From: Martin Schwidefsky <schwidefsky@de.ibm.com>
To: linux-kernel@vger.kernel.org, torvalds@transmeta.com
Subject: [PATCH] 2.5.43 s390 (3/6): uaccess bug.
Date: Wed, 16 Oct 2002 18:47:46 +0200 [thread overview]
Message-ID: <200210161847.46058.schwidefsky@de.ibm.com> (raw)
Don't rely on lowcore information in __copy_{from,to}_user_asm.
diff -urN linux-2.5.43/arch/s390/lib/uaccess.S linux-2.5.43-s390/arch/s390/lib/uaccess.S
--- linux-2.5.43/arch/s390/lib/uaccess.S Wed Oct 16 05:27:18 2002
+++ linux-2.5.43-s390/arch/s390/lib/uaccess.S Wed Oct 16 17:54:05 2002
@@ -1,9 +1,9 @@
/*
* arch/s390/lib/uaccess.S
- * fixup routines for copy_{from|to}_user functions.
+ * __copy_{from|to}_user functions.
*
* s390
- * Copyright (C) 2000 IBM Deutschland Entwicklung GmbH, IBM Corporation
+ * Copyright (C) 2000,2002 IBM Deutschland Entwicklung GmbH, IBM Corporation
* Authors(s): Martin Schwidefsky (schwidefsky@de.ibm.com)
*
* These functions have standard call interface
@@ -22,17 +22,23 @@
1: sacf 0
lr %r2,%r5
br %r14
-2: sll %r4,1
- srl %r4,1
- lhi %r3,-4096
- sll %r3,1
- srl %r3,1
- n %r3,__LC_TRANS_EXC_ADDR
- sr %r3,%r4
- jm 1b
- j 0b
+2: lhi %r1,-4096
+ lr %r3,%r4
+ slr %r3,%r1 # %r3 = %r4 + 4096
+ nr %r3,%r1 # %r3 = (%r4 + 4096) & -4096
+ slr %r3,%r4 # %r3 = #bytes to next user page boundary
+ clr %r5,%r3 # copy crosses next page boundary ?
+ jnh 1b # no, this page fauled
+ # The page after the current user page might have faulted.
+ # We cant't find out which page because the program check handler
+ # might have callled schedule, destroying all lowcore information.
+ # We retry with the shortened length.
+3: mvcle %r2,%r4,0
+ jo 3b
+ j 1b
.section __ex_table,"a"
.long 0b,2b
+ .long 3b,1b
.previous
.align 4
@@ -46,17 +52,23 @@
1: sacf 0
lr %r2,%r3
br %r14
-2: sll %r4,1
- srl %r4,1
- lhi %r5,-4096
- sll %r5,1
- srl %r5,1
- n %r5,__LC_TRANS_EXC_ADDR
- sr %r5,%r4
- jm 1b
- j 0b
+2: lhi %r1,-4096
+ lr %r5,%r4
+ slr %r5,%r1 # %r5 = %r4 + 4096
+ nr %r5,%r1 # %r5 = (%r4 + 4096) & -4096
+ slr %r5,%r4 # %r5 = #bytes to next user page boundary
+ clr %r3,%r5 # copy crosses next page boundary ?
+ jnh 1b # no, the current page fauled
+ # The page after the current user page might have faulted.
+ # We cant't find out which page because the program check handler
+ # might have callled schedule, destroying all lowcore information.
+ # We retry with the shortened length.
+3: mvcle %r4,%r2,0
+ jo 3b
+ j 1b
.section __ex_table,"a"
- .long 0b,2b
+ .long 0b,2b
+ .long 3b,1b
.previous
.align 4
@@ -71,18 +83,26 @@
0: mvcle %r4,%r2,0
jo 0b
1: sacf 0
- lr %r2,%r3
br %r14
-2: sll %r4,1
- srl %r4,1
- lhi %r5,-4096
- sll %r5,1
- srl %r5,1
- n %r5,__LC_TRANS_EXC_ADDR
- sr %r5,%r4
- jm 1b
- j 0b
+2: lr %r2,%r5
+ lhi %r1,-4096
+ slr %r5,%r1 # %r5 = %r4 + 4096
+ nr %r5,%r1 # %r5 = (%r4 + 4096) & -4096
+ slr %r5,%r4 # %r5 = #bytes to next user page boundary
+ clr %r2,%r5 # copy crosses next page boundary ?
+ jnh 1b # no, the current page fauled
+ # The page after the current user page might have faulted.
+ # We cant't find out which page because the program check handler
+ # might have callled schedule, destroying all lowcore information.
+ # We retry with the shortened length.
