Re: [PATCH v2 4/4] powerpc: Book3S 64-bit "heavyweight" KASAN support
Hi Christophe, I think I've covered everything you've mentioned in the v3 I'm about to send, except for: >> +/* mark early shadow region as RO and wipe */ >> +pte = __pte(__pa(kasan_early_shadow_page) | >> +pgprot_val(PAGE_KERNEL_RO) | _PAGE_PTE); > > Any reason for _PAGE_PTE being required here and not being included in > PAGE_KERNEL_RO ? I'm not 100% sure quite what you mean here. I think you're asking: why do we need to supply _PAGE_PTE here, shouldn't PAGE_KERNEL_RO set that bit or cover that case? _PAGE_PTE is defined by section 5.7.10.2 of Book III of ISA 3.0: bit 1 (linux bit 62) is 'Leaf (entry is a PTE)' I originally had this because it was set in Balbir's original implementation, but the bit is also set by pte_mkpte which is called in set_pte_at, so I also think it's right to set it. I don't know why it's not included in the permission classes; I suspect it's because it's not conceptually a permission, it's set and cleared in things like swp entry code. Does that answer your question? Regards, Daniel
Re: [PATCH v2 4/4] powerpc: Book3S 64-bit "heavyweight" KASAN support
On 12/11/19 5:24 PM, Daniel Axtens wrote: > Hi Balbir, > > +Discontiguous memory can occur when you have a machine with memory spread > +across multiple nodes. For example, on a Talos II with 64GB of RAM: > + > + - 32GB runs from 0x0 to 0x_0008__, > + - then there's a gap, > + - then the final 32GB runs from 0x_2000__ to > 0x_2008__ > + > +This can create _significant_ issues: > + > + - If we try to treat the machine as having 64GB of _contiguous_ RAM, we > would > + assume that ran from 0x0 to 0x_0010__. We'd then reserve > the > + last 1/8th - 0x_000e__ to 0x_0010__ as the > shadow > + region. But when we try to access any of that, we'll try to access > pages > + that are not physically present. > + If we reserved memory for KASAN from each node (discontig region), we might survive this no? May be we need NUMA aware KASAN? That might be a generic change, just thinking out loud. >>> >>> The challenge is that - AIUI - in inline instrumentation, the compiler >>> doesn't generate calls to things like __asan_loadN and >>> __asan_storeN. Instead it uses -fasan-shadow-offset to compute the >>> checks, and only calls the __asan_report* family of functions if it >>> detects an issue. This also matches what I can observe with objdump >>> across outline and inline instrumentation settings. >>> >>> This means that for this sort of thing to work we would need to either >>> drop back to out-of-line calls, or teach the compiler how to use a >>> nonlinear, NUMA aware mem-to-shadow mapping. >> >> Yes, out of line is expensive, but seems to work well for all use cases. > > I'm not sure this is true. Looking at scripts/Makefile.kasan, allocas, > stacks and globals will only be instrumented if you can provide > KASAN_SHADOW_OFFSET. In the case you're proposing, we can't provide a > static offset. I _think_ this is a compiler limitation, where some of > those instrumentations only work/make sense with a static offset, but > perhaps that's not right? Dmitry and Andrey, can you shed some light on > this? > There is no code in the kernel is poisoning/unpoisoning redzones/variables on stack. It's because it's always done by the compiler, it inserts some code in prologue/epilogue of every function. So compiler needs to know the shadow offset which will be used to poison/unpoison stack frames. There is no such kind of limitation on globals instrumentation. The only reason globals instrumentation depends on -fasan-shadow-offset is because there was some bug related to globals in old gcc version which didn't support -fasan-shadow-offset. If you want stack instrumentation with not standard mem-to-shadow mapping, the options are: 1. Patch compiler to make it possible the poisoning/unpoisonig of stack frames via function calls. 2. Use out-line instrumentation and do whatever mem-to-shadow mapping you want, but keep all kernel stacks in some special place for which standard mem-to-shadow mapping (addr >>3 +offset) works. > Also, as it currently stands, the speed difference between inline and > outline is approximately 2x, and given that we'd like to run this > full-time in syzkaller I think there is value in trading off speed for > some limitations. >
Re: [PATCH v2 4/4] powerpc: Book3S 64-bit "heavyweight" KASAN support
Le 12/12/2019 à 08:42, Balbir Singh a écrit : On 12/12/19 1:24 am, Daniel Axtens wrote: Hi Balbir, +Discontiguous memory can occur when you have a machine with memory spread +across multiple nodes. For example, on a Talos II with 64GB of RAM: + + - 32GB runs from 0x0 to 0x_0008__, + - then there's a gap, + - then the final 32GB runs from 0x_2000__ to 0x_2008__ + +This can create _significant_ issues: + + - If we try to treat the machine as having 64GB of _contiguous_ RAM, we would + assume that ran from 0x0 to 0x_0010__. We'd then reserve the + last 1/8th - 0x_000e__ to 0x_0010__ as the shadow + region. But when we try to access any of that, we'll try to access pages + that are not physically present. + If we reserved memory for KASAN from each node (discontig region), we might survive this no? May be we need NUMA aware KASAN? That might be a generic change, just thinking out loud. The challenge is that - AIUI - in inline instrumentation, the compiler doesn't generate calls to things like __asan_loadN and __asan_storeN. Instead it uses -fasan-shadow-offset to compute the checks, and only calls the __asan_report* family of functions if it detects an issue. This also matches what I can observe with objdump across outline and