lkml.org 
[lkml]   [2014]   [Mar]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [x86, vdso] BUG: unable to handle kernel paging request at d34bd000
On Mon, Mar 10, 2014 at 10:58 AM, H. Peter Anvin <hpa@linux.intel.com> wrote:
> On 03/10/2014 10:52 AM, Andy Lutomirski wrote:
>>>
>>> Hint: where is your RIP? Where is the RIP of other processes?
>>>
>>
>> Whoa there, I'm not suggesting anything nearly that crazy :)
>>
>> I'm suggesting changing out the vvar page *for that process*, which is
>> not executable. The actual vdso code already supports this -- from
>> userspace's point of view it's the same thing as 'echo acpi_pm >
>> /sys/devices/system/clocksource/clocksource0/current_clocksource',
>> except that if the actual clocksource is HPET, the hpet page will be
>> switched out (presumably with a zero page) while being read.
>>
>> Other processes are totally irrelevant, unless they share the same
>> struct mm. (This is why the vvar page can't be in the fixmap for this
>> to work.)
>>
>
> I meant "threads" not "processes"...

Still okay. The vclock_gettime code does, more or less:

do {
seq = raw_read_seqcount_begin(&gtod->seq);
mode = gtod->clock.vclock_mode;
read the time;
} while (unlikely(read_seqcount_retry(&gtod->seq, seq)));

Switching the clocksource in current code will make seq odd, then
change vclock_mode, then make seq even again. The prctl would zap the
mapping, flush the TLB, and then map something else (with a different
seq and vclock_mode) there. User code will be hard pressed to tell
the difference.

To avoid having to carve out a special seq value, I'd actually propose
just leaving seq odd for the TSC off case -- I think that the
vclock_gettime code could move the branch for mode == NONE inside the
loop with no loss in performance.

--Andy


\
 
 \ /
  Last update: 2014-03-10 20:01    [W:0.113 / U:1.168 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site