RFC: ARM: fix the uaccess crash on PB11MPCore

PATCH New Linus Walleij 3 participants 7 messages Jul 11, 2016 – Oct 17, 2016 Arm (32-bit)

Share & tools

Linus Walleij

author

2016-07-11 17:08 UTC #0 lore raw

PATCH 1/1 RFC: ARM: fix the uaccess crash on PB11MPCore

The following patch was sketched by Russell in response to my crashes on the PB11MPCore after the patch for software-based priviledged no access support for ARMv8.1. See this thread:
http://marc.info/?l=linux-arm-kernel&m=144051749807214&w=2

I am unsure what is going on, I suspect everyone involved in the discussion is. I just want to repost this to get the discussion restarted, as I still have to apply this patch with every kernel iteration to get my PB11MPCore Realview running.

I also know that Oxnas has actual, mass-deployed NAS (PogoPlug Pro variants) using PB11MPCore, and that they may or may not be seeing the same issue so I want their feedback on this: do you or do you not see this with mainline, or have you not even tested?

Cc Russell King <[email protected]>

Cc Will Deacon <[email protected]>

Cc Neil Armstrong <[email protected]>

Fixes a5e090acbf54 ("ARM: software-based priviledged-no-access support")

Signed-off-by Linus Walleij <[email protected]>

---
 arch/arm/kernel/smp_tlb.c | 7 +++++++
 1 file changed, 7 insertions(+)

arch/arm/kernel/smp_tlb.c +7 -0

index 2e72be4f623e..7cb079e74010 100644
@@ -9,6 +9,7 @@
  */
 #include <linux/preempt.h>
 #include <linux/smp.h>
+#include <linux/uaccess.h>
 
 #include <asm/smp_plat.h>
 #include <asm/tlbflush.h>

@@ -40,8 +41,11 @@ static inline void ipi_flush_tlb_mm(void *arg)
 static inline void ipi_flush_tlb_page(void *arg)
 {
 	struct tlb_args *ta = (struct tlb_args *)arg;
+	unsigned int __ua_flags = uaccess_save_and_enable();
 
 	local_flush_tlb_page(ta->ta_vma, ta->ta_start);
+
+	uaccess_restore(__ua_flags);
 }
 
 static inline void ipi_flush_tlb_kernel_page(void *arg)

@@ -54,8 +58,11 @@ static inline void ipi_flush_tlb_kernel_page(void *arg)
 static inline void ipi_flush_tlb_range(void *arg)
 {
 	struct tlb_args *ta = (struct tlb_args *)arg;
+	unsigned int __ua_flags = uaccess_save_and_enable();
 
 	local_flush_tlb_range(ta->ta_vma, ta->ta_start, ta->ta_end);
+
+	uaccess_restore(__ua_flags);
 }
 
 static inline void ipi_flush_tlb_kernel_range(void *arg)

Signature · 1 line

2.7.4

Neil Armstrong

2016-07-12 11:27 UTC #1 lore raw

PATCH 1/1 RFC: ARM: fix the uaccess crash on PB11MPCore

2016-07-11 19:08 GMT+02:00 Linus Walleij <[email protected]>:

Quoted 11 lines

The following patch was sketched by Russell in response to my crashes on the PB11MPCore after the patch for software-based priviledged no access support for ARMv8.1. See this thread:
http://marc.info/?l=linux-arm-kernel&m=144051749807214&w=2
I am unsure what is going on, I suspect everyone involved in the discussion is. I just want to repost this to get the discussion restarted, as I still have to apply this patch with every kernel iteration to get my PB11MPCore Realview running.

Quoted 5 lines

I also know that Oxnas has actual, mass-deployed NAS (PogoPlug Pro variants) using PB11MPCore, and that they may or may not be seeing the same issue so I want their feedback on this: do you or do you not see this with mainline, or have you not even tested?

Hi Linus,

Actually the last off-tree support of the OX820 is on 4.4, and I do not personally own a OX820 based device,
but I'm in he process of finding one to achieve upstream support along the Ox810.

