From: Michael Neuling Subject: powerpc: Fix ptrace compat wrapper for FPU register access Patch-mainline: 2.6.30-rc4 Git-commit: bc826666e4252f78d2b144af3b7d699ff5efce0a References: bnc#496027 powerpc: Fix ptrace compat wrapper for FPU register access The ptrace compat wrapper mishandles access to the fpu registers. The PTRACE_PEEKUSR and PTRACE_POKEUSR requests miscalculate the index into the fpr array due to the broken FPINDEX macro. The PPC_PTRACE_PEEKUSR_3264 request needs to use the same formula that the native ptrace interface uses when operating on the register number (as opposed to the 4-byte offset). The PPC_PTRACE_POKEUSR_3264 request didn't take TS_FPRWIDTH into account. Signed-off-by: Andreas Schwab Signed-off-by: Michael Neuling Signed-off-by: Paul Mackerras Acked-by: Jeff Mahoney --- arch/powerpc/kernel/ptrace32.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) --- a/arch/powerpc/kernel/ptrace32.c +++ b/arch/powerpc/kernel/ptrace32.c @@ -70,7 +70,8 @@ static long compat_ptrace_old(struct tas /* Macros to workout the correct index for the FPR in the thread struct */ #define FPRNUMBER(i) (((i) - PT_FPR0) >> 1) #define FPRHALF(i) (((i) - PT_FPR0) & 1) -#define FPRINDEX(i) TS_FPRWIDTH * FPRNUMBER(i) + FPRHALF(i) +#define FPRINDEX(i) TS_FPRWIDTH * FPRNUMBER(i) * 2 + FPRHALF(i) +#define FPRINDEX_3264(i) (TS_FPRWIDTH * ((i) - PT_FPR0)) static int compat_ptrace_getsiginfo(struct task_struct *child, compat_siginfo_t __user *data) { @@ -192,8 +193,9 @@ long compat_arch_ptrace(struct task_stru CHECK_FULL_REGS(child->thread.regs); if (numReg >= PT_FPR0) { flush_fp_to_thread(child); - tmp = ((unsigned long int *)child->thread.fpr) - [FPRINDEX(numReg)]; + /* get 64 bit FPR */ + tmp = ((u64 *)child->thread.fpr) + [FPRINDEX_3264(numReg)]; } else { /* register within PT_REGS struct */ tmp = ptrace_get_reg(child, numReg); } @@ -286,8 +288,13 @@ long compat_arch_ptrace(struct task_stru freg = (freg & 0xfffffffful) | (data << 32); ret = ptrace_put_reg(child, numReg, freg); } else { + u64 *tmp; flush_fp_to_thread(child); - ((unsigned int *)child->thread.regs)[index] = data; + /* get 64 bit FPR ... */ + tmp = &(((u64 *)child->thread.fpr) + [FPRINDEX_3264(numReg)]); + /* ... write the 32 bit part we want */ + ((u32 *)tmp)[index % 2] = data; ret = 0; } break;