Code: int do_mathemu(struct pt_regs *regs, struct fpustate *f)
{
	unsigned long pc = regs->tpc;
	unsigned long tstate = regs->tstate;
	u32 insn = 0;
	int type = 0;
	/* ftt tells which ftt it may happen in, r is rd, b is rs2 and a is rs1. The *u arg tells
	   whether the argument should be packed/unpacked (0 - do not unpack/pack, 1 - unpack/pack)
	   non-u args tells the size of the argument (0 - no argument, 1 - single, 2 - double, 3 - quad */
#define TYPE(ftt, r, ru, b, bu, a, au) type = (au << 2) | (a << 0) | (bu << 5) | (b << 3) | (ru << 8) | (r << 6) | (ftt << 9)
	int freg;
	static u64 zero[2] = { 0L, 0L };
	int flags;
	FP_DECL_EX;
	FP_DECL_S(SA); FP_DECL_S(SB); FP_DECL_S(SR);
	FP_DECL_D(DA); FP_DECL_D(DB); FP_DECL_D(DR);
	FP_DECL_Q(QA); FP_DECL_Q(QB); FP_DECL_Q(QR);
	int IR;
	long XR, xfsr;
 
 	if (tstate & TSTATE_PRIV)
 		die_if_kernel("unfinished/unimplemented FPop from kernel", regs);
	perf_sw_event(PERF_COUNT_SW_EMULATION_FAULTS, 1, 0, regs, 0);
 	if (test_thread_flag(TIF_32BIT))
 		pc = (u32)pc;
 	if (get_user(insn, (u32 __user *) pc) != -EFAULT) {
		if ((insn & 0xc1f80000) == 0x81a00000) /* FPOP1 */ {
			switch ((insn >> 5) & 0x1ff) {
			/* QUAD - ftt == 3 */
			case FMOVQ:
			case FNEGQ:
			case FABSQ: TYPE(3,3,0,3,0,0,0); break;
			case FSQRTQ: TYPE(3,3,1,3,1,0,0); break;
			case FADDQ:
			case FSUBQ:
			case FMULQ:
			case FDIVQ: TYPE(3,3,1,3,1,3,1); break;
			case FDMULQ: TYPE(3,3,1,2,1,2,1); break;
			case FQTOX: TYPE(3,2,0,3,1,0,0); break;
			case FXTOQ: TYPE(3,3,1,2,0,0,0); break;
			case FQTOS: TYPE(3,1,1,3,1,0,0); break;
			case FQTOD: TYPE(3,2,1,3,1,0,0); break;
			case FITOQ: TYPE(3,3,1,1,0,0,0); break;
			case FSTOQ: TYPE(3,3,1,1,1,0,0); break;
			case FDTOQ: TYPE(3,3,1,2,1,0,0); break;
			case FQTOI: TYPE(3,1,0,3,1,0,0); break;

			/* We can get either unimplemented or unfinished
			 * for these cases.  Pre-Niagara systems generate
			 * unfinished fpop for SUBNORMAL cases, and Niagara
			 * always gives unimplemented fpop for fsqrt{s,d}.
			 */
			case FSQRTS: {
				unsigned long x = current_thread_info()->xfsr[0];

				x = (x >> 14) & 0xf;
				TYPE(x,1,1,1,1,0,0);
				break;
			}

			case FSQRTD: {
				unsigned long x = current_thread_info()->xfsr[0];

				x = (x >> 14) & 0xf;
				TYPE(x,2,1,2,1,0,0);
				break;
			}

			/* SUBNORMAL - ftt == 2 */
			case FADDD:
			case FSUBD:
			case FMULD:
			case FDIVD: TYPE(2,2,1,2,1,2,1); break;
			case FADDS:
			case FSUBS:
			case FMULS:
			case FDIVS: TYPE(2,1,1,1,1,1,1); break;
			case FSMULD: TYPE(2,2,1,1,1,1,1); break;
			case FSTOX: TYPE(2,2,0,1,1,0,0); break;
			case FDTOX: TYPE(2,2,0,2,1,0,0); break;
			case FDTOS: TYPE(2,1,1,2,1,0,0); break;
			case FSTOD: TYPE(2,2,1,1,1,0,0); break;
			case FSTOI: TYPE(2,1,0,1,1,0,0); break;
			case FDTOI: TYPE(2,1,0,2,1,0,0); break;

