Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1240071 > unrolled thread

[PATCH v2 26/36] x86/entry/32: Switch INT80 to the new C syscall path

Started byAndy Lutomirski <luto@kernel.org>
First post2015-10-06 03:00 +0200
Last post2015-10-16 19:20 +0200
Articles 12 — 5 participants

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  [PATCH v2 26/36] x86/entry/32: Switch INT80 to the new C syscall path Andy Lutomirski <luto@kernel.org> - 2015-10-06 03:00 +0200
    [tip:x86/asm] x86/entry/32:   Switch INT80 to the new C syscall path tip-bot for Andy Lutomirski <tipbot@zytor.com> - 2015-10-09 15:20 +0200
      Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall  path Borislav Petkov <bp@alien8.de> - 2015-10-15 20:10 +0200
        Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path Andy Lutomirski <luto@amacapital.net> - 2015-10-15 21:20 +0200
          Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall  path Borislav Petkov <bp@alien8.de> - 2015-10-16 13:00 +0200
            Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path Andy Lutomirski <luto@amacapital.net> - 2015-10-16 18:00 +0200
              Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall  path Borislav Petkov <bp@alien8.de> - 2015-10-16 19:40 +0200
                Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path Brian Gerst <brgerst@gmail.com> - 2015-10-16 20:30 +0200
                  Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path Andy Lutomirski <luto@amacapital.net> - 2015-10-16 20:40 +0200
                    Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path Brian Gerst <brgerst@gmail.com> - 2015-10-16 21:40 +0200
            Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path Andy Lutomirski <luto@amacapital.net> - 2015-10-16 18:00 +0200
              Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall  path Borislav Petkov <bp@alien8.de> - 2015-10-16 19:20 +0200

#1240071 — [PATCH v2 26/36] x86/entry/32: Switch INT80 to the new C syscall path

FromAndy Lutomirski <luto@kernel.org>
Date2015-10-06 03:00 +0200
Subject[PATCH v2 26/36] x86/entry/32: Switch INT80 to the new C syscall path
Message-ID<qgoLN-7cw-27@gated-at.bofh.it>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
---
 arch/x86/entry/entry_32.S | 34 +++++++++++++---------------------
 1 file changed, 13 insertions(+), 21 deletions(-)

diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
index 36b6beb181f6..02881e528945 100644
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -153,13 +153,13 @@
 
 #endif /* CONFIG_X86_32_LAZY_GS */
 
-.macro SAVE_ALL
+.macro SAVE_ALL pt_regs_ax=%eax
 	cld
 	PUSH_GS
 	pushl	%fs
 	pushl	%es
 	pushl	%ds
-	pushl	%eax
+	pushl	\pt_regs_ax
 	pushl	%ebp
 	pushl	%edi
 	pushl	%esi
@@ -370,20 +370,17 @@ ENDPROC(entry_SYSENTER_32)
 	# system call handler stub
 ENTRY(entry_INT80_32)
 	ASM_CLAC
-	pushl	%eax				# save orig_eax
-	SAVE_ALL
-	GET_THREAD_INFO(%ebp)
-						# system call tracing in operation / emulation
-	testl	$_TIF_WORK_SYSCALL_ENTRY, TI_flags(%ebp)
-	jnz	syscall_trace_entry
-	cmpl	$(NR_syscalls), %eax
-	jae	syscall_badsys
-syscall_call:
-	call	*sys_call_table(, %eax, 4)
-syscall_after_call:
-	movl	%eax, PT_EAX(%esp)		# store the return value
-syscall_exit:
-	jmp	syscall_exit_work
+	pushl	%eax			/* pt_regs->orig_ax */
+	SAVE_ALL pt_regs_ax=$-ENOSYS	/* save rest, load -ENOSYS into ax */
+
+	/*
+	 * User mode is traced as though IRQs are on, and the interrupt gate
+	 * turned them off.
+	 */
+	TRACE_IRQS_OFF
+
+	movl	%esp, %eax
+	call	do_int80_syscall_32
 
 restore_all:
 	TRACE_IRQS_IRET
@@ -491,11 +488,6 @@ syscall_fault:
 	jmp	resume_userspace
 END(syscall_fault)
 
-syscall_badsys:
-	movl	$-ENOSYS, %eax
-	jmp	syscall_after_call
-END(syscall_badsys)
-
 sysenter_badsys:
 	movl	$-ENOSYS, %eax
 	jmp	sysenter_after_call
-- 
2.4.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1243358 — [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path

