Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

[qemu64,+smep,+smap] Kernel panic - not syncing: No working init found.

627 views
Skip to first unread message

Fengguang Wu

unread,
Feb 13, 2014, 7:50:03 AM2/13/14
to
Greetings,

I find that when running

qemu-system-x86_64 -cpu qemu64,+smep,+smap

Some kernels will 100% produce this error, where the error code
-13,-14 are -EACCES and -EFAULT:

[ 30.071380] Starting init: /sbin/init exists but couldn't execute it (error -14)
[ 30.072073] Starting init: /etc/init exists but couldn't execute it (error -13)
[ 30.073669] Starting init: /bin/sh exists but couldn't execute it (error -14)
[ 30.074147] Kernel panic - not syncing: No working init found. Try passing init= option to kernel. See Linux Documentation/init.txt for guidance.
[ 30.074147] CPU: 0 PID: 1 Comm: init Not tainted 3.14.0-rc1-next-20140207-01715-g72569d9 #1
[ 30.074147] 0000000000000000 ffff88000e065ec0 ffffffff815774ce ffff88000e065f38
[ 30.074147] ffffffff81575037 0000000000000008 ffff88000e065f48 ffff88000e065ee8
[ 30.074147] ffffffff81869e04 0000000000000001 ffff88000e062010 0000000000000000
[ 30.074147] Call Trace:
[ 30.074147] [<ffffffff815774ce>] dump_stack+0x19/0x1b
[ 30.074147] [<ffffffff81575037>] panic+0xd0/0x1d1
[ 30.074147] [<ffffffff8156d6f5>] ? rest_init+0x139/0x139
[ 30.074147] [<ffffffff8156d7cb>] kernel_init+0xd6/0xda
[ 30.074147] [<ffffffff81585f0a>] ret_from_fork+0x7a/0xb0
[ 30.074147] [<ffffffff8156d6f5>] ? rest_init+0x139/0x139
[ 30.074147] Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff)

Any ideas?

Thanks,
Fengguang
dmesg-quantal-waimea-8:20140208013850:x86_64-randconfig-r0-02080122:3.14.0-rc1-next-20140207-01715-g72569d9:1
config-3.14.0-rc1-next-20140207-01715-g72569d9

H. Peter Anvin

unread,
Feb 13, 2014, 10:00:02 AM2/13/14
to
On 02/13/2014 04:45 AM, Fengguang Wu wrote:
> Greetings,
>
> I find that when running
>
> qemu-system-x86_64 -cpu qemu64,+smep,+smap
>
> Some kernels will 100% produce this error, where the error code
> -13,-14 are -EACCES and -EFAULT:
>
> Any ideas?
>

I notice this is a non-SMAP kernel:

# CONFIG_X86_SMAP is not set

If the kernel turns on SMAP in CR4 even though SMAP isn't enabled in the
kernel, that is a kernel bug. If Qemu enforces SMAP even if it is
turned off in CR4, that would be a Qemu bug. I have reproduced the
failure locally and an am considering both possibilities now.

-hpa

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majo...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

H. Peter Anvin

unread,
Feb 13, 2014, 10:50:02 AM2/13/14
to
On 02/13/2014 06:55 AM, H. Peter Anvin wrote:
> On 02/13/2014 04:45 AM, Fengguang Wu wrote:
>> Greetings,
>>
>> I find that when running
>>
>> qemu-system-x86_64 -cpu qemu64,+smep,+smap
>>
>> Some kernels will 100% produce this error, where the error code
>> -13,-14 are -EACCES and -EFAULT:
>>
>> Any ideas?
>>
>
> I notice this is a non-SMAP kernel:
>
> # CONFIG_X86_SMAP is not set
>
> If the kernel turns on SMAP in CR4 even though SMAP isn't enabled in the
> kernel, that is a kernel bug. If Qemu enforces SMAP even if it is
> turned off in CR4, that would be a Qemu bug. I have reproduced the
> failure locally and an am considering both possibilities now.
>

So we do turn on the bit in CR4 even with SMAP compiled out. This is a
bug. However, I still get the same failure even with that bug fixed
(and qemu "info registers" verify that it is, indeed, not set) so I'm
wondering if there is a bug in Qemu as well. However, staring at the
code in Qemu I don't see where that bug would be...

