tools, slub: Fix off-by-one buffer corruption after readlink() call
[linux-2.6/linux-mips.git] / arch / sparc / kernel / unaligned_32.c
blob7efbb2f9e77ff63d9a18be9f44f166cd04f05bda
1 /*
2 * unaligned.c: Unaligned load/store trap handling with special
3 * cases for the kernel to do them more quickly.
5 * Copyright (C) 1996 David S. Miller (davem@caip.rutgers.edu)
6 * Copyright (C) 1996 Jakub Jelinek (jj@sunsite.mff.cuni.cz)
7 */
10 #include <linux/kernel.h>
11 #include <linux/sched.h>
12 #include <linux/mm.h>
13 #include <linux/module.h>
14 #include <asm/ptrace.h>
15 #include <asm/processor.h>
16 #include <asm/system.h>
17 #include <asm/uaccess.h>
18 #include <linux/smp.h>
19 #include <linux/perf_event.h>
21 enum direction {
22 load, /* ld, ldd, ldh, ldsh */
23 store, /* st, std, sth, stsh */
24 both, /* Swap, ldstub, etc. */
25 fpload,
26 fpstore,
27 invalid,
30 static inline enum direction decode_direction(unsigned int insn)
32 unsigned long tmp = (insn >> 21) & 1;
34 if(!tmp)
35 return load;
36 else {
37 if(((insn>>19)&0x3f) == 15)
38 return both;
39 else
40 return store;
44 /* 8 = double-word, 4 = word, 2 = half-word */
45 static inline int decode_access_size(unsigned int insn)
47 insn = (insn >> 19) & 3;
49 if(!insn)
50 return 4;
51 else if(insn == 3)
52 return 8;
53 else if(insn == 2)
54 return 2;
55 else {
56 printk("Impossible unaligned trap. insn=%08x\n", insn);
57 die_if_kernel("Byte sized unaligned access?!?!", current->thread.kregs);
58 return 4; /* just to keep gcc happy. */
62 /* 0x400000 = signed, 0 = unsigned */
63 static inline int decode_signedness(unsigned int insn)
65 return (insn & 0x400000);
68 static inline void maybe_flush_windows(unsigned int rs1, unsigned int rs2,
69 unsigned int rd)
71 if(rs2 >= 16 || rs1 >= 16 || rd >= 16) {
72 /* Wheee... */
73 __asm__ __volatile__("save %sp, -0x40, %sp\n\t"
74 "save %sp, -0x40, %sp\n\t"
75 "save %sp, -0x40, %sp\n\t"
76 "save %sp, -0x40, %sp\n\t"
77 "save %sp, -0x40, %sp\n\t"
78 "save %sp, -0x40, %sp\n\t"
79 "save %sp, -0x40, %sp\n\t"
80 "restore; restore; restore; restore;\n\t"
81 "restore; restore; restore;\n\t");
85 static inline int sign_extend_imm13(int imm)
87 return imm << 19 >> 19;
90 static inline unsigned long fetch_reg(unsigned int reg, struct pt_regs *regs)
92 struct reg_window32 *win;
94 if(reg < 16)
95 return (!reg ? 0 : regs->u_regs[reg]);
97 /* Ho hum, the slightly complicated case. */
98 win = (struct reg_window32 *) regs->u_regs[UREG_FP];
99 return win->locals[reg - 16]; /* yes, I know what this does... */
102 static inline unsigned long safe_fetch_reg(unsigned int reg, struct pt_regs *regs)
104 struct reg_window32 __user *win;
105 unsigned long ret;
107 if (reg < 16)
108 return (!reg ? 0 : regs->u_regs[reg]);
110 /* Ho hum, the slightly complicated case. */
111 win = (struct reg_window32 __user *) regs->u_regs[UREG_FP];
113 if ((unsigned long)win & 3)
114 return -1;
116 if (get_user(ret, &win->locals[reg - 16]))
117 return -1;
119 return ret;
122 static inline unsigned long *fetch_reg_addr(unsigned int reg, struct pt_regs *regs)
124 struct reg_window32 *win;
126 if(reg < 16)
127 return &regs->u_regs[reg];
128 win = (struct reg_window32 *) regs->u_regs[UREG_FP];
129 return &win->locals[reg - 16];
132 static unsigned long compute_effective_address(struct pt_regs *regs,
