# git rev-parse -q --verify cc43634c11b8ced6d99562d1e188e100c9e76e61^{commit} cc43634c11b8ced6d99562d1e188e100c9e76e61 already have revision, skipping fetch # git checkout -q -f -B kisskb cc43634c11b8ced6d99562d1e188e100c9e76e61 # git clean -qxdf # < git log -1 # commit cc43634c11b8ced6d99562d1e188e100c9e76e61 # Author: Gustavo Luiz Duarte # Date: Tue Feb 11 00:38:29 2020 -0300 # # powerpc/tm: Fix clearing MSR[TS] in current when reclaiming on signal delivery # # After a treclaim, we expect to be in non-transactional state. If we # don't clear the current thread's MSR[TS] before we get preempted, then # tm_recheckpoint_new_task() will recheckpoint and we get rescheduled in # suspended transaction state. # # When handling a signal caught in transactional state, # handle_rt_signal64() calls get_tm_stackpointer() that treclaims the # transaction using tm_reclaim_current() but without clearing the # thread's MSR[TS]. This can cause the TM Bad Thing exception below if # later we pagefault and get preempted trying to access the user's # sigframe, using __put_user(). Afterwards, when we are rescheduled back # into do_page_fault() (but now in suspended state since the thread's # MSR[TS] was not cleared), upon executing 'rfid' after completion of # the page fault handling, the exception is raised because a transition # from suspended to non-transactional state is invalid. # # Unexpected TM Bad Thing exception at c00000000000de44 (msr 0x8000000302a03031) tm_scratch=800000010280b033 # Oops: Unrecoverable exception, sig: 6 [#1] # LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries # Modules linked in: nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6_tables ip_tables nft_compat ip_set nf_tables nfnetlink xts vmx_crypto sg virtio_balloon # r_mod cdrom virtio_net net_failover virtio_blk virtio_scsi failover dm_mirror dm_region_hash dm_log dm_mod # CPU: 25 PID: 15547 Comm: a.out Not tainted 5.4.0-rc2 #32 # NIP: c00000000000de44 LR: c000000000034728 CTR: 0000000000000000 # REGS: c00000003fe7bd70 TRAP: 0700 Not tainted (5.4.0-rc2) # MSR: 8000000302a03031 CR: 44000884 XER: 00000000 # CFAR: c00000000000dda4 IRQMASK: 0 # PACATMSCRATCH: 800000010280b033 # GPR00: c000000000034728 c000000f65a17c80 c000000001662800 00007fffacf3fd78 # GPR04: 0000000000001000 0000000000001000 0000000000000000 c000000f611f8af0 # GPR08: 0000000000000000 0000000078006001 0000000000000000 000c000000000000 # GPR12: c000000f611f84b0 c00000003ffcb200 0000000000000000 0000000000000000 # GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 # GPR20: 0000000000000000 0000000000000000 0000000000000000 c000000f611f8140 # GPR24: 0000000000000000 00007fffacf3fd68 c000000f65a17d90 c000000f611f7800 # GPR28: c000000f65a17e90 c000000f65a17e90 c000000001685e18 00007fffacf3f000 # NIP [c00000000000de44] fast_exception_return+0xf4/0x1b0 # LR [c000000000034728] handle_rt_signal64+0x78/0xc50 # Call Trace: # [c000000f65a17c80] [c000000000034710] handle_rt_signal64+0x60/0xc50 (unreliable) # [c000000f65a17d30] [c000000000023640] do_notify_resume+0x330/0x460 # [c000000f65a17e20] [c00000000000dcc4] ret_from_except_lite+0x70/0x74 # Instruction dump: # 7c4ff120 e8410170 7c5a03a6 38400000 f8410060 e8010070 e8410080 e8610088 # 60000000 60000000 e8810090 e8210078 <4c000024> 48000000 e8610178 88ed0989 # ---[ end trace 93094aa44b442f87 ]--- # # The simplified sequence of events that triggers the above exception is: # # ... # userspace in NON-TRANSACTIONAL state # tbegin # userspace in TRANSACTIONAL state # signal delivery # kernelspace in SUSPENDED state # handle_rt_signal64() # get_tm_stackpointer() # treclaim # kernelspace in NON-TRANSACTIONAL state # __put_user() # page fault happens. We will never get back here because of the TM Bad Thing exception. # # page fault handling kicks in and we voluntarily preempt ourselves # do_page_fault() # __schedule() # __switch_to(other_task) # # our task is rescheduled and we recheckpoint because the thread's MSR[TS] was not cleared # __switch_to(our_task) # switch_to_tm() # tm_recheckpoint_new_task() # trechkpt # kernelspace in SUSPENDED state # # The page fault handling resumes, but now we are in suspended transaction state # do_page_fault() completes # rfid <----- trying to get back where the page fault happened (we were non-transactional back then) # TM Bad Thing # illegal transition from suspended to non-transactional # # This patch fixes that issue by clearing the current thread's MSR[TS] # just after treclaim in get_tm_stackpointer() so that we stay in # non-transactional state in case we are preempted. In order to make # treclaim and clearing the thread's MSR[TS] atomic from a preemption # perspective when CONFIG_PREEMPT is set, preempt_disable/enable() is # used. It's also necessary to save the previous value of the thread's # MSR before get_tm_stackpointer() is called so that it can be exposed # to the signal handler later in setup_tm_sigcontexts() to inform the # userspace MSR at the moment of the signal delivery. # # Found with tm-signal-context-force-tm kernel selftest. # # Fixes: 2b0a576d15e0 ("powerpc: Add new transactional memory state to the signal context") # Cc: stable@vger.kernel.org # v3.9 # Signed-off-by: Gustavo Luiz Duarte # Acked-by: Michael Neuling # Signed-off-by: Michael Ellerman # Link: https://lore.kernel.org/r/20200211033831.11165-1-gustavold@linux.ibm.com # < /opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux-gcc --version # < /opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux-ld --version # < git log --format=%s --max-count=1 cc43634c11b8ced6d99562d1e188e100c9e76e61 # < make -s -j 48 ARCH=powerpc O=/kisskb/build/powerpc-fixes_pmac32_defconfig+kexec_powerpc-gcc4.6 CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux- pmac32_defconfig # Added to kconfig configs/2006/11/29/pmac32_defconfigkexec # yes \n | make -s -j 48 ARCH=powerpc O=/kisskb/build/powerpc-fixes_pmac32_defconfig+kexec_powerpc-gcc4.6 CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux- oldconfig yes: standard output: Broken pipe # make -s -j 48 ARCH=powerpc O=/kisskb/build/powerpc-fixes_pmac32_defconfig+kexec_powerpc-gcc4.6 CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux- /kisskb/src/drivers/tty/serial/8250/8250_core.c: In function 'univ8250_release_irq': /kisskb/src/drivers/tty/serial/8250/8250_core.c:248:18: warning: 'i' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/tty/serial/8250/8250_core.c:228:19: note: 'i' was declared here /kisskb/src/kernel/printk/printk.c: In function 'devkmsg_sysctl_set_loglvl': /kisskb/src/kernel/printk/printk.c:204:16: warning: 'old' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/sound/ppc/awacs.c: In function 'snd_pmac_awacs_init': /kisskb/src/include/sound/control.h:218:2: warning: 'speaker_vol' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/sound/ppc/awacs.c:873:36: note: 'speaker_vol' was declared here /kisskb/src/fs/proc/inode.c: In function 'proc_reg_open': /kisskb/src/include/linux/list.h:72:12: warning: 