From: Ard Biesheuvel <ardb@kernel.org>
To: Florian Fainelli <f.fainelli@gmail.com>
Cc: Arnd Bergmann <arnd@arndb.de>,
Abbott Liu <liuwenliang@huawei.com>,
Linus Walleij <linus.walleij@linaro.org>,
Russell King <linux@armlinux.org.uk>,
Mike Rapoport <rppt@linux.ibm.com>,
Andrey Ryabinin <aryabinin@virtuozzo.com>,
Linux ARM <linux-arm-kernel@lists.infradead.org>
Subject: Re: [PATCH 0/6 v14] KASan for Arm
Date: Sat, 3 Oct 2020 17:50:28 +0200 [thread overview]
Message-ID: <CAMj1kXFcnQdm0bnuLEhDTW=WBgkTLu0BDd2C3uN3AtMt+AUinw@mail.gmail.com> (raw)
In-Reply-To: <39a52fa8-4297-0072-755f-8c904227f12d@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 1644 bytes --]
On Thu, 1 Oct 2020 at 21:19, Florian Fainelli <f.fainelli@gmail.com> wrote:
>
>
>
> On 10/1/2020 8:22 AM, Linus Walleij wrote:
> > This is the 14th iteration of KASan for ARM/Aarch32.
> >
> > I have added one patch in the beginning of the series to
> > fix the issue when the DTB (often attached DTB) ends up
> > in lowmem. It also amends ARM to copy the device tree
> > instead of just unflattening it and using it from where
> > it is.
> >
> > This fixes my particular issue on the Qualcomm APQ8060
> > and I hope it may also solve Florian's issue and what
> > Ard has been seeing. If you inspect patch 1/6 you can
> > see what has been going on for me. My hypothesis about
> > what was going on was mostly right.
> >
> > You are encouraged to test this patch set to find memory out
> > of bounds bugs with ARM32 platforms and drivers.
> >
> > There is a git branch you can pull in:
> > https://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-integrator.git/log/?h=kasan
>
> It does appear to be slight better, although all platforms that I have
> where memory starts at physical address 0 cannot boot, attached logs
> which are all more or less the same.
>
> The physical memory map looks like this:
>
> 0..3GB -> DRAM
> 3GB..4GB -> Registers, Boot ROM, Boot SRAM
> 4GB..12GB -> DRAM extension
>
> Do any of the platforms you use for testing have a similar memory map?
> Could you try to contrive a QEMU machine to have something similar in
> case that helps reproducing these failures?
>
I am getting very similar failures on a Raspberry Pi4 booting in
32-bit mode from U-boot+EFI
Full log attached.
I will try to dig a bit deeper.
[-- Attachment #2: screen-exchange --]
[-- Type: application/octet-stream, Size: 13476 bytes --]
Initialising SDRAM 'Micron' 16Gb x2 total-size: 32 Gbit 3200
Loading recovery.elf hnd: 0x00000000
Failed to read recovery.elf error: 6
Loading start4.elf hnd: 0x00000206
Loading fixup4.dat hnd: 0x00000202
MEM GPU: 76 ARM: 948 TOTAL: 1024
FIXUP src: 128 256 dst: 948 1024
Starting start4.elf @ 0xfec00200
INFO: BL33 will boot in Non-secure AArch32 Hypervisor mode
NOTICE: BL31: v2.3(debug):v2.3-140-g967a6d162d9d
NOTICE: BL31: Built : 17:26:28, Jun 11 2020
INFO: Changed device tree to advertise PSCI.
INFO: ARM GICv2 driver initialized
INFO: BL31: Initializing runtime services
INFO: BL31: cortex_a72: CPU workaround for 859971 was applied
INFO: BL31: cortex_a72: CPU workaround for cve_2017_5715 was applied
INFO: BL31: cortex_a72: CPU workaround for cve_2018_3639 was applied
INFO: BL31: Preparing for EL3 exit to normal world
INFO: Entry point address = 0x20000
INFO: SPSR = 0x1da
U-Boot 2020.07-rc4-00027-g7f3689f236cd (Jun 11 2020 - 18:07:34 +0200)
DRAM: 3.9 GiB
RPI 4 Model B (0xc03111)
MMC: mmcnr@7e300000: 1, emmc2@7e340000: 0
Loading Environment from FAT... OK
In: serial
Out: serial
Err: serial
Net: eth0: ethernet@7d580000
Hit any key to stop autoboot: 0
U-Boot> setenv bootargs earlycon efi=debug
U-Boot> boot
ERROR: reserving fdt memory region failed (addr=0 size=80000)
15188480 bytes read in 838 ms (17.3 MiB/s)
Card did not respond to voltage select!
