Re: [PATCH v10 00/18] Enable FSGSBASE instructions

From: Vegard Nossum
Date: Sun May 10 2020 - 04:31:19 EST


On 5/10/20 10:09 AM, Vegard Nossum wrote:

On 4/24/20 1:21 AM, Sasha Levin wrote:
Benefits:
Currently a user process that wishes to read or write the FS/GS base must
make a system call. But recent X86 processors have added new instructions
for use in 64-bit mode that allow direct access to the FS and GS segment
base addresses. The operating system controls whether applications can
use these instructions with a %cr4 control bit.
[...]
So FWIW I've done some overnight fuzz testing of this patch set and
haven't seen any problems. Will try a couple of other kernel configs too.

I spoke a few minutes too soon. Just hit this, if anybody wants to have
a look:

[ 6402.786418] ------------[ cut here ]------------
[ 6402.787769] WARNING: CPU: 0 PID: 13802 at arch/x86/kernel/traps.c:811 do_debug+0x16c/0x210
[ 6402.790042] CPU: 0 PID: 13802 Comm: init Not tainted 5.7.0-rc4+ #194
[ 6402.791779] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 6402.793365] RIP: 0010:do_debug+0x16c/0x210
[ 6402.794496] Code: ef e8 f8 fb 00 00 f6 85 91 00 00 00 02 74 b9 fa 66 66 90 66 66 90 e8 c3 f5 11 00 eb ab f6 85 88 00 00 00 03 0f 85 6e ff ff ff <0f> 0b 80 e4 bf 49 89 84 24 58 0a 00 00 f0 41 80 0c 24 10 48 81 a5
[ 6402.799557] RSP: 0000:fffffe0000011f20 EFLAGS: 00010046
[ 6402.800995] RAX: 0000000000004002 RBX: 0000000000000000 RCX: 00000000ffffffff
[ 6402.802959] RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffffffff82471e60
[ 6402.804891] RBP: fffffe0000011f58 R08: 0000000000000000 R09: 0000000000000005
[ 6402.806836] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88803e739a00
[ 6402.808775] R13: 0000000000000000 R14: 000000003ce24000 R15: 0000000000000000
[ 6402.810723] FS: 000000000097a8c0(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000
[ 6402.812933] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 6402.814509] CR2: 0000000040000010 CR3: 000000003ce24000 CR4: 00000000000006f0
[ 6402.816468] DR0: 0000000000000001 DR1: 0000000040006070 DR2: 00007ffff7ffd000
[ 6402.818406] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000003b3062a
[ 6402.820353] Call Trace:
[ 6402.821043] <#DB>
[ 6402.821622] debug+0x37/0x70
[ 6402.822449] RIP: 0010:arch_stack_walk_user+0x79/0x110
[ 6402.823851] Code: b8 f0 ff ff bf be f0 df ff ff 48 0f 44 c6 48 39 d0 0f 82 94 00 00 00 41 83 87 b8 09 00 00 01 66 66 90 0f ae e8 31 c0 48 8b 1a <66> 66 90 85 c0 75 72 66 66 90 0f ae e8 48 8b 72 08 66 66 90 85 c0
[ 6402.828923] RSP: 0000:ffffc90003807d80 EFLAGS: 00000046
[ 6402.830346] RAX: 0000000000000000 RBX: 0040001000bf4800 RCX: 0000000000000001
[ 6402.832288] RDX: 0000000040006073 RSI: 00000000400060dd RDI: ffffc90003807db8
[ 6402.834250] RBP: ffffc90003807f58 R08: 0000000000000001 R09: ffff88803e444400
[ 6402.836203] R10: 000000000000054c R11: ffff88803d2d955c R12: ffff88803e739a00
[ 6402.838139] R13: ffffffff810f16a0 R14: ffffc90003807db8 R15: ffff88803e739a00
[ 6402.840083] ? profile_setup.cold+0xa1/0xa1
[ 6402.841235] </#DB>
[ 6402.841836] stack_trace_save_user+0x8c/0xd4
[ 6402.843045] trace_buffer_unlock_commit_regs+0x122/0x1a0
[ 6402.844501] trace_event_buffer_commit+0x6d/0x240
[ 6402.845799] trace_event_raw_event_preemptirq_template+0x75/0xc0
[ 6402.847441] ? debug+0x53/0x70
[ 6402.848299] ? trace_hardirqs_off_thunk+0x1a/0x33
[ 6402.849593] trace_hardirqs_off_caller+0xa6/0xd0
[ 6402.850862] ? debug+0x4e/0x70
[ 6402.851727] trace_hardirqs_off_thunk+0x1a/0x33
[ 6402.852983] debug+0x53/0x70
[ 6402.853785] RIP: 0033:0x400060dd
[ 6402.854681] Code: 7a 1e 9e 91 de 4c 65 49 be 00 d0 ff f7 ff 7f 00 00 49 bf de a7 b3 e8 d7 21 3c 15 9c 48 81 0c 24 00 01 00 00 9d b8 62 00 00 00 <8e> c0 0f 05 66 8c c8 9c 48 81 24 24 ff fe ff ff 9d 48 89 04 25 40
[ 6402.859689] RSP: 002b:000000004000aea0 EFLAGS: 00000317
[ 6402.861116] RAX: 0000000000000062 RBX: 0000000040001000 RCX: ffffffffffffffff
[ 6402.863097] RDX: 0000000040003000 RSI: 0000000040004000 RDI: 0000000040001000
[ 6402.866199] RBP: 0000000040006073 R08: 0000000000000001 R09: 0000000000000001
[ 6402.868142] R10: ffffffffef080df2 R11: 1000000000000000 R12: fdffffffffffffff
[ 6402.870083] R13: 654cde919e1e7ab5 R14: 00007ffff7ffd000 R15: 153c21d7e8b3a7de
[ 6402.872049] ---[ end trace 91a3039d0fd63799 ]---

It might not be related to the patch set, mind.


Vegard