mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-06 02:50:43 +00:00
a7c5724b5c
Short story: Exception handlers used by some copy_to_user() and copy_from_user() functions do not diligently clean up floating point register usage, and this can result in a user process seeing invalid values in floating point registers. This sometimes makes the process fail. Long story: Several cpu-specific (NG4, NG2, U1, U3) memcpy functions use floating point registers and VIS alignaddr/faligndata to accelerate data copying when source and dest addresses don't align well. Linux uses a lazy scheme for saving floating point registers; It is not done upon entering the kernel since it's a very expensive operation. Rather, it is done only when needed. If the kernel ends up not using FP regs during the course of some trap or system call, then it can return to user space without saving or restoring them. The various memcpy functions begin their FP code with VISEntry (or a variation thereof), which saves the FP regs. They conclude their FP code with VISExit (or a variation) which essentially marks the FP regs "clean", ie, they contain no unsaved values. fprs.FPRS_FEF is turned off so that a lazy restore will be triggered when/if the user process accesses floating point regs again. The bug is that the user copy variants of memcpy, copy_from_user() and copy_to_user(), employ an exception handling mechanism to detect faults when accessing user space addresses, and when this handler is invoked, an immediate return from the function is forced, and VISExit is not executed, thus leaving the fprs register in an indeterminate state, but often with fprs.FPRS_FEF set and one or more dirty bits. This results in a return to user space with invalid values in the FP regs, and since fprs.FPRS_FEF is on, no lazy restore occurs. This bug affects copy_to_user() and copy_from_user() for NG4, NG2, U3, and U1. All are fixed by using a new exception handler for those loads and stores that are done during the time between VISEnter and VISExit. n.b. In NG4memcpy, the problematic code can be triggered by a copy size greater than 128 bytes and an unaligned source address. This bug is known to be the cause of random user process memory corruptions while perf is running with the callgraph option (ie, perf record -g). This occurs because perf uses copy_from_user() to read user stacks, and may fault when it follows a stack frame pointer off to an invalid page. Validation checks on the stack address just obscure the underlying problem. Signed-off-by: Rob Gardner <rob.gardner@oracle.com> Signed-off-by: Dave Aldridge <david.j.aldridge@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
428 lines
9.3 KiB
ArmAsm
428 lines
9.3 KiB
ArmAsm
/* U3memcpy.S: UltraSparc-III optimized memcpy.
|
|
*
|
|
* Copyright (C) 1999, 2000, 2004 David S. Miller (davem@redhat.com)
|
|
*/
|
|
|
|
#ifdef __KERNEL__
|
|
#include <asm/visasm.h>
|
|
#include <asm/asi.h>
|
|
#define GLOBAL_SPARE %g7
|
|
#else
|
|
#define ASI_BLK_P 0xf0
|
|
#define FPRS_FEF 0x04
|
|
#ifdef MEMCPY_DEBUG
|
|
#define VISEntryHalf rd %fprs, %o5; wr %g0, FPRS_FEF, %fprs; \
|
|
clr %g1; clr %g2; clr %g3; subcc %g0, %g0, %g0;
|
|
#define VISExitHalf and %o5, FPRS_FEF, %o5; wr %o5, 0x0, %fprs
|
|
#else
|
|
#define VISEntryHalf rd %fprs, %o5; wr %g0, FPRS_FEF, %fprs
|
|
#define VISExitHalf and %o5, FPRS_FEF, %o5; wr %o5, 0x0, %fprs
|
|
#endif
|
|
#define GLOBAL_SPARE %g5
|
|
#endif
|
|
|
|
#ifndef EX_LD
|
|
#define EX_LD(x) x
|
|
#endif
|
|
#ifndef EX_LD_FP
|
|
#define EX_LD_FP(x) x
|
|
#endif
|
|
|
|
#ifndef EX_ST
|
|
#define EX_ST(x) x
|
|
#endif
|
|
#ifndef EX_ST_FP
|
|
#define EX_ST_FP(x) x
|
|
#endif
|
|
|
|
#ifndef EX_RETVAL
|
|
#define EX_RETVAL(x) x
|
|
#endif
|
|
|
|
#ifndef LOAD
|
|
#define LOAD(type,addr,dest) type [addr], dest
|
|
#endif
|
|
|
|
#ifndef STORE
|
|
#define STORE(type,src,addr) type src, [addr]
|
|
#endif
|
|
|
|
#ifndef STORE_BLK
|
|
#define STORE_BLK(src,addr) stda src, [addr] ASI_BLK_P
|
|
#endif
|
|
|
|
#ifndef FUNC_NAME
|
|
#define FUNC_NAME U3memcpy
|
|
#endif
|
|
|
|
#ifndef PREAMBLE
|
|
#define PREAMBLE
|
|
#endif
|
|
|
|
#ifndef XCC
|
|
#define XCC xcc
|
|
#endif
|
|
|
|
.register %g2,#scratch
|
|
.register %g3,#scratch
|
|
|
|
/* Special/non-trivial issues of this code:
|
|
*
|
|
* 1) %o5 is preserved from VISEntryHalf to VISExitHalf
|
|
* 2) Only low 32 FPU registers are used so that only the
|
|
* lower half of the FPU register set is dirtied by this
|
|
* code. This is especially important in the kernel.