Scanning disk mmcnr@7e300000.blk...
Disk mmcnr@7e300000.blk not ready
Scanning disk emmc2@7e340000.blk...
Found 2 disks
EFI stub: Entering in HYP mode with MMU enabled
EFI stub: Booting Linux Kernel...
EFI stub: ERROR: Could not determine UEFI Secure Boot status.
EFI stub: Using DTB from configuration table
EFI stub: Exiting boot services and installing virtual address map...
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 5.9.0-rc7+ (ard@gambale) (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0, GNU ld (GNU Binutils for Debian) 2.31.1) #186 SMP PREEMPT Sat Oct 3 17:41:42 CEST 2020
[ 0.000000] CPU: ARMv7 Processor [410fd083] revision 3 (ARMv7), cr=70c5383d
[ 0.000000] CPU: div instructions available: patching division code
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[ 0.000000] OF: fdt: Machine model: Raspberry Pi 4 Model B Rev 1.1
[ 0.000000] earlycon: pl11 at MMIO 0x00000000fe201000 (options '')
[ 0.000000] printk: bootconsole [pl11] enabled
[ 0.000000] Memory policy: Data cache writealloc
[ 0.000000] efi: Getting UEFI parameters from /chosen in DT:
[ 0.000000] efi: System Table : 0x3b36c890
[ 0.000000] efi: MemMap Address : 0x00000000390c3040
[ 0.000000] efi: MemMap Size : 0x000003c0
[ 0.000000] efi: MemMap Desc. Size : 0x00000028
[ 0.000000] efi: MemMap Desc. Version : 0x00000001
[ 0.000000] efi: EFI v2.80 by Das U-Boot
[ 0.000000] efi: RTPROP=0x39f52040 SMBIOS=0x39f4c000 MEMRESERVE=0x390c6040
[ 0.000000] efi: Processing EFI memory map:
[ 0.000000] efi: 0x000000000000-0x000000000fff [Reserved | | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x000000001000-0x000000202fff [Conventional Memory| | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x000000203000-0x000002202fff [Boot Data | | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x000002203000-0x000007cfffff [Conventional Memory| | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x000007d00000-0x000007efffff [Loader Data | | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x000007f00000-0x000007f0efff [ACPI Reclaim Memory| | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x000007f0f000-0x0000390c2fff [Conventional Memory| | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x0000390c3000-0x0000390c8fff [Loader Data | | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x0000390c9000-0x000039f46fff [Loader Code | | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x000039f47000-0x000039f4afff [Reserved | | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x000039f4b000-0x000039f4bfff [Boot Data | | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x000039f4c000-0x000039f4cfff [Runtime Data |RUN| | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x000039f4d000-0x000039f4efff [Boot Data | | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x000039f4f000-0x000039f4ffff [Reserved | | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x000039f50000-0x000039f51fff [Boot Data | | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x000039f52000-0x000039f53fff [Runtime Data |RUN| | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x000039f54000-0x000039f54fff [Reserved | | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x000039f55000-0x000039f56fff [Boot Data | | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x000039f57000-0x000039f5afff [Reserved | | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x000039f5b000-0x00003b36bfff [Loader Data | | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x00003b36c000-0x00003b36cfff [Runtime Code |RUN| | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x00003b36d000-0x00003b3fffff [Loader Data | | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x000040000000-0x0000fbffffff [Boot Data | | | | | | | | | |WB| | | ]
