From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, Denis Kirjanov <kda@linux-powerpc.org>,
"Ravi Bangoria" <ravi.bangoria@linux.ibm.com>,
"Michael Ellerman" <mpe@ellerman.id.au>
Subject: [PATCH 3.16 17/47] powerpc/watchpoint: Restore NV GPRs while returning from exception
Date: Fri, 25 Oct 2019 19:03:18 +0100 [thread overview]
Message-ID: <lsq.1572026582.203708098@decadent.org.uk> (raw)
In-Reply-To: <lsq.1572026581.992411028@decadent.org.uk>
3.16.76-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
commit f474c28fbcbe42faca4eb415172c07d76adcb819 upstream.
powerpc hardware triggers watchpoint before executing the instruction.
To make trigger-after-execute behavior, kernel emulates the
instruction. If the instruction is 'load something into non-volatile
register', exception handler should restore emulated register state
while returning back, otherwise there will be register state
corruption. eg, adding a watchpoint on a list can corrput the list:
# cat /proc/kallsyms | grep kthread_create_list
c00000000121c8b8 d kthread_create_list
Add watchpoint on kthread_create_list->prev:
# perf record -e mem:0xc00000000121c8c0
Run some workload such that new kthread gets invoked. eg, I just
logged out from console:
list_add corruption. next->prev should be prev (c000000001214e00), \
but was c00000000121c8b8. (next=c00000000121c8b8).
WARNING: CPU: 59 PID: 309 at lib/list_debug.c:25 __list_add_valid+0xb4/0xc0
CPU: 59 PID: 309 Comm: kworker/59:0 Kdump: loaded Not tainted 5.1.0-rc7+ #69
...
NIP __list_add_valid+0xb4/0xc0
LR __list_add_valid+0xb0/0xc0
Call Trace:
__list_add_valid+0xb0/0xc0 (unreliable)
__kthread_create_on_node+0xe0/0x260
kthread_create_on_node+0x34/0x50
create_worker+0xe8/0x260
worker_thread+0x444/0x560
kthread+0x160/0x1a0
ret_from_kernel_thread+0x5c/0x70
List corruption happened because it uses 'load into non-volatile
register' instruction:
Snippet from __kthread_create_on_node:
c000000000136be8: addis r29,r2,-19
c000000000136bec: ld r29,31424(r29)
if (!__list_add_valid(new, prev, next))
c000000000136bf0: mr r3,r30
c000000000136bf4: mr r5,r28
c000000000136bf8: mr r4,r29
c000000000136bfc: bl c00000000059a2f8 <__list_add_valid+0x8>
Register state from WARN_ON():
GPR00: c00000000059a3a0 c000007ff23afb50 c000000001344e00 0000000000000075
GPR04: 0000000000000000 0000000000000000 0000001852af8bc1 0000000000000000
GPR08: 0000000000000001 0000000000000007 0000000000000006 00000000000004aa
GPR12: 0000000000000000 c000007ffffeb080 c000000000137038 c000005ff62aaa00
GPR16: 0000000000000000 0000000000000000 c000007fffbe7600 c000007fffbe7370
GPR20: c000007fffbe7320 c000007fffbe7300 c000000001373a00 0000000000000000
GPR24: fffffffffffffef7 c00000000012e320 c000007ff23afcb0 c000000000cb8628
GPR28: c00000000121c8b8 c000000001214e00 c000007fef5b17e8 c000007fef5b17c0
Watchpoint hit at 0xc000000000136bec.
addis r29,r2,-19
=> r29 = 0xc000000001344e00 + (-19 << 16)
=> r29 = 0xc000000001214e00
ld r29,31424(r29)
=> r29 = *(0xc000000001214e00 + 31424)
=> r29 = *(0xc00000000121c8c0)
0xc00000000121c8c0 is where we placed a watchpoint and thus this
instruction was emulated by emulate_step. But because handle_dabr_fault
did not restore emulated register state, r29 still contains stale
value in above register state.
Fixes: 5aae8a5370802 ("powerpc, hw_breakpoints: Implement hw_breakpoints for 64-bit server processors")
Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/powerpc/kernel/exceptions-64s.S | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -1630,7 +1630,7 @@ handle_page_fault:
addi r3,r1,STACK_FRAME_OVERHEAD
bl do_page_fault
cmpdi r3,0
- beq+ 12f
+ beq+ ret_from_except_lite
bl save_nvgprs
mr r5,r3
addi r3,r1,STACK_FRAME_OVERHEAD
@@ -1645,7 +1645,12 @@ handle_dabr_fault:
ld r5,_DSISR(r1)
addi r3,r1,STACK_FRAME_OVERHEAD
bl do_break
-12: b ret_from_except_lite
+ /*
+ * do_break() may have changed the NV GPRS while handling a breakpoint.
