From: "Rafael J. Wysocki" <rafael@kernel.org>
To: Stephen Smalley <sds@tycho.nsa.gov>
Cc: "Rafael J. Wysocki" <rafael@kernel.org>,
Ingo Molnar <mingo@kernel.org>,
Logan Gunthorpe <logang@deltatee.com>,
Kees Cook <keescook@chromium.org>, Ingo Molnar <mingo@redhat.com>,
"the arch/x86 maintainers" <x86@kernel.org>,
"linux-pm@vger.kernel.org" <linux-pm@vger.kernel.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Andy Lutomirski <luto@kernel.org>, Borislav Petkov <bp@alien8.de>,
Denys Vlasenko <dvlasenk@redhat.com>,
Brian Gerst <brgerst@gmail.com>
Subject: Re: PROBLEM: Resume form hibernate broken by setting NX on gap
Date: Fri, 20 May 2016 23:46:36 +0200 [thread overview]
Message-ID: <CAJZ5v0gWxVwJ4aNEKtnCnY-GvFACaAjFDJNH__2YeAco-f1kRQ@mail.gmail.com> (raw)
In-Reply-To: <7b865a03-484f-2d10-aa3e-d9c0d04caecb@tycho.nsa.gov>
On Fri, May 20, 2016 at 3:56 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> On 05/20/2016 07:34 AM, Rafael J. Wysocki wrote:
>> On Fri, May 20, 2016 at 9:15 AM, Ingo Molnar <mingo@kernel.org> wrote:
>>>
>>> * Logan Gunthorpe <logang@deltatee.com> wrote:
>>>
>>>> Hi,
>>>>
>>>> I have been working on a bug that causes my laptop to freeze during
>>>> resume from hibernation. I did a bisect to find the offending commit:
>>>>
>>>> [ab76f7b4ab] x86/mm: Set NX on gap between __ex_table and rodata
>>>>
>>>> There is more information in the bugzilla report [1] that
>>>> I've been working on but I will summarize things below.
>>>>
>>>> I've experienced intermittent but reproducible freezes when resuming
>>>> from hibernation since about kernel version 3.19. The freeze was
>>>> significantly more reproducible when a few applications were loaded
>>>> before hibernation and would largely not happen if hibernated
>>>> immediately after booting to a desktop. I did some tracing work to find
>>>> that the kernel gets as far as the resume_image call in
>>>> swsusp_arch_resume and I could not find any response from the image
>>>> kernel when I hit the bug. I also did testing that seemed to rule out
>>>> this being caused by a problematic driver.
>>>>
>>>> I did a successful bisect between 3.18 and 3.19 which found a bug in
>>>> commit f5b2831d6 that was then later fixed by commit 55696b1f66 in 4.4.
>>>> Then, I did a second bisect with a ported version of the fix to the
>>>> first bug and found commit ab76f7b4ab in 4.3 to also break hibernation
>>>> with what appears to be the exact same symptoms. Reverting that commit
>>>> in recent kernels up to and including 4.6 fixes the issue and restores
>>>> reliable hibernation. However, it's not at all clear to me why that
>>>> commit would cause this issue or how to fix the issue without reverting.
>>>
>>> I've attached that commit below and also Cc:-ed a few more people who might have
>>> an idea about why this regressed. Worst-case we'll have to revert it.
>>
>> Without looking deep into mm, my theory would be that after this patch
>> the final jump from the boot kernel to the image kernel's trampoline
>> code during resume may crash the kernel if the trampoline page turns
>> out to be NX in the boot kernel (it has to be executable in both the
>> boot and the image kernels).
>
> So, pardon my ignorance, but where is this trampoline page placed in
> kernel memory?
On 32-bit its location has to be the same in both the boot and the
image kernels and that's within kernel text in both cases, so that
shouldn't be a problem.
On 64-bit its location depends on the image kernel and specifically on
the location of the restore_registers routine in it. The (virtual)
address of that routine is stored in the restore_jump_address
variable, so the page containing it (the trampoline page) can be found
with the help of that.
swsusp_arch_resume() sets up a temporary kernel mapping to finalize
the image restoration and that page must not be NX in that mapping for
things to work.
next prev parent reply other threads:[~2016-05-20 21:46 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <573DF82D.50006@deltatee.com>
2016-05-20 7:15 ` PROBLEM: Resume form hibernate broken by setting NX on gap Ingo Molnar
2016-05-20 11:34 ` Rafael J. Wysocki
2016-05-20 13:56 ` Stephen Smalley
2016-05-20 21:46 ` Rafael J. Wysocki [this message]
2016-05-20 21:59 ` Kees Cook
2016-05-20 22:16 ` Kees Cook
[not found] ` <573FC081.20006@deltatee.com>
2016-05-21 16:39 ` Kees Cook
[not found] ` <575A3E95.5090100@deltatee.com>
2016-06-10 18:09 ` Kees Cook
2016-06-10 18:16 ` Logan Gunthorpe
2016-06-10 18:18 ` Kees Cook
2016-06-10 21:27 ` Rafael J. Wysocki
2016-06-10 22:29 ` Rafael J. Wysocki
2016-06-10 22:28 ` Logan Gunthorpe
2016-06-10 22:33 ` Rafael J. Wysocki
2016-06-11 0:13 ` Rafael J. Wysocki
2016-06-11 1:47 ` Rafael J. Wysocki
2016-06-11 11:48 ` Rafael J. Wysocki
2016-06-11 16:35 ` Logan Gunthorpe
2016-06-11 17:39 ` Logan Gunthorpe
2016-06-12 1:05 ` Rafael J. Wysocki
2016-06-12 4:48 ` Logan Gunthorpe
2016-06-12 14:31 ` Rafael J. Wysocki
2016-06-12 16:11 ` Logan Gunthorpe
2016-06-13 13:43 ` Rafael J. Wysocki
2016-06-10 22:11 ` Rafael J. Wysocki
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAJZ5v0gWxVwJ4aNEKtnCnY-GvFACaAjFDJNH__2YeAco-f1kRQ@mail.gmail.com \
--to=rafael@kernel.org \
--cc=bp@alien8.de \
--cc=brgerst@gmail.com \
--cc=dvlasenk@redhat.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pm@vger.kernel.org \
--cc=logang@deltatee.com \
--cc=luto@kernel.org \
--cc=mingo@kernel.org \
--cc=mingo@redhat.com \
--cc=sds@tycho.nsa.gov \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).