Fromtip-bot for Andy Lutomirski <tipbot@zytor.com>
Date2015-10-09 15:20 +0200
Subject[tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path
Message-ID<qhFKz-3bI-51@gated-at.bofh.it>
In reply to#1240071
Commit-ID:  150ac78d63afb96360dab448b7b4d33c98c8266c
Gitweb:     http://git.kernel.org/tip/150ac78d63afb96360dab448b7b4d33c98c8266c
Author:     Andy Lutomirski <luto@kernel.org>
AuthorDate: Mon, 5 Oct 2015 17:48:14 -0700
Committer:  Ingo Molnar <mingo@kernel.org>
CommitDate: Fri, 9 Oct 2015 09:41:10 +0200

x86/entry/32: Switch INT80 to the new C syscall path

Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-kernel@vger.kernel.org
Link: http://lkml.kernel.org/r/a7e8d8df96838eae3208dd0441023f3ce7a81831.1444091585.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
 arch/x86/entry/entry_32.S | 34 +++++++++++++---------------------
 1 file changed, 13 insertions(+), 21 deletions(-)

diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
index 36b6beb..02881e5 100644
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -153,13 +153,13 @@
 
 #endif /* CONFIG_X86_32_LAZY_GS */
 
-.macro SAVE_ALL
+.macro SAVE_ALL pt_regs_ax=%eax
 	cld
 	PUSH_GS
 	pushl	%fs
 	pushl	%es
 	pushl	%ds
-	pushl	%eax
+	pushl	\pt_regs_ax
 	pushl	%ebp
 	pushl	%edi
 	pushl	%esi
@@ -370,20 +370,17 @@ ENDPROC(entry_SYSENTER_32)
 	# system call handler stub
 ENTRY(entry_INT80_32)
 	ASM_CLAC
-	pushl	%eax				# save orig_eax
-	SAVE_ALL
-	GET_THREAD_INFO(%ebp)
-						# system call tracing in operation / emulation
-	testl	$_TIF_WORK_SYSCALL_ENTRY, TI_flags(%ebp)
-	jnz	syscall_trace_entry
-	cmpl	$(NR_syscalls), %eax
-	jae	syscall_badsys
-syscall_call:
-	call	*sys_call_table(, %eax, 4)
-syscall_after_call:
-	movl	%eax, PT_EAX(%esp)		# store the return value
-syscall_exit:
-	jmp	syscall_exit_work
+	pushl	%eax			/* pt_regs->orig_ax */
+	SAVE_ALL pt_regs_ax=$-ENOSYS	/* save rest, load -ENOSYS into ax */
+
+	/*
+	 * User mode is traced as though IRQs are on, and the interrupt gate
+	 * turned them off.
+	 */
+	TRACE_IRQS_OFF
+
+	movl	%esp, %eax
+	call	do_int80_syscall_32
 
 restore_all:
 	TRACE_IRQS_IRET
@@ -491,11 +488,6 @@ syscall_fault:
 	jmp	resume_userspace
 END(syscall_fault)
 
-syscall_badsys:
-	movl	$-ENOSYS, %eax
-	jmp	syscall_after_call
-END(syscall_badsys)
-
 sysenter_badsys:
 	movl	$-ENOSYS, %eax
 	jmp	sysenter_after_call
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1248051 — Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path

