CINXE.COM

<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>LKML: Roland McGrath: [PATCH] x86_64: handle iret faults better</title><link href="/css/message.css" rel="stylesheet" type="text/css" /><link href="/css/wrap.css" rel="alternate stylesheet" type="text/css" title="wrap" /><link href="/css/nowrap.css" rel="stylesheet" type="text/css" title="nowrap" /><link href="/favicon.ico" rel="shortcut icon" /><script src="/js/simple-calendar.js" type="text/javascript"></script><script src="/js/styleswitcher.js" type="text/javascript"></script><link rel="alternate" type="application/rss+xml" title="lkml.org : last 100 messages" href="/rss.php" /><link rel="alternate" type="application/rss+xml" title="lkml.org : last messages by Roland McGrath" href="/groupie.php?aid=8730" /><script> var _paq = window._paq = window._paq || []; /* tracker methods like "setCustomDimension" should be called before "trackPageView" */ _paq.push(["setDoNotTrack", true]); _paq.push(["disableCookies"]); _paq.push(['trackPageView']); _paq.push(['enableLinkTracking']); (function() { var u="//m.lkml.org/"; _paq.push(['setTrackerUrl', u+'matomo.php']); _paq.push(['setSiteId', '1']); var d=document, g=d.createElement('script'), s=d.getElementsByTagName('script')[0]; g.async=true; g.src=u+'matomo.js'; s.parentNode.insertBefore(g,s); })(); </script></head><body onload="es.jasper.simpleCalendar.init();" itemscope="itemscope" itemtype="http://schema.org/BlogPosting"><table border="0" cellpadding="0" cellspacing="0"><tr><td width="180" align="center"><a href="/"><img style="border:0;width:135px;height:32px" src="/images/toprowlk.gif" alt="lkml.org" /></a></td><td width="32">聽</td><td class="nb"><div><a class="nb" href="/lkml"> [lkml]</a> 聽 <a class="nb" href="/lkml/2005"> [2005]</a> 聽 <a class="nb" href="/lkml/2005/4"> [Apr]</a> 聽 <a class="nb" href="/lkml/2005/4/23"> [23]</a> 聽 <a class="nb" href="/lkml/last100"> [last100]</a> 聽 <a href="/rss.php"><img src="/images/rss-or.gif" border="0" alt="RSS Feed" /></a></div><div>Views: <a href="#" class="nowrap" onclick="setActiveStyleSheet('wrap');return false;">[wrap]</a><a href="#" class="wrap" onclick="setActiveStyleSheet('nowrap');return false;">[no wrap]</a> 聽 <a class="nb" href="/lkml/mheaders/2005/4/23/129" onclick="this.href='/lkml/headers'+'/2005/4/23/129';">[headers]</a>聽 <a href="/lkml/bounce/2005/4/23/129">[forward]</a>聽 </div></td><td width="32">聽</td></tr><tr><td valign="top"><div class="es-jasper-simpleCalendar" baseurl="/lkml/"></div><div class="threadlist">Messages in this thread</div><ul class="threadlist"><li class="root"><a href="/lkml/2005/4/23/129">First message in thread</a></li><li class="origin"><a href="/lkml/2005/4/25/84">Roland McGrath</a><ul><li><a href="/lkml/2005/4/25/84">Andi Kleen</a><ul><li><a href="/lkml/2005/4/25/91">Linus Torvalds</a><ul><li><a href="/lkml/2005/4/25/236">Roland McGrath</a><ul><li><a href="/lkml/2005/4/25/242">Linus Torvalds</a></li></ul></li></ul></li></ul></li></ul></li></ul><div class="threadlist">Patch in this message</div><ul class="threadlist"><li><a href="/lkml/diff/2005/4/23/129/1">Get diff 1</a></li></ul></td><td width="32" rowspan="2" class="c" valign="top"><img src="/images/icornerl.gif" width="32" height="32" alt="/" /></td><td class="c" rowspan="2" valign="top" style="padding-top: 1em"><table><tr><td><table><tr><td class="lp">Date</td><td class="rp" itemprop="datePublished">Sat, 23 Apr 2005 17:50:37 -0700</td></tr><tr><td class="lp">From</td><td class="rp" itemprop="author">Roland McGrath <></td></tr><tr><td class="lp">Subject</td><td class="rp" itemprop="name">[PATCH] x86_64: handle iret faults better</td></tr></table></td><td></td></tr></table><pre itemprop="articleBody">This is the x86_64 variant of the i386 fix I just submitted. I think iret can only produce these faults when returning to user mode in a 32-bit process. The failure mode is even more mysterious on x86_64, because it exits with -9999&0x7f instead of 11 (SIGSEGV), so it says "Unknown signal 113 (core dumped)" when it exits without actually trying to dump a core file. Thanks, Roland Signed-off-by: Roland McGrath <roland@redhat.com> --- linux-2.6/arch/x86_64/kernel/entry.S +++ linux-2.6/arch/x86_64/kernel/entry.S @@ -471,14 +470,6 @@ iret_label: .section __ex_table,"a" .quad iret_label,bad_iret .previous - .section .fixup,"ax" - /* force a signal here? this matches i386 behaviour */ - /* running with kernel gs */ -bad_iret: - movq $-9999,%rdi /* better code? */ - jmp do_exit - .previous - /* edi: workmask, edx: work */ retint_careful: bt $TIF_NEED_RESCHED,%edx @@ -522,6 +513,31 @@ retint_kernel: #endif CFI_ENDPROC + /* + * Traps in iret mean that userland tried to restore a bogus + * cs, eip, ss, esp, or eflags. Some kinds of bogosity just cause + * a trap after the iret returns, but some will cause a trap in + * iret itself. We want to treat those as if the restored user + * state is what caused that trap, i.e. produce the appropriate signal. + * Since normal .fixup code doesn't have access to the trap info, + * traps.c has a