[PATCH v2] sh: lib: Restore r4 in shift helpers

[PATCH v2] sh: lib: Restore r4 in shift helpers

[Florian Fuchs]

Commit 940d4113f330 ("sh: New gcc support") reuses r4 as scratch for
the jump table offset and pops the saved value into r0 in the jmp
delay slot, so the helpers return with r4 still holding the table
byte. GCC can keep a live value in r4 across the call, which leads to
runtime data corruption.

GCC calls __ashlsi3, __ashrsi3 and __lshrsi3 with a special convention:
value in r4, result in r0, and only r0 and T clobbered.

Pop the saved value back into r4 before the jmp and copy it to r0 in
the delay slot. The shift sequences only operate on r0, so r4 is now
preserved across the whole call.

Fixes: 940d4113f330 ("sh: New gcc support")
Signed-off-by: Florian Fuchs <fuchsfl@gmail.com>
---
v1->v2: Make commit message more accurate

v1: https://lore.kernel.org/linux-sh/20260714104147.2016549-1-fuchsfl@gmail.com/

Without the patch, the early boot on e.g J2 gets a kernel BUG at
mm/percpu.c:2604 / "can't handle more than one group."
        PCPU_SETUP_BUG_ON(pcpu_verify_alloc_info(ai) < 0);
As the static condition in mm/percpu-km.c wasn't true:
        ai->nr_groups != 1
nr_groups contained 60 - the clobbered value from the shift helper.

This change was tested on the J2 core on the Mimas v2 board. It can
theoretically also target other SH2 devices, but I don't have any other
than J2 sadly.

The flow of operations matches now the state in the libgcc, see also
in gcc: libgcc/config/sh/lib1funcs.S

 arch/sh/lib/ashlsi3.S | 3 ++-
 arch/sh/lib/ashrsi3.S | 3 ++-
 arch/sh/lib/lshrsi3.S | 3 ++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/arch/sh/lib/ashlsi3.S b/arch/sh/lib/ashlsi3.S
index 4df4401cdf31..73a9d709b169 100644
--- a/arch/sh/lib/ashlsi3.S
+++ b/arch/sh/lib/ashlsi3.S
@@ -63,8 +63,9 @@ __ashlsi3_r0:
 	mova	ashlsi3_table,r0
 	mov.b	@(r0,r4),r4
 	add	r4,r0
+	mov.l	@r15+,r4
 	jmp	@r0
-	mov.l	@r15+,r0
+	mov	r4,r0
 
 	.align	2
 ashlsi3_table:
diff --git a/arch/sh/lib/ashrsi3.S b/arch/sh/lib/ashrsi3.S
index bf3c4e03e6ff..9962d7c587df 100644
--- a/arch/sh/lib/ashrsi3.S
+++ b/arch/sh/lib/ashrsi3.S
@@ -62,8 +62,9 @@ __ashrsi3_r0:
 	mova	ashrsi3_table,r0
 	mov.b	@(r0,r4),r4
 	add	r4,r0
+	mov.l	@r15+,r4
 	jmp	@r0
-	mov.l	@r15+,r0
+	mov	r4,r0
 
 	.align	2
 ashrsi3_table:
diff --git a/arch/sh/lib/lshrsi3.S b/arch/sh/lib/lshrsi3.S
index b79b8170061f..9218f0bad1cc 100644
--- a/arch/sh/lib/lshrsi3.S
+++ b/arch/sh/lib/lshrsi3.S
@@ -62,8 +62,9 @@ __lshrsi3_r0:
 	mova	lshrsi3_table,r0
 	mov.b	@(r0,r4),r4
 	add	r4,r0
+	mov.l	@r15+,r4
 	jmp	@r0
-	mov.l	@r15+,r0
+	mov	r4,r0
 
 	.align	2
 lshrsi3_table:
-- 
2.43.0