FromBorislav Petkov <bp@alien8.de>
Date2015-10-15 20:10 +0200
SubjectRe: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path
Message-ID<qjV8t-5Jg-1@gated-at.bofh.it>
In reply to#1243358
On Fri, Oct 09, 2015 at 06:12:44AM -0700, tip-bot for Andy Lutomirski wrote:
> Commit-ID:  150ac78d63afb96360dab448b7b4d33c98c8266c
> Gitweb:     http://git.kernel.org/tip/150ac78d63afb96360dab448b7b4d33c98c8266c
> Author:     Andy Lutomirski <luto@kernel.org>
> AuthorDate: Mon, 5 Oct 2015 17:48:14 -0700
> Committer:  Ingo Molnar <mingo@kernel.org>
> CommitDate: Fri, 9 Oct 2015 09:41:10 +0200
> 
> x86/entry/32: Switch INT80 to the new C syscall path
> 
> Signed-off-by: Andy Lutomirski <luto@kernel.org>
> Cc: Andy Lutomirski <luto@amacapital.net>
> Cc: Borislav Petkov <bp@alien8.de>
> Cc: Brian Gerst <brgerst@gmail.com>
> Cc: Denys Vlasenko <dvlasenk@redhat.com>
> Cc: H. Peter Anvin <hpa@zytor.com>
> Cc: Linus Torvalds <torvalds@linux-foundation.org>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: linux-kernel@vger.kernel.org
> Link: http://lkml.kernel.org/r/a7e8d8df96838eae3208dd0441023f3ce7a81831.1444091585.git.luto@kernel.org
> Signed-off-by: Ingo Molnar <mingo@kernel.org>
> ---
>  arch/x86/entry/entry_32.S | 34 +++++++++++++---------------------
>  1 file changed, 13 insertions(+), 21 deletions(-)

Just triggered this here on rc5+tip/master, 32-bit. Any ideas?

------------[ cut here ]------------
WARNING: CPU: 1 PID: 1 at /mnt/kernel/kernel/linux-2.6/kernel/locking/lockdep.c:2639 trace_hardirqs_off_caller+0xef/0x150()
DEBUG_LOCKS_WARN_ON(!irqs_disabled())
Modules linked in:

CPU: 1 PID: 1 Comm: init Tainted: G        W       4.3.0-rc5+ #1
Hardware name: LENOVO 30515QG/30515QG, BIOS 8RET30WW (1.12 ) 09/15/2011
 00000000 00000000 f44fbf34 c1301072 f44fbf74 f44fbf64 c105658d c1819094
 f44fbf90 00000001 c181f838 00000a4f c10a284f c10a284f f4520000 c1662048
 00000009 f44fbf7c c10565f3 00000009 f44fbf74 c1819094 f44fbf90 f44fbf9c
Call Trace:
 [<c1301072>] dump_stack+0x4b/0x79
 [<c105658d>] warn_slowpath_common+0x8d/0xc0
 [<c10a284f>] ? trace_hardirqs_off_caller+0xef/0x150
 [<c10a284f>] ? trace_hardirqs_off_caller+0xef/0x150
 [<c1662048>] ? entry_INT80_32+0x28/0x2f
 [<c10565f3>] warn_slowpath_fmt+0x33/0x40
 [<c10a284f>] trace_hardirqs_off_caller+0xef/0x150
 [<c1000f1c>] trace_hardirqs_off_thunk+0xc/0x10
 [<c1662048>] ? entry_INT80_32+0x28/0x2f
---[ end trace dd0b2c83c5d36016 ]---

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1248093 — Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path

