lkml.org 
[lkml]   [2018]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH 3.18 45/52] MIPS: memset.S: Fix clobber of v1 in last_fixup
    Hi,

    IIRC, The v1 is a temporary register, value is not preserved across
    function calls.

    I don't see any functions that generated by compiler to restore values
    of v1 after clobbered it.

    On Sun, Apr 22, 2018 at 9:54 PM, Greg Kroah-Hartman
    <gregkh@linuxfoundation.org> wrote:
    > 3.18-stable review patch. If anyone has any objections, please let me know.
    >
    > ------------------
    >
    > From: Matt Redfearn <matt.redfearn@mips.com>
    >
    > commit c96eebf07692e53bf4dd5987510d8b550e793598 upstream.
    >
    > The label .Llast_fixup\@ is jumped to on page fault within the final
    > byte set loop of memset (on < MIPSR6 architectures). For some reason, in
    > this fault handler, the v1 register is randomly set to a2 & STORMASK.
    > This clobbers v1 for the calling function. This can be observed with the
    > following test code:
    >
    > static int __init __attribute__((optimize("O0"))) test_clear_user(void)
    > {
    > register int t asm("v1");
    > char *test;
    > int j, k;
    >
    > pr_info("\n\n\nTesting clear_user\n");
    > test = vmalloc(PAGE_SIZE);
    >
    > for (j = 256; j < 512; j++) {
    > t = 0xa5a5a5a5;
    > if ((k = clear_user(test + PAGE_SIZE - 256, j)) != j - 256) {
    > pr_err("clear_user (%px %d) returned %d\n", test + PAGE_SIZE - 256, j, k);
    > }
    > if (t != 0xa5a5a5a5) {
    > pr_err("v1 was clobbered to 0x%x!\n", t);
    > }
    > }
    >
    > return 0;
    > }
    > late_initcall(test_clear_user);
    >
    > Which demonstrates that v1 is indeed clobbered (MIPS64):
    >
    > Testing clear_user
    > v1 was clobbered to 0x1!
    > v1 was clobbered to 0x2!
    > v1 was clobbered to 0x3!
    > v1 was clobbered to 0x4!
    > v1 was clobbered to 0x5!
    > v1 was clobbered to 0x6!
    > v1 was clobbered to 0x7!
    >
    > Since the number of bytes that could not be set is already contained in
    > a2, the andi placing a value in v1 is not necessary and actively
    > harmful in clobbering v1.
    >
    > Reported-by: James Hogan <jhogan@kernel.org>
    > Signed-off-by: Matt Redfearn <matt.redfearn@mips.com>
    > Cc: Ralf Baechle <ralf@linux-mips.org>
    > Cc: linux-mips@linux-mips.org
    > Cc: stable@vger.kernel.org
    > Patchwork: https://patchwork.linux-mips.org/patch/19109/
    > Signed-off-by: James Hogan <jhogan@kernel.org>
    > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    >
    > ---
    > arch/mips/lib/memset.S | 2 +-
    > 1 file changed, 1 insertion(+), 1 deletion(-)
    >
    > --- a/arch/mips/lib/memset.S
    > +++ b/arch/mips/lib/memset.S
    > @@ -210,7 +210,7 @@
    >
    > .Llast_fixup\@:
    > jr ra
    > - andi v1, a2, STORMASK
    > + nop
    >
    > .Lsmall_fixup\@:
    > PTR_SUBU a2, t1, a0
    >
    >
    >



    --
    Best regards!
    Hev
    https://hev.cc

    \
     
     \ /
      Last update: 2018-04-23 09:17    [W:3.695 / U:0.584 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site