|
|
* 3) This code never prefetches cachelines past the end
|
|
* of the source buffer.
|
|
*/
|
|
|
|
.text
|
|
.align 64
|
|
|
|
/* The cheetah's flexible spine, oversized liver, enlarged heart,
|
|
* slender muscular body, and claws make it the swiftest hunter
|
|
* in Africa and the fastest animal on land. Can reach speeds
|
|
* of up to 2.4GB per second.
|
|
*/
|
|
|
|
.globl FUNC_NAME
|
|
.type FUNC_NAME,#function
|
|
FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
|
|
srlx %o2, 31, %g2
|
|
cmp %g2, 0
|
|
tne %xcc, 5
|
|
PREAMBLE
|
|
mov %o0, %o4
|
|
cmp %o2, 0
|
|
be,pn %XCC, 85f
|
|
or %o0, %o1, %o3
|
|
cmp %o2, 16
|
|
blu,a,pn %XCC, 80f
|
|
or %o3, %o2, %o3
|
|
|
|
cmp %o2, (3 * 64)
|
|
blu,pt %XCC, 70f
|
|
andcc %o3, 0x7, %g0
|
|
|
|
/* Clobbers o5/g1/g2/g3/g7/icc/xcc. We must preserve
|
|
* o5 from here until we hit VISExitHalf.
|
|
*/
|
|
VISEntryHalf
|
|
|
|
/* Is 'dst' already aligned on an 64-byte boundary? */
|
|
andcc %o0, 0x3f, %g2
|
|
be,pt %XCC, 2f
|
|
|
|
/* Compute abs((dst & 0x3f) - 0x40) into %g2. This is the number
|
|
* of bytes to copy to make 'dst' 64-byte aligned. We pre-
|
|
* subtract this from 'len'.