+ * If so, we need to restore them with their updated values. Don't use
+ * ret_from_except_lite here.
+ */
+ b ret_from_except
/* We have a page fault that hash_page could handle but HV refused
next prev parent reply other threads:[~2019-10-25 18:10 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-25 18:03 [PATCH 3.16 00/47] 3.16.76-rc1 review Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 01/47] eCryptfs: fix a couple type promotion bugs Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 02/47] ARM: riscpc: fix DMA Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 03/47] 9p/virtio: Add cleanup path in p9_virtio_init Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 04/47] tty: serial: cpm_uart - fix init when SMC is relocated Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 05/47] signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 06/47] xfrm: Fix xfrm sel prefix length validation Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 07/47] af_key: fix leaks in key_pol_get_resp and dump_sp Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 08/47] crypto: talitos - check AES key size Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 09/47] crypto: ghash - fix unaligned memory access in ghash_setkey() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 10/47] s390/qdio: handle PENDING state for QEBSM devices Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 11/47] memstick: Fix error cleanup path of memstick_init Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 12/47] gpio: omap: fix lack of irqstatus_raw0 for OMAP4 Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 13/47] xfrm: fix sa selector validation Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 14/47] PCI: Do not poll for PME if the device is in D3cold Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 15/47] usb: gadget: ether: Fix race between gether_disconnect and rx_submit Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 16/47] powerpc/32s: fix suspend/resume when IBATs 4-7 are used Ben Hutchings
2019-10-25 18:03 ` Ben Hutchings [this message]
2019-10-25 18:03 ` [PATCH 3.16 18/47] USB: serial: option: add GosunCn ZTE WeLink ME3630 Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 19/47] USB: serial: option: add support for GosunCn ME3630 RNDIS mode Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 20/47] s390: fix stfle zero padding Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 21/47] VMCI: Fix integer overflow in VMCI handle arrays Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 22/47] mwifiex: Don't abort on small, spec-compliant vendor IEs Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 23/47] mwifiex: fix 802.11n/WPA detection Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 24/47] media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 25/47] EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 26/47] carl9170: fix misuse of device driver API Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 27/47] x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 28/47] x86/tls: Fix possible spectre-v1 in do_get_thread_area() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 29/47] USB: serial: ftdi_sio: add ID for isodebug v1 Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 30/47] igmp: fix memory leak in igmpv3_del_delrec() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 31/47] s390/qdio: (re-)initialize tiqdio list entries Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 32/47] s390/qdio: don't touch the dsci in tiqdio_add_input_queues() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 33/47] net: bridge: stp: don't cache eth dest pointer before skb pull Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 34/47] lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGE_SIZE Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 35/47] bonding: validate ip header before check IPPROTO_IGMP Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 36/47] NFSv4: Handle the special Linux file open access mode Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 37/47] ARC: hide unused function unw_hdr_alloc Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 38/47] udf: Fix incorrect final NOT_ALLOCATED (hole) extent length Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 39/47] mm/mmu_notifier: use hlist_add_head_rcu() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 40/47] net: neigh: fix multiple neigh timer scheduling Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 41/47] ALSA: seq: Break too long mutex context in the write loop Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 42/47] coda: pass the host file in vma->vm_file on mmap Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 43/47] caif-hsi: fix possible deadlock in cfhsi_exit_module() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 44/47] parisc: Fix kernel panic due invalid values in IAOQ0 or IAOQ1 Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 45/47] padata: use smp_mb in padata_reorder to avoid orphaned padata jobs Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 46/47] Input: psmouse - fix build error of multiple definition Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 47/47] KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed Ben Hutchings
2019-10-25 19:05 ` Joe Perches
2019-10-31 22:14 ` Ben Hutchings
2019-10-31 22:53 ` Joe Perches
2019-10-31 22:56 ` Paolo Bonzini
2019-11-01 8:07 ` Sasha Levin
2019-11-01 15:40 ` Joe Perches
2019-11-02 7:39 ` Sasha Levin
2019-10-26 1:35 ` [PATCH 3.16 00/47] 3.16.76-rc1 review Guenter Roeck
2019-10-26 18:00 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1572026582.203708098@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=kda@linux-powerpc.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mpe@ellerman.id.au \
--cc=ravi.bangoria@linux.ibm.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox