From: Andrew Lutomirski <luto@mit.edu> To: Richard Weinberger <richard@nod.at> Cc: Al Viro <viro@zeniv.linux.org.uk>, user-mode-linux-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org, Linus Torvalds <torvalds@linux-foundation.org> Subject: Re: [RFC] weird crap with vdso on uml/i386 Date: Sat, 20 Aug 2011 17:40:03 -0400 [thread overview] Message-ID: <CAObL_7H8E1fde-d_Kfjrg2mQ5PdAp9X=fVRTqXJKzzYmQ1vAQQ@mail.gmail.com> (raw) In-Reply-To: <CAObL_7FoPHu6AKneswjEmiU4UBjUuKpYahakOaTNXM3=ZCpYaA@mail.gmail.com> On Sat, Aug 20, 2011 at 5:26 PM, Andrew Lutomirski <luto@mit.edu> wrote: > On Sat, Aug 20, 2011 at 4:55 PM, Richard Weinberger <richard@nod.at> wrote: > I'm missing a bit of the background. Is the user-on-UML app calling > into a vdso entry provided by UML or into a vdso entry provided by the > host? > > Why does anything care whether ecx is saved? Doesn't the default > calling convention allow the callee to clobber ecx? > > But my guess is that the 64-bit host sysret code might be buggy (or > the value in gs:whatever is wrong). Can you get gdb to breakpoint at > the beginning of __kernel_vsyscall before the crash? > This is suspicious: ENTRY(ia32_cstar_target) CFI_STARTPROC32 simple CFI_SIGNAL_FRAME CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET CFI_REGISTER rip,rcx /*CFI_REGISTER rflags,r11*/ SWAPGS_UNSAFE_STACK movl %esp,%r8d CFI_REGISTER rsp,r8 movq PER_CPU_VAR(kernel_stack),%rsp /* * No need to follow this irqs on/off section: the syscall * disabled irqs and here we enable it straight after entry: */ ENABLE_INTERRUPTS(CLBR_NONE) SAVE_ARGS 8,0,0 movl %eax,%eax /* zero extension */ movq %rax,ORIG_RAX-ARGOFFSET(%rsp) movq %rcx,RIP-ARGOFFSET(%rsp) CFI_REL_OFFSET rip,RIP-ARGOFFSET movq %rbp,RCX-ARGOFFSET(%rsp) /* this lies slightly to ptrace */ The entry code looks something like: The text of __kernel_vsyscall() is 0xffffe420 <__kernel_vsyscall+0>: push %ebp 0xffffe421 <__kernel_vsyscall+1>: mov %ecx,%ebp 0xffffe423 <__kernel_vsyscall+3>: syscall 0xffffe425 <__kernel_vsyscall+5>: mov $0x2b,%ecx 0xffffe42a <__kernel_vsyscall+10>: mov %ecx,%ss 0xffffe42c <__kernel_vsyscall+12>: mov %ebp,%ecx 0xffffe42e <__kernel_vsyscall+14>: pop %ebp 0xffffe42f <__kernel_vsyscall+15>: ret so the line: movq %rbp,RCX-ARGOFFSET(%rsp) /* this lies slightly to ptrace */ will cause iret (if iret happens) to restore the original rbp in rcx (why? -- it seems okay if syscall is hit in __kernel_vsyscall but not if something else does the syscall). I don't see what saves rbp to the stack frame. This is also suspicious: movq %r11,EFLAGS-ARGOFFSET(%rsp) that's inconsistent with my reading of the AMD manual. How well is the compat syscall entry tested through both the fast and slow paths? UML is unusual in that it uses ptrace to trap all system calls, right? That means that syscalls will enter through the cstar target but return through the iret path. --Andy
WARNING: multiple messages have this Message-ID (diff)
