Re: Time to enable partial relro [a stable/11 -r304029 armv6 "PT2MAP abort" (copyout+0x2c4) panic possibly related to enabling RELRO?]

From: Mark Millard <markmi_at_dsl-only.net>
Date: Sat, 27 Aug 2016 03:35:29 -0700
[I've no solid evidence of what the panic is tied to. OPTIONS_FILE_SET+=RELRO ise is just what was new/unusual in the portmaster -DKa that was going on when the rpi2 had the panic.]

The console history shows (the cc quoted just gives a ball park for where it was in the binutils build):

> cc -DHAVE_CONFIG_H -I.  -I. -I. -I../bfd -I./../bfd -I./../include  -pipe -mcpu=cortex-a7  -I/usr/local/include -g -fno-strict-aliasing -DENABLE_PLUGINS -DLOCAL
> EDIR="\"/usr/local/share/locale\"" -mcpu=cortex-a7 -W -Wall -Wstrict-prototypes -Wmissing-prototypes -Wshadow -DELF_LIST_OPTIONS=TRUE -DELF_SHLIB_LIST_OPTIONS=T
> RUE -DELF_PLT_UNWIND_LIST_OPTIONS=TRUE -pipe -mcpu=cortex-a7  -I/usr/local/include -g -fno-strict-aliasing -MT eavrxmega2.o -MD -MP -MF .deps/eavrxmega2.Tpo -c 
> -o eavrxmega2.o eavrxmega2.c
> panic: pmap_fault: PT2MAP abort
> cpuid = 3
> KDB: stack backtrace:
> db_trace_self() at db_trace_self
>          pc = 0xc06b2ad0  lr = 0xc014edf4 (db_trace_self_wrapper+0x30)
>          sp = 0xed27c880  fp = 0xed27c998
> db_trace_self_wrapper() at db_trace_self_wrapper+0x30
>          pc = 0xc014edf4  lr = 0xc0336968 (vpanic+0x13c)
>          sp = 0xed27c9a0  fp = 0xed27c9c0
>          r4 = 0x00000100  r5 = 0xc4125a50
>          r6 = 0xc076ab91  r7 = 0x00000001
> vpanic() at vpanic+0x13c
>          pc = 0xc0336968  lr = 0xc033682c (vpanic)
>          sp = 0xed27c9c8  fp = 0xed27c9cc
>          r4 = 0xc0991ba0  r5 = 0x00000000
>          r6 = 0xbfefefe8  r7 = 0x00000007
>          r8 = 0x00000013  r9 = 0x00000007
>         r10 = 0xc41daf44
> vpanic() at vpanic
>          pc = 0xc033682c  lr = 0xc06ce40c (pmap_fault+0x638)
>          sp = 0xed27c9d4  fp = 0xed27ca08
>          r4 = 0x00000007  r5 = 0x00000013
>          r6 = 0x00000007  r7 = 0xc41daf44
>          r8 = 0xed27c9cc  r9 = 0xc033682c
>         r10 = 0xed27c9d4
> pmap_fault() at pmap_fault+0x638
>          pc = 0xc06ce40c  lr = 0xc06d30f8 (abort_handler+0xbc)
>          sp = 0xed27ca10  fp = 0xed27caa0
>          r4 = 0xc0991ba0  r5 = 0x00000007
>          r6 = 0x00000000  r7 = 0x00000007
>          r8 = 0x00000013  r9 = 0xc4125a50
>         r10 = 0xed27caa8
> abort_handler() at abort_handler+0xbc
>          pc = 0xc06d30f8  lr = 0xc06b53b8 (exception_exit)
>          sp = 0xed27caa8  fp = 0xed27cb60
>          r4 = 0xc0991ba0  r5 = 0x00000000
>          r6 = 0xbfbfaa04  r7 = 0x00000006
>          r8 = 0xc41daf54  r9 = 0x00000806
>         r10 = 0xc41daf44
> exception_exit() at exception_exit
>          pc = 0xc06b53b8  lr = 0xc03131e8 (__mtx_lock_sleep+0x220)
>          sp = 0xed27cb38  fp = 0xed27cb60
>          r0 = 0x002fefe8  r1 = 0xbfc00000
>          r2 = 0xc41daf44  r3 = 0x00000001
>          r4 = 0xc0991ba0  r5 = 0x00000000
>          r6 = 0xbfbfaa04  r7 = 0x00000006
>          r8 = 0xc41daf54  r9 = 0x00000806
>         r10 = 0xc41daf44 r12 = 0xed27ca78
> pmap_fault() at pmap_fault+0x1b4
>          pc = 0xc06cdf88  lr = 0xc06d30f8 (abort_handler+0xbc)
>          sp = 0xed27cb68  fp = 0xed27cbf8
>          r4 = 0x00000030  r5 = 0x00000006
>          r6 = 0x00000000  r7 = 0x00000806
>          r8 = 0x00000013  r9 = 0xc4125a50
>         r10 = 0xed27cc00
> abort_handler() at abort_handler+0xbc
>          pc = 0xc06d30f8  lr = 0xc06b53b8 (exception_exit)
>          sp = 0xed27cc00  fp = 0x00000000
>          r4 = 0x00000030  r5 = 0x00000000
>          r6 = 0x00000000  r7 = 0xed27ccb4
>          r8 = 0xed27ce00  r9 = 0x00000000
>         r10 = 0xed27cea0
> exception_exit() at exception_exit
>          pc = 0xc06b53b8  lr = 0xc06ad77c (copyout+0x9c)
>          sp = 0xed27cc94  fp = 0x00000000
>          r0 = 0xed27ccb8  r1 = 0xbfbfaa04
>          r2 = 0x00000000  r3 = 0x00000000
>          r4 = 0x00000030  r5 = 0x00000000
>          r6 = 0x00000000  r7 = 0xed27ccb4
>          r8 = 0xed27ce00  r9 = 0x00000000
>         r10 = 0xed27cea0 r12 = 0x00000000
> copyout() at copyout+0x2c4
>          pc = 0xc06ad9a4  lr = 0xc06ad77c (copyout+0x9c)
>          sp = 0xed27cc94  fp = 0x00000000
> copyout() at copyout+0x9c
>          pc = 0xc06ad77c  lr = 0xc06ad77c (copyout+0x9c)
>          sp = 0xed27cc94  fp = 0x00000000
> Unwind failure (no registers changed)
> KDB: enter: panic
> [ thread pid 54457 tid 100158 ]
> Stopped at      $d.6:   ldrb    r15, [r15, r15, ror r15]!
> db> 

