Re: Regression in 2.6.25-rc3: s2ram segfaults before suspending

Klaus S. Madsen wrote:

On Fri, Feb 29, 2008 at 22:26:54 +0100, Ingo Molnar wrote:

quoted

* H. Peter Anvin [off-list ref] wrote:

quoted

Klaus S. Madsen wrote:

quoted

open("/dev/mem", O_RDWR)                = 5
mmap2(NULL, 1282, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_SHARED|MAP_FIXED, 5, 0) = 0
mmap2(0xa0000, 393216, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 5, 0xa0) = 0xa0000

                         ^^^^^^^^^^^^^^^^^^^^

quoted

close(5)                                = 0
ioperm(0, 0x400, 0x1)                   = 0
iopl(0x3)                               = 0
access("/sys/bus/pci", R_OK)            = 0
write(1, "Calling get_mode\n", 17)      = 17
vm86(0x1, 0xb7f14ccc, 0xb7f14830, 0xc000, 0x18b6 <unfinished ...>

--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV (core dumped) +++

This is the VGA BIOS being mapped, it's mapped PROT_READ|PROT_WRITE, but  
no PROT_EXEC; if the kernel is NX-capable it *should* segfault trying to 
execute out of this area, which is exactly what will happen when vm86 
executes INT 10h.

If we can find that mmap() in the s2ram source code and add PROT_EXEC 
to it, it would be interesting.

Klaus, could you send your .config as well? Lets make sure that NX is 
even relevant in this context.

Allright. The mmap in question is in the x86-common.c file in libx86,
and adding PROT_EXEC to it solves the problem.

I have attached my .config.

The only thing I don't understand is why this is suddenly a problem with
2.6.25, and not with 2.6.24? Is there a bug in 2.6.24 and previously
that allows real-mode execution of non-executable pages?

One wonders, especially since the checkin it was bisected to it had 
nothing to do with NX.  I suspect there is either a bug in the NX logic, 
which this checkin inadvertently fixed(!), or there is an ad hoc hack 
that should probably never have existed.  More investigation necessary, 
but now we know a lot more.

	-hpa