Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1431093 > unrolled thread

[GIT pull] x86 fixes for 4.7

Back to article view | Back to linux.kernel

Contents

  [GIT pull] x86 fixes for 4.7 Thomas Gleixner <tglx@linutronix.de> - 2016-06-25 10:30 +0200
    Re: [GIT pull] x86 fixes for 4.7 Linus Torvalds <torvalds@linux-foundation.org> - 2016-06-25 15:50 +0200
      Re: [GIT pull] x86 fixes for 4.7 "Rafael J. Wysocki" <rjw@rjwysocki.net> - 2016-06-26 02:50 +0200
        Re: [GIT pull] x86 fixes for 4.7 Borislav Petkov <bp@alien8.de> - 2016-06-26 18:50 +0200
      Re: [GIT pull] x86 fixes for 4.7 Thomas Gleixner <tglx@linutronix.de> - 2016-06-27 11:30 +0200

#1431093 — [GIT pull] x86 fixes for 4.7

Linus,

please pull the latest x86-urgent-for-linus git tree from:

   git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git x86-urgent-for-linus

This update contains:

  - The final fix for the hibernation resume path which addresses the observed
    crashes which were exposed by a recent change which sets NX on gap pages.

  - A trivial update to the maintainers file

Thanks,

	tglx

------------------>
Jon Mason (1):
      MAINTAINERS: Update the Calgary IOMMU entry

Rafael J. Wysocki (1):
      x86/power/64: Fix crash whan the hibernation code passes control to the image kernel


 MAINTAINERS                       |  6 ++--
 arch/x86/power/hibernate_64.c     | 69 +++++++++++++++++++++++++++++++++++----
 arch/x86/power/hibernate_asm_64.S | 31 +++++++++---------
 3 files changed, 81 insertions(+), 25 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 16700e4fcc4a..f589a9d0fb87 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2773,9 +2773,9 @@ F:	include/net/caif/
 F:	net/caif/
 
 CALGARY x86-64 IOMMU
-M:	Muli Ben-Yehuda <muli@il.ibm.com>
-M:	"Jon D. Mason" <jdmason@kudzu.us>
-L:	discuss@x86-64.org
+M:	Muli Ben-Yehuda <mulix@mulix.org>
+M:	Jon Mason <jdmason@kudzu.us>
+L:	iommu@lists.linux-foundation.org
 S:	Maintained
 F:	arch/x86/kernel/pci-calgary_64.c
 F:	arch/x86/kernel/tce_64.c
diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c
index 009947d419a6..aba6e26d3891 100644
--- a/arch/x86/power/hibernate_64.c
+++ b/arch/x86/power/hibernate_64.c
@@ -27,7 +27,8 @@ extern asmlinkage __visible int restore_image(void);
  * Address to jump to in the last phase of restore in order to get to the image
  * kernel's text (this value is passed in the image header).
  */
-unsigned long restore_jump_address __visible;
+void *restore_jump_address __visible;
+unsigned long jump_address_phys;
 
 /*
  * Value of the cr3 register from before the hibernation (this value is passed
@@ -37,8 +38,51 @@ unsigned long restore_cr3 __visible;
 
 pgd_t *temp_level4_pgt __visible;
 
+void *restore_pgd_addr __visible;
+pgd_t restore_pgd __visible;
+
 void *relocated_restore_code __visible;
 
+static int prepare_temporary_text_mapping(void)
+{
+	unsigned long vaddr = (unsigned long)restore_jump_address;
+	unsigned long paddr = jump_address_phys & PMD_MASK;
+	pmd_t *pmd;
+	pud_t *pud;
+
+	/*
+	 * The new mapping only has to cover the page containing the image
+	 * kernel's entry point (jump_address_phys), because the switch over to
+	 * it is carried out by relocated code running from a page allocated
+	 * specifically for this purpose and covered by the identity mapping, so
+	 * the temporary kernel text mapping is only needed for the final jump.
+	 * However, in that mapping the virtual address of the image kernel's
+	 * entry point must be the same as its virtual address in the image
+	 * kernel (restore_jump_address), so the image kernel's
+	 * restore_registers() code doesn't find itself in a different area of
+	 * the virtual address space after switching over to the original page
+	 * tables used by the image kernel.
+	 */
+	pud = (pud_t *)get_safe_page(GFP_ATOMIC);
+	if (!pud)
+		return -ENOMEM;
+
+	restore_pgd = __pgd(__pa(pud) | _KERNPG_TABLE);
+
+	pud += pud_index(vaddr);
+	pmd = (pmd_t *)get_safe_page(GFP_ATOMIC);
+	if (!pmd)
+		return -ENOMEM;
+
+	set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE));
+
+	pmd += pmd_index(vaddr);
+	set_pmd(pmd, __pmd(paddr | __PAGE_KERNEL_LARGE_EXEC));
+
+	restore_pgd_addr = temp_level4_pgt + pgd_index(vaddr);
+	return 0;
+}
+
 static void *alloc_pgt_page(void *context)
 {
 	return (void *)get_safe_page(GFP_ATOMIC);
@@ -59,10 +103,19 @@ static int set_up_temporary_mappings(void)
 	if (!temp_level4_pgt)
 		return -ENOMEM;
 
