Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4725c860 authored by Martin Schwidefsky's avatar Martin Schwidefsky
Browse files

s390: fix save and restore of the floating-point-control register 



The FPC_VALID_MASK has been used to check the validity of the value
to be loaded into the floating-point-control register. With the
introduction of the floating-point extension facility and the
decimal-floating-point additional bits have been defined which need
to be checked in a non straight forward way. So far these bits have
been ignored which can cause an incorrect results for decimal-
floating-point operations, e.g. an incorrect rounding mode to be
set after signal return.

The static check with the FPC_VALID_MASK is replaced with a trial
load of the floating-point-control value, see test_fp_ctl.

In addition an information leak with the padding word between the
floating-point-control word and the floating-point registers in
the s390_fp_regs is fixed.

Reported-by: default avatarHeiko Carstens <heiko.carstens@de.ibm.com>
Reviewed-by: default avatarHeiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
parent 01a7cfa2

arch/s390/include/asm/switch_to.h

+81 −43
Original line number Diff line number Diff line
@@ -13,58 +13,94 @@ 
extern struct task_struct *__switch_to(void *, void *);

extern void update_cr_regs(struct task_struct *task);



static inline void save_fp_regs(s390_fp_regs *fpregs)

static inline int test_fp_ctl(u32 fpc)

{

	u32 orig_fpc;

	int rc;



	if (!MACHINE_HAS_IEEE)

		return 0;



	asm volatile(

		"	std	0,%O0+8(%R0)\n"

		"	std	2,%O0+24(%R0)\n"

		"	std	4,%O0+40(%R0)\n"

		"	std	6,%O0+56(%R0)"

		: "=Q" (*fpregs) : "Q" (*fpregs));

		"	efpc    %1\n"

		"	sfpc	%2\n"

		"0:	sfpc	%1\n"

		"	la	%0,0\n"

		"1:\n"

		EX_TABLE(0b,1b)

		: "=d" (rc), "=d" (orig_fpc)

		: "d" (fpc), "0" (-EINVAL));

	return rc;

}



static inline void save_fp_ctl(u32 *fpc)

{

	if (!MACHINE_HAS_IEEE)

		return;



	asm volatile(

		"       stfpc   %0\n"

		"	std	1,%O0+16(%R0)\n"

		"	std	3,%O0+32(%R0)\n"

		"	std	5,%O0+48(%R0)\n"

		"	std	7,%O0+64(%R0)\n"

		"	std	8,%O0+72(%R0)\n"

		"	std	9,%O0+80(%R0)\n"

		"	std	10,%O0+88(%R0)\n"

		"	std	11,%O0+96(%R0)\n"

		"	std	12,%O0+104(%R0)\n"

		"	std	13,%O0+112(%R0)\n"

		"	std	14,%O0+120(%R0)\n"

		"	std	15,%O0+128(%R0)\n"

		: "=Q" (*fpregs) : "Q" (*fpregs));

		: "+Q" (*fpc));

}



static inline void restore_fp_regs(s390_fp_regs *fpregs)

static inline int restore_fp_ctl(u32 *fpc)

{

	int rc;



	if (!MACHINE_HAS_IEEE)

		return 0;



	asm volatile(

		"	ld	0,%O0+8(%R0)\n"

		"	ld	2,%O0+24(%R0)\n"

		"	ld	4,%O0+40(%R0)\n"

		"	ld	6,%O0+56(%R0)"

		: : "Q" (*fpregs));

		"0:	lfpc    %1\n"

		"	la	%0,0\n"

		"1:\n"

		EX_TABLE(0b,1b)

		: "=d" (rc) : "Q" (*fpc), "0" (-EINVAL));

	return rc;

}



static inline void save_fp_regs(freg_t *fprs)

{

	asm volatile("std 0,%0" : "=Q" (fprs[0]));

	asm volatile("std 2,%0" : "=Q" (fprs[2]));

	asm volatile("std 4,%0" : "=Q" (fprs[4]));

	asm volatile("std 6,%0" : "=Q" (fprs[6]));

	if (!MACHINE_HAS_IEEE)

		return;

	asm volatile(

		"	lfpc	%0\n"

		"	ld	1,%O0+16(%R0)\n"

		"	ld	3,%O0+32(%R0)\n"

		"	ld	5,%O0+48(%R0)\n"

		"	ld	7,%O0+64(%R0)\n"

		"	ld	8,%O0+72(%R0)\n"

		"	ld	9,%O0+80(%R0)\n"

		"	ld	10,%O0+88(%R0)\n"

		"	ld	11,%O0+96(%R0)\n"

		"	ld	12,%O0+104(%R0)\n"

		"	ld	13,%O0+112(%R0)\n"

		"	ld	14,%O0+120(%R0)\n"