FromAndy Lutomirski <luto@amacapital.net>
Date2015-10-15 21:20 +0200
SubjectRe: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path
Message-ID<qjWee-7ns-5@gated-at.bofh.it>
In reply to#1248051
On Thu, Oct 15, 2015 at 11:09 AM, Borislav Petkov <bp@alien8.de> wrote:
> On Fri, Oct 09, 2015 at 06:12:44AM -0700, tip-bot for Andy Lutomirski wrote:
>> Commit-ID:  150ac78d63afb96360dab448b7b4d33c98c8266c
>> Gitweb:     http://git.kernel.org/tip/150ac78d63afb96360dab448b7b4d33c98c8266c
>> Author:     Andy Lutomirski <luto@kernel.org>
>> AuthorDate: Mon, 5 Oct 2015 17:48:14 -0700
>> Committer:  Ingo Molnar <mingo@kernel.org>
>> CommitDate: Fri, 9 Oct 2015 09:41:10 +0200
>>
>> x86/entry/32: Switch INT80 to the new C syscall path
>>
>> Signed-off-by: Andy Lutomirski <luto@kernel.org>
>> Cc: Andy Lutomirski <luto@amacapital.net>
>> Cc: Borislav Petkov <bp@alien8.de>
>> Cc: Brian Gerst <brgerst@gmail.com>
>> Cc: Denys Vlasenko <dvlasenk@redhat.com>
>> Cc: H. Peter Anvin <hpa@zytor.com>
>> Cc: Linus Torvalds <torvalds@linux-foundation.org>
>> Cc: Peter Zijlstra <peterz@infradead.org>
>> Cc: Thomas Gleixner <tglx@linutronix.de>
>> Cc: linux-kernel@vger.kernel.org
>> Link: http://lkml.kernel.org/r/a7e8d8df96838eae3208dd0441023f3ce7a81831.1444091585.git.luto@kernel.org
>> Signed-off-by: Ingo Molnar <mingo@kernel.org>
>> ---
>>  arch/x86/entry/entry_32.S | 34 +++++++++++++---------------------
>>  1 file changed, 13 insertions(+), 21 deletions(-)
>
> Just triggered this here on rc5+tip/master, 32-bit. Any ideas?
>
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 1 at /mnt/kernel/kernel/linux-2.6/kernel/locking/lockdep.c:2639 trace_hardirqs_off_caller+0xef/0x150()
> DEBUG_LOCKS_WARN_ON(!irqs_disabled())
> Modules linked in:
>
> CPU: 1 PID: 1 Comm: init Tainted: G        W       4.3.0-rc5+ #1
> Hardware name: LENOVO 30515QG/30515QG, BIOS 8RET30WW (1.12 ) 09/15/2011
>  00000000 00000000 f44fbf34 c1301072 f44fbf74 f44fbf64 c105658d c1819094
>  f44fbf90 00000001 c181f838 00000a4f c10a284f c10a284f f4520000 c1662048
>  00000009 f44fbf7c c10565f3 00000009 f44fbf74 c1819094 f44fbf90 f44fbf9c
> Call Trace:
>  [<c1301072>] dump_stack+0x4b/0x79
>  [<c105658d>] warn_slowpath_common+0x8d/0xc0
>  [<c10a284f>] ? trace_hardirqs_off_caller+0xef/0x150
>  [<c10a284f>] ? trace_hardirqs_off_caller+0xef/0x150
>  [<c1662048>] ? entry_INT80_32+0x28/0x2f

Can you turn that entry_INT80_32 address into either a line number of
some assembly code?  I'm not seeing the code path that could do this,
and there are two unlikely choices.

Based on the warning that triggered, I assume you have
CONFIG_PROVE_LOCKING=y, which means that the obvious failures that
would have blown up like this should also have warned earlier.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1248638 — Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path

FromBorislav Petkov <bp@alien8.de>
Date2015-10-16 13:00 +0200
SubjectRe: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path
Message-ID<qkaTU-3YR-29@gated-at.bofh.it>
In reply to#1248093
On Thu, Oct 15, 2015 at 12:09:16PM -0700, Andy Lutomirski wrote:
> On Thu, Oct 15, 2015 at 11:09 AM, Borislav Petkov <bp@alien8.de> wrote:
> > On Fri, Oct 09, 2015 at 06:12:44AM -0700, tip-bot for Andy Lutomirski wrote:
> >> Commit-ID:  150ac78d63afb96360dab448b7b4d33c98c8266c
> >> Gitweb:     http://git.kernel.org/tip/150ac78d63afb96360dab448b7b4d33c98c8266c
> >> Author:     Andy Lutomirski <luto@kernel.org>
> >> AuthorDate: Mon, 5 Oct 2015 17:48:14 -0700
> >> Committer:  Ingo Molnar <mingo@kernel.org>
> >> CommitDate: Fri, 9 Oct 2015 09:41:10 +0200
> >>
> >> x86/entry/32: Switch INT80 to the new C syscall path
> >>
> >> Signed-off-by: Andy Lutomirski <luto@kernel.org>
> >> Cc: Andy Lutomirski <luto@amacapital.net>
> >> Cc: Borislav Petkov <bp@alien8.de>
> >> Cc: Brian Gerst <brgerst@gmail.com>
> >> Cc: Denys Vlasenko <dvlasenk@redhat.com>
> >> Cc: H. Peter Anvin <hpa@zytor.com>
> >> Cc: Linus Torvalds <torvalds@linux-foundation.org>
> >> Cc: Peter Zijlstra <peterz@infradead.org>
> >> Cc: Thomas Gleixner <tglx@linutronix.de>
> >> Cc: linux-kernel@vger.kernel.org
> >> Link: http://lkml.kernel.org/r/a7e8d8df96838eae3208dd0441023f3ce7a81831.1444091585.git.luto@kernel.org
> >> Signed-off-by: Ingo Molnar <mingo@kernel.org>
> >> ---
> >>  arch/x86/entry/entry_32.S | 34 +++++++++++++---------------------
> >>  1 file changed, 13 insertions(+), 21 deletions(-)
> >
> > Just triggered this here on rc5+tip/master, 32-bit. Any ideas?
> >
> > ------------[ cut here ]------------
> > WARNING: CPU: 1 PID: 1 at /mnt/kernel/kernel/linux-2.6/kernel/locking/lockdep.c:2639 trace_hardirqs_off_caller+0xef/0x150()
> > DEBUG_LOCKS_WARN_ON(!irqs_disabled())
> > Modules linked in:
> >
> > CPU: 1 PID: 1 Comm: init Tainted: G        W       4.3.0-rc5+ #1
> > Hardware name: LENOVO 30515QG/30515QG, BIOS 8RET30WW (1.12 ) 09/15/2011
> >  00000000 00000000 f44fbf34 c1301072 f44fbf74 f44fbf64 c105658d c1819094
> >  f44fbf90 00000001 c181f838 00000a4f c10a284f c10a284f f4520000 c1662048
> >  00000009 f44fbf7c c10565f3 00000009 f44fbf74 c1819094 f44fbf90 f44fbf9c
> > Call Trace:
> >  [<c1301072>] dump_stack+0x4b/0x79
> >  [<c105658d>] warn_slowpath_common+0x8d/0xc0
> >  [<c10a284f>] ? trace_hardirqs_off_caller+0xef/0x150
> >  [<c10a284f>] ? trace_hardirqs_off_caller+0xef/0x150
> >  [<c1662048>] ? entry_INT80_32+0x28/0x2f
> 
> Can you turn that entry_INT80_32 address into either a line number of
> some assembly code?  I'm not seeing the code path that could do this,
> and there are two unlikely choices.

