sparc64: Fix corrupted thread fault code.

Every path that ends up at do_sparc64_fault() must install a valid
FAULT_CODE_* bitmask in the per-thread fault code byte.

Two paths leading to the label winfix_trampoline (which expects the
FAULT_CODE_* mask in register %g4) were not doing so:

1) For pre-hypervisor TLB protection violation traps, if we took
   the 'winfix_trampoline' path we wouldn't have %g4 initialized
   with the FAULT_CODE_* value yet.  Resulting in using the
   TLB_TAG_ACCESS register address value instead.

2) In the TSB miss path, when we notice that we are going to use a
   hugepage mapping, but we haven't allocated the hugepage TSB yet, we
   still have to take the window fixup case into consideration and
   in that particular path we leave %g4 not setup properly.

Errors on this sort were largely invisible previously, but after
commit 4ccb9272892c33ef1c19a783cfa87103b30c2784 ("sparc64: sun4v TLB
error power off events") we now have a fault_code mask bit
(FAULT_CODE_BAD_RA) that triggers due to this bug.

FAULT_CODE_BAD_RA triggers because this bit is set in TLB_TAG_ACCESS
(see #1 above) and thus we get seemingly random bus errors triggered
for user processes.

Fixes: 4ccb9272892c ("sparc64: sun4v TLB error power off events")
Reported-by: Meelis Roos <mroos@linux.ee>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/arch/sparc/kernel/dtlb_prot.S b/arch/sparc/kernel/dtlb_prot.S
index b2c2c5be281c436f25b8cb66353546d9fcd8f82c..d668ca149e647ac832f88b3602134768d712ef80 100644 (file)
--- a/arch/sparc/kernel/dtlb_prot.S
+++ b/arch/sparc/kernel/dtlb_prot.S
@@ -24,11 +24,11 @@
        mov             TLB_TAG_ACCESS, %g4             ! For reload of vaddr
 
 /* PROT ** ICACHE line 2: More real fault processing */
+       ldxa            [%g4] ASI_DMMU, %g5             ! Put tagaccess in %g5
        bgu,pn          %xcc, winfix_trampoline         ! Yes, perform winfixup
-        ldxa           [%g4] ASI_DMMU, %g5             ! Put tagaccess in %g5
-       ba,pt           %xcc, sparc64_realfault_common  ! Nope, normal fault
         mov            FAULT_CODE_DTLB | FAULT_CODE_WRITE, %g4
-       nop
+       ba,pt           %xcc, sparc64_realfault_common  ! Nope, normal fault
+        nop
        nop
        nop
        nop

diff --git a/arch/sparc/kernel/tsb.S b/arch/sparc/kernel/tsb.S
index 14158d40ba766d05917482029edd93546078281d..be98685c14c62301250db79791269fb411ea9e0a 100644 (file)
--- a/arch/sparc/kernel/tsb.S
+++ b/arch/sparc/kernel/tsb.S
@@ -162,10 +162,10 @@ tsb_miss_page_table_walk_sun4v_fastpath:
        nop
        .previous
 
-       rdpr    %tl, %g3
-       cmp     %g3, 1
+       rdpr    %tl, %g7
+       cmp     %g7, 1
        bne,pn  %xcc, winfix_trampoline
-        nop
+        mov    %g3, %g4
        ba,pt   %xcc, etrap
         rd     %pc, %g7
        call    hugetlb_setup