Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1462357

[PATCH 4.4 26/49] x86/mtrr: Fix Xorg crashes in Qemu sessions

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 4.4 26/49] x86/mtrr: Fix Xorg crashes in Qemu sessions
Date 2016-08-14 22:30 +0200
Message-ID <s6acG-4ts-35@gated-at.bofh.it> (permalink)
References <s6acF-4ts-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Toshi Kani <toshi.kani@hpe.com>

commit edfe63ec97ed8d4496225f7ba54c9ce4207c5431 upstream.

A Xorg failure on qemu32 was reported as a regression [1] caused by
commit 9cd25aac1f44 ("x86/mm/pat: Emulate PAT when it is disabled").

This patch fixes the Xorg crash.

Negative effects of this regression were the following two failures [2]
in Xorg on QEMU with QEMU CPU model "qemu32" (-cpu qemu32), which were
triggered by the fact that its virtual CPU does not support MTRRs.

 #1. copy_process() failed in the check in reserve_pfn_range()

    copy_process
     copy_mm
      dup_mm
       dup_mmap
        copy_page_range
         track_pfn_copy
          reserve_pfn_range

 A WC map request was tracked as WC in memtype, which set a PTE as
 UC (pgprot) per __cachemode2pte_tbl[].  This led to this error in
 reserve_pfn_range() called from track_pfn_copy(), which obtained
 a pgprot from a PTE.  It converts pgprot to page_cache_mode, which
 does not necessarily result in the original page_cache_mode since
 __cachemode2pte_tbl[] redirects multiple types to UC.

 #2. error path in copy_process() then hit WARN_ON_ONCE in
     untrack_pfn().

     x86/PAT: Xorg:509 map pfn expected mapping type uncached-
     minus for [mem 0xfd000000-0xfdffffff], got write-combining
      Call Trace:
     dump_stack
     warn_slowpath_common
     ? untrack_pfn
     ? untrack_pfn
     warn_slowpath_null
     untrack_pfn
     ? __kunmap_atomic
     unmap_single_vma
     ? pagevec_move_tail_fn
     unmap_vmas
     exit_mmap
     mmput
     copy_process.part.47
     _do_fork
     SyS_clone
     do_syscall_32_irqs_on
     entry_INT80_32

These negative effects are caused by two separate bugs, but they
can be addressed in separate patches.  Fixing the pat_init() issue
described below addresses the root cause, and avoids Xorg to hit
these cases.

When the CPU does not support MTRRs, MTRR does not call pat_init(),
which leaves PAT enabled without initializing PAT.  This pat_init()
issue is a long-standing issue, but manifested as issue #1 (and then
hit issue #2) with the above-mentioned commit because the memtype
now tracks cache attribute with 'page_cache_mode'.

This pat_init() issue existed before the commit, but we used pgprot
in memtype.  Hence, we did not have issue #1 before.  But WC request
resulted in WT in effect because WC pgrot is actually WT when PAT
is not initialized.  This is not how it was designed to work.  When
PAT is set to disable properly, WC is converted to UC.  The use of
WT can result in a system crash if the target range does not support
WT.  Fortunately, nobody ran into such issue before.

To fix this pat_init() issue, PAT code has been enhanced to provide
pat_disable() interface.  Call this interface when MTRRs are disabled.
By setting PAT to disable properly, PAT bypasses the memtype check,
and avoids issue #1.

  [1]: https://lkml.org/lkml/2016/3/3/828
  [2]: https://lkml.org/lkml/2016/3/4/775

Signed-off-by: Toshi Kani <toshi.kani@hpe.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Borislav Petkov <bp@suse.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Luis R. Rodriguez <mcgrof@suse.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Toshi Kani <toshi.kani@hp.com>
Cc: elliott@hpe.com
Cc: konrad.wilk@oracle.com
Cc: paul.gortmaker@windriver.com
Cc: xen-devel@lists.xenproject.org
Link: http://lkml.kernel.org/r/1458769323-24491-5-git-send-email-toshi.kani@hpe.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/include/asm/mtrr.h     |    6 +++++-
 arch/x86/kernel/cpu/mtrr/main.c |   10 +++++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

--- a/arch/x86/include/asm/mtrr.h
+++ b/arch/x86/include/asm/mtrr.h
@@ -24,6 +24,7 @@
 #define _ASM_X86_MTRR_H
 
