Messages in this thread | | | Subject | Re: KVM guest sometimes failed to boot because of kernel stack overflow if KPTI is enabled on a hisilicon ARM64 platform. | From | Wei Xu <> | Date | Fri, 22 Jun 2018 21:46:53 +0800 |
| |
Hi Will,
On 2018/6/22 21:31, Will Deacon wrote: > Hi again, Wei, > > On Fri, Jun 22, 2018 at 09:18:27PM +0800, Wei Xu wrote: >> On 2018/6/22 19:16, Will Deacon wrote: >>> On Fri, Jun 22, 2018 at 06:45:15PM +0800, Wei Xu wrote: >>>> On 2018/6/22 17:23, Will Deacon wrote: >>>>> Perhaps just writing back the table entries is enough to cause the issue, >>>>> although I really can't understand why that would be the case. Can you try >>>>> the diff below (without my previous change), please? >>>> Thanks! >>>> But it does not resolve the issue(only apply this patch based on 4.17.0). >>> Thanks, that's a useful data point. It means that it still crashes even if >>> we write back the same table entries, so it's the fact that we're writing >>> them at all which causes the problem, not the value that we write. >>> >>> Whilst looking at the code, we noticed a missing DMB. On the off-chance >>> that it helps, can you try this instead please? >> Thanks! >> Only apply below patch based on 4.17.0, we still got the crash. > Oh well, it was worth a shot (and that's still a fix worth having). Please > can you provide the complete disassembly for kpti_install_ng_mappings() > (I'm referring to the C function in cpufeature.c) along with a corresponding > crash log so that we can correlate the instruction stream with the crash? Just let me know if you need more information. Thanks!
The disassemble code is as below: Dump of assembler code for function kpti_install_ng_mappings: 0xffff000008091d68 <+0>: stp x29, x30, [sp,#-112]! 0xffff000008091d6c <+4>: adrp x0, 0xffff000009022000 <bp_hardening_data> 0xffff000008091d70 <+8>: mov x29, sp 0xffff000008091d74 <+12>: stp x23, x24, [sp,#48] 0xffff000008091d78 <+16>: adrp x24, 0xffff000009191000 <reset_devices> 0xffff000008091d7c <+20>: add x0, x0, #0x10 0xffff000008091d80 <+24>: add x1, x24, #0x550 0xffff000008091d84 <+28>: stp x19, x20, [sp,#16] 0xffff000008091d88 <+32>: stp x21, x22, [sp,#32] 0xffff000008091d8c <+36>: stp x25, x26, [sp,#64] 0xffff000008091d90 <+40>: stp x27, x28, [sp,#80] 0xffff000008091d94 <+44>: mrs x2, tpidr_el1 0xffff000008091d98 <+48>: ldrb w1, [x1,#8] 0xffff000008091d9c <+52>: ldr w20, [x2,x0] 0xffff000008091da0 <+56>: cbnz w1, 0xffff000008091f18 <kpti_install_ng_mappings+432> 0xffff000008091da4 <+60>: adrp x27, 0xffff000008ea9000 <cpu_ops+384> 0xffff000008091da8 <+64>: adrp x19, 0xffff000009190000 <empty_zero_page> 0xffff000008091dac <+68>: add x19, x19, #0x0 0xffff000008091db0 <+72>: adrp x1, 0xffff000008a44000 <kimage_vaddr> 0xffff000008091db4 <+76>: mov