lkml.org 
[lkml]   [2020]   [Feb]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 205/237] powerpc/tm: Fix endianness flip on trap
    Date
    From: Gustavo Romero <gromero@linux.vnet.ibm.com>

    [ Upstream commit 1c200e63d055ec0125e44a5e386b9b78aada7eb3 ]

    Currently it's possible that a thread on PPC64 LE has its endianness
    flipped inadvertently to Big-Endian resulting in a crash once the process
    is back from the signal handler.

    If giveup_all() is called when regs->msr has the bits MSR.FP and MSR.VEC
    disabled (and hence MSR.VSX disabled too) it returns without calling
    check_if_tm_restore_required() which copies regs->msr to ckpt_regs->msr if
    the process caught a signal whilst in transactional mode. Then once in
    setup_tm_sigcontexts() MSR from ckpt_regs.msr is used, but since
    check_if_tm_restore_required() was not called previuosly, gp_regs[PT_MSR]
    gets a copy of invalid MSR bits as MSR in ckpt_regs was not updated from
    regs->msr and so is zeroed. Later when leaving the signal handler once in
    sys_rt_sigreturn() the TS bits of gp_regs[PT_MSR] are checked to determine
    if restore_tm_sigcontexts() must be called to pull in the correct MSR state
    into the user context. Because TS bits are zeroed
    restore_tm_sigcontexts() is never called and MSR restored from the user
    context on returning from the signal handler has the MSR.LE (the endianness
    bit) forced to zero (Big-Endian). That leads, for instance, to 'nop' being
    treated as an illegal instruction in the following sequence:

    tbegin.
    beq 1f
    trap
    tend.
    1: nop

    on PPC64 LE machines and the process dies just after returning from the
    signal handler.

    PPC64 BE is also affected but in a subtle way since forcing Big-Endian on
    a BE machine does not change the endianness.

    This commit fixes the issue described above by ensuring that once in
    setup_tm_sigcontexts() the MSR used is from regs->msr instead of from
    ckpt_regs->msr and by ensuring that we pull in only the MSR.FP, MSR.VEC,
    and MSR.VSX bits from ckpt_regs->msr.

    The fix was tested both on LE and BE machines and no regression regarding
    the powerpc/tm selftests was observed.

    Signed-off-by: Gustavo Romero <gromero@linux.vnet.ibm.com>
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    arch/powerpc/kernel/signal_64.c | 8 +++++++-
    1 file changed, 7 insertions(+), 1 deletion(-)

    diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
    index 2d52fed72e216..b203c16d46d4e 100644
    --- a/arch/powerpc/kernel/signal_64.c
    +++ b/arch/powerpc/kernel/signal_64.c
    @@ -207,7 +207,7 @@ static long setup_tm_sigcontexts(struct sigcontext __user *sc,
    elf_vrreg_t __user *tm_v_regs = sigcontext_vmx_regs(tm_sc);
    #endif
    struct pt_regs *regs = tsk->thread.regs;
    - unsigned long msr = tsk->thread.ckpt_regs.msr;
    + unsigned long msr = tsk->thread.regs->msr;
    long err = 0;

    BUG_ON(tsk != current);
    @@ -216,6 +216,12 @@ static long setup_tm_sigcontexts(struct sigcontext __user *sc,

    WARN_ON(tm_suspend_disabled);

    + /* Restore checkpointed FP, VEC, and VSX bits from ckpt_regs as
    + * it contains the correct FP, VEC, VSX state after we treclaimed
    + * the transaction and giveup_all() was called on reclaiming.
    + */
    + msr |= tsk->thread.ckpt_regs.msr & (MSR_FP | MSR_VEC | MSR_VSX);
    +
    /* Remove TM bits from thread's MSR. The MSR in the sigcontext
    * just indicates to userland that we were doing a transaction, but we
    * don't want to return in transactional state. This also ensures
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-02-27 15:01    [W:4.028 / U:0.288 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site