Message ID | 20160615064457.8369-2-cyrilbur@gmail.com (mailing list archive) |
---|---|
State | Superseded |
Headers | show |
Hi, [auto build test ERROR on powerpc/next] [also build test ERROR on v4.7-rc3 next-20160615] [if your patch is applied to the wrong git tree, please drop us a note to help improve the system] url: https://github.com/0day-ci/linux/commits/Cyril-Bur/selftests-powerpc-exec-with-suspended-transaction/20160615-144928 base: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git next config: powerpc-tqm8560_defconfig (attached as .config) compiler: powerpc-linux-gnu-gcc (Debian 5.3.1-8) 5.3.1 20160205 reproduce: wget https://git.kernel.org/cgit/linux/kernel/git/wfg/lkp-tests.git/plain/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # save the attached .config to linux build tree make.cross ARCH=powerpc All error/warnings (new ones prefixed by >>): In file included from arch/powerpc/include/asm/processor.h:13:0, from arch/powerpc/include/asm/thread_info.h:33, from include/linux/thread_info.h:54, from include/asm-generic/preempt.h:4, from arch/powerpc/include/generated/asm/preempt.h:1, from include/linux/preempt.h:59, from include/linux/spinlock.h:50, from include/linux/seqlock.h:35, from include/linux/time.h:5, from include/uapi/linux/timex.h:56, from include/linux/timex.h:56, from include/linux/sched.h:19, from arch/powerpc/kernel/process.c:18: arch/powerpc/kernel/process.c: In function 'start_thread': >> arch/powerpc/include/asm/reg.h:64:23: error: left shift count >= width of type [-Werror=shift-count-overflow] #define __MASK(X) (1UL<<(X)) ^ >> arch/powerpc/include/asm/reg.h:116:18: note: in expansion of macro '__MASK' #define MSR_TS_T __MASK(MSR_TS_T_LG) /* Transaction Transactional */ ^ >> arch/powerpc/include/asm/reg.h:117:22: note: in expansion of macro 'MSR_TS_T' #define MSR_TS_MASK (MSR_TS_T | MSR_TS_S) /* Transaction State bits */ ^ >> arch/powerpc/include/asm/reg.h:121:37: note: in expansion of macro 'MSR_TS_MASK' #define MSR_TM_SUSPENDED(x) (((x) & MSR_TS_MASK) == MSR_TS_S) ^ >> arch/powerpc/kernel/process.c:1517:6: note: in expansion of macro 'MSR_TM_SUSPENDED' if (MSR_TM_SUSPENDED(mfmsr())) ^ >> arch/powerpc/include/asm/reg.h:64:23: error: left shift count >= width of type [-Werror=shift-count-overflow] #define __MASK(X) (1UL<<(X)) ^ arch/powerpc/include/asm/reg.h:115:18: note: in expansion of macro '__MASK' #define MSR_TS_S __MASK(MSR_TS_S_LG) /* Transaction Suspended */ ^ >> arch/powerpc/include/asm/reg.h:117:33: note: in expansion of macro 'MSR_TS_S' #define MSR_TS_MASK (MSR_TS_T | MSR_TS_S) /* Transaction State bits */ ^ >> arch/powerpc/include/asm/reg.h:121:37: note: in expansion of macro 'MSR_TS_MASK' #define MSR_TM_SUSPENDED(x) (((x) & MSR_TS_MASK) == MSR_TS_S) ^ >> arch/powerpc/kernel/process.c:1517:6: note: in expansion of macro 'MSR_TM_SUSPENDED' if (MSR_TM_SUSPENDED(mfmsr())) ^ >> arch/powerpc/include/asm/reg.h:64:23: error: left shift count >= width of type [-Werror=shift-count-overflow] #define __MASK(X) (1UL<<(X)) ^ arch/powerpc/include/asm/reg.h:115:18: note: in expansion of macro '__MASK' #define MSR_TS_S __MASK(MSR_TS_S_LG) /* Transaction Suspended */ ^ arch/powerpc/include/asm/reg.h:121:53: note: in expansion of macro 'MSR_TS_S' #define MSR_TM_SUSPENDED(x) (((x) & MSR_TS_MASK) == MSR_TS_S) ^ >> arch/powerpc/kernel/process.c:1517:6: note: in expansion of macro 'MSR_TM_SUSPENDED' if (MSR_TM_SUSPENDED(mfmsr())) ^ cc1: all warnings being treated as errors vim +/MSR_TM_SUSPENDED +1517 arch/powerpc/kernel/process.c 1501 #endif 1502 1503 /* 1504 * If we exec out of a kernel thread then thread.regs will not be 1505 * set. Do it now. 1506 */ 1507 if (!current->thread.regs) { 1508 struct pt_regs *regs = task_stack_page(current) + THREAD_SIZE; 1509 current->thread.regs = regs - 1; 1510 } 1511 1512 /* 1513 * Clear any transactional state, we're exec()ing. The cause is 1514 * not important as there will never be a recheckpoint so it's not 1515 * user visible. 1516 */ > 1517 if (MSR_TM_SUSPENDED(mfmsr())) 1518 tm_reclaim_current(0); 1519 1520 memset(regs->gpr, 0, sizeof(regs->gpr)); 1521 regs->ctr = 0; 1522 regs->link = 0; 1523 regs->xer = 0; 1524 regs->ccr = 0; 1525 regs->gpr[1] = sp; --- 0-DAY kernel test infrastructure Open Source Technology Center https://lists.01.org/pipermail/kbuild-all Intel Corporation
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c index ea8a28f..b0c58a3 100644 --- a/arch/powerpc/kernel/process.c +++ b/arch/powerpc/kernel/process.c @@ -1509,6 +1509,14 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp) current->thread.regs = regs - 1; } + /* + * Clear any transactional state, we're exec()ing. The cause is + * not important as there will never be a recheckpoint so it's not + * user visible. + */ + if (MSR_TM_SUSPENDED(mfmsr())) + tm_reclaim_current(0); + memset(regs->gpr, 0, sizeof(regs->gpr)); regs->ctr = 0; regs->link = 0;