x0, x19 0xffff000008091db8 <+80>: add x1, x1, #0x3d8 0xffff000008091dbc <+84>: ldr x2, [x27,#672] 0xffff000008091dc0 <+88>: sub x4, x1, x2 0xffff000008091dc4 <+92>: sub x0, x0, x2 0xffff000008091dc8 <+96>: msr ttbr0_el1, x0 0xffff000008091dcc <+100>: isb 0xffff000008091dd0 <+104>: dsb nshst 0xffff000008091dd4 <+108>: tlbi vmalle1 0xffff000008091dd8 <+112>: nop 0xffff000008091ddc <+116>: nop 0xffff000008091de0 <+120>: dsb nsh 0xffff000008091de4 <+124>: isb 0xffff000008091de8 <+128>: adrp x3, 0xffff000009056000 <armv8_event_attr_sw_incr+8> 0xffff000008091dec <+132>: ldr x0, [x3,#2248] 0xffff000008091df0 <+136>: cmp x0, #0x10 0xffff000008091df4 <+140>: b.ne 0xffff000008091f64 <kpti_install_ng_mappings+508> 0xffff000008091df8 <+144>: adrp x28, 0xffff000008ea9000 <cpu_ops+384> 0xffff000008091dfc <+148>: ldr x2, [x27,#672] 0xffff000008091e00 <+152>: adrp x1, 0xffff0000091f3000 0xffff000008091e04 <+156>: adrp x26, 0xffff0000091f7000 0xffff000008091e08 <+160>: add x1, x1, #0x0 0xffff000008091e0c <+164>: add x21, x26, #0x0 0xffff000008091e10 <+168>: ldr x0, [x28,#656] 0xffff000008091e14 <+172>: adrp x23, 0xffff000008ea9000 <cpu_ops+384> 0xffff000008091e18 <+176>: sub x1, x1, x2 0xffff000008091e1c <+180>: sub x1, x1, x0 0xffff000008091e20 <+184>: orr x0, x1, #0xffff800000000000 0xffff000008091e24 <+188>: cmp x0, x21 0xffff000008091e28 <+192>: b.eq 0xffff000008091f60 <kpti_install_ng_mappings+504> 0xffff000008091e2c <+196>: mov x22, x19 0xffff000008091e30 <+200>: str x3, [x29,#96] 0xffff000008091e34 <+204>: str x4, [x29,#104] 0xffff000008091e38 <+208>: sub x2, x22, x2 0xffff000008091e3c <+212>: msr ttbr0_el1, x2 0xffff000008091e40 <+216>: isb 0xffff000008091e44 <+220>: ldr x0, [x28,#656] 0xffff000008091e48 <+224>: and x1, x1, #0x7fffffffffff 0xffff000008091e4c <+228>: adrp x25, 0xffff00000906d000 <shmem_swaplist_mutex+16> 0xffff000008091e50 <+232>: add x0, x1, x0 0xffff000008091e54 <+236>: add x1, x25, #0x7b0 0xffff000008091e58 <+240>: bl 0xffff0000080a021c <cpu_do_switch_mm> 0xffff000008091e5c <+244>: adrp x0, 0xffff00000904a000 <__cpu_online_mask> 0xffff000008091e60 <+248>: mov w1, #0x80 // #128 0xffff000008091e64 <+252>: add x0, x0, #0x0 0xffff000008091e68 <+256>: bl 0xffff0000083e22f0 <__bitmap_weight> 0xffff000008091e6c <+260>: mov w1, w0 0xffff000008091e70 <+264>: ldr x5, [x23,#672] 0xffff000008091e74 <+268>: mov w0, w20 0xffff000008091e78 <+272>: ldr x4, [x29,#104] 0xffff000008091e7c <+276>: mov x2, x21 0xffff000008091e80 <+280>: sub x2, x2, x5 0xffff000008091e84 <+284>: blr x4 0xffff000008091e88 <+288>: ldr x1, [x23,#672] 0xffff000008091e8c <+292>: mrs x0, sp_el0 0xffff000008091e90 <+296>: sub x22, x22, x1 0xffff000008091e94 <+300>: ldr x1, [x0,#1128] 0xffff000008091e98 <+304>: msr ttbr0_el1, x22 0xffff000008091e9c <+308>: isb 