kaiser: Set _PAGE_NX only if supported
Subsystems (3)
PATCH 1/1 kaiser: Set _PAGE_NX only if supported
This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed out that the reason of that crash is that NX bit get set for page tables. It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map
See https://www.spinics.net/lists/kernel/msg2689835.html for details.
--- arch/x86/mm/kaiser.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/x86/mm/kaiser.c +4 -0
@@ -198,6 +198,10 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,* requires that not to be #defined to 0): so mask it off here. */ flags &= ~_PAGE_GLOBAL; +/* If CPU doesn't support NX, don't set it. */ +if (!(__supported_pte_mask & _PAGE_NX)) + flags &= ~_PAGE_NX; +for (; address < end_addr; address +=PAGE_SIZE ) { target_address =get_pa_from_mapping (address);
Signature · 1 line
2.16.0.rc1.238.g530d649a79-goog
PATCH v2 1/1 kaiser: Set _PAGE_NX only if supported
This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed out that the reason of that crash is that NX bit get set for page tables. It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map
See https://www.spinics.net/lists/kernel/msg2689835.html for details.
--- arch/x86/mm/kaiser.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/mm/kaiser.c +2 -0
@@ -198,6 +198,8 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,* requires that not to be #defined to 0): so mask it off here. */ flags &= ~_PAGE_GLOBAL; +if (!(__supported_pte_mask & _PAGE_NX)) + flags &= ~_PAGE_NX;for (; address < end_addr; address +=PAGE_SIZE ) { target_address =get_pa_from_mapping (address);
Signature · 1 line
2.16.0.rc1.238.g530d649a79-goog
Quoted 6 lines · Lepton Wu
This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed out that the reason of that crash is that NX bit get set for page tables. It seems we missed checking if
_PAGE_NXis supported inkaiser_add_user_mapSee https://www.spinics.net/lists/kernel/msg2689835.html for details.
You might want to use
instead.
Quoted 10 lines
Signed-off-by Lepton Wu <[email protected]>--- arch/x86/mm/kaiser.c | 4 ++++ 1 file changed, 4 insertions(+)arch/x86/mm/kaiser.c +0
-0
arch/x86/mm/kaiser.c static int kaiser_add_user_map(const void *__start_addr, unsigned long size, · line 202
Quoted 5 lines
arch/x86/mm/kaiser.c +2
-0@@ -198,6 +198,10 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,* requires that not to be #defined to 0): so mask it off here. */ flags &= ~_PAGE_GLOBAL; +/* If CPU doesn't support NX, don't set it. */ +if (!(__supported_pte_mask & _PAGE_NX))
This line has spaces instead of a tab at the beginning of the line, resulting in a checkpatch error.
Otherwise feel free to add
to the next version. Thanks a lot for tracking this down!
Guenter
Quoted 8 lines
arch/x86/mm/kaiser.c +2
-1+ flags &= ~_PAGE_NX; +for (; address < end_addr; address +=PAGE_SIZE ) { target_address =get_pa_from_mapping (address); --2.16.0.rc1.238.g530d649a79-goog
PATCH v3 1/1 kaiser: Set _PAGE_NX only if supported
In reply to Lepton WuThis finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed out that the reason of that crash is that NX bit get set for page tables. It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map
--- arch/x86/mm/kaiser.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/mm/kaiser.c +2 -0
@@ -198,6 +198,8 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,* requires that not to be #defined to 0): so mask it off here. */ flags &= ~_PAGE_GLOBAL; +if (!(__supported_pte_mask & _PAGE_NX)) + flags &= ~_PAGE_NX;for (; address < end_addr; address +=PAGE_SIZE ) { target_address =get_pa_from_mapping (address);
Signature · 1 line
2.16.0.rc1.238.g530d649a79-goog
Quoted 7 lines · Lepton Wu
This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed out that the reason of that crash is that NX bit get set for page tables. It seems we missed checking if
_PAGE_NXis supported inkaiser_add_user_mapSigned-off-by Lepton Wu <[email protected]>
Hint: You might want to version your patches; otherwise it is difficult for the maintainer(s) to find the latest version.
Note that the fix probably also applies to v4.9 as well as to older stable kernels.
Guenter
Quoted 20 lines
--- arch/x86/mm/kaiser.c | 2 ++ 1 file changed, 2 insertions(+)arch/x86/mm/kaiser.c +2
-1@@ -198,6 +198,8 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,* requires that not to be #defined to 0): so mask it off here. */ flags &= ~_PAGE_GLOBAL; +if (!(__supported_pte_mask & _PAGE_NX)) + flags &= ~_PAGE_NX;for (; address < end_addr; address +=PAGE_SIZE ) { target_address =get_pa_from_mapping (address); --2.16.0.rc1.238.g530d649a79-goog
The last version is "V4" and I added it in subject.
