Received: by 2002:ac0:8c8e:0:0:0:0:0 with SMTP id r14csp1082932ima; Wed, 6 Feb 2019 13:26:20 -0800 (PST) X-Google-Smtp-Source: AHgI3Ia0Hf64pzW4AldCPLaiCV1eE/tb4Ni2qKGb1DS0uIvyjs2e2gfHNkPgX5bi7lxfQP2KpGKf X-Received: by 2002:a63:f40e:: with SMTP id g14mr2934425pgi.326.1549488380835; Wed, 06 Feb 2019 13:26:20 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1549488380; cv=none; d=google.com; s=arc-20160816; b=OHKM7T2pTJGWzhfTAsPY9Mp1j2pEv2lZp4rDHOkxf0+qMBBUcfmuR2Par6+F9VpMrG H/6ByymAFrtZwSoB8lfvwt+R6ftula1ubSFu9oAv6dYC/pE31t3AOk1yBbFuTWRJV9tW 3FmBPj7QPLRGQM5xJgJKTEmy/5lAok0aNAIG8F5aPakZdFVMQv0aDbpDcwWWtVWiMXB1 s7TdWRWKhPAKr5B88DYIFMs5HXHBgONAuVhP7o+GWms4CK1PfiKFztmWP4V+yFZur/4S YTryOwUW8AJ4tRH9Eh83H9fqjZ0c51aXCv3C6TDgEA2+ophLtOtNYPSReWmExfAQYRqg mlOA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=vFEIBubFtM9Rt2PFGbyxo47yogIA7OLrfIEavljBuKY=; b=X2iDUX51yltTivSjxXcbCgI+KS2zs1XdMrs8EWxKE+/DhIc6o+Q51uUD3/JtUa5ZZv xwx0rMerkMYsXfgCApaSfRRG47SdDVxGF5SZ6jJ4ucvIvk16N0Qv42JuOWt+mhFx20vM hbmxP+ZjLhrvNCvayavAef22Xv2BuoYsNjZ6qUusHTjevxjYQujw+YcAI2f5lxEe9ZkQ y+M80ajHMjkeA2OKVwUzUF3EETsUiapXToyBC2Yy3EU0YEHOx28JBcAwmFYVYkpXMJAa acglMhFU6+jWWB99HHqk1L/kiig6dpSTgnThnIhi9PhHqlTNeP3GQxAMR6qkGGIy3p6+ zJfw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b="LaX7zbR/"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id t6si6765587pgn.258.2019.02.06.13.26.04; Wed, 06 Feb 2019 13:26:20 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b="LaX7zbR/"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726774AbfBFVXr (ORCPT + 99 others); Wed, 6 Feb 2019 16:23:47 -0500 Received: from mail-ed1-f66.google.com ([209.85.208.66]:46439 "EHLO mail-ed1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725983AbfBFVXr (ORCPT ); Wed, 6 Feb 2019 16:23:47 -0500 Received: by mail-ed1-f66.google.com with SMTP id o10so7172339edt.13 for ; Wed, 06 Feb 2019 13:23:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=vFEIBubFtM9Rt2PFGbyxo47yogIA7OLrfIEavljBuKY=; b=LaX7zbR/uy3XUDTO61apcwTZae5KQvy+yx+DUb9gFImdMCw6Az6e3NJMs6ZtFOc0Uh KxXsAl+3jVzw5oJT6YPqgcyqVtUW3fSZu6h53bzrDpD13oE+C6wv2mfMAZLLbJChsoFi ngIS7IEh8stu+arNf2e9FpWRE9OJ7L6MidhDs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=vFEIBubFtM9Rt2PFGbyxo47yogIA7OLrfIEavljBuKY=; b=fqJ7PfYk8zbF3zGKe3Sezb0ywv7LxMWpbvN1wVsgMY4HgiqZeBLIoskEQK4tjrxWBi P5MJB/waNBY+1epfSmTDt5fGXY+dYua80FTb5T70hBPpEUF9L4yYxKK0zUTv9BUPo6tK AXts1RgDnLWIh8QYhfi1JXDYdMVi9pu74mC/QOkpUjs3hNAIBEKVV59ykFJTp9CWCJ5F /jrdLMierENFkyKqXOib3jiY6YU+H4/ET6+HwINknogneQE/92a3Kb8XuVWk5maNVtJ3 E1RMsyPreeVus9plrAvc5jSOwYXSeLCXGkbu0gyuKQbsl5y2T2uIB5RSQj5K3D7yYEql MLVw== X-Gm-Message-State: AHQUAuYaDUr7Ls2EgULj/Q5O2kr1MzxK0Y8TuR4wLidV/YY7JE31m59S wt5vkrj1f31WY1CxbJsDgPYUuUJd7/E= X-Received: by 2002:aa7:d487:: with SMTP id b7mr9430839edr.256.1549488224718; Wed, 06 Feb 2019 13:23:44 -0800 (PST) Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com. [209.85.128.52]) by smtp.gmail.com with ESMTPSA id i8sm1477401edg.21.2019.02.06.13.23.43 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 06 Feb 2019 13:23:44 -0800 (PST) Received: by mail-wm1-f52.google.com with SMTP id z5so4020749wmf.0 for ; Wed, 06 Feb 2019 13:23:43 -0800 (PST) X-Received: by 2002:a1c:27c6:: with SMTP id n189mr4578711wmn.108.1549488223205; Wed, 