133 unsigned int insn)
135 unsigned int rs1 = (insn >> 14) & 0x1f;
136 unsigned int rs2 = insn & 0x1f;
137 unsigned int rd = (insn >> 25) & 0x1f;
139 if(insn & 0x2000) {
140 maybe_flush_windows(rs1, 0, rd);
141 return (fetch_reg(rs1, regs) + sign_extend_imm13(insn));
142 } else {
143 maybe_flush_windows(rs1, rs2, rd);
144 return (fetch_reg(rs1, regs) + fetch_reg(rs2, regs));
148 unsigned long safe_compute_effective_address(struct pt_regs *regs,
149 unsigned int insn)
151 unsigned int rs1 = (insn >> 14) & 0x1f;
152 unsigned int rs2 = insn & 0x1f;
153 unsigned int rd = (insn >> 25) & 0x1f;
155 if(insn & 0x2000) {
156 maybe_flush_windows(rs1, 0, rd);
157 return (safe_fetch_reg(rs1, regs) + sign_extend_imm13(insn));
158 } else {
159 maybe_flush_windows(rs1, rs2, rd);
160 return (safe_fetch_reg(rs1, regs) + safe_fetch_reg(rs2, regs));
164 /* This is just to make gcc think panic does return... */
165 static void unaligned_panic(char *str)
167 panic(str);
170 /* una_asm.S */
171 extern int do_int_load(unsigned long *dest_reg, int size,
172 unsigned long *saddr, int is_signed);
173 extern int __do_int_store(unsigned long *dst_addr, int size,
174 unsigned long *src_val);
176 static int do_int_store(int reg_num, int size, unsigned long *dst_addr,
177 struct pt_regs *regs)
179 unsigned long zero[2] = { 0, 0 };
180 unsigned long *src_val;
182 if (reg_num)
183 src_val = fetch_reg_addr(reg_num, regs);
184 else {
185 src_val = &zero[0];
186 if (size == 8)
187 zero[1] = fetch_reg(1, regs);
189 return __do_int_store(dst_addr, size, src_val);
192 extern void smp_capture(void);
193 extern void smp_release(void);
195 static inline void advance(struct pt_regs *regs)
197 regs->pc = regs->npc;
198 regs->npc += 4;
201 static inline int floating_point_load_or_store_p(unsigned int insn)
203 return (insn >> 24) & 1;
206 static inline int ok_for_kernel(unsigned int insn)
208 return !floating_point_load_or_store_p(insn);
211 static void kernel_mna_trap_fault(struct pt_regs *regs, unsigned int insn)
213 unsigned long g2 = regs->u_regs [UREG_G2];
214 unsigned long fixup = search_extables_range(regs->pc, &g2);
216 if (!fixup) {
217 unsigned long address = compute_effective_address(regs, insn);
218 if(address < PAGE_SIZE) {
219 printk(KERN_ALERT "Unable to handle kernel NULL pointer dereference in mna handler");
220 } else
221 printk(KERN_ALERT "Unable to handle kernel paging request in mna handler");
222 printk(KERN_ALERT " at virtual address %08lx\n",address);
223 printk(KERN_ALERT "current->{mm,active_mm}->context = %08lx\n",
224 (current->mm ? current->mm->context :
225 current->active_mm->context));
226 printk(KERN_ALERT "current->{mm,active_mm}->pgd = %08lx\n",
227 (current->mm ? (unsigned long) current->mm->pgd :
228 (unsigned long) current->active_mm->pgd));
229 die_if_kernel("Oops", regs);
230 /* Not reached */
232 regs->pc = fixup;
233 regs->npc = regs->pc + 4;
234 regs->u_regs [UREG_G2] = g2;
237 asmlinkage void kernel_unaligned_trap(struct pt_regs *regs, unsigned int insn)
239 enum direction dir = decode_direction(insn);
240 int size = decode_access_size(insn);
242 if(!ok_for_kernel(insn) || dir == both) {
243 printk("Unsupported unaligned load/store trap for kernel at <%08lx>.\n",
244 regs->pc);
