[regression] segfault in Qt apps running on Linux kernel 6.10.8 ARM with LPAE

[regression] segfault in Qt apps running on Linux kernel 6.10.8 ARM with LPAE

[Linux regression tracking (Thorsten Leemhuis)]

Hi, Thorsten here, the Linux kernel's regression tracker.

Catalin, Linus, I noticed a report about a regression in
bugzilla.kernel.org that appears to be caused by a change of yours:

7af5b901e84743 ("ARM: 9358/2: Implement PAN for LPAE by TTBR0 page table
walks disablement") [v6.10-rc1]

As many (most?) kernel developers don't keep an eye on the bug tracker,
I decided to write this mail. To quote from https://bugzilla.kernel.org/
show_bug.cgi?id=219247 :

> Trying to run LxQt on a Chromebook XE303C12 with Devuan 4 and Linux
> kernel 6.10.8 results in a segmentation fault (for LxQt). There are
> no such problems with Linux kernel 6.9.12 or earlier. With Linux
> kernel 6.10.8 it is possible to run Xfce4, but trying to run for
> example Kate ends in a segmentation fault. Mesa 20.3.5, patched for
> partial hardware acceleration, preserves this acceleration in Xfce4.
> The mpv works using acceleration regardless of the Linux kernel
> version. dmesg does not give anything significantly new compared to
> previous kernel version.

See the ticket for more details and the bisection log. The reporter is CCed.

Ciao, Thorsten (wearing his 'the Linux kernel's regression tracker' hat)
--
Everything you wanna know about Linux kernel regression tracking:
https://linux-regtracking.leemhuis.info/about/#tldr
If I did something stupid, please tell me, as explained on that page.

P.S.: let me use this mail to also add the report to the list of tracked
regressions to ensure it's doesn't fall through the cracks:

#regzbot introduced: 7af5b901e84743c608aae90cb0e429702812c324
#regzbot title: ARM: segfault in Qt apps running on Linux kernel 6.10.8
ARM with LPAE
#regzbot from: Andrew
#regzbot duplicate: https://bugzilla.kernel.org/show_bug.cgi?id=219247
#regzbot ignore-activity

Re: [regression] segfault in Qt apps running on Linux kernel 6.10.8 ARM with LPAE

[Catalin Marinas]

On Wed, Sep 25, 2024 at 02:23:35PM +0200, Linux regression tracking (Thorsten Leemhuis) wrote:
> Catalin, Linus, I noticed a report about a regression in
> bugzilla.kernel.org that appears to be caused by a change of yours:
> 
> 7af5b901e84743 ("ARM: 9358/2: Implement PAN for LPAE by TTBR0 page table
> walks disablement") [v6.10-rc1]
> 
> As many (most?) kernel developers don't keep an eye on the bug tracker,
> I decided to write this mail. To quote from
> https://bugzilla.kernel.org/show_bug.cgi?id=219247 :
> 
> > Trying to run LxQt on a Chromebook XE303C12 with Devuan 4 and Linux
> > kernel 6.10.8 results in a segmentation fault (for LxQt). There are
> > no such problems with Linux kernel 6.9.12 or earlier. With Linux
> > kernel 6.10.8 it is possible to run Xfce4, but trying to run for
> > example Kate ends in a segmentation fault. Mesa 20.3.5, patched for
> > partial hardware acceleration, preserves this acceleration in Xfce4.
> > The mpv works using acceleration regardless of the Linux kernel
> > version. dmesg does not give anything significantly new compared to
> > previous kernel version.
> 
> See the ticket for more details and the bisection log. The reporter is CCed.

I had a quick look and the fault seems to be a level 2 translation fault
while in user space (code 0x206). I can't tell whether the fault address
is valid and we just messed up the pairing of user access enable/disable
or something else happened. Having TTBCR.PD0 == 1 does lead to
translation faults, though not sure what the DFSR register says. Anyway,
normally I'd expect do_page_fault() to get stuck in a continuous fault
loop if the vma was valid rather than end up with SIGSEGV.

Andrew, could you please share the .config file you have, maybe attach
it to the bugzilla report? Also, could you try the kernel with
CONFIG_CPU_TTBR0_PAN disabled without any patches reverted?

Another thing to try is invalidate the TLBs before returning to user,
just in case those TTBCR bits are cached in the TLB in a way we did not
envisage. Untested diff below:

----------------8<--------------------------------
diff --git a/arch/arm/include/asm/uaccess-asm.h b/arch/arm/include/asm/uaccess-asm.h
index 4bccd895d954..c00b400b7f4d 100644
--- a/arch/arm/include/asm/uaccess-asm.h
+++ b/arch/arm/include/asm/uaccess-asm.h
@@ -91,6 +91,9 @@
 	bic	\tmp, \tmp, #TTBCR_EPD0 | TTBCR_T0SZ_MASK
 	bic	\tmp, \tmp, #TTBCR_A1
 	mcr	p15, 0, \tmp, c2, c0, 2		@ write TTBCR
+	isb
+	mcr	p15, 0, \tmp, c8, c7, 0		@ invalidate TLBs
+	dsb
 	.if	\isb
 	instr_sync
 	.endif
----------------8<--------------------------------

Thanks.

-- 
Catalin