0xffff000008091ea0 <+312>: dsb nshst 0xffff000008091ea4 <+316>: tlbi vmalle1 0xffff000008091ea8 <+320>: nop 0xffff000008091eac <+324>: nop 0xffff000008091eb0 <+328>: dsb nsh 0xffff000008091eb4 <+332>: isb 0xffff000008091eb8 <+336>: ldr x3, [x29,#96] 0xffff000008091ebc <+340>: ldr x0, [x3,#2248] 0xffff000008091ec0 <+344>: cmp x0, #0x10 0xffff000008091ec4 <+348>: b.ne 0xffff000008091f48 <kpti_install_ng_mappings+480> 0xffff000008091ec8 <+352>: add x25, x25, #0x7b0 0xffff000008091ecc <+356>: cmp x1, x25 0xffff000008091ed0 <+360>: b.eq 0xffff000008091f08 <kpti_install_ng_mappings+416> 0xffff000008091ed4 <+364>: ldr x2, [x1,#64] 0xffff000008091ed8 <+368>: add x26, x26, #0x0 0xffff000008091edc <+372>: cmp x2, x26 0xffff000008091ee0 <+376>: b.eq 0xffff000008091f60 <kpti_install_ng_mappings+504> 0xffff000008091ee4 <+380>: ldr x0, [x27,#672] 0xffff000008091ee8 <+384>: sub x19, x19, x0 0xffff000008091eec <+388>: msr ttbr0_el1, x19 0xffff000008091ef0 <+392>: isb 0xffff000008091ef4 <+396>: tbz x2, #47, 0xffff000008091f34 <kpti_install_ng_mappings+460> 0xffff000008091ef8 <+400>: ldr x0, [x28,#656] 0xffff000008091efc <+404>: and x2, x2, #0x7fffffffffff 0xffff000008091f00 <+408>: add x0, x2, x0 0xffff000008091f04 <+412>: bl 0xffff0000080a021c <cpu_do_switch_mm> 0xffff000008091f08 <+416>: cbnz w20, 0xffff000008091f18 <kpti_install_ng_mappings+432> 0xffff000008091f0c <+420>: add x24, x24, #0x550 0xffff000008091f10 <+424>: mov w0, #0x1 // #1 0xffff000008091f14 <+428>: strb w0, [x24,#8] 0xffff000008091f18 <+432>: ldp x19, x20, [sp,#16] 0xffff000008091f1c <+436>: ldp x21, x22, [sp,#32] 0xffff000008091f20 <+440>: ldp x23, x24, [sp,#48] 0xffff000008091f24 <+444>: ldp x25, x26, [sp,#64] 0xffff000008091f28 <+448>: ldp x27, x28, [sp,#80] 0xffff000008091f2c <+452>: ldp x29, x30, [sp],#112 0xffff000008091f30 <+456>: ret 0xffff000008091f34 <+460>: adrp x0, 0xffff000008ea9000 <cpu_ops+384> 0xffff000008091f38 <+464>: ldr x0, [x0,#672] 0xffff000008091f3c <+468>: sub x0, x2, x0 0xffff000008091f40 <+472>: bl 0xffff0000080a021c <cpu_do_switch_mm> 0xffff000008091f44 <+476>: b 0xffff000008091f08 <kpti_install_ng_mappings+416> 0xffff000008091f48 <+480>: mrs x0, tcr_el1 0xffff000008091f4c <+484>: and x0, x0, #0xffffffffffffffc0 0xffff000008091f50 <+488>: orr x0, x0, #0x10 0xffff000008091f54 <+492>: msr tcr_el1, x0 0xffff000008091f58 <+496>: isb 0xffff000008091f5c <+500>: b 0xffff000008091ec8 <kpti_install_ng_mappings+352> 0xffff000008091f60 <+504>: brk #0x800 0xffff000008091f64 <+508>: mrs x1, tcr_el1 0xffff000008091f68 <+512>: and x1, x1, #0xffffffffffffffc0 0xffff000008091f6c <+516>: orr x0, x1, x0 0xffff000008091f70 <+520>: msr tcr_el1, x0 0xffff000008091f74 <+524>: isb 0xffff000008091f78 <+528>: b 0xffff000008091df8 <kpti_install_ng_mappings+144> End of assembler dump.