inline instrumentation settings. This means that for this sort of thing to work we would need to either drop back to out-of-line calls, or teach the compiler how to use a nonlinear, NUMA aware mem-to-shadow mapping. Yes, out of line is expensive, but seems to work well for all use cases. I'm not sure this is true. Looking at scripts/Makefile.kasan, allocas, stacks and globals will only be instrumented if you can provide KASAN_SHADOW_OFFSET. In the case you're proposing, we can't provide a static offset. I _think_ this is a compiler limitation, where some of those instrumentations only work/make sense with a static offset, but perhaps that's not right? Dmitry and Andrey, can you shed some light on this? From what I can read, everything should still be supported, the info page for gcc states that globals, stack asan should be enabled by default. allocas may have limited meaning if stack-protector is turned on (no?) Where do you read that ? As far as I can see, there is not much details about -fsanitize=kernel-address and -fasan-shadow-offset=number in GCC doc (https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html) [...] I think I got CONFIG_PHYS_MEM_SIZE_FOR_KASN wrong, honestly I don't get why we need this size? The size is in MB and the default is 0. Why does the powerpc port of KASAN need the SIZE to be explicitly specified? AFAICS, it is explained in details in Daniel's commit log. That's because on book3s64, KVM requires KASAN to also work when MMU is off. The 0 default is for when CONFIG_KASAN is not selected, in order to avoid a forest of #ifdefs in the code. Christophe
Re: [PATCH v2 4/4] powerpc: Book3S 64-bit "heavyweight" KASAN support
On 12/12/19 1:24 am, Daniel Axtens wrote: > Hi Balbir, > > +Discontiguous memory can occur when you have a machine with memory spread > +across multiple nodes. For example, on a Talos II with 64GB of RAM: > + > + - 32GB runs from 0x0 to 0x_0008__, > + - then there's a gap, > + - then the final 32GB runs from 0x_2000__ to > 0x_2008__ > + > +This can create _significant_ issues: > + > + - If we try to treat the machine as having 64GB of _contiguous_ RAM, we > would > + assume that ran from 0x0 to 0x_0010__. We'd then reserve > the > + last 1/8th - 0x_000e__ to 0x_0010__ as the > shadow > + region. But when we try to access any of that, we'll try to access > pages > + that are not physically present. > + If we reserved memory for KASAN from each node (discontig region), we might survive this no? May be we need NUMA aware KASAN? That might be a generic change, just thinking out loud. >>> >>> The challenge is that - AIUI - in inline instrumentation, the compiler >>> doesn't generate calls to things like __asan_loadN and >>> __asan_storeN. Instead it uses -fasan-shadow-offset to compute the >>> checks, and only calls the __asan_report* family of functions if it >>> detects an issue. This also matches what I can observe with objdump >>> across outline and inline instrumentation settings. >>> >>> This means that for this sort of thing to work we would need to either >>> drop back to out-of-line calls, or teach the compiler how to use a >>> nonlinear, NUMA aware mem-to-shadow mapping. >> >> Yes, out of line is expensive, but seems to work well for all use cases. > > I'm not sure this is true. Looking at scripts/Makefile.kasan, allocas, > stacks and globals will only be instrumented if you can provide > KASAN_SHADOW_OFFSET. In the case you're proposing, we can't provide a > static offset. I _think_ this is a compiler limitation, where some of > those instrumentations only work/make sense with a static offset, but > perhaps that's not right? Dmitry and Andrey, can you shed some light on > this? > >From what I can read, everything should still be supported, the info page for gcc states that globals, stack asan should be enabled by default. allocas may have limited meaning if stack-protector is turned on (no?) > Also, as it currently stands, the speed difference between inline and > outline is approximately 2x, and given that we'd like to run this > full-time in syzkaller I think there is value in trading off speed for > some limitations. > Full speed vs actually working across different configurations? >> BTW, the current set of patches just hang if I try to make the default >> mode as out of line > > Do you have CONFIG_RELOCATABLE? > > I've tested the following process: > > # 1) apply patches on a fresh linux-next > # 2) output dir > mkdir ../out-3s-kasan > > # 3) merge in the relevant config snippets > cat > kasan.config << EOF > CONFIG_EXPERT=y > CONFIG_LD_HEAD_STUB_CATCH=y > > CONFIG_RELOCATABLE=y > > CONFIG_KASAN=y > CONFIG_KASAN_GENERIC=y > CONFIG_KASAN_OUTLINE=y > > CONFIG_PHYS_MEM_SIZE_FOR_KASAN=2048 > EOF > I think I got CONFIG_PHYS_MEM_SIZE_FOR_KASN wrong, honestly I don't get why we need this size? The size is in MB and the default is 0. Why does the powerpc port of KASAN need the SIZE to be explicitly specified? Balbir Singh.
Re: [PATCH v2 4/4] powerpc: Book3S 64-bit "heavyweight" KASAN support
Hi Balbir,
+Discontiguous memory can occur when you have a machine with memory spread
+across multiple nodes. For example, on a Talos II with 64GB of RAM:
+
+ - 32GB runs from 0x0 to 0x_0008__,
+ - then there's a gap,
+ - then the final 32GB runs from 0x_2000__ to
0x_2008__
+
+This can create _significant_ issues:
+
+ - If we try to treat the machine as having 64GB of _contiguous_ RAM, we
would
+ assume that ran from 0x0 to 0x_0010__. We'd then reserve
the
+ last 1/8th - 0x_000e__ to 0x_0010__ as the
shadow
+ region. But when we try to access any of that, we'll try to access
pages
+ that are not physically present.