'pdeo' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/fs/proc/inode.c:338:21: note: 'pdeo' was declared here /kisskb/src/drivers/gpu/drm/drm_dp_mst_topology.c: In function 'drm_dp_mst_dsc_aux_for_port': /kisskb/src/drivers/gpu/drm/drm_dp_mst_topology.c:5399:9: warning: missing braces around initializer [-Wmissing-braces] /kisskb/src/drivers/gpu/drm/drm_dp_mst_topology.c:5399:9: warning: (near initialization for 'desc.ident') [-Wmissing-braces] /kisskb/src/kernel/trace/trace_events.c: In function 'event_create_dir': /kisskb/src/kernel/trace/trace_events.c:2039:6: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/usb/core/devio.c: In function 'async_completed': /kisskb/src/drivers/usb/core/devio.c:625:23: warning: 'errno' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/gpu/drm/drm_edid.c: In function 'cea_mode_alternate_timings': /kisskb/src/drivers/gpu/drm/drm_edid.c:3275:2: error: call to '__compiletime_assert_3282' declared with attribute error: BUILD_BUG_ON failed: cea_mode_for_vic(8)->vtotal != 262 || cea_mode_for_vic(9)->vtotal != 262 || cea_mode_for_vic(12)->vtotal != 262 || cea_mode_for_vic(13)->vtotal != 262 || cea_mode_for_vic(23)->vtotal != 312 || cea_mode_for_vic(24)->vtotal != 312 || cea_mode_for_vic(27)->vtotal != 312 || cea_mode_for_vic(28)->vtotal != 312 /kisskb/src/drivers/gpu/drm/drm_edid.c:3997: confused by earlier errors, bailing out make[4]: *** [/kisskb/src/scripts/Makefile.build:266: drivers/gpu/drm/drm_edid.o] Error 1 make[4]: *** Waiting for unfinished jobs.... /kisskb/src/fs/ext4/extents.c: In function 'ext4_convert_unwritten_io_end_vec': /kisskb/src/fs/ext4/extents.c:5009:23: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/net/wireless/broadcom/b43/phy_n.c: In function 'b43_nphy_rf_ctl_override_rev7': /kisskb/src/drivers/net/wireless/broadcom/b43/phy_n.c:190:21: warning: 'val_addr' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/net/tun.c: In function 'tun_get_user': /kisskb/src/drivers/net/tun.c:1836:30: warning: 'copylen' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/net/tun.c:1749:46: warning: 'linear' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/fs/udf/unicode.c: In function 'udf_name_conv_char': /kisskb/src/fs/udf/unicode.c:132:8: warning: 'c' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/fs/nfsd/nfs4xdr.c: In function 'nfsd4_encode_components_esc': /kisskb/src/fs/nfsd/nfs4xdr.c:2076:9: warning: 'str' may be used uninitialized in this function [-Wuninitialized] make[3]: *** [/kisskb/src/scripts/Makefile.build:503: drivers/gpu/drm] Error 2 make[2]: *** [/kisskb/src/scripts/Makefile.build:503: drivers/gpu] Error 2 make[1]: *** [/kisskb/src/Makefile:1681: drivers] Error 2 make[1]: *** Waiting for unfinished jobs.... /kisskb/src/net/mac80211/mlme.c: In function 'ieee80211_rx_mgmt_beacon': /kisskb/src/net/mac80211/mlme.c:1576:3: warning: 'pwr_level_cisco' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/net/mac80211/mlme.c:1533:6: note: 'pwr_level_cisco' was declared here /kisskb/src/fs/io_uring.c: In function '__io_sqe_files_update.isra.82': /kisskb/src/fs/io_uring.c:5713:13: warning: 'err' may be used uninitialized in this function [-Wuninitialized] make: *** [Makefile:179: sub-make] Error 2 Command 'make -s -j 48 ARCH=powerpc O=/kisskb/build/powerpc-fixes_pmac32_defconfig+kexec_powerpc-gcc4.6 CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux- ' returned non-zero exit status 2 # rm -rf /kisskb/build/powerpc-fixes_pmac32_defconfig+kexec_powerpc-gcc4.6 # Build took: 0:01:22.017030