Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-30 Thread Boris Ostrovsky
On 07/30/2015 04:05 PM, Andy Lutomirski wrote: On Thu, Jul 30, 2015 at 1:01 PM, Boris Ostrovsky boris.ostrov...@oracle.com wrote: On 07/30/2015 02:54 PM, Andrew Cooper wrote: On 30/07/15 19:30, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 5:29 PM, Andrew Cooper andrew.coop...@citrix.com

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-30 Thread Boris Ostrovsky
On 07/30/2015 02:54 PM, Andrew Cooper wrote: On 30/07/15 19:30, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 5:29 PM, Andrew Cooper andrew.coop...@citrix.com wrote: On 30/07/2015 00:13, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 4:02 PM, Andrew Cooper andrew.coop...@citrix.com wrote:

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-30 Thread Andy Lutomirski
On Thu, Jul 30, 2015 at 1:01 PM, Boris Ostrovsky boris.ostrov...@oracle.com wrote: On 07/30/2015 02:54 PM, Andrew Cooper wrote: On 30/07/15 19:30, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 5:29 PM, Andrew Cooper andrew.coop...@citrix.com wrote: On 30/07/2015 00:13, Andy Lutomirski

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-30 Thread Andy Lutomirski
On Wed, Jul 29, 2015 at 5:29 PM, Andrew Cooper andrew.coop...@citrix.com wrote: On 30/07/2015 00:13, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 4:02 PM, Andrew Cooper andrew.coop...@citrix.com wrote: On 29/07/2015 23:49, Boris Ostrovsky wrote: On 07/29/2015 06:46 PM, David Vrabel wrote:

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-29 Thread Andrew Cooper
On 29/07/2015 23:05, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 2:37 PM, Andrew Cooper andrew.coop...@citrix.com wrote: On 29/07/2015 22:26, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 2:23 PM, Boris Ostrovsky boris.ostrov...@oracle.com wrote: On 07/29/2015 03:03 PM, Andrew Cooper

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-29 Thread Boris Ostrovsky
On 07/29/2015 06:11 PM, Andrew Cooper wrote: On 29/07/2015 23:05, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 2:37 PM, Andrew Cooper andrew.coop...@citrix.com wrote: On 29/07/2015 22:26, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 2:23 PM, Boris Ostrovsky boris.ostrov...@oracle.com

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-29 Thread Boris Ostrovsky
On 07/29/2015 03:03 PM, Andrew Cooper wrote: On 29/07/15 15:43, Boris Ostrovsky wrote: FYI, I have got a repro now and am investigating. Good and bad news. This bug has nothing to do with LDTs themselves. I have worked out what is going on, but this: diff --git a/arch/x86/xen/enlighten.c

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-29 Thread Boris Ostrovsky
On 07/29/2015 05:26 PM, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 2:23 PM, Boris Ostrovsky boris.ostrov...@oracle.com wrote: On 07/29/2015 03:03 PM, Andrew Cooper wrote: On 29/07/15 15:43, Boris Ostrovsky wrote: FYI, I have got a repro now and am investigating. Good and bad news. This

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-29 Thread Andy Lutomirski
On Wed, Jul 29, 2015 at 2:37 PM, Andrew Cooper andrew.coop...@citrix.com wrote: On 29/07/2015 22:26, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 2:23 PM, Boris Ostrovsky boris.ostrov...@oracle.com wrote: On 07/29/2015 03:03 PM, Andrew Cooper wrote: On 29/07/15 15:43, Boris Ostrovsky wrote:

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-29 Thread Andy Lutomirski
On Wed, Jul 29, 2015 at 2:23 PM, Boris Ostrovsky boris.ostrov...@oracle.com wrote: On 07/29/2015 03:03 PM, Andrew Cooper wrote: On 29/07/15 15:43, Boris Ostrovsky wrote: FYI, I have got a repro now and am investigating. Good and bad news. This bug has nothing to do with LDTs themselves.

