linux-kernel - Re: [RFC PATCH 1/2] x86: Fix rbp saving in pt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 7 Jan 2011 17:05:02 +0100
From:	Frederic Weisbecker <fweisbec@...il.com>
To:	Ingo Molnar <mingo@...e.hu>
Cc:	Jan Beulich <JBeulich@...ell.com>,
	"H. Peter Anvin" <a.p.zijlstra@...llo.nl>,
	Stephane Eranian <eranian@...gle.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	Soeren Sandmann Pedersen <sandmann@...hat.com>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [RFC PATCH 1/2] x86: Fix rbp saving in pt_regs on irq entry

On Fri, Jan 07, 2011 at 01:31:30PM +0100, Ingo Molnar wrote:
> 
> * Jan Beulich <JBeulich@...ell.com> wrote:
> 
> > > Now I don't understand how this is all useful as this is not a normal proc but 
> > > an interruption. We can't get back the return address from the CFA. Or am I 
> > > missing something?
> > 
> > Unwind annotations, when written correctly, allow unwinding through all kinds of 
> > execution flows, including interrupts or exceptions as well as including stack 
> > switches.
> 
> Yeah and that's rather useful, as exception contexts can nest in very weird ways, 
> especially with NMIs involved. For example a 7-context combination is possible:
> 
>   user-space -> syscall -> pagefault -> softirq -> hardirq -> debug trap -> NMI
> 
> And the call frame walking logic needs to be able to get all the way back to 
> user-space ...
> 
> For that every transition needs to work flawlessly, for debugging (and CFI based 
> profiling) to work fine.
> 
> Most of those transitions can happen at any instruction boundary that a given 
> context executes, so the total number of possible combinations is virtually endless.
> 
> Unfortunately we dont seem to have a good way to test any of this automatically. 
> Putting a perf probe on every assembly instruction perhaps, and checking whether the 
> frame manages to go back all the way to user-space?

May be.

Once I'll have perf callchain based on CFI ready, we'll perhaps find some issues
there. Although I guess there are already tools that can make use of that.

> 
> Thanks,
> 
> 	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/