[ 0.000000] efi: 0x0000fe100000-0x0000fe100fff [Memory Mapped I/O |RUN| | | | | | | | | | | | ]
[ 0.000000] efi: CPSR at EFI stub entry : 0x600001da
[ 0.000000] efi: SCTLR at EFI stub entry : 0x30c51835
[ 0.000000] efi: CPSR after ExitBootServices() : 0x600001da
[ 0.000000] efi: SCTLR after ExitBootServices(): 0x30c51835
[ 0.000000] Reserved memory: created CMA memory pool at 0x000000002c000000, size 64 MiB
[ 0.000000] OF: reserved mem: initialized node linux,cma, compatible id shared-dma-pool
[ 0.000000] ATAGs/DTB found in lowmem, skip clearing PMD @0xc7c00000
[ 0.000000] ATAGs/DTB found in lowmem, skip clearing PMD @0xc7e00000
[ 0.000000] Zone ranges:
[ 0.000000] DMA [mem 0x0000000000080000-0x000000002fffffff]
[ 0.000000] Normal empty
[ 0.000000] HighMem [mem 0x0000000030000000-0x00000000fbffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000080000-0x00000000001fffff]
[ 0.000000] node 0: [mem 0x0000000000200000-0x0000000039f46fff]
[ 0.000000] node 0: [mem 0x0000000039f47000-0x0000000039f4afff]
[ 0.000000] node 0: [mem 0x0000000039f4b000-0x0000000039f4bfff]
[ 0.000000] node 0: [mem 0x0000000039f4c000-0x0000000039f4cfff]
[ 0.000000] node 0: [mem 0x0000000039f4d000-0x0000000039f4efff]
[ 0.000000] node 0: [mem 0x0000000039f4f000-0x0000000039f4ffff]
[ 0.000000] node 0: [mem 0x0000000039f50000-0x0000000039f51fff]
[ 0.000000] node 0: [mem 0x0000000039f52000-0x0000000039f54fff]
[ 0.000000] node 0: [mem 0x0000000039f55000-0x0000000039f56fff]
[ 0.000000] node 0: [mem 0x0000000039f57000-0x0000000039f5afff]
[ 0.000000] node 0: [mem 0x0000000039f5b000-0x000000003b36bfff]
[ 0.000000] node 0: [mem 0x000000003b36c000-0x000000003b36cfff]
[ 0.000000] node 0: [mem 0x000000003b36d000-0x000000003b3fffff]
[ 0.000000] node 0: [mem 0x0000000040000000-0x00000000fbffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000080000-0x00000000fbffffff]
[ 0.000000] kasan: Mapping kernel virtual memory block: c0080000-c0200000 at shadow: b7010000-b7040000
[ 0.000000] kasan: Truncate memory block c0200000-f9f47000
[ 0.000000] to c0200000-f0000000
[ 0.000000] kasan: Mapping kernel virtual memory block: c0200000-f0000000 at shadow: b7040000-bd000000
[ 0.000000] 8<--- cut here ---
[ 0.000000] Unable to handle kernel paging request at virtual address bc1ffe00
[ 0.000000] pgd = (ptrval)
[ 0.000000] [bc1ffe00] *pgd=80000000206003, *pmd=00000000
[ 0.000000] Internal error: Oops: 206 [#1] PREEMPT SMP THUMB2
[ 0.000000] Modules linked in:
[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.9.0-rc7+ #186
[ 0.000000] Hardware name: BCM2711
[ 0.000000] PC is at check_memory_region+0x3e/0x12c
[ 0.000000] LR is at 0xbc1fffff
[ 0.000000] pc : [<c05c57ce>] lr : [<bc1fffff>] psr: 000000f3
[ 0.000000] sp : c2403be8 ip : e8ffffff fp : 00000000
[ 0.000000] r10: ffffffff r9 : ffffffff r8 : bc200000
[ 0.000000] r7 : 00001000 r6 : 00000000 r5 : 00000040 r4 : bc1ffe00
[ 0.000000] r3 : c22244d3 r2 : 00000001 r1 : 00001000 r0 : e8fff000
[ 0.000000] Flags: nzcv IRQs off FIQs off Mode SVC_32 ISA Thumb Segment user
[ 0.000000] Control: 70c5383d Table: 022d5140 DAC: ffffffff
[ 0.000000] Process swapper (pid: 0, stack limit = 0x(ptrval))
[ 0.000000] Stack: (0xc2403be8 to 0xc2404000)
[ 0.000000] 3be0: 00001000 e8fff000 00000000 00001000 e8fff000 ffffffff
[ 0.000000] 3c00: ffffffff c05c41eb b7480788 00000000 c2400000 c22244d3 40000000 ffffffff
[ 0.000000] 3c20: 00000001 00000000 ffffffff 00000000 80000000 00000050 00000000 c121f723
[ 0.000000] 3c40: 41b58ab3 c1f94398 c22243f0 00000000 00000050 c04a6225 00000400 00000006