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-29 Thread Andrew Cooper
On 29/07/2015 22:26, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 2:23 PM, Boris Ostrovsky boris.ostrov...@oracle.com wrote: On 07/29/2015 03:03 PM, Andrew Cooper wrote: On 29/07/15 15:43, Boris Ostrovsky wrote: FYI, I have got a repro now and am investigating. Good and bad news. This bug

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-29 Thread Andrew Cooper
On 29/07/15 15:43, Boris Ostrovsky wrote: FYI, I have got a repro now and am investigating. Good and bad news. This bug has nothing to do with LDTs themselves. I have worked out what is going on, but this: diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c index 5abeaac..7e1a82e

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-29 Thread David Vrabel
On 29/07/2015 23:49, Boris Ostrovsky wrote: On 07/29/2015 06:46 PM, David Vrabel wrote: On 29/07/2015 23:11, Andrew Cooper wrote: On 29/07/2015 23:05, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 2:37 PM, Andrew Cooper andrew.coop...@citrix.com wrote: On 29/07/2015 22:26, Andy

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-29 Thread Andrew Cooper
On 29/07/2015 23:49, Boris Ostrovsky wrote: On 07/29/2015 06:46 PM, David Vrabel wrote: On 29/07/2015 23:11, Andrew Cooper wrote: On 29/07/2015 23:05, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 2:37 PM, Andrew Cooper andrew.coop...@citrix.com wrote: On 29/07/2015 22:26, Andy Lutomirski

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-29 Thread Boris Ostrovsky
On 07/29/2015 06:46 PM, David Vrabel wrote: On 29/07/2015 23:11, Andrew Cooper wrote: On 29/07/2015 23:05, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 2:37 PM, Andrew Cooper andrew.coop...@citrix.com wrote: On 29/07/2015 22:26, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 2:23 PM,

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-29 Thread Andrew Cooper
On 30/07/2015 00:13, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 4:02 PM, Andrew Cooper andrew.coop...@citrix.com wrote: On 29/07/2015 23:49, Boris Ostrovsky wrote: On 07/29/2015 06:46 PM, David Vrabel wrote: On 29/07/2015 23:11, Andrew Cooper wrote: On 29/07/2015 23:05, Andy Lutomirski

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-29 Thread David Vrabel
On 29/07/2015 23:11, Andrew Cooper wrote: On 29/07/2015 23:05, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 2:37 PM, Andrew Cooper andrew.coop...@citrix.com wrote: On 29/07/2015 22:26, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 2:23 PM, Boris Ostrovsky boris.ostrov...@oracle.com

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-29 Thread Andy Lutomirski
On Wed, Jul 29, 2015 at 4:02 PM, Andrew Cooper andrew.coop...@citrix.com wrote: On 29/07/2015 23:49, Boris Ostrovsky wrote: On 07/29/2015 06:46 PM, David Vrabel wrote: On 29/07/2015 23:11, Andrew Cooper wrote: On 29/07/2015 23:05, Andy Lutomirski wrote: On Wed, Jul 29, 2015 at 2:37 PM,

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-29 Thread Boris Ostrovsky
On 07/29/2015 10:21 AM, Andrew Cooper wrote: On 29/07/15 06:28, Andy Lutomirski wrote: On Tue, Jul 28, 2015 at 8:01 PM, Boris Ostrovsky boris.ostrov...@oracle.com wrote: On 07/28/2015 08:47 PM, Andrew Cooper wrote: On 29/07/2015 01:21, Andy Lutomirski wrote: On Tue, Jul 28, 2015 at 10:10 AM,

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-29 Thread Andrew Cooper
On 29/07/15 06:28, Andy Lutomirski wrote: On Tue, Jul 28, 2015 at 8:01 PM, Boris Ostrovsky boris.ostrov...@oracle.com wrote: On 07/28/2015 08:47 PM, Andrew Cooper wrote: On 29/07/2015 01:21, Andy Lutomirski wrote: On Tue, Jul 28, 2015 at 10:10 AM, Boris Ostrovsky boris.ostrov...@oracle.com

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-28 Thread Andy Lutomirski
On Tue, Jul 28, 2015 at 10:10 AM, Boris Ostrovsky boris.ostrov...@oracle.com wrote: On 07/28/2015 01:07 PM, Andy Lutomirski wrote: On Tue, Jul 28, 2015 at 9:30 AM, Andrew Cooper andrew.coop...@citrix.com wrote: I suspect that the set_ldt(NULL, 0) call hasn't reached Xen before

