Commit d3f46896 authored Mar 05, 2018 by Christian Borntraeger Committed by Martin Schwidefsky Mar 06, 2018

s390/entry.S: fix spurious zeroing of r0



when a system call is interrupted we might call the critical section
cleanup handler that re-does some of the operations. When we are between
.Lsysc_vtime and .Lsysc_do_svc we might also redo the saving of the
problem state registers r0-r7:

.Lcleanup_system_call:
[...]
0:      # update accounting time stamp
        mvc     __LC_LAST_UPDATE_TIMER(8),__LC_SYNC_ENTER_TIMER
        # set up saved register r11
        lg      %r15,__LC_KERNEL_STACK
        la      %r9,STACK_FRAME_OVERHEAD(%r15)
        stg     %r9,24(%r11)            # r11 pt_regs pointer
        # fill pt_regs
        mvc     __PT_R8(64,%r9),__LC_SAVE_AREA_SYNC
--->    stmg    %r0,%r7,__PT_R0(%r9)

The problem is now, that we might have already zeroed out r0.
The fix is to move the zeroing of r0 after sysc_do_svc.

Reported-by: Farhan Ali <alifm@linux.vnet.ibm.com>
Fixes: 7041d281 ("s390: scrub registers on kernel entry and KVM exit")
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

parent 61e18270

arch/s390/kernel/entry.S

+2 −2

Original line number	Original line	Diff line number	Diff line
	@@ -427,13 +427,13 @@ ENTRY(system_call)
	UPDATE_VTIME %r8,%r9,__LC_SYNC_ENTER_TIMER		UPDATE_VTIME %r8,%r9,__LC_SYNC_ENTER_TIMER
	BPENTER __TI_flags(%r12),_TIF_ISOLATE_BP		BPENTER __TI_flags(%r12),_TIF_ISOLATE_BP
	stmg %r0,%r7,__PT_R0(%r11)		stmg %r0,%r7,__PT_R0(%r11)
	# clear user controlled register to prevent speculative use
	xgr %r0,%r0
	mvc __PT_R8(64,%r11),__LC_SAVE_AREA_SYNC		mvc __PT_R8(64,%r11),__LC_SAVE_AREA_SYNC
	mvc __PT_PSW(16,%r11),__LC_SVC_OLD_PSW		mvc __PT_PSW(16,%r11),__LC_SVC_OLD_PSW
	mvc __PT_INT_CODE(4,%r11),__LC_SVC_ILC		mvc __PT_INT_CODE(4,%r11),__LC_SVC_ILC
	stg %r14,__PT_FLAGS(%r11)		stg %r14,__PT_FLAGS(%r11)
	.Lsysc_do_svc:		.Lsysc_do_svc:
			# clear user controlled register to prevent speculative use
			xgr %r0,%r0
	# load address of system call table		# load address of system call table
	lg %r10,__THREAD_sysc_table(%r13,%r12)		lg %r10,__THREAD_sysc_table(%r13,%r12)
	llgh %r8,__PT_INT_CODE+2(%r11)		llgh %r8,__PT_INT_CODE+2(%r11)

Admin message