lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Fri, 18 Dec 2020 13:48:09 +0000
From:   Guillaume Tucker <guillaume.tucker@...labora.com>
To:     kernelci-results@...ups.io,
        Linus Walleij <linus.walleij@...aro.org>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Russell King <rmk+kernel@...linux.org.uk>,
        Ard Biesheuvel <ardb@...nel.org>
Cc:     Kees Cook <keescook@...omium.org>,
        linux-arm-kernel@...ts.infradead.org,
        Abbott Liu <liuwenliang@...wei.com>,
        linux-kernel@...r.kernel.org, Ingo Molnar <mingo@...nel.org>,
        Russell King <linux@...linux.org.uk>,
        "kernelci@...ups.io" <kernelci@...ups.io>
Subject: Re: next/master bisection: baseline.login on
 ox820-cloudengines-pogoplug-series-3

Hi Ard,

Please see the bisection report below about a boot failure on
ox820-cloudengines-pogoplug-series-3.  There was also a bisection
yesterday with next-20201216 which landed on the same commit, on
the same platform and also with oxnas_v6_defconfig.  I'm not
aware of any other platform on kernelci.org showing the same
regression.

Hope this helps!

Best wishes,
Guillaume

On 18/12/2020 10:51, KernelCI bot wrote:
> * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
> * This automated bisection report was sent to you on the basis  *
> * that you may be involved with the breaking commit it has      *
> * found.  No manual investigation has been done to verify it,   *
> * and the root cause of the problem may be somewhere else.      *
> *                                                               *
> * If you do send a fix, please include this trailer:            *
> *   Reported-by: "kernelci.org bot" <bot@...nelci.org>          *
> *                                                               *
> * Hope this helps!                                              *
> * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
> 
> next/master bisection: baseline.login on ox820-cloudengines-pogoplug-series-3
> 
> Summary:
>   Start:      90cc8cf2d1ab Add linux-next specific files for 20201217
>   Plain log:  https://storage.kernelci.org/next/master/next-20201217/arm/oxnas_v6_defconfig/gcc-8/lab-baylibre/baseline-ox820-cloudengines-pogoplug-series-3.txt
>   HTML log:   https://storage.kernelci.org/next/master/next-20201217/arm/oxnas_v6_defconfig/gcc-8/lab-baylibre/baseline-ox820-cloudengines-pogoplug-series-3.html
>   Result:     f77ac2e378be ARM: 9030/1: entry: omit FP emulation for UND exceptions taken in kernel mode
> 
> Checks:
>   revert:     PASS
>   verify:     PASS
> 
> Parameters:
>   Tree:       next
>   URL:        https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
>   Branch:     master
>   Target:     ox820-cloudengines-pogoplug-series-3
>   CPU arch:   arm
>   Lab:        lab-baylibre
>   Compiler:   gcc-8
>   Config:     oxnas_v6_defconfig
>   Test case:  baseline.login
> 
> Breaking commit found:
> 
> -------------------------------------------------------------------------------
> commit f77ac2e378be9dd61eb88728f0840642f045d9d1
> Author: Ard Biesheuvel <ardb@...nel.org>
> Date:   Thu Nov 19 18:09:16 2020 +0100
> 
>     ARM: 9030/1: entry: omit FP emulation for UND exceptions taken in kernel mode
>     
>     There are a couple of problems with the exception entry code that deals
>     with FP exceptions (which are reported as UND exceptions) when building
>     the kernel in Thumb2 mode:
>     - the conditional branch to vfp_kmode_exception in vfp_support_entry()
>       may be out of range for its target, depending on how the linker decides
>       to arrange the sections;
>     - when the UND exception is taken in kernel mode, the emulation handling
>       logic is entered via the 'call_fpe' label, which means we end up using
>       the wrong value/mask pairs to match and detect the NEON opcodes.
>     
>     Since UND exceptions in kernel mode are unlikely to occur on a hot path
>     (as opposed to the user mode version which is invoked for VFP support
>     code and lazy restore), we can use the existing undef hook machinery for
>     any kernel mode instruction emulation that is needed, including calling
>     the existing vfp_kmode_exception() routine for unexpected cases. So drop
>     the call to call_fpe, and instead, install an undef hook that will get
>     called for NEON and VFP instructions that trigger an UND exception in
>     kernel mode.
>     
>     While at it, make sure that the PC correction is accurate for the
>     execution mode where the exception was taken, by checking the PSR
>     Thumb bit.
