Re: [PATCH v2] powerpc/irq: Fix missing r2 clobber in PCREL inline assembly

["Christophe Leroy (CS GROUP)" <chleroy@kernel.org>]

Le 27/07/2026 à 12:58, Saket Kumar Bhaskar a écrit :
> In CONFIG_PPC_KERNEL_PCREL mode, r2 is no longer reserved for the TOC
> pointer and is available as a caller-saved register [0].
> 
> Both call_do_irq() and call_do_softirq() use inline assembly to call
> functions with stack switching, but fail to list r2 in their clobber
> lists. This causes the compiler to assume r2 is preserved across these
> calls, leading to register corruption when the called functions
> (__do_irq and __do_softirq) clobber r2.
> 
> As a result of this kernel crash during interrupt handling is seen and
> the kernel fails to boot:
> 
> BUG: Unable to handle kernel data access on write at 0xc000000404697638
> Faulting instruction address: 0xc0000000000181ec
> Oops: Kernel access of bad area, sig: 11 [#1]
> NIP [c0000000000181ec] __do_IRQ+0x6c/0xc0
> 
> With older GCC, the compiler would conservatively allocate
> callee-saved registers (like r31) for values spanning function calls,
> accidentally avoiding the bug:
> 
> <__do_IRQ>:
> 00 00 00 60 	nop
> a6 02 08 7c 	mflr    r0
> f8 ff e1 fb 	std     r31,-8(r1)
> f0 ff c1 fb 	std     r30,-16(r1)
> 2d 03 10 06 	pla     r31,53297316
> 
> ...
> 
> 3d e8 ff 4b 	bl      c0000000000165ac <__do_irq>
> 00 00 21 e8 	ld      r1,0(r1)
> 28 00 4d e9 	ld      r10,40(r13)
> 40 00 21 38 	addi    r1,r1,64
> 2a f9 aa 7f 	stdx    r29,r10,r31
> 
> With newer GCC 14, the compiler uses r2 for such values, exposing the
> missing clobber specification:
> 
> <__do_IRQ>:
> 00 00 00 60     nop
> a6 02 08 7c     mflr    r0
> f0 ff c1 fb     std     r30,-16(r1)
> f8 ff e1 fb     std     r31,-8(r1)
> 29 02 10 06     pla     r2,36252592     # c0000000022aadc0 <__irq_regs>
> 
> ...
> 
> 85 dc ff 4b 	bl      c000000000015ee0 <__do_irq>
> 00 00 21 e8 	ld      r1,0(r1)
> 28 00 2d e9 	ld      r9,40(r13)
> 30 00 21 38 	addi    r1,r1,48
> 2a 11 c9 7f 	stdx    r30,r9,r2
> 
> Fix this by adding r2 to the clobber list for both call_do_irq() and
> call_do_softirq() when CONFIG_PPC_KERNEL_PCREL is enabled.
> 
> [0]: https://www.mail-archive.com/gcc-patches@gcc.gnu.org/msg313226.html
> 
> Fixes: 7e3a68be42e1 ("powerpc/64: vmlinux support building with PCREL addresing")
> Signed-off-by: Saket Kumar Bhaskar <skb99@linux.ibm.com>
> ---
> Changes since v1:
> Addressed comments from Segher:
> * Modified comments to "clobber may happen"
> 
> v1: https://lore.kernel.org/all/dc021f42afa10396052499cbeda1772e30b7ca64.1784530547.git.skb99@linux.ibm.com/
> 
>   arch/powerpc/kernel/irq.c | 14 ++++++++++++--
>   1 file changed, 12 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
> index a0e8b998c9b5..b5343cfd6c9f 100644
> --- a/arch/powerpc/kernel/irq.c
> +++ b/arch/powerpc/kernel/irq.c
> @@ -218,7 +218,12 @@ static __always_inline void call_do_softirq(const void *sp)
>   		   [callee] "i" (__do_softirq)
>   		 : // Clobbers
>   		   "lr", "xer", "ctr", "memory", "cr0", "cr1", "cr5", "cr6",
> -		   "cr7", "r0", "r3", "r4", "r5", "r6", "r7", "r8", "r9", "r10",
> +		   "cr7", "r0",
> +		  /* r2 may be clobbered by the callee when using the ELFv2 ABI */

Not sure the comment is correct. You get CONFIG_PPC64_ELF_ABI_V2 without 
CONFIG_PPC_KERNEL_PCREL.

Kconfig help presents CONFIG_PPC_KERNEL_PCREL as an ABI extension.

> +#ifdef CONFIG_PPC_KERNEL_PCREL
> +		   "r2",
> +#endif
> +		   "r3", "r4", "r5", "r6", "r7", "r8", "r9", "r10",
>   		   "r11", "r12"

To minimise number of small lines I'd prefer something like:

		   "lr", "xer", "ctr", "memory", "cr0", "cr1", "cr5", "cr6", "cr7", "r0",
#ifdef CONFIG_PPC_KERNEL_PCREL
		   "r2",
#endif
		   "r3", "r4", "r5", "r6", "r7", "r8", "r9", "r10", "r11", "r12"


>   	);
>   }
> @@ -276,7 +281,12 @@ static __always_inline void call_do_irq(struct pt_regs *regs, void *sp)
>   		   [callee] "i" (__do_irq)
>   		 : // Clobbers
>   		   "lr", "xer", "ctr", "memory", "cr0", "cr1", "cr5", "cr6",
> -		   "cr7", "r0", "r4", "r5", "r6", "r7", "r8", "r9", "r10",
> +		   "cr7", "r0",
> +		  /* r2 may be clobbered by the callee when using the ELFv2 ABI */
> +#ifdef CONFIG_PPC_KERNEL_PCREL
> +		   "r2",
> +#endif
> +		   "r4", "r5", "r6", "r7", "r8", "r9", "r10",

Same

>   		   "r11", "r12"
>   	);
>   }

Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>