powerpc/e6500: hw tablewalk: fix recursive tlb lock on cpu 0 (1cb4ed92) · Commits · e / devices / android_kernel_fairphone_FP3

Commit "TLB lock recursive" introduced a bug whereby cpu 0 uses the same value for "lock held" as is used to indicate that the lock is free. This means that cpu 1 can acquire the lock whenever it wants, regardless of whether cpu 0 has it locked, which in turn means we can get duplicate TLB entries. Add one to the CPU value to ensure we do not use zero as a "lock held" value. Signed-off-by:

Scott Wood <scottwood@freescale.com> Reported-by:

Ed Swarthout <ed.swarthout@freescale.com>

arch/powerpc/mm/tlb_low_64e.S

+2 −1

Original line number	Original line	Diff line number	Diff line
	@@ -296,7 +296,7 @@ itlb_miss_fault_bolted:
	* r14 = page table base		* r14 = page table base
	* r13 = PACA		* r13 = PACA
	* r11 = tlb_per_core ptr		* r11 = tlb_per_core ptr
	* r10 = cpu number		* r10 = crap (free to use)
	*/		*/
	tlb_miss_common_e6500:		tlb_miss_common_e6500:
	/*		/*
	@@ -309,6 +309,7 @@ tlb_miss_common_e6500:
	lhz r10,PACAPACAINDEX(r13)		lhz r10,PACAPACAINDEX(r13)
	cmpdi r15,0		cmpdi r15,0
	cmpdi cr1,r15,1 /* set cr1.eq = 0 for non-recursive */		cmpdi cr1,r15,1 /* set cr1.eq = 0 for non-recursive */
			addi r10,r10,1
	bne 2f		bne 2f
	stbcx. r10,0,r11		stbcx. r10,0,r11
	bne 1b		bne 1b