linux-kernel - Re: WARNING with LBR + precise_ip=2 + bpf_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 18 Jun 2020 23:21:11 +0000
From:   Song Liu <songliubraving@...com>
To:     Andi Kleen <ak@...ux.intel.com>
CC:     linux-kernel <linux-kernel@...r.kernel.org>,
        Kan Liang <kan.liang@...ux.intel.com>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Tejun Heo <tj@...nel.org>, "Andrii Nakryiko" <andriin@...com>,
        Francis Ricci <fjricci@...com>
Subject: Re: WARNING with LBR + precise_ip=2 + bpf_get_stackid()



> On Jun 18, 2020, at 3:35 PM, Andi Kleen <ak@...ux.intel.com> wrote:
> 
>> We noticed that this only happens with precise_ip >= 2. This is caused by 
>> setup_pebs_fixed_sample_data() using pens->real_ip:
>> 
>> 	set_linear_ip(regs, pebs->real_ip);
> 
> With precise_ip == 1 the IP will be one instruction behind.
> That's the only difference to 2 or 3.
> 
> So something about the actual instruction confuses the unwinder.
> 
> I would check if there is anything special about these IPs:
> 
>> 0xfffffe00004d1f78 entry_SYSCALL_64
>> 0xfffffe00004d1fa0 entry_SYSCALL_64
>> 0xfffffe00004d1fd8 entry_SYSCALL_64

I don't have this system at the moment. For the system I have, I got:

[36000.163945] WARNING: can't access registers at error_entry+0x74/0xe0
[36000.243879] WARNING: can't access registers at error_entry+0x65/0xe0
[36000.334288] WARNING: can't access registers at syscall_return_via_sysret+0x12/0x7f
[36000.540940] WARNING: can't access registers at syscall_return_via_sysret+0x6/0x7f
[58419.640387] WARNING: can't access registers at syscall_return_via_sysret+0xb/0x7f
[58423.082418] WARNING: can't access registers at syscall_return_via_sysret+0xf/0x7f
[58423.155705] WARNING: can't access registers at syscall_return_via_sysret+0x6/0x7f

And

(gdb) x/5i error_entry+0x65
   0xffffffff81c01075 <error_entry+101>:        pop    %r12
   0xffffffff81c01077 <error_entry+103>:        mov    %rsp,%rdi
   0xffffffff81c0107a <error_entry+106>:        callq  0xffffffff81aa7a30 <sync_regs>
   0xffffffff81c0107f <error_entry+111>:        mov    %rax,%rsp
   0xffffffff81c01082 <error_entry+114>:        push   %r12
(gdb) x/5i error_entry+0x74
   0xffffffff81c01084 <error_entry+116>:        retq
   0xffffffff81c01085 <error_entry+117>:        nop
   0xffffffff81c01086 <error_entry+118>:        nop
   0xffffffff81c01087 <error_entry+119>:        nop
   0xffffffff81c01088 <error_entry+120>:        retq
(gdb) x/5i syscall_return_via_sysret+0xb
   0xffffffff81c000ec <entry_SYSCALL_64+236>:   pop    %r10
   0xffffffff81c000ee <entry_SYSCALL_64+238>:   pop    %r9
   0xffffffff81c000f0 <entry_SYSCALL_64+240>:   pop    %r8
   0xffffffff81c000f2 <entry_SYSCALL_64+242>:   pop    %rax
   0xffffffff81c000f3 <entry_SYSCALL_64+243>:   pop    %rsi
(gdb) x/5i syscall_return_via_sysret+0xa
   0xffffffff81c000eb <entry_SYSCALL_64+235>:   pop    %rsi
   0xffffffff81c000ec <entry_SYSCALL_64+236>:   pop    %r10
   0xffffffff81c000ee <entry_SYSCALL_64+238>:   pop    %r9
   0xffffffff81c000f0 <entry_SYSCALL_64+240>:   pop    %r8
   0xffffffff81c000f2 <entry_SYSCALL_64+242>:   pop    %rax
(gdb) x/5i syscall_return_via_sysret+0x12
   0xffffffff81c000f3 <entry_SYSCALL_64+243>:   pop    %rsi
   0xffffffff81c000f4 <entry_SYSCALL_64+244>:   pop    %rdx
   0xffffffff81c000f5 <entry_SYSCALL_64+245>:   pop    %rsi
   0xffffffff81c000f6 <entry_SYSCALL_64+246>:   mov    %rsp,%rdi
   0xffffffff81c000f9 <entry_SYSCALL_64+249>:   mov    %gs:0x6004,%rsp
(gdb) x/5i syscall_return_via_sysret+0x6
   0xffffffff81c000e7 <entry_SYSCALL_64+231>:   pop    %r12
   0xffffffff81c000e9 <entry_SYSCALL_64+233>:   pop    %rbp
   0xffffffff81c000ea <entry_SYSCALL_64+234>:   pop    %rbx
   0xffffffff81c000eb <entry_SYSCALL_64+235>:   pop    %rsi
   0xffffffff81c000ec <entry_SYSCALL_64+236>:   pop    %r10

I am not sure whether there is anything special. Maybe "pop"?

Thanks,
Song