Messages in this thread | | | Subject | Re: [RESEND PATCH v6 08/12] x86/fsgsbase/64: Use the per-CPU base as GSBASE at the paranoid_entry | From | Andy Lutomirski <> | Date | Wed, 1 May 2019 13:25:56 -0700 |
| |
> On May 1, 2019, at 1:21 PM, Bae, Chang Seok <chang.seok.bae@intel.com> wrote: > > >>> On May 1, 2019, at 11:01, Bae, Chang Seok <chang.seok.bae@intel.com> wrote: >>> >>> On May 1, 2019, at 10:40, Andy Lutomirski <luto@kernel.org> wrote: >>> >>> On Wed, May 1, 2019 at 6:52 AM Bae, Chang Seok <chang.seok.bae@intel.com> wrote: >>>> >>>> >>>>> On Apr 5, 2019, at 06:50, Andy Lutomirski <luto@amacapital.net> wrote: >>>>> >>>>> Furthermore, if you folks even want me to review this series, the ptrace tests need to be in place. On inspection of the current code (after the debacle a few releases back), it appears the SETREGSET’s effect depends on the current values in the registers — it does not actually seem to reliably load the whole state. So my confidence will be greatly increased if your series first adds a test that detects that bug (and fails!), then fixes the bug in a tiny little patch, then adds FSGSBASE, and keeps the test working. >>>>> >>>> >>>> I think I need to understand the issue. Appreciate if you can elaborate a little bit. >>>> >>> >>> This patch series gives a particular behavior to PTRACE_SETREGS and >>> PTRACE_POKEUSER. There should be a test case that validates that >>> behavior, including testing the weird cases where gs != 0 and gsbase >>> contains unusual values. Some existing tests might be pretty close to >>> doing what's needed. >>> >>> Beyond that, the current putreg() code does this: >>> >>> case offsetof(struct user_regs_struct,gs_base): >>> /* >>> * Exactly the same here as the %fs handling above. >>> */ >>> if (value >= TASK_SIZE_MAX) >>> return -EIO; >>> if (child->thread.gsbase != value) >>> return do_arch_prctl_64(child, ARCH_SET_GS, value); >>> return 0; >>> >>> and do_arch_prctl_64(), in turn, does this: >>> >>> case ARCH_SET_GS: { >>> if (unlikely(arg2 >= TASK_SIZE_MAX)) >>> return -EPERM; >>> >>> preempt_disable(); >>> /* >>> * ARCH_SET_GS has always overwritten the index >>> * and the base. Zero is the most sensible value >>> * to put in the index, and is the only value that >>> * makes any sense if FSGSBASE is unavailable. >>> */ >>> if (task == current) { >>> [not used for ptrace] >>> } else { >>> task->thread.gsindex = 0; >>> x86_gsbase_write_task(task, arg2); >>> } >>> >>> ... >>> >>> So writing the value that was already there to gsbase via putreg() >>> does nothing, but writing a *different* value implicitly clears gs, >>> but writing a different value will clear gs. >>> >>> This behavior is, AFAICT, complete nonsense. It happens to work >>> because usually gdb writes the same value back, and, in any case, gs >>> comes *after* gsbase in user_regs_struct, so gs gets replaced anyway. >>> But I think that this behavior should be fixed up and probably tested. >>> Certainly the behavior should *not* be the same on a fsgsbase kernel, >>> and and the fsgsbase behavior definitely needs a selftest. >> >> Okay, got the point; now crystal clear. >> >> I have my own test case for that though, need to find a very simple and >> acceptable solution. >> > > One solution that I recall, HPA once suggested, is: > Write registers in a reverse order from user_regs_struct, for SETREGS > > Assuming these for clarification, first: > * old and new index != 0 > * taking GS as an example though, should be the same with FS > > Then, interesting cases would be something like these, without FSGSBASE: > Case (a), when index only changed to (new index): > (Then, the result after SETREGS would be) > GS = (new index), GSBASE = the base fetched from (new index) > Case (b), when base only changed to (new base): > Case (c), when both are changed: > GS = 0, GSBASE = (new base) > > Now, with FSGSBASE: > Case (a): > GS = (new index), GSBASE = (old base) > Case (b): > GS = (old index), GSBASE = (new base) > Case (c): > GS = (new index), GSBASE = (new base) > > As a reference, today's kernel behavior, without FSGSBASE: > Case (a): > GS = (new index), GSBASE = the base fetched from (new index) > Case (b): > GS = (old index), GSBASE = (old base) > Case (c): > GS = (new index), GSBASE = the base fetched from (new index) > > Now, with that reverse ordering and taking that "GSBASE is important" [1], > it looks like to be working in terms of its base value: > Case (b) and (c) will behave the same as with FSGSBASE > Case (a) still differs between w/ and w/o FSGSBASE. > Well, I'd say this bit comes from the 'new model' vs. the 'leagcy > model'. So, then okay with that. Any thoughts? > > >
This seems more complicated than needed. How about we just remove all the magic and make putreg on the base registers never change the selector.
As far as I can tell, the only downside is that, on a non-FSGSBASE kernel, setting only the base if the selector already has a nonzero value won’t work, but I would be quite surprised if this breaks anything.
| |