+
>>>
>>> If we reserved memory for KASAN from each node (discontig region), we might
>>> survive
>>> this no? May be we need NUMA aware KASAN? That might be a generic change,
>>> just thinking
>>> out loud.
>>
>> The challenge is that - AIUI - in inline instrumentation, the compiler
>> doesn't generate calls to things like __asan_loadN and
>> __asan_storeN. Instead it uses -fasan-shadow-offset to compute the
>> checks, and only calls the __asan_report* family of functions if it
>> detects an issue. This also matches what I can observe with objdump
>> across outline and inline instrumentation settings.
>>
>> This means that for this sort of thing to work we would need to either
>> drop back to out-of-line calls, or teach the compiler how to use a
>> nonlinear, NUMA aware mem-to-shadow mapping.
>
> Yes, out of line is expensive, but seems to work well for all use cases.
I'm not sure this is true. Looking at scripts/Makefile.kasan, allocas,
stacks and globals will only be instrumented if you can provide
KASAN_SHADOW_OFFSET. In the case you're proposing, we can't provide a
static offset. I _think_ this is a compiler limitation, where some of
those instrumentations only work/make sense with a static offset, but
perhaps that's not right? Dmitry and Andrey, can you shed some light on
this?
Also, as it currently stands, the speed difference between inline and
outline is approximately 2x, and given that we'd like to run this
full-time in syzkaller I think there is value in trading off speed for
some limitations.
> BTW, the current set of patches just hang if I try to make the default
> mode as out of line
Do you have CONFIG_RELOCATABLE?
I've tested the following process:
# 1) apply patches on a fresh linux-next
# 2) output dir
mkdir ../out-3s-kasan
# 3) merge in the relevant config snippets
cat > kasan.config << EOF
CONFIG_EXPERT=y
CONFIG_LD_HEAD_STUB_CATCH=y
CONFIG_RELOCATABLE=y
CONFIG_KASAN=y
CONFIG_KASAN_GENERIC=y
CONFIG_KASAN_OUTLINE=y
CONFIG_PHYS_MEM_SIZE_FOR_KASAN=2048
EOF
ARCH=powerpc CROSS_COMPILE=powerpc64-linux-gnu-
./scripts/kconfig/merge_config.sh -O ../out-3s-kasan/
arch/powerpc/configs/pseries_defconfig arch/powerpc/configs/le.config
kasan.config
# 4) make
make O=../out-3s-kasan/ ARCH=powerpc CROSS_COMPILE=powerpc64-linux-gnu- -j8
vmlinux
# 5) test
qemu-system-ppc64 -m 2G -M pseries -cpu power9 -kernel
../out-3s-kasan/vmlinux -nographic -chardev stdio,id=charserial0,mux=on
-device spapr-vty,chardev=charserial0,reg=0x3000 -initrd
./rootfs-le.cpio.xz -mon chardev=charserial0,mode=readline -nodefaults -smp 4
This boots fine for me under TCG and KVM, with both CONFIG_KASAN_OUTLINE
and CONFIG_KASAN_INLINE. You do still need to supply the size even in
outline mode - I don't have code that switches over to vmalloced space
when in outline mode. I will clarify the docs on that.
+ if (IS_ENABLED(CONFIG_KASAN) && IS_ENABLED(CONFIG_PPC_BOOK3S_64)) {
+ kasan_memory_size =
+ ((phys_addr_t)CONFIG_PHYS_MEM_SIZE_FOR_KASAN << 20);
+
+ if (top_phys_addr < kasan_memory_size) {
+ /*
+ * We are doomed. Attempts to call e.g. panic() are
+ * likely to fail because they call out into
+ * instrumented code, which will almost certainly
+ * access memory beyond the end of physical
+ * memory. Hang here so that at least the NIP points
+ * somewhere that will help you debug it if you look at
+ * it in qemu.
+ */
+ while (true)
+ ;
>>>
>>> Again with the right hooks in check_memory_region_inline() these are
>>> recoverable,
>>> or so I think
>>
>> So unless I misunderstand the circumstances in which
>> check_memory_region_inline is used, this isn't going to help with inline
>> instrumentation.
>>
>
> Yes, I understand. Same as above?
Yes.
>>> NOTE: I can't test any of these, well may be with qemu, let me see if I can
>>> spin
>>> the series and provide more feedback
>>
>> It's
Re: [PATCH v2 4/4] powerpc: Book3S 64-bit "heavyweight" KASAN support
On 11/12/19 4:21 pm, Daniel Axtens wrote:
> Hi Balbir,
>
>>> +Discontiguous memory can occur when you have a machine with memory spread
>>> +across multiple nodes. For example, on a Talos II with 64GB of RAM:
>>> +
>>> + - 32GB runs from 0x0 to 0x_0008__,
>>> + - then there's a gap,
>>> + - then the final 32GB runs from 0x_2000__ to
>>> 0x_2008__
>>> +
>>> +This can create _significant_ issues:
>>> +
>>> + - If we try to treat the machine as having 64GB of _contiguous_ RAM, we
>>> would
>>> + assume that ran from 0x0 to 0x_0010__. We'd then reserve the
>>> + last 1/8th - 0x_000e__ to 0x_0010__ as the
>>> shadow
>>> + region. But when we try to access any of that, we'll try to access pages
>>> + that are not physically present.
>>> +
>>
>> If we reserved memory for KASAN from each node (discontig region), we might
>> survive
>> this no? May be we need NUMA aware KASAN? That might be a generic change,
>> just thinking
>> out loud.
