* [PATCH 0/2] fix bug when calling kexec_load()
@ 2021-10-30 18:31 ` Rongwei Wang
0 siblings, 0 replies; 28+ messages in thread
From: Rongwei Wang @ 2021-10-30 18:31 UTC (permalink / raw)
To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba,
akpm, rppt, anshuman.khandual
Cc: linux-arm-kernel, linux-kernel
Patch 1/2 mainly to fix the bug when calling kexec_load().
And a user case shown in commit log.
Patch 2/2 just make a very simple optimization, reducing
calls to page_address() in kexec_page_alloc().
Thanks!
Rongwei Wang (2):
arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in
copy_pte()
arm64: kexec: reduce calls to page_address()
arch/arm64/kernel/machine_kexec.c | 6 ++++--
arch/arm64/mm/trans_pgd.c | 7 ++++---
2 files changed, 8 insertions(+), 5 deletions(-)
--
2.27.0
^ permalink raw reply [flat|nested] 28+ messages in thread* [PATCH 0/2] fix bug when calling kexec_load() @ 2021-10-30 18:31 ` Rongwei Wang 0 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-10-30 18:31 UTC (permalink / raw) To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba, akpm, rppt, anshuman.khandual Cc: linux-arm-kernel, linux-kernel Patch 1/2 mainly to fix the bug when calling kexec_load(). And a user case shown in commit log. Patch 2/2 just make a very simple optimization, reducing calls to page_address() in kexec_page_alloc(). Thanks! Rongwei Wang (2): arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte() arm64: kexec: reduce calls to page_address() arch/arm64/kernel/machine_kexec.c | 6 ++++-- arch/arm64/mm/trans_pgd.c | 7 ++++--- 2 files changed, 8 insertions(+), 5 deletions(-) -- 2.27.0 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH 1/2] arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte() 2021-10-30 18:31 ` Rongwei Wang @ 2021-10-30 18:31 ` Rongwei Wang -1 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-10-30 18:31 UTC (permalink / raw) To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba, akpm, rppt, anshuman.khandual Cc: linux-arm-kernel, linux-kernel In commit 5de59884ac0e ("arm64: trans_pgd: pass NULL instead of init_mm to *_populate functions"), simply replace init_mm with NULL for pmd_populate_kernel. But in commit 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings"), adding the check of mm context in pmd_populate_kernel. And these changes will cause a crash when executing copy_pte/trans_pgd.c, as follows: kernel BUG at arch/arm64/include/asm/pgalloc.h:79! Internal error: Oops - BUG: 0 [#1] SMP Modules linked in: rfkill(E) aes_ce_blk(E) aes_ce_cipher(E) ... CPU: 21 PID: 1617 Comm: a.out Kdump: loaded Tainted: ... 5.15.0-rc7-mm1+ #8 Hardware name: ECS, BIOS 0.0.0 02/06/2015 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : trans_pgd_create_copy+0x4ac/0x4f0 lr : trans_pgd_create_copy+0x34c/0x4f0 sp : ffff80001bf2bc50 x29: ffff80001bf2bc50 x28: ffff0010067f1000 x27: ffff800011072000 x26: ffff001fffff8000 x25: ffff008000000000 x24: 0040000000000041 x23: 0040000000000001 x22: ffff80001bf2bd68 x21: ffff80001188ded8 x20: ffff800000000000 x19: ffff000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200004c0 x14: ffff00003fffffff x13: ffff007fffffffff x12: ffff800010f882a8 x11: 0000000000face57 x10: 0000000000000001 x9 : 0000000000000000 x8 : ffff00100cece000 x7 : ffff001001c9f000 x6 : ffff00100ae40000 x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffff001fffff7000 x2 : ffff000000200000 x1 : ffff000040000000 x0 : ffff00100cecd000 Call trace: trans_pgd_create_copy+0x4ac/0x4f0 machine_kexec_post_load+0x94/0x3bc do_kexec_load+0x11c/0x2e0 __arm64_sys_kexec_load+0xa8/0xf4 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0x58/0x190 do_el0_svc+0x2c/0x90 el0_svc+0x28/0xe0 el0t_64_sync_handler+0xb0/0xb4 el0t_64_sync+0x180/0x184 Code: f90000c0 d5033a9f d5033fdf 17ffff7b (d4210000) ---[ end trace cc5461ffe1a085db ]--- Kernel panic - not syncing: Oops - BUG: Fatal exception This bug can be reproduced by a user case: void execute_kexec_load(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); *(uint64_t*)0x200004c0 = 0; *(uint64_t*)0x200004c8 = 0; *(uint64_t*)0x200004d0 = 0; *(uint64_t*)0x200004d8 = 0; syscall(__NR_kexec_load, 0ul, 1ul, 0x200004c0ul, 0ul); } And this patch just make some simple changes, and including replace pmd_populate_kernel with pmd_populate. Fixes: 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings") Reported-by: Abaci <abaci@linux.alibaba.com> Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> --- arch/arm64/mm/trans_pgd.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c index d7da8ca40d2e..3f1fc6cb9c9d 100644 --- a/arch/arm64/mm/trans_pgd.c +++ b/arch/arm64/mm/trans_pgd.c @@ -62,12 +62,13 @@ static int copy_pte(struct trans_pgd_info *info, pmd_t *dst_pmdp, { pte_t *src_ptep; pte_t *dst_ptep; + struct page *page; unsigned long addr = start; - dst_ptep = trans_alloc(info); - if (!dst_ptep) + page = virt_to_page(trans_alloc(info)); + if (!page) return -ENOMEM; - pmd_populate_kernel(NULL, dst_pmdp, dst_ptep); + pmd_populate(NULL, dst_pmdp, page); dst_ptep = pte_offset_kernel(dst_pmdp, start); src_ptep = pte_offset_kernel(src_pmdp, start); -- 2.27.0 ^ permalink raw reply related [flat|nested] 28+ messages in thread
* [PATCH 1/2] arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte() @ 2021-10-30 18:31 ` Rongwei Wang 0 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-10-30 18:31 UTC (permalink / raw) To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba, akpm, rppt, anshuman.khandual Cc: linux-arm-kernel, linux-kernel In commit 5de59884ac0e ("arm64: trans_pgd: pass NULL instead of init_mm to *_populate functions"), simply replace init_mm with NULL for pmd_populate_kernel. But in commit 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings"), adding the check of mm context in pmd_populate_kernel. And these changes will cause a crash when executing copy_pte/trans_pgd.c, as follows: kernel BUG at arch/arm64/include/asm/pgalloc.h:79! Internal error: Oops - BUG: 0 [#1] SMP Modules linked in: rfkill(E) aes_ce_blk(E) aes_ce_cipher(E) ... CPU: 21 PID: 1617 Comm: a.out Kdump: loaded Tainted: ... 5.15.0-rc7-mm1+ #8 Hardware name: ECS, BIOS 0.0.0 02/06/2015 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : trans_pgd_create_copy+0x4ac/0x4f0 lr : trans_pgd_create_copy+0x34c/0x4f0 sp : ffff80001bf2bc50 x29: ffff80001bf2bc50 x28: ffff0010067f1000 x27: ffff800011072000 x26: ffff001fffff8000 x25: ffff008000000000 x24: 0040000000000041 x23: 0040000000000001 x22: ffff80001bf2bd68 x21: ffff80001188ded8 x20: ffff800000000000 x19: ffff000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200004c0 x14: ffff00003fffffff x13: ffff007fffffffff x12: ffff800010f882a8 x11: 0000000000face57 x10: 0000000000000001 x9 : 0000000000000000 x8 : ffff00100cece000 x7 : ffff001001c9f000 x6 : ffff00100ae40000 x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffff001fffff7000 x2 : ffff000000200000 x1 : ffff000040000000 x0 : ffff00100cecd000 Call trace: trans_pgd_create_copy+0x4ac/0x4f0 machine_kexec_post_load+0x94/0x3bc do_kexec_load+0x11c/0x2e0 __arm64_sys_kexec_load+0xa8/0xf4 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0x58/0x190 do_el0_svc+0x2c/0x90 el0_svc+0x28/0xe0 el0t_64_sync_handler+0xb0/0xb4 el0t_64_sync+0x180/0x184 Code: f90000c0 d5033a9f d5033fdf 17ffff7b (d4210000) ---[ end trace cc5461ffe1a085db ]--- Kernel panic - not syncing: Oops - BUG: Fatal exception This bug can be reproduced by a user case: void execute_kexec_load(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); *(uint64_t*)0x200004c0 = 0; *(uint64_t*)0x200004c8 = 0; *(uint64_t*)0x200004d0 = 0; *(uint64_t*)0x200004d8 = 0; syscall(__NR_kexec_load, 0ul, 1ul, 0x200004c0ul, 0ul); } And this patch just make some simple changes, and including replace pmd_populate_kernel with pmd_populate. Fixes: 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings") Reported-by: Abaci <abaci@linux.alibaba.com> Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> --- arch/arm64/mm/trans_pgd.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c index d7da8ca40d2e..3f1fc6cb9c9d 100644 --- a/arch/arm64/mm/trans_pgd.c +++ b/arch/arm64/mm/trans_pgd.c @@ -62,12 +62,13 @@ static int copy_pte(struct trans_pgd_info *info, pmd_t *dst_pmdp, { pte_t *src_ptep; pte_t *dst_ptep; + struct page *page; unsigned long addr = start; - dst_ptep = trans_alloc(info); - if (!dst_ptep) + page = virt_to_page(trans_alloc(info)); + if (!page) return -ENOMEM; - pmd_populate_kernel(NULL, dst_pmdp, dst_ptep); + pmd_populate(NULL, dst_pmdp, page); dst_ptep = pte_offset_kernel(dst_pmdp, start); src_ptep = pte_offset_kernel(src_pmdp, start); -- 2.27.0 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply related [flat|nested] 28+ messages in thread