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-28 Thread Andrew Cooper
On 29/07/2015 01:21, Andy Lutomirski wrote: On Tue, Jul 28, 2015 at 10:10 AM, Boris Ostrovsky boris.ostrov...@oracle.com wrote: On 07/28/2015 01:07 PM, Andy Lutomirski wrote: On Tue, Jul 28, 2015 at 9:30 AM, Andrew Cooper andrew.coop...@citrix.com wrote: I suspect that the set_ldt(NULL, 0)

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-28 Thread Boris Ostrovsky
On 07/28/2015 06:29 AM, Andrew Cooper wrote: After forward-porting my virtio patches, I got this thing to run on Xen. After several tries, I got: [ 53.985707] [ cut here ] [ 53.986314] kernel BUG at arch/x86/xen/enlighten.c:496! [ 53.986677] invalid opcode:

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-28 Thread Boris Ostrovsky
On 07/28/2015 11:15 AM, Konrad Rzeszutek Wilk wrote: On Tue, Jul 28, 2015 at 10:50:39AM -0400, Boris Ostrovsky wrote: On 07/28/2015 10:35 AM, Andrew Cooper wrote: On 28/07/15 15:05, Boris Ostrovsky wrote: On 07/28/2015 06:29 AM, Andrew Cooper wrote: After forward-porting my virtio patches, I

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-28 Thread Andy Lutomirski
On Jul 28, 2015 3:30 AM, Andrew Cooper andrew.coop...@citrix.com wrote: On 28/07/15 04:16, Andy Lutomirski wrote: On Mon, Jul 27, 2015 at 7:20 PM, Andy Lutomirski l...@amacapital.net wrote: On Mon, Jul 27, 2015 at 9:18 AM, Boris Ostrovsky boris.ostrov...@oracle.com wrote: On

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-28 Thread Konrad Rzeszutek Wilk
On Tue, Jul 28, 2015 at 10:50:39AM -0400, Boris Ostrovsky wrote: On 07/28/2015 10:35 AM, Andrew Cooper wrote: On 28/07/15 15:05, Boris Ostrovsky wrote: On 07/28/2015 06:29 AM, Andrew Cooper wrote: After forward-porting my virtio patches, I got this thing to run on Xen. After several tries, I

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-28 Thread Andrew Cooper
On 28/07/15 15:50, Boris Ostrovsky wrote: On 07/28/2015 10:35 AM, Andrew Cooper wrote: On 28/07/15 15:05, Boris Ostrovsky wrote: On 07/28/2015 06:29 AM, Andrew Cooper wrote: After forward-porting my virtio patches, I got this thing to run on Xen. After several tries, I got: [ 53.985707]

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-28 Thread Andrew Cooper
On 28/07/15 15:05, Boris Ostrovsky wrote: On 07/28/2015 06:29 AM, Andrew Cooper wrote: After forward-porting my virtio patches, I got this thing to run on Xen. After several tries, I got: [ 53.985707] [ cut here ] [ 53.986314] kernel BUG at

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-28 Thread Boris Ostrovsky
On 07/28/2015 10:35 AM, Andrew Cooper wrote: On 28/07/15 15:05, Boris Ostrovsky wrote: On 07/28/2015 06:29 AM, Andrew Cooper wrote: After forward-porting my virtio patches, I got this thing to run on Xen. After several tries, I got: [ 53.985707] [ cut here ] [

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-28 Thread Boris Ostrovsky
On 07/28/2015 11:23 AM, Andrew Cooper wrote: On 28/07/15 15:50, Boris Ostrovsky wrote: On 07/28/2015 10:35 AM, Andrew Cooper wrote: On 28/07/15 15:05, Boris Ostrovsky wrote: On 07/28/2015 06:29 AM, Andrew Cooper wrote: After forward-porting my virtio patches, I got this thing to run on Xen.