Quoted 39 lines · Guenter Roeck
Quoted 7 lines · Lepton Wu
This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed out that the reason of that crash is that NX bit get set for page tables. It seems we missed checking if
_PAGE_NXis supported inkaiser_add_user_mapSigned-off-by Lepton Wu <[email protected]>Reviewed-by Guenter Roeck <[email protected]>Hint: You might want to version your patches; otherwise it is difficult for the maintainer(s) to find the latest version.
Note that the fix probably also applies to v4.9 as well as to older stable kernels.
Guenter
Quoted 20 lines
--- arch/x86/mm/kaiser.c | 2 ++ 1 file changed, 2 insertions(+)arch/x86/mm/kaiser.c +2
-1@@ -198,6 +198,8 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,* requires that not to be #defined to 0): so mask it off here. */ flags &= ~_PAGE_GLOBAL; +if (!(__supported_pte_mask & _PAGE_NX)) + flags &= ~_PAGE_NX;for (; address < end_addr; address +=PAGE_SIZE ) { target_address =get_pa_from_mapping (address); --2.16.0.rc1.238.g530d649a79-goog
FYI, this patch also clean applied to 4.9.y tree. I guess I don't need to send another one to 4.9 tree. Just applied it to 4.9 should be fine.
Quoted 42 lines · lepton
The last version is "V4" and I added it in subject.
Quoted 39 lines · Guenter Roeck
Quoted 7 lines · Lepton Wu
This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed out that the reason of that crash is that NX bit get set for page tables. It seems we missed checking if
_PAGE_NXis supported inkaiser_add_user_mapSigned-off-by Lepton Wu <[email protected]>Reviewed-by Guenter Roeck <[email protected]>Hint: You might want to version your patches; otherwise it is difficult for the maintainer(s) to find the latest version.
Note that the fix probably also applies to v4.9 as well as to older stable kernels.
Guenter
Quoted 20 lines
--- arch/x86/mm/kaiser.c | 2 ++ 1 file changed, 2 insertions(+)arch/x86/mm/kaiser.c +2
-1@@ -198,6 +198,8 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,* requires that not to be #defined to 0): so mask it off here. */ flags &= ~_PAGE_GLOBAL; +if (!(__supported_pte_mask & _PAGE_NX)) + flags &= ~_PAGE_NX;for (; address < end_addr; address +=PAGE_SIZE ) { target_address =get_pa_from_mapping (address); --2.16.0.rc1.238.g530d649a79-goog
Greg Kroah-Hartman
maintainerQuoted 3 lines · lepton
FYI, this patch also clean applied to 4.9.y tree. I guess I don't need to send another one to 4.9 tree. Just applied it to 4.9 should be fine.
Now queued up to both 4.9 and 4.4 trees, many thanks for this.
greg k-h
FYI, I did a quick test for other recent updated linux-stable-rc tree, it seems we also backport kaiser patch to 3.2.y and 3.16.y tree (but not 3.18.y tree, why?),
3.2.y and 3.16.y has same issue, to fix it, these 2 branches also need this patch. (it can clean apply).
They also need another earlier patch which has been merged to 4.4/4.9:
Quoted 8 lines · Greg Kroah-Hartman
Quoted 3 lines · lepton
FYI, this patch also clean applied to 4.9.y tree. I guess I don't need to send another one to 4.9 tree. Just applied it to 4.9 should be fine.
Now queued up to both 4.9 and 4.4 trees, many thanks for this.
greg k-h
Greg Kroah-Hartman
maintainerQuoted 3 lines · lepton
FYI, I did a quick test for other recent updated linux-stable-rc tree, it seems we also backport kaiser patch to 3.2.y and 3.16.y tree (but not 3.18.y tree, why?),
Because I don't want to :)
Seriously, the only people relying on 3.18 already picked the fixes up from some other tree (i.e. the android-common tree), and I don't want to do the x86 backport as it would be a mess and take up too much of my time for absolutely no users.
thanks,
greg k-h
PATCH 1/2 kaiser: Set _PAGE_NX only if supported
In reply to leptonFrom: Guenter Roeck <[email protected]>
This resolves a crash if loaded under qemu + haxm under windows. See https://www.spinics.net/lists/kernel/msg2689835.html for details. Here is a boot log (the log is from chromeos-4.4, but Tao Wu says that the same log is also seen with vanilla v4.4.110-rc1).
