JVM can't protect protection page about sgx-lkl HOT 5 CLOSED

Ok,thank you @cpriebe ,now after update my ubuntu to 18.04,this problem has been resolved.
As the changelog shows,the 4.4.150 kernel and 4.17 kernel also resolved this bug.i believe it is available!
Thank you!

from sgx-lkl.

This is most likely due to a Linux kernel bug introduced by the changes related to the L1TF/Foreshadow mitigations (see https://lkml.org/lkml/2018/8/14/887).

The actual bug and the fix are described here: https://lkml.org/lkml/2018/8/16/697

[...]
Manifested as an unexpected mprotect(..., PROT_NONE) failure when
called on a VMA that has VM_PFNMAP and was mmap'd to as something
other than PROT_NONE but never used.  mprotect() sends the PROT_NONE
request down prot_none_walk(), which walks the PTEs to check the PFNs.
prot_none_pte_entry() gets the bogus PFN from pte_pfn() and returns
-EACCES because it thinks mprotect() is trying to adjust a high MMIO
address

This has already been patched upstream. Looking at the Ubuntu kernel changelogs (https://launchpad.net/ubuntu/+source/linux/+changelog, search for "x86/speculation/l1tf: Exempt zeroed PTEs from inversion"), it seems like the patch has been applied to the 4.17 kernel used by Ubuntu 18.10, but hasn't made it into the 16.04/18.04 LTS kernels.

To summarize, the solution here is to use a recent version of the kernel that includes the x86/speculation/l1tf: Exempt zeroed PTEs from inversion patch.

from sgx-lkl.

This has been resolved a while ago in the official 16.04 and 18.10 Ubuntu kernels. This finally has been backported to the 4.15 kernel used by Ubuntu 18.04. The new kernel version that includes the fix has officially been released today.

See the corresponding bug report here: https://bugs.launchpad.net/ubuntu/+bug/1799237

For Ubuntu 18.04 the bug is fixed in kernel version 4.15.0-46.49.

I am closing this issue.

from sgx-lkl.

hi @cpriebe ，Recently,I meet the same error when i running applications on the JVM on top of SGX-LKL(ubuntu16.04 4.15.0-46-generic ),to resolve the probleam,i must update ubuntu 16.04 to ubuntu 18.04?

from sgx-lkl.

Hi @Zxiaoyu95

I am not entirely sure whether the fix is available as part of the Ubuntu 16.04 4.15 image (4.15.0-46.49~16.04.1). But it should be fixed in the 4.4 kernel that is used by 16.04 by default. You could downgrade to that. As you suggested, you could also update to 18.04. In any case, you need to use a kernel with the fix applied. Upstream this has been fixed from I believe 4.17.17 and onward.

You can check which of the official Ubuntu kernel images have the fix applied to them here:

https://launchpad.net/ubuntu/+source/linux/+changelog

Search for x86/speculation/l1tf: Exempt zeroed PTEs from inversion to find where and when the fix has been backported.

from sgx-lkl.