The crash log for it is as : estuary:/$ ./qemu-system-aarch64 -machine virt,kernel_irqchip=on,gic-version=3 -cpu host -enable-kvm -smp 1 -m 1024 -kernel ./Image-4.17-joyx -initrd ../mini-rootfs-arm64.cpio.gz -nographic -append "rdinit=init console=ttyAMA0 earlycon=pl011,0x9000000" [ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x480fd010] [ 0.000000] Linux version 4.17.0-45864-g29dcea8-dirty (joyx@Turing-Arch-b) (gcc version 4.9.1 20140505 (prerelease) (crosstool-NG linaro-1.13.1-4.9-2014.05 - Linaro GCC 4.9-2014.05)) #16 SMP PREEMPT Fri Jun 22 21:05:10 CST 2018 [ 0.000000] Machine model: linux,dummy-virt [ 0.000000] earlycon: pl11 at MMIO 0x0000000009000000 (options '') [ 0.000000] bootconsole [pl11] enabled [ 0.000000] efi: Getting EFI parameters from FDT: [ 0.000000] efi: UEFI not found. [ 0.000000] cma: Reserved 16 MiB at 0x000000007f000000 [ 0.000000] NUMA: No NUMA configuration found [ 0.000000] NUMA: Faking a node at [mem 0x0000000000000000-0x000000007fffffff] [ 0.000000] NUMA: NODE_DATA [mem 0x7efeb300-0x7efecdff] [ 0.000000] Zone ranges: [ 0.000000] DMA32 [mem 0x0000000040000000-0x000000007fffffff] [ 0.000000] Normal empty [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000040000000-0x000000007fffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000007fffffff] [ 0.000000] psci: probing for conduit method from DT. [ 0.000000] psci: PSCIv1.0 detected in firmware. [ 0.000000] psci: Using standard PSCI v0.2 function IDs [ 0.000000] psci: Trusted OS migration not required [ 0.000000] psci: SMC Calling Convention v1.1 [ 0.000000] random: get_random_bytes called from start_kernel+0xa8/0x418 with crng_init=0 [ 0.000000] percpu: Embedded 24 pages/cpu @ (ptrval) s57984 r8192 d32128 u98304 [ 0.000000] Detected VIPT I-cache on CPU0 [ 0.000000] CPU features: detected: Kernel page table isolation (KPTI) [ 0.000000] CPU features: detected: Hardware dirty bit management [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 258048 [ 0.000000] Policy zone: DMA32 [ 0.000000] Kernel command line: rdinit=init console=ttyAMA0 earlycon=pl011,0x9000000 [ 0.000000] Memory: 968436K/1048576K available (10044K kernel code, 1328K rwdata, 4840K rodata, 1216K init, 409K bss, 63756K reserved, 16384K cma-reserved) [ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] Preemptible hierarchical RCU implementation. [ 0.000000] RCU restricting CPUs from NR_CPUS=128 to nr_cpu_ids=1. [ 0.000000] Tasks RCU enabled. [ 0.000000] RCU: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=1 [ 0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0 [ 0.000000] GICv3: Distributor has no Range Selector support [ 0.000000] GICv3: no VLPI support, no direct LPI support [ 0.000000] ITS [mem 0x08080000-0x0809ffff] [ 0.000000] ITS@0x0000000008080000: allocated 8192 Devices @7d830000 (indirect, esz 8, psz 64K, shr 1) [ 0.000000] ITS@0x0000000008080000: allocated 8192 Interrupt Collections @7d840000 (flat, esz 8, psz 64K, shr 1) [ 0.000000] GIC: using LPI property table @0x000000007d850000 [ 0.000000] ITS: Allocated 1792 chunks for LPIs [ 0.000000] GICv3: CPU0: found redistributor 0 region 0:0x00000000080a0000 [ 