[ 0.000000] 3c60: 40000000 ffffffff 00000000 00000000 c2cb4a28 600000d3 c247d8a0 ffffc000
[ 0.000000] 3c80: 00000000 c2406cf8 c2400000 c2cb1560 c2406d70 c2400000 0000005a 00000002
[ 0.000000] 3ca0: 00000001 00000000 00000001 c04a753b c1f76e94 c2403d8c 00000050 00000000
[ 0.000000] 3cc0: 00000001 b74807a0 c2400000 c04a7c40 c1f76f08 c24c71a0 39f47000 00000000
[ 0.000000] 3ce0: c1f76f3c c04a75eb c1f76e94 00000000 39f47000 00000001 00000000 40000000
[ 0.000000] 3d00: ffffffff e9083418 c2416cf8 c0206de8 c2074084 c2209eed 40000000 ffffffff
[ 0.000000] 3d20: 00000001 00000000 ffffffff 00000000 00000000 b7883000 2900071f b7a00000
[ 0.000000] 3d40: c2ca5a38 c220a02b 2900071f 00c00000 c1f76f3c bd000000 00000000 c24c6f40
[ 0.000000] 3d60: c2ca1000 c0203010 00002ca3 bd000000 bd100000 bd000000 b7040000 c0200000
[ 0.000000] 3d80: c1f76f08 c24c71a0 39f47000 00000000 c1f76f3c c220a101 bd000000 c220a2ed
[ 0.000000] 3da0: c1f76f08 c2ce2858 c22d30d8 c220a311 f0000000 ffff1000 39f47000 00000000
[ 0.000000] 3dc0: c2074000 c2074084 c2403f80 c22c38e0 c0208000 c314453f c22d1a40 c24c6f40
[ 0.000000] 3de0: c2074000 c041f6fc c2403f80 c2203d1f 0000006c 70c5383d 00000000 00000000
[ 0.000000] 3e00: 00000000 00000000 00000000 c04e7495 c2490c08 c04e778d 00000000 00000000
[ 0.000000] 3e20: 00000000 00000000 00000002 c2cb4b12 00000000 00000002 c2410660 c2403fcc
[ 0.000000] 3e40: 00000001 184807cc c247da60 c247da68 c2cb4a20 00000002 00000000 c121f723
[ 0.000000] 3e60: 41b58ab3 c1f74b60 c22036e4 00000000 00000002 c04a6225 00000400 00000005
[ 0.000000] 3e80: 00000002 00000000 00000000 00000000 c2cb4a28 600001d3 c247d8a0 ffffc000
[ 0.000000] 3ea0: 00000000 c2406cf8 c2400000 c2cb1560 c2406d70 c2400000 000000ae 00000002
[ 0.000000] 3ec0: ffffc000 600001d3 00000001 c04a753b c1400980 c2403fac 00000002 00000000
[ 0.000000] 3ee0: 00000000 b74807e4 c2400000 c04a7c40 c2406cc0 ffffffff 00000001 70c5387d
[ 0.000000] 3f00: 00000000 c04a75eb c1400980 c2403fac 00000001 c04a7ca7 00000000 00000000
[ 0.000000] 3f20: 41b58ab3 c1f82ac4 c04a7c40 00000000 00000000 00000000 00000000 00000000
[ 0.000000] 3f40: c2403fac 00000000 00000000 00000000 00000000 00000000 00000000 c049370b
[ 0.000000] 3f60: 00000000 c24953f0 c146b1a0 c04fa117 c24953e0 c22d6274 c24955ac c24953f0
[ 0.000000] 3f80: ffffffff 00000001 70c5387d 00000000 c22d6274 c2ca4000 c2ca4000 c2406cc0
[ 0.000000] 3fa0: c2406cc0 ffffffff 00000001 70c5387d 00000000 c2200aeb 00000001 c24c6f40
[ 0.000000] 3fc0: c2ca1000 c0203010 00002ca3 c22d1a40 00000000 00000000 00000000 c220032c
[ 0.000000] 3fe0: 00000000 30c0387d ffffffff 07d00000 410fd083 00000000 00000000 00000000
[ 0.000000] [<c05c57ce>] (check_memory_region) from [<c05c41eb>] (memset+0x13/0x24)
[ 0.000000] [<c05c41eb>] (memset) from [<c22244d3>] (memblock_alloc_try_nid+0xe3/0x108)
[ 0.000000] [<c22244d3>] (memblock_alloc_try_nid) from [<c2209eed>] (kasan_alloc_block.constprop.1+0x65/0x68)
[ 0.000000] [<c2209eed>] (kasan_alloc_block.constprop.1) from [<c220a02b>] (kasan_pgd_populate+0x13b/0x1dc)
[ 0.000000] [<c220a02b>] (kasan_pgd_populate) from [<c220a101>] (create_mapping+0x35/0x3a)
[ 0.000000] [<c220a101>] (create_mapping) from [<c220a311>] (kasan_init+0x1d3/0x2fa)
[ 0.000000] [<c220a311>] (kasan_init) from [<c2203d1f>] (setup_arch+0x63b/0xe58)
[ 0.000000] [<c2203d1f>] (setup_arch) from [<c2200aeb>] (start_kernel+0x69/0x2fe)
[ 0.000000] [<c2200aeb>] (start_kernel) from [<00000000>] (0x0)
[ 0.000000] Code: f014 0607 d131 10ed (e9d4) 6700
[ 0.000000] random: get_random_bytes called from print_oops_end_marker+0x1f/0x40 with crng_init=0
[ 0.000000] ---[ end trace 0000000000000000 ]---
[ 0.000000] Kernel panic - not syncing: Attempted to kill the idle task!
