Re: [Xen-devel] [PATCH v2 2/4] x86/xen: add basic KASAN support for PV kernel
On 17/01/2020 14:56, Boris Ostrovsky wrote:
>
>
> On 1/17/20 7:58 AM, Sergey Dyasli wrote:
>> --- a/arch/x86/mm/kasan_init_64.c
>> +++ b/arch/x86/mm/kasan_init_64.c
>> @@ -13,6 +13,9 @@
>> #include
>> #include
>> +#include
>> +#include
>> +
>> #include
>> #include
>> #include
>> @@ -332,6 +335,11 @@ void __init kasan_early_init(void)
>> for (i = 0; pgtable_l5_enabled() && i < PTRS_PER_P4D; i++)
>> kasan_early_shadow_p4d[i] = __p4d(p4d_val);
>> +if (xen_pv_domain()) {
>> +pgd_t *pv_top_pgt = xen_pv_kasan_early_init();
>> +kasan_map_early_shadow(pv_top_pgt);
>> +}
>> +
>
>
> I'd suggest replacing this with xen_kasan_early_init() and doing everything,
> including PV check, there. This way non-Xen code won't need to be aware of
> Xen-specific details such as guest types.
This would require exporting kasan_map_early_shadow() via kasan.h.
I'm fine with either approach.
>> kasan_map_early_shadow(early_top_pgt);
>> kasan_map_early_shadow(init_top_pgt);
>> }
>> @@ -369,6 +377,8 @@ void __init kasan_init(void)
>> __pgd(__pa(tmp_p4d_table) | _KERNPG_TABLE));
>> }
>> +xen_pv_kasan_pin_pgd(early_top_pgt);
>> +
>
> And drop "_pv" here (and below) for the same reason.
This is a reasonable suggestion.
>> load_cr3(early_top_pgt);
>> __flush_tlb_all();
>> @@ -433,6 +443,8 @@ void __init kasan_init(void)
>> load_cr3(init_top_pgt);
>> __flush_tlb_all();
>> +xen_pv_kasan_unpin_pgd(early_top_pgt);
>> +
>>
--
Thanks,
Sergey
___
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
Re: [Xen-devel] [PATCH v2 2/4] x86/xen: add basic KASAN support for PV kernel
Hi Sergey,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on xen-tip/linux-next]
[also build test ERROR on tip/x86/mm tip/auto-latest linux/master linus/master
v5.5-rc7 next-20200121]
[if your patch is applied to the wrong git tree, please drop us a note to help
improve the system. BTW, we also suggest to use '--base' option to specify the
base tree in git format-patch, please see https://stackoverflow.com/a/37406982]
url:
https://github.com/0day-ci/linux/commits/Sergey-Dyasli/basic-KASAN-support-for-Xen-PV-domains/20200118-073544
base: https://git.kernel.org/pub/scm/linux/kernel/git/xen/tip.git linux-next
config: x86_64-randconfig-a002-20200121 (attached as .config)
compiler: gcc-6 (Debian 6.3.0-18+deb9u1) 6.3.0 20170516
reproduce:
# save the attached .config to linux build tree
make ARCH=x86_64
If you fix the issue, kindly add following tag
Reported-by: kbuild test robot
All errors (new ones prefixed by >>):
arch/x86/xen/mmu_pv.c: In function 'xen_pv_kasan_early_init':
>> arch/x86/xen/mmu_pv.c:1778:16: error: 'kasan_early_shadow_pud' undeclared
>> (first use in this function)
set_page_prot(kasan_early_shadow_pud, PAGE_KERNEL_RO);
^~
arch/x86/xen/mmu_pv.c:1778:16: note: each undeclared identifier is reported
