• Michael Neuling's avatar
    powerpc: Fix undetected data corruption with P9N DD2.1 VSX CI load emulation · 1da4a027
    Michael Neuling authored
    __get_user_atomic_128_aligned() stores to kaddr using stvx which is a
    VMX store instruction, hence kaddr must be 16 byte aligned otherwise
    the store won't occur as expected.
    
    Unfortunately when we call __get_user_atomic_128_aligned() in
    p9_hmi_special_emu(), the buffer we pass as kaddr (ie. vbuf) isn't
    guaranteed to be 16B aligned. This means that the write to vbuf in
    __get_user_atomic_128_aligned() has the bottom bits of the address
    truncated. This results in other local variables being
    overwritten. Also vbuf will not contain the correct data which results
    in the userspace emulation being wrong and hence undetected user data
    corruption.
    
    In the past we've been mostly lucky as vbuf has ended up aligned but
    this is fragile and isn't always true. CONFIG_STACKPROTECTOR in
    particular can change the stack arrangement enough that our luck runs
    out.
    
    This issue only occurs on POWER9 Nimbus <= DD2.1 bare metal.
    
    The fix is to align vbuf to a 16 byte boundary.
    
    Fixes: 5080332c ("powerpc/64s: Add workaround for P9 vector CI load issue")
    Cc: stable@vger.kernel.org # v4.15+
    Signed-off-by: default avatarMichael Neuling <mikey@neuling.org>
    Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
    Link: https://lore.kernel.org/r/20201013043741.743413-1-mikey@neuling.org
    1da4a027
traps.c 59.7 KB