Messages in this thread | | | From | Andy Lutomirski <> | Date | Mon, 10 Mar 2014 11:10:57 -0700 | Subject | Re: [x86, vdso] BUG: unable to handle kernel paging request at d34bd000 |
| |
On Mon, Mar 10, 2014 at 10:58 AM, H. Peter Anvin <hpa@linux.intel.com> wrote: > On 03/10/2014 10:52 AM, Andy Lutomirski wrote: >>> >>> Hint: where is your RIP? Where is the RIP of other processes? >>> >> >> Whoa there, I'm not suggesting anything nearly that crazy :) >> >> I'm suggesting changing out the vvar page *for that process*, which is >> not executable. The actual vdso code already supports this -- from >> userspace's point of view it's the same thing as 'echo acpi_pm > >> /sys/devices/system/clocksource/clocksource0/current_clocksource', >> except that if the actual clocksource is HPET, the hpet page will be >> switched out (presumably with a zero page) while being read. >> >> Other processes are totally irrelevant, unless they share the same >> struct mm. (This is why the vvar page can't be in the fixmap for this >> to work.) >> > > I meant "threads" not "processes"...
Still okay. The vclock_gettime code does, more or less:
do { seq = raw_read_seqcount_begin(>od->seq); mode = gtod->clock.vclock_mode; read the time; } while (unlikely(read_seqcount_retry(>od->seq, seq)));
Switching the clocksource in current code will make seq odd, then change vclock_mode, then make seq even again. The prctl would zap the mapping, flush the TLB, and then map something else (with a different seq and vclock_mode) there. User code will be hard pressed to tell the difference.
To avoid having to carve out a special seq value, I'd actually propose just leaving seq odd for the TSC off case -- I think that the vclock_gettime code could move the branch for mode == NONE inside the loop with no loss in performance.
--Andy
| |