The following BUG_ON error was reported on QEMU/i386:
kernel BUG at arch/x86/mm/physaddr.c:79!
Call Trace:
phys_mem_access_prot_allowed
mmap_mem
? mmap_region
mmap_region
do_mmap
vm_mmap_pgoff
SyS_mmap_pgoff
do_int80_syscall_32
entry_INT80_32
after commit edfe63ec97ed ("x86/mtrr: Fix Xorg crashes in
Qemu sessions").
PAT is now set to disabled state when MTRRs are disabled.
Thus, reactivating the __pa(high_memory) check in
phys_mem_access_prot_allowed().
When CONFIG_DEBUG_VIRTUAL is set, __pa() calls __phys_addr(),
which in turn calls slow_virt_to_phys() for 'high_memory'.
Because 'high_memory' is set to (the max direct mapped virt
addr + 1), it is not a valid virtual address. Hence,
slow_virt_to_phys() returns 0 and hit the BUG_ON. Using
__pa_nodebug() instead of __pa() will fix this BUG_ON.
However, this code block, originally written for Pentiums and
earlier, is no longer adequate since a 32-bit Xen guest has
MTRRs disabled and supports ZONE_HIGHMEM. In this setup,
this code sets UC attribute for accessing RAM in high memory
range.
Delete this code block as it has been unused for a long time.
Reported-by: kernel test robot <[email protected]>
Link: https://lkml.org/lkml/2016/4/1/608
Signed-off-by: Toshi Kani <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: Ingo Molnar <[email protected]>
Cc: H. Peter Anvin <[email protected]>
Cc: Borislav Petkov <[email protected]>
Cc: David Vrabel <[email protected]>
---
This patch is based on -tip.
v2: Change to remove the code block.
---
arch/x86/mm/pat.c | 19 -------------------
1 file changed, 19 deletions(-)
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index c4c3ddc..fb0604f 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -778,25 +778,6 @@ int phys_mem_access_prot_allowed(struct file *file, unsigned long pfn,
if (file->f_flags & O_DSYNC)
pcm = _PAGE_CACHE_MODE_UC_MINUS;
-#ifdef CONFIG_X86_32
- /*
- * On the PPro and successors, the MTRRs are used to set
- * memory types for physical addresses outside main memory,
- * so blindly setting UC or PWT on those pages is wrong.
- * For Pentiums and earlier, the surround logic should disable
- * caching for the high addresses through the KEN pin, but
- * we maintain the tradition of paranoia in this code.
- */
- if (!pat_enabled() &&
- !(boot_cpu_has(X86_FEATURE_MTRR) ||
- boot_cpu_has(X86_FEATURE_K6_MTRR) ||
- boot_cpu_has(X86_FEATURE_CYRIX_ARR) ||
- boot_cpu_has(X86_FEATURE_CENTAUR_MCR)) &&
- (pfn << PAGE_SHIFT) >= __pa(high_memory)) {
- pcm = _PAGE_CACHE_MODE_UC;
- }
-#endif
-
*vma_prot = __pgprot((pgprot_val(*vma_prot) & ~_PAGE_CACHE_MASK) |
cachemode2protval(pcm));
return 1;
* Toshi Kani <[email protected]> wrote:
> The following BUG_ON error was reported on QEMU/i386:
>
> kernel BUG at arch/x86/mm/physaddr.c:79!
> Call Trace:
> phys_mem_access_prot_allowed
> mmap_mem
> ? mmap_region
> mmap_region
> do_mmap
> vm_mmap_pgoff
> SyS_mmap_pgoff
> do_int80_syscall_32
> entry_INT80_32
>
> after commit edfe63ec97ed ("x86/mtrr: Fix Xorg crashes in
> Qemu sessions").
>
> PAT is now set to disabled state when MTRRs are disabled.
> Thus, reactivating the __pa(high_memory) check in
> phys_mem_access_prot_allowed().
>
> When CONFIG_DEBUG_VIRTUAL is set, __pa() calls __phys_addr(),
> which in turn calls slow_virt_to_phys() for 'high_memory'.
> Because 'high_memory' is set to (the max direct mapped virt
> addr + 1), it is not a valid virtual address. Hence,
> slow_virt_to_phys() returns 0 and hit the BUG_ON. Using
> __pa_nodebug() instead of __pa() will fix this BUG_ON.
>
> However, this code block, originally written for Pentiums and
> earlier, is no longer adequate since a 32-bit Xen guest has
> MTRRs disabled and supports ZONE_HIGHMEM. In this setup,
> this code sets UC attribute for accessing RAM in high memory
> range.
>
> Delete this code block as it has been unused for a long time.
>
> Reported-by: kernel test robot <[email protected]>
> Link: https://lkml.org/lkml/2016/4/1/608
> Signed-off-by: Toshi Kani <[email protected]>
> Cc: Thomas Gleixner <[email protected]>
> Cc: Ingo Molnar <[email protected]>
> Cc: H. Peter Anvin <[email protected]>
> Cc: Borislav Petkov <[email protected]>
> Cc: David Vrabel <[email protected]>
So you missed the Reviewed-by tag from Boris ...