only once for each function it appears in
>> arch/x86/xen/mmu_pv.c:1779:16: error: 'kasan_early_shadow_pmd' undeclared
>> (first use in this function)
set_page_prot(kasan_early_shadow_pmd, PAGE_KERNEL_RO);
^~
>> arch/x86/xen/mmu_pv.c:1780:16: error: 'kasan_early_shadow_pte' undeclared
>> (first use in this function)
set_page_prot(kasan_early_shadow_pte, PAGE_KERNEL_RO);
^~
vim +/kasan_early_shadow_pud +1778 arch/x86/xen/mmu_pv.c
1774
1775 pgd_t * __init xen_pv_kasan_early_init(void)
1776 {
1777 /* PV page tables must be read-only */
> 1778 set_page_prot(kasan_early_shadow_pud, PAGE_KERNEL_RO);
> 1779 set_page_prot(kasan_early_shadow_pmd, PAGE_KERNEL_RO);
> 1780 set_page_prot(kasan_early_shadow_pte, PAGE_KERNEL_RO);
1781
1782 /* Return a pointer to the initial PV page tables */
1783 return (pgd_t *)xen_start_info->pt_base;
1784 }
1785
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/hyperkitty/list/kbuild-...@lists.01.org Intel Corporation
.config.gz
Description: application/gzip
___
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
Re: [Xen-devel] [PATCH v2 2/4] x86/xen: add basic KASAN support for PV kernel
Hi Sergey,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on xen-tip/linux-next]
[also build test ERROR on tip/x86/mm tip/auto-latest linux/master linus/master
v5.5-rc7 next-20200117]
[if your patch is applied to the wrong git tree, please drop us a note to help
improve the system. BTW, we also suggest to use '--base' option to specify the
base tree in git format-patch, please see https://stackoverflow.com/a/37406982]
url:
https://github.com/0day-ci/linux/commits/Sergey-Dyasli/basic-KASAN-support-for-Xen-PV-domains/20200118-073544
base: https://git.kernel.org/pub/scm/linux/kernel/git/xen/tip.git linux-next
config: i386-randconfig-f003-20200120 (attached as .config)
compiler: gcc-7 (Debian 7.5.0-3) 7.5.0
reproduce:
# save the attached .config to linux build tree
make ARCH=i386
If you fix the issue, kindly add following tag
Reported-by: kbuild test robot
All errors (new ones prefixed by >>):
arch/x86//xen/mmu_pv.c: In function 'xen_pv_kasan_early_init':
>> arch/x86//xen/mmu_pv.c:1778:16: error: 'kasan_early_shadow_pud' undeclared
>> (first use in this function); did you mean 'kasan_free_shadow'?
set_page_prot(kasan_early_shadow_pud, PAGE_KERNEL_RO);
^~
kasan_free_shadow
arch/x86//xen/mmu_pv.c:1778:16: note: each undeclared identifier is reported
only once for each function it appears in
>> arch/x86//xen/mmu_pv.c:1779:16: error: 'kasan_early_shadow_pmd' undeclared
>> (first use in this function); did you mean 'kasan_early_shadow_pud'?
set_page_prot(kasan_early_shadow_pmd, PAGE_KERNEL_RO);
^~
kasan_early_shadow_pud
>> arch/x86//xen/mmu_pv.c:1780:16: error: 'kasan_early_shadow_pte' undeclared
>> (first use in this function); did you mean 'kasan_early_shadow_pmd'?