Userspace can quite legitimately perform an exec() syscall with a suspended transaction. exec() does not return to the old process, rather it load a new one and starts that, the expectation therefore is that the new process starts not in a transaction. Currently exec() is not treated any differently to any other syscall which creates problems. Firstly it could allow a new process to start with a suspended transaction for a binary that no longer exists. This means that the checkpointed state won't be valid and if the suspended transaction were ever to be resumed and subsequently aborted (a possibility which is exceedingly likely as exec()ing will likely doom the transaction) the new process will jump to invalid state. Secondly the incorrect attempt to keep the transactional state while still zeroing state for the new process creates at least two TM Bad Things. The first triggers on the rfid to return to userspace as start_thread() has given the new process a 'clean' MSR but the suspend will still be set in the hardware MSR. The second TM Bad Thing triggers in __switch_to() as the processor is still transactionally suspended but __switch_to() wants to zero the TM sprs for the new process. This is an example of the outcome of calling exec() with a suspended transaction. Note the first 700 is likely the first TM bad thing decsribed earlier only the kernel can't report it as we've loaded userspace registers. c000000000009980 is the rfid in fast_exception_return() Bad kernel stack pointer 3fffcfa1a370 at c000000000009980 Oops: Bad kernel stack pointer, sig: 6 [#1] SMP NR_CPUS=2048 NUMA pSeries Modules linked in: CPU: 0 PID: 2006 Comm: tm-execed Not tainted 4.6.0-rc3cyrilb769744c1efb74735f687b36ba6f97b5668e0f515 #1 task: c0000000fbea6d80 ti: c00000003ffec000 task.ti: c0000000fb7ec000 NIP: c000000000009980 LR: 0000000000000000 CTR: 0000000000000000 REGS: c00000003ffefd40 TRAP: 0700 Not tainted (4.6.0-rc3cyrilb769744c1efb74735f687b36ba6f97b5668e0f515) MSR: 8000000300201031 <SF,ME,IR,DR,LE,TM[SE]> CR: 00000000 XER: 00000000 CFAR: c0000000000098b4 SOFTE: 0 PACATMSCRATCH: b00000010000d033 GPR00: 0000000000000000 00003fffcfa1a370 0000000000000000 0000000000000000 GPR04: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR12: 00003fff966611c0 0000000000000000 0000000000000000 0000000000000000 GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR24: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR28: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 NIP [c000000000009980] fast_exception_return+0xb0/0xb8 LR [0000000000000000] (null) Call Trace: Instruction dump: f84d0278 e9a100d8 7c7b03a6 e84101a0 7c4ff120 e8410170 7c5a03a6 e8010070 e8410080 e8610088 e8810090 e8210078 <4c000024> 48000000 e8610178 88ed023b ---[ end trace 4d79afb454bb5313 ]--- ------------[ cut here ]------------ Kernel BUG at c000000000043e80 [verbose debug info unavailable] Unexpected TM Bad Thing exception at c000000000043e80 (msr 0x201033) Oops: Unrecoverable exception, sig: 6 [#2] SMP NR_CPUS=2048 NUMA pSeries Modules linked in: CPU: 0 PID: 2006 Comm: tm-execed Tainted: G D 4.6.0-rc3cyrilb769744c1efb74735f687b36ba6f97b5668e0f515 #1 task: c0000000fbea6d80 ti: c00000003ffec000 task.ti: c0000000fb7ec000 NIP: c000000000043e80 LR: c000000000015a24 CTR: 0000000000000000 REGS: c00000003ffef7e0 TRAP: 0700 Tainted: G D (4.6.0-rc3cyrilb769744c1efb74735f687b36ba6f97b5668e0f515) MSR: 8000000300201033 <SF,ME,IR,DR,RI,LE,TM[SE]> CR: 28002828 XER: 00000000 CFAR: c000000000015a20 SOFTE: 0 PACATMSCRATCH: b00000010000d033 GPR00: 0000000000000000 c00000003ffefa60 c000000000db5500 c0000000fbead000 GPR04: 8000000300001033 2222222222222222 2222222222222222 00000000ff160000 GPR08: 0000000000000000 800000010000d033 c0000000fb7e3ea0 c00000000fe00004 GPR12: 0000000000002200 c00000000fe00000 0000000000000000 0000000000000000 GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR20: 0000000000000000 0000000000000000 c0000000fbea7410 00000000ff160000 GPR24: c0000000ffe1f600 c0000000fbea8700 c0000000fbea8700 c0000000fbead000 GPR28: c000000000e20198 c0000000fbea6d80 c0000000fbeab680 c0000000fbea6d80 NIP [c000000000043e80] tm_restore_sprs+0xc/0x1c LR [c000000000015a24] __switch_to+0x1f4/0x420 Call Trace: Instruction dump: 7c800164 4e800020 7c0022a6 f80304a8 7c0222a6 f80304b0 7c0122a6 f80304b8 4e800020 e80304a8 7c0023a6 e80304b0 <7c0223a6> e80304b8 7c0123a6 4e800020 ---[ end trace 4d79afb454bb5314 ]--- Fixes: bc2a940 ("powerpc: Hook in new transactional memory code") Signed-off-by: Cyril Bur <cyrilbur@gmail.com> --- arch/powerpc/kernel/process.c | 8 ++++++++ 1 file changed, 8 insertions(+)