From: Vegard Nossum <vegard.nossum@oracle.com>
To: Sasha Levin <sashal@kernel.org>,
linux-kernel@vger.kernel.org, tglx@linutronix.de,
luto@kernel.org
Cc: tony.luck@intel.com, ak@linux.intel.com, chang.seok.bae@intel.com
Subject: Re: [PATCH v10 00/18] Enable FSGSBASE instructions
Date: Sun, 10 May 2020 10:29:47 +0200 [thread overview]
Message-ID: <d7111932-6ba5-1484-4347-210d9e80316f@oracle.com> (raw)
In-Reply-To: <5a6a0ef5-4dfc-d0b1-9181-5df4211cfcd9@oracle.com>
On 5/10/20 10:09 AM, Vegard Nossum wrote:
>
> On 4/24/20 1:21 AM, Sasha Levin wrote:
>> Benefits:
>> Currently a user process that wishes to read or write the FS/GS base must
>> make a system call. But recent X86 processors have added new instructions
>> for use in 64-bit mode that allow direct access to the FS and GS segment
>> base addresses. The operating system controls whether applications can
>> use these instructions with a %cr4 control bit.
[...]
> So FWIW I've done some overnight fuzz testing of this patch set and
> haven't seen any problems. Will try a couple of other kernel configs too.
I spoke a few minutes too soon. Just hit this, if anybody wants to have
a look:
[ 6402.786418] ------------[ cut here ]------------
[ 6402.787769] WARNING: CPU: 0 PID: 13802 at arch/x86/kernel/traps.c:811
do_debug+0x16c/0x210
[ 6402.790042] CPU: 0 PID: 13802 Comm: init Not tainted 5.7.0-rc4+ #194
[ 6402.791779] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 6402.793365] RIP: 0010:do_debug+0x16c/0x210
[ 6402.794496] Code: ef e8 f8 fb 00 00 f6 85 91 00 00 00 02 74 b9 fa 66
66 90 66 66 90 e8 c3 f5 11 00 eb ab f6 85 88 00 00 00 03 0f 85 6e ff ff
ff <0f> 0b 80 e4 bf 49 89 84 24 58 0a 00 00 f0 41 80 0c 24 10 48 81 a5
[ 6402.799557] RSP: 0000:fffffe0000011f20 EFLAGS: 00010046
[ 6402.800995] RAX: 0000000000004002 RBX: 0000000000000000 RCX:
00000000ffffffff
[ 6402.802959] RDX: 0000000000000000 RSI: 0000000000000003 RDI:
ffffffff82471e60
[ 6402.804891] RBP: fffffe0000011f58 R08: 0000000000000000 R09:
0000000000000005
[ 6402.806836] R10: 0000000000000000 R11: 0000000000000000 R12:
ffff88803e739a00
[ 6402.808775] R13: 0000000000000000 R14: 000000003ce24000 R15:
0000000000000000
[ 6402.810723] FS: 000000000097a8c0(0000) GS:ffff88803ec00000(0000)
knlGS:0000000000000000
[ 6402.812933] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 6402.814509] CR2: 0000000040000010 CR3: 000000003ce24000 CR4:
00000000000006f0
[ 6402.816468] DR0: 0000000000000001 DR1: 0000000040006070 DR2:
00007ffff7ffd000
[ 6402.818406] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7:
0000000003b3062a
[ 6402.820353] Call Trace:
[ 6402.821043] <#DB>
[ 6402.821622] debug+0x37/0x70
[ 6402.822449] RIP: 0010:arch_stack_walk_user+0x79/0x110
[ 6402.823851] Code: b8 f0 ff ff bf be f0 df ff ff 48 0f 44 c6 48 39 d0
0f 82 94 00 00 00 41 83 87 b8 09 00 00 01 66 66 90 0f ae e8 31 c0 48 8b
1a <66> 66 90 85 c0 75 72 66 66 90 0f ae e8 48 8b 72 08 66 66 90 85 c0
[ 6402.828923] RSP: 0000:ffffc90003807d80 EFLAGS: 00000046
[ 6402.830346] RAX: 0000000000000000 RBX: 0040001000bf4800 RCX:
0000000000000001
[ 6402.832288] RDX: 0000000040006073 RSI: 00000000400060dd RDI:
ffffc90003807db8
[ 6402.834250] RBP: ffffc90003807f58 R08: 0000000000000001 R09:
ffff88803e444400
[ 6402.836203] R10: 000000000000054c R11: ffff88803d2d955c R12:
ffff88803e739a00
[ 6402.838139] R13: ffffffff810f16a0 R14: ffffc90003807db8 R15:
ffff88803e739a00
[ 6402.840083] ? profile_setup.cold+0xa1/0xa1
[ 6402.841235] </#DB>
[ 6402.841836] stack_trace_save_user+0x8c/0xd4
[ 6402.843045] trace_buffer_unlock_commit_regs+0x122/0x1a0
[ 6402.844501] trace_event_buffer_commit+0x6d/0x240
[ 6402.845799] trace_event_raw_event_preemptirq_template+0x75/0xc0
[ 6402.847441] ? debug+0x53/0x70
[ 6402.848299] ? trace_hardirqs_off_thunk+0x1a/0x33
[ 6402.849593] trace_hardirqs_off_caller+0xa6/0xd0
[ 6402.850862] ? debug+0x4e/0x70
[ 6402.851727] trace_hardirqs_off_thunk+0x1a/0x33
[ 6402.852983] debug+0x53/0x70
[ 6402.853785] RIP: 0033:0x400060dd
[ 6402.854681] Code: 7a 1e 9e 91 de 4c 65 49 be 00 d0 ff f7 ff 7f 00 00
49 bf de a7 b3 e8 d7 21 3c 15 9c 48 81 0c 24 00 01 00 00 9d b8 62 00 00
00 <8e> c0 0f 05 66 8c c8 9c 48 81 24 24 ff fe ff ff 9d 48 89 04 25 40
[ 6402.859689] RSP: 002b:000000004000aea0 EFLAGS: 00000317
[ 6402.861116] RAX: 0000000000000062 RBX: 0000000040001000 RCX:
ffffffffffffffff
[ 6402.863097] RDX: 0000000040003000 RSI: 0000000040004000 RDI:
0000000040001000
[ 6402.866199] RBP: 0000000040006073 R08: 0000000000000001 R09:
0000000000000001
[ 6402.868142] R10: ffffffffef080df2 R11: 1000000000000000 R12:
fdffffffffffffff
[ 6402.870083] R13: 654cde919e1e7ab5 R14: 00007ffff7ffd000 R15:
153c21d7e8b3a7de
[ 6402.872049] ---[ end trace 91a3039d0fd63799 ]---
It might not be related to the patch set, mind.
