Re: [PATCH v3] powerpc/irq: Fix missing r2 clobber in PCREL inline assembly

On 03/08/26 10:58 am, Saket Kumar Bhaskar wrote:
> In CONFIG_PPC_KERNEL_PCREL mode, r2 is no longer reserved for the TOC
> pointer and is available as a caller-saved register [0].
> 
> Both call_do_irq() and call_do_softirq() use inline assembly to call
> functions with stack switching, but fail to list r2 in their clobber
> lists. This causes the compiler to assume r2 is preserved across these
> calls, leading to register corruption when the called functions
> (__do_irq and __do_softirq) clobber r2.
> 
> As a result of this kernel crash during interrupt handling is seen and
> the kernel fails to boot:
> 
> BUG: Unable to handle kernel data access on write at 0xc000000404697638
> Faulting instruction address: 0xc0000000000181ec
> Oops: Kernel access of bad area, sig: 11 [#1]
> NIP [c0000000000181ec] __do_IRQ+0x6c/0xc0
> 
> With older GCC, the compiler would conservatively allocate
> callee-saved registers (like r31) for values spanning function calls,
> accidentally avoiding the bug:
> 
> <__do_IRQ>:
> 00 00 00 60 	nop
> a6 02 08 7c 	mflr    r0
> f8 ff e1 fb 	std     r31,-8(r1)
> f0 ff c1 fb 	std     r30,-16(r1)
> 2d 03 10 06 	pla     r31,53297316
> 
> ...
> 
> 3d e8 ff 4b 	bl      c0000000000165ac <__do_irq>
> 00 00 21 e8 	ld      r1,0(r1)
> 28 00 4d e9 	ld      r10,40(r13)
> 40 00 21 38 	addi    r1,r1,64
> 2a f9 aa 7f 	stdx    r29,r10,r31
> 
> With newer GCC 14, the compiler uses r2 for such values, exposing the
> missing clobber specification:
> 
> <__do_IRQ>:
> 00 00 00 60     nop
> a6 02 08 7c     mflr    r0
> f0 ff c1 fb     std     r30,-16(r1)
> f8 ff e1 fb     std     r31,-8(r1)
> 29 02 10 06     pla     r2,36252592     # c0000000022aadc0 <__irq_regs>
> 
> ...
> 
> 85 dc ff 4b 	bl      c000000000015ee0 <__do_irq>
> 00 00 21 e8 	ld      r1,0(r1)
> 28 00 2d e9 	ld      r9,40(r13)
> 30 00 21 38 	addi    r1,r1,48
> 2a 11 c9 7f 	stdx    r30,r9,r2
> 
> Fix this by adding r2 to the clobber list for both call_do_irq() and
> call_do_softirq() when CONFIG_PPC_KERNEL_PCREL is enabled.
> 
> [0]: https://www.mail-archive.com/[email protected]/msg313226.html
> 

Reviewed-by: Hari Bathini <[email protected]>

> Fixes: 7e3a68be42e1 ("powerpc/64: vmlinux support building with PCREL addresing")
> Signed-off-by: Saket Kumar Bhaskar <[email protected]>
> Reviewed-by: Christophe Leroy (CS GROUP) <[email protected]>
> ---
> 
> Changes since v1:
> Addressed comments from Segher:
> * Modified comments to "clobber may happen"
> 
> v1: https://lore.kernel.org/all/dc021f42afa10396052499cbeda1772e30b7ca64.1784530547.git.skb99@linux.ibm.com/
> 
> Changes since v2:
> Addressed comments from Christophe:
> * Modified comments.
> * Adjusted the clobber list change to minimize number of small lines.
> 
> v2: https://lore.kernel.org/all/7c84fa5e24263d8247b4723118e6130d63b40912.1785131859.git.skb99@linux.ibm.com/
> 
>   arch/powerpc/kernel/irq.c | 16 ++++++++++++----
>   1 file changed, 12 insertions(+), 4 deletions(-)
> 
> diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
> index a0e8b998c9b5..cb010830c1c4 100644
> --- a/arch/powerpc/kernel/irq.c
> +++ b/arch/powerpc/kernel/irq.c
> @@ -217,8 +217,12 @@ static __always_inline void call_do_softirq(const void *sp)
>   		   [sp] "b" (sp), [offset] "i" (THREAD_SIZE - STACK_FRAME_MIN_SIZE),
>   		   [callee] "i" (__do_softirq)
>   		 : // Clobbers
> -		   "lr", "xer", "ctr", "memory", "cr0", "cr1", "cr5", "cr6",
> -		   "cr7", "r0", "r3", "r4", "r5", "r6", "r7", "r8", "r9", "r10",
> +		   "lr", "xer", "ctr", "memory", "cr0", "cr1", "cr5", "cr6", "cr7", "r0",
> +		  /* r2 may be clobbered by the callee when using PCREL mode in the ELFv2 ABI. */
> +#ifdef CONFIG_PPC_KERNEL_PCREL
> +		   "r2",
> +#endif
> +		   "r3", "r4", "r5", "r6", "r7", "r8", "r9", "r10",
>   		   "r11", "r12"
>   	);
>   }
> @@ -275,8 +279,12 @@ static __always_inline void call_do_irq(struct pt_regs *regs, void *sp)
>   		   [sp] "b" (sp), [offset] "i" (THREAD_SIZE - STACK_FRAME_MIN_SIZE),
>   		   [callee] "i" (__do_irq)
>   		 : // Clobbers
> -		   "lr", "xer", "ctr", "memory", "cr0", "cr1", "cr5", "cr6",
> -		   "cr7", "r0", "r4", "r5", "r6", "r7", "r8", "r9", "r10",
> +		   "lr", "xer", "ctr", "memory", "cr0", "cr1", "cr5", "cr6", "cr7", "r0",
> +		  /* r2 may be clobbered by the callee when using PCREL mode in the ELFv2 ABI. */
> +#ifdef CONFIG_PPC_KERNEL_PCREL
> +		   "r2",
> +#endif
> +		   "r4", "r5", "r6", "r7", "r8", "r9", "r10",
>   		   "r11", "r12"
>   	);
>   }