From: Christophe LEROY <christophe.leroy@c-s.fr>
To: Michael Ellerman <mpe@ellerman.id.au>,
Benjamin Herrenschmidt <benh@kernel.crashing.org>,
Paul Mackerras <paulus@samba.org>, Scott Wood <oss@buserror.net>
Cc: linux-kernel@vger.kernel.org, linuxppc-dev@lists.ozlabs.org
Subject: Re: [PATCH 2/5] powerpc/mm: split store_updates_sp() in two parts in do_page_fault()
Date: Tue, 6 Jun 2017 15:29:57 +0200 [thread overview]
Message-ID: <7f84df86-37b0-a7a5-9294-92adbacf8f49@c-s.fr> (raw)
In-Reply-To: <87r2yxpeic.fsf@concordia.ellerman.id.au>
Le 06/06/2017 à 13:00, Michael Ellerman a écrit :
> christophe leroy <christophe.leroy@c-s.fr> writes:
>
>> Le 05/06/2017 à 12:45, Michael Ellerman a écrit :
>>> Christophe LEROY <christophe.leroy@c-s.fr> writes:
>>>
>>>> Le 02/06/2017 à 11:26, Michael Ellerman a écrit :
>>>>> Christophe Leroy <christophe.leroy@c-s.fr> writes:
>>>>>
>>>>>> Only the get_user() in store_updates_sp() has to be done outside
>>>>>> the mm semaphore. All the comparison can be done within the semaphore,
>>>>>> so only when really needed.
>>>>>>
>>>>>> As we got a DSI exception, the address pointed by regs->nip is
>>>>>> obviously valid, otherwise we would have had a instruction exception.
>>>>>> So __get_user() can be used instead of get_user()
>>>>>
>>>>> I don't think that part is true.
>>>>>
>>>>> You took a DSI so there *was* an instruction at NIP, but since then it
>>>>> may have been unmapped by another thread.
>>>>>
>>>>> So I don't think you can assume the get_user() will succeed.
>>>>
>>>> The difference between get_user() and __get_user() is that get_user()
>>>> performs an access_ok() in addition.
>>>>
>>>> Doesn't access_ok() only checks whether addr is below TASK_SIZE to
>>>> ensure it is a valid user address ?
>>>
>>> Yeah more or less, via some gross macros.
>>>
>>> I was actually not that worried about the switch from get_user() to
>>> __get_user(), but rather that you removed the check of the return value.
>>> ie.
>>>
>>> - if (get_user(inst, (unsigned int __user *)regs->nip))
>>> - return 0;
>>>
>>> Became:
>>>
>>> if (is_write && user_mode(regs))
>>> - store_update_sp = store_updates_sp(regs);
>>> + __get_user(inst, (unsigned int __user *)regs->nip);
>>>
>>>
>>> I think dropping the access_ok() probably is alright, because the NIP
>>> must (should!) have been in userspace, though as Ben says it's always
>>> good to be paranoid.
>>>
>>> But ignoring that the address can fault at all is wrong AFAICS.
>>
>> I see what you mean now.
>>
>> Indeed,
>>
>> - unsigned int inst;
>>
>> Became
>>
>> + unsigned int inst = 0;
>>
>> Since __get_user() doesn't modify 'inst' in case of error, 'inst'
>> remains 0, and store_updates_sp(0) return false. That was the idea behind.
>
> Ugh. OK, my bad. Though it is a little subtle.
>
> How about:
>
> @@ -286,10 +290,13 @@ int do_page_fault(struct pt_regs *regs, unsigned long address,
> /*
> * We want to do this outside mmap_sem, because reading code around nip
> * can result in fault, which will cause a deadlock when called with
> - * mmap_sem held
> + * mmap_sem held. We don't need to check if get_user() fails, if it does
> + * it won't modify inst, and an inst of 0 will return false from
> + * store_updates_sp().
> */
> + inst = 0;
> if (is_write && is_user)
> - store_update_sp = store_updates_sp(regs);
> + get_user(inst, (unsigned int __user *)regs->nip);
>
> if (is_user)
> flags |= FAULT_FLAG_USER;
>
>
> Then this one can go in.
>
I just submitted v4 version of the patch "powerpc/mm: Only read faulting
instruction when necessary in do_page_fault()", skipping this step and
going directly to the final solution.
The new approach has been to keep everything inside store_updates_sp()
function and just move the call.
Christophe
next prev parent reply other threads:[~2017-06-06 13:30 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-19 12:56 [PATCH 0/5] powerpc/mm: some cleanup of do_page_fault() Christophe Leroy
2017-04-19 12:56 ` [PATCH 1/5] powerpc/mm: only call store_updates_sp() on stores in do_page_fault() Christophe Leroy
2017-04-24 9:10 ` Aneesh Kumar K.V
2017-06-05 10:21 ` [1/5] " Michael Ellerman
2017-04-19 12:56 ` [PATCH 2/5] powerpc/mm: split store_updates_sp() in two parts " Christophe Leroy
2017-04-24 9:11 ` Aneesh Kumar K.V
2017-06-02 9:26 ` Michael Ellerman
2017-06-02 9:39 ` Christophe LEROY
2017-06-02 12:11 ` Benjamin Herrenschmidt
2017-06-02 12:31 ` Christophe LEROY
2017-06-05 10:49 ` Michael Ellerman
2017-06-05 10:45 ` Michael Ellerman
2017-06-05 17:48 ` christophe leroy
2017-06-06 11:00 ` Michael Ellerman
2017-06-06 13:29 ` Christophe LEROY [this message]
2017-04-19 12:56 ` [PATCH 3/5] powerpc/mm: remove a redundant test " Christophe Leroy
2017-04-19 12:56 ` [PATCH 4/5] powerpc/mm: Evaluate user_mode(regs) only once " Christophe Leroy
2017-04-24 9:13 ` Aneesh Kumar K.V
2017-04-19 12:56 ` [PATCH 5/5] powerpc/mm: The 8xx doesn't call do_page_fault() for breakpoints Christophe Leroy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7f84df86-37b0-a7a5-9294-92adbacf8f49@c-s.fr \
--to=christophe.leroy@c-s.fr \
--cc=benh@kernel.crashing.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=mpe@ellerman.id.au \
--cc=oss@buserror.net \
--cc=paulus@samba.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).