releases/4.10.7/powerpc-64s-fix-idle-wakeup-potential-to-clobber-registers.patch

   1 From 6d98ce0be541d4a3cfbb52cd75072c0339ebb500 Mon Sep 17 00:00:00 2001
   2 From: Nicholas Piggin <npiggin@gmail.com>
   3 Date: Fri, 17 Mar 2017 15:13:20 +1000
   4 Subject: powerpc/64s: Fix idle wakeup potential to clobber registers
   5
   6 From: Nicholas Piggin <npiggin@gmail.com>
   7
   8 commit 6d98ce0be541d4a3cfbb52cd75072c0339ebb500 upstream.
   9
  10 We concluded there may be a window where the idle wakeup code could get
  11 to pnv_wakeup_tb_loss() (which clobbers non-volatile GPRs), but the
  12 hardware may set SRR1[46:47] to 01b (no state loss) which would result
  13 in the wakeup code failing to restore non-volatile GPRs.
  14
  15 I was not able to trigger this condition with trivial tests on real
  16 hardware or simulator, but the ISA (at least 2.07) seems to allow for
  17 it, and Gautham says that it can happen if there is an exception pending
  18 when the sleep/winkle instruction is executed.
  19
  20 Fixes: 1706567117ba ("powerpc/kvm: make hypervisor state restore a function")
  21 Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
  22 Acked-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
  23 Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
  24 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  25
  26 ---
  27  arch/powerpc/kernel/idle_book3s.S |   20 +++++++++++++++++---
  28  1 file changed, 17 insertions(+), 3 deletions(-)
  29
  30 --- a/arch/powerpc/kernel/idle_book3s.S
  31 +++ b/arch/powerpc/kernel/idle_book3s.S
  32 @@ -439,9 +439,23 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
  33  _GLOBAL(pnv_wakeup_tb_loss)
  34         ld      r1,PACAR1(r13)
  35         /*
  36 -        * Before entering any idle state, the NVGPRs are saved in the stack
  37 -        * and they are restored before switching to the process context. Hence
  38 -        * until they are restored, they are free to be used.
  39 +        * Before entering any idle state, the NVGPRs are saved in the stack.
  40 +        * If there was a state loss, or PACA_NAPSTATELOST was set, then the
  41 +        * NVGPRs are restored. If we are here, it is likely that state is lost,
  42 +        * but not guaranteed -- neither ISA207 nor ISA300 tests to reach
  43 +        * here are the same as the test to restore NVGPRS:
  44 +        * PACA_THREAD_IDLE_STATE test for ISA207, PSSCR test for ISA300,
  45 +        * and SRR1 test for restoring NVGPRs.
  46 +        *
  47 +        * We are about to clobber NVGPRs now, so set NAPSTATELOST to
  48 +        * guarantee they will always be restored. This might be tightened
  49 +        * with careful reading of specs (particularly for ISA300) but this
  50 +        * is already a slow wakeup path and it's simpler to be safe.
  51 +        */
  52 +       li      r0,1
  53 +       stb     r0,PACA_NAPSTATELOST(r13)
  54 +
  55 +       /*
  56          *
  57          * Save SRR1 and LR in NVGPRs as they might be clobbered in
  58          * opal_call() (called in CHECK_HMI_INTERRUPT). SRR1 is required