-	/* It is safe to reuse the original kernel mapping */
+	/* Re-use the original kernel text mapping for now */
 	set_pgd(temp_level4_pgt + pgd_index(__START_KERNEL_map),
 		init_level4_pgt[pgd_index(__START_KERNEL_map)]);
 
+	/*
+	 * Prepare a temporary mapping for the kernel text, but don't use it
+	 * just yet, we'll switch over to it later.  It only has to cover one
+	 * piece of code: the page containing the image kernel's entry point.
+	 */
+	result = prepare_temporary_text_mapping();
+	if (result)
+		return result;
+
 	/* Set up the direct mapping from scratch */
 	for (i = 0; i < nr_pfn_mapped; i++) {
 		mstart = pfn_mapped[i].start << PAGE_SHIFT;
@@ -89,8 +142,7 @@ int swsusp_arch_resume(void)
 	relocated_restore_code = (void *)get_safe_page(GFP_ATOMIC);
 	if (!relocated_restore_code)
 		return -ENOMEM;
-	memcpy(relocated_restore_code, &core_restore_code,
-	       &restore_registers - &core_restore_code);
+	memcpy(relocated_restore_code, &core_restore_code, PAGE_SIZE);
 
 	restore_image();
 	return 0;
@@ -108,12 +160,13 @@ int pfn_is_nosave(unsigned long pfn)
 }
 
 struct restore_data_record {
-	unsigned long jump_address;
+	void *jump_address;
+	unsigned long jump_address_phys;
 	unsigned long cr3;
 	unsigned long magic;
 };
 
-#define RESTORE_MAGIC	0x0123456789ABCDEFUL
+#define RESTORE_MAGIC	0x123456789ABCDEF0UL
 
 /**
  *	arch_hibernation_header_save - populate the architecture specific part
@@ -126,7 +179,8 @@ int arch_hibernation_header_save(void *addr, unsigned int max_size)
 
 	if (max_size < sizeof(struct restore_data_record))
 		return -EOVERFLOW;
-	rdr->jump_address = restore_jump_address;
+	rdr->jump_address = &restore_registers;
+	rdr->jump_address_phys = __pa_symbol(&restore_registers);
 	rdr->cr3 = restore_cr3;
 	rdr->magic = RESTORE_MAGIC;
 	return 0;
@@ -142,6 +196,7 @@ int arch_hibernation_header_restore(void *addr)
 	struct restore_data_record *rdr = addr;
 
 	restore_jump_address = rdr->jump_address;
+	jump_address_phys = rdr->jump_address_phys;
 	restore_cr3 = rdr->cr3;
 	return (rdr->magic == RESTORE_MAGIC) ? 0 : -EINVAL;
 }
diff --git a/arch/x86/power/hibernate_asm_64.S b/arch/x86/power/hibernate_asm_64.S
index 4400a43b9e28..3856ea4c9299 100644
--- a/arch/x86/power/hibernate_asm_64.S
+++ b/arch/x86/power/hibernate_asm_64.S
@@ -44,9 +44,6 @@ ENTRY(swsusp_arch_suspend)
 	pushfq
 	popq	pt_regs_flags(%rax)
 
-	/* save the address of restore_registers */
-	movq	$restore_registers, %rax
-	movq	%rax, restore_jump_address(%rip)
 	/* save cr3 */
 	movq	%cr3, %rax
 	movq	%rax, restore_cr3(%rip)
@@ -72,8 +69,10 @@ ENTRY(restore_image)
 	movq	%rax, %cr4;  # turn PGE back on
 