[ 0.712750] Freeing unused kernel memory: 552K [ 0.721821] init: Corrupted page table at address 57b029b332e0 [ 0.722761] PGD 80000000bb238067 PUD bc36a067 PMD bc369067 PTE 45d2067 [ 0.722761] Bad pagetable: 000b [#1] PREEMPT SMP [ 0.722761] Modules linked in: [ 0.722761] CPU: 1 PID: 1 Comm: init Not tainted 4.4.96 #31 [ 0.722761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014 [ 0.722761] task: ffff8800bc290000 ti: ffff8800bc28c000 task.ti: ffff8800bc28c000 [ 0.722761] RIP: 0010:[<ffffffff83f4129e>] [<ffffffff83f4129e>] __clear_user+0x42/0x67 [ 0.722761] RSP: 0000:ffff8800bc28fcf8 EFLAGS: 00010202 [ 0.722761] RAX: 0000000000000000 RBX: 00000000000001a4 RCX: 00000000000001a4 [ 0.722761] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000057b029b332e0 [ 0.722761] RBP: ffff8800bc28fd08 R08: ffff8800bc290000 R09: ffff8800bb2f4000 [ 0.722761] R10: ffff8800bc290000 R11: ffff8800bb2f4000 R12: 000057b029b332e0 [ 0.722761] R13: 0000000000000000 R14: 000057b029b33340 R15: ffff8800bb1e2a00 [ 0.722761] FS: 0000000000000000(0000) GS:ffff8800bfb00000(0000) knlGS:0000000000000000 [ 0.722761] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 0.722761] CR2: 000057b029b332e0 CR3: 00000000bb2f8000 CR4: 00000000000006e0 [ 0.722761] Stack: [ 0.722761] 000057b029b332e0 ffff8800bb95fa80 ffff8800bc28fd18 ffffffff83f4120c [ 0.722761] ffff8800bc28fe18 ffffffff83e9e7a1 ffff8800bc28fd68 0000000000000000 [ 0.722761] ffff8800bc290000 ffff8800bc290000 ffff8800bc290000 ffff8800bc290000 [ 0.722761] Call Trace: [ 0.722761] [<ffffffff83f4120c>] clear_user+0x2e/0x30 [ 0.722761] [<ffffffff83e9e7a1>] load_elf_binary+0xa7f/0x18f7 [ 0.722761] [<ffffffff83de2088>] search_binary_handler+0x86/0x19c [ 0.722761] [<ffffffff83de389e>] do_execveat_common.isra.26+0x909/0xf98 [ 0.722761] [<ffffffff844febe0>] ? rest_init+0x87/0x87 [ 0.722761] [<ffffffff83de40be>] do_execve+0x23/0x25 [ 0.722761] [<ffffffff83c002e3>] run_init_process+0x2b/0x2d [ 0.722761] [<ffffffff844fec4d>] kernel_init+0x6d/0xda [ 0.722761] [<ffffffff84505b2f>] ret_from_fork+0x3f/0x70 [ 0.722761] [<ffffffff844febe0>] ? rest_init+0x87/0x87 [ 0.722761] Code: 86 84 be 12 00 00 00 e8 87 0d e8 ff 66 66 90 48 89 d8 48 c1 eb 03 4c 89 e7 83 e0 07 48 89 d9 be 08 00 00 00 31 d2 48 85 c9 74 0a <48> 89 17 48 01 f7 ff c9 75 f6 48 89 c1 85 c9 74 09 88 17 48 ff [ 0.722761] RIP [<ffffffff83f4129e>] __clear_user+0x42/0x67 [ 0.722761] RSP <ffff8800bc28fcf8> [ 0.722761] ---[ end trace def703879b4ff090 ]--- [ 0.722761] BUG: sleeping function called from invalid context at /mnt/host/source/src/third_party/kernel/v4.4/kernel/locking/rwsem.c:21 [ 0.722761] in_atomic(): 0, irqs_disabled(): 1, pid: 1, name: init [ 0.722761] CPU: 1 PID: 1 Comm: init Tainted: G D 4.4.96 #31 [ 0.722761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014 [ 0.722761] 0000000000000086 dcb5d76098c89836 ffff8800bc28fa30 ffffffff83f34004 [ 0.722761] ffffffff84839dc2 0000000000000015 ffff8800bc28fa40 ffffffff83d57dc9 [ 0.722761] ffff8800bc28fa68 ffffffff83d57e6a ffffffff84a53640 0000000000000000 [ 0.722761] Call Trace: [ 0.722761] [<ffffffff83f34004>] dump_stack+0x4d/0x63 [ 0.722761] [<ffffffff83d57dc9>] ___might_sleep+0x13a/0x13c [ 0.722761] [<ffffffff83d57e6a>] __might_sleep+0x9f/0xa6 [ 0.722761] [<ffffffff84502788>] down_read+0x20/0x31 [ 0.722761] [<ffffffff83cc5d9b>] __blocking_notifier_call_chain+0x35/0x63 [ 0.722761] [<ffffffff83cc5ddd>] blocking_notifier_call_chain+0x14/0x16 [ 0.800374] usb 1-1: new full-speed USB device number 2 using uhci_hcd [ 0.722761] [<ffffffff83cefe97>] profile_task_exit+0x1a/0x1c [ 0.802309] [<ffffffff83cac84e>] do_exit+0x39/0xe7f [ 0.802309] [<ffffffff83ce5938>] ? vprintk_default+0x1d/0x1f [ 0.802309] [<ffffffff83d7bb95>] ? printk+0x57/0x73 [ 0.802309] [<ffffffff83c46e25>] oops_end+0x80/0x85 [ 0.802309] [<ffffffff83c7b747>] pgtable_bad+0x8a/0x95 [ 0.802309] [<ffffffff83ca7f4a>] __do_page_fault+0x8c/0x352 [ 0.802309] [<ffffffff83eefba5>] ? file_has_perm+0xc4/0xe5 [ 0.802309] [<ffffffff83ca821c>] do_page_fault+0xc/0xe [ 0.802309] [<ffffffff84507682>] page_fault+0x22/0x30 [ 0.802309] [<ffffffff83f4129e>] ? __clear_user+0x42/0x67 [ 0.802309] [<ffffffff83f4127f>] ? __clear_user+0x23/0x67 [ 0.802309] [<ffffffff83f4120c>] clear_user+0x2e/0x30 [ 0.802309] [<ffffffff83e9e7a1>] load_elf_binary+0xa7f/0x18f7 [ 0.802309] [<ffffffff83de2088>] search_binary_handler+0x86/0x19c [ 0.802309] [<ffffffff83de389e>] do_execveat_common.isra.26+0x909/0xf98 [ 0.802309] [<ffffffff844febe0>] ? rest_init+0x87/0x87 [ 0.802309] [<ffffffff83de40be>] do_execve+0x23/0x25 [ 0.802309] [<ffffffff83c002e3>] run_init_process+0x2b/0x2d [ 0.802309] [<ffffffff844fec4d>] kernel_init+0x6d/0xda [ 0.802309] [<ffffffff84505b2f>] ret_from_fork+0x3f/0x70 [ 0.802309] [<ffffffff844febe0>] ? rest_init+0x87/0x87 [ 0.830559] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 [ 0.830559] [ 0.831305] Kernel Offset: 0x2c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 0.831305] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
The crash part of this problem may be solved with the following patch (thanks to Hugh for the hint). There is still another problem, though - with this patch applied, the qemu session aborts with "VCPU Shutdown request", whatever that means.
--- arch/x86/mm/kaiser.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/mm/kaiser.c +2 -1
@@ -411,7 +411,8 @@ pgd_t kaiser_set_shadow_pgd(pgd_t *pgdp, pgd_t pgd)* get out to userspace running on the kernel CR3, * userspace will crash instead of running. */ - pgd.pgd |= _PAGE_NX; +if (__supported_pte_mask & _PAGE_NX) + pgd.pgd |= _PAGE_NX; } }else if (!pgd.pgd) {/*
Signature · 1 line
2.14.1
PATCH 2/2 kaiser: Set _PAGE_NX only if supported
From: Lepton Wu <[email protected]>
This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed out that the reason of that crash is that NX bit get set for page tables. It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map
(backported from Greg K-H's 4.4 stable-queue)
--- arch/x86/mm/kaiser.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/mm/kaiser.c +2 -0
@@ -189,6 +189,8 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,* requires that not to be #defined to 0): so mask it off here. */ flags &= ~_PAGE_GLOBAL; +if (!(__supported_pte_mask & _PAGE_NX)) + flags &= ~_PAGE_NX;if (flags & _PAGE_USER)BUG_ON (address <FIXADDR_START || end_addr >=FIXADDR_TOP );
Signature · 1 line
2.14.1
PATCH v4 1/1 kaiser: Set _PAGE_NX only if supported
In reply to Lepton WuThis finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed out that the reason of that crash is that NX bit get set for page tables. It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map
--- arch/x86/mm/kaiser.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/mm/kaiser.c +2 -0
@@ -198,6 +198,8 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,* requires that not to be #defined to 0): so mask it off here. */ flags &= ~_PAGE_GLOBAL; +if (!(__supported_pte_mask & _PAGE_NX)) + flags &= ~_PAGE_NX;for (; address < end_addr; address +=PAGE_SIZE ) { target_address =get_pa_from_mapping (address);
Signature · 1 line
2.16.0.rc1.238.g530d649a79-goog
Patch "kaiser: Set _PAGE_NX only if supported" has been added to the 4.4-stable tree
This is a note to let you know that I've just added the patch titled
kaiser: Set _PAGE_NX only if supported
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
kaiser-set-_page_nx-only-if-supported.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From [email protected] Sat Jan 13 15:46:36 2018
From: Lepton Wu <[email protected]>
Date: Fri, 12 Jan 2018 13:42:56 -0800
Subject: kaiser: Set _PAGE_NX only if supported
To: [email protected]
Cc: [email protected], [email protected], [email protected], Lepton Wu <[email protected]>
Message-ID: <[email protected]>