* Re: [PATCH 1/2] arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte() 2021-10-30 18:31 ` Rongwei Wang @ 2021-10-31 12:25 ` Ard Biesheuvel -1 siblings, 0 replies; 28+ messages in thread From: Ard Biesheuvel @ 2021-10-31 12:25 UTC (permalink / raw) To: Rongwei Wang Cc: Catalin Marinas, Will Deacon, Mark Rutland, James Morse, Fuad Tabba, Andrew Morton, Mike Rapoport, Anshuman Khandual, Linux ARM, Linux Kernel Mailing List On Sat, 30 Oct 2021 at 20:32, Rongwei Wang <rongwei.wang@linux.alibaba.com> wrote: > > In commit 5de59884ac0e ("arm64: trans_pgd: pass NULL instead > of init_mm to *_populate functions"), simply replace init_mm > with NULL for pmd_populate_kernel. But in commit 59511cfd08f3 > ("arm64: mm: use XN table mapping attributes for user/kernel > mappings"), adding the check of mm context in > pmd_populate_kernel. And these changes will cause a crash when > executing copy_pte/trans_pgd.c, as follows: > > kernel BUG at arch/arm64/include/asm/pgalloc.h:79! > Internal error: Oops - BUG: 0 [#1] SMP > Modules linked in: rfkill(E) aes_ce_blk(E) aes_ce_cipher(E) ... > CPU: 21 PID: 1617 Comm: a.out Kdump: loaded Tainted: ... 5.15.0-rc7-mm1+ #8 > Hardware name: ECS, BIOS 0.0.0 02/06/2015 > pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) > pc : trans_pgd_create_copy+0x4ac/0x4f0 > lr : trans_pgd_create_copy+0x34c/0x4f0 > sp : ffff80001bf2bc50 > x29: ffff80001bf2bc50 x28: ffff0010067f1000 x27: ffff800011072000 > x26: ffff001fffff8000 x25: ffff008000000000 x24: 0040000000000041 > x23: 0040000000000001 x22: ffff80001bf2bd68 x21: ffff80001188ded8 > x20: ffff800000000000 x19: ffff000000000000 x18: 0000000000000000 > x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200004c0 > x14: ffff00003fffffff x13: ffff007fffffffff x12: ffff800010f882a8 > x11: 0000000000face57 x10: 0000000000000001 x9 : 0000000000000000 > x8 : ffff00100cece000 x7 : ffff001001c9f000 x6 : ffff00100ae40000 > x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffff001fffff7000 > x2 : ffff000000200000 x1 : ffff000040000000 x0 : ffff00100cecd000 > Call trace: > trans_pgd_create_copy+0x4ac/0x4f0 > machine_kexec_post_load+0x94/0x3bc > do_kexec_load+0x11c/0x2e0 > __arm64_sys_kexec_load+0xa8/0xf4 > invoke_syscall+0x50/0x120 > el0_svc_common.constprop.0+0x58/0x190 > do_el0_svc+0x2c/0x90 > el0_svc+0x28/0xe0 > el0t_64_sync_handler+0xb0/0xb4 > el0t_64_sync+0x180/0x184 > Code: f90000c0 d5033a9f d5033fdf 17ffff7b (d4210000) > ---[ end trace cc5461ffe1a085db ]--- > Kernel panic - not syncing: Oops - BUG: Fatal exception > > This bug can be reproduced by a user case: > > void execute_kexec_load(void) > { > syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); > syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); > syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); > > *(uint64_t*)0x200004c0 = 0; > *(uint64_t*)0x200004c8 = 0; > *(uint64_t*)0x200004d0 = 0; > *(uint64_t*)0x200004d8 = 0; > syscall(__NR_kexec_load, 0ul, 1ul, 0x200004c0ul, 0ul); > } > > And this patch just make some simple changes, and including > replace pmd_populate_kernel with pmd_populate. > > Fixes: 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings") > Reported-by: Abaci <abaci@linux.alibaba.com> > Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> > --- > arch/arm64/mm/trans_pgd.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c > index d7da8ca40d2e..3f1fc6cb9c9d 100644 > --- a/arch/arm64/mm/trans_pgd.c > +++ b/arch/arm64/mm/trans_pgd.c > @@ -62,12 +62,13 @@ static int copy_pte(struct trans_pgd_info *info, pmd_t *dst_pmdp, > { > pte_t *src_ptep; > pte_t *dst_ptep; > + struct page *page; > unsigned long addr = start; > > - dst_ptep = trans_alloc(info); > - if (!dst_ptep) > + page = virt_to_page(trans_alloc(info)); > + if (!page) > return -ENOMEM; > - pmd_populate_kernel(NULL, dst_pmdp, dst_ptep); > + pmd_populate(NULL, dst_pmdp, page); Are you sure this truly fixes the underlying issue rather than the symptom? pmd_populate() will create a table entry with the PXN attribute set, which means nothing below it will be executable by the kernel, regardless of the executable permissions at the PTE level. > dst_ptep = pte_offset_kernel(dst_pmdp, start); > > src_ptep = pte_offset_kernel(src_pmdp, start); > -- > 2.27.0 > ^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH 1/2] arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte() @ 2021-10-31 12:25 ` Ard Biesheuvel 0 siblings, 0 replies; 28+ messages in thread From: Ard Biesheuvel @ 2021-10-31 12:25 UTC (permalink / raw) To: Rongwei Wang Cc: Catalin Marinas, Will Deacon, Mark Rutland, James Morse, Fuad Tabba, Andrew Morton, Mike Rapoport, Anshuman Khandual, Linux ARM, Linux Kernel Mailing List On Sat, 30 Oct 2021 at 20:32, Rongwei Wang <rongwei.wang@linux.alibaba.com> wrote: > > In commit 5de59884ac0e ("arm64: trans_pgd: pass NULL instead > of init_mm to *_populate functions"), simply replace init_mm > with NULL for pmd_populate_kernel. But in commit 59511cfd08f3 > ("arm64: mm: use XN table mapping attributes for user/kernel > mappings"), adding the check of mm context in > pmd_populate_kernel. And these changes will cause a crash when > executing copy_pte/trans_pgd.c, as follows: > > kernel BUG at arch/arm64/include/asm/pgalloc.h:79! > Internal error: Oops - BUG: 0 [#1] SMP > Modules linked in: rfkill(E) aes_ce_blk(E) aes_ce_cipher(E) ... > CPU: 21 PID: 1617 Comm: a.out Kdump: loaded Tainted: ... 5.15.0-rc7-mm1+ #8 > Hardware name: ECS, BIOS 0.0.0 02/06/2015 > pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) > pc : trans_pgd_create_copy+0x4ac/0x4f0 > lr : trans_pgd_create_copy+0x34c/0x4f0 > sp : ffff80001bf2bc50 > x29: ffff80001bf2bc50 x28: ffff0010067f1000 x27: ffff800011072000 > x26: ffff001fffff8000 x25: ffff008000000000 x24: 0040000000000041 > x23: 0040000000000001 x22: ffff80001bf2bd68 x21: ffff80001188ded8 > x20: ffff800000000000 x19: ffff000000000000 x18: 0000000000000000 > x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200004c0 > x14: ffff00003fffffff x13: ffff007fffffffff x12: ffff800010f882a8 > x11: 0000000000face57 x10: 0000000000000001 x9 : 0000000000000000 > x8 : ffff00100cece000 x7 : ffff001001c9f000 x6 : ffff00100ae40000 > x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffff001fffff7000 > x2 : ffff000000200000 x1 : ffff000040000000 x0 : ffff00100cecd000 > Call trace: > trans_pgd_create_copy+0x4ac/0x4f0 > machine_kexec_post_load+0x94/0x3bc > do_kexec_load+0x11c/0x2e0 > __arm64_sys_kexec_load+0xa8/0xf4 > invoke_syscall+0x50/0x120 > el0_svc_common.constprop.0+0x58/0x190 > do_el0_svc+0x2c/0x90 > el0_svc+0x28/0xe0 > el0t_64_sync_handler+0xb0/0xb4 > el0t_64_sync+0x180/0x184 > Code: f90000c0 d5033a9f d5033fdf 17ffff7b (d4210000) > ---[ end trace cc5461ffe1a085db ]--- > Kernel panic - not syncing: Oops - BUG: Fatal exception > > This bug can be reproduced by a user case: > > void execute_kexec_load(void) > { > syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); > syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); > syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); > > *(uint64_t*)0x200004c0 = 0; > *(uint64_t*)0x200004c8 = 0; > *(uint64_t*)0x200004d0 = 0; > *(uint64_t*)0x200004d8 = 0; > syscall(__NR_kexec_load, 0ul, 1ul, 0x200004c0ul, 0ul); > } > > And this patch just make some simple changes, and including > replace pmd_populate_kernel with pmd_populate. > > Fixes: 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings") > Reported-by: Abaci <abaci@linux.alibaba.com> > Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> > --- > arch/arm64/mm/trans_pgd.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c > index d7da8ca40d2e..3f1fc6cb9c9d 100644 > --- a/arch/arm64/mm/trans_pgd.c > +++ b/arch/arm64/mm/trans_pgd.c > @@ -62,12 +62,13 @@ static int copy_pte(struct trans_pgd_info *info, pmd_t *dst_pmdp, > { > pte_t *src_ptep; > pte_t *dst_ptep; > + struct page *page; > unsigned long addr = start; > > - dst_ptep = trans_alloc(info); > - if (!dst_ptep) > + page = virt_to_page(trans_alloc(info)); > + if (!page) > return -ENOMEM; > - pmd_populate_kernel(NULL, dst_pmdp, dst_ptep); > + pmd_populate(NULL, dst_pmdp, page); Are you sure this truly fixes the underlying issue rather than the symptom? pmd_populate() will create a table entry with the PXN attribute set, which means nothing below it will be executable by the kernel, regardless of the executable permissions at the PTE level. > dst_ptep = pte_offset_kernel(dst_pmdp, start); > > src_ptep = pte_offset_kernel(src_pmdp, start); > -- > 2.27.0 > _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH 1/2] arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte() 2021-10-31 12:25 ` Ard Biesheuvel @ 2021-11-01 2:14 ` Rongwei Wang -1 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-11-01 2:14 UTC (permalink / raw) To: Ard Biesheuvel Cc: Catalin Marinas, Will Deacon, Mark Rutland, James Morse, Fuad Tabba, Andrew Morton, Mike Rapoport, Anshuman Khandual, Linux ARM, Linux Kernel Mailing List On 10/31/21 8:25 PM, Ard Biesheuvel wrote: > On Sat, 30 Oct 2021 at 20:32, Rongwei Wang > <rongwei.wang@linux.alibaba.com> wrote: >> >> In commit 5de59884ac0e ("arm64: trans_pgd: pass NULL instead >> of init_mm to *_populate functions"), simply replace init_mm >> with NULL for pmd_populate_kernel. But in commit 59511cfd08f3 >> ("arm64: mm: use XN table mapping attributes for user/kernel >> mappings"), adding the check of mm context in >> pmd_populate_kernel. And these changes will cause a crash when >> executing copy_pte/trans_pgd.c, as follows: >> >> kernel BUG at arch/arm64/include/asm/pgalloc.h:79! >> Internal error: Oops - BUG: 0 [#1] SMP >> Modules linked in: rfkill(E) aes_ce_blk(E) aes_ce_cipher(E) ... >> CPU: 21 PID: 1617 Comm: a.out Kdump: loaded Tainted: ... 5.15.0-rc7-mm1+ #8 >> Hardware name: ECS, BIOS 0.0.0 02/06/2015 >> pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) >> pc : trans_pgd_create_copy+0x4ac/0x4f0 >> lr : trans_pgd_create_copy+0x34c/0x4f0 >> sp : ffff80001bf2bc50 >> x29: ffff80001bf2bc50 x28: ffff0010067f1000 x27: ffff800011072000 >> x26: ffff001fffff8000 x25: ffff008000000000 x24: 0040000000000041 >> x23: 0040000000000001 x22: ffff80001bf2bd68 x21: ffff80001188ded8 >> x20: ffff800000000000 x19: ffff000000000000 x18: 0000000000000000 >> x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200004c0 >> x14: ffff00003fffffff x13: ffff007fffffffff x12: ffff800010f882a8 >> x11: 0000000000face57 x10: 0000000000000001 x9 : 0000000000000000 >> x8 : ffff00100cece000 x7 : ffff001001c9f000 x6 : ffff00100ae40000 >> x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffff001fffff7000 >> x2 : ffff000000200000 x1 : ffff000040000000 x0 : ffff00100cecd000 >> Call trace: >> trans_pgd_create_copy+0x4ac/0x4f0 >> machine_kexec_post_load+0x94/0x3bc >> do_kexec_load+0x11c/0x2e0 >> __arm64_sys_kexec_load+0xa8/0xf4 >> invoke_syscall+0x50/0x120 >> el0_svc_common.constprop.0+0x58/0x190 >> do_el0_svc+0x2c/0x90 >> el0_svc+0x28/0xe0 >> el0t_64_sync_handler+0xb0/0xb4 >> el0t_64_sync+0x180/0x184 >> Code: f90000c0 d5033a9f d5033fdf 17ffff7b (d4210000) >> ---[ end trace cc5461ffe1a085db ]--- >> Kernel panic - not syncing: Oops - BUG: Fatal exception >> >> This bug can be reproduced by a user case: >> >> void execute_kexec_load(void) >> { >> syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); >> syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); >> syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); >> >> *(uint64_t*)0x200004c0 = 0; >> *(uint64_t*)0x200004c8 = 0; >> *(uint64_t*)0x200004d0 = 0; >> *(uint64_t*)0x200004d8 = 0; >> syscall(__NR_kexec_load, 0ul, 1ul, 0x200004c0ul, 0ul); >> } >> >> And this patch just make some simple changes, and including >> replace pmd_populate_kernel with pmd_populate. >> >> Fixes: 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings") >> Reported-by: Abaci <abaci@linux.alibaba.com> >> Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> >> --- >> arch/arm64/mm/trans_pgd.c | 7 ++++--- >> 1 file changed, 4 insertions(+), 3 deletions(-) >> >> diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c >> index d7da8ca40d2e..3f1fc6cb9c9d 100644 >> --- a/arch/arm64/mm/trans_pgd.c >> +++ b/arch/arm64/mm/trans_pgd.c >> @@ -62,12 +62,13 @@ static int copy_pte(struct trans_pgd_info *info, pmd_t *dst_pmdp, >> { >> pte_t *src_ptep; >> pte_t *dst_ptep; >> + struct page *page; >> unsigned long addr = start; >> >> - dst_ptep = trans_alloc(info); >> - if (!dst_ptep) >> + page = virt_to_page(trans_alloc(info)); >> + if (!page) >> return -ENOMEM; >> - pmd_populate_kernel(NULL, dst_pmdp, dst_ptep); >> + pmd_populate(NULL, dst_pmdp, page); > > Are you sure this truly fixes the underlying issue rather than the symptom? > Hi Ard I just found bug line on 'VM_BUG_ON(mm != &init_mm)' shown below, seems a obvious incorrect use of 'pmd_populate_kernel' in copy_pte. It seems these changes were introduced in this year. static inline void pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmdp, pte_t *ptep) { VM_BUG_ON(mm != &init_mm); __pmd_populate(pmdp, __pa(ptep), PMD_TYPE_TABLE | PMD_TABLE_UXN); } And I had run some testcases, not triggered this bug any more. If I missing something, please remind me! And I will check it again. Thanks! > pmd_populate() will create a table entry with the PXN attribute set, > which means nothing below it will be executable by the kernel, > regardless of the executable permissions at the PTE level. > > >> dst_ptep = pte_offset_kernel(dst_pmdp, start); >> >> src_ptep = pte_offset_kernel(src_pmdp, start); >> -- >> 2.27.0 >> ^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH 1/2] arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte() @ 2021-11-01 2:14 ` Rongwei Wang 0 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-11-01 2:14 UTC (permalink / raw) To: Ard Biesheuvel Cc: Catalin Marinas, Will Deacon, Mark Rutland, James Morse, Fuad Tabba, Andrew Morton, Mike Rapoport, Anshuman Khandual, Linux ARM, Linux Kernel Mailing List On 10/31/21 8:25 PM, Ard Biesheuvel wrote: > On Sat, 30 Oct 2021 at 20:32, Rongwei Wang > <rongwei.wang@linux.alibaba.com> wrote: >> >> In commit 5de59884ac0e ("arm64: trans_pgd: pass NULL instead >> of init_mm to *_populate functions"), simply replace init_mm >> with NULL for pmd_populate_kernel. But in commit 59511cfd08f3 >> ("arm64: mm: use XN table mapping attributes for user/kernel >> mappings"), adding the check of mm context in >> pmd_populate_kernel. And these changes will cause a crash when >> executing copy_pte/trans_pgd.c, as follows: >> >> kernel BUG at arch/arm64/include/asm/pgalloc.h:79! >> Internal error: Oops - BUG: 0 [#1] SMP >> Modules linked in: rfkill(E) aes_ce_blk(E) aes_ce_cipher(E) ... >> CPU: 21 PID: 1617 Comm: a.out Kdump: loaded Tainted: ... 5.15.0-rc7-mm1+ #8 >> Hardware name: ECS, BIOS 0.0.0 02/06/2015 >> pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) >> pc : trans_pgd_create_copy+0x4ac/0x4f0 >> lr : trans_pgd_create_copy+0x34c/0x4f0 >> sp : ffff80001bf2bc50 >> x29: ffff80001bf2bc50 x28: ffff0010067f1000 x27: ffff800011072000 >> x26: ffff001fffff8000 x25: ffff008000000000 x24: 0040000000000041 >> x23: 0040000000000001 x22: ffff80001bf2bd68 x21: ffff80001188ded8 >> x20: ffff800000000000 x19: ffff000000000000 x18: 0000000000000000 >> x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200004c0 >> x14: ffff00003fffffff x13: ffff007fffffffff x12: ffff800010f882a8 >> x11: 0000000000face57 x10: 0000000000000001 x9 : 0000000000000000 >> x8 : ffff00100cece000 x7 : ffff001001c9f000 x6 : ffff00100ae40000 >> x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffff001fffff7000 >> x2 : ffff000000200000 x1 : ffff000040000000 x0 : ffff00100cecd000 >> Call trace: >> trans_pgd_create_copy+0x4ac/0x4f0 >> machine_kexec_post_load+0x94/0x3bc >> do_kexec_load+0x11c/0x2e0 >> __arm64_sys_kexec_load+0xa8/0xf4 >> invoke_syscall+0x50/0x120 >> el0_svc_common.constprop.0+0x58/0x190 >> do_el0_svc+0x2c/0x90 >> el0_svc+0x28/0xe0 >> el0t_64_sync_handler+0xb0/0xb4 >> el0t_64_sync+0x180/0x184 >> Code: f90000c0 d5033a9f d5033fdf 17ffff7b (d4210000) >> ---[ end trace cc5461ffe1a085db ]--- >> Kernel panic - not syncing: Oops - BUG: Fatal exception >> >> This bug can be reproduced by a user case: >> >> void execute_kexec_load(void) >> { >> syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); >> syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); >> syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); >> >> *(uint64_t*)0x200004c0 = 0; >> *(uint64_t*)0x200004c8 = 0; >> *(uint64_t*)0x200004d0 = 0; >> *(uint64_t*)0x200004d8 = 0; >> syscall(__NR_kexec_load, 0ul, 1ul, 0x200004c0ul, 0ul); >> } >> >> And this patch just make some simple changes, and including >> replace pmd_populate_kernel with pmd_populate. >> >> Fixes: 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings") >> Reported-by: Abaci <abaci@linux.alibaba.com> >> Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> >> --- >> arch/arm64/mm/trans_pgd.c | 7 ++++--- >> 1 file changed, 4 insertions(+), 3 deletions(-) >> >> diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c >> index d7da8ca40d2e..3f1fc6cb9c9d 100644 >> --- a/arch/arm64/mm/trans_pgd.c >> +++ b/arch/arm64/mm/trans_pgd.c >> @@ -62,12 +62,13 @@ static int copy_pte(struct trans_pgd_info *info, pmd_t *dst_pmdp, >> { >> pte_t *src_ptep; >> pte_t *dst_ptep; >> + struct page *page; >> unsigned long addr = start; >> >> - dst_ptep = trans_alloc(info); >> - if (!dst_ptep) >> + page = virt_to_page(trans_alloc(info)); >> + if (!page) >> return -ENOMEM; >> - pmd_populate_kernel(NULL, dst_pmdp, dst_ptep); >> + pmd_populate(NULL, dst_pmdp, page); > > Are you sure this truly fixes the underlying issue rather than the symptom? > Hi Ard I just found bug line on 'VM_BUG_ON(mm != &init_mm)' shown below, seems a obvious incorrect use of 'pmd_populate_kernel' in copy_pte. It seems these changes were introduced in this year. static inline void pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmdp, pte_t *ptep) { VM_BUG_ON(mm != &init_mm); __pmd_populate(pmdp, __pa(ptep), PMD_TYPE_TABLE | PMD_TABLE_UXN); } And I had run some testcases, not triggered this bug any more. If I missing something, please remind me! And I will check it again. Thanks! > pmd_populate() will create a table entry with the PXN attribute set, > which means nothing below it will be executable by the kernel, > regardless of the executable permissions at the PTE level. > > >> dst_ptep = pte_offset_kernel(dst_pmdp, start); >> >> src_ptep = pte_offset_kernel(src_pmdp, start); >> -- >> 2.27.0 >> _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH 1/2] arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte() 2021-10-31 12:25 ` Ard Biesheuvel @ 2021-11-05 5:58 ` Rongwei Wang -1 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-11-05 5:58 UTC (permalink / raw) To: Ard Biesheuvel Cc: Catalin Marinas, Will Deacon, Mark Rutland, James Morse, Fuad Tabba, Andrew Morton, Mike Rapoport, Anshuman Khandual, Linux ARM, Linux Kernel Mailing List On 10/31/21 8:25 PM, Ard Biesheuvel wrote: > On Sat, 30 Oct 2021 at 20:32, Rongwei Wang > <rongwei.wang@linux.alibaba.com> wrote: >> >> In commit 5de59884ac0e ("arm64: trans_pgd: pass NULL instead >> of init_mm to *_populate functions"), simply replace init_mm >> with NULL for pmd_populate_kernel. But in commit 59511cfd08f3 >> ("arm64: mm: use XN table mapping attributes for user/kernel >> mappings"), adding the check of mm context in >> pmd_populate_kernel. And these changes will cause a crash when >> executing copy_pte/trans_pgd.c, as follows: >> >> kernel BUG at arch/arm64/include/asm/pgalloc.h:79! >> Internal error: Oops - BUG: 0 [#1] SMP >> Modules linked in: rfkill(E) aes_ce_blk(E) aes_ce_cipher(E) ... >> CPU: 21 PID: 1617 Comm: a.out Kdump: loaded Tainted: ... 5.15.0-rc7-mm1+ #8 >> Hardware name: ECS, BIOS 0.0.0 02/06/2015 >> pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) >> pc : trans_pgd_create_copy+0x4ac/0x4f0 >> lr : trans_pgd_create_copy+0x34c/0x4f0 >> sp : ffff80001bf2bc50 >> x29: ffff80001bf2bc50 x28: ffff0010067f1000 x27: ffff800011072000 >> x26: ffff001fffff8000 x25: ffff008000000000 x24: 0040000000000041 >> x23: 0040000000000001 x22: ffff80001bf2bd68 x21: ffff80001188ded8 >> x20: ffff800000000000 x19: ffff000000000000 x18: 0000000000000000 >> x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200004c0 >> x14: ffff00003fffffff x13: ffff007fffffffff x12: ffff800010f882a8 >> x11: 0000000000face57 x10: 0000000000000001 x9 : 0000000000000000 >> x8 : ffff00100cece000 x7 : ffff001001c9f000 x6 : ffff00100ae40000 >> x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffff001fffff7000 >> x2 : ffff000000200000 x1 : ffff000040000000 x0 : ffff00100cecd000 >> Call trace: >> trans_pgd_create_copy+0x4ac/0x4f0 >> machine_kexec_post_load+0x94/0x3bc >> do_kexec_load+0x11c/0x2e0 >> __arm64_sys_kexec_load+0xa8/0xf4 >> invoke_syscall+0x50/0x120 >> el0_svc_common.constprop.0+0x58/0x190 >> do_el0_svc+0x2c/0x90 >> el0_svc+0x28/0xe0 >> el0t_64_sync_handler+0xb0/0xb4 >> el0t_64_sync+0x180/0x184 >> Code: f90000c0 d5033a9f d5033fdf 17ffff7b (d4210000) >> ---[ end trace cc5461ffe1a085db ]--- >> Kernel panic - not syncing: Oops - BUG: Fatal exception >> >> This bug can be reproduced by a user case: >> >> void execute_kexec_load(void) >> { >> syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); >> syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); >> syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); >> >> *(uint64_t*)0x200004c0 = 0; >> *(uint64_t*)0x200004c8 = 0; >> *(uint64_t*)0x200004d0 = 0; >> *(uint64_t*)0x200004d8 = 0; >> syscall(__NR_kexec_load, 0ul, 1ul, 0x200004c0ul, 0ul); >> } >> >> And this patch just make some simple changes, and including >> replace pmd_populate_kernel with pmd_populate. >> >> Fixes: 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings") >> Reported-by: Abaci <abaci@linux.alibaba.com> >> Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> >> --- >> arch/arm64/mm/trans_pgd.c | 7 ++++--- >> 1 file changed, 4 insertions(+), 3 deletions(-) >> >> diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c >> index d7da8ca40d2e..3f1fc6cb9c9d 100644 >> --- a/arch/arm64/mm/trans_pgd.c >> +++ b/arch/arm64/mm/trans_pgd.c >> @@ -62,12 +62,13 @@ static int copy_pte(struct trans_pgd_info *info, pmd_t *dst_pmdp, >> { >> pte_t *src_ptep; >> pte_t *dst_ptep; >> + struct page *page; >> unsigned long addr = start; >> >> - dst_ptep = trans_alloc(info); >> - if (!dst_ptep) >> + page = virt_to_page(trans_alloc(info)); >> + if (!page) >> return -ENOMEM; >> - pmd_populate_kernel(NULL, dst_pmdp, dst_ptep); >> + pmd_populate(NULL, dst_pmdp, page); > > Are you sure this truly fixes the underlying issue rather than the symptom? > > pmd_populate() will create a table entry with the PXN attribute set, > which means nothing below it will be executable by the kernel, > regardless of the executable permissions at the PTE level. Hi Ard I had check here again because of you reminder. Indeed, It's incorrect fix just replace pmd_populate_kernel with pmd_populate in above patch. And how about the following method to be used to fix this bug? In fact, the following code just restore one modification in 5de59884ac0e ("arm64: trans_pgd: pass NULL instead of init_mm to *_populate functions"). diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c index d7da8ca40d2e..5275ca312360 100644 --- a/arch/arm64/mm/trans_pgd.c +++ b/arch/arm64/mm/trans_pgd.c @@ -67,7 +67,7 @@ static int copy_pte(struct trans_pgd_info *info, pmd_t *dst_pmdp, dst_ptep = trans_alloc(info); if (!dst_ptep) return -ENOMEM; - pmd_populate_kernel(NULL, dst_pmdp, dst_ptep); + pmd_populate_kernel(&init_mm, dst_pmdp, dst_ptep); dst_ptep = pte_offset_kernel(dst_pmdp, start); src_ptep = pte_offset_kernel(src_pmdp, start); Thanks! > > >> dst_ptep = pte_offset_kernel(dst_pmdp, start); >> >> src_ptep = pte_offset_kernel(src_pmdp, start); >> -- >> 2.27.0 >> ^ permalink raw reply related [flat|nested] 28+ messages in thread
* Re: [PATCH 1/2] arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte() @ 2021-11-05 5:58 ` Rongwei Wang 0 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-11-05 5:58 UTC (permalink / raw) To: Ard Biesheuvel Cc: Catalin Marinas, Will Deacon, Mark Rutland, James Morse, Fuad Tabba, Andrew Morton, Mike Rapoport, Anshuman Khandual, Linux ARM, Linux Kernel Mailing List On 10/31/21 8:25 PM, Ard Biesheuvel wrote: > On Sat, 30 Oct 2021 at 20:32, Rongwei Wang > <rongwei.wang@linux.alibaba.com> wrote: >> >> In commit 5de59884ac0e ("arm64: trans_pgd: pass NULL instead >> of init_mm to *_populate functions"), simply replace init_mm >> with NULL for pmd_populate_kernel. But in commit 59511cfd08f3 >> ("arm64: mm: use XN table mapping attributes for user/kernel >> mappings"), adding the check of mm context in >> pmd_populate_kernel. And these changes will cause a crash when >> executing copy_pte/trans_pgd.c, as follows: >> >> kernel BUG at arch/arm64/include/asm/pgalloc.h:79! >> Internal error: Oops - BUG: 0 [#1] SMP >> Modules linked in: rfkill(E) aes_ce_blk(E) aes_ce_cipher(E) ... >> CPU: 21 PID: 1617 Comm: a.out Kdump: loaded Tainted: ... 5.15.0-rc7-mm1+ #8 >> Hardware name: ECS, BIOS 0.0.0 02/06/2015 >> pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) >> pc : trans_pgd_create_copy+0x4ac/0x4f0 >> lr : trans_pgd_create_copy+0x34c/0x4f0 >> sp : ffff80001bf2bc50 >> x29: ffff80001bf2bc50 x28: ffff0010067f1000 x27: ffff800011072000 >> x26: ffff001fffff8000 x25: ffff008000000000 x24: 0040000000000041 >> x23: 0040000000000001 x22: ffff80001bf2bd68 x21: ffff80001188ded8 >> x20: ffff800000000000 x19: ffff000000000000 x18: 0000000000000000 >> x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200004c0 >> x14: ffff00003fffffff x13: ffff007fffffffff x12: ffff800010f882a8 >> x11: 0000000000face57 x10: 0000000000000001 x9 : 0000000000000000 >> x8 : ffff00100cece000 x7 : ffff001001c9f000 x6 : ffff00100ae40000 >> x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffff001fffff7000 >> x2 : ffff000000200000 x1 : ffff000040000000 x0 : ffff00100cecd000 >> Call trace: >> trans_pgd_create_copy+0x4ac/0x4f0 >> machine_kexec_post_load+0x94/0x3bc >> do_kexec_load+0x11c/0x2e0 >> __arm64_sys_kexec_load+0xa8/0xf4 >> invoke_syscall+0x50/0x120 >> el0_svc_common.constprop.0+0x58/0x190 >> do_el0_svc+0x2c/0x90 >> el0_svc+0x28/0xe0 >> el0t_64_sync_handler+0xb0/0xb4 >> el0t_64_sync+0x180/0x184 >> Code: f90000c0 d5033a9f d5033fdf 17ffff7b (d4210000) >> ---[ end trace cc5461ffe1a085db ]--- >> Kernel panic - not syncing: Oops - BUG: Fatal exception >> >> This bug can be reproduced by a user case: >> >> void execute_kexec_load(void) >> { >> syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); >> syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); >> syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); >> >> *(uint64_t*)0x200004c0 = 0; >> *(uint64_t*)0x200004c8 = 0; >> *(uint64_t*)0x200004d0 = 0; >> *(uint64_t*)0x200004d8 = 0; >> syscall(__NR_kexec_load, 0ul, 1ul, 0x200004c0ul, 0ul); >> } >> >> And this patch just make some simple changes, and including >> replace pmd_populate_kernel with pmd_populate. >> >> Fixes: 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings") >> Reported-by: Abaci <abaci@linux.alibaba.com> >> Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> >> --- >> arch/arm64/mm/trans_pgd.c | 7 ++++--- >> 1 file changed, 4 insertions(+), 3 deletions(-) >> >> diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c >> index d7da8ca40d2e..3f1fc6cb9c9d 100644 >> --- a/arch/arm64/mm/trans_pgd.c >> +++ b/arch/arm64/mm/trans_pgd.c >> @@ -62,12 +62,13 @@ static int copy_pte(struct trans_pgd_info *info, pmd_t *dst_pmdp, >> { >> pte_t *src_ptep; >> pte_t *dst_ptep; >> + struct page *page; >> unsigned long addr = start; >> >> - dst_ptep = trans_alloc(info); >> - if (!dst_ptep) >> + page = virt_to_page(trans_alloc(info)); >> + if (!page) >> return -ENOMEM; >> - pmd_populate_kernel(NULL, dst_pmdp, dst_ptep); >> + pmd_populate(NULL, dst_pmdp, page); > > Are you sure this truly fixes the underlying issue rather than the symptom? > > pmd_populate() will create a table entry with the PXN attribute set, > which means nothing below it will be executable by the kernel, > regardless of the executable permissions at the PTE level. Hi Ard I had check here again because of you reminder. Indeed, It's incorrect fix just replace pmd_populate_kernel with pmd_populate in above patch. And how about the following method to be used to fix this bug? In fact, the following code just restore one modification in 5de59884ac0e ("arm64: trans_pgd: pass NULL instead of init_mm to *_populate functions"). diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c index d7da8ca40d2e..5275ca312360 100644 --- a/arch/arm64/mm/trans_pgd.c +++ b/arch/arm64/mm/trans_pgd.c @@ -67,7 +67,7 @@ static int copy_pte(struct trans_pgd_info *info, pmd_t *dst_pmdp, dst_ptep = trans_alloc(info); if (!dst_ptep) return -ENOMEM; - pmd_populate_kernel(NULL, dst_pmdp, dst_ptep); + pmd_populate_kernel(&init_mm, dst_pmdp, dst_ptep); dst_ptep = pte_offset_kernel(dst_pmdp, start); src_ptep = pte_offset_kernel(src_pmdp, start); Thanks! > > >> dst_ptep = pte_offset_kernel(dst_pmdp, start); >> >> src_ptep = pte_offset_kernel(src_pmdp, start); >> -- >> 2.27.0 >> _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply related [flat|nested] 28+ messages in thread
* [PATCH 2/2] arm64: kexec: reduce calls to page_address() 2021-10-30 18:31 ` Rongwei Wang @ 2021-10-30 18:32 ` Rongwei Wang -1 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-10-30 18:32 UTC (permalink / raw) To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba, akpm, rppt, anshuman.khandual Cc: linux-arm-kernel, linux-kernel In kexec_page_alloc(), page_address() is called twice. This patch add a new variable to help to reduce calls to page_address(). Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> --- arch/arm64/kernel/machine_kexec.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/machine_kexec.c b/arch/arm64/kernel/machine_kexec.c index 1038494135c8..7f2530bcd42e 100644 --- a/arch/arm64/kernel/machine_kexec.c +++ b/arch/arm64/kernel/machine_kexec.c @@ -104,13 +104,15 @@ static void *kexec_page_alloc(void *arg) { struct kimage *kimage = (struct kimage *)arg; struct page *page = kimage_alloc_control_pages(kimage, 0); + void *vaddr = NULL; if (!page) return NULL; - memset(page_address(page), 0, PAGE_SIZE); + vaddr = page_address(page); + memset(vaddr, 0, PAGE_SIZE); - return page_address(page); + return vaddr; } int machine_kexec_post_load(struct kimage *kimage) -- 2.27.0 ^ permalink raw reply related [flat|nested] 28+ messages in thread
* [PATCH 2/2] arm64: kexec: reduce calls to page_address() @ 2021-10-30 18:32 ` Rongwei Wang 0 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-10-30 18:32 UTC (permalink / raw) To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba, akpm, rppt, anshuman.khandual Cc: linux-arm-kernel, linux-kernel In kexec_page_alloc(), page_address() is called twice. This patch add a new variable to help to reduce calls to page_address(). Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> --- arch/arm64/kernel/machine_kexec.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/machine_kexec.c b/arch/arm64/kernel/machine_kexec.c index 1038494135c8..7f2530bcd42e 100644 --- a/arch/arm64/kernel/machine_kexec.c +++ b/arch/arm64/kernel/machine_kexec.c @@ -104,13 +104,15 @@ static void *kexec_page_alloc(void *arg) { struct kimage *kimage = (struct kimage *)arg; struct page *page = kimage_alloc_control_pages(kimage, 0); + void *vaddr = NULL; if (!page) return NULL; - memset(page_address(page), 0, PAGE_SIZE); + vaddr = page_address(page); + memset(vaddr, 0, PAGE_SIZE); - return page_address(page); + return vaddr; } int machine_kexec_post_load(struct kimage *kimage) -- 2.27.0 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply related [flat|nested] 28+ messages in thread
* [PATCH v2 0/2] fix bug when calling kexec_load() 2021-10-30 18:31 ` Rongwei Wang @ 2021-11-14 20:16 ` Rongwei Wang -1 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-11-14 20:16 UTC (permalink / raw) To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba, akpm, rppt, anshuman.khandual Cc: linux-arm-kernel, linux-kernel Patch 1/2 mainly to fix the bug when calling kexec_load(). And a user case shown in commit log. Patch 2/2 just make a very simple optimization, reducing calls to page_address() in kexec_page_alloc(). v1 -> v2 - Patch " arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte()" restore the usage of pmd_populate_kernel. v1 link: https://patchwork.kernel.org/project/linux-arm-kernel/patch/20211030183200.51295-2-rongwei.wang@linux.alibaba.com/ Rongwei Wang (2): arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte() arm64: kexec: reduce calls to page_address() arch/arm64/kernel/machine_kexec.c | 6 ++++-- arch/arm64/mm/trans_pgd.c | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) -- 2.27.0 ^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH v2 0/2] fix bug when calling kexec_load() @ 2021-11-14 20:16 ` Rongwei Wang 0 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-11-14 20:16 UTC (permalink / raw) To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba, akpm, rppt, anshuman.khandual Cc: linux-arm-kernel, linux-kernel Patch 1/2 mainly to fix the bug when calling kexec_load(). And a user case shown in commit log. Patch 2/2 just make a very simple optimization, reducing calls to page_address() in kexec_page_alloc(). v1 -> v2 - Patch " arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte()" restore the usage of pmd_populate_kernel. v1 link: https://patchwork.kernel.org/project/linux-arm-kernel/patch/20211030183200.51295-2-rongwei.wang@linux.alibaba.com/ Rongwei Wang (2): arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte() arm64: kexec: reduce calls to page_address() arch/arm64/kernel/machine_kexec.c | 6 ++++-- arch/arm64/mm/trans_pgd.c | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) -- 2.27.0 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH v2 1/2] arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte() 2021-11-14 20:16 ` Rongwei Wang @ 2021-11-14 20:16 ` Rongwei Wang -1 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-11-14 20:16 UTC (permalink / raw) To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba, akpm, rppt, anshuman.khandual Cc: linux-arm-kernel, linux-kernel In commit 5de59884ac0e ("arm64: trans_pgd: pass NULL instead of init_mm to *_populate functions"), simply replace init_mm with NULL for pmd_populate_kernel. But in commit 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings"), adding the check of mm context in pmd_populate_kernel. And these changes will cause a crash when executing copy_pte/trans_pgd.c, as follows: kernel BUG at arch/arm64/include/asm/pgalloc.h:79! Internal error: Oops - BUG: 0 [#1] SMP Modules linked in: rfkill(E) aes_ce_blk(E) aes_ce_cipher(E) ... CPU: 21 PID: 1617 Comm: a.out Kdump: loaded Tainted: ... 5.15.0-rc7-mm1+ #8 Hardware name: ECS, BIOS 0.0.0 02/06/2015 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : trans_pgd_create_copy+0x4ac/0x4f0 lr : trans_pgd_create_copy+0x34c/0x4f0 sp : ffff80001bf2bc50 x29: ffff80001bf2bc50 x28: ffff0010067f1000 x27: ffff800011072000 x26: ffff001fffff8000 x25: ffff008000000000 x24: 0040000000000041 x23: 0040000000000001 x22: ffff80001bf2bd68 x21: ffff80001188ded8 x20: ffff800000000000 x19: ffff000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200004c0 x14: ffff00003fffffff x13: ffff007fffffffff x12: ffff800010f882a8 x11: 0000000000face57 x10: 0000000000000001 x9 : 0000000000000000 x8 : ffff00100cece000 x7 : ffff001001c9f000 x6 : ffff00100ae40000 x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffff001fffff7000 x2 : ffff000000200000 x1 : ffff000040000000 x0 : ffff00100cecd000 Call trace: trans_pgd_create_copy+0x4ac/0x4f0 machine_kexec_post_load+0x94/0x3bc do_kexec_load+0x11c/0x2e0 __arm64_sys_kexec_load+0xa8/0xf4 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0x58/0x190 do_el0_svc+0x2c/0x90 el0_svc+0x28/0xe0 el0t_64_sync_handler+0xb0/0xb4 el0t_64_sync+0x180/0x184 Code: f90000c0 d5033a9f d5033fdf 17ffff7b (d4210000) ---[ end trace cc5461ffe1a085db ]--- Kernel panic - not syncing: Oops - BUG: Fatal exception This bug can be reproduced by a user case: void execute_kexec_load(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); *(uint64_t*)0x200004c0 = 0; *(uint64_t*)0x200004c8 = 0; *(uint64_t*)0x200004d0 = 0; *(uint64_t*)0x200004d8 = 0; syscall(__NR_kexec_load, 0ul, 1ul, 0x200004c0ul, 0ul); } And this patch make a simple change, just restoring init_mm for 'pmd_populate_kernel' in 'copy_pte'. Fixes: 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings") Reported-by: Abaci <abaci@linux.alibaba.com> Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> --- arch/arm64/mm/trans_pgd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c index d7da8ca40d2e..5275ca312360 100644 --- a/arch/arm64/mm/trans_pgd.c +++ b/arch/arm64/mm/trans_pgd.c @@ -67,7 +67,7 @@ static int copy_pte(struct trans_pgd_info *info, pmd_t *dst_pmdp, dst_ptep = trans_alloc(info); if (!dst_ptep) return -ENOMEM; - pmd_populate_kernel(NULL, dst_pmdp, dst_ptep); + pmd_populate_kernel(&init_mm, dst_pmdp, dst_ptep); dst_ptep = pte_offset_kernel(dst_pmdp, start); src_ptep = pte_offset_kernel(src_pmdp, start); -- 2.27.0 ^ permalink raw reply related [flat|nested] 28+ messages in thread
