Subject: mips64 LOAD_KPTE2 fix

From: Atsushi Nemoto <[email-masked]>
Date: Mon, 02 Jun 2003 20:14:53 +0900 (JST)

If a TLB exception occured on very high address (such as
0xffffffffffffffff), invalid_vmalloc_address should be called but
currently not.

I think it is because LOAD_KPTE2 in arch/mips64/mm/tlbex-r4k.S does
not check overflow of (kptbl + offset).  Here is a patch (both 2.4 and
2.5).

diff -u linux-mips-cvs/arch/mips64/mm/tlbex-r4k.S linux.new/arch/mips64/mm/tlbex-r4k.S
--- linux-mips-cvs/arch/mips64/mm/tlbex-r4k.S	Mon Apr 28 09:44:54 2003
+++ linux.new/arch/mips64/mm/tlbex-r4k.S	Mon Jun  2 19:44:57 2003
@@ -72,6 +72,8 @@
 	/*
 	 * Determine that fault address is within vmalloc range.
 	 */
+	bgez	\ptr, \not_vmalloc		# check overflow
+	nop
 	dla	\tmp, ekptbl
 	sltu	\tmp, \ptr, \tmp
 	beqz	\tmp, \not_vmalloc		# not vmalloc
---
Atsushi Nemoto

---

From: Atsushi Nemoto <[email-masked]>
Date: Mon, 02 Jun 2003 20:23:45 +0900 (JST)

>>>>> On Mon, 02 Jun 2003 20:14:53 +0900 (JST), Atsushi Nemoto <[email-masked]> said:
anemo> If a TLB exception occured on very high address (such as
anemo> 0xffffffffffffffff), invalid_vmalloc_address should be called
anemo> but currently not.

anemo> I think it is because LOAD_KPTE2 in arch/mips64/mm/tlbex-r4k.S
anemo> does not check overflow of (kptbl + offset).  Here is a patch
anemo> (both 2.4 and 2.5).

Please ignore it.  I missed an another fix.  The beqz lacks delay
slot.  Here is a new patch.

+++ linux.new/arch/mips64/mm/tlbex-r4k.S	Mon Jun  2 20:16:41 2003
@@ -72,9 +72,12 @@
 	.endm

---
Atsushi Nemoto

---

From: "Maciej W. Rozycki" <[email-masked]>
Date: Tue, 3 Jun 2003 14:58:44 +0200 (MET DST)

> +++ linux.new/arch/mips64/mm/tlbex-r4k.S	Mon Jun  2 20:16:41 2003

 The missing delay slot filler might be called a feature, but LOAD_KPTE2
is so far always used near such code it cannot be avoided.  So the "nop"
is correct.  Please pay attention to proper indentation of instructions in
branch delay slots -- this helps avoiding such errors.

 I don't think a separate overflow check is needed, even I see how the
code can fail for large offsets into XKSEG.  How about this patch?  Does
it work for you?  It would not incur unnecessary overhead.

  Maciej

-- 
+  Maciej W. Rozycki, Technical University of Gdansk, Poland   +
+--------------------------------------------------------------+
+        e-mail: [email-masked], PGP key available        +

patch-mips-2.4.21-pre4-20030505-load_kpte2-0
diff -up --recursive --new-file linux-mips-2.4.21-pre4-20030505.macro/arch/mips64/mm/tlbex-r4k.S linux-mips-2.4.21-pre4-20030505/arch/mips64/mm/tlbex-r4k.S
--- linux-mips-2.4.21-pre4-20030505.macro/arch/mips64/mm/tlbex-r4k.S	2003-04-27 02:56:39.000000000 +0000
+++ linux-mips-2.4.21-pre4-20030505/arch/mips64/mm/tlbex-r4k.S	2003-06-03 12:54:41.000000000 +0000
@@ -73,8 +73,9 @@
 	 * Determine that fault address is within vmalloc range.
 	 */
 	dla	\tmp, ekptbl
-	sltu	\tmp, \ptr, \tmp
+	slt	\tmp, \ptr, \tmp
 	beqz	\tmp, \not_vmalloc		# not vmalloc
+	 nop
 	.endm

---

From: Atsushi Nemoto <[email-masked]>
Date: Wed, 04 Jun 2003 10:02:04 +0900 (JST)

>>>>> On Tue, 3 Jun 2003 14:58:44 +0200 (MET DST), "Maciej W. Rozycki" <[email-masked]> said:
macro>  I don't think a separate overflow check is needed, even I see
macro> how the code can fail for large offsets into XKSEG.  How about
macro> this patch?  Does it work for you?  It would not incur
macro> unnecessary overhead.

macro> diff -up --recursive --new-file linux-mips-2.4.21-pre4-20030505.macro/arch/mips64/mm/tlbex-r4k.S linux-mips-2.4.21-pre4-20030505/arch/mips64/mm/tlbex-r4k.S
macro> --- linux-mips-2.4.21-pre4-20030505.macro/arch/mips64/mm/tlbex-r4k.S	2003-04-27 02:56:39.000000000 +0000
macro> +++ linux-mips-2.4.21-pre4-20030505/arch/mips64/mm/tlbex-r4k.S	2003-06-03 12:54:41.000000000 +0000
macro> @@ -73,8 +73,9 @@
macro>  	 * Determine that fault address is within vmalloc range.
macro>  	 */
macro>  	dla	\tmp, ekptbl
macro> -	sltu	\tmp, \ptr, \tmp
macro> +	slt	\tmp, \ptr, \tmp
macro>  	beqz	\tmp, \not_vmalloc		# not vmalloc
macro> +	 nop
macro>  	.endm

Thank you for pointing out this.  I did not think very much.  But you
mean "slt \tmp, \tmp, \ptr", don't you?

+++ linux.new/arch/mips64/mm/tlbex-r4k.S	Wed Jun  4 09:45:48 2003
+	slt	\tmp, \tmp, \ptr

---
Atsushi Nemoto

---

From: "Maciej W. Rozycki" <[email-masked]>
Date: Wed, 4 Jun 2003 16:09:10 +0200 (MET DST)

> mean "slt \tmp, \tmp, \ptr", don't you?

 Not at all.  Why would I want to reverse the comparison?

---

From: Atsushi Nemoto <[email-masked]>
Date: Thu, 05 Jun 2003 09:58:02 +0900 (JST)

>>>>> On Wed, 4 Jun 2003 16:09:10 +0200 (MET DST), "Maciej W. Rozycki" <[email-masked]> said:
>> Thank you for pointing out this.  I did not think very much.  But
>> you mean "slt \tmp, \tmp, \ptr", don't you?

macro>  Not at all.  Why would I want to reverse the comparison?

Sorry, I garbled.  Please ignore my last patch.  Your patch works
fine.  Thank you again.

---
Atsushi Nemoto

---

From: "Maciej W. Rozycki" <[email-masked]>
Date: Thu, 5 Jun 2003 14:15:52 +0200 (MET DST)

> Sorry, I garbled.  Please ignore my last patch.  Your patch works

 Ralf, OK to apply then?

---

From: Ralf Baechle <[email-masked]>
Date: Thu, 5 Jun 2003 14:19:59 +0200

> > Sorry, I garbled.  Please ignore my last patch.  Your patch works

Yes, please.

  Ralf