Why, that's the TRACE_IRQS_OFF at the end of entry_INT80_32. It calls
trace_hardirqs_off_caller through the thunk. That's pretty obvious. Or
am I misunderstanding you?

c1662020 <entry_INT80_32>:
c1662020:       90                      nop
c1662021:       90                      nop
c1662022:       90                      nop
c1662023:       50                      push   %eax
c1662024:       fc                      cld    
c1662025:       6a 00                   push   $0x0
c1662027:       0f a0                   push   %fs
c1662029:       06                      push   %es
c166202a:       1e                      push   %ds
c166202b:       6a da                   push   $0xffffffda
c166202d:       55                      push   %ebp
c166202e:       57                      push   %edi
c166202f:       56                      push   %esi
c1662030:       52                      push   %edx
c1662031:       51                      push   %ecx
c1662032:       53                      push   %ebx
c1662033:       ba 7b 00 00 00          mov    $0x7b,%edx
c1662038:       8e da                   mov    %edx,%ds
c166203a:       8e c2                   mov    %edx,%es
c166203c:       ba d8 00 00 00          mov    $0xd8,%edx
c1662041:       8e e2                   mov    %edx,%fs
c1662043:       e8 c8 ee 99 ff          call   c1000f10 <trace_hardirqs_off_thunk>
c1662048:       89 e0                   mov    %esp,%eax
c166204a:       e8 61 f9 99 ff          call   c10019b0 <do_int80_syscall_32>


        /*
         * User mode is traced as though IRQs are on, and the interrupt gate
         * turned them off.
         */
        TRACE_IRQS_OFF

Sounds like the gate didn't disable IRQs, right? Or did the
irqs_disabled() check get tricked into looking at the wrong flags...?
But I don't see it. Hmmm..

> Based on the warning that triggered, I assume you have
> CONFIG_PROVE_LOCKING=y,

yes.

> which means that the obvious failures that would have blown up like
> this should also have warned earlier.

If you mean, earlier in the boot, the only splat before that one is (see
the "not tainted").

[    2.703038] NX-protecting the kernel data: 5740k
[    2.703822] ------------[ cut here ]------------
[    2.703973] WARNING: CPU: 0 PID: 1 at /mnt/kernel/kernel/linux-2.6/arch/x86/mm/dump_pagetables.c:225 note_page+0x63e/0x800()
[    2.704177] x86/mm: Found insecure W+X mapping at address c00a0000/0xc00a0000
[    2.704324] Modules linked in:
[    2.704461] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.3.0-rc5+ #1
...