tip-bot for H. Peter Anvin

unread,
Feb 13, 2014, 11:00:01 AM2/13/14
to
Commit-ID: 03bbd596ac04fef47ce93a730b8f086d797c3021
Gitweb: http://git.kernel.org/tip/03bbd596ac04fef47ce93a730b8f086d797c3021
Author: H. Peter Anvin <h...@linux.intel.com>
AuthorDate: Thu, 13 Feb 2014 07:34:30 -0800
Committer: H. Peter Anvin <h...@linux.intel.com>
CommitDate: Thu, 13 Feb 2014 07:50:25 -0800

x86, smap: Don't enable SMAP if CONFIG_X86_SMAP is disabled

If SMAP support is not compiled into the kernel, don't enable SMAP in
CR4 -- in fact, we should clear it, because the kernel doesn't contain
the proper STAC/CLAC instructions for SMAP support.

Found by Fengguang Wu's test system.

Reported-by: Fengguang Wu <fenggu...@intel.com>
Link: http://lkml.kernel.org/r/20140213124550.GA30497@localhost
Signed-off-by: H. Peter Anvin <h...@linux.intel.com>
Cc: <sta...@vger.kernel.org> # v3.7+
---
arch/x86/kernel/cpu/common.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 24b6fd1..8e28bf2 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -284,8 +284,13 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c)
raw_local_save_flags(eflags);
BUG_ON(eflags & X86_EFLAGS_AC);

- if (cpu_has(c, X86_FEATURE_SMAP))
+ if (cpu_has(c, X86_FEATURE_SMAP)) {
+#ifdef CONFIG_X86_SMAP
set_in_cr4(X86_CR4_SMAP);
+#else
+ clear_in_cr4(X86_CR4_SMAP);
+#endif
+ }
}

/*

H. Peter Anvin

unread,
Feb 13, 2014, 11:00:01 AM2/13/14
to
On 02/13/2014 06:55 AM, H. Peter Anvin wrote:
> On 02/13/2014 04:45 AM, Fengguang Wu wrote:
>> Greetings,
>>
>> I find that when running
>>
>> qemu-system-x86_64 -cpu qemu64,+smep,+smap
>>
>> Some kernels will 100% produce this error, where the error code
>> -13,-14 are -EACCES and -EFAULT:
>>
>> Any ideas?
>>
>
> I notice this is a non-SMAP kernel:
>
> # CONFIG_X86_SMAP is not set
>
> If the kernel turns on SMAP in CR4 even though SMAP isn't enabled in the
> kernel, that is a kernel bug. If Qemu enforces SMAP even if it is
> turned off in CR4, that would be a Qemu bug. I have reproduced the
> failure locally and an am considering both possibilities now.
>

No, it is simply a second kernel bug. I have patches for both and will
push them momentarily.

tip-bot for H. Peter Anvin

unread,
Feb 13, 2014, 11:00:03 AM2/13/14
to
Commit-ID: f27d7759ad1ff48673831e598d6df4c76b2bcd06
Gitweb: http://git.kernel.org/tip/f27d7759ad1ff48673831e598d6df4c76b2bcd06
Author: H. Peter Anvin <h...@linux.intel.com>
AuthorDate: Thu, 13 Feb 2014 07:46:04 -0800
Committer: H. Peter Anvin <h...@linux.intel.com>
CommitDate: Thu, 13 Feb 2014 07:50:45 -0800

x86, smap: smap_violation() is bogus if CONFIG_X86_SMAP is off

If CONFIG_X86_SMAP is disabled, smap_violation() tests for conditions
which are incorrect (as the AC flag doesn't matter), causing spurious
faults.

The dynamic disabling of SMAP (nosmap on the command line) is fine
because it disables X86_FEATURE_SMAP, therefore causing the
static_cpu_has() to return false.

Found by Fengguang Wu's test system.

Reported-by: Fengguang Wu <fenggu...@intel.com>
Link: http://lkml.kernel.org/r/20140213124550.GA30497@localhost
Signed-off-by: H. Peter Anvin <h...@linux.intel.com>
Cc: <sta...@vger.kernel.org> # v3.7+
---
arch/x86/mm/fault.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 9d591c8..4b39bb7 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -1087,12 +1087,14 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code)
if (unlikely(error_code & PF_RSVD))
pgtable_bad(regs, error_code, address);

+#ifdef CONFIG_X86_SMAP
if (static_cpu_has(X86_FEATURE_SMAP)) {
if (unlikely(smap_violation(error_code, regs))) {
bad_area_nosemaphore(regs, error_code, address);
return;
}
}
+#endif