From: Lepton Wu <[email protected]>
This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed out that the reason of that crash is that NX bit get set for page tables. It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map
--- arch/x86/mm/kaiser.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/mm/kaiser.c +2 -0
@@ -198,6 +198,8 @@ static int kaiser_add_user_map(const voi* requires that not to be #defined to 0): so mask it off here. */ flags &= ~_PAGE_GLOBAL; +if (!(__supported_pte_mask & _PAGE_NX)) + flags &= ~_PAGE_NX;for (; address < end_addr; address +=PAGE_SIZE ) { target_address =get_pa_from_mapping (address);
Patches currently in stable-queue which might be from [email protected] are
queue-4.4/kaiser-set-_page_nx-only-if-supported.patch
Patch "kaiser: Set _PAGE_NX only if supported" has been added to the 4.9-stable tree
In reply to Lepton WuThis is a note to let you know that I've just added the patch titled
kaiser: Set _PAGE_NX only if supported
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
kaiser-set-_page_nx-only-if-supported.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From [email protected] Sat Jan 13 15:46:36 2018
From: Lepton Wu <[email protected]>
Date: Fri, 12 Jan 2018 13:42:56 -0800
Subject: kaiser: Set _PAGE_NX only if supported
To: [email protected]
Cc: [email protected], [email protected], [email protected], Lepton Wu <[email protected]>
Message-ID: <[email protected]>
From: Lepton Wu <[email protected]>
This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed out that the reason of that crash is that NX bit get set for page tables. It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map
--- arch/x86/mm/kaiser.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/mm/kaiser.c +2 -0
@@ -197,6 +197,8 @@ static int kaiser_add_user_map(const voi* requires that not to be #defined to 0): so mask it off here. */ flags &= ~_PAGE_GLOBAL; +if (!(__supported_pte_mask & _PAGE_NX)) + flags &= ~_PAGE_NX;for (; address < end_addr; address +=PAGE_SIZE ) { target_address =get_pa_from_mapping (address);
Patches currently in stable-queue which might be from [email protected] are
queue-4.9/kaiser-set-_page_nx-only-if-supported.patch
PATCH 1/2 kaiser: Set _PAGE_NX only if supported
From: Guenter Roeck <[email protected]>
This resolves a crash if loaded under qemu + haxm under windows. See https://www.spinics.net/lists/kernel/msg2689835.html for details. Here is a boot log (the log is from chromeos-4.4, but Tao Wu says that the same log is also seen with vanilla v4.4.110-rc1).
[ 0.712750] Freeing unused kernel memory: 552K [ 0.721821] init: Corrupted page table at address 57b029b332e0 [ 0.722761] PGD 80000000bb238067 PUD bc36a067 PMD bc369067 PTE 45d2067 [ 0.722761] Bad pagetable: 000b [#1] PREEMPT SMP [ 0.722761] Modules linked in: [ 0.722761] CPU: 1 PID: 1 Comm: init Not tainted 4.4.96 #31 [ 0.722761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014 [ 0.722761] task: ffff8800bc290000 ti: ffff8800bc28c000 task.ti: ffff8800bc28c000 [ 0.722761] RIP: 0010:[<ffffffff83f4129e>] [<ffffffff83f4129e>] __clear_user+0x42/0x67 [ 0.722761] RSP: 0000:ffff8800bc28fcf8 EFLAGS: 00010202 [ 0.722761] RAX: 0000000000000000 RBX: 00000000000001a4 RCX: 00000000000001a4 [ 0.722761] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000057b029b332e0 [ 0.722761] RBP: ffff8800bc28fd08 R08: ffff8800bc290000 R09: ffff8800bb2f4000 [ 0.722761] R10: ffff8800bc290000 R11: ffff8800bb2f4000 R12: 000057b029b332e0 [ 0.722761] R13: 0000000000000000 R14: 000057b029b33340 R15: ffff8800bb1e2a00 [ 0.722761] FS: 0000000000000000(0000) GS:ffff8800bfb00000(0000) knlGS:0000000000000000 [ 0.722761] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 0.722761] CR2: 000057b029b332e0 CR3: 00000000bb2f8000 CR4: 00000000000006e0 [ 0.722761] Stack: [ 0.722761] 000057b029b332e0 ffff8800bb95fa80 ffff8800bc28fd18 ffffffff83f4120c [ 