io_uring sets up the io worker kernel thread via a syscall out of an
user space prrocess. This process might have used FPU and since
copy_thread() didn't clear FPU states for kernel threads a BUG()
is triggered for using FPU inside kernel. Move code around
to always clear FPU state for user and kernel threads.
Cc: [email protected]
Reported-by: Aurelien Jarno <[email protected]>
Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1055021
Signed-off-by: Thomas Bogendoerfer <[email protected]>
---
arch/mips/kernel/process.c | 25 +++++++++++++------------
1 file changed, 13 insertions(+), 12 deletions(-)
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 5387ed0a5186..b630604c577f 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -121,6 +121,19 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
/* Put the stack after the struct pt_regs. */
childksp = (unsigned long) childregs;
p->thread.cp0_status = (read_c0_status() & ~(ST0_CU2|ST0_CU1)) | ST0_KERNEL_CUMASK;
+
+ /*
+ * New tasks lose permission to use the fpu. This accelerates context
+ * switching for most programs since they don't use the fpu.
+ */
+ clear_tsk_thread_flag(p, TIF_USEDFPU);
+ clear_tsk_thread_flag(p, TIF_USEDMSA);
+ clear_tsk_thread_flag(p, TIF_MSA_CTX_LIVE);
+
+#ifdef CONFIG_MIPS_MT_FPAFF
+ clear_tsk_thread_flag(p, TIF_FPUBOUND);
+#endif /* CONFIG_MIPS_MT_FPAFF */
+
if (unlikely(args->fn)) {
/* kernel thread */
unsigned long status = p->thread.cp0_status;
@@ -149,20 +162,8 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
p->thread.reg29 = (unsigned long) childregs;
p->thread.reg31 = (unsigned long) ret_from_fork;
- /*
- * New tasks lose permission to use the fpu. This accelerates context
- * switching for most programs since they don't use the fpu.
- */
childregs->cp0_status &= ~(ST0_CU2|ST0_CU1);
- clear_tsk_thread_flag(p, TIF_USEDFPU);
- clear_tsk_thread_flag(p, TIF_USEDMSA);
- clear_tsk_thread_flag(p, TIF_MSA_CTX_LIVE);
-
-#ifdef CONFIG_MIPS_MT_FPAFF
- clear_tsk_thread_flag(p, TIF_FPUBOUND);
-#endif /* CONFIG_MIPS_MT_FPAFF */
-
#ifdef CONFIG_MIPS_FP_SUPPORT
atomic_set(&p->thread.bd_emu_frame, BD_EMUFRAME_NONE);
#endif
--
2.35.3
在2023年11月30日十一月 下午4:36，Thomas Bogendoerfer写道：
> io_uring sets up the io worker kernel thread via a syscall out of an
> user space prrocess. This process might have used FPU and since
> copy_thread() didn't clear FPU states for kernel threads a BUG()
> is triggered for using FPU inside kernel. Move code around
> to always clear FPU state for user and kernel threads.
>
> Cc: [email protected]
> Reported-by: Aurelien Jarno <[email protected]>
> Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1055021
> Signed-off-by: Thomas Bogendoerfer <[email protected]>
Reviewed-by: Jiaxun Yang <[email protected]>
Perhaps
Suggested-by: Jiaxun Yang <[email protected]>
As well :-)
Thanks
- Jiaxun
> ---
> arch/mips/kernel/process.c | 25 +++++++++++++------------
> 1 file changed, 13 insertions(+), 12 deletions(-)
>
> diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
> index 5387ed0a5186..b630604c577f 100644
> --- a/arch/mips/kernel/process.c
> +++ b/arch/mips/kernel/process.c
> @@ -121,6 +121,19 @@ int copy_thread(struct task_struct *p, const
> struct kernel_clone_args *args)
> /* Put the stack after the struct pt_regs. */
> childksp = (unsigned long) childregs;
> p->thread.cp0_status = (read_c0_status() & ~(ST0_CU2|ST0_CU1)) |
> ST0_KERNEL_CUMASK;
> +
> + /*
> + * New tasks lose permission to use the fpu. This accelerates context
> + * switching for most programs since they don't use the fpu.