I've added it, but please try to propagate tags!
Thanks,
Ingo
Commit-ID: 1886297ce0c8d563a08c8a8c4c0b97743e06cd37
Gitweb: http://git.kernel.org/tip/1886297ce0c8d563a08c8a8c4c0b97743e06cd37
Author: Toshi Kani <[email protected]>
AuthorDate: Mon, 11 Apr 2016 13:36:00 -0600
Committer: Ingo Molnar <[email protected]>
CommitDate: Wed, 13 Apr 2016 11:35:33 +0200
x86/mm/pat: Fix BUG_ON() in mmap_mem() on QEMU/i386
The following BUG_ON() crash was reported on QEMU/i386:
kernel BUG at arch/x86/mm/physaddr.c:79!
Call Trace:
phys_mem_access_prot_allowed
mmap_mem
? mmap_region
mmap_region
do_mmap
vm_mmap_pgoff
SyS_mmap_pgoff
do_int80_syscall_32
entry_INT80_32
after commit:
edfe63ec97ed ("x86/mtrr: Fix Xorg crashes in Qemu sessions")
PAT is now set to disabled state when MTRRs are disabled.
Thus, reactivating the __pa(high_memory) check in
phys_mem_access_prot_allowed().
When CONFIG_DEBUG_VIRTUAL is set, __pa() calls __phys_addr(),
which in turn calls slow_virt_to_phys() for 'high_memory'.
Because 'high_memory' is set to (the max direct mapped virt
addr + 1), it is not a valid virtual address. Hence,
slow_virt_to_phys() returns 0 and hit the BUG_ON. Using
__pa_nodebug() instead of __pa() will fix this BUG_ON.
However, this code block, originally written for Pentiums and
earlier, is no longer adequate since a 32-bit Xen guest has
MTRRs disabled and supports ZONE_HIGHMEM. In this setup,
this code sets UC attribute for accessing RAM in high memory
range.
Delete this code block as it has been unused for a long time.
Reported-by: kernel test robot <[email protected]>
Reviewed-by: Borislav Petkov <[email protected]>
Signed-off-by: Toshi Kani <[email protected]>
Cc: Andrew Morton <[email protected]>
Cc: David Vrabel <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Paul E. McKenney <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: [email protected]
Link: http://lkml.kernel.org/r/[email protected]
Link: https://lkml.org/lkml/2016/4/1/608
Signed-off-by: Ingo Molnar <[email protected]>
---
arch/x86/mm/pat.c | 19 -------------------
1 file changed, 19 deletions(-)
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index c4c3ddc..fb0604f 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -778,25 +778,6 @@ int phys_mem_access_prot_allowed(struct file *file, unsigned long pfn,
if (file->f_flags & O_DSYNC)
pcm = _PAGE_CACHE_MODE_UC_MINUS;
-#ifdef CONFIG_X86_32
- /*
- * On the PPro and successors, the MTRRs are used to set
- * memory types for physical addresses outside main memory,
- * so blindly setting UC or PWT on those pages is wrong.
- * For Pentiums and earlier, the surround logic should disable
- * caching for the high addresses through the KEN pin, but
- * we maintain the tradition of paranoia in this code.
- */
- if (!pat_enabled() &&
- !(boot_cpu_has(X86_FEATURE_MTRR) ||
- boot_cpu_has(X86_FEATURE_K6_MTRR) ||
- boot_cpu_has(X86_FEATURE_CYRIX_ARR) ||
- boot_cpu_has(X86_FEATURE_CENTAUR_MCR)) &&
- (pfn << PAGE_SHIFT) >= __pa(high_memory)) {
- pcm = _PAGE_CACHE_MODE_UC;
- }
-#endif
-
*vma_prot = __pgprot((pgprot_val(*vma_prot) & ~_PAGE_CACHE_MASK) |
cachemode2protval(pcm));
return 1;
On Wed, 2016-04-13 at 11:35 +0200, Ingo Molnar wrote:
> * Toshi Kani <[email protected]> wrote:
:
> >
> > However, this code block, originally written for Pentiums and
> > earlier, is no longer adequate since a 32-bit Xen guest has
> > MTRRs disabled and supports ZONE_HIGHMEM. In this setup,
> > this code sets UC attribute for accessing RAM in high memory
> > range.
> >
> > Delete this code block as it has been unused for a long time.
> >
> > Reported-by: kernel test robot <[email protected]>
> > Link: https://lkml.org/lkml/2016/4/1/608
> > Signed-off-by: Toshi Kani <[email protected]>
> > Cc: Thomas Gleixner <[email protected]>
> > Cc: Ingo Molnar <[email protected]>
> > Cc: H. Peter Anvin <[email protected]>
> > Cc: Borislav Petkov <[email protected]>
> > Cc: David Vrabel <[email protected]>
>
> So you missed the Reviewed-by tag from Boris ...
>
> I've added it, but please try to propagate tags!
Thanks Ingo!
I decided to drop the Reviewed-by tag for v1 since v2 has a different
approach.
-Toshi