0.722761] ffff8800bc28fe18 ffffffff83e9e7a1 ffff8800bc28fd68 0000000000000000 [ 0.722761] ffff8800bc290000 ffff8800bc290000 ffff8800bc290000 ffff8800bc290000 [ 0.722761] Call Trace: [ 0.722761] [<ffffffff83f4120c>] clear_user+0x2e/0x30 [ 0.722761] [<ffffffff83e9e7a1>] load_elf_binary+0xa7f/0x18f7 [ 0.722761] [<ffffffff83de2088>] search_binary_handler+0x86/0x19c [ 0.722761] [<ffffffff83de389e>] do_execveat_common.isra.26+0x909/0xf98 [ 0.722761] [<ffffffff844febe0>] ? rest_init+0x87/0x87 [ 0.722761] [<ffffffff83de40be>] do_execve+0x23/0x25 [ 0.722761] [<ffffffff83c002e3>] run_init_process+0x2b/0x2d [ 0.722761] [<ffffffff844fec4d>] kernel_init+0x6d/0xda [ 0.722761] [<ffffffff84505b2f>] ret_from_fork+0x3f/0x70 [ 0.722761] [<ffffffff844febe0>] ? rest_init+0x87/0x87 [ 0.722761] Code: 86 84 be 12 00 00 00 e8 87 0d e8 ff 66 66 90 48 89 d8 48 c1 eb 03 4c 89 e7 83 e0 07 48 89 d9 be 08 00 00 00 31 d2 48 85 c9 74 0a <48> 89 17 48 01 f7 ff c9 75 f6 48 89 c1 85 c9 74 09 88 17 48 ff [ 0.722761] RIP [<ffffffff83f4129e>] __clear_user+0x42/0x67 [ 0.722761] RSP <ffff8800bc28fcf8> [ 0.722761] ---[ end trace def703879b4ff090 ]--- [ 0.722761] BUG: sleeping function called from invalid context at /mnt/host/source/src/third_party/kernel/v4.4/kernel/locking/rwsem.c:21 [ 0.722761] in_atomic(): 0, irqs_disabled(): 1, pid: 1, name: init [ 0.722761] CPU: 1 PID: 1 Comm: init Tainted: G D 4.4.96 #31 [ 0.722761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014 [ 0.722761] 0000000000000086 dcb5d76098c89836 ffff8800bc28fa30 ffffffff83f34004 [ 0.722761] ffffffff84839dc2 0000000000000015 ffff8800bc28fa40 ffffffff83d57dc9 [ 0.722761] ffff8800bc28fa68 ffffffff83d57e6a ffffffff84a53640 0000000000000000 [ 0.722761] Call Trace: [ 0.722761] [<ffffffff83f34004>] dump_stack+0x4d/0x63 [ 0.722761] [<ffffffff83d57dc9>] ___might_sleep+0x13a/0x13c [ 0.722761] [<ffffffff83d57e6a>] __might_sleep+0x9f/0xa6 [ 0.722761] [<ffffffff84502788>] down_read+0x20/0x31 [ 0.722761] [<ffffffff83cc5d9b>] __blocking_notifier_call_chain+0x35/0x63 [ 0.722761] [<ffffffff83cc5ddd>] blocking_notifier_call_chain+0x14/0x16 [ 0.800374] usb 1-1: new full-speed USB device number 2 using uhci_hcd [ 0.722761] [<ffffffff83cefe97>] profile_task_exit+0x1a/0x1c [ 0.802309] [<ffffffff83cac84e>] do_exit+0x39/0xe7f [ 0.802309] [<ffffffff83ce5938>] ? vprintk_default+0x1d/0x1f [ 0.802309] [<ffffffff83d7bb95>] ? printk+0x57/0x73 [ 0.802309] [<ffffffff83c46e25>] oops_end+0x80/0x85 [ 0.802309] [<ffffffff83c7b747>] pgtable_bad+0x8a/0x95 [ 0.802309] [<ffffffff83ca7f4a>] __do_page_fault+0x8c/0x352 [ 0.802309] [<ffffffff83eefba5>] ? file_has_perm+0xc4/0xe5 [ 0.802309] [<ffffffff83ca821c>] do_page_fault+0xc/0xe [ 0.802309] [<ffffffff84507682>] page_fault+0x22/0x30 [ 0.802309] [<ffffffff83f4129e>] ? __clear_user+0x42/0x67 [ 0.802309] [<ffffffff83f4127f>] ? __clear_user+0x23/0x67 [ 0.802309] [<ffffffff83f4120c>] clear_user+0x2e/0x30 [ 0.802309] [<ffffffff83e9e7a1>] load_elf_binary+0xa7f/0x18f7 [ 0.802309] [<ffffffff83de2088>] search_binary_handler+0x86/0x19c [ 0.802309] [<ffffffff83de389e>] do_execveat_common.isra.26+0x909/0xf98 [ 0.802309] [<ffffffff844febe0>] ? rest_init+0x87/0x87 [ 0.802309] [<ffffffff83de40be>] do_execve+0x23/0x25 [ 0.802309] [<ffffffff83c002e3>] run_init_process+0x2b/0x2d [ 0.802309] [<ffffffff844fec4d>] kernel_init+0x6d/0xda [ 0.802309] [<ffffffff84505b2f>] ret_from_fork+0x3f/0x70 [ 0.802309] [<ffffffff844febe0>] ? rest_init+0x87/0x87 [ 0.830559] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 [ 0.830559] [ 0.831305] Kernel Offset: 0x2c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 0.831305] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
The crash part of this problem may be solved with the following patch (thanks to Hugh for the hint). There is still another problem, though - with this patch applied, the qemu session aborts with "VCPU Shutdown request", whatever that means.
