NetBSD Problem Report #42645

From  Tue Jan 19 22:36:47 2010
Return-Path: <>
Received: from ( [])
	by (Postfix) with ESMTP id EE71863C545
	for <>; Tue, 19 Jan 2010 22:36:46 +0000 (UTC)
Message-Id: <>
Date: Tue, 19 Jan 2010 22:36:46 +0000 (UTC)
Subject: Instant reboot with big modules (e.g. miniroot.kmod) on amd64
X-Send-Pr-Version: www-1.0

>Number:         42645
>Category:       port-amd64
>Synopsis:       Instant reboot with big modules (e.g. miniroot.kmod) on amd64
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    port-amd64-maintainer
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Jan 19 22:40:00 +0000 2010
>Closed-Date:    Thu Feb 09 19:38:14 +0000 2017
>Last-Modified:  Thu Feb 09 19:38:14 +0000 2017
>Originator:     Vladimir 'phcoder' Serbinenko
>Release:        5.0.1 and -current
sys/arch/amd64/amd64/locore.S seems to map only pages in the range 0x100000-0x1800000 When total amount of loaded modules is higher than that kernel instantly reboots (triple fault). It happes in following chunk of code:
	 * 6.
	 * Finally, we're in long mode. However, we're still
	 * in the identity mapped area (could not jump out
	 * of that earlier because it would have been a > 32bit
	 * jump). We can do that now, so here we go.
	movabsq	$longmode_hi,%rax
	jmp	*%rax
	 * We have arrived.
	 * There's no need anymore for the identity mapping in low
	 * memory, remove it.
	movq	$KERNBASE,%r8

	movq	$(NKL2_KIMG_ENTRIES+1),%rcx
	leaq	(PROC0_PTP2_OFF)(%rsi),%rbx
	addq	%r8, %rbx
1:	movq	$0,(%rbx)
	addq	$8,%rbx
	loop	1b

More exactly on 1:	movq	$0,(%rbx)
It tries to remove some mappings but since page table is after modules if big modules were loaded the memory holding pagetable isn't mapped. Triple fault.
Make a miniroot.kmod with 32MiB image. Load it in bootloader, type boot and see how you get triple-fault reboot instead.
add necessary entries to initial pagetable. LAzy solution would be just to map low 4GiB. Since boot protocol has 32-bit pointers this value can't be exceeded and mapping with 2M pages should be quite easy


From: "Maxime Villard" <>
Subject: PR/42645 CVS commit: src/sys/arch/amd64/amd64
Date: Thu, 9 Feb 2017 19:30:56 +0000

 Module Name:	src
 Committed By:	maxv
 Date:		Thu Feb  9 19:30:56 UTC 2017

 Modified Files:
 	src/sys/arch/amd64/amd64: locore.S

 Log Message:
 If the preloaded modules cannot be mapped with the initial amount of VA,
 discard the associated bootinfo entry. Otherwise the machine faults and
 reboots immediately.

 I spotted this bug more than a year ago, but I recently saw that there is
 already PR/42645 (7 years old), so just fix it. The size has been increased
 in the meantime, so the limit is unlikely to be reached anyway.

 To generate a diff of this commit:
 cvs rdiff -u -r1.120 -r1.121 src/sys/arch/amd64/amd64/locore.S

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-When: Thu, 09 Feb 2017 19:38:14 +0000
fixed - we now discard the modules, and the map is big enough anyway


NetBSD Home
NetBSD PR Database Search

(Contact us) $NetBSD: query-full-pr,v 1.39 2013/11/01 18:47:49 spz Exp $
$NetBSD:,v 1.8 2006/05/07 09:23:38 tsutsui Exp $
Copyright © 1994-2014 The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.