0.000000] CPU0: using LPI pending table @0x000000007d860000 [ 0.000000] GIC: PPI11 is secure or misconfigured [ 0.000000] arch_timer: WARNING: Invalid trigger for IRQ3, assuming level low [ 0.000000] arch_timer: WARNING: Please fix your firmware [ 0.000000] arch_timer: cp15 timer(s) running at 100.00MHz (virt). [ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x171024e7e0, max_idle_ns: 440795205315 ns [ 0.000001] sched_clock: 56 bits at 100MHz, resolution 10ns, wraps every 4398046511100ns [ 0.000849] Console: colour dummy device 80x25 [ 0.001427] Calibrating delay loop (skipped), value calculated using timer frequency.. 200.00 BogoMIPS (lpj=400000) [ 0.002485] pid_max: default: 32768 minimum: 301 [ 0.002966] Security Framework initialized [ 0.003549] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes) [ 0.004353] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes) [ 0.005068] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes) [ 0.005858] Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes) [ 0.025962] ASID allocator initialised with 32768 entries [ 0.029972] Hierarchical SRCU implementation. [ 0.034341] Platform MSI: its domain created [ 0.034793] PCI/MSI: /intc/its domain created [ 0.035360] EFI services will not be available. [ 0.038002] smp: Bringing up secondary CPUs ... [ 0.038472] smp: Brought up 1 node, 1 CPU [ 0.038878] SMP: Total of 1 processors activated. [ 0.039354] CPU features: detected: GIC system register CPU interface [ 0.040004] CPU features: detected: Privileged Access Never [ 0.040566] CPU features: detected: User Access Override [ 0.042462] Insufficient stack space to handle exception! [ 0.042464] ESR: 0x96000046 -- DABT (current EL) [ 0.043781] FAR: 0xffff0000093a80e0 [ 0.044239] Task stack: [0xffff0000093a8000..0xffff0000093ac000] [ 0.046967] IRQ stack: [0xffff000008000000..0xffff000008004000] [ 0.053361] Overflow stack: [0xffff80003efce2f0..0xffff80003efcf2f0] [ 0.059754] CPU: 0 PID: 12 Comm: migration/0 Not tainted 4.17.0-45864-g29dcea8-dirty #16 [ 0.067946] Hardware name: linux,dummy-virt (DT) [ 0.072644] pstate: 604003c5 (nZCv DAIF +PAN -UAO) [ 0.077480] pc : el1_sync+0x0/0xb0 [ 0.080970] lr : kpti_install_ng_mappings+0x120/0x214 [ 0.086143] sp : ffff0000093a80e0 [ 0.089513] x29: ffff0000093abce0 x28: ffff000008ea9000 [ 0.094929] x27: ffff000008ea9000 x26: ffff0000091f7000 [ 0.100241] x25: ffff00000906d000 x24: ffff000009191000 [ 0.105657] x23: ffff000008ea9000 x22: 0000000041190000 [ 0.111448] x21: ffff0000091f7000 x20: 0000000000000000 [ 0.116437] x19: ffff000009190000 x18: 000000003455d99d [ 0.121739] x17: 0000000000000001 x16: 00f8000040ffff13 [ 0.127155] x15: 000000007eff6000 x14: 000000007eff6000 [ 0.132576] x13: 00f800007fe00f11 x12: 000000007eff8000 [ 0.137886] x11: 000000007eff8000 x10: 0000000000000000 [ 0.143300] x9 : 000000007eff9000 x8 : 000000007eff9000 [ 0.148717] x7 : 0000000000000000 x6 : 00000000411f8000 [ 0.154028] x5 : 00000000411f8000 x4 : 0000000040a443d4 [ 0.159444] x3 : 00000000411f7000 x2 : 00000000411f7000 [ 0.164862] x1 : ffff00000906d7b0 x0 : ffff80003da61c00 [ 0.170179] Kernel panic - not syncing: kernel stack