From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <mikey@neuling.org>
Received: from ozlabs.org (ozlabs.org [103.22.144.67])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by lists.ozlabs.org (Postfix) with ESMTPS id 3sHcTP3rXjzDq5f
 for <linuxppc-dev@lists.ozlabs.org>; Mon, 22 Aug 2016 12:09:45 +1000 (AEST)
Message-ID: <1471831785.14506.36.camel@neuling.org>
Subject: Re: [PATCH] powerpc/tm: do not use r13 for tabort_syscall
From: Michael Neuling <mikey@neuling.org>
To: Nicholas Piggin <npiggin@gmail.com>, linuxppc-dev@lists.ozlabs.org
Cc: Sam Bobroff <sam.bobroff@au1.ibm.com>, Michael Ellerman
 <mpe@ellerman.id.au>
Date: Mon, 22 Aug 2016 12:09:45 +1000
In-Reply-To: <1469172468-12892-1-git-send-email-npiggin@gmail.com>
References: <1469172468-12892-1-git-send-email-npiggin@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
List-Id: Linux on PowerPC Developers Mail List <linuxppc-dev.lists.ozlabs.org>
List-Unsubscribe: <https://lists.ozlabs.org/options/linuxppc-dev>,
 <mailto:linuxppc-dev-request@lists.ozlabs.org?subject=unsubscribe>
List-Archive: <http://lists.ozlabs.org/pipermail/linuxppc-dev/>
List-Post: <mailto:linuxppc-dev@lists.ozlabs.org>
List-Help: <mailto:linuxppc-dev-request@lists.ozlabs.org?subject=help>
List-Subscribe: <https://lists.ozlabs.org/listinfo/linuxppc-dev>,
 <mailto:linuxppc-dev-request@lists.ozlabs.org?subject=subscribe>

On Fri, 2016-07-22 at 17:27 +1000, Nicholas Piggin wrote:
> tabort_syscall runs with RI=3D1, so a nested recoverable machine
> check will load the paca into r13 and overwrite what we loaded
> it with, because exceptions returning to privileged mode do not
> restore r13.
>=20
> This has survived testing with sc instruction inside transaction
> (bare sc, not glibc syscall because glibc can tabort before sc).
> Verified the transaction is failing failing with with
> TM_CAUSE_SYSCALL.
>=20
> Signed-off-by: Nick Piggin <npiggin@gmail.com>
> Cc: Michael Neuling <mikey@neuling.org>

FWIW

Acked-by: Michael Neuling <mikey@neuling.org>

> Cc: Sam Bobroff <sam.bobroff@au1.ibm.com>
> Cc: Michael Ellerman <mpe@ellerman.id.au>
>=20
> ---
>=20
> =C2=A0arch/powerpc/kernel/entry_64.S | 20 ++++++++++----------
> =C2=A01 file changed, 10 insertions(+), 10 deletions(-)
>=20
> diff --git a/arch/powerpc/kernel/entry_64.S
> b/arch/powerpc/kernel/entry_64.S
> index 73e461a..387dee3 100644
> --- a/arch/powerpc/kernel/entry_64.S
> +++ b/arch/powerpc/kernel/entry_64.S
> @@ -368,13 +368,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
> =C2=A0tabort_syscall:
> =C2=A0	/* Firstly we need to enable TM in the kernel */
> =C2=A0	mfmsr	r10
> -	li	r13, 1
> -	rldimi	r10, r13, MSR_TM_LG, 63-MSR_TM_LG
> -	mtmsrd	r10, 0
> +	li	r9,1
> +	rldimi	r10,r9,MSR_TM_LG,63-MSR_TM_LG
> +	mtmsrd	r10,0
> =C2=A0
> =C2=A0	/* tabort, this dooms the transaction, nothing else */
> -	li	r13, (TM_CAUSE_SYSCALL|TM_CAUSE_PERSISTENT)
> -	TABORT(R13)
> +	li	r9,(TM_CAUSE_SYSCALL|TM_CAUSE_PERSISTENT)
> +	TABORT(R9)
> =C2=A0
> =C2=A0	/*
> =C2=A0	=C2=A0* Return directly to userspace. We have corrupted user regis=
ter
> state,
> @@ -382,11 +382,11 @@ tabort_syscall:
> =C2=A0	=C2=A0* resume after the tbegin of the aborted transaction with th=
e
> =C2=A0	=C2=A0* checkpointed register state.
> =C2=A0	=C2=A0*/
> -	li	r13, MSR_RI
> -	andc	r10, r10, r13
> -	mtmsrd	r10, 1
> -	mtspr	SPRN_SRR0, r11
> -	mtspr	SPRN_SRR1, r12
> +	li	r9,MSR_RI
> +	andc	r10,r10,r9
> +	mtmsrd	r10,1
> +	mtspr	SPRN_SRR0,r11
> +	mtspr	SPRN_SRR1,r12
> =C2=A0
> =C2=A0	rfid
> =C2=A0	b	.	/* prevent speculative execution */