From: Andrew Lutomirski <luto@mit.edu> To: Richard Weinberger <richard@nod.at> Cc: Linus Torvalds <torvalds@linux-foundation.org>, Al Viro <viro@zeniv.linux.org.uk>, user-mode-linux-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org Subject: Re: [uml-devel] [RFC] weird crap with vdso on uml/i386 Date: Sat, 20 Aug 2011 17:40:03 -0400 [thread overview] Message-ID: <CAObL_7H8E1fde-d_Kfjrg2mQ5PdAp9X=fVRTqXJKzzYmQ1vAQQ@mail.gmail.com> (raw) In-Reply-To: <CAObL_7FoPHu6AKneswjEmiU4UBjUuKpYahakOaTNXM3=ZCpYaA@mail.gmail.com> On Sat, Aug 20, 2011 at 5:26 PM, Andrew Lutomirski <luto@mit.edu> wrote: > On Sat, Aug 20, 2011 at 4:55 PM, Richard Weinberger <richard@nod.at> wrote: > I'm missing a bit of the background. Is the user-on-UML app calling > into a vdso entry provided by UML or into a vdso entry provided by the > host? > > Why does anything care whether ecx is saved? Doesn't the default > calling convention allow the callee to clobber ecx? > > But my guess is that the 64-bit host sysret code might be buggy (or > the value in gs:whatever is wrong). Can you get gdb to breakpoint at > the beginning of __kernel_vsyscall before the crash? > This is suspicious: ENTRY(ia32_cstar_target) CFI_STARTPROC32 simple CFI_SIGNAL_FRAME CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET CFI_REGISTER rip,rcx /*CFI_REGISTER rflags,r11*/ SWAPGS_UNSAFE_STACK movl %esp,%r8d CFI_REGISTER rsp,r8 movq PER_CPU_VAR(kernel_stack),%rsp /* * No need to follow this irqs on/off section: the syscall * disabled irqs and here we enable it straight after entry: */ ENABLE_INTERRUPTS(CLBR_NONE) SAVE_ARGS 8,0,0 movl %eax,%eax /* zero extension */ movq %rax,ORIG_RAX-ARGOFFSET(%rsp) movq %rcx,RIP-ARGOFFSET(%rsp) CFI_REL_OFFSET rip,RIP-ARGOFFSET movq %rbp,RCX-ARGOFFSET(%rsp) /* this lies slightly to ptrace */ The entry code looks something like: The text of __kernel_vsyscall() is 0xffffe420 <__kernel_vsyscall+0>: push %ebp 0xffffe421 <__kernel_vsyscall+1>: mov %ecx,%ebp 0xffffe423 <__kernel_vsyscall+3>: syscall 0xffffe425 <__kernel_vsyscall+5>: mov $0x2b,%ecx 0xffffe42a <__kernel_vsyscall+10>: mov %ecx,%ss 0xffffe42c <__kernel_vsyscall+12>: mov %ebp,%ecx 0xffffe42e <__kernel_vsyscall+14>: pop %ebp 0xffffe42f <__kernel_vsyscall+15>: ret so the line: movq %rbp,RCX-ARGOFFSET(%rsp) /* this lies slightly to ptrace */ will cause iret (if iret happens) to restore the original rbp in rcx (why? -- it seems okay if syscall is hit in __kernel_vsyscall but not if something else does the syscall). I don't see what saves rbp to the stack frame. This is also suspicious: movq %r11,EFLAGS-ARGOFFSET(%rsp) that's inconsistent with my reading of the AMD manual. How well is the compat syscall entry tested through both the fast and slow paths? UML is unusual in that it uses ptrace to trap all system calls, right? That means that syscalls will enter through the cstar target but return through the iret path. --Andy ------------------------------------------------------------------------------ Get a FREE DOWNLOAD! and learn more about uberSVN rich system, user administration capabilities and model configuration. Take the hassle out of deploying and managing Subversion and the tools developers use with it. http://p.sf.net/sfu/wandisco-d2d-2 _______________________________________________ User-mode-linux-devel mailing list User-mode-linux-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel
next prev parent reply other threads:[~2011-08-20 21:40 UTC|newest] Thread overview: 161+ messages / expand[flat|nested] mbox.gz Atom feed top 2011-08-18 18:58 Subject: [PATCH 00/91] pending uml patches Al Viro 2011-08-18 18:58 ` [uml-devel] " Al Viro 2011-08-18 19:12 ` Richard Weinberger 2011-08-18 19:12 ` [uml-devel] " Richard Weinberger 2011-08-18 19:19 ` Al Viro 2011-08-18 19:19 ` [uml-devel] " Al Viro 2011-08-19 4:31 ` Al Viro 2011-08-19 8:51 ` Richard Weinberger 2011-08-19 8:51 ` [uml-devel] " Richard Weinberger 2011-08-20 1:18 ` [RFC] weird crap with vdso on uml/i386 Al Viro 2011-08-20 15:22 ` Richard Weinberger 2011-08-20 20:14 ` Al Viro 2011-08-20 20:14 ` [uml-devel] " Al Viro 2011-08-20 20:55 ` Richard Weinberger 2011-08-20 21:26 ` Andrew Lutomirski 2011-08-20 21:26 ` Andrew Lutomirski 2011-08-20 21:38 ` Richard Weinberger 2011-08-20 21:38 ` [uml-devel] " Richard Weinberger 2011-08-20 21:40 ` Andrew Lutomirski [this message] 2011-08-20 21:40 ` Andrew Lutomirski 2011-08-21 6:34 ` Al Viro 2011-08-21 6:34 ` [uml-devel] " Al Viro 2011-08-21 8:42 ` SYSCALL, ptrace and syscall restart breakages (Re: [RFC] weird crap with vdso on uml/i386) Al Viro 2011-08-21 8:42 ` [uml-devel] " Al Viro 2011-08-21 11:24 ` Andrew Lutomirski 2011-08-21 11:24 ` [uml-devel] " Andrew Lutomirski 2011-08-21 13:37 ` Andrew Lutomirski 2011-08-21 13:37 ` [uml-devel] " Andrew Lutomirski 2011-08-21 14:51 ` Al Viro 2011-08-21 14:51 ` [uml-devel] " Al Viro 2011-08-21 14:43 ` Al Viro 2011-08-21 16:41 ` Al Viro 2011-08-21 16:41 ` [uml-devel] " Al Viro 2011-08-22 0:44 ` Andrew Lutomirski 2011-08-22 0:44 ` Andrew Lutomirski 2011-08-22 1:09 ` Linus Torvalds 2011-08-22 1:19 ` Al Viro 2011-08-22 1:19 ` [uml-devel] " Al Viro 2011-08-22 1:19 ` H. Peter Anvin 2011-08-22 1:19 ` [uml-devel] " H. Peter Anvin 2011-08-22 21:25 ` [tip:x86/urgent] x86-32, vdso: On system call restart after SYSENTER, use int $0x80 tip-bot for H. Peter Anvin 2011-08-23 23:40 ` tip-bot for H. Peter Anvin 2011-08-22 1:16 ` SYSCALL, ptrace and syscall restart breakages (Re: [RFC] weird crap with vdso on uml/i386) Al Viro 2011-08-22 1:16 ` [uml-devel] " Al Viro 2011-08-22 1:41 ` Linus Torvalds 2011-08-22 1:41 ` [uml-devel] " Linus Torvalds 2011-08-22 1:48 ` H. Peter Anvin 2011-08-22 1:48 ` [uml-devel] " H. Peter Anvin 2011-08-22 2:01 ` Andrew Lutomirski 2011-08-22 2:01 ` [uml-devel] " Andrew Lutomirski 2011-08-22 2:07 ` Al Viro 2011-08-22 2:07 ` [uml-devel] " Al Viro 2011-08-22 2:26 ` Andrew Lutomirski 2011-08-22 2:26 ` [uml-devel] " Andrew Lutomirski 2011-08-22 2:34 ` H. Peter Anvin 2011-08-22 2:34 ` [uml-devel] " H. Peter Anvin 2011-08-22 4:05 ` H. Peter Anvin 2011-08-22 4:05 ` [uml-devel] " H. Peter Anvin 2011-08-22 9:53 ` Ingo Molnar 2011-08-22 13:34 ` Andrew Lutomirski 2011-08-22 13:34 ` Andrew Lutomirski 2011-08-22 14:40 ` Borislav Petkov 2011-08-22 14:40 ` Borislav Petkov 2011-08-22 15:13 ` Al Viro 2011-08-22 15:13 ` Al Viro 2011-08-22 20:05 ` Linus Torvalds 2011-08-22 20:05 ` Linus Torvalds 2011-08-22 20:11 ` H. Peter Anvin 2011-08-22 20:11 ` H. Peter Anvin 2011-08-22 21:52 ` Andrew Lutomirski 2011-08-22 21:52 ` Andrew Lutomirski 2011-08-22 22:04 ` H. Peter Anvin 2011-08-22 22:04 ` H. Peter Anvin 2011-08-22 23:27 ` Linus Torvalds 2011-08-22 23:46 ` H. Peter Anvin 2011-08-22 23:46 ` H. Peter Anvin 2011-08-23 0:03 ` Al Viro 2011-08-23 0:03 ` Al Viro 