linux-kernel - Re: [patch 1/2] F00F bug fixup for i386

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070715024931.GA25152@Krystal>
Date:	Sat, 14 Jul 2007 22:49:31 -0400
From:	Mathieu Desnoyers <mathieu.desnoyers@...ymtl.ca>
To:	Alexey Dobriyan <adobriyan@...il.com>
Cc:	akpm@...ux-foundation.org, linux-kernel@...r.kernel.org
Subject: Re: [patch 1/2] F00F bug fixup for i386 - use immediate values

* Alexey Dobriyan (adobriyan@...il.com) wrote:
> On Fri, Jul 13, 2007 at 09:26:43PM -0400, Mathieu Desnoyers wrote:
> > Use the faster immediate values for F00F bug handling in do_page_fault.
> 
> > --- linux-2.6-lttng.orig/arch/i386/mm/fault.c
> > +++ linux-2.6-lttng/arch/i386/mm/fault.c
> > @@ -492,7 +493,7 @@
> >  	/*
> >  	 * Pentium F0 0F C7 C8 bug workaround.
> >  	 */
> > -	if (boot_cpu_data.f00f_bug) {
> > +	immediate_if (&f00f_bug_fix) {
> 
> This code is not called during normal pagefaults and even during invalid
> userspace accesses.
> 
> Out of curiosity, I inserted printk() at this place to see where I was
> wrong. I got only two hits:
> 
> 	Checking if this processor honours the WP bit even in supervisor mode... do_page_fault:
> 	Freeing unused kernel memory: 116k freed
> 	do_page_fault:
> 
> Resume: nobody gives a fuck about performance of this particular if,
> 	so conversion it totally pointless.
> 

Interesting investigation, let's push it further:

instrumenting the f00f test site with a printk, I get:

[    0.000000] Checking if this processor honours the WP bit even in
supervisor mode... TEST: would test f00f bug at vadd ffecc000, eip c011928e
[    0.000000] Ok.
... and (whenever xdm restarts) :
[   64.768165] TEST: would test f00f bug at vadd 00000000, eip c0237596
[   64.787136] TEST: would test f00f bug at vadd 0000004c, eip c02375a2

Those EIPs are:

0xc011928e <do_test_wp_bit+20>: mov    %cl,0xffecd000(%edx)
-> Will trigger fixup_exception.

0xc0237596 <__copy_from_user_ll+53>:    rep movsl %ds:(%esi),%es:(%edi)
0xc02375a2 <__copy_from_user_ll+65>:    mov    0x20(%esi),%eax
-> Those look like user-space programs that gave NULL pointers to kernel
system calls.

I agree with you that this is not a "hot path". It was mostly a
straightforward test conversion.

Mathieu

-- 
Mathieu Desnoyers
Computer Engineering Ph.D. Student, Ecole Polytechnique de Montreal
OpenPGP key fingerprint: 8CD5 52C3 8E3C 4140 715F  BA06 3F25 A8FE 3BAE 9A68
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/