--- arch/x86/mm/kaiser.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/mm/kaiser.c +2 -1
@@ -428,7 +428,8 @@ pgd_t kaiser_set_shadow_pgd(pgd_t *pgdp, pgd_t pgd)* get out to userspace running on the kernel CR3, * userspace will crash instead of running. */ - pgd.pgd |= _PAGE_NX; +if (__supported_pte_mask & _PAGE_NX) + pgd.pgd |= _PAGE_NX; } }else if (!pgd.pgd) {/*
Signature · 1 line
2.14.1
PATCH 2/2 kaiser: Set _PAGE_NX only if supported
From: Lepton Wu <[email protected]>
This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed out that the reason of that crash is that NX bit get set for page tables. It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map
(backported from Greg K-H's 4.4 stable-queue)
--- arch/x86/mm/kaiser.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/mm/kaiser.c +2 -0
@@ -195,6 +195,8 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,* requires that not to be #defined to 0): so mask it off here. */ flags &= ~_PAGE_GLOBAL; +if (!(__supported_pte_mask & _PAGE_NX)) + flags &= ~_PAGE_NX;for (; address < end_addr; address +=PAGE_SIZE ) { target_address =get_pa_from_mapping (address);
Signature · 1 line
2.14.1
Quoted 6 lines · Juerg Haefliger
From: Guenter Roeck <[email protected]>
This resolves a crash if loaded under qemu + haxm under windows. See https://www.spinics.net/lists/kernel/msg2689835.html for details. Here is a boot log (the log is from chromeos-4.4, but Tao Wu says that the same log is also seen with vanilla v4.4.110-rc1).
Thanks, I've queued up these two patches for both 3.2 and 3.16.
Ben.
Quoted 110 lines
[ 0.712750] Freeing unused kernel memory: 552K [ 0.721821] init: Corrupted page table at address 57b029b332e0 [ 0.722761] PGD 80000000bb238067 PUD bc36a067 PMD bc369067 PTE 45d2067 [ 0.722761] Bad pagetable: 000b [#1] PREEMPT SMP [ 0.722761] Modules linked in: [ 0.722761] CPU: 1 PID: 1 Comm: init Not tainted 4.4.96 #31 [ 0.722761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014 [ 0.722761] task: ffff8800bc290000 ti: ffff8800bc28c000 task.ti: ffff8800bc28c000 [ 0.722761] RIP: 0010:[<ffffffff83f4129e>] [<ffffffff83f4129e>] __clear_user+0x42/0x67 [ 0.722761] RSP: 0000:ffff8800bc28fcf8 EFLAGS: 00010202 [ 0.722761] RAX: 0000000000000000 RBX: 00000000000001a4 RCX: 00000000000001a4 [ 0.722761] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000057b029b332e0 [ 0.722761] RBP: ffff8800bc28fd08 R08: ffff8800bc290000 R09: ffff8800bb2f4000 [ 0.722761] R10: ffff8800bc290000 R11: ffff8800bb2f4000 R12: 000057b029b332e0 [ 0.722761] R13: 0000000000000000 R14: 000057b029b33340 R15: ffff8800bb1e2a00 [ 0.722761] FS: 0000000000000000(0000) GS:ffff8800bfb00000(0000) knlGS:0000000000000000 [ 0.722761] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 0.722761] CR2: 000057b029b332e0 CR3: 00000000bb2f8000 CR4: 00000000000006e0 [ 0.722761] Stack: [ 0.722761] 000057b029b332e0 ffff8800bb95fa80 ffff8800bc28fd18 ffffffff83f4120c [ 0.722761] ffff8800bc28fe18 ffffffff83e9e7a1 ffff8800bc28fd68 0000000000000000 [ 0.722761] ffff8800bc290000 ffff8800bc290000 ffff8800bc290000 ffff8800bc290000 [ 0.722761] Call Trace: [ 0.722761] [<ffffffff83f4120c>] clear_user+0x2e/0x30 [ 0.722761] [<ffffffff83e9e7a1>] load_elf_binary+0xa7f/0x18f7 [ 0.722761] [<ffffffff83de2088>] search_binary_handler+0x86/0x19c [ 0.722761] [<ffffffff83de389e>] do_execveat_common.isra.26+0x909/0xf98 [ 0.722761] [<ffffffff844febe0>] ? rest_init+0x87/0x87 [ 0.722761] [<ffffffff83de40be>] do_execve+0x23/0x25 [ 0.722761] [<ffffffff83c002e3>] run_init_process+0x2b/0x2d [ 0.722761] [<ffffffff844fec4d>] kernel_init+0x6d/0xda [ 0.722761] [<ffffffff84505b2f>] ret_from_fork+0x3f/0x70 [ 0.722761] [<ffffffff844febe0>] ? rest_init+0x87/0x87 [ 0.722761] Code: 86 84 be 12 00 00 00 e8 87 0d e8 ff 66 66 90 48 89 d8 48 c1 