# git rev-parse -q --verify cc43634c11b8ced6d99562d1e188e100c9e76e61^{commit} cc43634c11b8ced6d99562d1e188e100c9e76e61 already have revision, skipping fetch # git checkout -q -f -B kisskb cc43634c11b8ced6d99562d1e188e100c9e76e61 # git clean -qxdf # < git log -1 # commit cc43634c11b8ced6d99562d1e188e100c9e76e61 # Author: Gustavo Luiz Duarte # Date: Tue Feb 11 00:38:29 2020 -0300 # # powerpc/tm: Fix clearing MSR[TS] in current when reclaiming on signal delivery # # After a treclaim, we expect to be in non-transactional state. If we # don't clear the current thread's MSR[TS] before we get preempted, then # tm_recheckpoint_new_task() will recheckpoint and we get rescheduled in # suspended transaction state. # # When handling a signal caught in transactional state, # handle_rt_signal64() calls get_tm_stackpointer() that treclaims the # transaction using tm_reclaim_current() but without clearing the # thread's MSR[TS]. This can cause the TM Bad Thing exception below if # later we pagefault and get preempted trying to access the user's # sigframe, using __put_user(). Afterwards, when we are rescheduled back # into do_page_fault() (but now in suspended state since the thread's # MSR[TS] was not cleared), upon executing 'rfid' after completion of # the page fault handling, the exception is raised because a transition # from suspended to non-transactional state is invalid. # # Unexpected TM Bad Thing exception at c00000000000de44 (msr 0x8000000302a03031) tm_scratch=800000010280b033 # Oops: Unrecoverable exception, sig: 6 [#1] # LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries # Modules linked in: nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6_tables ip_tables nft_compat ip_set nf_tables nfnetlink xts vmx_crypto sg virtio_balloon # r_mod cdrom virtio_net net_failover virtio_blk virtio_scsi failover dm_mirror dm_region_hash dm_log dm_mod # CPU: 25 PID: 15547 Comm: a.out Not tainted 5.4.0-rc2 #32 # NIP: c00000000000de44 LR: c000000000034728 CTR: 0000000000000000 # REGS: c00000003fe7bd70 TRAP: 0700 Not tainted (5.4.0-rc2) # MSR: 8000000302a03031 CR: 44000884 XER: 00000000 # CFAR: c00000000000dda4 IRQMASK: 0 # PACATMSCRATCH: 800000010280b033 # GPR00: c000000000034728 c000000f65a17c80 c000000001662800 00007fffacf3fd78 # GPR04: 0000000000001000 0000000000001000 0000000000000000 c000000f611f8af0 # GPR08: 0000000000000000 0000000078006001 0000000000000000 000c000000000000 # GPR12: c000000f611f84b0 c00000003ffcb200 0000000000000000 0000000000000000 # GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 # GPR20: 0000000000000000 0000000000000000 0000000000000000 c000000f611f8140 # GPR24: 0000000000000000 00007fffacf3fd68 c000000f65a17d90 c000000f611f7800 # GPR28: c000000f65a17e90 c000000f65a17e90 c000000001685e18 00007fffacf3f000 # NIP [c00000000000de44] fast_exception_return+0xf4/0x1b0 # LR [c000000000034728] handle_rt_signal64+0x78/0xc50 # Call Trace: # [c000000f65a17c80] [c000000000034710] handle_rt_signal64+0x60/0xc50 (unreliable) # [c000000f65a17d30] [c000000000023640] do_notify_resume+0x330/0x460 # [c000000f65a17e20] [c00000000000dcc4] ret_from_except_lite+0x70/0x74 # Instruction dump: # 7c4ff120 e8410170 7c5a03a6 38400000 f8410060 e8010070 e8410080 e8610088 # 60000000 60000000 e8810090 e8210078 <4c000024> 48000000 e8610178 88ed0989 # ---[ end trace 93094aa44b442f87 ]--- # # The simplified sequence of events that triggers the above exception is: # # ... # userspace in NON-TRANSACTIONAL state # tbegin # userspace in TRANSACTIONAL state # signal delivery # kernelspace in SUSPENDED state # handle_rt_signal64() # get_tm_stackpointer() # treclaim # kernelspace in NON-TRANSACTIONAL state # __put_user() # page fault happens. We will never get back here because of the TM Bad Thing exception. # # page fault handling kicks in and we voluntarily preempt ourselves # do_page_fault() # __schedule() # __switch_to(other_task) # # our task is rescheduled and we recheckpoint because the thread's MSR[TS] was not cleared # __switch_to(our_task) # switch_to_tm() # tm_recheckpoint_new_task() # trechkpt # kernelspace in SUSPENDED state # # The page fault handling resumes, but now we are in suspended transaction state # do_page_fault() completes # rfid <----- trying to get back where the page fault