linux-kernel - Re: [tip:x86/urgent] x86/mm/kmmio: Fix mmiotrace for page unaligned addresses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 12 Dec 2017 15:43:34 +0100
From:   Peter Zijlstra <peterz@...radead.org>
To:     Ilia Mirkin <imirkin@...m.mit.edu>
Cc:     Ingo Molnar <mingo@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Pekka Paalanen <ppaalanen@...il.com>, Lyude <lyude@...hat.com>,
        Steven Rostedt <rostedt@...dmis.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Karol Herbst <kherbst@...hat.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>, hpa@...or.com,
        linux-tip-commits@...r.kernel.org,
        Karol Herbst <karolherbst@...il.com>
Subject: Re: [tip:x86/urgent] x86/mm/kmmio: Fix mmiotrace for page unaligned
 addresses

On Tue, Dec 12, 2017 at 09:21:10AM -0500, Ilia Mirkin wrote:
> The "thing" being mmiotrace, or the "thing" being page-unaligned addresses?

mmiotrace

> If the former, its primary use-case is for snooping on the NVIDIA
> proprietary GPU driver in order to figure out how to drive the
> underlying hardware. The driver does ioremap's to get at PCI space,
> which mmiotrace "steals" and provides pages without a present bit set,
> along with a fault handler. When the fault handler is hit, it
> reinstates the faulting page, and single-steps the faulting
> instruction

At which point you have valid page-tables and another CPU can access
that page too.

> reading the before/after regs to determine what happened
> (doesn't work universally, but enough for instructions used for PCI
> MMIO accesses). See mmio-mod.c::pre and post (the latter is called
> from the debug handler).

And after that you only invalidate the TLBs for the CPU that took the
initial fault, leaving possibly stale TLBs on other CPUs.


So this 'thing' has huge gaping SMP holes in.