linux-kernel - Re: another pagetable initialization crash on xen

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.00.1104011525260.16492@kaball-desktop>
Date:	Tue, 5 Apr 2011 14:47:33 +0100
From:	Stefano Stabellini <stefano.stabellini@...citrix.com>
To:	Yinghai Lu <yinghai@...nel.org>
CC:	Stefano Stabellini <Stefano.Stabellini@...citrix.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: another pagetable initialization crash on xen

On Wed, 30 Mar 2011, Yinghai Lu wrote:
> On 03/30/2011 09:59 AM, Stefano Stabellini wrote:
> > On Wed, 30 Mar 2011, Stefano Stabellini wrote:
> >> I have another unrelated question: init_memory_mapping is called on the
> >> range 0 - max_low_pfn, but that range usually includes a reserved region
> >> below the first MB. On one machine of mine the IOAPIC mmio region falls
> >> in that memory range therefore we are mapping the IOAPIC mmio region in
> >> init_memory_mapping without going through the fixmap as we should.
> >> This is causing problems on Xen, but I guess it could theoretically
> >> cause problems on other platforms as well. Should we avoid reserved
> >> memory regions below the first MB from the initial memory mappings?
> >
> > Sorry I mixed up frame numbers with physical addresses, so the IOAPIC
> > mmio region is actually at 0xfec00000 where it should be but it gets
> > mapped during the initial memory mapping (range 0 - 0x100000000).
> > Is that supposed to happen? Shouldn't it go through the fixmap?
> 
> io apic addr is going through fixmap.
> 
> initial_memory_mapping will map to [0, max_mem_under_4g).
> max_mem_under_4g is from E820 table searching.
> 
> later it will map [4g, max_mem_above_4g).
> 
> We do not map mmio gap between [max_mem_under_4g,4g)

Thanks for the explanation, I figure out what the problem is: on xen we
add an extra memory region at the end of the e820, and on this
particular machine this extra memory region would start below 4g and
cross over the 4g boundary:

[0xfee01000-0x192655000)


Unfortunately e820_end_of_low_ram_pfn does not expect an
e820 layout like that so it returns 4g, therefore initial_memory_mapping
will map [0 - 0x100000000), that is a memory range that includes some
reserved memory regions.


I would submit a fix that makes sure that the extra memory region is
always added over 4g and not below.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/