[BUG] Huge-leaf translation and splitting confuse PAT with physical address bits #30

Open
opened 2026-09-22 08:32:10 +02:00 by erikinkinen · 0 comments
Owner

Summary

Huge-page PAT bit 12 was included in physical-address arithmetic by scalar translation, batched backing translation and diagnostic snapshots. Splitting a 2 MiB leaf also shifted physical backing and lost the final-level PAT selector. New table references inherited leaf cache/global bits. The correction is implemented and verified locally; no original native exploit or universal boot failure is claimed.

Reproduction

The original base is Kernel 12184850cd73fff066abcb7f97039a0828b2a928. An extraction of the existing address/split arithmetic into a shared helper enables five independent host controls. Four fail and the ordinary PAT-zero WriteBack control passes, with Cargo status 101 and no compiler warnings. PAT index 4 introduces a 4096-byte physical bias; the first small-page child and equivalent snapshot differ from independent expected addresses; new table branch flags include leaf cache/global state. The original source, extraction patch, controls and complete process evidence are retained. This is a focused arithmetic reproduction, not an unchanged-clean-checkout or native exploit reproduction.

Expected and actual behavior

Address decoding must follow the actual leaf level. Both splitting levels must preserve the physical extent, leaf permissions, observations and cache index, reencoding PAT from bit 12 to bit 7 for final 4 KiB leaves. Newly allocated table pages require their own WriteBack policy. Malformed huge address geometry must fail before publication. Ordinary PAT-zero mappings passing the original positive control do not establish correctness for other cache indices.

The corrected shared geometry now serves both translators, native split preparation, diagnostic snapshots and supervisor-baseline validation. It adds no userspace cache-selection API or new mapping authority. Temporary native probe mappings retain backing and table ownership until exact parent restoration and invalidation, including old global translations.

Environment and identity

Host validation uses Linux x86_64, Rust 1.97.1, warning-denied builds and original pinned dependencies. The coordinated Integration catalog selects the exact signed correction. Native coverage runs the maintained x86_64 VM scenarios under their original grants and 60/120-second deadlines. The new native probe covers a real 2 MiB huge leaf with PAT index 4 and its 4 KiB split; it verifies existing PAT entries 0 and 4 are both WriteBack without reprogramming PAT. Host controls additionally cover 1 GiB leaves and both complete split levels. No runtime 1 GiB test or processor-specific MAXPHYADDR expansion is claimed.

Evidence and prior checks

Eleven new controls cover all eight cache indices, complete splitting extents, permissions, reserved geometry, nonleaf refusal and address boundaries. Four strict host configurations pass 796/820 tests with three existing ignored cases; sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. All 172 maintained Integration helpers pass.

Six native executions satisfy seven contracts: mapping and sparse checks sharing the same runtime configuration, lifetime revocation, owned invocation, both allocator scenarios and ordinary exec-successor across all 73 components. Exact signed source and retained packaged artifacts are verified, with no image warnings or QEMU stderr. The new mapping witness appears only after real reads, both production translators, split-policy verification and complete restoration. The technical manual passes 45 tests, complete 2,433-page generation, all 451,388 word bounds and changed-page visual review without final warnings or overflow.

Publication CI: Kernel 654/655 and Docs 1019/1020 pass. Eight complete original logs (1,592,794 bytes) confirm Kernel 796/820 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration 1735/1736 remains queued and has no completed acceptance. Complete corrected CI review remains required before closing this report; original failures remain retained.

Tracking

Related owned address-space design, Kernel compatibility, Kernel audit, Kernel review, Integration review and Phase 6 completion. Private VSpace population, CR3 activation, live-root reclamation and complete guest rebuilding remain separate obligations. Earlier ext4 CI deadline failures remain unresolved.