-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1248923 — Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path

FromAndy Lutomirski <luto@amacapital.net>
Date2015-10-16 18:00 +0200
SubjectRe: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path
Message-ID<qkfAd-2um-3@gated-at.bofh.it>
In reply to#1248638
On Fri, Oct 16, 2015 at 3:52 AM, Borislav Petkov <bp@alien8.de> wrote:
> On Thu, Oct 15, 2015 at 12:09:16PM -0700, Andy Lutomirski wrote:
>> On Thu, Oct 15, 2015 at 11:09 AM, Borislav Petkov <bp@alien8.de> wrote:
>> > On Fri, Oct 09, 2015 at 06:12:44AM -0700, tip-bot for Andy Lutomirski wrote:
>> >> Commit-ID:  150ac78d63afb96360dab448b7b4d33c98c8266c
>> >> Gitweb:     http://git.kernel.org/tip/150ac78d63afb96360dab448b7b4d33c98c8266c
>> >> Author:     Andy Lutomirski <luto@kernel.org>
>> >> AuthorDate: Mon, 5 Oct 2015 17:48:14 -0700
>> >> Committer:  Ingo Molnar <mingo@kernel.org>
>> >> CommitDate: Fri, 9 Oct 2015 09:41:10 +0200
>> >>
>> >> x86/entry/32: Switch INT80 to the new C syscall path
>> >>
>> >> Signed-off-by: Andy Lutomirski <luto@kernel.org>
>> >> Cc: Andy Lutomirski <luto@amacapital.net>
>> >> Cc: Borislav Petkov <bp@alien8.de>
>> >> Cc: Brian Gerst <brgerst@gmail.com>
>> >> Cc: Denys Vlasenko <dvlasenk@redhat.com>
>> >> Cc: H. Peter Anvin <hpa@zytor.com>
>> >> Cc: Linus Torvalds <torvalds@linux-foundation.org>
>> >> Cc: Peter Zijlstra <peterz@infradead.org>
>> >> Cc: Thomas Gleixner <tglx@linutronix.de>
>> >> Cc: linux-kernel@vger.kernel.org
>> >> Link: http://lkml.kernel.org/r/a7e8d8df96838eae3208dd0441023f3ce7a81831.1444091585.git.luto@kernel.org
>> >> Signed-off-by: Ingo Molnar <mingo@kernel.org>
>> >> ---
>> >>  arch/x86/entry/entry_32.S | 34 +++++++++++++---------------------
>> >>  1 file changed, 13 insertions(+), 21 deletions(-)
>> >
>> > Just triggered this here on rc5+tip/master, 32-bit. Any ideas?
>> >
>> > ------------[ cut here ]------------
>> > WARNING: CPU: 1 PID: 1 at /mnt/kernel/kernel/linux-2.6/kernel/locking/lockdep.c:2639 trace_hardirqs_off_caller+0xef/0x150()
>> > DEBUG_LOCKS_WARN_ON(!irqs_disabled())
>> > Modules linked in:
>> >
>> > CPU: 1 PID: 1 Comm: init Tainted: G        W       4.3.0-rc5+ #1
>> > Hardware name: LENOVO 30515QG/30515QG, BIOS 8RET30WW (1.12 ) 09/15/2011
>> >  00000000 00000000 f44fbf34 c1301072 f44fbf74 f44fbf64 c105658d c1819094
>> >  f44fbf90 00000001 c181f838 00000a4f c10a284f c10a284f f4520000 c1662048
>> >  00000009 f44fbf7c c10565f3 00000009 f44fbf74 c1819094 f44fbf90 f44fbf9c
>> > Call Trace:
>> >  [<c1301072>] dump_stack+0x4b/0x79
>> >  [<c105658d>] warn_slowpath_common+0x8d/0xc0
>> >  [<c10a284f>] ? trace_hardirqs_off_caller+0xef/0x150
>> >  [<c10a284f>] ? trace_hardirqs_off_caller+0xef/0x150
>> >  [<c1662048>] ? entry_INT80_32+0x28/0x2f
>>
>> Can you turn that entry_INT80_32 address into either a line number of
>> some assembly code?  I'm not seeing the code path that could do this,
>> and there are two unlikely choices.
>
> Why, that's the TRACE_IRQS_OFF at the end of entry_INT80_32. It calls
> trace_hardirqs_off_caller through the thunk. That's pretty obvious. Or
> am I misunderstanding you?