>
> The challenge is that - AIUI - in inline instrumentation, the compiler
> doesn't generate calls to things like __asan_loadN and
> __asan_storeN. Instead it uses -fasan-shadow-offset to compute the
> checks, and only calls the __asan_report* family of functions if it
> detects an issue. This also matches what I can observe with objdump
> across outline and inline instrumentation settings.
>
> This means that for this sort of thing to work we would need to either
> drop back to out-of-line calls, or teach the compiler how to use a
> nonlinear, NUMA aware mem-to-shadow mapping.
Yes, out of line is expensive, but seems to work well for all use cases.
BTW, the current set of patches just hang if I try to make the default
mode as out of line
>
> I'll document this a bit better in the next spin.
>
>>> + if (IS_ENABLED(CONFIG_KASAN) && IS_ENABLED(CONFIG_PPC_BOOK3S_64)) {
>>> + kasan_memory_size =
>>> + ((phys_addr_t)CONFIG_PHYS_MEM_SIZE_FOR_KASAN << 20);
>>> +
>>> + if (top_phys_addr < kasan_memory_size) {
>>> + /*
>>> +* We are doomed. Attempts to call e.g. panic() are
>>> +* likely to fail because they call out into
>>> +* instrumented code, which will almost certainly
>>> +* access memory beyond the end of physical
>>> +* memory. Hang here so that at least the NIP points
>>> +* somewhere that will help you debug it if you look at
>>> +* it in qemu.
>>> +*/
>>> + while (true)
>>> + ;
>>
>> Again with the right hooks in check_memory_region_inline() these are
>> recoverable,
>> or so I think
>
> So unless I misunderstand the circumstances in which
> check_memory_region_inline is used, this isn't going to help with inline
> instrumentation.
>
Yes, I understand. Same as above?
>>> +void __init kasan_init(void)
>>> +{
>>> + int i;
>>> + void *k_start = kasan_mem_to_shadow((void *)RADIX_KERN_VIRT_START);
>>> + void *k_end = kasan_mem_to_shadow((void *)RADIX_VMEMMAP_END);
>>> +
>>> + pte_t pte = __pte(__pa(kasan_early_shadow_page) |
>>> + pgprot_val(PAGE_KERNEL) | _PAGE_PTE);
>>> +
>>> + if (!early_radix_enabled())
>>> + panic("KASAN requires radix!");
>>> +
>>
>> I think this is avoidable, we could use a static key for disabling kasan in
>> the generic code. I wonder what happens if someone tries to boot this
>> image on a Power8 box and keeps panic'ing with no easy way of recovering.
>
> Again, assuming I understand correctly that the compiler generates raw
> IR->asm for these checks rather than calling out to a function, then I
> don't think we get a way to intercept those checks. It's too late to do
> anything at the __asan report stage because that will already have
> accessed memory that's not set up properly.
>
> If you try to boot this on a Power8 box it will panic and you'll have to
> boot into another kernel from the bootloader. I don't think it's
> avoidable without disabling inline instrumentation, but I'd love to be
> proven wrong.
>
>>
>> NOTE: I can't test any of these, well may be with qemu, let me see if I can
>> spin
>> the series and provide more feedback
>
> It's actually super easy to do simple boot tests with qemu, it works fine in
> TCG,
> Michael's wiki page at
> https://github.com/linuxppc/wiki/wiki/Booting-with-Qemu is very helpful.
>
> I did this a lot in development.
>
> My full commandline, fwiw, is:
>
> qemu-system-ppc64 -m 8G -M pseries -cpu power9 -kernel
> ../out-3s-radix/vmlinux -nographic -chardev stdio,id=charserial0,mux=on
> -device spapr-vty,chardev=charserial0,reg=0x3000 -initrd
> ./rootfs-le.cpio.xz -mon chardev=charserial0,mode=readline -nodefaults -smp 4
qemu has been crashing with KASAN enabled/ both inline/out-of-line options. I
Re: [PATCH v2 4/4] powerpc: Book3S 64-bit "heavyweight" KASAN support
Hi Balbir,
>> +Discontiguous memory can occur when you have a machine with memory spread
>> +across multiple nodes. For example, on a Talos II with 64GB of RAM:
>> +
>> + - 32GB runs from 0x0 to 0x_0008__,
>> + - then there's a gap,
>> + - then the final 32GB runs from 0x_2000__ to
>> 0x_2008__
>> +
>> +This can create _significant_ issues:
>> +
>> + - If we try to treat the machine as having 64GB of _contiguous_ RAM, we
>> would
>> + assume that ran from 0x0 to 0x_0010__. We'd then reserve the
>> + last 1/8th - 0x_000e__ to 0x_0010__ as the shadow
>> + region. But when we try to access any of that, we'll try to access pages
>> + that are not physically present.
>> +
>
> If we reserved memory for KASAN from each node (discontig region), we might
> survive
> this no? May be we need NUMA aware KASAN? That might be a generic change,
> just thinking
> out loud.
The challenge is that - AIUI - in inline instrumentation, the compiler
doesn't generate calls to things like __asan_loadN and
__asan_storeN. Instead it uses -fasan-shadow-offset to compute the
checks, and only calls the __asan_report* family of functions if it
detects an issue. This also matches what I can observe with objdump
across outline and inline instrumentation settings.
This means that for this sort of thing to work we would need to either
drop back to out-of-line calls, or teach the compiler how to use a
nonlinear, NUMA aware mem-to-shadow mapping.
I'll document this a bit better in the next spin.
