Re: ptrace vs FSGSBASE

[Andy Lutomirski]

On Mon, May 2, 2016 at 8:35 AM, Oleg Nesterov <oleg@xxxxxxxxxx> wrote:
> On 05/02, Andy Lutomirski wrote:
>>
>> On Mon, May 2, 2016 at 7:27 AM, Oleg Nesterov <oleg@xxxxxxxxxx> wrote:
>> >>
>> >> 1. I read fs_base using ptrace.  I think I should get the actual
>> >> fs_base without any nonsense.
>> >
>> > Which fs_base? The member of user_regs_struct? But this structure/layout
>> > is just the ABI, so to me it seems correct that getreg() tries to look
>> > at ->fs and/or ->fsindex.
>>
>> Yeah, the member of user_regs_struct.
>
> Still can't understand this... user_regs_struct is just the set of offsets
> we use to "name" the registers for getreg/putreg. We simply do not have
> "the actual fs_base" we could use in getreg(), we need to calculate it.

Right.  When I said writing to fs_base, I meant using POKEUSER or
similar to write to the thing referred to as fs_base via the helpers
in arch/x86/kernel/ptrace.c

>
>> > I can't understand what does "atomically" mean in this context.
>>
>> I mean "change fs and fs_base to these two values in a single syscall
>> so that the kernel can do something intelligent."
>>
>> Let me give some background:
>> [... snip ...]
>
> Thanks Andy. I need to re-read your explanation, but it seems I am starting
> to understand. And yes, I didn't bother to look at putreg() when I wrote
> my reply.
>
>> If you write, say, 0x2b to
>> fs and 12345 to fs_base using the ptrace API, you'd end up with FS ==
>> 0x2b and FSBASE == 0,
>
> Hmm. I can be easily wrong again but afaics in this case do_arch_prctl()
> will change fs/fs_base first and set
>
>         fsindex = FS_TLS_SEL
>         fs = 0
>
> and then... and then I simply can't understand what set_segment_reg(fs)
> will/should do in this case.

Exactly.  Hence my uncertainly as to what to do.

> Nor I can understand the "thread.fs != value"
> check before do_arch_prctl(ARCH_SET_FS). Confused.

I think that code was a optimization that doesn't make much sense.

It wouldn't surprise me if almost no one uses any of this
functionality right now.

--Andy