>     
>     Cc: Dmitry Osipenko <digetx@...il.com>
>     Cc: Kees Cook <keescook@...omium.org>
>     Fixes: eff8728fe698 ("vmlinux.lds.h: Add PGO and AutoFDO input sections")
>     Signed-off-by: Ard Biesheuvel <ardb@...nel.org>
>     Reviewed-by: Linus Walleij <linus.walleij@...aro.org>
>     Reviewed-by: Nick Desaulniers <ndesaulniers@...gle.com>
>     Signed-off-by: Russell King <rmk+kernel@...linux.org.uk>
> 
> diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
> index c4220f51fcf3..0ea8529a4872 100644
> --- a/arch/arm/kernel/entry-armv.S
> +++ b/arch/arm/kernel/entry-armv.S
> @@ -252,31 +252,10 @@ __und_svc:
>  #else
>  	svc_entry
>  #endif
> -	@
> -	@ call emulation code, which returns using r9 if it has emulated
> -	@ the instruction, or the more conventional lr if we are to treat
> -	@ this as a real undefined instruction
> -	@
> -	@  r0 - instruction
> -	@
> -#ifndef CONFIG_THUMB2_KERNEL
> -	ldr	r0, [r4, #-4]
> -#else
> -	mov	r1, #2
> -	ldrh	r0, [r4, #-2]			@ Thumb instruction at LR - 2
> -	cmp	r0, #0xe800			@ 32-bit instruction if xx >= 0
> -	blo	__und_svc_fault
> -	ldrh	r9, [r4]			@ bottom 16 bits
> -	add	r4, r4, #2
> -	str	r4, [sp, #S_PC]
> -	orr	r0, r9, r0, lsl #16
> -#endif
> -	badr	r9, __und_svc_finish
> -	mov	r2, r4
> -	bl	call_fpe
>  
>  	mov	r1, #4				@ PC correction to apply
> -__und_svc_fault:
> + THUMB(	tst	r5, #PSR_T_BIT		)	@ exception taken in Thumb mode?
> + THUMB(	movne	r1, #2			)	@ if so, fix up PC correction
>  	mov	r0, sp				@ struct pt_regs *regs
>  	bl	__und_fault
>  
> diff --git a/arch/arm/vfp/vfphw.S b/arch/arm/vfp/vfphw.S
> index 4fcff9f59947..d5837bf05a9a 100644
> --- a/arch/arm/vfp/vfphw.S
> +++ b/arch/arm/vfp/vfphw.S
> @@ -79,11 +79,6 @@ ENTRY(vfp_support_entry)
>  	DBGSTR3	"instr %08x pc %08x state %p", r0, r2, r10
>  
>  	.fpu	vfpv2
> -	ldr	r3, [sp, #S_PSR]	@ Neither lazy restore nor FP exceptions
> -	and	r3, r3, #MODE_MASK	@ are supported in kernel mode
> -	teq	r3, #USR_MODE
> -	bne	vfp_kmode_exception	@ Returns through lr
> -
>  	VFPFMRX	r1, FPEXC		@ Is the VFP enabled?
>  	DBGSTR1	"fpexc %08x", r1
>  	tst	r1, #FPEXC_EN
> diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
> index 8c9e7f9f0277..c3b6451c18bd 100644
> --- a/arch/arm/vfp/vfpmodule.c
> +++ b/arch/arm/vfp/vfpmodule.c
> @@ -23,6 +23,7 @@
>  #include <asm/cputype.h>
>  #include <asm/system_info.h>
>  #include <asm/thread_notify.h>
> +#include <asm/traps.h>
>  #include <asm/vfp.h>
>  
>  #include "vfpinstr.h"
> @@ -642,7 +643,9 @@ static int vfp_starting_cpu(unsigned int unused)
>  	return 0;
>  }
>  
> -void vfp_kmode_exception(void)
> +#ifdef CONFIG_KERNEL_MODE_NEON
> +
> +static int vfp_kmode_exception(struct pt_regs *regs, unsigned int instr)
>  {
>  	/*
>  	 * If we reach this point, a floating point exception has been raised
> @@ -660,9 +663,51 @@ void vfp_kmode_exception(void)
>  		pr_crit("BUG: unsupported FP instruction in kernel mode\n");
>  	else
>  		pr_crit("BUG: FP instruction issued in kernel mode with FP unit disabled\n");
> +	pr_crit("FPEXC == 0x%08x\n", fmrx(FPEXC));
> +	return 1;
>  }
>  
> -#ifdef CONFIG_KERNEL_MODE_NEON
> +static struct undef_hook vfp_kmode_exception_hook[] = {{
