In relocate_32.S, function clear_utlb_entry() goes into real mode. To
do so, it has to calculate the physical address based on the virtual
address. To get the virtual address it uses 'bl' which is problematic
(see commit c974809a26a1 ("powerpc/vdso: Avoid link stack corruption
in __get_datapage()")). In addition, the calculation is done on a
wrong address because 'bl' loads LR with the address of the following
instruction, not the address of the target. So when the target is not
the instruction following the 'bl' instruction, it may lead to
unexpected behaviour.

Fix it by re-writing the code so that is goes via another path which
is based 'bcl 20,31,.+4' which is the right instruction to use for that.

Fixes: 683430200315 ("powerpc/47x: Kernel support for KEXEC")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
---
v2: Fixed patch description and added Fixes: tag.
[Previous patch subject was "powerpc: Fix address calculation in clear_utlb_entry()"]
---
 arch/powerpc/kexec/relocate_32.S | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/arch/powerpc/kexec/relocate_32.S b/arch/powerpc/kexec/relocate_32.S
index 104c9911f406..dd86e338307d 100644
--- a/arch/powerpc/kexec/relocate_32.S
+++ b/arch/powerpc/kexec/relocate_32.S
@@ -348,16 +348,13 @@ write_utlb:
 	rlwinm	r10, r24, 0, 22, 27
 
 	cmpwi	r10, PPC47x_TLB0_4K
-	bne	0f
 	li	r10, 0x1000			/* r10 = 4k */
-	ANNOTATE_INTRA_FUNCTION_CALL
-	bl	1f
+	beq	0f
 
-0:
 	/* Defaults to 256M */
 	lis	r10, 0x1000
 
-	bcl	20,31,$+4
+0:	bcl	20,31,$+4
 1:	mflr	r4
 	addi	r4, r4, (2f-1b)			/* virtual address  of 2f */
 
-- 
2.47.0

On Thu, 06 Mar 2025 11:24:28 +0100, Christophe Leroy wrote:
> In relocate_32.S, function clear_utlb_entry() goes into real mode. To
> do so, it has to calculate the physical address based on the virtual
> address. To get the virtual address it uses 'bl' which is problematic
> (see commit c974809a26a1 ("powerpc/vdso: Avoid link stack corruption
> in __get_datapage()")). In addition, the calculation is done on a
> wrong address because 'bl' loads LR with the address of the following
> instruction, not the address of the target. So when the target is not
> the instruction following the 'bl' instruction, it may lead to
> unexpected behaviour.
> 
> [...]

Applied to powerpc/next.

[1/1] powerpc/kexec: fix physical address calculation in clear_utlb_entry()
      https://git.kernel.org/powerpc/c/861efb8a48ee8b73ae4e8817509cd4e82fd52bc4

Thanks