[ 0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---
[-- Attachment #3: Type: text/plain, Size: 176 bytes --]
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2020-10-03 15:53 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-01 15:22 [PATCH 0/6 v14] KASan for Arm Linus Walleij
2020-10-01 15:22 ` [PATCH 1/6 v14] ARM: Handle a device tree in lowmem Linus Walleij
2020-10-01 16:45 ` Florian Fainelli
2020-10-01 20:31 ` Linus Walleij
2020-10-02 11:01 ` Ard Biesheuvel
2020-10-04 20:50 ` Linus Walleij
2020-10-05 7:14 ` Ard Biesheuvel
2020-10-05 9:14 ` Ard Biesheuvel
2020-10-05 13:27 ` Linus Walleij
2020-10-05 13:30 ` Linus Walleij
2020-10-05 13:36 ` Ard Biesheuvel
2020-10-05 14:22 ` Ard Biesheuvel
2020-10-06 9:11 ` Linus Walleij
2020-10-06 9:16 ` Ard Biesheuvel
2020-10-06 9:19 ` Linus Walleij
2020-10-06 8:47 ` Linus Walleij
2020-10-06 8:48 ` Ard Biesheuvel
2020-10-05 12:26 ` Linus Walleij
2020-10-01 15:22 ` [PATCH 2/6 v14] ARM: Disable KASan instrumentation for some code Linus Walleij
2020-10-01 15:22 ` [PATCH 3/6 v14] ARM: Replace string mem* functions for KASan Linus Walleij
2020-10-01 15:22 ` [PATCH 4/6 v14] ARM: Define the virtual space of KASan's shadow region Linus Walleij
2020-10-01 15:22 ` [PATCH 5/6 v14] ARM: Initialize the mapping of KASan shadow memory Linus Walleij
2020-10-01 15:22 ` [PATCH 6/6 v14] ARM: Enable KASan for ARM Linus Walleij
2020-10-01 19:19 ` [PATCH 0/6 v14] KASan for Arm Florian Fainelli
2020-10-01 20:34 ` Linus Walleij
2020-10-01 20:38 ` Florian Fainelli
2020-10-01 21:18 ` Linus Walleij
2020-10-01 21:29 ` Arnd Bergmann
2020-10-01 21:35 ` Florian Fainelli
2020-10-03 15:50 ` Ard Biesheuvel [this message]
2020-10-04 8:06 ` Ard Biesheuvel
2020-10-04 8:41 ` Ard Biesheuvel
2020-10-04 9:09 ` Ard Biesheuvel
2020-10-04 20:24 ` Florian Fainelli
2020-10-05 8:40 ` Linus Walleij
2020-10-06 13:21 ` Linus Walleij
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAMj1kXFcnQdm0bnuLEhDTW=WBgkTLu0BDd2C3uN3AtMt+AUinw@mail.gmail.com' \
--to=ardb@kernel.org \
--cc=arnd@arndb.de \
--cc=aryabinin@virtuozzo.com \
--cc=f.fainelli@gmail.com \
--cc=linus.walleij@linaro.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux@armlinux.org.uk \
--cc=liuwenliang@huawei.com \
--cc=rppt@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).