> +	.instr_mask	= 0xfe000000,
> +	.instr_val	= 0xf2000000,
> +	.cpsr_mask	= MODE_MASK | PSR_T_BIT,
> +	.cpsr_val	= SVC_MODE,
> +	.fn		= vfp_kmode_exception,
> +}, {
> +	.instr_mask	= 0xff100000,
> +	.instr_val	= 0xf4000000,
> +	.cpsr_mask	= MODE_MASK | PSR_T_BIT,
> +	.cpsr_val	= SVC_MODE,
> +	.fn		= vfp_kmode_exception,
> +}, {
> +	.instr_mask	= 0xef000000,
> +	.instr_val	= 0xef000000,
> +	.cpsr_mask	= MODE_MASK | PSR_T_BIT,
> +	.cpsr_val	= SVC_MODE | PSR_T_BIT,
> +	.fn		= vfp_kmode_exception,
> +}, {
> +	.instr_mask	= 0xff100000,
> +	.instr_val	= 0xf9000000,
> +	.cpsr_mask	= MODE_MASK | PSR_T_BIT,
> +	.cpsr_val	= SVC_MODE | PSR_T_BIT,
> +	.fn		= vfp_kmode_exception,
> +}, {
> +	.instr_mask	= 0x0c000e00,
> +	.instr_val	= 0x0c000a00,
> +	.cpsr_mask	= MODE_MASK,
> +	.cpsr_val	= SVC_MODE,
> +	.fn		= vfp_kmode_exception,
> +}};
> +
> +static int __init vfp_kmode_exception_hook_init(void)
> +{
> +	int i;
> +
> +	for (i = 0; i < ARRAY_SIZE(vfp_kmode_exception_hook); i++)
> +		register_undef_hook(&vfp_kmode_exception_hook[i]);
> +	return 0;
> +}
> +core_initcall(vfp_kmode_exception_hook_init);
>  
>  /*
>   * Kernel-side NEON support functions
> -------------------------------------------------------------------------------
> 
> 
> Git bisection log:
> 
> -------------------------------------------------------------------------------
> git bisect start
> # good: [31f6551ad75608d9c71fd4d3548c33f1abc52093] cifs: handle "guest" mount parameter
> git bisect good 31f6551ad75608d9c71fd4d3548c33f1abc52093
> # bad: [90cc8cf2d1ab87d708ebc311ac104ccbbefad9fc] Add linux-next specific files for 20201217
> git bisect bad 90cc8cf2d1ab87d708ebc311ac104ccbbefad9fc
> # good: [3db1a3fa98808aa90f95ec3e0fa2fc7abf28f5c9] Merge tag 'staging-5.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
> git bisect good 3db1a3fa98808aa90f95ec3e0fa2fc7abf28f5c9
> # bad: [4538b80cd2885c885e3bf06e5103bc0f214c11ee] Merge remote-tracking branch 'arm-soc/for-next'
> git bisect bad 4538b80cd2885c885e3bf06e5103bc0f214c11ee
> # good: [5ee863bec794f30bdf7fdf57ce0d9f579b0d1aa3] Merge branch 'parisc-5.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux
> git bisect good 5ee863bec794f30bdf7fdf57ce0d9f579b0d1aa3
> # good: [fb10b701887b9fce88aacc06ca4b6c9160ca7a66] Merge branch 'arm/dt' into for-next
> git bisect good fb10b701887b9fce88aacc06ca4b6c9160ca7a66
> # good: [821a8a63a6b55ee5325e07bf5ab7d7a1752009d1] Merge remote-tracking branch 'asm-generic/master'
> git bisect good 821a8a63a6b55ee5325e07bf5ab7d7a1752009d1
> # good: [7debceff46eef5350bf2b62494c7772f78b22257] Merge branch 'arm/dt' into for-next
> git bisect good 7debceff46eef5350bf2b62494c7772f78b22257
> # bad: [b383a1412e0df59c556abb93c1fa2399e91b6102] Merge remote-tracking branch 'arm64/for-next/core'
> git bisect bad b383a1412e0df59c556abb93c1fa2399e91b6102
> # good: [113eb4ce4fc33ef3deda1431497811d43342c0cc] Merge branch 'for-next/iommu/vt-d' into for-next/iommu/core
> git bisect good 113eb4ce4fc33ef3deda1431497811d43342c0cc
> # skip: [eb86b15a2c53e2263b7cbad00a0100c8451989dc] Merge branches 'fixes' and 'misc' into for-next
> git bisect skip eb86b15a2c53e2263b7cbad00a0100c8451989dc