My comment over this patch is like yours, isn't there a way to narrow such changes to ARMv6+SMP enabled kernels ? It would be a pity to have such workaround enabled for V7 only kernels.

Neil

Quoted 49 lines

Cc Russell King <[email protected]>

Cc Will Deacon <[email protected]>

Cc Neil Armstrong <[email protected]>

Fixes a5e090acbf54 ("ARM: software-based priviledged-no-access support")

Signed-off-by Linus Walleij <[email protected]>

---
 arch/arm/kernel/smp_tlb.c | 7 +++++++
 1 file changed, 7 insertions(+)

arch/arm/kernel/smp_tlb.c +7 -1

index 2e72be4f623e..7cb079e74010 100644
@@ -9,6 +9,7 @@
  */
 #include <linux/preempt.h>
 #include <linux/smp.h>
+#include <linux/uaccess.h>
 
 #include <asm/smp_plat.h>
 #include <asm/tlbflush.h>

@@ -40,8 +41,11 @@ static inline void ipi_flush_tlb_mm(void *arg)
 static inline void ipi_flush_tlb_page(void *arg)
 {
        struct tlb_args *ta = (struct tlb_args *)arg;
+       unsigned int __ua_flags = uaccess_save_and_enable();
 
        local_flush_tlb_page(ta->ta_vma, ta->ta_start);
+
+       uaccess_restore(__ua_flags);
 }
 
 static inline void ipi_flush_tlb_kernel_page(void *arg)

@@ -54,8 +58,11 @@ static inline void ipi_flush_tlb_kernel_page(void *arg)
 static inline void ipi_flush_tlb_range(void *arg)
 {
        struct tlb_args *ta = (struct tlb_args *)arg;
+       unsigned int __ua_flags = uaccess_save_and_enable();
 
        local_flush_tlb_range(ta->ta_vma, ta->ta_start, ta->ta_end);
+
+       uaccess_restore(__ua_flags);
 }
 
 static inline void ipi_flush_tlb_kernel_range(void *arg)
--

2.7.4

Signature · 4 lines

Neil Armstrong
Embedded Linux Software Engineer
BayLibre - At the Heart of Embedded Linux
www.baylibre.com

Arnd Bergmann

2016-07-12 11:53 UTC #2 lore raw

PATCH 1/1 RFC: ARM: fix the uaccess crash on PB11MPCore

Quoted 18 lines · CEST Neil Armstrong

2016-07-11 19:08 GMT+02:00 Linus Walleij <[email protected]>:
Quoted 11 lines
The following patch was sketched by Russell in response to my crashes on the PB11MPCore after the patch for software-based priviledged no access support for ARMv8.1. See this thread:
http://marc.info/?l=linux-arm-kernel&m=144051749807214&w=2
I am unsure what is going on, I suspect everyone involved in the discussion is. I just want to repost this to get the discussion restarted, as I still have to apply this patch with every kernel iteration to get my PB11MPCore Realview running.
Quoted 5 lines
I also know that Oxnas has actual, mass-deployed NAS (PogoPlug Pro variants) using PB11MPCore, and that they may or may not be seeing the same issue so I want their feedback on this: do you or do you not see this with mainline, or have you not even tested?

Quoted 7 lines

Hi Linus,
Actually the last off-tree support of the OX820 is on 4.4, and I do not personally own a OX820 based device,
but I'm in he process of finding one to achieve upstream support along the Ox810.

The Aldi NAS boxes (NAS-212) are widely available on ebay in Germany, there is even a shop that sells both the Pogoplug and the Medion machine with Debian preinstalled: http://www.ebay.de/sch/it-shop-rm/m.html

If you need help getting one, you can send it to me and I forward it to your French address.