|
|
*/
|
|
sub %o0, %o1, GLOBAL_SPARE
|
|
sub %g2, 0x40, %g2
|
|
sub %g0, %g2, %g2
|
|
sub %o2, %g2, %o2
|
|
andcc %g2, 0x7, %g1
|
|
be,pt %icc, 2f
|
|
and %g2, 0x38, %g2
|
|
|
|
1: subcc %g1, 0x1, %g1
|
|
EX_LD_FP(LOAD(ldub, %o1 + 0x00, %o3))
|
|
EX_ST_FP(STORE(stb, %o3, %o1 + GLOBAL_SPARE))
|
|
bgu,pt %XCC, 1b
|
|
add %o1, 0x1, %o1
|
|
|
|
add %o1, GLOBAL_SPARE, %o0
|
|
|
|
2: cmp %g2, 0x0
|
|
and %o1, 0x7, %g1
|
|
be,pt %icc, 3f
|
|
alignaddr %o1, %g0, %o1
|
|
|
|
EX_LD_FP(LOAD(ldd, %o1, %f4))
|
|
1: EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f6))
|
|
add %o1, 0x8, %o1
|
|
subcc %g2, 0x8, %g2
|
|
faligndata %f4, %f6, %f0
|
|
EX_ST_FP(STORE(std, %f0, %o0))
|
|
be,pn %icc, 3f
|
|
add %o0, 0x8, %o0
|
|
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f4))
|
|
add %o1, 0x8, %o1
|
|
subcc %g2, 0x8, %g2
|
|
faligndata %f6, %f4, %f2
|
|
EX_ST_FP(STORE(std, %f2, %o0))
|
|
bne,pt %icc, 1b
|
|
add %o0, 0x8, %o0
|
|
|
|
3: LOAD(prefetch, %o1 + 0x000, #one_read)
|
|
LOAD(prefetch, %o1 + 0x040, #one_read)
|
|
andn %o2, (0x40 - 1), GLOBAL_SPARE
|
|
LOAD(prefetch, %o1 + 0x080, #one_read)
|
|
LOAD(prefetch, %o1 + 0x0c0, #one_read)
|
|
LOAD(prefetch, %o1 + 0x100, #one_read)
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x000, %f0))
|
|
LOAD(prefetch, %o1 + 0x140, #one_read)
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x008, %f2))
|
|
LOAD(prefetch, %o1 + 0x180, #one_read)
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x010, %f4))
|
|
LOAD(prefetch, %o1 + 0x1c0, #one_read)
|
|
faligndata %f0, %f2, %f16
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x018, %f6))
|
|
faligndata %f2, %f4, %f18
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x020, %f8))
|
|
faligndata %f4, %f6, %f20
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x028, %f10))
|
|
faligndata %f6, %f8, %f22
|
|
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x030, %f12))
|
|
faligndata %f8, %f10, %f24
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x038, %f14))
|
|
faligndata %f10, %f12, %f26
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0))
|
|
|
|
subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE
|
|
add %o1, 0x40, %o1
|
|
bgu,pt %XCC, 1f
|
|
srl GLOBAL_SPARE, 6, %o3
|
|
ba,pt %xcc, 2f
|
|
nop
|
|
|
|
.align 64
|
|
1:
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x008, %f2))
|
|
faligndata %f12, %f14, %f28
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x010, %f4))
|
|
faligndata %f14, %f0, %f30
|
|
EX_ST_FP(STORE_BLK(%f16, %o0))
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x018, %f6))
|
|
faligndata %f0, %f2, %f16
|
|
add %o0, 0x40, %o0
|
|
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x020, %f8))
|
|
faligndata %f2, %f4, %f18
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x028, %f10))
|
|
faligndata %f4, %f6, %f20
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x030, %f12))
|
|
subcc %o3, 0x01, %o3
|
|
faligndata %f6, %f8, %f22
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x038, %f14))
|
|
|
|
faligndata %f8, %f10, %f24
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0))
|
|
LOAD(prefetch, %o1 + 0x1c0, #one_read)
|
|
faligndata %f10, %f12, %f26
|
|
bg,pt %XCC, 1b
|
|
add %o1, 0x40, %o1
|
|
|
|
/* Finally we copy the last full 64-byte block. */
|
|
2:
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x008, %f2))
|
|
faligndata %f12, %f14, %f28
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x010, %f4))
|
|
faligndata %f14, %f0, %f30
|
|
EX_ST_FP(STORE_BLK(%f16, %o0))
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x018, %f6))
|
|
faligndata %f0, %f2, %f16
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x020, %f8))
|
|
faligndata %f2, %f4, %f18
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x028, %f10))
|
|
faligndata %f4, %f6, %f20
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x030, %f12))
|
|
faligndata %f6, %f8, %f22
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x038, %f14))
|
|
faligndata %f8, %f10, %f24
|
|
cmp %g1, 0
|
|
be,pt %XCC, 1f
|
|
add %o0, 0x40, %o0
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0))
|
|
1: faligndata %f10, %f12, %f26
|
|
faligndata %f12, %f14, %f28
|
|
faligndata %f14, %f0, %f30
|
|
EX_ST_FP(STORE_BLK(%f16, %o0))
|
|
add %o0, 0x40, %o0
|
|
add %o1, 0x40, %o1
|
|
membar #Sync
|
|
|
|
/* Now we copy the (len modulo 64) bytes at the end.