> # skip: [2a50d6b9cfe96ef5d39b9c3497dcc83a907d00cd] ARM: 9033/1: arm/smp: Drop the macro S(x,s)
> git bisect skip 2a50d6b9cfe96ef5d39b9c3497dcc83a907d00cd
> # good: [421015713b306e47af95d4d61cdfbd96d462e4cb] ARM: 9017/2: Enable KASan for ARM
> git bisect good 421015713b306e47af95d4d61cdfbd96d462e4cb
> # good: [2c736bb4087f2cb949cbbaf4148733131b8466dc] Merge tag 'arm-adrl-replacement-for-v5.11' of git://git.kernel.org/pub/scm/linux/kernel/git/ardb/linux into devel-stable
> git bisect good 2c736bb4087f2cb949cbbaf4148733131b8466dc
> # skip: [3597a10e4c444f3d4d6a64bdc98e4585a99301b9] ARM: 9036/1: uncompress: Fix dbgadtb size parameter name
> git bisect skip 3597a10e4c444f3d4d6a64bdc98e4585a99301b9
> # skip: [1205285c7a71c3b7a879e31ec477639f2dac22b1] ARM: 9027/1: head.S: explicitly map DT even if it lives in the first physical section
> git bisect skip 1205285c7a71c3b7a879e31ec477639f2dac22b1
> # good: [71fe89ceb55bc0a85121b757cc8d3fb6ff457263] dma-iommu: remove __iommu_dma_mmap
> git bisect good 71fe89ceb55bc0a85121b757cc8d3fb6ff457263
> # skip: [17fb1a208129e3472ec45be08cbe39601a407e2c] ARM: 9031/1: hyp-stub: remove unused .L__boot_cpu_mode_offset symbol
> git bisect skip 17fb1a208129e3472ec45be08cbe39601a407e2c
> # good: [95d1718c961e49cfa02995ce1587a22cd7e2fbf5] Merge remote-tracking branch 'arm64/for-next/iommu/core' into for-next/core
> git bisect good 95d1718c961e49cfa02995ce1587a22cd7e2fbf5
> # skip: [0fe88ade3f937d6efc276901a56be6575a5a2171] ARM: 9032/1: arm/mm: Convert PUD level pgtable helper macros into functions
> git bisect skip 0fe88ade3f937d6efc276901a56be6575a5a2171
> # good: [730b5764ea8526e48bdb85a24ed96d62de435940] ARM: 9024/1: Drop useless cast of "u64" to "long long"
> git bisect good 730b5764ea8526e48bdb85a24ed96d62de435940
> # good: [4d576cab16f57e1f87978f6997a725179398341e] ARM: 9028/1: disable KASAN in call stack capturing routines
> git bisect good 4d576cab16f57e1f87978f6997a725179398341e
> # skip: [3bdf1a7503d61d2241f93f36e9c0d8a0d444bc5c] ARM: 9037/1: uncompress: Add OF_DT_MAGIC macro
> git bisect skip 3bdf1a7503d61d2241f93f36e9c0d8a0d444bc5c
> # bad: [f77ac2e378be9dd61eb88728f0840642f045d9d1] ARM: 9030/1: entry: omit FP emulation for UND exceptions taken in kernel mode
> git bisect bad f77ac2e378be9dd61eb88728f0840642f045d9d1
> # good: [3c9f5708b7aed6a963e2aefccbd1854802de163e] ARM: 9029/1: Make iwmmxt.S support Clang's integrated assembler
> git bisect good 3c9f5708b7aed6a963e2aefccbd1854802de163e
> # first bad commit: [f77ac2e378be9dd61eb88728f0840642f045d9d1] ARM: 9030/1: entry: omit FP emulation for UND exceptions taken in kernel mode
> -------------------------------------------------------------------------------
> 
> 
> -=-=-=-=-=-=-=-=-=-=-=-
> Groups.io Links: You receive all messages sent to this group.
> View/Reply Online (#4773): https://groups.io/g/kernelci-results/message/4773
> Mute This Topic: https://groups.io/mt/79040317/924702
> Group Owner: kernelci-results+owner@...ups.io
> Unsubscribe: https://groups.io/g/kernelci-results/unsub [guillaume.tucker@...labora.com]
> -=-=-=-=-=-=-=-=-=-=-=-
> 
> 

Powered by blists - more mailing lists