On Tue, 9 Jan 2018, Peter Zijlstra wrote: > So CONFIG_PAGE_TABLE_ISOLATION=y and booting with "pti=off" makes it > 'work', right?
yes. Previously I was changing CONFIG_PAGE_TABLE_ISOLATION and recompiling, but just now I booted with it set to yes and pti=off and the fuzzer has been running fine for a half hour (usually it crashes in under 5 minutes). I did see these in the logs which I don't think I've seen before. WARNING: stack recursion on stack type 2 WARNING: can't dereference iret registers at 000000000783fea8 for ip paranoid_entry+0x2e/0x90 WARNING: can't dereference registers at 00000000f0698d17 for ip paranoid_entry+0x4c/0x90 WARNING: stack going in the wrong direction? ip=native_sched_clock+0x9/0x90 > The below is always my first try to get something out of the machine, > after that its printk() stuffing code to see how far we get.. > > In particular I'd start instrumenting the NMI entry_64.S code, because > that's really the biggest difference between PTI and !PTI :/ all rather > bothersome I'm afraid. I'll try that next. Also getting a few other machines up and into a state that I can start fuzzing on them. (extra challenge, the lab my machines is in possibly has a leak in the roof, and they're calling for an inch of rain on top of 3 feet of existing snow so I might have to shut everything down and relocate on short notice). Vince
