example FP
|
|
* branch instructions on systems without an FPU.
|
|
*
|
|
* Return: Zero on success, negative if ir is a NOP, signal number on failure.
|
|
*/
|
|
extern int mips_dsemul(struct pt_regs *regs, mips_instruction ir,
|
|
unsigned long branch_pc, unsigned long cont_pc);
|
|
|
|
/**
|
|
* do_dsemulret() - Return from a delay slot 'emulation' frame
|
|
* @xcp: User thread register context.
|
|
*
|
|
* Call in response to the BRK_MEMU break instruction used to return to
|
|
* the kernel from branch delay slot 'emulation' frames following a call
|
|
* to mips_dsemul(). Restores the user thread PC to the value that was
|
|
* passed as the cpc parameter to mips_dsemul().
|
|
*
|
|
* Return: True if an emulation frame was returned from, else false.
|
|
*/
|
|
extern bool do_dsemulret(struct pt_regs *xcp);
|
|
|
|
/**
|
|
* dsemul_thread_cleanup() - Cleanup thread 'emulation' frame
|
|
* @tsk: The task structure associated with the thread
|
|
*
|
|
* If the thread @tsk has a branch delay slot 'emulation' frame
|
|
* allocated to it then free that frame.
|
|
*
|
|
* Return: True if a frame was freed, else false.
|
|
*/
|
|
extern bool dsemul_thread_cleanup(struct task_struct *tsk);
|
|
|
|
/**
|
|
* dsemul_thread_rollback() - Rollback from an 'emulation' frame
|
|
* @regs: User thread register context.
|
|
*
|
|
* If the current thread, whose register context is represented by @regs,
|
|
* is executing within a delay slot 'emulation' frame then exit that
|
|
* frame. The PC will be rolled back to the branch if the instruction
|
|
* that was being 'emulated' has not yet executed, or advanced to the
|
|
* continuation PC if it has.
|
|
*
|
|
* Return: True if a frame was exited, else false.
|
|
*/
|
|
extern bool dsemul_thread_rollback(struct pt_regs *regs);
|
|
|
|
/**
|
|
* dsemul_mm_cleanup() - Cleanup per-mm delay slot 'emulation' state
|
|
* @mm: The struct mm_struct to cleanup state for.
|
|
*
|
|
* Cleanup state for the given @mm, ensuring that any memory allocated
|
|
* for delay slot 'emulation' book-keeping is freed. This is to be called
|
|
* before @mm is freed in order to avoid memory leaks.
|
|
*/
|
|
extern void dsemul_mm_cleanup(struct mm_struct *mm);
|
|
|
|
#endif /* __MIPS_ASM_DSEMUL_H__ */
|