Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Sun, 6 Oct 2019 10:29:43 +0800
From:   Changbin Du <changbin.du@gmail.com>
To:     Dave Hansen <dave.hansen@intel.com>
Cc:     Andy Lutomirski <luto@kernel.org>,
        Changbin Du <changbin.du@gmail.com>,
        Dave Hansen <dave.hansen@linux.intel.com>,
        X86 ML <x86@kernel.org>, LKML <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] x86/mm: determine whether the fault address is canonical
Message-ID: <20191006022941.pvwldrjyhl4z5inu@mail.google.com>
References: <20191004134501.30651-1-changbin.du@gmail.com>
 <CALCETrWEhNCWDz7OVpbYJceJ5eShsWWhuyuAQQSzAdKncUo7zA@mail.gmail.com>
 <2d078dbc-73ca-0868-71f8-16e413ebdbf4@intel.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <2d078dbc-73ca-0868-71f8-16e413ebdbf4@intel.com>
User-Agent: NeoMutt/20180716
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Fri, Oct 04, 2019 at 08:14:25AM -0700, Dave Hansen wrote:
> On 10/4/19 7:59 AM, Andy Lutomirski wrote:
> >> @@ -123,7 +125,8 @@ __visible bool ex_handler_uaccess(const struct exception_table_entry *fixup,
> >>                                   unsigned long error_code,
> >>                                   unsigned long fault_addr)
> >>  {
> >> -       WARN_ONCE(trapnr == X86_TRAP_GP, "General protection fault in user access. Non-canonical address?");
> >> +       WARN_ONCE(trapnr == X86_TRAP_GP, "General protection fault at %s address in user access.",
> >> +                 is_canonical_addr(fault_addr) ? "canonical" : "non-canonical");
> > Unless the hardware behaves rather differently from the way I think it
> > does, fault_addr is garbage for anything other than #PF and sometimes
> > for #DF.  (And maybe the virtualization faults?)  I don't believe that
> > #GP fills in CR2.
> 
> For #GP, we do:
> 
> do_general_protection(struct pt_regs *regs, long error_code)
> {
> ...
>         if (!user_mode(regs)) {
>                 if (fixup_exception(regs, X86_TRAP_GP, error_code, 0))
>                         return;
> 
> Where the 0 is 'fault_addr'.  I'm not sure any other way that
> ex_handler_uaccess() can get called with trapnr == X86_TRAP_GP.  0 is
> canonical last I checked, which would make this patch a bit academic. :)
My fault. I thought the 'fault_addr' is filled with a valid value. So we really
don't know the answer without decoding the instruction which causes this #GP. :)

-- 
Cheers,
Changbin Du