245 unaligned_panic("Wheee. Kernel does fpu/atomic unaligned load/store.");
246 } else {
247 unsigned long addr = compute_effective_address(regs, insn);
248 int err;
250 perf_sw_event(PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, regs, addr);
251 switch (dir) {
252 case load:
253 err = do_int_load(fetch_reg_addr(((insn>>25)&0x1f),
254 regs),
255 size, (unsigned long *) addr,
256 decode_signedness(insn));
257 break;
259 case store:
260 err = do_int_store(((insn>>25)&0x1f), size,
261 (unsigned long *) addr, regs);
262 break;
263 default:
264 panic("Impossible kernel unaligned trap.");
265 /* Not reached... */
267 if (err)
268 kernel_mna_trap_fault(regs, insn);
269 else
270 advance(regs);
274 static inline int ok_for_user(struct pt_regs *regs, unsigned int insn,
275 enum direction dir)
277 unsigned int reg;
278 int check = (dir == load) ? VERIFY_READ : VERIFY_WRITE;
279 int size = ((insn >> 19) & 3) == 3 ? 8 : 4;
281 if ((regs->pc | regs->npc) & 3)
282 return 0;
284 /* Must access_ok() in all the necessary places. */
285 #define WINREG_ADDR(regnum) \
286 ((void __user *)(((unsigned long *)regs->u_regs[UREG_FP])+(regnum)))
288 reg = (insn >> 25) & 0x1f;
289 if (reg >= 16) {
290 if (!access_ok(check, WINREG_ADDR(reg - 16), size))
291 return -EFAULT;
293 reg = (insn >> 14) & 0x1f;
294 if (reg >= 16) {
295 if (!access_ok(check, WINREG_ADDR(reg - 16), size))
296 return -EFAULT;
298 if (!(insn & 0x2000)) {
299 reg = (insn & 0x1f);
300 if (reg >= 16) {
301 if (!access_ok(check, WINREG_ADDR(reg - 16), size))
302 return -EFAULT;
305 #undef WINREG_ADDR
306 return 0;
309 static void user_mna_trap_fault(struct pt_regs *regs, unsigned int insn)
311 siginfo_t info;
313 info.si_signo = SIGBUS;
314 info.si_errno = 0;
315 info.si_code = BUS_ADRALN;
316 info.si_addr = (void __user *)safe_compute_effective_address(regs, insn);
317 info.si_trapno = 0;
318 send_sig_info(SIGBUS, &info, current);
321 asmlinkage void user_unaligned_trap(struct pt_regs *regs, unsigned int insn)
323 enum direction dir;
325 if(!(current->thread.flags & SPARC_FLAG_UNALIGNED) ||
326 (((insn >> 30) & 3) != 3))
327 goto kill_user;
328 dir = decode_direction(insn);
329 if(!ok_for_user(regs, insn, dir)) {
330 goto kill_user;
331 } else {
332 int err, size = decode_access_size(insn);
333 unsigned long addr;
335 if(floating_point_load_or_store_p(insn)) {
336 printk("User FPU load/store unaligned unsupported.\n");
337 goto kill_user;
340 addr = compute_effective_address(regs, insn);
341 perf_sw_event(PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, regs, addr);
342 switch(dir) {
343 case load:
344 err = do_int_load(fetch_reg_addr(((insn>>25)&0x1f),
345 regs),
346 size, (unsigned long *) addr,
347 decode_signedness(insn));
348 break;
350 case store:
351 err = do_int_store(((insn>>25)&0x1f), size,
352 (unsigned long *) addr, regs);
353 break;
355 case both:
357 * This was supported in 2.4. However, we question
358 * the value of SWAP instruction across word boundaries.
360 printk("Unaligned SWAP unsupported.\n");
361 err = -EFAULT;
362 break;
364 default:
365 unaligned_panic("Impossible user unaligned trap.");
366 goto out;
368 if (err)
369 goto kill_user;
370 else
371 advance(regs);
372 goto out;
375 kill_user:
376 user_mna_trap_fault(regs, insn);
377 out: