From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758500AbdCVEi2 (ORCPT ); Wed, 22 Mar 2017 00:38:28 -0400 Received: from mail.kernel.org ([198.145.29.136]:48634 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750908AbdCVEhm (ORCPT ); Wed, 22 Mar 2017 00:37:42 -0400 MIME-Version: 1.0 In-Reply-To: References: <20170321045713.GE23490@yexl-desktop> From: Andy Lutomirski Date: Tue, 21 Mar 2017 21:27:55 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [lkp-robot] [x86] 69218e4799: BUG:kernel_hang_in_boot_stage To: Thomas Garnier Cc: Andy Lutomirski , Linus Torvalds , kernel test robot , Ingo Molnar , Alexander Potapenko , Andrew Morton , Andrey Ryabinin , Ard Biesheuvel , Boris Ostrovsky , Borislav Petkov , Chris Wilson , Christian Borntraeger , Dmitry Vyukov , Frederic Weisbecker , Jiri Kosina , Joerg Roedel , Jonathan Corbet , Josh Poimboeuf , Juergen Gross , Kees Cook , Len Brown , Lorenzo Stoakes , "Luis R . Rodriguez" , Matt Fleming , Michal Hocko , Paolo Bonzini , Paul Gortmaker , Pavel Machek , Peter Zijlstra , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , "Rafael J . Wysocki" , Rusty Russell , Stanislaw Gruszka , Thomas Gleixner , Tim Chen , Vitaly Kuznetsov , zijun_hu , LKML , Stephen Rothwell , LKP Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Mar 21, 2017 at 5:41 PM, Thomas Garnier wrote: > On Tue, Mar 21, 2017 at 4:51 PM, Andy Lutomirski wrote: >> On Tue, Mar 21, 2017 at 3:32 PM, Andy Lutomirski wrote: >>> On Tue, Mar 21, 2017 at 2:11 PM, Linus Torvalds >>> wrote: >>>> On Tue, Mar 21, 2017 at 1:25 PM, Thomas Garnier wrote: >>>>> The issue seems to be related to exceptions happening in close pages >>>>> to the fixmap GDT remapping. >>>>> >>>>> The original page fault happen in do_test_wp_bit which set a fixmap >>>>> entry to test WP flag. If I grow the number of processors supported >>>>> increasing the distance between the remapped GDT page and the WP test >>>>> page, the error does not reproduce. >>>>> >>>>> I am still looking at the exact distance between repro and no-repro as >>>>> well as the exact root cause. >>>> >>>> Hmm. Have we set the GDT limit incorrectly, somehow? The GDT *can* >>>> cover 8k entries, which at 8 bytes each would be 64kB. >>> >>> The QEMU barf says the GDT limit is 0xff, for better or for worse. >>> >>>> >>>> So somebody trying to load an invalid segment (say, 0xffff) might end >>>> up causing an access to the GDT base + 64k - 8. >>>> >>>> It is also possible that the CPU might do a page table writability >>>> check *before* it does the limit check. That would sound odd, though. >>>> Might be a CPU errata. >>>> >>> >> >>> There's presumably something genuinely wrong with our GDT. >> >> This is suspicious. I added this code in test_wp_bit: >> >> if (memcmp(get_current_gdt_ro(), get_current_gdt_rw(), 4096) != 0) { >> pr_err("Oh crap\n"); >> BUG_ON(1); >> } >> >> It printed "Oh crap" and blew up. Methinks something's wrong with the >> fixmap. Is it possible that we're crossing a PMD boundary and failing >> to translate the addresses right? > > I might be that. We crash when the PKMAP_BASE is just after the FIX_WP_TEST. > > I will continue testing couple scenarios and design a fix. Moving the > GDT FIXMAP at the beginning or align the base (or pad the end). > Talk about barking up the wrong tree... diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index f8e22dbad86c..c564f62c7a8d 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -462,7 +464,8 @@ pgprot_t pg_fixmap_gdt_flags = PAGE_KERNEL; static inline void setup_fixmap_gdt(int cpu) { __set_fixmap(get_cpu_gdt_ro_index(cpu), - __pa(get_cpu_gdt_rw(cpu)), pg_fixmap_gdt_flags); + slow_virt_to_phys(get_cpu_gdt_rw(cpu)), + pg_fixmap_gdt_flags); } /* Load the original GDT from the per-cpu structure */ This makes UP boot for me, but SMP (2 cpus) is still busted. From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: multipart/mixed; boundary="===============7683416781708900370==" MIME-Version: 1.0 From: Andy Lutomirski To: lkp@lists.01.org Subject: Re: [lkp-robot] [x86] 69218e4799: BUG:kernel_hang_in_boot_stage Date: Tue, 21 Mar 2017 21:27:55 -0700 Message-ID: In-Reply-To: List-Id: --===============7683416781708900370== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Tue, Mar 21, 2017 at 5:41 PM, Thomas Garnier wro= te: > On Tue, Mar 21, 2017 at 4:51 PM, Andy Lutomirski wrot= e: >> On Tue, Mar 21, 2017 at 3:32 PM, Andy Lutomirski = wrote: >>> On Tue, Mar 21, 2017 at 2:11 PM, Linus Torvalds >>> wrote: >>>> On Tue, Mar 21, 2017 at 1:25 PM, Thomas Garnier wrote: >>>>> The issue seems to be related to exceptions happening in close pages >>>>> to the fixmap GDT remapping. >>>>> >>>>> The original page fault happen in do_test_wp_bit which set a fixmap >>>>> entry to test WP flag. If I grow the number of processors supported >>>>> increasing the distance between the remapped GDT page and the WP test >>>>> page, the error does not reproduce. >>>>> >>>>> I am still looking at the exact distance between repro and no-repro as >>>>> well as the exact root cause. >>>> >>>> Hmm. Have we set the GDT limit incorrectly, somehow? The GDT *can* >>>> cover 8k entries, which at 8 bytes each would be 64kB. >>> >>> The QEMU barf says the GDT limit is 0xff, for better or for worse. >>> >>>> >>>> So somebody trying to load an invalid segment (say, 0xffff) might end >>>> up causing an access to the GDT base + 64k - 8. >>>> >>>> It is also possible that the CPU might do a page table writability >>>> check *before* it does the limit check. That would sound odd, though. >>>> Might be a CPU errata. >>>> >>> >> >>> There's presumably something genuinely wrong with our GDT. >> >> This is suspicious. I added this code in test_wp_bit: >> >> if (memcmp(get_current_gdt_ro(), get_current_gdt_rw(), 4096) !=3D 0)= { >> pr_err("Oh crap\n"); >> BUG_ON(1); >> } >> >> It printed "Oh crap" and blew up. Methinks something's wrong with the >> fixmap. Is it possible that we're crossing a PMD boundary and failing >> to translate the addresses right? > > I might be that. We crash when the PKMAP_BASE is just after the FIX_WP_TE= ST. > > I will continue testing couple scenarios and design a fix. Moving the > GDT FIXMAP at the beginning or align the base (or pad the end). > Talk about barking up the wrong tree... diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index f8e22dbad86c..c564f62c7a8d 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -462,7 +464,8 @@ pgprot_t pg_fixmap_gdt_flags =3D PAGE_KERNEL; static inline void setup_fixmap_gdt(int cpu) { __set_fixmap(get_cpu_gdt_ro_index(cpu), - __pa(get_cpu_gdt_rw(cpu)), pg_fixmap_gdt_flags); + slow_virt_to_phys(get_cpu_gdt_rw(cpu)), + pg_fixmap_gdt_flags); } /* Load the original GDT from the per-cpu structure */ This makes UP boot for me, but SMP (2 cpus) is still busted. --===============7683416781708900370==--