>> +if (IS_ENABLED(CONFIG_KASAN) && IS_ENABLED(CONFIG_PPC_BOOK3S_64)) {
>> +kasan_memory_size =
>> +((phys_addr_t)CONFIG_PHYS_MEM_SIZE_FOR_KASAN << 20);
>> +
>> +if (top_phys_addr < kasan_memory_size) {
>> +/*
>> + * We are doomed. Attempts to call e.g. panic() are
>> + * likely to fail because they call out into
>> + * instrumented code, which will almost certainly
>> + * access memory beyond the end of physical
>> + * memory. Hang here so that at least the NIP points
>> + * somewhere that will help you debug it if you look at
>> + * it in qemu.
>> + */
>> +while (true)
>> +;
>
> Again with the right hooks in check_memory_region_inline() these are
> recoverable,
> or so I think
So unless I misunderstand the circumstances in which
check_memory_region_inline is used, this isn't going to help with inline
instrumentation.
>> +void __init kasan_init(void)
>> +{
>> +int i;
>> +void *k_start = kasan_mem_to_shadow((void *)RADIX_KERN_VIRT_START);
>> +void *k_end = kasan_mem_to_shadow((void *)RADIX_VMEMMAP_END);
>> +
>> +pte_t pte = __pte(__pa(kasan_early_shadow_page) |
>> + pgprot_val(PAGE_KERNEL) | _PAGE_PTE);
>> +
>> +if (!early_radix_enabled())
>> +panic("KASAN requires radix!");
>> +
>
> I think this is avoidable, we could use a static key for disabling kasan in
> the generic code. I wonder what happens if someone tries to boot this
> image on a Power8 box and keeps panic'ing with no easy way of recovering.
Again, assuming I understand correctly that the compiler generates raw
IR->asm for these checks rather than calling out to a function, then I
don't think we get a way to intercept those checks. It's too late to do
anything at the __asan report stage because that will already have
accessed memory that's not set up properly.
If you try to boot this on a Power8 box it will panic and you'll have to
boot into another kernel from the bootloader. I don't think it's
avoidable without disabling inline instrumentation, but I'd love to be
proven wrong.
>
> NOTE: I can't test any of these, well may be with qemu, let me see if I can
> spin
> the series and provide more feedback
It's actually super easy to do simple boot tests with qemu, it works fine in
TCG,
Michael's wiki page at
https://github.com/linuxppc/wiki/wiki/Booting-with-Qemu is very helpful.
I did this a lot in development.
My full commandline, fwiw, is:
qemu-system-ppc64 -m 8G -M pseries -cpu power9 -kernel
../out-3s-radix/vmlinux -nographic -chardev stdio,id=charserial0,mux=on
-device spapr-vty,chardev=charserial0,reg=0x3000 -initrd
./rootfs-le.cpio.xz -mon chardev=charserial0,mode=readline -nodefaults -smp 4
Regards,
Daniel
Re: [PATCH v2 4/4] powerpc: Book3S 64-bit "heavyweight" KASAN support
Hi Daniel,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on next-20191209]
[also build test ERROR on linus/master v5.5-rc1]
[cannot apply to powerpc/next asm-generic/master v5.4]
[if your patch is applied to the wrong git tree, please drop us a note to help
improve the system. BTW, we also suggest to use '--base' option to specify the
base tree in git format-patch, please see https://stackoverflow.com/a/37406982]
url:
https://github.com/0day-ci/linux/commits/Daniel-Axtens/KASAN-for-powerpc64-radix-plus-generic-mm-change/20191210-171342
base:6cf8298daad041cd15dc514d8a4f93ca3636c84e
config: powerpc-allnoconfig (attached as .config)
compiler: powerpc-linux-gcc (GCC) 7.5.0
reproduce:
wget
https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O
~/bin/make.cross
chmod +x ~/bin/make.cross
# save the attached .config to linux build tree
GCC_VERSION=7.5.0 make.cross ARCH=powerpc
If you fix the issue, kindly add following tag
Reported-by: kbuild test robot
All error/warnings (new ones prefixed by >>):
In file included from include/linux/printk.h:7:0,
from include/linux/kernel.h:15,
from arch/powerpc/kernel/prom.c:15:
arch/powerpc/kernel/prom.c: In function 'early_reserve_mem':
>> include/linux/kern_levels.h:5:18: error: format '%llu' expects argument of
>> type 'long long unsigned int', but argument 3 has type 'phys_addr_t {aka
>> unsigned int}' [-Werror=format=]
#define KERN_SOH "\001" /* ASCII Start Of Header */
^
include/linux/kern_levels.h:11:18: note: in expansion of macro 'KERN_SOH'
#define KERN_ERR KERN_SOH "3" /* error conditions */
^~~~
include/linux/printk.h:304:9: note: in expansion of macro 'KERN_ERR'
printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
^~~~
>> arch/powerpc/kernel/prom.c:694:4: note: in expansion of macro 'pr_err'
pr_err("===\n"
^~
arch/powerpc/kernel/prom.c:697:48: note: format string is defined here
"The actual physical memory detected is %llu MB.\n"
~~~^
%u
cc1: all warnings being treated as errors
--
In file included from include/linux/printk.h:7:0,
from include/linux/kernel.h:15,
from arch/powerpc//kernel/prom.c:15:
arch/powerpc//kernel/prom.c: In function 'early_reserve_mem':
>> include/linux/kern_levels.h:5:18: error: format '%llu' expects argument of
>> type 'long long unsigned int', but argument 3 has type 'phys_addr_t {aka
>> unsigned int}' [-Werror=format=]
#define KERN_SOH "\001" /* ASCII Start Of Header */
^
include/linux/kern_levels.h:11:18: note: in expansion of macro 'KERN_SOH'
#define KERN_ERR KERN_SOH "3" /* error conditions */
^~~~
include/linux/printk.h:304:9: note: in expansion of macro 'KERN_ERR'
printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
^~~~
arch/powerpc//kernel/prom.c:694:4: note: in expansion of macro 'pr_err'
pr_err("===\n"
^~
arch/powerpc//kernel/prom.c:697:48: note: format string is defined here
"The actual physical memory detected is %llu MB.\n"
~~~^
%u
cc1: all warnings being treated as errors
vim +/pr_err +694 arch/powerpc/kernel/prom.c
675
676 if (IS_ENABLED(CONFIG_KASAN) &&
IS_ENABLED(CONFIG_PPC_BOOK3S_64)) {
677 kasan_memory_size =
678 ((phys_addr_t)CONFIG_PHYS_MEM_SIZE_FOR_KASAN <<
20);
679
680 if (top_phys_addr < kasan_memory_size) {
681 /*
682 * We are doomed. Attempts to call e.g. panic()
are
683 * likely to fail because they call out into
684 * instrumented code, which will almost
certainly
685 * access memory beyond the end of physical
686 * memory. Hang here so that at least the NIP
points
687 * somewhere that will help you debug it if you
look at
688 * it in qemu.