set_page_prot(kasan_early_shadow_pte, PAGE_KERNEL_RO);
^~
kasan_early_shadow_pmd
vim +1778 arch/x86//xen/mmu_pv.c
1774
1775 pgd_t * __init xen_pv_kasan_early_init(void)
1776 {
1777 /* PV page tables must be read-only */
> 1778 set_page_prot(kasan_early_shadow_pud, PAGE_KERNEL_RO);
> 1779 set_page_prot(kasan_early_shadow_pmd, PAGE_KERNEL_RO);
> 1780 set_page_prot(kasan_early_shadow_pte, PAGE_KERNEL_RO);
1781
1782 /* Return a pointer to the initial PV page tables */
1783 return (pgd_t *)xen_start_info->pt_base;
1784 }
1785
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/hyperkitty/list/kbuild-...@lists.01.org Intel Corporation
.config.gz
Description: application/gzip
___
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
Re: [Xen-devel] [PATCH v2 2/4] x86/xen: add basic KASAN support for PV kernel
On 1/17/20 7:58 AM, Sergey Dyasli wrote:
--- a/arch/x86/mm/kasan_init_64.c
+++ b/arch/x86/mm/kasan_init_64.c
@@ -13,6 +13,9 @@
#include
#include
+#include
+#include
+
#include
#include
#include
@@ -332,6 +335,11 @@ void __init kasan_early_init(void)
for (i = 0; pgtable_l5_enabled() && i < PTRS_PER_P4D; i++)
kasan_early_shadow_p4d[i] = __p4d(p4d_val);
+ if (xen_pv_domain()) {
+ pgd_t *pv_top_pgt = xen_pv_kasan_early_init();
+ kasan_map_early_shadow(pv_top_pgt);
+ }
+
I'd suggest replacing this with xen_kasan_early_init() and doing
everything, including PV check, there. This way non-Xen code won't need
to be aware of Xen-specific details such as guest types.
kasan_map_early_shadow(early_top_pgt);
kasan_map_early_shadow(init_top_pgt);
}
@@ -369,6 +377,8 @@ void __init kasan_init(void)
__pgd(__pa(tmp_p4d_table) | _KERNPG_TABLE));
}
+ xen_pv_kasan_pin_pgd(early_top_pgt);
+
And drop "_pv" here (and below) for the same reason.
-boris
load_cr3(early_top_pgt);
__flush_tlb_all();
@@ -433,6 +443,8 @@ void __init kasan_init(void)
load_cr3(init_top_pgt);
__flush_tlb_all();
+ xen_pv_kasan_unpin_pgd(early_top_pgt);
+
___
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
[Xen-devel] [PATCH v2 2/4] x86/xen: add basic KASAN support for PV kernel
This enables to use Outline instrumentation for Xen PV kernels.
KASAN_INLINE and KASAN_VMALLOC options currently lead to boot crashes
and hence disabled.
Signed-off-by: Sergey Dyasli
---
v1 --> v2:
- Fix compilation without CONFIG_XEN_PV
- Use macros for KASAN_SHADOW_START
RFC --> v1:
- New functions with declarations in xen/xen-ops.h
- Fixed the issue with free_kernel_image_pages() with the help of
xen_pv_kasan_unpin_pgd()
---
arch/x86/mm/kasan_init_64.c | 12
arch/x86/xen/Makefile | 7 +++
arch/x86/xen/enlighten_pv.c | 3 +++
arch/x86/xen/mmu_pv.c | 38 +
drivers/xen/Makefile| 2 ++
include/xen/xen-ops.h | 10 ++
kernel/Makefile | 2 ++
lib/Kconfig.kasan | 3 ++-
8 files changed, 76 insertions(+), 1 deletion(-)
diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c
index cf5bc37c90ac..902a6a152d33 100644
--- a/arch/x86/mm/kasan_init_64.c
+++ b/arch/x86/mm/kasan_init_64.c
@@ -13,6 +13,9 @@
#include
#include
+#include
+#include
+
#include
#include
#include
@@ -332,6 +335,11 @@ void __init kasan_early_init(void)
for (i = 0; pgtable_l5_enabled() && i < PTRS_PER_P4D; i++)
kasan_early_shadow_p4d[i] = __p4d(p4d_val);