Arnd

Neil Armstrong

2016-07-20 08:08 UTC #3 lore raw

PATCH 1/1 RFC: ARM: fix the uaccess crash on PB11MPCore

Quoted 27 lines · Arnd Bergmann

Quoted 18 lines · CEST Neil Armstrong
2016-07-11 19:08 GMT+02:00 Linus Walleij <[email protected]>:
Quoted 11 lines
The following patch was sketched by Russell in response to my crashes on the PB11MPCore after the patch for software-based priviledged no access support for ARMv8.1. See this thread:
http://marc.info/?l=linux-arm-kernel&m=144051749807214&w=2
I am unsure what is going on, I suspect everyone involved in the discussion is. I just want to repost this to get the discussion restarted, as I still have to apply this patch with every kernel iteration to get my PB11MPCore Realview running.
Quoted 5 lines
I also know that Oxnas has actual, mass-deployed NAS (PogoPlug Pro variants) using PB11MPCore, and that they may or may not be seeing the same issue so I want their feedback on this: do you or do you not see this with mainline, or have you not even tested?
Quoted 7 lines
Hi Linus,
Actually the last off-tree support of the OX820 is on 4.4, and I do not personally own a OX820 based device,
but I'm in he process of finding one to achieve upstream support along the Ox810.

Quoted 9 lines

The Aldi NAS boxes (NAS-212) are widely available on ebay in Germany, there is even a shop that sells both the Pogoplug and the Medion machine with Debian preinstalled: http://www.ebay.de/sch/it-shop-rm/m.html
If you need help getting one, you can send it to me and I forward it to your French address.
Arnd

Arnd,

Thanks, I got a Pogoplug V3 and have access to the serial line, I will forward port the 4.4 openwrt kernel to 4.7 ASAP and try to reproduce the bug encountered by Linus.

Neil

Neil Armstrong

2016-09-09 07:57 UTC #4 lore raw

PATCH 1/1 RFC: ARM: fix the uaccess crash on PB11MPCore

In reply to Linus Walleij

Quoted 17 lines · Linus Walleij

The following patch was sketched by Russell in response to my crashes on the PB11MPCore after the patch for software-based priviledged no access support for ARMv8.1. See this thread:
http://marc.info/?l=linux-arm-kernel&m=144051749807214&w=2
I am unsure what is going on, I suspect everyone involved in the discussion is. I just want to repost this to get the discussion restarted, as I still have to apply this patch with every kernel iteration to get my PB11MPCore Realview running.
I also know that Oxnas has actual, mass-deployed NAS (PogoPlug Pro variants) using PB11MPCore, and that they may or may not be seeing the same issue so I want their feedback on this: do you or do you not see this with mainline, or have you not even tested?

Quoted 8 lines

Cc Russell King <[email protected]>
Cc Will Deacon <[email protected]>
Cc Neil Armstrong <[email protected]>
Fixes a5e090acbf54 ("ARM: software-based priviledged-no-access support")
Signed-off-by Linus Walleij <[email protected]>
---
 arch/arm/kernel/smp_tlb.c | 7 +++++++
 1 file changed, 7 insertions(+)

Hi Linus, Russell, Arnd,

I made a quick port ox OX820 over v4.8-rc4 and when enabling CONFIG_CPU_SW_DOMAIN_PAN I get the following trace at boot time :

[    1.690000] Unable to handle kernel paging request at virtual address b6f23684
[    1.690000] Unable to handle kernel paging request at virtual address b6f95ef4
[    1.690000] pgd = c281c000
[    1.690000] [b6f95ef4] *pgd=62821831, *pte=00000000, *ppte=00000000
[    1.690000] Internal error: Oops: 81f [#1] SMP ARM
[    1.690000] Modules linked in:
[    1.690000] CPU: 1 PID: 65 Comm: mount Not tainted 4.8.0-rc4-00001-g0e9c45d-dirty #22
[    1.690000] Hardware name: Generic DT based system
[    1.690000] task: c2aad860 task.stack: c2814000
[    1.690000] PC is at ipi_flush_tlb_page+0x34/0x44
[    1.690000] LR is at on_each_cpu_mask+0x58/0x60
[    1.690000] pc : [<c010d3dc>]    lr : [<c017d584>]    psr: 20000193
[    1.690000] sp : c2815da0  ip : 00000002  fp : 00067c40
[    1.690000] r10: c0702744  r9 : 67c4079f  r8 : 67c9e75f
[    1.690000] r7 : c2815dbc  r6 : c010d3a8  r5 : c2816164  r4 : 20000113
[    1.690000] r3 : 00000000  r2 : b6f95003  r1 : 00000003  r0 : 00000003
[    1.690000] Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment none
[    1.690000] Control: 00c5787d  Table: 6281c00a  DAC: 00000051
[    1.690000] Process mount (pid: 65, stack limit = 0xc2814190)
[    1.690000] Stack: (0xc2815da0 to 0xc2816000)
[...]
[    1.690000] ---[ end trace 8f1207a6d611da09 ]---

