[PATCH] x86: fix system die when load with "reservetop" parameter

[PATCH] x86: fix system die when load with "reservetop" parameter

[Xiao Guangrong]

The system will die if the kernel is booted with "reservetop" parameter,
in present code, parse "reservetop" parameter after early_ioremap_init(),
and some function still use early_ioremap() after it.

The problem is, "reservetop" parameter can modify 'FIXADDR_TOP', then the
virtual address got by early_ioremap() is base on old 'FIXADDR_TOP', but
the page mapping is base on new 'FIXADDR_TOP', it will occur page fault,
and the IDT is not prepare yet, so, the system is dead.

So, put parse_early_param() in the front of early_ioremap_init() in this
patch.

Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
---
 arch/x86/kernel/setup.c |   10 +++++-----
 1 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 26fce55..aad6149 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -713,6 +713,11 @@ void __init setup_arch(char **cmdline_p)
 	printk(KERN_INFO "Command line: %s\n", boot_command_line);
 #endif
 
+	strlcpy(command_line, boot_command_line, COMMAND_LINE_SIZE);
+	*cmdline_p = command_line;
+
+	parse_early_param();
+
 	/* VMI may relocate the fixmap; do this before touching ioremap area */
 	vmi_init();
 
@@ -795,11 +800,6 @@ void __init setup_arch(char **cmdline_p)
 #endif
 #endif
 
-	strlcpy(command_line, boot_command_line, COMMAND_LINE_SIZE);
-	*cmdline_p = command_line;
-
-	parse_early_param();
-
 #ifdef CONFIG_X86_64
 	check_efer();
 #endif
-- 
1.6.1.2

Re: [PATCH] x86: fix system die when load with "reservetop" parameter

[Ingo Molnar]

* Xiao Guangrong <xiaoguangrong@cn.fujitsu.com> wrote:

> The system will die if the kernel is booted with "reservetop" 
> parameter, in present code, parse "reservetop" parameter after 
> early_ioremap_init(), and some function still use early_ioremap() 
> after it.

btw., what are you using the 'reservetop' boot option for?

> The problem is, "reservetop" parameter can modify 'FIXADDR_TOP', 
> then the virtual address got by early_ioremap() is base on old 
> 'FIXADDR_TOP', but the page mapping is base on new 'FIXADDR_TOP', 
> it will occur page fault, and the IDT is not prepare yet, so, the 
> system is dead.
> 
> So, put parse_early_param() in the front of early_ioremap_init() 
> in this patch.
> 
> Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
> ---
>  arch/x86/kernel/setup.c |   10 +++++-----
>  1 files changed, 5 insertions(+), 5 deletions(-)

Does this bug trigger in 2.6.30 too?

I'm quite nervous about doing this change so late in the .31 cycle, 
we've got a hundred early parameters that now get executed much 
earlier than before. No way can i test all of them and others 
testing it (like in your case) takes time to trickle through.

So unless this is a .31 regression i'd be inclined to queue it up 
for .32.

	Ingo

[tip:x86/urgent] x86: Fix system crash when loading with "reservetop" parameter

[tip-bot for Xiao Guangrong]

Commit-ID:  8126dec32738421afa362114337331337b4be17f
Gitweb:     http://git.kernel.org/tip/8126dec32738421afa362114337331337b4be17f
Author:     Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
AuthorDate: Thu, 20 Aug 2009 20:23:11 +0800
Committer:  Ingo Molnar <mingo@elte.hu>
CommitDate: Fri, 21 Aug 2009 16:40:30 +0200

x86: Fix system crash when loading with "reservetop" parameter

The system will die if the kernel is booted with "reservetop"
parameter, in present code, parse "reservetop" parameter after
early_ioremap_init(), and some function still use
early_ioremap() after it.

The problem is, "reservetop" parameter can modify
'FIXADDR_TOP', then the virtual address got by early_ioremap()
is base on old 'FIXADDR_TOP', but the page mapping is base on
new 'FIXADDR_TOP', it will occur page fault, and the IDT is not
prepare yet, so, the system is dead.

So, put parse_early_param() in the front of
early_ioremap_init() in this patch.

Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
Cc: yinghai@kernel.org
Cc: Andrew Morton <akpm@linux-foundation.org>
LKML-Reference: <4A8D402F.4080805@cn.fujitsu.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>


---
 arch/x86/kernel/setup.c |   10 +++++-----
 1 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 63f32d2..02643cc 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -711,6 +711,11 @@ void __init setup_arch(char **cmdline_p)
 	printk(KERN_INFO "Command line: %s\n", boot_command_line);
 #endif
 
+	strlcpy(command_line, boot_command_line, COMMAND_LINE_SIZE);
+	*cmdline_p = command_line;
+
+	parse_early_param();
+
 	/* VMI may relocate the fixmap; do this before touching ioremap area */
 	vmi_init();
 
@@ -793,11 +798,6 @@ void __init setup_arch(char **cmdline_p)
 #endif
 #endif
 
-	strlcpy(command_line, boot_command_line, COMMAND_LINE_SIZE);
-	*cmdline_p = command_line;
-
-	parse_early_param();
-
 #ifdef CONFIG_X86_64
 	check_efer();
 #endif

Re: [PATCH] x86: fix system die when load with "reservetop" parameter

[Xiao Guangrong]

Ingo Molnar wrote:
> * Xiao Guangrong <xiaoguangrong@cn.fujitsu.com> wrote:
> 
>> The system will die if the kernel is booted with "reservetop" 
>> parameter, in present code, parse "reservetop" parameter after 
>> early_ioremap_init(), and some function still use early_ioremap() 
>> after it.
> 
> btw., what are you using the 'reservetop' boot option for?
> 

Hi Ingo,

Actually, this bug is detected by my review first, then confirm it by
loading with "reservetop" parameter

>> The problem is, "reservetop" parameter can modify 'FIXADDR_TOP', 
>> then the virtual address got by early_ioremap() is base on old 
>> 'FIXADDR_TOP', but the page mapping is base on new 'FIXADDR_TOP', 
>> it will occur page fault, and the IDT is not prepare yet, so, the 
>> system is dead.
>>
>> So, put parse_early_param() in the front of early_ioremap_init() 
>> in this patch.
>>
>> Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
>> ---
>>  arch/x86/kernel/setup.c |   10 +++++-----
>>  1 files changed, 5 insertions(+), 5 deletions(-)
> 
> Does this bug trigger in 2.6.30 too?
> 
> I'm quite nervous about doing this change so late in the .31 cycle, 
> we've got a hundred early parameters that now get executed much 
> earlier than before. No way can i test all of them and others 
> testing it (like in your case) takes time to trickle through.
> 
> So unless this is a .31 regression i'd be inclined to queue it up 
> for .32.
> 

OK, this parameter is introduced in v2.6.27, but It seems like less
people use it and no one report this bug before. So, I think we can
queue it up for .32

Thanks,
Xiao