overflow [ 0.176069] CPU: 0 PID: 12 Comm: migration/0 Not tainted 4.17.0-45864-g29dcea8-dirty #16 [ 0.184152] Hardware name: linux,dummy-virt (DT) [ 0.188851] Call trace: [ 0.191380] dump_backtrace+0x0/0x180 [ 0.195113] show_stack+0x14/0x1c [ 0.198488] dump_stack+0x90/0xb0 [ 0.201862] panic+0x138/0x2a0 [ 0.204989] __stack_chk_fail+0x0/0x18 [ 0.208836] handle_bad_stack+0x118/0x124 [ 0.212927] __bad_stack+0x88/0x8c [ 0.216414] el1_sync+0x0/0xb0 [ 0.219544] Unable to handle kernel paging request at virtual address ffff0000093abce0 [ 0.227507] Mem abort info: [ 0.230390] ESR = 0x96000006 [ 0.233517] Exception class = DABT (current EL), IL = 32 bits [ 0.239428] SET = 0, FnV = 0 [ 0.242555] EA = 0, S1PTW = 0 [ 0.245797] Data abort info: [ 0.248795] ISV = 0, ISS = 0x00000006 [ 0.252652] CM = 0, WnR = 0 [ 0.255769] swapper pgtable: 4k pages, 48-bit VAs, pgdp = (ptrval) [ 0.262645] [ffff0000093abce0] pgd=00000000411f8803, pud=00000000411f9803, pmd=0000000000000000 [ 0.271438] Internal error: Oops: 96000006 [#1] PREEMPT SMP [ 0.277098] Modules linked in: [ 0.280227] CPU: 0 PID: 12 Comm: migration/0 Not tainted 4.17.0-45864-g29dcea8-dirty #16 [ 0.288310] Hardware name: linux,dummy-virt (DT) [ 0.293004] pstate: 204003c5 (nzCv DAIF +PAN -UAO) [ 0.297931] pc : unwind_frame+0x28/0xc8 [ 0.301792] lr : dump_backtrace+0x12c/0x180 [ 0.306114] sp : ffff80003efcf000 [ 0.309483] x29: ffff80003efcf000 x28: ffff80003da61c00 [ 0.314798] x27: ffff000008ea9000 x26: ffff0000091f7000 [ 0.320216] x25: ffff00000906d000 x24: ffff0000093a80e0 [ 0.325527] x23: 0000000000000000 x22: ffff000008dbada8 [ 0.330941] x21: 0000000000000000 x20: ffff000009049000 [ 0.336355] x19: ffff80003da61c00 x18: 000000003455d99d [ 0.341770] x17: 0000000000000001 x16: 00f8000040ffff13 [ 0.347078] x15: 000000007eff6000 x14: 642d386165636439 [ 0.352491] x13: 0000000000000000 x12: cc26f77952f87e00 [ 0.357905] x11: ffffffffffffffff x10: 0000000000000075 [ 0.363214] x9 : ffff0000085ae9e8 x8 : ffff80003efcec90 [ 0.368628] x7 : 0000000000000000 x6 : ffff0000091befe1 [ 0.374053] x5 : 0000000000000000 x4 : ffff0000093ac000 [ 0.379363] x3 : ffff0000093a8000 x2 : ffff0000093abce0 [ 0.384779] x1 : ffff80003efcf048 x0 : ffff80003da61c00 [ 0.390196] Process migration/0 (pid: 12, stack limit = 0x (ptrval)) [ 0.397188] Call trace: [ 0.399712] unwind_frame+0x28/0xc8 [ 0.403316] show_stack+0x14/0x1c [ 0.406689] dump_stack+0x90/0xb0 [ 0.410065] panic+0x138/0x2a0 [ 0.413193] __stack_chk_fail+0x0/0x18 [ 0.416934] handle_bad_stack+0x118/0x124 [ 0.421025] __bad_stack+0x88/0x8c [ 0.424513] el1_sync+0x0/0xb0 [ 0.427643] Unable to handle kernel paging request at virtual address ffff0000093abce0 [ 0.435604] Mem abort info: [ 0.438488] ESR = 0x96000006 [ 0.441615] Exception class = DABT (current EL), IL = 32 bits [ 0.447635] SET = 0, FnV = 0 [ 0.450759] EA = 0, S1PTW = 0 [ 0.454002] Data abort info: [ 0.456896] ISV = 0, ISS = 0x00000006 [ 0.460863] CM = 0, WnR = 0 [ 0.463874] swapper pgtable: 4k pages, 48-bit VAs, pgdp = (ptrval) [ 0.470750] [ffff0000093abce0] pgd=00000000411f8803, pud=00000000411f9803, pmd=0000000000000000
Best Regards, Wei
> Thanks, > > Will > > . >
| |