		"	ld	15,%O0+128(%R0)\n"

		: : "Q" (*fpregs));

	asm volatile("std 1,%0" : "=Q" (fprs[1]));

	asm volatile("std 3,%0" : "=Q" (fprs[3]));

	asm volatile("std 5,%0" : "=Q" (fprs[5]));

	asm volatile("std 7,%0" : "=Q" (fprs[7]));

	asm volatile("std 8,%0" : "=Q" (fprs[8]));

	asm volatile("std 9,%0" : "=Q" (fprs[9]));

	asm volatile("std 10,%0" : "=Q" (fprs[10]));

	asm volatile("std 11,%0" : "=Q" (fprs[11]));

	asm volatile("std 12,%0" : "=Q" (fprs[12]));

	asm volatile("std 13,%0" : "=Q" (fprs[13]));

	asm volatile("std 14,%0" : "=Q" (fprs[14]));

	asm volatile("std 15,%0" : "=Q" (fprs[15]));

}



static inline void restore_fp_regs(freg_t *fprs)

{

	asm volatile("ld 0,%0" : : "Q" (fprs[0]));

	asm volatile("ld 2,%0" : : "Q" (fprs[2]));

	asm volatile("ld 4,%0" : : "Q" (fprs[4]));

	asm volatile("ld 6,%0" : : "Q" (fprs[6]));

	if (!MACHINE_HAS_IEEE)

		return;

	asm volatile("ld 1,%0" : : "Q" (fprs[1]));

	asm volatile("ld 3,%0" : : "Q" (fprs[3]));

	asm volatile("ld 5,%0" : : "Q" (fprs[5]));

	asm volatile("ld 7,%0" : : "Q" (fprs[7]));

	asm volatile("ld 8,%0" : : "Q" (fprs[8]));

	asm volatile("ld 9,%0" : : "Q" (fprs[9]));

	asm volatile("ld 10,%0" : : "Q" (fprs[10]));

	asm volatile("ld 11,%0" : : "Q" (fprs[11]));

	asm volatile("ld 12,%0" : : "Q" (fprs[12]));

	asm volatile("ld 13,%0" : : "Q" (fprs[13]));

	asm volatile("ld 14,%0" : : "Q" (fprs[14]));

	asm volatile("ld 15,%0" : : "Q" (fprs[15]));

}



static inline void save_access_regs(unsigned int *acrs)
@@ -83,12 +119,14 @@ static inline void restore_access_regs(unsigned int *acrs) 


#define switch_to(prev,next,last) do {					\

	if (prev->mm) {							\

		save_fp_regs(&prev->thread.fp_regs);			\

		save_fp_ctl(&prev->thread.fp_regs.fpc);			\

		save_fp_regs(prev->thread.fp_regs.fprs);		\

		save_access_regs(&prev->thread.acrs[0]);		\

		save_ri_cb(prev->thread.ri_cb);				\

	}								\

	if (next->mm) {							\

		restore_fp_regs(&next->thread.fp_regs);			\

		restore_fp_ctl(&next->thread.fp_regs.fpc);		\

		restore_fp_regs(next->thread.fp_regs.fprs);		\

		restore_access_regs(&next->thread.acrs[0]);		\

		restore_ri_cb(next->thread.ri_cb, prev->thread.ri_cb);	\

		update_cr_regs(next);					\

arch/s390/include/uapi/asm/ptrace.h

+1 −1
Original line number Diff line number Diff line
@@ -199,6 +199,7 @@ typedef union 
typedef struct

{

	__u32   fpc;

	__u32	pad;

	freg_t  fprs[NUM_FPRS];              

} s390_fp_regs;
@@ -206,7 +207,6 @@ typedef struct 
#define FPC_FLAGS_MASK          0x00F80000

#define FPC_DXC_MASK            0x0000FF00

#define FPC_RM_MASK             0x00000003

#define FPC_VALID_MASK          0xF8F8FF03



/* this typedef defines how a Program Status Word looks like */

typedef struct

arch/s390/include/uapi/asm/sigcontext.h

+1 −0
Original line number Diff line number Diff line
@@ -49,6 +49,7 @@ typedef struct 
typedef struct

{

	unsigned int fpc;

	unsigned int pad;

	double   fprs[__NUM_FPRS];

} _s390_fp_regs;

arch/s390/kernel/compat_linux.h

+1 −0
Original line number Diff line number Diff line
@@ -27,6 +27,7 @@ typedef union 
typedef struct

{

	unsigned int	fpc;

	unsigned int	pad;

	freg_t32	fprs[__NUM_FPRS];              

} _s390_fp_regs32;

arch/s390/kernel/compat_signal.c

+30 −29
Original line number Diff line number Diff line
@@ -153,60 +153,61 @@ int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from) 


static int save_sigregs32(struct pt_regs *regs, _sigregs32 __user *sregs)