			/* Only Ultra-III generates these */
			case FXTOS: TYPE(2,1,1,2,0,0,0); break;
			case FXTOD: TYPE(2,2,1,2,0,0,0); break;
#if 0			/* Optimized inline in sparc64/kernel/entry.S */
			case FITOS: TYPE(2,1,1,1,0,0,0); break;
#endif
			case FITOD: TYPE(2,2,1,1,0,0,0); break;
			}
		}
		else if ((insn & 0xc1f80000) == 0x81a80000) /* FPOP2 */ {
			IR = 2;
			switch ((insn >> 5) & 0x1ff) {
			case FCMPQ: TYPE(3,0,0,3,1,3,1); break;
			case FCMPEQ: TYPE(3,0,0,3,1,3,1); break;
			/* Now the conditional fmovq support */
			case FMOVQ0:
			case FMOVQ1:
			case FMOVQ2:
			case FMOVQ3:
				/* fmovq %fccX, %fY, %fZ */
				if (!((insn >> 11) & 3))
					XR = current_thread_info()->xfsr[0] >> 10;
				else
					XR = current_thread_info()->xfsr[0] >> (30 + ((insn >> 10) & 0x6));
				XR &= 3;
				IR = 0;
				switch ((insn >> 14) & 0x7) {
				/* case 0: IR = 0; break; */			/* Never */
				case 1: if (XR) IR = 1; break;			/* Not Equal */
				case 2: if (XR == 1 || XR == 2) IR = 1; break;	/* Less or Greater */
				case 3: if (XR & 1) IR = 1; break;		/* Unordered or Less */
				case 4: if (XR == 1) IR = 1; break;		/* Less */
				case 5: if (XR & 2) IR = 1; break;		/* Unordered or Greater */
				case 6: if (XR == 2) IR = 1; break;		/* Greater */
				case 7: if (XR == 3) IR = 1; break;		/* Unordered */
				}
				if ((insn >> 14) & 8)
					IR ^= 1;
				break;
			case FMOVQI:
			case FMOVQX:
				/* fmovq %[ix]cc, %fY, %fZ */
				XR = regs->tstate >> 32;
				if ((insn >> 5) & 0x80)
					XR >>= 4;
				XR &= 0xf;
				IR = 0;
				freg = ((XR >> 2) ^ XR) & 2;
				switch ((insn >> 14) & 0x7) {
				/* case 0: IR = 0; break; */			/* Never */
				case 1: if (XR & 4) IR = 1; break;		/* Equal */
				case 2: if ((XR & 4) || freg) IR = 1; break;	/* Less or Equal */
				case 3: if (freg) IR = 1; break;		/* Less */
				case 4: if (XR & 5) IR = 1; break;		/* Less or Equal Unsigned */
				case 5: if (XR & 1) IR = 1; break;		/* Carry Set */
				case 6: if (XR & 8) IR = 1; break;		/* Negative */
				case 7: if (XR & 2) IR = 1; break;		/* Overflow Set */
				}
				if ((insn >> 14) & 8)
					IR ^= 1;
				break;
			case FMOVQZ:
			case FMOVQLE:
			case FMOVQLZ:
			case FMOVQNZ:
			case FMOVQGZ:
			case FMOVQGE:
				freg = (insn >> 14) & 0x1f;
				if (!freg)
					XR = 0;
				else if (freg < 16)
					XR = regs->u_regs[freg];
				else if (test_thread_flag(TIF_32BIT)) {
					struct reg_window32 __user *win32;
					flushw_user ();
					win32 = (struct reg_window32 __user *)((unsigned long)((u32)regs->u_regs[UREG_FP]));
					get_user(XR, &win32->locals[freg - 16]);
				} else {
					struct reg_window __user *win;
					flushw_user ();
					win = (struct reg_window __user *)(regs->u_regs[UREG_FP] + STACK_BIAS);
					get_user(XR, &win->locals[freg - 16]);
				}
				IR = 0;
				switch ((insn >> 10) & 3) {
				case 1: if (!XR) IR = 1; break;			/* Register Zero */
				case 2: if (XR <= 0) IR = 1; break;		/* Register Less Than or Equal to Zero */
				case 3: if (XR < 0) IR = 1; break;		/* Register Less Than Zero */
				}
				if ((insn >> 10) & 4)
					IR ^= 1;
				break;
			}
			if (IR == 0) {
				/* The fmov test was false. Do a nop instead */
				current_thread_info()->xfsr[0] &= ~(FSR_CEXC_MASK);
				regs->tpc = regs->tnpc;
				regs->tnpc += 4;
				return 1;
			} else if (IR == 1) {
				/* Change the instruction into plain fmovq */
				insn = (insn & 0x3e00001f) | 0x81a00060;
				TYPE(3,3,0,3,0,0,0); 
			}
		}
	}
	if (type) {
		argp rs1 = NULL, rs2 = NULL, rd = NULL;
		