689 */
690 while (true)
691 ;
692 } else if (top_phys_addr > kasan_memory_size) {
693 /* print a bg warning in hopes people
notice */
> 694
> pr_err("===\n"
695 "Physical memory exceeds compiled-in
maximum!\n"
696
Re: [PATCH v2 4/4] powerpc: Book3S 64-bit "heavyweight" KASAN support
On 10/12/19 3:47 pm, Daniel Axtens wrote:
> KASAN support on powerpc64 is challenging:
>
> - We want to be able to support inline instrumentation so as to be
>able to catch global and stack issues.
>
> - We run some code in real mode after boot, most notably a lot of
>KVM code. We'd like to be able to instrument this.
>
>[For those not immersed in ppc64, in real mode, the top nibble or
>2 bits (depending on radix/hash mmu) of the address is ignored. The
>linear mapping is placed at 0xc000. This means that a
>pointer to part of the linear mapping will work both in real mode,
>where it will be interpreted as a physical address of the form
>0x000..., and out of real mode, where it will go via the linear
>mapping.]
>
> - Inline instrumentation requires a fixed offset.
>
> - Because of our running things in real mode, the offset has to
>point to valid memory both in and out of real mode.
>
> This makes finding somewhere to put the KASAN shadow region challenging.
>
> One approach is just to give up on inline instrumentation and override
> the address->shadow calculation. This way we can delay all checking
> until after we get everything set up to our satisfaction. However,
> we'd really like to do better.
>
> What we can do - if we know _at compile time_ how much contiguous
> physical memory we have - is to set aside the top 1/8th of the memory
> and use that. This is a big hammer (hence the "heavyweight" name) and
> comes with 3 big consequences:
>
> - kernels will simply fail to boot on machines with less memory than
>specified when compiling.
>
> - kernels running on machines with more memory than specified when
>compiling will simply ignore the extra memory.
>
> - there's no nice way to handle physically discontiguous memory, so
>you are restricted to the first physical memory block.
>
> If you can bear all this, you get full support for KASAN.
>
> Despite the limitations, it can still find bugs,
> e.g. http://patchwork.ozlabs.org/patch/1103775/
>
> The current implementation is Radix only.
>
> Massive thanks to mpe, who had the idea for the initial design.
>
> Signed-off-by: Daniel Axtens
>
> ---
> Changes since v1:
> - Landed kasan vmalloc support upstream
> - Lots of feedback from Christophe.
>
> Changes since the rfc:
>
> - Boots real and virtual hardware, kvm works.
>
> - disabled reporting when we're checking the stack for exception
>frames. The behaviour isn't wrong, just incompatible with KASAN.
>
> - Documentation!
>
> - Dropped old module stuff in favour of KASAN_VMALLOC.
>
> The bugs with ftrace and kuap were due to kernel bloat pushing
> prom_init calls to be done via the plt. Because we did not have
> a relocatable kernel, and they are done very early, this caused
> everything to explode. Compile with CONFIG_RELOCATABLE!
> ---
> Documentation/dev-tools/kasan.rst | 8 +-
> Documentation/powerpc/kasan.txt | 102 +-
> arch/powerpc/Kconfig | 3 +
> arch/powerpc/Kconfig.debug| 21
> arch/powerpc/Makefile | 11 ++
> arch/powerpc/include/asm/kasan.h | 20 +++-
> arch/powerpc/kernel/process.c | 8 ++
> arch/powerpc/kernel/prom.c| 59 +-
> arch/powerpc/mm/kasan/Makefile| 3 +-
> .../mm/kasan/{kasan_init_32.c => init_32.c} | 0
> arch/powerpc/mm/kasan/init_book3s_64.c| 67
> 11 files changed, 293 insertions(+), 9 deletions(-)
> rename arch/powerpc/mm/kasan/{kasan_init_32.c => init_32.c} (100%)
> create mode 100644 arch/powerpc/mm/kasan/init_book3s_64.c
>
> diff --git a/Documentation/dev-tools/kasan.rst
> b/Documentation/dev-tools/kasan.rst
> index 4af2b5d2c9b4..d99dc580bc11 100644
> --- a/Documentation/dev-tools/kasan.rst
> +++ b/Documentation/dev-tools/kasan.rst
> @@ -22,8 +22,9 @@ global variables yet.