> + */
> + clear_tsk_thread_flag(p, TIF_USEDFPU);
> + clear_tsk_thread_flag(p, TIF_USEDMSA);
> + clear_tsk_thread_flag(p, TIF_MSA_CTX_LIVE);
> +
> +#ifdef CONFIG_MIPS_MT_FPAFF
> + clear_tsk_thread_flag(p, TIF_FPUBOUND);
> +#endif /* CONFIG_MIPS_MT_FPAFF */
> +
> if (unlikely(args->fn)) {
> /* kernel thread */
> unsigned long status = p->thread.cp0_status;
> @@ -149,20 +162,8 @@ int copy_thread(struct task_struct *p, const
> struct kernel_clone_args *args)
> p->thread.reg29 = (unsigned long) childregs;
> p->thread.reg31 = (unsigned long) ret_from_fork;
>
> - /*
> - * New tasks lose permission to use the fpu. This accelerates context
> - * switching for most programs since they don't use the fpu.
> - */
> childregs->cp0_status &= ~(ST0_CU2|ST0_CU1);
>
> - clear_tsk_thread_flag(p, TIF_USEDFPU);
> - clear_tsk_thread_flag(p, TIF_USEDMSA);
> - clear_tsk_thread_flag(p, TIF_MSA_CTX_LIVE);
> -
> -#ifdef CONFIG_MIPS_MT_FPAFF
> - clear_tsk_thread_flag(p, TIF_FPUBOUND);
> -#endif /* CONFIG_MIPS_MT_FPAFF */
> -
> #ifdef CONFIG_MIPS_FP_SUPPORT
> atomic_set(&p->thread.bd_emu_frame, BD_EMUFRAME_NONE);
> #endif
> --
> 2.35.3
--
- Jiaxun
On Fri, Dec 01, 2023 at 11:12:21AM +0000, Jiaxun Yang wrote:
>
>
> 在2023年11月30日十一月 下午4:36，Thomas Bogendoerfer写道：
> > io_uring sets up the io worker kernel thread via a syscall out of an
> > user space prrocess. This process might have used FPU and since
> > copy_thread() didn't clear FPU states for kernel threads a BUG()
> > is triggered for using FPU inside kernel. Move code around
> > to always clear FPU state for user and kernel threads.
> >
> > Cc: [email protected]
> > Reported-by: Aurelien Jarno <[email protected]>
> > Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1055021
> > Signed-off-by: Thomas Bogendoerfer <[email protected]>
>
> Reviewed-by: Jiaxun Yang <[email protected]>
>
> Perhaps
> Suggested-by: Jiaxun Yang <[email protected]>
>
> As well :-)
I've added both
Thomas.
--
Crap can work. Given enough thrust pigs will fly, but it's not necessarily a
good idea. [ RFC1925, 2.3 ]
On Thu, Nov 30, 2023 at 05:36:01PM +0100, Thomas Bogendoerfer wrote:
> io_uring sets up the io worker kernel thread via a syscall out of an
> user space prrocess. This process might have used FPU and since
> copy_thread() didn't clear FPU states for kernel threads a BUG()
> is triggered for using FPU inside kernel. Move code around
> to always clear FPU state for user and kernel threads.
>
> Cc: [email protected]
> Reported-by: Aurelien Jarno <[email protected]>
> Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1055021
> Signed-off-by: Thomas Bogendoerfer <[email protected]>
> ---
> arch/mips/kernel/process.c | 25 +++++++++++++------------
> 1 file changed, 13 insertions(+), 12 deletions(-)
applied to mips-fixes.
Thomas.
--
Crap can work. Given enough thrust pigs will fly, but it's not necessarily a
good idea. [ RFC1925, 2.3 ]