 	/* prepare to jump to the image kernel */
-	movq	restore_jump_address(%rip), %rax
 	movq	restore_cr3(%rip), %rbx
+	movq	restore_jump_address(%rip), %r10
+	movq	restore_pgd(%rip), %r8
+	movq	restore_pgd_addr(%rip), %r9
 
 	/* prepare to copy image data to their original locations */
 	movq	restore_pblist(%rip), %rdx
@@ -96,20 +95,22 @@ ENTRY(core_restore_code)
 	/* progress to the next pbe */
 	movq	pbe_next(%rdx), %rdx
 	jmp	.Lloop
+
 .Ldone:
+	/* switch over to the temporary kernel text mapping */
+	movq	%r8, (%r9)
+	/* flush TLB */
+	movq	%rax, %rdx
+	andq	$~(X86_CR4_PGE), %rdx
+	movq	%rdx, %cr4;  # turn off PGE
+	movq	%cr3, %rcx;  # flush TLB
+	movq	%rcx, %cr3;
+	movq	%rax, %cr4;  # turn PGE back on
 	/* jump to the restore_registers address from the image header */
-	jmpq	*%rax
-	/*
-	 * NOTE: This assumes that the boot kernel's text mapping covers the
-	 * image kernel's page containing restore_registers and the address of
-	 * this page is the same as in the image kernel's text mapping (it
-	 * should always be true, because the text mapping is linear, starting
-	 * from 0, and is supposed to cover the entire kernel text for every
-	 * kernel).
-	 *
-	 * code below belongs to the image kernel
-	 */
+	jmpq	*%r10
 
+	 /* code below belongs to the image kernel */
+	.align PAGE_SIZE
 ENTRY(restore_registers)
 	FRAME_BEGIN
 	/* go back to the original page tables */

[toc] | [next] | [standalone]

#1431126

On Sat, Jun 25, 2016 at 1:25 AM, Thomas Gleixner <tglx@linutronix.de> wrote:
>
> please pull the latest x86-urgent-for-linus git tree from:

Nope.

> This update contains:
>
>   - The final fix for the hibernation resume path which addresses the observed
>     crashes which were exposed by a recent change which sets NX on gap pages.

I'm pretty sure that's not the final fix. And that it caused more
problems than it fixed, afaik.

Adding Rafael to the cc to verify.

Rafael, this is the "odd restore_pgd_addr and extra TLB flush" patch.

               Linus

[toc] | [prev] | [next] | [standalone]

#1431266

On Saturday, June 25, 2016 06:49:09 AM Linus Torvalds wrote:
> On Sat, Jun 25, 2016 at 1:25 AM, Thomas Gleixner <tglx@linutronix.de> wrote:
> >
> > please pull the latest x86-urgent-for-linus git tree from:
> 
> Nope.
> 
> > This update contains:
> >
> >   - The final fix for the hibernation resume path which addresses the observed
> >     crashes which were exposed by a recent change which sets NX on gap pages.
> 
> I'm pretty sure that's not the final fix. And that it caused more
> problems than it fixed, afaik.

Well, it caused problems to happen on one system only, but it did cause them
to happen and anyway it is not the final fix.

> Adding Rafael to the cc to verify.
> 
> Rafael, this is the "odd restore_pgd_addr and extra TLB flush" patch.

Right.

The (hopefully) final one is https://patchwork.kernel.org/patch/9189139/
and it still is pending a test on the Boris' machine where the previous one
didn't work.  If that doesn't pass, we'll need to defer it until we know
the reason and possibly make some additional changes before applying it,
so I'd rather route this one through the PM tree.

Thanks,
Rafael

[toc] | [prev] | [next] | [standalone]

#1431542

On Sun, Jun 26, 2016 at 02:45:44AM +0200, Rafael J. Wysocki wrote:
> The (hopefully) final one is https://patchwork.kernel.org/patch/9189139/
> and it still is pending a test on the Boris' machine where the previous one
> didn't work.  If that doesn't pass, we'll need to defer it until we know
> the reason and possibly make some additional changes before applying it,

I'm afraid we do, unfortunately. Btw, I'm testing only this patch,
without your pages list optimization.