> Tag-based KASAN is only supported in Clang and requires version 7.0.0 or
> later.
>
> Currently generic KASAN is supported for the x86_64, arm64, xtensa and s390
> -architectures. It is also supported on 32-bit powerpc kernels. Tag-based
> KASAN
> -is supported only on arm64.
> +architectures. It is also supported on powerpc, for 32-bit kernels, and for
> +64-bit kernels running under the Radix MMU. Tag-based KASAN is supported only
> +on arm64.
>
> Usage
> -
> @@ -256,7 +257,8 @@ CONFIG_KASAN_VMALLOC
>
>
> With ``CONFIG_KASAN_VMALLOC``, KASAN can cover vmalloc space at the
> -cost of greater memory usage. Currently this is only supported on x86.
> +cost of greater memory usage. Currently this is optional on x86, and
> +required on 64-bit powerpc.
>
> This works by hooking into vmalloc and vmap, and dynamically
> allocating real shadow memory to back the mappings.
> diff --git a/Documentation/powerpc/kasan.txt
Re: [PATCH v2 4/4] powerpc: Book3S 64-bit "heavyweight" KASAN support
Le 10/12/2019 à 05:47, Daniel Axtens a écrit :
KASAN support on powerpc64 is challenging:
- We want to be able to support inline instrumentation so as to be
able to catch global and stack issues.
- We run some code in real mode after boot, most notably a lot of
KVM code. We'd like to be able to instrument this.
[For those not immersed in ppc64, in real mode, the top nibble or
2 bits (depending on radix/hash mmu) of the address is ignored. The
linear mapping is placed at 0xc000. This means that a
pointer to part of the linear mapping will work both in real mode,
where it will be interpreted as a physical address of the form
0x000..., and out of real mode, where it will go via the linear
mapping.]
- Inline instrumentation requires a fixed offset.
- Because of our running things in real mode, the offset has to
point to valid memory both in and out of real mode.
This makes finding somewhere to put the KASAN shadow region challenging.
One approach is just to give up on inline instrumentation and override
the address->shadow calculation. This way we can delay all checking
until after we get everything set up to our satisfaction. However,
we'd really like to do better.
I think all the 'we' wordings should be rephrased in line with kernel
process (see
https://www.kernel.org/doc/html/latest/process/submitting-patches.html):
Describe your changes in imperative mood, e.g. "make xyzzy do frotz"
instead of "[This patch] makes xyzzy do frotz" or "[I] changed xyzzy
to do frotz", as if you are giving orders to the codebase to change
its behaviour.
For instance, could instead be:
"This way all checking can be delay after everything get set up to
satisfaction. However, better could really be done."
What we can do - if we know _at compile time_ how much contiguous
physical memory we have - is to set aside the top 1/8th of the memory
and use that. This is a big hammer (hence the "heavyweight" name) and
comes with 3 big consequences:
- kernels will simply fail to boot on machines with less memory than
specified when compiling.
- kernels running on machines with more memory than specified when
compiling will simply ignore the extra memory.
- there's no nice way to handle physically discontiguous memory, so
you are restricted to the first physical memory block.
If you can bear all this, you get full support for KASAN.
Despite the limitations, it can still find bugs,
e.g. http://patchwork.ozlabs.org/patch/1103775/
The current implementation is Radix only.
Massive thanks to mpe, who had the idea for the initial design.
Signed-off-by: Daniel Axtens
---
Changes since v1:
- Landed kasan vmalloc support upstream
- Lots of feedback from Christophe.
Changes since the rfc:
- Boots real and virtual hardware, kvm works.
- disabled reporting when we're checking the stack for exception
frames. The behaviour isn't wrong, just incompatible with KASAN.
- Documentation!
- Dropped old module stuff in favour of KASAN_VMALLOC.
The bugs with ftrace and kuap were due to kernel bloat pushing
prom_init calls to be done via the plt. Because we did not have
a relocatable kernel, and they are done very early, this caused
everything to explode. Compile with CONFIG_RELOCATABLE!
---
Documentation/dev-tools/kasan.rst | 8 +-
Documentation/powerpc/kasan.txt | 102 +-
arch/powerpc/Kconfig | 3 +
arch/powerpc/Kconfig.debug| 21
arch/powerpc/Makefile | 11 ++
arch/powerpc/include/asm/kasan.h | 20 +++-
arch/powerpc/kernel/process.c | 8 ++
arch/powerpc/kernel/prom.c| 59 +-
arch/powerpc/mm/kasan/Makefile| 3 +-
.../mm/kasan/{kasan_init_32.c => init_32.c} | 0
arch/powerpc/mm/kasan/init_book3s_64.c| 67
11 files changed, 293 insertions(+), 9 deletions(-)
rename arch/powerpc/mm/kasan/{kasan_init_32.c => init_32.c} (100%)
create mode 100644 arch/powerpc/mm/kasan/init_book3s_64.c
diff --git a/Documentation/dev-tools/kasan.rst
b/Documentation/dev-tools/kasan.rst
index 4af2b5d2c9b4..d99dc580bc11 100644
--- a/Documentation/dev-tools/kasan.rst
+++ b/Documentation/dev-tools/kasan.rst
@@ -22,8 +22,9 @@ global variables yet.
Tag-based KASAN is only supported in Clang and requires version 7.0.0 or
later.