2011-08-23 0:07 ` Al Viro 2011-08-23 0:07 ` Al Viro 2011-08-23 0:07 ` H. Peter Anvin 2011-08-23 0:07 ` H. Peter Anvin 2011-08-23 0:22 ` Linus Torvalds 2011-08-23 0:22 ` Linus Torvalds 2011-08-23 1:01 ` Al Viro 2011-08-23 1:13 ` Al Viro 2011-08-23 1:13 ` Al Viro 2011-08-23 1:59 ` Linus Torvalds 2011-08-23 1:59 ` Linus Torvalds 2011-08-23 2:59 ` Al Viro 2011-08-23 2:59 ` Al Viro 2011-08-23 2:17 ` Al Viro 2011-08-23 6:15 ` Al Viro 2011-08-23 14:26 ` Borislav Petkov 2011-08-23 16:30 ` Al Viro 2011-08-23 16:30 ` Al Viro 2011-08-23 16:03 ` Linus Torvalds 2011-08-23 16:03 ` Linus Torvalds 2011-08-23 16:11 ` Andrew Lutomirski 2011-08-23 16:11 ` Andrew Lutomirski 2011-08-23 16:20 ` Linus Torvalds 2011-08-23 16:20 ` Linus Torvalds 2011-08-23 17:33 ` Al Viro 2011-08-23 17:33 ` Al Viro 2011-08-23 18:04 ` Al Viro 2011-08-23 18:04 ` Al Viro 2011-08-24 12:44 ` [PATCH] x86, asm: Document some of the syscall asm glue Borislav Petkov 2011-08-23 16:22 ` [uml-devel] SYSCALL, ptrace and syscall restart breakages (Re: [RFC] weird crap with vdso on uml/i386) Borislav Petkov 2011-08-23 16:29 ` Linus Torvalds 2011-08-23 16:53 ` Al Viro 2011-08-23 16:53 ` Al Viro 2011-08-23 16:58 ` Richard Weinberger 2011-08-23 16:58 ` Richard Weinberger 2011-08-23 17:07 ` Al Viro 2011-08-23 17:07 ` Al Viro 2011-08-23 17:29 ` Richard Weinberger 2011-08-23 17:29 ` Richard Weinberger 2011-08-25 0:05 ` Richard Weinberger 2011-08-23 19:15 ` H. Peter Anvin 2011-08-23 19:15 ` H. Peter Anvin 2011-08-23 20:56 ` Borislav Petkov 2011-08-23 21:06 ` H. Peter Anvin 2011-08-23 21:10 ` Borislav Petkov 2011-08-23 23:04 ` H. Peter Anvin 2011-08-23 23:04 ` H. Peter Anvin 2011-08-24 21:10 ` H. Peter Anvin 2011-08-24 21:10 ` H. Peter Anvin 2011-08-23 16:48 ` Al Viro 2011-08-23 16:48 ` Al Viro 2011-08-23 17:33 ` Linus Torvalds 2011-08-23 17:33 ` Linus Torvalds 2011-08-23 21:08 ` H. Peter Anvin 2011-08-23 21:08 ` H. Peter Anvin 2011-08-23 21:20 ` Linus Torvalds 2011-08-23 21:20 ` Linus Torvalds 2011-08-23 23:04 ` H. Peter Anvin 2011-08-23 23:04 ` H. Peter Anvin 2011-08-23 19:18 ` H. Peter Anvin 2011-08-23 19:18 ` H. Peter Anvin 2011-08-23 19:24 ` Linus Torvalds 2011-08-23 19:24 ` Linus Torvalds 2011-08-23 19:26 ` H. Peter Anvin 2011-08-23 19:26 ` H. Peter Anvin 2011-08-23 19:41 ` Al Viro 2011-08-23 19:41 ` Al Viro 2011-08-23 19:43 ` Linus Torvalds 2011-08-23 19:43 ` Linus Torvalds 2011-08-23 21:17 ` Al Viro 2011-08-23 21:17 ` Al Viro 2011-08-23 1:16 ` Andrew Lutomirski 2011-08-23 1:18 ` H. Peter Anvin 2011-08-23 1:18 ` H. Peter Anvin 2011-08-22 4:07 ` Al Viro 2011-08-22 4:11 ` H. Peter Anvin 2011-08-22 4:11 ` [uml-devel] " H. Peter Anvin 2011-08-22 4:26 ` Al Viro 2011-08-22 4:26 ` [uml-devel] " Al Viro 2011-08-22 5:03 ` H. Peter Anvin 2011-08-22 5:03 ` [uml-devel] " H. Peter Anvin 2011-08-23 5:10 ` Andrew Lutomirski 2011-08-23 5:10 ` [uml-devel] " Andrew Lutomirski
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to='CAObL_7H8E1fde-d_Kfjrg2mQ5PdAp9X=fVRTqXJKzzYmQ1vAQQ@mail.gmail.com' \ --to=luto@mit.edu \ --cc=linux-kernel@vger.kernel.org \ --cc=richard@nod.at \ --cc=torvalds@linux-foundation.org \ --cc=user-mode-linux-devel@lists.sourceforge.net \ --cc=viro@zeniv.linux.org.uk \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.