[  381.830413] PM: Basic memory bitmaps freed
[  381.835297] Restarting tasks ... 
[  381.838620] kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
[  381.838689] done.
[  381.850763] BUG: unable to handle kernel paging request at ffff88042b957e40
[  381.850765] IP: [<ffff88042b957e40>] 0xffff88042b957e40
[  381.850766] PGD 2065067 PUD 2068067 PMD 800000042b8001e3 
[  381.850767] Oops: 0011 [#1] PREEMPT SMP
[  381.850778] Modules linked in: binfmt_misc ipv6 vfat fat amd64_edac_mod edac_mce_amd fuse dm_crypt dm_mod amdkfd kvm_amd kvm amd_iommu_v2 radeq
[  381.850779] CPU: 3 PID: 1 Comm: init Not tainted 4.7.0-rc3+ #1
[  381.850780] Hardware name: To be filled by O.E.M. To be filled by O.E.M./M5A97 EVO R2.0, BIOS 1503 01/16/2013
[  381.850781] task: ffff88042b958000 ti: ffff88042b954000 task.ti: ffff88042b954000
[  381.850782] RIP: 0010:[<ffff88042b957e40>]  [<ffff88042b957e40>] 0xffff88042b957e40
[  381.850783] RSP: 0018:ffff88042b957e00  EFLAGS: 00010282
[  381.850783] RAX: 0000000000000000 RBX: ffff88042b957f58 RCX: 0000000000000000
[  381.850784] RDX: 0000000000000001 RSI: ffffffff81062a2d RDI: ffffffff81687d8c
[  381.850784] RBP: ffff88042b957ef0 R08: 0000000000000000 R09: 0000000000000002
[  381.850785] R10: 00000000ffffffff R11: 0000000000000001 R12: ffff88042b954000
[  381.850785] R13: ffff88042b954000 R14: ffff88042b957f58 R15: ffff88042b958000
[  381.850786] FS:  00007f1143649800(0000) GS:ffff88043dcc0000(0000) knlGS:0000000000000000
[  381.850787] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  381.850787] CR2: ffff88042b957e40 CR3: 00000004298af000 CR4: 00000000000406e0
[  381.850788] Stack:
[  381.850789]  ffff88042b1ed000 ffff88042b1ed000 0000000000000000 ffffffff8117f8ae
[  381.850790]  ffffff9c00000002 ffff88042b09ac00 ffffffff81175d5f 0000000000000011
[  381.850791]  0000000000001c3d 0000000000000001 0000000000001180 0000000000000000
[  381.850792] Call Trace:
[  381.850795]  [<ffffffff8117f8ae>] ? getname_flags+0x5e/0x1b0
[  381.850797]  [<ffffffff81175d5f>] ? cp_new_stat+0x10f/0x120
[  381.850799]  [<ffffffff810b9eca>] ? ktime_get_ts64+0x4a/0xf0
[  381.850800]  [<ffffffff81183a57>] ? poll_select_copy_remaining+0xe7/0x130
[  381.850802]  [<ffffffff8100263a>] exit_to_usermode_loop+0x8a/0xb0
[  381.850804]  [<ffffffff81002a6b>] syscall_return_slowpath+0x5b/0x70
[  381.850806]  [<ffffffff81688272>] entry_SYSCALL_64_fastpath+0xa5/0xa7
[  381.850820] Code: 00 00 00 ae f8 17 81 ff ff ff ff 02 00 00 00 9c ff ff ff 00 ac 09 2b 04 88 ff ff 5f 5d 17 81 ff ff ff ff 11 00 00 00 00 00 0 
[  381.850821] RIP  [<ffff88042b957e40>] 0xffff88042b957e40
[  381.850821]  RSP <ffff88042b957e00>
[  381.850821] CR2: ffff88042b957e40
[  381.850824] ---[ end trace b4f9b4244a59d886 ]---
[  381.851025] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
[  381.851025] 
[  381.858574] Kernel Offset: disabled

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.
--

[toc] | [prev] | [next] | [standalone]

#1431855

On Sat, 25 Jun 2016, Linus Torvalds wrote:
> I'm pretty sure that's not the final fix. And that it caused more
> problems than it fixed, afaik.

Sorry. That slipped through my attention. Thanks for spotting it!

       tglx

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web