+ slr %r2,%r5
+3: mvcle %r4,%r2,0
+ jo 3b
+ j 1b
+4: alr %r2,%r5
+ j 1b
.section __ex_table,"a"
- .long 0b,2b
+ .long 0b,2b
+ .long 3b,4b
.previous
diff -urN linux-2.5.43/arch/s390x/lib/uaccess.S linux-2.5.43-s390/arch/s390x/lib/uaccess.S
--- linux-2.5.43/arch/s390x/lib/uaccess.S Wed Oct 16 05:28:33 2002
+++ linux-2.5.43-s390/arch/s390x/lib/uaccess.S Wed Oct 16 17:54:05 2002
@@ -1,9 +1,9 @@
/*
* arch/s390x/lib/uaccess.S
- * fixup routines for copy_{from|to}_user functions.
+ * __copy_{from|to}_user functions.
*
- * S390
- * Copyright (C) 2000 IBM Deutschland Entwicklung GmbH, IBM Corporation
+ * s390
+ * Copyright (C) 2000,2002 IBM Deutschland Entwicklung GmbH, IBM Corporation
* Authors(s): Martin Schwidefsky (schwidefsky@de.ibm.com)
*
* These functions have standard call interface
@@ -22,14 +22,23 @@
1: sacf 0
lgr %r2,%r5
br %r14
-2: lghi %r3,-4096
- ng %r3,__LC_TRANS_EXC_ADDR
- sgr %r3,%r4
- jm 1b
- j 0b
+2: lghi %r1,-4096
+ lgr %r3,%r4
+ slgr %r3,%r1 # %r3 = %r4 + 4096
+ ngr %r3,%r1 # %r3 = (%r4 + 4096) & -4096
+ slgr %r3,%r4 # %r3 = #bytes to next user page boundary
+ clgr %r5,%r3 # copy crosses next page boundary ?
+ jnh 1b # no, this page fauled
+ # The page after the current user page might have faulted.
+ # We cant't find out which page because the program check handler
+ # might have callled schedule, destroying all lowcore information.
+ # We retry with the shortened length.
+3: mvcle %r2,%r4,0
+ jo 3b
+ j 1b
.section __ex_table,"a"
- .align 8
.quad 0b,2b
+ .quad 3b,1b
.previous
.align 4
@@ -43,14 +52,23 @@
1: sacf 0
lgr %r2,%r3
br %r14
-2: lghi %r5,-4096
- ng %r5,__LC_TRANS_EXC_ADDR
- sgr %r5,%r4
- jm 1b
- j 0b
+2: lghi %r1,-4096
+ lgr %r5,%r4
+ slgr %r5,%r1 # %r5 = %r4 + 4096
+ ngr %r5,%r1 # %r5 = (%r4 + 4096) & -4096
+ slgr %r5,%r4 # %r5 = #bytes to next user page boundary
+ clgr %r3,%r5 # copy crosses next page boundary ?
+ jnh 1b # no, the current page fauled
+ # The page after the current user page might have faulted.
+ # We cant't find out which page because the program check handler
+ # might have callled schedule, destroying all lowcore information.
+ # We retry with the shortened length.
+3: mvcle %r4,%r2,0
+ jo 3b
+ j 1b
.section __ex_table,"a"
- .align 8
- .quad 0b,2b
+ .quad 0b,2b
+ .quad 3b,1b
.previous
.align 4
@@ -65,14 +83,25 @@
0: mvcle %r4,%r2,0
jo 0b
1: sacf 0
- lgr %r2,%r5
br %r14
-2: lghi %r5,-4096
- ng %r5,__LC_TRANS_EXC_ADDR
- sgr %r5,%r4
- jm 1b
- j 0b
+2: lgr %r2,%r5
+ lghi %r1,-4096
+ slgr %r5,%r1 # %r5 = %r4 + 4096
+ ngr %r5,%r1 # %r5 = (%r4 + 4096) & -4096
+ slgr %r5,%r4 # %r5 = #bytes to next user page boundary
+ clgr %r2,%r5 # copy crosses next page boundary ?
+ jnh 1b # no, the current page fauled
+ # The page after the current user page might have faulted.
+ # We cant't find out which page because the program check handler
+ # might have callled schedule, destroying all lowcore information.
+ # We retry with the shortened length.
+ slgr %r2,%r5
+3: mvcle %r4,%r2,0
+ jo 3b
+ j 1b
+4: algr %r2,%r5
+ j 1b
.section __ex_table,"a"
- .align 8
- .quad 0b,2b
+ .quad 0b,2b
+ .quad 3b,4b
.previous
reply other threads:[~2002-10-16 16:47 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200210161847.46058.schwidefsky@de.ibm.com \
--to=schwidefsky@de.ibm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=torvalds@transmeta.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®