{

	_s390_regs_common32 regs32;

	int err, i;

	_sigregs32 user_sregs;

	int i;



	regs32.psw.mask = psw32_user_bits |

	user_sregs.regs.psw.mask = psw32_user_bits |

		((__u32)(regs->psw.mask >> 32) & PSW32_MASK_USER);

	regs32.psw.addr = (__u32) regs->psw.addr |

	user_sregs.regs.psw.addr = (__u32) regs->psw.addr |

		(__u32)(regs->psw.mask & PSW_MASK_BA);

	for (i = 0; i < NUM_GPRS; i++)

		regs32.gprs[i] = (__u32) regs->gprs[i];

		user_sregs.regs.gprs[i] = (__u32) regs->gprs[i];

	save_access_regs(current->thread.acrs);

	memcpy(regs32.acrs, current->thread.acrs, sizeof(regs32.acrs));

	err = __copy_to_user(&sregs->regs, &regs32, sizeof(regs32));

	if (err)

		return -EFAULT;

	save_fp_regs(&current->thread.fp_regs);

	/* s390_fp_regs and _s390_fp_regs32 are the same ! */

	err = __copy_to_user(&sregs->fpregs, &current->thread.fp_regs,

			     sizeof(_s390_fp_regs32));

	if (err)

	memcpy(&user_sregs.regs.acrs, current->thread.acrs,

	       sizeof(user_sregs.regs.acrs));

	save_fp_ctl(&current->thread.fp_regs.fpc);

	save_fp_regs(current->thread.fp_regs.fprs);

	memcpy(&user_sregs.fpregs, &current->thread.fp_regs,

	       sizeof(user_sregs.fpregs));

	if (__copy_to_user(sregs, &user_sregs, sizeof(_sigregs32)))

		return -EFAULT;

	return 0;

}



static int restore_sigregs32(struct pt_regs *regs,_sigregs32 __user *sregs)

{

	_s390_regs_common32 regs32;

	int err, i;

	_sigregs32 user_sregs;

	int i;



	/* Alwys make any pending restarted system call return -EINTR */

	current_thread_info()->restart_block.fn = do_no_restart_syscall;



	err = __copy_from_user(&regs32, &sregs->regs, sizeof(regs32));

	if (err)

	if (__copy_from_user(&user_sregs, &sregs->regs, sizeof(user_sregs)))

		return -EFAULT;



	/* Loading the floating-point-control word can fail. Do that first. */

	if (restore_fp_ctl(&user_sregs.fpregs.fpc))

		return -EINVAL;



	/* Use regs->psw.mask instead of PSW_USER_BITS to preserve PER bit. */

	regs->psw.mask = (regs->psw.mask & ~PSW_MASK_USER) |

		(__u64)(regs32.psw.mask & PSW32_MASK_USER) << 32 |

		(__u64)(regs32.psw.addr & PSW32_ADDR_AMODE);

		(__u64)(user_sregs.regs.psw.mask & PSW32_MASK_USER) << 32 |

		(__u64)(user_sregs.regs.psw.addr & PSW32_ADDR_AMODE);

	/* Check for invalid user address space control. */

	if ((regs->psw.mask & PSW_MASK_ASC) == PSW_ASC_HOME)

		regs->psw.mask = PSW_ASC_PRIMARY |

			(regs->psw.mask & ~PSW_MASK_ASC);

	regs->psw.addr = (__u64)(regs32.psw.addr & PSW32_ADDR_INSN);

	regs->psw.addr = (__u64)(user_sregs.regs.psw.addr & PSW32_ADDR_INSN);

	for (i = 0; i < NUM_GPRS; i++)

		regs->gprs[i] = (__u64) regs32.gprs[i];

	memcpy(current->thread.acrs, regs32.acrs, sizeof(current->thread.acrs));

		regs->gprs[i] = (__u64) user_sregs.regs.gprs[i];

	memcpy(&current->thread.acrs, &user_sregs.regs.acrs,

	       sizeof(current->thread.acrs));

	restore_access_regs(current->thread.acrs);



	err = __copy_from_user(&current->thread.fp_regs, &sregs->fpregs,

			       sizeof(_s390_fp_regs32));

	current->thread.fp_regs.fpc &= FPC_VALID_MASK;

	if (err)

		return -EFAULT;

	memcpy(&current->thread.fp_regs, &user_sregs.fpregs,

	       sizeof(current->thread.fp_regs));



	restore_fp_regs(&current->thread.fp_regs);

	restore_fp_regs(current->thread.fp_regs.fprs);

	clear_thread_flag(TIF_SYSCALL);	/* No longer in a system call */

	return 0;

}