		freg = (current_thread_info()->xfsr[0] >> 14) & 0xf;
		if (freg != (type >> 9))
			goto err;
		current_thread_info()->xfsr[0] &= ~0x1c000;
		freg = ((insn >> 14) & 0x1f);
		switch (type & 0x3) {
		case 3: if (freg & 2) {
				current_thread_info()->xfsr[0] |= (6 << 14) /* invalid_fp_register */;
				goto err;
			}
		case 2: freg = ((freg & 1) << 5) | (freg & 0x1e);
		case 1: rs1 = (argp)&f->regs[freg];
			flags = (freg < 32) ? FPRS_DL : FPRS_DU; 
			if (!(current_thread_info()->fpsaved[0] & flags))
				rs1 = (argp)&zero;
			break;
		}
		switch (type & 0x7) {
		case 7: FP_UNPACK_QP (QA, rs1); break;
		case 6: FP_UNPACK_DP (DA, rs1); break;
		case 5: FP_UNPACK_SP (SA, rs1); break;
		}
		freg = (insn & 0x1f);
		switch ((type >> 3) & 0x3) {
		case 3: if (freg & 2) {
				current_thread_info()->xfsr[0] |= (6 << 14) /* invalid_fp_register */;
				goto err;
			}
		case 2: freg = ((freg & 1) << 5) | (freg & 0x1e);
		case 1: rs2 = (argp)&f->regs[freg];
			flags = (freg < 32) ? FPRS_DL : FPRS_DU; 
			if (!(current_thread_info()->fpsaved[0] & flags))
				rs2 = (argp)&zero;
			break;
		}
		switch ((type >> 3) & 0x7) {
		case 7: FP_UNPACK_QP (QB, rs2); break;
		case 6: FP_UNPACK_DP (DB, rs2); break;
		case 5: FP_UNPACK_SP (SB, rs2); break;
		}
		freg = ((insn >> 25) & 0x1f);
		switch ((type >> 6) & 0x3) {
		case 3: if (freg & 2) {
				current_thread_info()->xfsr[0] |= (6 << 14) /* invalid_fp_register */;
				goto err;
			}
		case 2: freg = ((freg & 1) << 5) | (freg & 0x1e);
		case 1: rd = (argp)&f->regs[freg];
			flags = (freg < 32) ? FPRS_DL : FPRS_DU; 
			if (!(current_thread_info()->fpsaved[0] & FPRS_FEF)) {
				current_thread_info()->fpsaved[0] = FPRS_FEF;
				current_thread_info()->gsr[0] = 0;
			}
			if (!(current_thread_info()->fpsaved[0] & flags)) {
				if (freg < 32)
					memset(f->regs, 0, 32*sizeof(u32));
				else
					memset(f->regs+32, 0, 32*sizeof(u32));
			}
			current_thread_info()->fpsaved[0] |= flags;
			break;
		}
		switch ((insn >> 5) & 0x1ff) {
		/* + */
		case FADDS: FP_ADD_S (SR, SA, SB); break;
		case FADDD: FP_ADD_D (DR, DA, DB); break;
		case FADDQ: FP_ADD_Q (QR, QA, QB); break;
		/* - */
		case FSUBS: FP_SUB_S (SR, SA, SB); break;
		case FSUBD: FP_SUB_D (DR, DA, DB); break;
		case FSUBQ: FP_SUB_Q (QR, QA, QB); break;
		/* * */
		case FMULS: FP_MUL_S (SR, SA, SB); break;
		case FSMULD: FP_CONV (D, S, 1, 1, DA, SA);
			     FP_CONV (D, S, 1, 1, DB, SB);
		case FMULD: FP_MUL_D (DR, DA, DB); break;
		case FDMULQ: FP_CONV (Q, D, 2, 1, QA, DA);
			     FP_CONV (Q, D, 2, 1, QB, DB);
		case FMULQ: FP_MUL_Q (QR, QA, QB); break;
		/* / */