|
|
* Note how we borrow the %f0 loaded above.
|
|
*
|
|
* Also notice how this code is careful not to perform a
|
|
* load past the end of the src buffer.
|
|
*/
|
|
and %o2, 0x3f, %o2
|
|
andcc %o2, 0x38, %g2
|
|
be,pn %XCC, 2f
|
|
subcc %g2, 0x8, %g2
|
|
be,pn %XCC, 2f
|
|
cmp %g1, 0
|
|
|
|
sub %o2, %g2, %o2
|
|
be,a,pt %XCC, 1f
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x00, %f0))
|
|
|
|
1: EX_LD_FP(LOAD(ldd, %o1 + 0x08, %f2))
|
|
add %o1, 0x8, %o1
|
|
subcc %g2, 0x8, %g2
|
|
faligndata %f0, %f2, %f8
|
|
EX_ST_FP(STORE(std, %f8, %o0))
|
|
be,pn %XCC, 2f
|
|
add %o0, 0x8, %o0
|
|
EX_LD_FP(LOAD(ldd, %o1 + 0x08, %f0))
|
|
add %o1, 0x8, %o1
|
|
subcc %g2, 0x8, %g2
|
|
faligndata %f2, %f0, %f8
|
|
EX_ST_FP(STORE(std, %f8, %o0))
|
|
bne,pn %XCC, 1b
|
|
add %o0, 0x8, %o0
|
|
|
|
/* If anything is left, we copy it one byte at a time.
|
|
* Note that %g1 is (src & 0x3) saved above before the
|
|
* alignaddr was performed.
|
|
*/
|
|
2:
|
|
cmp %o2, 0
|
|
add %o1, %g1, %o1
|
|
VISExitHalf
|
|
be,pn %XCC, 85f
|
|
sub %o0, %o1, %o3
|
|
|
|
andcc %g1, 0x7, %g0
|
|
bne,pn %icc, 90f
|
|
andcc %o2, 0x8, %g0
|
|
be,pt %icc, 1f
|
|
nop
|
|
EX_LD(LOAD(ldx, %o1, %o5))
|
|
EX_ST(STORE(stx, %o5, %o1 + %o3))
|
|
add %o1, 0x8, %o1
|
|
|
|
1: andcc %o2, 0x4, %g0
|
|
be,pt %icc, 1f
|
|
nop
|
|
EX_LD(LOAD(lduw, %o1, %o5))
|
|
EX_ST(STORE(stw, %o5, %o1 + %o3))
|
|
add %o1, 0x4, %o1
|
|
|
|
1: andcc %o2, 0x2, %g0
|
|
be,pt %icc, 1f
|
|
nop
|
|
EX_LD(LOAD(lduh, %o1, %o5))
|
|
EX_ST(STORE(sth, %o5, %o1 + %o3))
|
|
add %o1, 0x2, %o1
|
|
|
|
1: andcc %o2, 0x1, %g0
|
|
be,pt %icc, 85f
|
|
nop
|
|
EX_LD(LOAD(ldub, %o1, %o5))
|
|
ba,pt %xcc, 85f
|
|
EX_ST(STORE(stb, %o5, %o1 + %o3))
|
|
|
|
.align 64
|
|
70: /* 16 < len <= 64 */
|
|
bne,pn %XCC, 75f
|
|
sub %o0, %o1, %o3
|
|
|
|
72:
|
|
andn %o2, 0xf, GLOBAL_SPARE
|
|
and %o2, 0xf, %o2
|
|
1: subcc GLOBAL_SPARE, 0x10, GLOBAL_SPARE
|
|
EX_LD(LOAD(ldx, %o1 + 0x00, %o5))
|
|
EX_LD(LOAD(ldx, %o1 + 0x08, %g1))
|
|
EX_ST(STORE(stx, %o5, %o1 + %o3))