## Summary Huge-page PAT bit 12 was included in physical-address arithmetic by scalar translation, batched backing translation and diagnostic snapshots. Splitting a 2 MiB leaf also shifted physical backing and lost the final-level PAT selector. New table references inherited leaf cache/global bits. The correction is implemented and verified locally; no original native exploit or universal boot failure is claimed. ## Reproduction The original base is Kernel `12184850cd73fff066abcb7f97039a0828b2a928`. An extraction of the existing address/split arithmetic into a shared helper enables five independent host controls. Four fail and the ordinary PAT-zero WriteBack control passes, with Cargo status 101 and no compiler warnings. PAT index 4 introduces a 4096-byte physical bias; the first small-page child and equivalent snapshot differ from independent expected addresses; new table branch flags include leaf cache/global state. The original source, extraction patch, controls and complete process evidence are retained. This is a focused arithmetic reproduction, not an unchanged-clean-checkout or native exploit reproduction. ## Expected and actual behavior Address decoding must follow the actual leaf level. Both splitting levels must preserve the physical extent, leaf permissions, observations and cache index, reencoding PAT from bit 12 to bit 7 for final 4 KiB leaves. Newly allocated table pages require their own WriteBack policy. Malformed huge address geometry must fail before publication. Ordinary PAT-zero mappings passing the original positive control do not establish correctness for other cache indices. The [corrected shared geometry](https://git.erikinkinen.fi/erix/kernel/commit/4f9cfcaeb63e9080f6d6a3e9fd190e6cb288c6fc) now serves both translators, native split preparation, diagnostic snapshots and supervisor-baseline validation. It adds no userspace cache-selection API or new mapping authority. Temporary native probe mappings retain backing and table ownership until exact parent restoration and invalidation, including old global translations. ## Environment and identity Host validation uses Linux x86_64, Rust 1.97.1, warning-denied builds and original pinned dependencies. The [coordinated Integration catalog](https://git.erikinkinen.fi/erix/integration/commit/ccc32eed0b4029a1ef82279c665811692c859985) selects the exact signed correction. Native coverage runs the maintained x86_64 VM scenarios under their original grants and 60/120-second deadlines. The new native probe covers a real 2 MiB huge leaf with PAT index 4 and its 4 KiB split; it verifies existing PAT entries 0 and 4 are both WriteBack without reprogramming PAT. Host controls additionally cover 1 GiB leaves and both complete split levels. No runtime 1 GiB test or processor-specific MAXPHYADDR expansion is claimed. ## Evidence and prior checks Eleven new controls cover all eight cache indices, complete splitting extents, permissions, reserved geometry, nonleaf refusal and address boundaries. Four strict host configurations pass 796/820 tests with three existing ignored cases; sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. All 172 maintained Integration helpers pass. Six native executions satisfy seven contracts: mapping and sparse checks sharing the same runtime configuration, lifetime revocation, owned invocation, both allocator scenarios and ordinary exec-successor across all 73 components. Exact signed source and retained packaged artifacts are verified, with no image warnings or QEMU stderr. The new mapping witness appears only after real reads, both production translators, split-policy verification and complete restoration. The [technical manual](https://git.erikinkinen.fi/erix/docs/commit/587a280f59e55598e3a26b788d589955ebb84212) passes 45 tests, complete 2,433-page generation, all 451,388 word bounds and changed-page visual review without final warnings or overflow. Publication CI: Kernel [654](https://git.erikinkinen.fi/erix/kernel/actions/runs/654)/[655](https://git.erikinkinen.fi/erix/kernel/actions/runs/655) and Docs [1019](https://git.erikinkinen.fi/erix/docs/actions/runs/1019)/[1020](https://git.erikinkinen.fi/erix/docs/actions/runs/1020) pass. Eight complete original logs (1,592,794 bytes) confirm Kernel 796/820 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration [1735](https://git.erikinkinen.fi/erix/integration/actions/runs/1735)/[1736](https://git.erikinkinen.fi/erix/integration/actions/runs/1736) remains queued and has no completed acceptance. Complete corrected CI review remains required before closing this report; original failures remain retained. ## Tracking Related [owned address-space design](https://git.erikinkinen.fi/erix/kernel/issues/22), [Kernel compatibility](https://git.erikinkinen.fi/erix/kernel/issues/1), [Kernel audit](https://git.erikinkinen.fi/erix/kernel/issues/2), [Kernel review](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration review](https://git.erikinkinen.fi/erix/integration/pulls/12) and [Phase 6 completion](https://git.erikinkinen.fi/erix/integration/issues/65). Private VSpace population, CR3 activation, live-root reclamation and complete guest rebuilding remain separate obligations. Earlier [ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
erix/kernel#30
No description provided.