[BUG] Huge-leaf translation and splitting confuse PAT with physical address bits #30
Labels
No labels
bug
ci
docs
duplicate
enhancement
help wanted
invalid
performance
phase-6
question
refactor
security
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
erix/kernel#30
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Huge-page PAT bit 12 was included in physical-address arithmetic by scalar translation, batched backing translation and diagnostic snapshots. Splitting a 2 MiB leaf also shifted physical backing and lost the final-level PAT selector. New table references inherited leaf cache/global bits. The correction is implemented and verified locally; no original native exploit or universal boot failure is claimed.
Reproduction
The original base is Kernel
12184850cd73fff066abcb7f97039a0828b2a928. An extraction of the existing address/split arithmetic into a shared helper enables five independent host controls. Four fail and the ordinary PAT-zero WriteBack control passes, with Cargo status 101 and no compiler warnings. PAT index 4 introduces a 4096-byte physical bias; the first small-page child and equivalent snapshot differ from independent expected addresses; new table branch flags include leaf cache/global state. The original source, extraction patch, controls and complete process evidence are retained. This is a focused arithmetic reproduction, not an unchanged-clean-checkout or native exploit reproduction.Expected and actual behavior
Address decoding must follow the actual leaf level. Both splitting levels must preserve the physical extent, leaf permissions, observations and cache index, reencoding PAT from bit 12 to bit 7 for final 4 KiB leaves. Newly allocated table pages require their own WriteBack policy. Malformed huge address geometry must fail before publication. Ordinary PAT-zero mappings passing the original positive control do not establish correctness for other cache indices.
The corrected shared geometry now serves both translators, native split preparation, diagnostic snapshots and supervisor-baseline validation. It adds no userspace cache-selection API or new mapping authority. Temporary native probe mappings retain backing and table ownership until exact parent restoration and invalidation, including old global translations.
Environment and identity
Host validation uses Linux x86_64, Rust 1.97.1, warning-denied builds and original pinned dependencies. The coordinated Integration catalog selects the exact signed correction. Native coverage runs the maintained x86_64 VM scenarios under their original grants and 60/120-second deadlines. The new native probe covers a real 2 MiB huge leaf with PAT index 4 and its 4 KiB split; it verifies existing PAT entries 0 and 4 are both WriteBack without reprogramming PAT. Host controls additionally cover 1 GiB leaves and both complete split levels. No runtime 1 GiB test or processor-specific MAXPHYADDR expansion is claimed.
Evidence and prior checks
Eleven new controls cover all eight cache indices, complete splitting extents, permissions, reserved geometry, nonleaf refusal and address boundaries. Four strict host configurations pass 796/820 tests with three existing ignored cases; sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. All 172 maintained Integration helpers pass.
Six native executions satisfy seven contracts: mapping and sparse checks sharing the same runtime configuration, lifetime revocation, owned invocation, both allocator scenarios and ordinary exec-successor across all 73 components. Exact signed source and retained packaged artifacts are verified, with no image warnings or QEMU stderr. The new mapping witness appears only after real reads, both production translators, split-policy verification and complete restoration. The technical manual passes 45 tests, complete 2,433-page generation, all 451,388 word bounds and changed-page visual review without final warnings or overflow.
Publication CI: Kernel 654/655 and Docs 1019/1020 pass. Eight complete original logs (1,592,794 bytes) confirm Kernel 796/820 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration 1735/1736 remains queued and has no completed acceptance. Complete corrected CI review remains required before closing this report; original failures remain retained.
Tracking
Related owned address-space design, Kernel compatibility, Kernel audit, Kernel review, Integration review and Phase 6 completion. Private VSpace population, CR3 activation, live-root reclamation and complete guest rebuilding remain separate obligations. Earlier ext4 CI deadline failures remain unresolved.