		case FDIVS: FP_DIV_S (SR, SA, SB); break;
		case FDIVD: FP_DIV_D (DR, DA, DB); break;
		case FDIVQ: FP_DIV_Q (QR, QA, QB); break;
		/* sqrt */
		case FSQRTS: FP_SQRT_S (SR, SB); break;
		case FSQRTD: FP_SQRT_D (DR, DB); break;
		case FSQRTQ: FP_SQRT_Q (QR, QB); break;
		/* mov */
		case FMOVQ: rd->q[0] = rs2->q[0]; rd->q[1] = rs2->q[1]; break;
		case FABSQ: rd->q[0] = rs2->q[0] & 0x7fffffffffffffffUL; rd->q[1] = rs2->q[1]; break;
		case FNEGQ: rd->q[0] = rs2->q[0] ^ 0x8000000000000000UL; rd->q[1] = rs2->q[1]; break;
		/* float to int */
		case FSTOI: FP_TO_INT_S (IR, SB, 32, 1); break;
		case FDTOI: FP_TO_INT_D (IR, DB, 32, 1); break;
		case FQTOI: FP_TO_INT_Q (IR, QB, 32, 1); break;
		case FSTOX: FP_TO_INT_S (XR, SB, 64, 1); break;
		case FDTOX: FP_TO_INT_D (XR, DB, 64, 1); break;
		case FQTOX: FP_TO_INT_Q (XR, QB, 64, 1); break;
		/* int to float */
		case FITOQ: IR = rs2->s; FP_FROM_INT_Q (QR, IR, 32, int); break;
		case FXTOQ: XR = rs2->d; FP_FROM_INT_Q (QR, XR, 64, long); break;
		/* Only Ultra-III generates these */
		case FXTOS: XR = rs2->d; FP_FROM_INT_S (SR, XR, 64, long); break;
		case FXTOD: XR = rs2->d; FP_FROM_INT_D (DR, XR, 64, long); break;
#if 0		/* Optimized inline in sparc64/kernel/entry.S */
		case FITOS: IR = rs2->s; FP_FROM_INT_S (SR, IR, 32, int); break;
#endif
		case FITOD: IR = rs2->s; FP_FROM_INT_D (DR, IR, 32, int); break;
		/* float to float */
		case FSTOD: FP_CONV (D, S, 1, 1, DR, SB); break;
		case FSTOQ: FP_CONV (Q, S, 2, 1, QR, SB); break;
		case FDTOQ: FP_CONV (Q, D, 2, 1, QR, DB); break;
		case FDTOS: FP_CONV (S, D, 1, 1, SR, DB); break;
		case FQTOS: FP_CONV (S, Q, 1, 2, SR, QB); break;
		case FQTOD: FP_CONV (D, Q, 1, 2, DR, QB); break;
		/* comparison */
		case FCMPQ:
		case FCMPEQ:
			FP_CMP_Q(XR, QB, QA, 3);
			if (XR == 3 &&
			    (((insn >> 5) & 0x1ff) == FCMPEQ ||
			     FP_ISSIGNAN_Q(QA) ||
			     FP_ISSIGNAN_Q(QB)))
				FP_SET_EXCEPTION (FP_EX_INVALID);
		}
		if (!FP_INHIBIT_RESULTS) {
			switch ((type >> 6) & 0x7) {
			case 0: xfsr = current_thread_info()->xfsr[0];
				if (XR == -1) XR = 2;
				switch (freg & 3) {
				/* fcc0, 1, 2, 3 */
				case 0: xfsr &= ~0xc00; xfsr |= (XR << 10); break;
				case 1: xfsr &= ~0x300000000UL; xfsr |= (XR << 32); break;
				case 2: xfsr &= ~0xc00000000UL; xfsr |= (XR << 34); break;
				case 3: xfsr &= ~0x3000000000UL; xfsr |= (XR << 36); break;
				}
				current_thread_info()->xfsr[0] = xfsr;
				break;
			case 1: rd->s = IR; break;
			case 2: rd->d = XR; break;
			case 5: FP_PACK_SP (rd, SR); break;
			case 6: FP_PACK_DP (rd, DR); break;
			case 7: FP_PACK_QP (rd, QR); break;
			}
		}