When applying this patch, it solved the issue.

Tested-by Neil Armstrong <[email protected]>

Neil

Linus Walleij

author

2016-09-12 13:36 UTC #5 lore raw

PATCH 1/1 RFC: ARM: fix the uaccess crash on PB11MPCore

Quoted 55 lines · Neil Armstrong

Quoted 17 lines · Linus Walleij
The following patch was sketched by Russell in response to my crashes on the PB11MPCore after the patch for software-based priviledged no access support for ARMv8.1. See this thread:
http://marc.info/?l=linux-arm-kernel&m=144051749807214&w=2
I am unsure what is going on, I suspect everyone involved in the discussion is. I just want to repost this to get the discussion restarted, as I still have to apply this patch with every kernel iteration to get my PB11MPCore Realview running.
I also know that Oxnas has actual, mass-deployed NAS (PogoPlug Pro variants) using PB11MPCore, and that they may or may not be seeing the same issue so I want their feedback on this: do you or do you not see this with mainline, or have you not even tested?
Quoted 8 lines
Cc Russell King <[email protected]>
Cc Will Deacon <[email protected]>
Cc Neil Armstrong <[email protected]>
Fixes a5e090acbf54 ("ARM: software-based priviledged-no-access support")
Signed-off-by Linus Walleij <[email protected]>
---
 arch/arm/kernel/smp_tlb.c | 7 +++++++
 1 file changed, 7 insertions(+)
Hi Linus, Russell, Arnd,
I made a quick port ox OX820 over v4.8-rc4 and when enabling CONFIG_CPU_SW_DOMAIN_PAN I get the following trace at boot time :
[    1.690000] Unable to handle kernel paging request at virtual address b6f23684
[    1.690000] Unable to handle kernel paging request at virtual address b6f95ef4
[    1.690000] pgd = c281c000
[    1.690000] [b6f95ef4] *pgd=62821831, *pte=00000000, *ppte=00000000
[    1.690000] Internal error: Oops: 81f [#1] SMP ARM
[    1.690000] Modules linked in:
[    1.690000] CPU: 1 PID: 65 Comm: mount Not tainted 4.8.0-rc4-00001-g0e9c45d-dirty #22
[    1.690000] Hardware name: Generic DT based system
[    1.690000] task: c2aad860 task.stack: c2814000
[    1.690000] PC is at ipi_flush_tlb_page+0x34/0x44
[    1.690000] LR is at on_each_cpu_mask+0x58/0x60
[    1.690000] pc : [<c010d3dc>]    lr : [<c017d584>]    psr: 20000193
[    1.690000] sp : c2815da0  ip : 00000002  fp : 00067c40
[    1.690000] r10: c0702744  r9 : 67c4079f  r8 : 67c9e75f
[    1.690000] r7 : c2815dbc  r6 : c010d3a8  r5 : c2816164  r4 : 20000113
[    1.690000] r3 : 00000000  r2 : b6f95003  r1 : 00000003  r0 : 00000003
[    1.690000] Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment none
[    1.690000] Control: 00c5787d  Table: 6281c00a  DAC: 00000051
[    1.690000] Process mount (pid: 65, stack limit = 0xc2814190)
[    1.690000] Stack: (0xc2815da0 to 0xc2816000)
[...]
[    1.690000] ---[ end trace 8f1207a6d611da09 ]---

Quoted 3 lines

When applying this patch, it solved the issue.
Tested-by Neil Armstrong <[email protected]>

So this problem appears on all ARM11MPcore, not just the RealView.