/*
* If we're in an interrupt, have no user context or are running

tip-bot for H. Peter Anvin

unread,
Feb 13, 2014, 11:20:03 AM2/13/14
to
Commit-ID: af0c23df96fbc16089e8eda4b94b7d69b845f81e
Gitweb: http://git.kernel.org/tip/af0c23df96fbc16089e8eda4b94b7d69b845f81e
Author: H. Peter Anvin <h...@linux.intel.com>
AuthorDate: Thu, 13 Feb 2014 07:46:04 -0800
Committer: H. Peter Anvin <h...@linux.intel.com>
CommitDate: Thu, 13 Feb 2014 08:08:58 -0800

x86, smap: smap_violation() is bogus if CONFIG_X86_SMAP is off

If CONFIG_X86_SMAP is disabled, smap_violation() tests for conditions
which are incorrect (as the AC flag doesn't matter), causing spurious
faults.

The dynamic disabling of SMAP (nosmap on the command line) is fine
because it disables X86_FEATURE_SMAP, therefore causing the
static_cpu_has() to return false.

Found by Fengguang Wu's test system.

[ v2: use IS_ENABLED() instead of #ifdef ]

Reported-by: Fengguang Wu <fenggu...@intel.com>
Link: http://lkml.kernel.org/r/20140213124550.GA30497@localhost
Signed-off-by: H. Peter Anvin <h...@linux.intel.com>
Cc: <sta...@vger.kernel.org> # v3.7+
---
arch/x86/mm/fault.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 9d591c8..824b445 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -1087,7 +1087,7 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code)
if (unlikely(error_code & PF_RSVD))
pgtable_bad(regs, error_code, address);

- if (static_cpu_has(X86_FEATURE_SMAP)) {
+ if (IS_ENABLED(CONFIG_X86_SMAP) && static_cpu_has(X86_FEATURE_SMAP)) {
if (unlikely(smap_violation(error_code, regs))) {
bad_area_nosemaphore(regs, error_code, address);
return;

tip-bot for H. Peter Anvin

unread,
Feb 13, 2014, 12:00:02 PM2/13/14
to
Commit-ID: 4640c7ee9b8953237d05a61ea3ea93981d1bc961
Gitweb: http://git.kernel.org/tip/4640c7ee9b8953237d05a61ea3ea93981d1bc961
Author: H. Peter Anvin <h...@linux.intel.com>
AuthorDate: Thu, 13 Feb 2014 07:46:04 -0800
Committer: H. Peter Anvin <h...@linux.intel.com>
CommitDate: Thu, 13 Feb 2014 08:40:52 -0800

x86, smap: smap_violation() is bogus if CONFIG_X86_SMAP is off

If CONFIG_X86_SMAP is disabled, smap_violation() tests for conditions
which are incorrect (as the AC flag doesn't matter), causing spurious
faults.

The dynamic disabling of SMAP (nosmap on the command line) is fine
because it disables X86_FEATURE_SMAP, therefore causing the
static_cpu_has() to return false.

Found by Fengguang Wu's test system.

[ v3: move all predicates into smap_violation() ]
[ v2: use IS_ENABLED() instead of #ifdef ]

Reported-by: Fengguang Wu <fenggu...@intel.com>
Link: http://lkml.kernel.org/r/20140213124550.GA30497@localhost
Signed-off-by: H. Peter Anvin <h...@linux.intel.com>
Cc: <sta...@vger.kernel.org> # v3.7+
---
arch/x86/mm/fault.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 9d591c8..6dea040 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -1001,6 +1001,12 @@ static int fault_in_kernel_space(unsigned long address)

static inline bool smap_violation(int error_code, struct pt_regs *regs)
{
+ if (!IS_ENABLED(CONFIG_X86_SMAP))
+ return false;
+
+ if (!static_cpu_has(X86_FEATURE_SMAP))
+ return false;
+
if (error_code & PF_USER)
return false;

@@ -1087,11 +1093,9 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code)
if (unlikely(error_code & PF_RSVD))
pgtable_bad(regs, error_code, address);

- if (static_cpu_has(X86_FEATURE_SMAP)) {
- if (unlikely(smap_violation(error_code, regs))) {
- bad_area_nosemaphore(regs, error_code, address);
- return;
- }
+ if (unlikely(smap_violation(error_code, regs))) {
+ bad_area_nosemaphore(regs, error_code, address);
+ return;
}

/*
0 new messages