		if(_fex != 0)
			return record_exception(regs, _fex);

		/* Success and no exceptions detected. */
		current_thread_info()->xfsr[0] &= ~(FSR_CEXC_MASK);
		regs->tpc = regs->tnpc;
		regs->tnpc += 4;
		return 1;
	}
err:	return 0;
}

Vulnerability Type: DoS Overflow 
CWE ID: CWE-399
Summary: The Performance Events subsystem in the Linux kernel before 3.1 does not properly handle event overflows associated with PERF_COUNT_SW_CPU_CLOCK events, which allows local users to cause a denial of service (system hang) via a crafted application.
Commit Message: perf: Remove the nmi parameter from the swevent and overflow interface

The nmi parameter indicated if we could do wakeups from the current
context, if not, we would set some state and self-IPI and let the
resulting interrupt do the wakeup.

For the various event classes:

  - hardware: nmi=0; PMI is in fact an NMI or we run irq_work_run from
    the PMI-tail (ARM etc.)
  - tracepoint: nmi=0; since tracepoint could be from NMI context.
  - software: nmi=[0,1]; some, like the schedule thing cannot
    perform wakeups, and hence need 0.

As one can see, there is very little nmi=1 usage, and the down-side of
not using it is that on some platforms some software events can have a
jiffy delay in wakeup (when arch_irq_work_raise isn't implemented).

The up-side however is that we can remove the nmi parameter and save a
bunch of conditionals in fast paths.

Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Michael Cree <mcree@orcon.net.nz>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Deng-Cheng Zhu <dengcheng.zhu@gmail.com>
Cc: Anton Blanchard <anton@samba.org>
Cc: Eric B Munson <emunson@mgebm.net>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Paul Mundt <lethal@linux-sh.org>
Cc: David S. Miller <davem@davemloft.net>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Jason Wessel <jason.wessel@windriver.com>
Cc: Don Zickus <dzickus@redhat.com>
Link: http://lkml.kernel.org/n/tip-agjev8eu666tvknpb3iaj0fg@git.kernel.org
Signed-off-by: Ingo Molnar <mingo@elte.hu>