* [PATCH v2 1/2] arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte() @ 2021-11-14 20:16 ` Rongwei Wang 0 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-11-14 20:16 UTC (permalink / raw) To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba, akpm, rppt, anshuman.khandual Cc: linux-arm-kernel, linux-kernel In commit 5de59884ac0e ("arm64: trans_pgd: pass NULL instead of init_mm to *_populate functions"), simply replace init_mm with NULL for pmd_populate_kernel. But in commit 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings"), adding the check of mm context in pmd_populate_kernel. And these changes will cause a crash when executing copy_pte/trans_pgd.c, as follows: kernel BUG at arch/arm64/include/asm/pgalloc.h:79! Internal error: Oops - BUG: 0 [#1] SMP Modules linked in: rfkill(E) aes_ce_blk(E) aes_ce_cipher(E) ... CPU: 21 PID: 1617 Comm: a.out Kdump: loaded Tainted: ... 5.15.0-rc7-mm1+ #8 Hardware name: ECS, BIOS 0.0.0 02/06/2015 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : trans_pgd_create_copy+0x4ac/0x4f0 lr : trans_pgd_create_copy+0x34c/0x4f0 sp : ffff80001bf2bc50 x29: ffff80001bf2bc50 x28: ffff0010067f1000 x27: ffff800011072000 x26: ffff001fffff8000 x25: ffff008000000000 x24: 0040000000000041 x23: 0040000000000001 x22: ffff80001bf2bd68 x21: ffff80001188ded8 x20: ffff800000000000 x19: ffff000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200004c0 x14: ffff00003fffffff x13: ffff007fffffffff x12: ffff800010f882a8 x11: 0000000000face57 x10: 0000000000000001 x9 : 0000000000000000 x8 : ffff00100cece000 x7 : ffff001001c9f000 x6 : ffff00100ae40000 x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffff001fffff7000 x2 : ffff000000200000 x1 : ffff000040000000 x0 : ffff00100cecd000 Call trace: trans_pgd_create_copy+0x4ac/0x4f0 machine_kexec_post_load+0x94/0x3bc do_kexec_load+0x11c/0x2e0 __arm64_sys_kexec_load+0xa8/0xf4 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0x58/0x190 do_el0_svc+0x2c/0x90 el0_svc+0x28/0xe0 el0t_64_sync_handler+0xb0/0xb4 el0t_64_sync+0x180/0x184 Code: f90000c0 d5033a9f d5033fdf 17ffff7b (d4210000) ---[ end trace cc5461ffe1a085db ]--- Kernel panic - not syncing: Oops - BUG: Fatal exception This bug can be reproduced by a user case: void execute_kexec_load(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); *(uint64_t*)0x200004c0 = 0; *(uint64_t*)0x200004c8 = 0; *(uint64_t*)0x200004d0 = 0; *(uint64_t*)0x200004d8 = 0; syscall(__NR_kexec_load, 0ul, 1ul, 0x200004c0ul, 0ul); } And this patch make a simple change, just restoring init_mm for 'pmd_populate_kernel' in 'copy_pte'. Fixes: 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings") Reported-by: Abaci <abaci@linux.alibaba.com> Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> --- arch/arm64/mm/trans_pgd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c index d7da8ca40d2e..5275ca312360 100644 --- a/arch/arm64/mm/trans_pgd.c +++ b/arch/arm64/mm/trans_pgd.c @@ -67,7 +67,7 @@ static int copy_pte(struct trans_pgd_info *info, pmd_t *dst_pmdp, dst_ptep = trans_alloc(info); if (!dst_ptep) return -ENOMEM; - pmd_populate_kernel(NULL, dst_pmdp, dst_ptep); + pmd_populate_kernel(&init_mm, dst_pmdp, dst_ptep); dst_ptep = pte_offset_kernel(dst_pmdp, start); src_ptep = pte_offset_kernel(src_pmdp, start); -- 2.27.0 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply related [flat|nested] 28+ messages in thread
* Re: [PATCH v2 1/2] arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte() 2021-11-14 20:16 ` Rongwei Wang @ 2021-11-19 3:04 ` Rongwei Wang -1 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-11-19 3:04 UTC (permalink / raw) To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba, akpm, rppt, anshuman.khandual, kernelfans Cc: linux-arm-kernel, linux-kernel Hi Ard and Pingfan This bug I had fix and send out Patch v1 in 31 Oct. And it seems my patch had been ignored, and Pingfan's patch had been reviewed: This is link of Pingfan's patch: https://lore.kernel.org/linux-arm-kernel/20211111060316.12438-1-kernelfans@gmail.com/#r It seems that I am not subscribe linux-arm-kernel successfully. Thanks! On 11/15/21 4:16 AM, Rongwei Wang wrote: > In commit 5de59884ac0e ("arm64: trans_pgd: pass NULL instead > of init_mm to *_populate functions"), simply replace init_mm > with NULL for pmd_populate_kernel. But in commit 59511cfd08f3 > ("arm64: mm: use XN table mapping attributes for user/kernel > mappings"), adding the check of mm context in > pmd_populate_kernel. And these changes will cause a crash when > executing copy_pte/trans_pgd.c, as follows: > > kernel BUG at arch/arm64/include/asm/pgalloc.h:79! > Internal error: Oops - BUG: 0 [#1] SMP > Modules linked in: rfkill(E) aes_ce_blk(E) aes_ce_cipher(E) ... > CPU: 21 PID: 1617 Comm: a.out Kdump: loaded Tainted: ... 5.15.0-rc7-mm1+ #8 > Hardware name: ECS, BIOS 0.0.0 02/06/2015 > pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) > pc : trans_pgd_create_copy+0x4ac/0x4f0 > lr : trans_pgd_create_copy+0x34c/0x4f0 > sp : ffff80001bf2bc50 > x29: ffff80001bf2bc50 x28: ffff0010067f1000 x27: ffff800011072000 > x26: ffff001fffff8000 x25: ffff008000000000 x24: 0040000000000041 > x23: 0040000000000001 x22: ffff80001bf2bd68 x21: ffff80001188ded8 > x20: ffff800000000000 x19: ffff000000000000 x18: 0000000000000000 > x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200004c0 > x14: ffff00003fffffff x13: ffff007fffffffff x12: ffff800010f882a8 > x11: 0000000000face57 x10: 0000000000000001 x9 : 0000000000000000 > x8 : ffff00100cece000 x7 : ffff001001c9f000 x6 : ffff00100ae40000 > x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffff001fffff7000 > x2 : ffff000000200000 x1 : ffff000040000000 x0 : ffff00100cecd000 > Call trace: > trans_pgd_create_copy+0x4ac/0x4f0 > machine_kexec_post_load+0x94/0x3bc > do_kexec_load+0x11c/0x2e0 > __arm64_sys_kexec_load+0xa8/0xf4 > invoke_syscall+0x50/0x120 > el0_svc_common.constprop.0+0x58/0x190 > do_el0_svc+0x2c/0x90 > el0_svc+0x28/0xe0 > el0t_64_sync_handler+0xb0/0xb4 > el0t_64_sync+0x180/0x184 > Code: f90000c0 d5033a9f d5033fdf 17ffff7b (d4210000) > ---[ end trace cc5461ffe1a085db ]--- > Kernel panic - not syncing: Oops - BUG: Fatal exception > > This bug can be reproduced by a user case: > > void execute_kexec_load(void) > { > syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); > syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); > syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); > > *(uint64_t*)0x200004c0 = 0; > *(uint64_t*)0x200004c8 = 0; > *(uint64_t*)0x200004d0 = 0; > *(uint64_t*)0x200004d8 = 0; > syscall(__NR_kexec_load, 0ul, 1ul, 0x200004c0ul, 0ul); > } > > And this patch make a simple change, just restoring init_mm > for 'pmd_populate_kernel' in 'copy_pte'. > > Fixes: 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings") > Reported-by: Abaci <abaci@linux.alibaba.com> > Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> > --- > arch/arm64/mm/trans_pgd.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c > index d7da8ca40d2e..5275ca312360 100644 > --- a/arch/arm64/mm/trans_pgd.c > +++ b/arch/arm64/mm/trans_pgd.c > @@ -67,7 +67,7 @@ static int copy_pte(struct trans_pgd_info *info, pmd_t *dst_pmdp, > dst_ptep = trans_alloc(info); > if (!dst_ptep) > return -ENOMEM; > - pmd_populate_kernel(NULL, dst_pmdp, dst_ptep); > + pmd_populate_kernel(&init_mm, dst_pmdp, dst_ptep); > dst_ptep = pte_offset_kernel(dst_pmdp, start); > > src_ptep = pte_offset_kernel(src_pmdp, start); > ^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH v2 1/2] arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte() @ 2021-11-19 3:04 ` Rongwei Wang 0 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-11-19 3:04 UTC (permalink / raw) To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba, akpm, rppt, anshuman.khandual, kernelfans Cc: linux-arm-kernel, linux-kernel Hi Ard and Pingfan This bug I had fix and send out Patch v1 in 31 Oct. And it seems my patch had been ignored, and Pingfan's patch had been reviewed: This is link of Pingfan's patch: https://lore.kernel.org/linux-arm-kernel/20211111060316.12438-1-kernelfans@gmail.com/#r It seems that I am not subscribe linux-arm-kernel successfully. Thanks! On 11/15/21 4:16 AM, Rongwei Wang wrote: > In commit 5de59884ac0e ("arm64: trans_pgd: pass NULL instead > of init_mm to *_populate functions"), simply replace init_mm > with NULL for pmd_populate_kernel. But in commit 59511cfd08f3 > ("arm64: mm: use XN table mapping attributes for user/kernel > mappings"), adding the check of mm context in > pmd_populate_kernel. And these changes will cause a crash when > executing copy_pte/trans_pgd.c, as follows: > > kernel BUG at arch/arm64/include/asm/pgalloc.h:79! > Internal error: Oops - BUG: 0 [#1] SMP > Modules linked in: rfkill(E) aes_ce_blk(E) aes_ce_cipher(E) ... > CPU: 21 PID: 1617 Comm: a.out Kdump: loaded Tainted: ... 5.15.0-rc7-mm1+ #8 > Hardware name: ECS, BIOS 0.0.0 02/06/2015 > pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) > pc : trans_pgd_create_copy+0x4ac/0x4f0 > lr : trans_pgd_create_copy+0x34c/0x4f0 > sp : ffff80001bf2bc50 > x29: ffff80001bf2bc50 x28: ffff0010067f1000 x27: ffff800011072000 > x26: ffff001fffff8000 x25: ffff008000000000 x24: 0040000000000041 > x23: 0040000000000001 x22: ffff80001bf2bd68 x21: ffff80001188ded8 > x20: ffff800000000000 x19: ffff000000000000 x18: 0000000000000000 > x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200004c0 > x14: ffff00003fffffff x13: ffff007fffffffff x12: ffff800010f882a8 > x11: 0000000000face57 x10: 0000000000000001 x9 : 0000000000000000 > x8 : ffff00100cece000 x7 : ffff001001c9f000 x6 : ffff00100ae40000 > x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffff001fffff7000 > x2 : ffff000000200000 x1 : ffff000040000000 x0 : ffff00100cecd000 > Call trace: > trans_pgd_create_copy+0x4ac/0x4f0 > machine_kexec_post_load+0x94/0x3bc > do_kexec_load+0x11c/0x2e0 > __arm64_sys_kexec_load+0xa8/0xf4 > invoke_syscall+0x50/0x120 > el0_svc_common.constprop.0+0x58/0x190 > do_el0_svc+0x2c/0x90 > el0_svc+0x28/0xe0 > el0t_64_sync_handler+0xb0/0xb4 > el0t_64_sync+0x180/0x184 > Code: f90000c0 d5033a9f d5033fdf 17ffff7b (d4210000) > ---[ end trace cc5461ffe1a085db ]--- > Kernel panic - not syncing: Oops - BUG: Fatal exception > > This bug can be reproduced by a user case: > > void execute_kexec_load(void) > { > syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); > syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); > syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); > > *(uint64_t*)0x200004c0 = 0; > *(uint64_t*)0x200004c8 = 0; > *(uint64_t*)0x200004d0 = 0; > *(uint64_t*)0x200004d8 = 0; > syscall(__NR_kexec_load, 0ul, 1ul, 0x200004c0ul, 0ul); > } > > And this patch make a simple change, just restoring init_mm > for 'pmd_populate_kernel' in 'copy_pte'. > > Fixes: 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings") > Reported-by: Abaci <abaci@linux.alibaba.com> > Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> > --- > arch/arm64/mm/trans_pgd.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c > index d7da8ca40d2e..5275ca312360 100644 > --- a/arch/arm64/mm/trans_pgd.c > +++ b/arch/arm64/mm/trans_pgd.c > @@ -67,7 +67,7 @@ static int copy_pte(struct trans_pgd_info *info, pmd_t *dst_pmdp, > dst_ptep = trans_alloc(info); > if (!dst_ptep) > return -ENOMEM; > - pmd_populate_kernel(NULL, dst_pmdp, dst_ptep); > + pmd_populate_kernel(&init_mm, dst_pmdp, dst_ptep); > dst_ptep = pte_offset_kernel(dst_pmdp, start); > > src_ptep = pte_offset_kernel(src_pmdp, start); > _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH v2 2/2] arm64: kexec: reduce calls to page_address() 2021-11-14 20:16 ` Rongwei Wang @ 2021-11-14 20:16 ` Rongwei Wang -1 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-11-14 20:16 UTC (permalink / raw) To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba, akpm, rppt, anshuman.khandual Cc: linux-arm-kernel, linux-kernel In kexec_page_alloc(), page_address() is called twice. This patch add a new variable to help to reduce calls to page_address(). Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> --- arch/arm64/kernel/machine_kexec.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/machine_kexec.c b/arch/arm64/kernel/machine_kexec.c index 1038494135c8..7f2530bcd42e 100644 --- a/arch/arm64/kernel/machine_kexec.c +++ b/arch/arm64/kernel/machine_kexec.c @@ -104,13 +104,15 @@ static void *kexec_page_alloc(void *arg) { struct kimage *kimage = (struct kimage *)arg; struct page *page = kimage_alloc_control_pages(kimage, 0); + void *vaddr = NULL; if (!page) return NULL; - memset(page_address(page), 0, PAGE_SIZE); + vaddr = page_address(page); + memset(vaddr, 0, PAGE_SIZE); - return page_address(page); + return vaddr; } int machine_kexec_post_load(struct kimage *kimage) -- 2.27.0 ^ permalink raw reply related [flat|nested] 28+ messages in thread
* [PATCH v2 2/2] arm64: kexec: reduce calls to page_address() @ 2021-11-14 20:16 ` Rongwei Wang 0 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-11-14 20:16 UTC (permalink / raw) To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba, akpm, rppt, anshuman.khandual Cc: linux-arm-kernel, linux-kernel In kexec_page_alloc(), page_address() is called twice. This patch add a new variable to help to reduce calls to page_address(). Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> --- arch/arm64/kernel/machine_kexec.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/machine_kexec.c b/arch/arm64/kernel/machine_kexec.c index 1038494135c8..7f2530bcd42e 100644 --- a/arch/arm64/kernel/machine_kexec.c +++ b/arch/arm64/kernel/machine_kexec.c @@ -104,13 +104,15 @@ static void *kexec_page_alloc(void *arg) { struct kimage *kimage = (struct kimage *)arg; struct page *page = kimage_alloc_control_pages(kimage, 0); + void *vaddr = NULL; if (!page) return NULL; - memset(page_address(page), 0, PAGE_SIZE); + vaddr = page_address(page); + memset(vaddr, 0, PAGE_SIZE); - return page_address(page); + return vaddr; } int machine_kexec_post_load(struct kimage *kimage) -- 2.27.0 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply related [flat|nested] 28+ messages in thread
* [PATCH v3 0/2] simple optimizations for page_address and 2021-10-30 18:31 ` Rongwei Wang @ 2021-11-25 17:05 ` Rongwei Wang -1 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-11-25 17:05 UTC (permalink / raw) To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba, akpm, rppt, anshuman.khandual, pasha.tatashin Cc: linux-arm-kernel, linux-kernel Hello Patch 1/2 mainly to fix the bug when calling kexec_load() originally, but because of ignored and link[1] also fixed this bug and had been applied to arm64 (for-next/fixes) before us. Anyway, It's nice to unify the use of 'pmd_populate_kernel' under arm64. Patch 2/2 just make a very simple optimization, reducing calls to page_address() in kexec_page_alloc(). v2 -> v3: - Patch "arm64: trans_pgd: unify the use of pmd_populate_kernel" rename this patch. v1 -> v2: - Patch " arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte()" restore the usage of pmd_populate_kernel. link1: https://lore.kernel.org/linux-arm-kernel/20211111060316.12438-1-kernelfans@gmail.com/ v1: https://lore.kernel.org/linux-arm-kernel/20211030183200.51295-1-rongwei.wang@linux.alibaba.com/ v2: https://lore.kernel.org/linux-arm-kernel/20211114201650.5542-1-rongwei.wang@linux.alibaba.com/ Rongwei Wang (2): arm64: trans_pgd: unify the use of pmd_populate_kernel arm64: kexec: reduce calls to page_address() arch/arm64/kernel/machine_kexec.c | 6 ++++-- arch/arm64/mm/trans_pgd.c | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) -- 1.8.3.1 ^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH v3 0/2] simple optimizations for page_address and @ 2021-11-25 17:05 ` Rongwei Wang 0 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-11-25 17:05 UTC (permalink / raw) To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba, akpm, rppt, anshuman.khandual, pasha.tatashin Cc: linux-arm-kernel, linux-kernel Hello Patch 1/2 mainly to fix the bug when calling kexec_load() originally, but because of ignored and link[1] also fixed this bug and had been applied to arm64 (for-next/fixes) before us. Anyway, It's nice to unify the use of 'pmd_populate_kernel' under arm64. Patch 2/2 just make a very simple optimization, reducing calls to page_address() in kexec_page_alloc(). v2 -> v3: - Patch "arm64: trans_pgd: unify the use of pmd_populate_kernel" rename this patch. v1 -> v2: - Patch " arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte()" restore the usage of pmd_populate_kernel. link1: https://lore.kernel.org/linux-arm-kernel/20211111060316.12438-1-kernelfans@gmail.com/ v1: https://lore.kernel.org/linux-arm-kernel/20211030183200.51295-1-rongwei.wang@linux.alibaba.com/ v2: https://lore.kernel.org/linux-arm-kernel/20211114201650.5542-1-rongwei.wang@linux.alibaba.com/ Rongwei Wang (2): arm64: trans_pgd: unify the use of pmd_populate_kernel arm64: kexec: reduce calls to page_address() arch/arm64/kernel/machine_kexec.c | 6 ++++-- arch/arm64/mm/trans_pgd.c | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) -- 1.8.3.1 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH v3 1/2] arm64: trans_pgd: unify the use of pmd_populate_kernel 2021-11-25 17:05 ` Rongwei Wang @ 2021-11-25 17:05 ` Rongwei Wang -1 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-11-25 17:05 UTC (permalink / raw) To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba, akpm, rppt, anshuman.khandual, pasha.tatashin Cc: linux-arm-kernel, linux-kernel In commit 5de59884ac0e ("arm64: trans_pgd: pass NULL instead of init_mm to *_populate functions"), simply replace init_mm with NULL for pmd_populate_kernel. But in commit 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings"), adding the check of mm context in 'pmd_populate_kernel'. And 'pmd_populate_kernel' always called with init_mm under arm64, nice to unify its use. This patch make a simple change, just restoring init_mm for 'pmd_populate_kernel' in 'copy_pte'. Suggested-by: Abaci <abaci@linux.alibaba.com> Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> --- arch/arm64/mm/trans_pgd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c index d7da8ca..5275ca3 100644 --- a/arch/arm64/mm/trans_pgd.c +++ b/arch/arm64/mm/trans_pgd.c @@ -67,7 +67,7 @@ static int copy_pte(struct trans_pgd_info *info, pmd_t *dst_pmdp, dst_ptep = trans_alloc(info); if (!dst_ptep) return -ENOMEM; - pmd_populate_kernel(NULL, dst_pmdp, dst_ptep); + pmd_populate_kernel(&init_mm, dst_pmdp, dst_ptep); dst_ptep = pte_offset_kernel(dst_pmdp, start); src_ptep = pte_offset_kernel(src_pmdp, start); -- 1.8.3.1 ^ permalink raw reply related [flat|nested] 28+ messages in thread