The portmaster -DKa attempt to rebuild binutils-2.27 on the rpi2 got my first armv6 stable/11 panic (and it has been much longer then that since I've gotten a 11.0-CURRENT panic). I was not around when the panic happened but it is still sitting at the db> serial console prompt and I can enter commands if appropriate.

FreeBSD 11.0 context: The rpi2 was/is at /usr/src/ stable/11 -r304029 : it has been a while since I've updated to track stable/11 . The few differences in my /usr/src are mostly for powerpc and powerpc64 specific changes: I normally use the same tree content everywhere that I build FreeBSD. The build used -mcpu=cortex-a7 as I've been doing since I started tracking the clang 3.8.0 project before it was merged.

Ports context: I had not updated by ports on the rpi2 in a while and I "svnlite updated" my /usr/ports to -r420950, picking the newer option to enable RELRO by default for things that have it. I enabled those defaults. (Doing similarly on amd64 first has had no troubles for me so far, not that I've done much after the portmaster -DKa .)

From the amd64 environment that I did an /usr/ports/ portmaster -DKa update to first, also tied to -r420950:

> # more /var/db/ports/devel_binutils/options
> # This file is auto-generated by 'make config'.
> # Options for binutils-2.27,1
> _OPTIONS_READ=binutils-2.27,1
> _FILE_COMPLETE_OPTIONS_LIST=NLS RELRO
> OPTIONS_FILE_SET+=NLS
> OPTIONS_FILE_SET+=RELRO

> # svnlite info /usr/ports | grep Re[lv][ai:]
> Relative URL: ^/head
> Revision: 420950
> Last Changed Rev: 420950

> # more /etc/make.conf
> WANT_QT_VERBOSE_CONFIGURE=1
> #
> DEFAULT_VERSIONS+=perl5=5.22
> WRKDIRPREFIX=/usr/obj/portswork
> WITH_DEBUG=
> WITH_DEBUG_FILES=
> MALLOC_PRODUCTION=

If I remember right the above are accurate for the rpi2 as well.

I'll note that arm-none-eabi-binutils-2.27,1 built and installed fine earlier in the portmaster -DKa activity. As did pkgconf-1.0.1 and sqlite3-3.14.1 . (The console history goes not go back to earlier then that. (sqlite3 is via dependencies, not something I directly select to build.)

===
Mark Millard
markmi at dsl-only.net
Received on Sat Aug 27 2016 - 08:35:42 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:41:07 UTC