Fix Kernel crash for MIPS rel6 in jump label branch function.

Commit Message

Archer Yan March 8, 2019, 3:29 a.m. UTC

Insert Branch instruction instead of NOP to make sure assembler don't
patch code in forbidden slot. In jump label function, it might
be possible to patch Control Transfer Instructions(CTIs) into
forbidden slot, which will generate Reserved Instruction exception
in MIPS release 6.

Signed-off-by: Archer Yan <[e-mail]>
Reviewed-by: Paul Burton <[e-mail]>
---
 arch/mips/include/asm/jump_label.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

Comments

Paul Burton March 11, 2019, 6:14 p.m. UTC | #1

Hello,

Archer Yan wrote:
> Insert Branch instruction instead of NOP to make sure assembler don't
> patch code in forbidden slot. In jump label function, it might
> be possible to patch Control Transfer Instructions(CTIs) into
> forbidden slot, which will generate Reserved Instruction exception
> in MIPS release 6.
> 
> Signed-off-by: Archer Yan <[e-mail]>
> Reviewed-by: Paul Burton <[e-mail]>

Applied to mips-fixes.

Thanks,
    Paul

[ This message was auto-generated; if you believe anything is incorrect
  then please email [e-mail] to report it. ]

Patch

diff --git a/arch/mips/include/asm/jump_label.h b/arch/mips/include/asm/jump_label.h
index e77672539e8e..e4456e450f94 100644
--- a/arch/mips/include/asm/jump_label.h
+++ b/arch/mips/include/asm/jump_label.h
@@ -21,15 +21,15 @@ 
 #endif
 
 #ifdef CONFIG_CPU_MICROMIPS
-#define NOP_INSN "nop32"
+#define B_INSN "b32"
 #else
-#define NOP_INSN "nop"
+#define B_INSN "b"
 #endif
 
 static __always_inline bool arch_static_branch(struct static_key *key, bool branch)
 {
-	asm_volatile_goto("1:\t" NOP_INSN "\n\t"
-		"nop\n\t"
+	asm_volatile_goto("1:\t" B_INSN " 2f\n\t"
+		"2:\tnop\n\t"
 		".pushsection __jump_table,  \"aw\"\n\t"
 		WORD_INSN " 1b, %l[l_yes], %0\n\t"
 		".popsection\n\t"