@@ -144,6 +144,26 @@ tsb_miss_page_table_walk_sun4v_fastpath:
bne,pt %xcc, 60f
nop
+ /* If this fault came from a window spill or fill (TL > 1),
+ * we cannot build a trap stack and call hugetlb_setup() from
+ * here. Route it through tsb_do_fault instead, so that
+ * do_sparc64_fault() runs and its huge-TSB grow check
+ * allocates the TSB before the access is replayed.
+ *
+ * This must be decided before the register bank switch below:
+ * %g3 (the fault code) and %g5 (now the PTE) live in the TLB
+ * miss handler's globals and do not survive it. Consuming
+ * them after the switch, as this path used to when it went to
+ * winfix_trampoline directly, records a stale %g3 as the
+ * fault code and a stale %g5 as the fault address, and the
+ * task is then killed with a SIGSEGV at a garbage address.
+ * tsb_do_fault re-fetches both from the MMU after switching.
+ */
+ rdpr %tl, %g7
+ cmp %g7, 1
+ bgu,pn %xcc, tsb_do_fault
+ nop
+
661: rdpr %pstate, %g5
wrpr %g5, PSTATE_AG | PSTATE_MG, %pstate
.section .sun4v_2insn_patch, "ax"
@@ -152,10 +172,6 @@ tsb_miss_page_table_walk_sun4v_fastpath:
nop
.previous
- rdpr %tl, %g7
- cmp %g7, 1
- bne,pn %xcc, winfix_trampoline
- mov %g3, %g4
ba,pt %xcc, etrap
rd %pc, %g7
call hugetlb_setup
The huge-page path in the TSB miss handler has to route a fault taken during a register window spill or fill away from hugetlb_setup(), since a trap stack cannot be built at TL > 1. That test is made after wrpr %g5, PSTATE_AG | PSTATE_MG, %pstate (SET_GL(1) on sun4v) has already switched the global register bank. %g3, holding the fault code, and %g5, holding the PTE, live in the TLB miss handler's globals and do not survive that switch, so the branch to winfix_trampoline passes on whatever the new bank happens to contain: a stale fault code and a garbage fault address. The task is then killed with SIGSEGV pointing at an address that was never mapped. The path predates the fault code being passed at all; it was given one when winfix_trampoline's %g4 requirement was fixed, and the register it reads has been the wrong bank's since. Make the decision before the switch and route to tsb_do_fault, which re-reads both from the MMU after switching banks, rather than entering winfix_trampoline with registers that no longer mean anything. Fixes: 84bd6d8b9c0f ("sparc64: Fix corrupted thread fault code.") Reported-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> Link: https://github.com/sparclinux/issues/issues/87 Signed-off-by: Stian Halseth <stian@itx.no> --- arch/sparc/kernel/tsb.S | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-)