eb 03 4c 89 e7 83 e0 07 48 89 d9 be 08 00 00 00 31 d2 48 85 c9 74 0a <48> 89 17 48 01 f7 ff c9 75 f6 48 89 c1 85 c9 74 09 88 17 48 ff [ 0.722761] RIP [<ffffffff83f4129e>] __clear_user+0x42/0x67 [ 0.722761] RSP <ffff8800bc28fcf8> [ 0.722761] ---[ end trace def703879b4ff090 ]--- [ 0.722761] BUG: sleeping function called from invalid context at /mnt/host/source/src/third_party/kernel/v4.4/kernel/locking/rwsem.c:21 [ 0.722761] in_atomic(): 0, irqs_disabled(): 1, pid: 1, name: init [ 0.722761] CPU: 1 PID: 1 Comm: init Tainted: G D 4.4.96 #31 [ 0.722761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014 [ 0.722761] 0000000000000086 dcb5d76098c89836 ffff8800bc28fa30 ffffffff83f34004 [ 0.722761] ffffffff84839dc2 0000000000000015 ffff8800bc28fa40 ffffffff83d57dc9 [ 0.722761] ffff8800bc28fa68 ffffffff83d57e6a ffffffff84a53640 0000000000000000 [ 0.722761] Call Trace: [ 0.722761] [<ffffffff83f34004>] dump_stack+0x4d/0x63 [ 0.722761] [<ffffffff83d57dc9>] ___might_sleep+0x13a/0x13c [ 0.722761] [<ffffffff83d57e6a>] __might_sleep+0x9f/0xa6 [ 0.722761] [<ffffffff84502788>] down_read+0x20/0x31 [ 0.722761] [<ffffffff83cc5d9b>] __blocking_notifier_call_chain+0x35/0x63 [ 0.722761] [<ffffffff83cc5ddd>] blocking_notifier_call_chain+0x14/0x16 [ 0.800374] usb 1-1: new full-speed USB device number 2 using uhci_hcd [ 0.722761] [<ffffffff83cefe97>] profile_task_exit+0x1a/0x1c [ 0.802309] [<ffffffff83cac84e>] do_exit+0x39/0xe7f [ 0.802309] [<ffffffff83ce5938>] ? vprintk_default+0x1d/0x1f [ 0.802309] [<ffffffff83d7bb95>] ? printk+0x57/0x73 [ 0.802309] [<ffffffff83c46e25>] oops_end+0x80/0x85 [ 0.802309] [<ffffffff83c7b747>] pgtable_bad+0x8a/0x95 [ 0.802309] [<ffffffff83ca7f4a>] __do_page_fault+0x8c/0x352 [ 0.802309] [<ffffffff83eefba5>] ? file_has_perm+0xc4/0xe5 [ 0.802309] [<ffffffff83ca821c>] do_page_fault+0xc/0xe [ 0.802309] [<ffffffff84507682>] page_fault+0x22/0x30 [ 0.802309] [<ffffffff83f4129e>] ? __clear_user+0x42/0x67 [ 0.802309] [<ffffffff83f4127f>] ? __clear_user+0x23/0x67 [ 0.802309] [<ffffffff83f4120c>] clear_user+0x2e/0x30 [ 0.802309] [<ffffffff83e9e7a1>] load_elf_binary+0xa7f/0x18f7 [ 0.802309] [<ffffffff83de2088>] search_binary_handler+0x86/0x19c [ 0.802309] [<ffffffff83de389e>] do_execveat_common.isra.26+0x909/0xf98 [ 0.802309] [<ffffffff844febe0>] ? rest_init+0x87/0x87 [ 0.802309] [<ffffffff83de40be>] do_execve+0x23/0x25 [ 0.802309] [<ffffffff83c002e3>] run_init_process+0x2b/0x2d [ 0.802309] [<ffffffff844fec4d>] kernel_init+0x6d/0xda [ 0.802309] [<ffffffff84505b2f>] ret_from_fork+0x3f/0x70 [ 0.802309] [<ffffffff844febe0>] ? rest_init+0x87/0x87 [ 0.830559] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 [ 0.830559] [ 0.831305] Kernel Offset: 0x2c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 0.831305] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009The crash part of this problem may be solved with the following patch (thanks to Hugh for the hint). There is still another problem, though - with this patch applied, the qemu session aborts with "VCPU Shutdown request", whatever that means.
Cc lepton <[email protected]>Signed-off-by Guenter Roeck <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>(cherry picked from commit b33c3c64c4786cd724ccde6fa97c87ada49f6a73 linux-4.4.y)Signed-off-by Juerg Haefliger <[email protected]>--- arch/x86/mm/kaiser.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)arch/x86/mm/kaiser.c +2
-1@@ -428,7 +428,8 @@ pgd_t kaiser_set_shadow_pgd(pgd_t *pgdp, pgd_t pgd)* get out to userspace running on the kernel CR3, * userspace will crash instead of running. */ - pgd.pgd |= _PAGE_NX; +if (__supported_pte_mask & _PAGE_NX) + pgd.pgd |= _PAGE_NX; } }else if (!pgd.pgd) {/*
Signature · 2 lines
Ben Hutchings Beware of programmers who carry screwdrivers. - Leonard Brandwein