happened (we were non-transactional back then) # TM Bad Thing # illegal transition from suspended to non-transactional # # This patch fixes that issue by clearing the current thread's MSR[TS] # just after treclaim in get_tm_stackpointer() so that we stay in # non-transactional state in case we are preempted. In order to make # treclaim and clearing the thread's MSR[TS] atomic from a preemption # perspective when CONFIG_PREEMPT is set, preempt_disable/enable() is # used. It's also necessary to save the previous value of the thread's # MSR before get_tm_stackpointer() is called so that it can be exposed # to the signal handler later in setup_tm_sigcontexts() to inform the # userspace MSR at the moment of the signal delivery. # # Found with tm-signal-context-force-tm kernel selftest. # # Fixes: 2b0a576d15e0 ("powerpc: Add new transactional memory state to the signal context") # Cc: stable@vger.kernel.org # v3.9 # Signed-off-by: Gustavo Luiz Duarte # Acked-by: Michael Neuling # Signed-off-by: Michael Ellerman # Link: https://lore.kernel.org/r/20200211033831.11165-1-gustavold@linux.ibm.com # < /opt/cross/kisskb/br-mipsel-o32-full-2016.08-613-ge98b4dd/bin/mipsel-linux-gcc --version # < /opt/cross/kisskb/br-mipsel-o32-full-2016.08-613-ge98b4dd/bin/mipsel-linux-ld --version # < git log --format=%s --max-count=1 cc43634c11b8ced6d99562d1e188e100c9e76e61 # < make -s -j 48 ARCH=mips O=/kisskb/build/powerpc-fixes_mips-defconfig_mipsel CROSS_COMPILE=/opt/cross/kisskb/br-mipsel-o32-full-2016.08-613-ge98b4dd/bin/mipsel-linux- defconfig # make -s -j 48 ARCH=mips O=/kisskb/build/powerpc-fixes_mips-defconfig_mipsel CROSS_COMPILE=/opt/cross/kisskb/br-mipsel-o32-full-2016.08-613-ge98b4dd/bin/mipsel-linux- FIT description: Linux 5.5.0-gcc43634c11b8 Created: Thu Feb 13 21:57:55 2020 Image 0 (kernel@0) Description: Linux 5.5.0-gcc43634c11b8 Created: Thu Feb 13 21:57:55 2020 Type: Kernel Image Compression: gzip compressed Data Size: 4889160 Bytes = 4774.57 KiB = 4.66 MiB Architecture: MIPS OS: Linux Load Address: 0x80100000 Entry Point: 0x80901210 Hash algo: sha1 Hash value: 03d895ffe5301250d86c0a6710b7f04be880f536 Image 1 (fdt@boston) Description: img,boston Device Tree Created: Thu Feb 13 21:57:55 2020 Type: Flat Device Tree Compression: uncompressed Data Size: 3793 Bytes = 3.70 KiB = 0.00 MiB Architecture: MIPS Hash algo: sha1 Hash value: 4799f50d688573234da6e9d7701234d394759ef4 Image 2 (fdt@ni169445) Description: NI 169445 device tree Created: Thu Feb 13 21:57:55 2020 Type: Flat Device Tree Compression: uncompressed Data Size: 1871 Bytes = 1.83 KiB = 0.00 MiB Architecture: MIPS Hash algo: sha1 Hash value: 51b89b31605ee62038c8468c429af091dfc75ec7 Image 3 (fdt@ocelot_pcb123) Description: MSCC Ocelot PCB123 Device Tree Created: Thu Feb 13 21:57:55 2020 Type: Flat Device Tree Compression: uncompressed Data Size: 4639 Bytes = 4.53 KiB = 0.00 MiB Architecture: MIPS Hash algo: sha1 Hash value: 018897896b42c41c943aca35a20e4300dba250c8 Image 4 (fdt@ocelot_pcb120) Description: MSCC Ocelot PCB120 Device Tree Created: Thu Feb 13 21:57:55 2020 Type: Flat Device Tree Compression: uncompressed Data Size: 5198 Bytes = 5.08 KiB = 0.00 MiB Architecture: MIPS Hash algo: sha1 Hash value: 36c7bd0bd79cfc2f7dd6acda6c7996294f4967e6 Image 5 (fdt@xilfpga) Description: MIPSfpga (xilfpga) Device Tree Created: Thu Feb 13 21:57:55 2020 Type: Flat Device Tree Compression: uncompressed Data Size: 2708 Bytes = 2.64 KiB = 0.00 MiB Architecture: MIPS Hash algo: sha1 Hash value: 63d058b780f65e22da30f0a183433765f1807f1d Default Configuration: 'conf@default' Configuration 0 (conf@default) Description: Generic Linux kernel Kernel: kernel@0 Configuration 1 (conf@boston) Description: Boston Linux kernel Kernel: kernel@0 FDT: fdt@boston Configuration 2 (conf@ni169445) Description: NI 169445 Linux Kernel Kernel: kernel@0 FDT: fdt@ni169445 Configuration 3 (conf@ocelot_pcb123) Description: Ocelot Linux kernel Kernel: kernel@0 FDT: fdt@ocelot_pcb123 Configuration 4 (conf@ocelot_pcb120) Description: Ocelot Linux kernel Kernel: kernel@0 FDT: fdt@ocelot_pcb120 Configuration 5 (conf@xilfpga) Description: MIPSfpga Linux kernel Kernel: kernel@0 FDT: fdt@xilfpga Completed OK # rm -rf /kisskb/build/powerpc-fixes_mips-defconfig_mipsel # Build took: 0:01:57.561708