Vegard
next prev parent reply other threads:[~2020-05-10 8:31 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-23 23:21 [PATCH v10 00/18] Enable FSGSBASE instructions Sasha Levin
2020-04-23 23:21 ` [PATCH v10 01/18] x86/ptrace: Prevent ptrace from clearing the FS/GS selector Sasha Levin
2020-04-25 22:46 ` Andy Lutomirski
2020-04-23 23:21 ` [PATCH v10 02/18] selftests/x86/fsgsbase: Test GS selector on ptracer-induced GS base write Sasha Levin
2020-04-23 23:21 ` [PATCH v10 03/18] x86/cpu: Add 'unsafe_fsgsbase' to enable CR4.FSGSBASE Sasha Levin
2020-04-23 23:21 ` [PATCH v10 04/18] x86/entry/64: Clean up paranoid exit Sasha Levin
2020-04-23 23:21 ` [PATCH v10 05/18] x86/entry/64: Switch CR3 before SWAPGS in paranoid entry Sasha Levin
2020-04-23 23:21 ` [PATCH v10 06/18] x86/entry/64: Introduce the FIND_PERCPU_BASE macro Sasha Levin
2020-04-23 23:21 ` [PATCH v10 07/18] x86/entry/64: Handle FSGSBASE enabled paranoid entry/exit Sasha Levin
2020-04-23 23:21 ` [PATCH v10 08/18] x86/entry/64: Document GSBASE handling in the paranoid path Sasha Levin
2020-04-23 23:21 ` [PATCH v10 09/18] x86/fsgsbase/64: Add intrinsics for FSGSBASE instructions Sasha Levin
2020-04-23 23:21 ` [PATCH v10 10/18] x86/fsgsbase/64: Enable FSGSBASE instructions in helper functions Sasha Levin
2020-04-23 23:22 ` [PATCH v10 11/18] x86/fsgsbase/64: Use FSGSBASE in switch_to() if available Sasha Levin
2020-04-23 23:22 ` [PATCH v10 12/18] x86/fsgsbase/64: move save_fsgs to header file Sasha Levin
2020-04-23 23:22 ` [PATCH v10 13/18] x86/fsgsbase/64: Use FSGSBASE instructions on thread copy and ptrace Sasha Levin
2020-04-23 23:22 ` [PATCH v10 14/18] x86/speculation/swapgs: Check FSGSBASE in enabling SWAPGS mitigation Sasha Levin
2020-04-23 23:22 ` [PATCH v10 15/18] selftests/x86/fsgsbase: Test ptracer-induced GS base write with FSGSBASE Sasha Levin
2020-04-23 23:22 ` [PATCH v10 16/18] x86/fsgsbase/64: Enable FSGSBASE on 64bit by default and add a chicken bit Sasha Levin
2020-04-23 23:22 ` [PATCH v10 17/18] x86/elf: Enumerate kernel FSGSBASE capability in AT_HWCAP2 Sasha Levin
2020-04-23 23:22 ` [PATCH v10 18/18] Documentation/x86/64: Add documentation for GS/FS addressing mode Sasha Levin
2020-05-10 8:09 ` [PATCH v10 00/18] Enable FSGSBASE instructions Vegard Nossum
2020-05-10 8:29 ` Vegard Nossum [this message]
2020-05-10 10:15 ` Thomas Gleixner
2020-05-10 14:17 ` Sasha Levin
2020-05-11 0:48 ` Andi Kleen
2020-05-11 0:50 ` Andi Kleen
2020-05-11 5:03 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d7111932-6ba5-1484-4347-210d9e80316f@oracle.com \
--to=vegard.nossum@oracle.com \
--cc=ak@linux.intel.com \
--cc=chang.seok.bae@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=sashal@kernel.org \
--cc=tglx@linutronix.de \
--cc=tony.luck@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).