Currently generic KASAN is supported for the x86_64, arm64, xtensa and s390
-architectures. It is also supported on 32-bit powerpc kernels. Tag-based KASAN
-is supported only on arm64.
+architectures. It is also supported on powerpc, for 32-bit kernels, and for
+64-bit kernels running under the Radix MMU. Tag-based KASAN is supported only
+on arm64.
Usage
-
@@ -256,7 +257,8 @@ CONFIG_KASAN_VMALLOC
With ``CONFIG_KASAN_VMALLOC``, KASAN can cover vmalloc
[PATCH v2 4/4] powerpc: Book3S 64-bit "heavyweight" KASAN support
KASAN support on powerpc64 is challenging:
- We want to be able to support inline instrumentation so as to be
able to catch global and stack issues.
- We run some code in real mode after boot, most notably a lot of
KVM code. We'd like to be able to instrument this.
[For those not immersed in ppc64, in real mode, the top nibble or
2 bits (depending on radix/hash mmu) of the address is ignored. The
linear mapping is placed at 0xc000. This means that a
pointer to part of the linear mapping will work both in real mode,
where it will be interpreted as a physical address of the form
0x000..., and out of real mode, where it will go via the linear
mapping.]
- Inline instrumentation requires a fixed offset.
- Because of our running things in real mode, the offset has to
point to valid memory both in and out of real mode.
This makes finding somewhere to put the KASAN shadow region challenging.
One approach is just to give up on inline instrumentation and override
the address->shadow calculation. This way we can delay all checking
until after we get everything set up to our satisfaction. However,
we'd really like to do better.
What we can do - if we know _at compile time_ how much contiguous
physical memory we have - is to set aside the top 1/8th of the memory
and use that. This is a big hammer (hence the "heavyweight" name) and
comes with 3 big consequences:
- kernels will simply fail to boot on machines with less memory than
specified when compiling.
- kernels running on machines with more memory than specified when
compiling will simply ignore the extra memory.
- there's no nice way to handle physically discontiguous memory, so
you are restricted to the first physical memory block.
If you can bear all this, you get full support for KASAN.
Despite the limitations, it can still find bugs,
e.g. http://patchwork.ozlabs.org/patch/1103775/
The current implementation is Radix only.
Massive thanks to mpe, who had the idea for the initial design.
Signed-off-by: Daniel Axtens
---
Changes since v1:
- Landed kasan vmalloc support upstream
- Lots of feedback from Christophe.
Changes since the rfc:
- Boots real and virtual hardware, kvm works.
- disabled reporting when we're checking the stack for exception
frames. The behaviour isn't wrong, just incompatible with KASAN.
- Documentation!
- Dropped old module stuff in favour of KASAN_VMALLOC.
The bugs with ftrace and kuap were due to kernel bloat pushing
prom_init calls to be done via the plt. Because we did not have
a relocatable kernel, and they are done very early, this caused
everything to explode. Compile with CONFIG_RELOCATABLE!
---
Documentation/dev-tools/kasan.rst | 8 +-
Documentation/powerpc/kasan.txt | 102 +-
arch/powerpc/Kconfig | 3 +
arch/powerpc/Kconfig.debug| 21
arch/powerpc/Makefile | 11 ++
arch/powerpc/include/asm/kasan.h | 20 +++-
arch/powerpc/kernel/process.c | 8 ++
arch/powerpc/kernel/prom.c| 59 +-
arch/powerpc/mm/kasan/Makefile| 3 +-
.../mm/kasan/{kasan_init_32.c => init_32.c} | 0
arch/powerpc/mm/kasan/init_book3s_64.c| 67
11 files changed, 293 insertions(+), 9 deletions(-)
rename arch/powerpc/mm/kasan/{kasan_init_32.c => init_32.c} (100%)
create mode 100644 arch/powerpc/mm/kasan/init_book3s_64.c
diff --git a/Documentation/dev-tools/kasan.rst
b/Documentation/dev-tools/kasan.rst
index 4af2b5d2c9b4..d99dc580bc11 100644
--- a/Documentation/dev-tools/kasan.rst
+++ b/Documentation/dev-tools/kasan.rst
@@ -22,8 +22,9 @@ global variables yet.
Tag-based KASAN is only supported in Clang and requires version 7.0.0 or later.
Currently generic KASAN is supported for the x86_64, arm64, xtensa and s390
-architectures. It is also supported on 32-bit powerpc kernels. Tag-based KASAN
-is supported only on arm64.
+architectures. It is also supported on powerpc, for 32-bit kernels, and for
+64-bit kernels running under the Radix MMU. Tag-based KASAN is supported only
+on arm64.
Usage
-
@@ -256,7 +257,8 @@ CONFIG_KASAN_VMALLOC
With ``CONFIG_KASAN_VMALLOC``, KASAN can cover vmalloc space at the
-cost of greater memory usage. Currently this is only supported on x86.
+cost of greater memory usage. Currently this is optional on x86, and
+required on 64-bit powerpc.
This works by hooking into vmalloc and vmap, and dynamically
allocating real shadow memory to back the mappings.
diff --git a/Documentation/powerpc/kasan.txt b/Documentation/powerpc/kasan.txt
index a85ce2ff8244..d6e7a415195c 100644
--- a/Documentation/powerpc/kasan.txt
+++ b/Documentation/powerpc/kasan.txt
@@ -1,4 +1,4 @@
-KASAN is supported on powerpc on 32-bit only.
+KASAN is supported on powerpc on 32-bit and 64-bit Radix only.
32 bit support