 #include <uapi/asm/mtrr.h>
+#include <asm/pat.h>
 
 
 /*
@@ -83,9 +84,12 @@ static inline int mtrr_trim_uncached_mem
 static inline void mtrr_centaur_report_mcr(int mcr, u32 lo, u32 hi)
 {
 }
+static inline void mtrr_bp_init(void)
+{
+	pat_disable("MTRRs disabled, skipping PAT initialization too.");
+}
 
 #define mtrr_ap_init() do {} while (0)
-#define mtrr_bp_init() do {} while (0)
 #define set_mtrr_aps_delayed_init() do {} while (0)
 #define mtrr_aps_init() do {} while (0)
 #define mtrr_bp_restore() do {} while (0)
--- a/arch/x86/kernel/cpu/mtrr/main.c
+++ b/arch/x86/kernel/cpu/mtrr/main.c
@@ -759,8 +759,16 @@ void __init mtrr_bp_init(void)
 		}
 	}
 
-	if (!mtrr_enabled())
+	if (!mtrr_enabled()) {
 		pr_info("MTRR: Disabled\n");
+
+		/*
+		 * PAT initialization relies on MTRR's rendezvous handler.
+		 * Skip PAT init until the handler can initialize both
+		 * features independently.
+		 */
+		pat_disable("MTRRs disabled, skipping PAT initialization too.");
+	}
 }
 
 void mtrr_ap_init(void)

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/49] 4.4.18-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 33/49] mm: memcontrol: fix swap counter leak on swapout from offline cgroup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 05/49] net: bgmac: Fix infinite loop in bgmac_dma_tx_add() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 26/49] x86/mtrr: Fix Xorg crashes in Qemu sessions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 28/49] x86/xen, pat: Remove PAT table init code from Xen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 01/49] tcp: make challenge acks less predictable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 03/49] ipv4: reject RTNH_F_DEAD and RTNH_F_LINKDOWN from user space Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 12/49] PNP: Add Broadwell to Intel MCH size workaround Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 23/49] x86/mm/pat: Add support of non-default PAT MSR setting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 24/49] x86/mm/pat: Add pat_disable() interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 10/49] scsi: ignore errors from scsi_dh_add_device() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 20/49] apparmor: fix ref count leak when profile sha1 hash is read Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 41/49] fs/dcache.c: avoid soft-lockup in dput() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 49/49] ext4: fix reference counting bug on block allocation error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 07/49] qed: Fix setting/clearing bit in completion bitmap Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 38/49] fuse: fsync() did not return IO errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 46/49] ext4: dont call ext4_should_journal_data() on the journal inode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 43/49] crypto: scatterwalk - Fix test in scatterwalk_done Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 19/49] Revert "s390/kdump: Clear subchannel ID to signal non-CCW/SCSI IPL" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 45/49] ext4: fix deadlock during page writeback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 22/49] devpts: clean up interface to pty drivers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 48/49] ext4: short-cut orphan cleanup on error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 32/49] mm: memcontrol: fix cgroup creation failure after many small jobs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 06/49] net/irda: fix NULL pointer dereference on memory allocation failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 27/49] x86/mtrr: Fix PAT init handling when MTRR is disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 44/49] ext4: check for extents that wrap around Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 29/49] x86/pat: Document the PAT initialization sequence Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 36/49] block: fix use-after-free in seq file Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 37/49] sysv, ipc: fix security-layer leaking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:40 +0200
  [PATCH 4.4 09/49] ipath: Restrict use of the write() interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:40 +0200
  [PATCH 4.4 35/49] x86/syscalls/64: Add compat_sys_keyctl for 32-bit userspace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:40 +0200
  [PATCH 4.4 21/49] random: strengthen input validation for RNDADDTOENTCNT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:40 +0200
  [PATCH 4.4 04/49] bonding: set carrier off for devices created through netlink Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:40 +0200
  [PATCH 4.4 11/49] PNP: Add Haswell-ULT to Intel MCH size workaround Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:40 +0200
  Re: [PATCH 4.4 00/49] 4.4.18-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-15 10:00 +0200
  Re: [PATCH 4.4 00/49] 4.4.18-stable review Guenter Roeck <linux@roeck-us.net> - 2016-08-15 15:10 +0200
  Re: [PATCH 4.4 00/49] 4.4.18-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-08-16 06:10 +0200

csiph-web