+ if (xen_pv_domain()) {
+ pgd_t *pv_top_pgt = xen_pv_kasan_early_init();
+ kasan_map_early_shadow(pv_top_pgt);
+ }
+
kasan_map_early_shadow(early_top_pgt);
kasan_map_early_shadow(init_top_pgt);
}
@@ -369,6 +377,8 @@ void __init kasan_init(void)
__pgd(__pa(tmp_p4d_table) | _KERNPG_TABLE));
}
+ xen_pv_kasan_pin_pgd(early_top_pgt);
+
load_cr3(early_top_pgt);
__flush_tlb_all();
@@ -433,6 +443,8 @@ void __init kasan_init(void)
load_cr3(init_top_pgt);
__flush_tlb_all();
+ xen_pv_kasan_unpin_pgd(early_top_pgt);
+
/*
* kasan_early_shadow_page has been used as early shadow memory, thus
* it may contain some garbage. Now we can clear and write protect it,
diff --git a/arch/x86/xen/Makefile b/arch/x86/xen/Makefile
index 084de77a109e..102fad0b0bca 100644
--- a/arch/x86/xen/Makefile
+++ b/arch/x86/xen/Makefile
@@ -1,3 +1,10 @@
+KASAN_SANITIZE_enlighten_pv.o := n
+KASAN_SANITIZE_enlighten.o := n
+KASAN_SANITIZE_irq.o := n
+KASAN_SANITIZE_mmu_pv.o := n
+KASAN_SANITIZE_p2m.o := n
+KASAN_SANITIZE_multicalls.o := n
+
# SPDX-License-Identifier: GPL-2.0
OBJECT_FILES_NON_STANDARD_xen-asm_$(BITS).o := y
diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
index ae4a41ca19f6..27de55699f24 100644
--- a/arch/x86/xen/enlighten_pv.c
+++ b/arch/x86/xen/enlighten_pv.c
@@ -72,6 +72,7 @@
#include
#include
#include
+#include
#ifdef CONFIG_ACPI
#include
@@ -1231,6 +1232,8 @@ asmlinkage __visible void __init xen_start_kernel(void)
/* Get mfn list */
xen_build_dynamic_phys_to_machine();
+ kasan_early_init();
+
/*
* Set up kernel GDT and segment registers, mainly so that
* -fstack-protector code can be executed.
diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
index c8dbee62ec2a..5cd63e37a2db 100644
--- a/arch/x86/xen/mmu_pv.c
+++ b/arch/x86/xen/mmu_pv.c
@@ -1771,6 +1771,36 @@ static void __init set_page_prot(void *addr, pgprot_t
prot)
{
return set_page_prot_flags(addr, prot, UVMF_NONE);
}
+
+pgd_t * __init xen_pv_kasan_early_init(void)
+{
+ /* PV page tables must be read-only */
+ set_page_prot(kasan_early_shadow_pud, PAGE_KERNEL_RO);
+ set_page_prot(kasan_early_shadow_pmd, PAGE_KERNEL_RO);
+ set_page_prot(kasan_early_shadow_pte, PAGE_KERNEL_RO);
+
+ /* Return a pointer to the initial PV page tables */
+ return (pgd_t *)xen_start_info->pt_base;
+}
+
+void __init xen_pv_kasan_pin_pgd(pgd_t *pgd)
+{
+ if (!xen_pv_domain())
+ return;
+
+ set_page_prot(pgd, PAGE_KERNEL_RO);
+ pin_pagetable_pfn(MMUEXT_PIN_L4_TABLE, PFN_DOWN(__pa_symbol(pgd)));
+}
+
+void __init xen_pv_kasan_unpin_pgd(pgd_t *pgd)
+{
+ if (!xen_pv_domain())
+ return;
+
+ pin_pagetable_pfn(MMUEXT_UNPIN_TABLE, PFN_DOWN(__pa_symbol(pgd)));
+ set_page_prot(pgd, PAGE_KERNEL);
+}
+
#ifdef CONFIG_X86_32
static void __init xen_map_identity_early(pmd_t *pmd, unsigned long max_pfn)
{
@@ -1943,6 +1973,14 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd,
unsigned long max_pfn)
if (i && i < pgd_index(__START_KERNEL_map))
init_top_pgt[i] = ((pgd_t *)xen_start_info->pt_base)[i];
+#ifdef CONFIG_KASAN
+ /* Copy KASAN mappings */
+ for (i = pgd_index(KASAN_SHADOW_START);
+i < pgd_index(KASAN_SHADOW_END);
+i++)
+ init_top_pgt[i] = ((pgd_t *)xen_start_info->pt_base)[i];
+#endif /* ifdef CONFIG_KASAN */
+
/* Make pagetable pieces RO */
