From: Steven Rostedt <rostedt@goodmis.org>
To: linux-kernel@vger.kernel.org
Cc: Ingo Molnar <mingo@elte.hu>,
Andrew Morton <akpm@linux-foundation.org>,
"H. Peter Anvin" <hpa@zytor.com>
Subject: [PATCH][GIT PULL][v3.3] x86: Test saved %rip in NMI to determine nested NMI
Date: Sat, 18 Feb 2012 21:06:13 -0500 [thread overview]
Message-ID: <1329617173.1561.5.camel@acer.local.home> (raw)
Ingo,
I found that it is possible for userspace to prevent an NMI from
triggering while it is running by setting its stack pointer to that of
the NMI stack. This tricks the NMI nested algorithm in thinking that the
NMI is nested. The easy solution to this is to test the %rip to make
sure that the NMI happened in kernel mode before testing for nesting.
I've tested a program that exhibits the missing NMIs and this patch
corrects that behavior.
-- Steve
Please pull the latest tip/perf/urgent tree, which can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git
tip/perf/urgent
Head SHA1: b80ddc7b1636474297815d47fbfed7552f9b8f2c
Steven Rostedt (1):
x86: Test saved %rip in NMI to determine nested NMI
----
arch/x86/kernel/entry_64.S | 8 ++++++++
1 files changed, 8 insertions(+), 0 deletions(-)
---------------------------
commit b80ddc7b1636474297815d47fbfed7552f9b8f2c
Author: Steven Rostedt <srostedt@redhat.com>
Date: Sat Feb 18 20:26:52 2012 -0500
x86: Test saved %rip in NMI to determine nested NMI
Currently, the NMI handler tests if it is nested by checking the
special variable saved no the stack (set during NMI handling) and
whether the saved stack is the NMI stack as well (to prevent the race
when the variable is set to zero). But userspace may set their %rsp
to any value as long as the do not derefence it, and it may make it
point to the NMI stack, which will prevent NMIs from triggering while
the userspace app is running. (I tested this, and it is indeed the case)
Add another check to determine nested NMIs by looking at the saved
%rip and making sure that it is a kernel pointer (negative).
Cc: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 3fe8239..7c35a7a 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -1532,6 +1532,14 @@ ENTRY(nmi)
pushq_cfi %rdx
/*
+ * If the RIP is not negative then we are in userspace where this is not
+ * a nested NMI.
+ */
+ movq 8(%rsp), %rdx
+ testq %rdx, %rdx
+ jns first_nmi
+
+ /*
* Check the special variable on the stack to see if NMIs are
* executing.
*/
next reply other threads:[~2012-02-19 2:06 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-02-19 2:06 Steven Rostedt [this message]
2012-02-19 12:56 ` [PATCH][GIT PULL][v3.3] x86: Test saved %rip in NMI to determine nested NMI Ingo Molnar
2012-02-19 13:46 ` hpanvin@gmail.com
2012-02-19 13:48 ` Ingo Molnar
2012-02-19 20:34 ` Steven Rostedt
2012-02-19 20:45 ` H. Peter Anvin
2012-02-19 21:00 ` Steven Rostedt
2012-02-19 14:57 ` Steven Rostedt
2012-02-20 8:10 ` Ingo Molnar
2012-02-20 14:41 ` Steven Rostedt
2012-02-20 15:34 ` Ingo Molnar
2012-02-20 17:07 ` H. Peter Anvin
2012-02-19 21:43 ` [PATCH v2][GIT PULL][v3.3] x86: Test saved %cs " Steven Rostedt
2012-02-20 11:47 ` [tip:x86/urgent] x86/nmi: Test saved %cs in NMI to determine nested NMI case tip-bot for Steven Rostedt
2012-02-20 16:51 ` Steven Rostedt
2012-02-27 21:29 ` Greg KH
2012-02-20 18:03 ` Linus Torvalds
2012-02-20 18:26 ` Steven Rostedt
2012-02-21 22:08 ` [tip:x86/urgent] x86: Specify a size for the cmp in the NMI handler tip-bot for Steven Rostedt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1329617173.1561.5.camel@acer.local.home \
--to=rostedt@goodmis.org \
--cc=akpm@linux-foundation.org \
--cc=hpa@zytor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@elte.hu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).