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-28 Thread Andrew Cooper
On 28/07/15 04:16, Andy Lutomirski wrote: On Mon, Jul 27, 2015 at 7:20 PM, Andy Lutomirski l...@amacapital.net wrote: On Mon, Jul 27, 2015 at 9:18 AM, Boris Ostrovsky boris.ostrov...@oracle.com wrote: On 07/27/2015 11:53 AM, Andy Lutomirski wrote: On Mon, Jul 27, 2015 at 8:36 AM, Boris

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-28 Thread Andrew Cooper
On 28/07/15 16:43, Andy Lutomirski wrote: After forward-porting my virtio patches, I got this thing to run on Xen. After several tries, I got: [ 53.985707] [ cut here ] [ 53.986314] kernel BUG at arch/x86/xen/enlighten.c:496! [ 53.986677] invalid opcode:

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-28 Thread Andy Lutomirski
On Tue, Jul 28, 2015 at 9:30 AM, Andrew Cooper andrew.coop...@citrix.com wrote: I suspect that the set_ldt(NULL, 0) call hasn't reached Xen before xen_free_ldt() is attempting to nab back the pages which Xen still has mapped as an LDT. I just instrumented it with yet more LSL instructions.

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-28 Thread Boris Ostrovsky
On 07/28/2015 01:07 PM, Andy Lutomirski wrote: On Tue, Jul 28, 2015 at 9:30 AM, Andrew Cooper andrew.coop...@citrix.com wrote: I suspect that the set_ldt(NULL, 0) call hasn't reached Xen before xen_free_ldt() is attempting to nab back the pages which Xen still has mapped as an LDT. I just

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-27 Thread Boris Ostrovsky
On 07/25/2015 01:36 AM, Andy Lutomirski wrote: Here's v3. It fixes the dazed and confused issue, I hope. It's also probably a good general attack surface reduction, and it replaces some scary code with IMO less scary code. Also, servers and embedded systems should probably turn off

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-27 Thread Andy Lutomirski
On Mon, Jul 27, 2015 at 8:36 AM, Boris Ostrovsky boris.ostrov...@oracle.com wrote: On 07/25/2015 01:36 AM, Andy Lutomirski wrote: Here's v3. It fixes the dazed and confused issue, I hope. It's also probably a good general attack surface reduction, and it replaces some scary code with IMO

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-27 Thread Boris Ostrovsky
On 07/27/2015 11:53 AM, Andy Lutomirski wrote: On Mon, Jul 27, 2015 at 8:36 AM, Boris Ostrovsky boris.ostrov...@oracle.com wrote: On 07/25/2015 01:36 AM, Andy Lutomirski wrote: Here's v3. It fixes the dazed and confused issue, I hope. It's also probably a good general attack surface

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-27 Thread Andy Lutomirski
On Mon, Jul 27, 2015 at 9:18 AM, Boris Ostrovsky boris.ostrov...@oracle.com wrote: On 07/27/2015 11:53 AM, Andy Lutomirski wrote: On Mon, Jul 27, 2015 at 8:36 AM, Boris Ostrovsky boris.ostrov...@oracle.com wrote: On 07/25/2015 01:36 AM, Andy Lutomirski wrote: Here's v3. It fixes the dazed

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-27 Thread Andy Lutomirski
On Mon, Jul 27, 2015 at 8:16 PM, Andy Lutomirski l...@amacapital.net wrote: On Mon, Jul 27, 2015 at 7:20 PM, Andy Lutomirski l...@amacapital.net wrote: On Mon, Jul 27, 2015 at 9:18 AM, Boris Ostrovsky boris.ostrov...@oracle.com wrote: On 07/27/2015 11:53 AM, Andy Lutomirski wrote: On Mon,

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-27 Thread Boris Ostrovsky
On 07/27/2015 11:16 PM, Andy Lutomirski wrote: On Mon, Jul 27, 2015 at 7:20 PM, Andy Lutomirski l...@amacapital.net wrote: On Mon, Jul 27, 2015 at 9:18 AM, Boris Ostrovsky boris.ostrov...@oracle.com wrote: On 07/27/2015 11:53 AM, Andy Lutomirski wrote: On Mon, Jul 27, 2015 at 8:36 AM, Boris

Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-25 Thread Willy Tarreau
On Fri, Jul 24, 2015 at 10:36:43PM -0700, Andy Lutomirski wrote: Willy and Kees: I left the config option alone. The -tiny people will like it, and we can always add a sysctl of some sort later. OK, please ignore my other e-mail I missed this part. I'll see if I can propose the sysctl

[Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

2015-07-24 Thread Andy Lutomirski
Here's v3. It fixes the dazed and confused issue, I hope. It's also probably a good general attack surface reduction, and it replaces some scary code with IMO less scary code. Also, servers and embedded systems should probably turn off modify_ldt. This makes that possible. Xen people, can you