powerpc/64s: fix scv entry fallback flush vs interrupt
commit 08685be7761d69914f08c3d6211c543a385a5b9c upstream.
The L1D flush fallback functions are not recoverable vs interrupts,
yet the scv entry flush runs with MSR[EE]=1. This can result in a
timer (soft-NMI) or MCE or SRESET interrupt hitting here and overwriting
the EXRFI save area, which ends up corrupting userspace registers for
scv return.
Fix this by disabling RI and EE for the scv entry fallback flush.
Fixes: f79643787e
("powerpc/64s: flush L1D on kernel entry")
Cc: stable@vger.kernel.org # 5.9+ which also have flush L1D patch backport
Reported-by: Tulio Magno Quites Machado Filho <tuliom@linux.ibm.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210111062408.287092-1-npiggin@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:

committed by
Greg Kroah-Hartman

parent
1bac5333d4
commit
062dea906b
@@ -75,7 +75,7 @@ BEGIN_FTR_SECTION
|
||||
bne .Ltabort_syscall
|
||||
END_FTR_SECTION_IFSET(CPU_FTR_TM)
|
||||
#endif
|
||||
INTERRUPT_TO_KERNEL
|
||||
SCV_INTERRUPT_TO_KERNEL
|
||||
mr r10,r1
|
||||
ld r1,PACAKSAVE(r13)
|
||||
std r10,0(r1)
|
||||
|
@@ -2993,6 +2993,25 @@ TRAMP_REAL_BEGIN(entry_flush_fallback)
|
||||
ld r11,PACA_EXRFI+EX_R11(r13)
|
||||
blr
|
||||
|
||||
/*
|
||||
* The SCV entry flush happens with interrupts enabled, so it must disable
|
||||
* to prevent EXRFI being clobbered by NMIs (e.g., soft_nmi_common). r10
|
||||
* (containing LR) does not need to be preserved here because scv entry
|
||||
* puts 0 in the pt_regs, CTR can be clobbered for the same reason.
|
||||
*/
|
||||
TRAMP_REAL_BEGIN(scv_entry_flush_fallback)
|
||||
li r10,0
|
||||
mtmsrd r10,1
|
||||
lbz r10,PACAIRQHAPPENED(r13)
|
||||
ori r10,r10,PACA_IRQ_HARD_DIS
|
||||
stb r10,PACAIRQHAPPENED(r13)
|
||||
std r11,PACA_EXRFI+EX_R11(r13)
|
||||
L1D_DISPLACEMENT_FLUSH
|
||||
ld r11,PACA_EXRFI+EX_R11(r13)
|
||||
li r10,MSR_RI
|
||||
mtmsrd r10,1
|
||||
blr
|
||||
|
||||
TRAMP_REAL_BEGIN(rfi_flush_fallback)
|
||||
SET_SCRATCH0(r13);
|
||||
GET_PACA(r13);
|
||||
|
@@ -145,6 +145,13 @@ SECTIONS
|
||||
__stop___entry_flush_fixup = .;
|
||||
}
|
||||
|
||||
. = ALIGN(8);
|
||||
__scv_entry_flush_fixup : AT(ADDR(__scv_entry_flush_fixup) - LOAD_OFFSET) {
|
||||
__start___scv_entry_flush_fixup = .;
|
||||
*(__scv_entry_flush_fixup)
|
||||
__stop___scv_entry_flush_fixup = .;
|
||||
}
|
||||
|
||||
. = ALIGN(8);
|
||||
__stf_exit_barrier_fixup : AT(ADDR(__stf_exit_barrier_fixup) - LOAD_OFFSET) {
|
||||
__start___stf_exit_barrier_fixup = .;
|
||||
|
Reference in New Issue
Block a user