This is a note to let you know that I've just added the patch titled powerpc/tm: Fix restoration of MSR on 32bit signal return to the 3.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: powerpc-tm-fix-restoration-of-msr-on-32bit-signal-return.patch and it can be found in the queue-3.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 2c27a18f8736da047bef2b997bdd48efc667e3c9 Mon Sep 17 00:00:00 2001 From: Michael Neuling <mikey@xxxxxxxxxxx> Date: Sun, 9 Jun 2013 21:23:17 +1000 Subject: powerpc/tm: Fix restoration of MSR on 32bit signal return From: Michael Neuling <mikey@xxxxxxxxxxx> commit 2c27a18f8736da047bef2b997bdd48efc667e3c9 upstream. Currently we clear out the MSR TM bits on signal return assuming that the signal should never return to an active transaction. This is bogus as the user may do this. It's most likely the transaction will be doomed due to a treclaim but that's a problem for the HW not the kernel. The current code is a legacy of earlier kernel implementations which did software rollback of active transactions in the kernel. That code has now gone but we didn't correctly fix up this part of the signals code which still makes the assumption that it must be returning to a suspended transaction. This pulls out both MSR TM bits from the user supplied context rather than just setting TM suspend. We pull out only the bits needed to ensure the user can't do anything dangerous to the MSR. Signed-off-by: Michael Neuling <mikey@xxxxxxxxxxx> Signed-off-by: Benjamin Herrenschmidt <benh@xxxxxxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/powerpc/kernel/signal_32.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/arch/powerpc/kernel/signal_32.c +++ b/arch/powerpc/kernel/signal_32.c @@ -754,7 +754,7 @@ static long restore_tm_user_regs(struct struct mcontext __user *tm_sr) { long err; - unsigned long msr; + unsigned long msr, msr_hi; #ifdef CONFIG_VSX int i; #endif @@ -859,8 +859,11 @@ static long restore_tm_user_regs(struct tm_enable(); /* This loads the checkpointed FP/VEC state, if used */ tm_recheckpoint(¤t->thread, msr); - /* The task has moved into TM state S, so ensure MSR reflects this */ - regs->msr = (regs->msr & ~MSR_TS_MASK) | MSR_TS_S; + /* Get the top half of the MSR */ + if (__get_user(msr_hi, &tm_sr->mc_gregs[PT_MSR])) + return 1; + /* Pull in MSR TM from user context */ + regs->msr = (regs->msr & ~MSR_TS_MASK) | ((msr_hi<<32) & MSR_TS_MASK); /* This loads the speculative FP/VEC state, if used */ if (msr & MSR_FP) { Patches currently in stable-queue which might be from mikey@xxxxxxxxxxx are queue-3.10/powerpc-tm-fix-writing-top-half-of-msr-on-32-bit-signals.patch queue-3.10/powerpc-tm-fix-return-of-active-64bit-signals.patch queue-3.10/powerpc-tm-fix-return-of-32bit-rt-signals-to-active-transactions.patch queue-3.10/powerpc-tm-fix-restoration-of-msr-on-32bit-signal-return.patch queue-3.10/powerpc-hw_brk-fix-clearing-of-extraneous-irq.patch queue-3.10/powerpc-hw_brk-fix-off-by-one-error-when-validating-dawr-region-end.patch queue-3.10/powerpc-hw_brk-fix-setting-of-length-for-exact-mode-breakpoints.patch queue-3.10/powerpc-tm-fix-32-bit-non-rt-signals.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html