06 Feb 2019 13:23:43 -0800 (PST) MIME-Version: 1.0 References: <20190131192533.34130-1-thgarnie@chromium.org> <20190131192533.34130-20-thgarnie@chromium.org> <20190206195642.GD9575@linux.intel.com> In-Reply-To: <20190206195642.GD9575@linux.intel.com> From: Thomas Garnier Date: Wed, 6 Feb 2019 13:23:31 -0800 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [PATCH v6 19/27] kvm: Adapt assembly for PIE support To: Sean Christopherson Cc: Kernel Hardening , Kristen Carlson Accardi , Paolo Bonzini , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Thomas Gleixner , Ingo Molnar , Borislav Petkov , "H. Peter Anvin" , "the arch/x86 maintainers" , Joerg Roedel , kvm list , LKML Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Feb 6, 2019 at 11:56 AM Sean Christopherson wrote: > > On Thu, Jan 31, 2019 at 11:24:26AM -0800, Thomas Garnier wrote: > > Change the assembly code to use only relative references of symbols for the > > kernel to be PIE compatible. The new __ASM_MOVABS macro is used to > > get the address of a symbol on both 32 and 64-bit with PIE support. > > > > Position Independent Executable (PIE) support will allow to extend the > > KASLR randomization range below 0xffffffff80000000. > > > > Signed-off-by: Thomas Garnier > > --- > > arch/x86/include/asm/kvm_host.h | 8 ++++++-- > > arch/x86/kernel/kvm.c | 6 ++++-- > > arch/x86/kvm/svm.c | 4 ++-- > > arch/x86/kvm/vmx/vmx.c | 2 +- > > 4 files changed, 13 insertions(+), 7 deletions(-) > > > > diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h > > index 4660ce90de7f..fdb3307d5fe1 100644 > > --- a/arch/x86/include/asm/kvm_host.h > > +++ b/arch/x86/include/asm/kvm_host.h > > @@ -1498,9 +1498,13 @@ asmlinkage void kvm_spurious_fault(void); > > ".pushsection .fixup, \"ax\" \n" \ > > "667: \n\t" \ > > cleanup_insn "\n\t" \ > > - "cmpb $0, kvm_rebooting \n\t" \ > > + "cmpb $0, kvm_rebooting" __ASM_SEL(, (%%rip)) " \n\t" \ > > "jne 668b \n\t" \ > > - __ASM_SIZE(push) " $666b \n\t" \ > > + __ASM_SIZE(push) "$0 \n\t" \ > > + __ASM_SIZE(push) "%%" _ASM_AX " \n\t" \ > > + _ASM_MOVABS " $666b, %%" _ASM_AX "\n\t" \ > > + _ASM_MOV " %%" _ASM_AX ", " __ASM_SEL(4, 8) "(%%" _ASM_SP ") \n\t" \ > > + __ASM_SIZE(pop) "%%" _ASM_AX " \n\t" \ > > This blob isn't very intuitive to begin with, and the extra stack > shenanigans are a bit much when PIE is disabled. What about breaking > out the behavior to separate helper macros to keep the simpler code > for non-PIE and to make the code somewhat self-documenting? E.g.: > > #ifndef CONFIG_X86_PIE > #define KVM_PUSH_FAULTING_INSN_RIP __ASM_SIZE(push) " $666b \n\t" > #else > #define KVM_PUSH_FAULTING_INSN_RIP \ > __ASM_SIZE(push) "$0 \n\t" \ > __ASM_SIZE(push) "%%" _ASM_AX " \n\t" \ > _ASM_MOVABS " $666b, %%" _ASM_AX "\n\t" \ > _ASM_MOV " %%" _ASM_AX ", " __ASM_SEL(4, 8) "(%%" _ASM_SP ") \n\t" \ > __ASM_SIZE(pop) "%%" _ASM_AX " \n\t" > #endif > > #define ____kvm_handle_fault_on_reboot(insn, cleanup_insn) \ > "666: " insn "\n\t" \ > "668: \n\t" \ > ".pushsection .fixup, \"ax\" \n" \ > "667: \n\t" \ > cleanup_insn "\n\t" \ > "cmpb $0, kvm_rebooting" __ASM_SEL(, (%%rip)) " \n\t" \ > "jne 668b \n\t" \ > KVM_PUSH_FAULTING_INSN_RIP \ > "jmp kvm_spurious_fault \n\t" \ > ".popsection \n\t" \ > _ASM_EXTABLE(666b, 667b) > > > "jmp kvm_spurious_fault \n\t" \ > > ".popsection \n\t" \ > > _ASM_EXTABLE(666b, 667b) > > diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c > > index 5c93a65ee1e5..f6eb02004e43 100644 > > --- a/arch/x86/kernel/kvm.c > > +++ b/arch/x86/kernel/kvm.c > > This change to arch/x86/kernel/kvm.c should be done in a separate patch > as it affects the kernel itself when running as a guest under KVM, > whereas arch/x86/kvm/**/* and arch/x86/include/asm/kvm_host.h affect > KVM as a host, i.e. the KVM module. Case in point, the below bug causes > a kernel panic when running as a KVM guest but has no impact on the KVM > module. Got it, will split in next iteration. > > > @@ -826,8 +826,10 @@ asm( > > ".global __raw_callee_save___kvm_vcpu_is_preempted;" > > ".type __raw_callee_save___kvm_vcpu_is_preempted, @function;" > > "__raw_callee_save___kvm_vcpu_is_preempted:" > > -"movq __per_cpu_offset(,%rdi,8), %rax;" > > -"cmpb $0, " __stringify(KVM_STEAL_TIME_preempted) "+steal_time(%rax);" > > +"leaq __per_cpu_offset(%rip), %rax;" > > +"movq (%rax,%rdi,8), %rax;" > > +"addq " __stringify(KVM_STEAL_TIME_preempted) "+steal_time(%rip), %rax;" > > This is wrong, it's directly accessing the per-cpu offset of 'steal_time' > as a virtual address, e.g. without PIE enabled: > > 0xffffffff8104820b <+11>: add 0x7efccffe(%rip),%rax # 0x15210 > > This results in kernel panics due to unhandled page faults: > > [ 0.001453] BUG: unable to handle kernel paging request at 0000000000015210 > [ 0.001453] #PF error: [normal kernel read fault] Yes, I think something went wrong in rebasing. Thanks for pointing it out. > > I think you want something like the following, except that the whole > point of handcoded assembly is to avoid modifying registers other than > RAX, i.e. modifying RDI is a no-no. > > "leaq " __stringify(KVM_STEAL_TIME_preempted) "+steal_time(%rip), %rdi;" > "cmpb $0, (%rax,%rdi,1);" > > > And similar to the comment on ____kvm_handle_fault_on_reboot(), what > about wrapping the PIE-specific version in an ifdef? I will look into this and try your approach. > > > +"cmpb $0, (%rax);" > > "setne %al;" > > "ret;" > > ".popsection"); > > diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c > > index f13a3a24d360..26abb82b1b67 100644 > > --- a/arch/x86/kvm/svm.c > > +++ b/arch/x86/kvm/svm.c > > @@ -706,12 +706,12 @@ static u32 svm_msrpm_offset(u32 msr) > > > > static inline void clgi(void) > > { > > - asm volatile (__ex("clgi")); > > + asm volatile (__ex("clgi") : :); > > } > > > > static inline void stgi(void) > > { > > - asm volatile (__ex("stgi")); > > + asm volatile (__ex("stgi") : :); > > } > > > > static inline void invlpga(unsigned long addr, u32 asid) > > diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c > > index 4341175339f3..3275761a7375 100644 > > --- a/arch/x86/kvm/vmx/vmx.c > > +++ b/arch/x86/kvm/vmx/vmx.c > > @@ -2161,7 +2161,7 @@ static void vmclear_local_loaded_vmcss(void) > > */ > > static void kvm_cpu_vmxoff(void) > > { > > - asm volatile (__ex("vmxoff")); > > + asm volatile (__ex("vmxoff") :::); > > > > intel_pt_handle_vmx(0); > > cr4_clear_bits(X86_CR4_VMXE); > > -- > > 2.20.1.495.gaa96b0ce6b-goog > > Thanks for the feedback.