Yours,
Linus Walleij

Neil Armstrong

2016-10-17 08:30 UTC #6 lore raw

PATCH 1/1 RFC: ARM: fix the uaccess crash on PB11MPCore

Quoted 56 lines · Linus Walleij

Quoted 55 lines · Neil Armstrong
Quoted 17 lines · Linus Walleij
The following patch was sketched by Russell in response to my crashes on the PB11MPCore after the patch for software-based priviledged no access support for ARMv8.1. See this thread:
http://marc.info/?l=linux-arm-kernel&m=144051749807214&w=2
I am unsure what is going on, I suspect everyone involved in the discussion is. I just want to repost this to get the discussion restarted, as I still have to apply this patch with every kernel iteration to get my PB11MPCore Realview running.
I also know that Oxnas has actual, mass-deployed NAS (PogoPlug Pro variants) using PB11MPCore, and that they may or may not be seeing the same issue so I want their feedback on this: do you or do you not see this with mainline, or have you not even tested?
Quoted 8 lines
Cc Russell King <[email protected]>
Cc Will Deacon <[email protected]>
Cc Neil Armstrong <[email protected]>
Fixes a5e090acbf54 ("ARM: software-based priviledged-no-access support")
Signed-off-by Linus Walleij <[email protected]>
---
 arch/arm/kernel/smp_tlb.c | 7 +++++++
 1 file changed, 7 insertions(+)
Hi Linus, Russell, Arnd,
I made a quick port ox OX820 over v4.8-rc4 and when enabling CONFIG_CPU_SW_DOMAIN_PAN I get the following trace at boot time :
[    1.690000] Unable to handle kernel paging request at virtual address b6f23684
[    1.690000] Unable to handle kernel paging request at virtual address b6f95ef4
[    1.690000] pgd = c281c000
[    1.690000] [b6f95ef4] *pgd=62821831, *pte=00000000, *ppte=00000000
[    1.690000] Internal error: Oops: 81f [#1] SMP ARM
[    1.690000] Modules linked in:
[    1.690000] CPU: 1 PID: 65 Comm: mount Not tainted 4.8.0-rc4-00001-g0e9c45d-dirty #22
[    1.690000] Hardware name: Generic DT based system
[    1.690000] task: c2aad860 task.stack: c2814000
[    1.690000] PC is at ipi_flush_tlb_page+0x34/0x44
[    1.690000] LR is at on_each_cpu_mask+0x58/0x60
[    1.690000] pc : [<c010d3dc>]    lr : [<c017d584>]    psr: 20000193
[    1.690000] sp : c2815da0  ip : 00000002  fp : 00067c40
[    1.690000] r10: c0702744  r9 : 67c4079f  r8 : 67c9e75f
[    1.690000] r7 : c2815dbc  r6 : c010d3a8  r5 : c2816164  r4 : 20000113
[    1.690000] r3 : 00000000  r2 : b6f95003  r1 : 00000003  r0 : 00000003
[    1.690000] Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment none
[    1.690000] Control: 00c5787d  Table: 6281c00a  DAC: 00000051
[    1.690000] Process mount (pid: 65, stack limit = 0xc2814190)
[    1.690000] Stack: (0xc2815da0 to 0xc2816000)
[...]
[    1.690000] ---[ end trace 8f1207a6d611da09 ]---

Quoted 9 lines

Quoted 3 lines
When applying this patch, it solved the issue.
Tested-by Neil Armstrong <[email protected]>
So this problem appears on all ARM11MPcore, not just the RealView.
Yours,
Linus Walleij

Hi Russell,

Is there a plan to push this fix as it appears to break the Realview platform and the OX820 I am currently pushing ?

Thanks,
Neil