I was thinking it could also be TRACE_IRQS_IRETQ, but I was wrong
(that would be trace_hardirqs_on_caller).

>
> c1662020 <entry_INT80_32>:
> c1662020:       90                      nop
> c1662021:       90                      nop
> c1662022:       90                      nop
> c1662023:       50                      push   %eax
> c1662024:       fc                      cld
> c1662025:       6a 00                   push   $0x0
> c1662027:       0f a0                   push   %fs
> c1662029:       06                      push   %es
> c166202a:       1e                      push   %ds
> c166202b:       6a da                   push   $0xffffffda
> c166202d:       55                      push   %ebp
> c166202e:       57                      push   %edi
> c166202f:       56                      push   %esi
> c1662030:       52                      push   %edx
> c1662031:       51                      push   %ecx
> c1662032:       53                      push   %ebx
> c1662033:       ba 7b 00 00 00          mov    $0x7b,%edx
> c1662038:       8e da                   mov    %edx,%ds
> c166203a:       8e c2                   mov    %edx,%es
> c166203c:       ba d8 00 00 00          mov    $0xd8,%edx
> c1662041:       8e e2                   mov    %edx,%fs
> c1662043:       e8 c8 ee 99 ff          call   c1000f10 <trace_hardirqs_off_thunk>
> c1662048:       89 e0                   mov    %esp,%eax
> c166204a:       e8 61 f9 99 ff          call   c10019b0 <do_int80_syscall_32>
>
>
>         /*
>          * User mode is traced as though IRQs are on, and the interrupt gate
>          * turned them off.
>          */
>         TRACE_IRQS_OFF
>
> Sounds like the gate didn't disable IRQs, right? Or did the
> irqs_disabled() check get tricked into looking at the wrong flags...?
> But I don't see it. Hmmm..

Wow I am incompetent.

    set_system_trap_gate(IA32_SYSCALL_VECTOR, entry_INT80_32);

How did I not catch that in testing?  Can you change that to
set_system_intr_gate and see if that helps?

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1249024 — Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path

FromBorislav Petkov <bp@alien8.de>
Date2015-10-16 19:40 +0200
SubjectRe: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path
Message-ID<qkh90-4PP-29@gated-at.bofh.it>
In reply to#1248923
On Fri, Oct 16, 2015 at 08:59:23AM -0700, Andy Lutomirski wrote:
> Wow I am incompetent.

Bah, it can happen to anyone...

>     set_system_trap_gate(IA32_SYSCALL_VECTOR, entry_INT80_32);
> 
> How did I not catch that in testing?  Can you change that to
> set_system_intr_gate and see if that helps?

Yeah, that was it. Well spotted, thanks!

Reported-and-tested-by: Borislav Petkov <bp@suse.de>

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1249049 — Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path

FromBrian Gerst <brgerst@gmail.com>
Date2015-10-16 20:30 +0200
SubjectRe: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path
Message-ID<qkhVo-5ZZ-9@gated-at.bofh.it>
In reply to#1249024
On Fri, Oct 16, 2015 at 1:34 PM, Borislav Petkov <bp@alien8.de> wrote:
> On Fri, Oct 16, 2015 at 08:59:23AM -0700, Andy Lutomirski wrote:
>> Wow I am incompetent.
>
> Bah, it can happen to anyone...
>
>>     set_system_trap_gate(IA32_SYSCALL_VECTOR, entry_INT80_32);
>>
>> How did I not catch that in testing?  Can you change that to
>> set_system_intr_gate and see if that helps?
>
> Yeah, that was it. Well spotted, thanks!

The INT80 handler doesn't do anything that requires interrupts to be
off (it is already on the process stack), so the tracing should be
fixed to expect interrupts on. do_int80_syscall_32() can be eliminated
too.

