[lkml]   [2016]   [Nov]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH urgent] x86/traps: Ignore high word of regs->cs in early_fixup_exception()
On the 80486 DX, it seems that some exceptions may leave garbage in
the high bits of CS. This causes sporadic failures in which
early_fixup_exception() refuses to fix up an exception.

As far as I can tell, this has been buggy for a long time, but the
problem seems to have been exacerbated by commit 1e02ce4cccdc ("x86:
Store a per-cpu shadow copy of CR4") and commit e1bfc11c5a6f
("x86/init: Fix cr4_init_shadow() on CR4-less machines").

This appears to have broken for as long as we've had early
exception handling.

Stable maintainers: This patch is needed all the way back to 3.4,
but it will only apply to 4.6 and up, as it depends on commit
0e861fbb5bda ("x86/head: Move early exception panic code into
early_fixup_exception()"). If you want to backport to kernels
before 4.6, please don't backport the prerequisites (there was a big
chain of them that rewrote a lot of the early exception machinery);
instead, ask me and I can send you a one-liner that will apply.

Fixes: 4c5023a3fa2e ("x86-32: Handle exception table entries during early boot")
Cc: H. Peter Anvin <>
Reported-by: Matthew Whitehead <>
Signed-off-by: Andy Lutomirski <>

This is for 4.9 because it makes it boot on some old 486 machines that it
can't currently reliably boot on.

I suspect we have many instances of similar bugs, and it would be nice
to fix them for real.

arch/x86/mm/extable.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
index 79ae939970d3..fcd06f7526de 100644
--- a/arch/x86/mm/extable.c
+++ b/arch/x86/mm/extable.c
@@ -135,7 +135,12 @@ void __init early_fixup_exception(struct pt_regs *regs, int trapnr)
if (early_recursion_flag > 2)
goto halt_loop;

- if (regs->cs != __KERNEL_CS)
+ /*
+ * Old CPUs leave the high bits of CS on the stack
+ * undefined. I'm not sure which CPUs do this, but at least
+ * the 486 DX works this way.
+ */
+ if ((regs->cs & 0xFFFF) != __KERNEL_CS)
goto fail;

 \ /
  Last update: 2016-11-20 03:43    [W:0.038 / U:1.760 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site