|
|
add %o1, 0x8, %o1
|
|
EX_ST(STORE(stx, %g1, %o1 + %o3))
|
|
bgu,pt %XCC, 1b
|
|
add %o1, 0x8, %o1
|
|
73: andcc %o2, 0x8, %g0
|
|
be,pt %XCC, 1f
|
|
nop
|
|
sub %o2, 0x8, %o2
|
|
EX_LD(LOAD(ldx, %o1, %o5))
|
|
EX_ST(STORE(stx, %o5, %o1 + %o3))
|
|
add %o1, 0x8, %o1
|
|
1: andcc %o2, 0x4, %g0
|
|
be,pt %XCC, 1f
|
|
nop
|
|
sub %o2, 0x4, %o2
|
|
EX_LD(LOAD(lduw, %o1, %o5))
|
|
EX_ST(STORE(stw, %o5, %o1 + %o3))
|
|
add %o1, 0x4, %o1
|
|
1: cmp %o2, 0
|
|
be,pt %XCC, 85f
|
|
nop
|
|
ba,pt %xcc, 90f
|
|
nop
|
|
|
|
75:
|
|
andcc %o0, 0x7, %g1
|
|
sub %g1, 0x8, %g1
|
|
be,pn %icc, 2f
|
|
sub %g0, %g1, %g1
|
|
sub %o2, %g1, %o2
|
|
|
|
1: subcc %g1, 1, %g1
|
|
EX_LD(LOAD(ldub, %o1, %o5))
|
|
EX_ST(STORE(stb, %o5, %o1 + %o3))
|
|
bgu,pt %icc, 1b
|
|
add %o1, 1, %o1
|
|
|
|
2: add %o1, %o3, %o0
|
|
andcc %o1, 0x7, %g1
|
|
bne,pt %icc, 8f
|
|
sll %g1, 3, %g1
|
|
|
|
cmp %o2, 16
|
|
bgeu,pt %icc, 72b
|
|
nop
|
|
ba,a,pt %xcc, 73b
|
|
|
|
8: mov 64, %o3
|
|
andn %o1, 0x7, %o1
|
|
EX_LD(LOAD(ldx, %o1, %g2))
|
|
sub %o3, %g1, %o3
|
|
andn %o2, 0x7, GLOBAL_SPARE
|
|
sllx %g2, %g1, %g2
|
|
1: EX_LD(LOAD(ldx, %o1 + 0x8, %g3))
|
|
subcc GLOBAL_SPARE, 0x8, GLOBAL_SPARE
|
|
add %o1, 0x8, %o1
|
|
srlx %g3, %o3, %o5
|
|
or %o5, %g2, %o5
|
|
EX_ST(STORE(stx, %o5, %o0))
|
|
add %o0, 0x8, %o0
|
|
bgu,pt %icc, 1b
|
|
sllx %g3, %g1, %g2
|
|
|
|
srl %g1, 3, %g1
|
|
andcc %o2, 0x7, %o2
|
|
be,pn %icc, 85f
|
|
add %o1, %g1, %o1
|
|
ba,pt %xcc, 90f
|
|
sub %o0, %o1, %o3
|
|
|
|
.align 64
|
|
80: /* 0 < len <= 16 */
|
|
andcc %o3, 0x3, %g0
|
|
bne,pn %XCC, 90f
|
|
sub %o0, %o1, %o3
|
|
|
|
1:
|
|
subcc %o2, 4, %o2
|
|
EX_LD(LOAD(lduw, %o1, %g1))
|
|
EX_ST(STORE(stw, %g1, %o1 + %o3))
|
|
bgu,pt %XCC, 1b
|
|
add %o1, 4, %o1
|
|
|
|
85: retl
|
|
mov EX_RETVAL(%o4), %o0
|
|
|
|
.align 32
|
|
90:
|
|
subcc %o2, 1, %o2
|
|
EX_LD(LOAD(ldub, %o1, %g1))
|
|
EX_ST(STORE(stb, %g1, %o1 + %o3))
|
|
bgu,pt %XCC, 90b
|
|
add %o1, 1, %o1
|
|
retl
|
|
mov EX_RETVAL(%o4), %o0
|
|
|
|
.size FUNC_NAME, .-FUNC_NAME
|