--
Brian Gerst
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1249053 — Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path

FromAndy Lutomirski <luto@amacapital.net>
Date2015-10-16 20:40 +0200
SubjectRe: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path
Message-ID<qki54-6bZ-15@gated-at.bofh.it>
In reply to#1249049
On Fri, Oct 16, 2015 at 11:22 AM, Brian Gerst <brgerst@gmail.com> wrote:
> On Fri, Oct 16, 2015 at 1:34 PM, Borislav Petkov <bp@alien8.de> wrote:
>> On Fri, Oct 16, 2015 at 08:59:23AM -0700, Andy Lutomirski wrote:
>>> Wow I am incompetent.
>>
>> Bah, it can happen to anyone...
>>
>>>     set_system_trap_gate(IA32_SYSCALL_VECTOR, entry_INT80_32);
>>>
>>> How did I not catch that in testing?  Can you change that to
>>> set_system_intr_gate and see if that helps?
>>
>> Yeah, that was it. Well spotted, thanks!
>
> The INT80 handler doesn't do anything that requires interrupts to be
> off (it is already on the process stack), so the tracing should be
> fixed to expect interrupts on. do_int80_syscall_32() can be eliminated
> too.

Good point.  Then we blow up in potentially interesting ways if an
iopl-using process does int80 with interrupts off.  Oh well.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1249106 — Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path

FromBrian Gerst <brgerst@gmail.com>
Date2015-10-16 21:40 +0200
SubjectRe: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path
Message-ID<qkj18-7AO-27@gated-at.bofh.it>
In reply to#1249053
On Fri, Oct 16, 2015 at 2:32 PM, Andy Lutomirski <luto@amacapital.net> wrote:
> On Fri, Oct 16, 2015 at 11:22 AM, Brian Gerst <brgerst@gmail.com> wrote:
>> On Fri, Oct 16, 2015 at 1:34 PM, Borislav Petkov <bp@alien8.de> wrote:
>>> On Fri, Oct 16, 2015 at 08:59:23AM -0700, Andy Lutomirski wrote:
>>>> Wow I am incompetent.
>>>
>>> Bah, it can happen to anyone...
>>>
>>>>     set_system_trap_gate(IA32_SYSCALL_VECTOR, entry_INT80_32);
>>>>
>>>> How did I not catch that in testing?  Can you change that to
>>>> set_system_intr_gate and see if that helps?
>>>
>>> Yeah, that was it. Well spotted, thanks!
>>
>> The INT80 handler doesn't do anything that requires interrupts to be
>> off (it is already on the process stack), so the tracing should be
>> fixed to expect interrupts on. do_int80_syscall_32() can be eliminated
>> too.
>
> Good point.  Then we blow up in potentially interesting ways if an
> iopl-using process does int80 with interrupts off.  Oh well.

The code this replaced ran with interrupts enabled too, so I don't see
this as a regression.  Usermode drivers could already blow up the
system in many different ways.  I doubt there were any that actually
did a system call while interrupts were disabled.

--
Brian Gerst
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1248928 — Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path

FromAndy Lutomirski <luto@amacapital.net>
Date2015-10-16 18:00 +0200
SubjectRe: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path
Message-ID<qkfAe-2um-23@gated-at.bofh.it>
In reply to#1248638
On Fri, Oct 16, 2015 at 7:05 AM, Borislav Petkov <bp@alien8.de> wrote:
>
> On Fri, Oct 16, 2015 at 12:52:29PM +0200, Borislav Petkov wrote:
> > > > Just triggered this here on rc5+tip/master, 32-bit. Any ideas?
> > > >
> > > > ------------[ cut here ]------------
> > > > WARNING: CPU: 1 PID: 1 at /mnt/kernel/kernel/linux-2.6/kernel/locking/lockdep.c:2639 trace_hardirqs_off_caller+0xef/0x150()
> > > > DEBUG_LOCKS_WARN_ON(!irqs_disabled())
> > > > Modules linked in:
>
> Hmm, something more is b0rked with this. I'm attaching a #GP splat from
> the intel laptop. Yeah, the box has paniced and the only way to catch it
> is a photo (how convenient that cameras are ubiquitous nowadays...).
>
> I see prepare_exit_to_usermode and do_signal ...
>
> Fun stuff :-\


Is this AMD or Intel?  If it's Intel, can you see if booting with
nosep fixes it?

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1249007 — Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path

FromBorislav Petkov <bp@alien8.de>
Date2015-10-16 19:20 +0200
SubjectRe: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall path
Message-ID<qkgPE-4tv-3@gated-at.bofh.it>
In reply to#1248928
On Fri, Oct 16, 2015 at 08:57:09AM -0700, Andy Lutomirski wrote:
> Is this AMD or Intel? 

Intel.

> If it's Intel, can you see if booting with nosep fixes it?

It does.

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web