* [PATCH v3 1/2] arm64: trans_pgd: unify the use of pmd_populate_kernel @ 2021-11-25 17:05 ` Rongwei Wang 0 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-11-25 17:05 UTC (permalink / raw) To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba, akpm, rppt, anshuman.khandual, pasha.tatashin Cc: linux-arm-kernel, linux-kernel In commit 5de59884ac0e ("arm64: trans_pgd: pass NULL instead of init_mm to *_populate functions"), simply replace init_mm with NULL for pmd_populate_kernel. But in commit 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings"), adding the check of mm context in 'pmd_populate_kernel'. And 'pmd_populate_kernel' always called with init_mm under arm64, nice to unify its use. This patch make a simple change, just restoring init_mm for 'pmd_populate_kernel' in 'copy_pte'. Suggested-by: Abaci <abaci@linux.alibaba.com> Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> --- arch/arm64/mm/trans_pgd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c index d7da8ca..5275ca3 100644 --- a/arch/arm64/mm/trans_pgd.c +++ b/arch/arm64/mm/trans_pgd.c @@ -67,7 +67,7 @@ static int copy_pte(struct trans_pgd_info *info, pmd_t *dst_pmdp, dst_ptep = trans_alloc(info); if (!dst_ptep) return -ENOMEM; - pmd_populate_kernel(NULL, dst_pmdp, dst_ptep); + pmd_populate_kernel(&init_mm, dst_pmdp, dst_ptep); dst_ptep = pte_offset_kernel(dst_pmdp, start); src_ptep = pte_offset_kernel(src_pmdp, start); -- 1.8.3.1 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply related [flat|nested] 28+ messages in thread
* [PATCH v3 2/2] arm64: kexec: reduce calls to page_address() 2021-11-25 17:05 ` Rongwei Wang @ 2021-11-25 17:06 ` Rongwei Wang -1 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-11-25 17:06 UTC (permalink / raw) To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba, akpm, rppt, anshuman.khandual, pasha.tatashin Cc: linux-arm-kernel, linux-kernel In kexec_page_alloc(), page_address() is called twice. This patch add a new variable to help to reduce calls to page_address(). Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> --- arch/arm64/kernel/machine_kexec.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/machine_kexec.c b/arch/arm64/kernel/machine_kexec.c index 1038494..7f2530b 100644 --- a/arch/arm64/kernel/machine_kexec.c +++ b/arch/arm64/kernel/machine_kexec.c @@ -104,13 +104,15 @@ static void *kexec_page_alloc(void *arg) { struct kimage *kimage = (struct kimage *)arg; struct page *page = kimage_alloc_control_pages(kimage, 0); + void *vaddr = NULL; if (!page) return NULL; - memset(page_address(page), 0, PAGE_SIZE); + vaddr = page_address(page); + memset(vaddr, 0, PAGE_SIZE); - return page_address(page); + return vaddr; } int machine_kexec_post_load(struct kimage *kimage) -- 1.8.3.1 ^ permalink raw reply related [flat|nested] 28+ messages in thread
* [PATCH v3 2/2] arm64: kexec: reduce calls to page_address() @ 2021-11-25 17:06 ` Rongwei Wang 0 siblings, 0 replies; 28+ messages in thread From: Rongwei Wang @ 2021-11-25 17:06 UTC (permalink / raw) To: catalin.marinas, will, mark.rutland, james.morse, ardb, tabba, akpm, rppt, anshuman.khandual, pasha.tatashin Cc: linux-arm-kernel, linux-kernel In kexec_page_alloc(), page_address() is called twice. This patch add a new variable to help to reduce calls to page_address(). Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com> --- arch/arm64/kernel/machine_kexec.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/machine_kexec.c b/arch/arm64/kernel/machine_kexec.c index 1038494..7f2530b 100644 --- a/arch/arm64/kernel/machine_kexec.c +++ b/arch/arm64/kernel/machine_kexec.c @@ -104,13 +104,15 @@ static void *kexec_page_alloc(void *arg) { struct kimage *kimage = (struct kimage *)arg; struct page *page = kimage_alloc_control_pages(kimage, 0); + void *vaddr = NULL; if (!page) return NULL; - memset(page_address(page), 0, PAGE_SIZE); + vaddr = page_address(page); + memset(vaddr, 0, PAGE_SIZE); - return page_address(page); + return vaddr; } int machine_kexec_post_load(struct kimage *kimage) -- 1.8.3.1 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply related [flat|nested] 28+ messages in thread
* Re: (subset) [PATCH v3 0/2] simple optimizations for page_address and 2021-11-25 17:05 ` Rongwei Wang @ 2021-12-10 18:40 ` Catalin Marinas -1 siblings, 0 replies; 28+ messages in thread From: Catalin Marinas @ 2021-12-10 18:40 UTC (permalink / raw) To: rppt, mark.rutland, james.morse, anshuman.khandual, will, akpm, Rongwei Wang, ardb, pasha.tatashin, tabba Cc: linux-arm-kernel, linux-kernel On Fri, 26 Nov 2021 01:05:58 +0800, Rongwei Wang wrote: > Patch 1/2 mainly to fix the bug when calling kexec_load() originally, but > because of ignored and link[1] also fixed this bug and had been applied > to arm64 (for-next/fixes) before us. Anyway, It's nice to unify the use of > 'pmd_populate_kernel' under arm64. > > Patch 2/2 just make a very simple optimization, reducing > calls to page_address() in kexec_page_alloc(). > > [...] Applied to arm64 (for-next/misc), thanks! [2/2] arm64: kexec: reduce calls to page_address() https://git.kernel.org/arm64/c/7afccde389dc -- Catalin ^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: (subset) [PATCH v3 0/2] simple optimizations for page_address and @ 2021-12-10 18:40 ` Catalin Marinas 0 siblings, 0 replies; 28+ messages in thread From: Catalin Marinas @ 2021-12-10 18:40 UTC (permalink / raw) To: rppt, mark.rutland, james.morse, anshuman.khandual, will, akpm, Rongwei Wang, ardb, pasha.tatashin, tabba Cc: linux-arm-kernel, linux-kernel On Fri, 26 Nov 2021 01:05:58 +0800, Rongwei Wang wrote: > Patch 1/2 mainly to fix the bug when calling kexec_load() originally, but > because of ignored and link[1] also fixed this bug and had been applied > to arm64 (for-next/fixes) before us. Anyway, It's nice to unify the use of > 'pmd_populate_kernel' under arm64. > > Patch 2/2 just make a very simple optimization, reducing > calls to page_address() in kexec_page_alloc(). > > [...] Applied to arm64 (for-next/misc), thanks! [2/2] arm64: kexec: reduce calls to page_address() https://git.kernel.org/arm64/c/7afccde389dc -- Catalin _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply [flat|nested] 28+ messages in thread
end of thread, other threads:[~2021-12-10 18:42 UTC | newest] Thread overview: 28+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2021-10-30 18:31 [PATCH 0/2] fix bug when calling kexec_load() Rongwei Wang 2021-10-30 18:31 ` Rongwei Wang 2021-10-30 18:31 ` [PATCH 1/2] arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte() Rongwei Wang 2021-10-30 18:31 ` Rongwei Wang 2021-10-31 12:25 ` Ard Biesheuvel 2021-10-31 12:25 ` Ard Biesheuvel 2021-11-01 2:14 ` Rongwei Wang 2021-11-01 2:14 ` Rongwei Wang 2021-11-05 5:58 ` Rongwei Wang 2021-11-05 5:58 ` Rongwei Wang 2021-10-30 18:32 ` [PATCH 2/2] arm64: kexec: reduce calls to page_address() Rongwei Wang 2021-10-30 18:32 ` Rongwei Wang 2021-11-14 20:16 ` [PATCH v2 0/2] fix bug when calling kexec_load() Rongwei Wang 2021-11-14 20:16 ` Rongwei Wang 2021-11-14 20:16 ` [PATCH v2 1/2] arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte() Rongwei Wang 2021-11-14 20:16 ` Rongwei Wang 2021-11-19 3:04 ` Rongwei Wang 2021-11-19 3:04 ` Rongwei Wang 2021-11-14 20:16 ` [PATCH v2 2/2] arm64: kexec: reduce calls to page_address() Rongwei Wang 2021-11-14 20:16 ` Rongwei Wang 2021-11-25 17:05 ` [PATCH v3 0/2] simple optimizations for page_address and Rongwei Wang 2021-11-25 17:05 ` Rongwei Wang 2021-11-25 17:05 ` [PATCH v3 1/2] arm64: trans_pgd: unify the use of pmd_populate_kernel Rongwei Wang 2021-11-25 17:05 ` Rongwei Wang 2021-11-25 17:06 ` [PATCH v3 2/2] arm64: kexec: reduce calls to page_address() Rongwei Wang 2021-11-25 17:06 ` Rongwei Wang 2021-12-10 18:40 ` (subset) [PATCH v3 0/2] simple optimizations for page_address and Catalin Marinas 2021-12-10 18:40 ` Catalin Marinas
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.