linux-kernel - Re: [RFC][PATCH] tracing/x86: Save CR2 before tracing irqsoff on error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190321163550.21b29194@gandalf.local.home>
Date:   Thu, 21 Mar 2019 16:35:50 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Andrew Cooper <andrew.cooper3@...rix.com>
Cc:     Andy Lutomirski <luto@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Jan Beulich <jbeulich@...e.com>,
        Boris Ostrovsky <boris.ostrovsky@...cle.com>,
        Juergen Gross <jgross@...e.com>,
        Stefano Stabellini <sstabellini@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        "H. Peter Anvin" <hpa@...or.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...nel.org>, Borislav Petkov <bp@...en8.de>,
        Joel Fernandes <joel@...lfernandes.org>,
        He Zhe <zhe.he@...driver.com>
Subject: Re: [RFC][PATCH] tracing/x86: Save CR2 before tracing irqsoff on
 error_entry

On Thu, 21 Mar 2019 20:00:19 +0000
Andrew Cooper <andrew.cooper3@...rix.com> wrote:

> I'm afraid that I've not got the original context of this thread, but
> I'm going to guess that something is resulting in a #PF before %cr2
> before it gets saved on the #PF path, and using a PVOP causes things to
> explode?

Actually it had nothing to do with PVOPs. It was tracing that caused
it. We added tracepoints to irqs off and on (with a config enabled),
and there's an option to allow taking user stack traces at any
tracepoint. The tracing of irqs off happened at the start of the page
fault entry, and by tracing the userspace stack (which can also fault)
we corrupted the cr2 for the original page fault.

The work now is to store that cr2 early on, but that requires doing it
in assembly, and that's where PVOPs makes the solution hard.

-- Steve


> 
> If it helps in the short term, Xen will trap and emulate a mov from cr2
> instruction correctly.  Performance will surely suck, but it might be an
> option if we need to rethink how this information is made available to
> guests.
> 
> Thanks,
> 
> ~Andrew