special case for iret. It's already generated the + * signal before we resume at bad_iret. Now we just need to recover + * the whole frame we were trying to restore, so it can be seen on + * our stack by the debugger. + */ + .section .fixup,"ax" + /* running with kernel gs */ +ENTRY(bad_iret) + CFI_STARTPROC simple + CFI_DEF_CFA rsp,(SS+8-RIP) + CFI_REL_OFFSET rip,0 + CFI_REL_OFFSET rsp,(RSP-RIP) + SAVE_ARGS 8 + jmp exit_intr + CFI_ENDPROC + .previous + + /* * APIC interrupts. */ @@ -826,7 +842,10 @@ paranoid_swapgs: swapgs paranoid_restore: RESTORE_ALL 8 - iretq +1: iretq + .section __ex_table,"a" + .quad 1b,bad_iret + .previous paranoid_userspace: cli GET_THREAD_INFO(%rcx) --- linux-2.6/arch/x86_64/kernel/traps.c +++ linux-2.6/arch/x86_64/kernel/traps.c @@ -404,6 +404,44 @@ void die_nmi(char *str, struct pt_regs * do_exit(SIGSEGV); } + +/* + * When we get an exception in the iret instructions in entry.S, whatever + * fault it is really belongs to the user state we are restoring. We want + * to turn it into a signal. To make that signal's info exactly match what + * this same kind of fault in a user instruction would show, the fixup + * needs to know the trapno and error code. But those are lost when we get + * back to the fixup entrypoint. So we have a special case for the iret + * fixups, and generate the signal here like a normal user trap would. + * Then the fixup code restores the pt_regs on the base of the stack to + * the bogus user state it was trying to return to, before handling the signal. + */ +extern void bad_iret(void); /* entry.S label for code in .fixup */ +static inline int is_iret(struct pt_regs *regs) +{ + return (regs->rip == (unsigned long)&bad_iret); +} + +/* + * If the iret was actually trying to return to kernel mode, + * that should be an oops. + */ +static inline int iret_to_user(struct pt_regs *regs) +{ + /* + * The frame being restored was all popped off and restored except + * the last five words that iret pops. Instead of popping, it + * pushed another trap frame, clobbering the part of the old one + * that we had already restored. So the restored registers are now + * all back in the new trap frame, but the rip et al show the + * in-kernel state at the iret instruction. The bad state we tried + * to restore with iret is still on the old stack below. + */ + struct pt_regs *oregs = container_of((unsigned long *) regs->rsp, + struct pt_regs, rip); + + return likely((oregs->cs & 3) == 3); +} static void do_trap(int trapnr, int signr, char *str, struct pt_regs * regs, long error_code, siginfo_t *info) { @@ -423,7 +461,9 @@ static void do_trap(int trapnr, int sign #endif if ((regs->cs & 3) != 0) { - struct task_struct *tsk = current; + struct task_struct *tsk; + user_trap: + tsk = current; if (exception_trace && unhandled_signal(tsk, signr)) printk(KERN_INFO @@ -447,7 +487,13 @@ static void do_trap(int trapnr, int sign fixup = search_exception_tables(regs->rip); if (fixup) { regs->rip = fixup->fixup; - } else - die(str, regs, error_code); + if (!is_iret(regs)) + return; + if (iret_to_user(regs)) { + local_irq_enable(); + goto user_trap; + } + } + die(str, regs, error_code); return; } @@ -523,8 +569,10 @@ asmlinkage void do_general_protection(st } #endif - if ((regs->cs & 3)!=0) { - struct task_struct *tsk = current; + if ((regs->cs & 3) != 0) { + struct task_struct *tsk; + user_gp: + tsk = current; if (exception_trace && unhandled_signal(tsk, SIGSEGV)) printk(KERN_INFO @@ -544,7 +592,12 @@ asmlinkage void do_general_protection(st fixup = search_exception_tables(regs->rip); if (fixup) { regs->rip = fixup->fixup; - return; + if (!is_iret(regs)) + return; + if (iret_to_user(regs)) { + local_irq_enable(); + goto user_gp; + } } if (notify_die(DIE_GPF, "general protection fault", regs, error_code, 13, SIGSEGV) == NOTIFY_STOP) - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at <a href="http://vger.kernel.org/majordomo-info.html">http://vger.kernel.org/majordomo-info.html</a> Please read the FAQ at <a href="http://www.tux.org/lkml/">http://www.tux.org/lkml/</a> </pre></td><td width="32" rowspan="2" class="c" valign="top"><img src="/images/icornerr.gif" width="32" height="32" alt="\" /></td></tr><tr><td align="right" valign="bottom"> 聽 </td></tr><tr><td align="right" valign="bottom">聽</td><td class="c" valign="bottom" style="padding-bottom: 0px"><img src="/images/bcornerl.gif" width="32" height="32" alt="\" /></td><td class="c">聽</td><td class="c" valign="bottom" style="padding-bottom: 0px"><img src="/images/bcornerr.gif" width="32" height="32" alt="/" /></td></tr><tr><td align="right" valign="top" colspan="2"> 聽 </td><td class="lm">Last update: 2005-04-24 02:55 聽聽 [from the cache] 漏2003-2020 <a href="http://blog.jasper.es/">Jasper Spaans</a>|hosted at <a href="https://www.digitalocean.com/?refcode=9a8e99d24cf9">Digital Ocean</a> and my Meterkast|<a href="http://blog.jasper.es/categories.html#lkml-ref">Read the blog</a></td><td>聽</td></tr></table><script language="javascript" src="/js/styleswitcher.js" type="text/javascript"></script></body></html>