From: Konrad Rzeszutek Wilk Subject: Re: git commit 9fd67b4ed0714ab718f1f9bd14c344af336a6df7 (x86-64: Give vvars their own page) breaks Xen PV guests (64-bit). Date: Tue, 26 Jul 2011 12:18:08 -0400 Message-ID: <20110726161808.GA5333@dumpdata.com> References: <20110725155442.GA21759@dumpdata.com> <20110725161009.GA9193@dumpdata.com> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: QUOTED-PRINTABLE Return-path: Content-Disposition: inline In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org To: Andrew Lutomirski Cc: jj@chaosbits.net, linux-kernel@vger.kernel.org, xen-devel@lists.xensource.com, arjan@infradead.org, JBeulich@novell.com, richard.weinberger@gmail.com, mikpe@it.uu.se, andi@firstfloor.org, brgerst@gmail.com, Louis.Rilling@kerlabs.com, Valdis.Kletnieks@vt.edu, pageexec@freemail.hu, mingo@elte.hu, Jeremy Fitzhardinge , Stefano Stabellini , Ian Campbell List-Id: xen-devel@lists.xenproject.org > > However, this is what I get later on, any ideas? >=20 > > [ =A0 =A00.585880] init[1] illegal int 0xcc from 32-bit mode ip:fff= fffffff600400 cs:e033 sp:7fff230ca088 ax:ffffffffff600400 si:7faee3e822= bf di:7fff230ca158 >=20 > That will, indeed, crash your system. >=20 > 0xe033 is FLAT_RING3_CS64 >=20 > Jeremy / other Xen people: I'm trying to implement a lightweight > check to distinguish a trap from a sane (i.e. allowable for syscalls) > 64-bit user context from anything else. There seems to be precedent > for using ->cs =3D=3D __USER_CS to detect 64-bitness; for example, st= ep.c > contains: >=20 > #ifdef CONFIG_X86_64 > case 0x40 ... 0x4f: > if (regs->cs !=3D __USER_CS) > /* 32-bit mode: register increment */ > return 0; > /* 64-bit mode: REX prefix */ > continue; > #endif >=20 > The prefetch opcode checker in mm/fault.c does something similar. >=20 > Even the sysret code in xen/xen-asm_64.S does: >=20 > pushq %r11 > pushq $__USER_CS > pushq %rcx >=20 > So I'm at a bit of a loss. >=20 > You could probably hack it up and get your kernel to boot by allowing > __USER_CS and 0xe033 in that check, but I'd rather understand it Did this little hack: diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_6= 4.c index dda7dff..5d0cf37 100644 --- a/arch/x86/kernel/vsyscall_64.c +++ b/arch/x86/kernel/vsyscall_64.c @@ -131,7 +131,7 @@ void dotraplinkage do_emulate_vsyscall(struct pt_re= gs *regs, long error_code) * Real 64-bit user mode code has cs =3D=3D __USER_CS. Anything else * is bogus. */ - if (regs->cs !=3D __USER_CS) { + if ((regs->cs !=3D __USER_CS) && (regs->cs !=3D FLAT_RING3_CS64)) { /* * If we trapped from kernel mode, we might as well OOPS now * instead of returning to some random address and OOPSing diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c index f987bde..0e4c13c 100644 --- a/arch/x86/xen/mmu.c +++ b/arch/x86/xen/mmu.c @@ -1916,6 +1916,7 @@ static void xen_set_fixmap(unsigned idx, phys_add= r_t phys, pgprot_t prot) # endif #else case VSYSCALL_LAST_PAGE ... VSYSCALL_FIRST_PAGE: + case VVAR_PAGE: #endif case FIX_TEXT_POKE0: case FIX_TEXT_POKE1: And getting this on 64-bit: started: BusyBox v1.14.3 (2011-07-26 11:43:49 EDT) [ 0.578603] rcS[1128]: segfault at ffffffffff5ff0a0 ip 00007fff40b73= 80a sp 00007fff40b5c0f0 error 4 [ 0.578847] rcS used greatest stack depth: 5024 bytes left [ 0.581897] sh[1131]: segfault at ffffffffff5ff0a0 ip 00007fffb93ff8= 0a sp 00007fffb92bbd70 error 4 [ 1.587637] sh[1137]: segfault at ffffffffff5ff0a0 ip 00007ffffa5ff8= 0a sp 00007ffffa522560 error 4 [ 2.592295] sh[1141]: segfault at ffffffffff5ff0a0 ip 00007ffffcb3f8= 0a sp 00007ffffca98af0 error 4 [ 3.596344] sh[1145]: segfault at ffffffffff5ff0a0 ip 00007fff2e3ff8= 0a sp 00007fff2e3e3370 error 4 [ 4.599812] sh[1149]: segfault at ffffffffff5ff0a0 ip 00007fff62dff8= 0a sp 00007fff62ca9f10 error 4 [ 5.605835] sh[1153]: segfault at ffffffffff5ff0a0 ip 00007fff117ff8= 0a sp 00007fff1175e7f0 error 4 [ 6.609438] sh[1157]: segfault at ffffffffff5ff0a0 ip 00007fff91bff8= 0a sp 00007fff91bd71c0 error 4 [ 7.614714] sh[1161]: segfault at ffffffffff5ff0a0 ip 00007fff396b28= 0a sp 00007fff3968ede0 error 4 [ 8.620374] sh[1165]: segfault at ffffffffff5ff0a0 ip 00007fffd398b8= 0a sp 00007fffd38ecd70 error 4 [ 9.625512] sh[1169]: segfault at ffffffffff5ff0a0 ip 00007fff617d98= 0a sp 00007fff61776070 error 4 [ 10.630246] sh[1173]: segfault at ffffffffff5ff0a0 ip 00007fff89fff8= 0a sp 00007fff89f7f3b0 error 4 [ 11.635588] sh[1177]: segfault at ffffffffff5ff0a0 ip 00007fffa95ff8= 0a sp 00007fffa95ea7c0 error 4 [ 12.640491] sh[1181]: segfault at ffffffffff5ff0a0 ip 00007fff28cd18= 0a sp 00007fff28c524f0 error 4 =2E.