From patchwork Mon Mar 13 18:32:10 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Boris Ostrovsky X-Patchwork-Id: 9621785 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5332B60244 for ; Mon, 13 Mar 2017 18:34:05 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 48A8B28494 for ; Mon, 13 Mar 2017 18:34:05 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3B92328503; Mon, 13 Mar 2017 18:34:05 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 0A5B628494 for ; Mon, 13 Mar 2017 18:34:03 +0000 (UTC) Received: (qmail 32686 invoked by uid 550); 13 Mar 2017 18:34:01 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 32630 invoked from network); 13 Mar 2017 18:34:00 -0000 To: Thomas Garnier References: <20170306220348.79702-1-thgarnie@google.com> <20170306220348.79702-2-thgarnie@google.com> <17ffcc5b-1c9a-51b6-272a-5eaecf1bc0c4@citrix.com> <5cf31779-45c5-d37f-86bc-d5afb3fb7ab6@oracle.com> <51c23e92-d1f0-427f-e069-c92fc4ed6226@oracle.com> <36579cc4-05e7-a448-767c-b9ad940362fc@oracle.com> Cc: Michal Hocko , Stanislaw Gruszka , kvm list , "linux-doc@vger.kernel.org" , Matt Fleming , Frederic Weisbecker , Josh Poimboeuf , Chris Wilson , "linux-mm@kvack.org" , Dave Hansen , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , "linux-efi@vger.kernel.org" , Alexander Potapenko , Pavel Machek , "H . Peter Anvin" , "kernel-hardening@lists.openwall.com" , Jiri Olsa , zijun_hu , Prarit Bhargava , Andi Kleen , Len Brown , Jonathan Corbet , Michael Ellerman , Joerg Roedel , X86 ML , "Luis R . Rodriguez" , kasan-dev , Christian Borntraeger , Ingo Molnar , "xen-devel@lists.xenproject.org" , Borislav Petkov , Fenghua Yu , Jiri Kosina , Kees Cook , Arnd Bergmann , He Chen , Brian Gerst , Rusty Russell , Joonsoo Kim , lguest@lists.ozlabs.org, Andy Lutomirski , Andrey Ryabinin , Thomas Gleixner , Andrew Morton , Dmitry Vyukov , Juergen Gross , Lorenzo Stoakes , Paul Gortmaker , Andrew Cooper , "linux-pm@vger.kernel.org" , Ard Biesheuvel , "Rafael J . Wysocki" , "linux-kernel@vger.kernel.org" , Andy Lutomirski , Peter Zijlstra , Paolo Bonzini , Vitaly Kuznetsov , Tim Chen From: Boris Ostrovsky Message-ID: Date: Mon, 13 Mar 2017 14:32:10 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.6.0 MIME-Version: 1.0 In-Reply-To: <36579cc4-05e7-a448-767c-b9ad940362fc@oracle.com> X-Source-IP: aserv0021.oracle.com [141.146.126.233] Subject: [kernel-hardening] Re: [Xen-devel] [PATCH v5 2/3] x86: Remap GDT tables in the Fixmap section X-Virus-Scanned: ClamAV using ClamSMTP On 03/09/2017 06:17 PM, Boris Ostrovsky wrote: > On 03/09/2017 05:31 PM, Thomas Garnier wrote: >> On Thu, Mar 9, 2017 at 2:13 PM, Boris Ostrovsky >> wrote: >>>>> I don't have any experience with Xen so it would be great if virtme can test it. >>>> I am pretty sure I tested this series at some point but I'll test it again. >>>> >>> >>> Fails 32-bit build: >>> >>> >>> /home/build/linux-boris/arch/x86/kvm/vmx.c: In function ‘segment_base’: >>> /home/build/linux-boris/arch/x86/kvm/vmx.c:2054: error: ‘host_gdt’ >>> undeclared (first use in this function) >>> /home/build/linux-boris/arch/x86/kvm/vmx.c:2054: error: (Each undeclared >>> identifier is reported only once >>> /home/build/linux-boris/arch/x86/kvm/vmx.c:2054: error: for each >>> function it appears in.) >>> /home/build/linux-boris/arch/x86/kvm/vmx.c:2054: error: type defaults to >>> ‘int’ in declaration of ‘type name’ >>> /home/build/linux-boris/arch/x86/kvm/vmx.c:2054: error: type defaults to >>> ‘int’ in declaration of ‘type name’ >>> /home/build/linux-boris/arch/x86/kvm/vmx.c:2054: warning: initialization >>> from incompatible pointer type >>> /home/build/linux-boris/arch/x86/kvm/vmx.c:2054: warning: unused >>> variable ‘gdt’ >>> >>> >>> -boris >> It seems that I forgot to remove line 2054 on the rebase. My 32-bit >> build comes clean but I assume it is not good enough compare to the >> full version I build for 64-bit KVM testing. >> >> Remove just this line and it should build fine, I will fix this on the >> next iteration. >> >> Thanks for testing, >> > > > So this, in fact, does break Xen in that the hypercall to set GDT fails. > > I will have lo look at this tomorrow but I definitely at least built > with v3 of this series. And I don't see why I wouldn't have tested it > once I built it. There are a couple of problems for Xen PV guests that need to be addressed: 1. Xen's set_fixmap op needs non-default handling for FIX_GDT_REMAP_BEGIN range 2. GDT remapping for PV guests needs to be RO for both 64 and 32-bit guests. I don't know how you prefer to deal with (2), patch below is one suggestion. With it all my boot tests (Xen and bare-metal) passed. One problem with applying it directly is that kernel becomes not-bisectable (Xen-wise) between patches 2 and 3 so perhaps you might pull some of the changes from patch 3 to patch 2. -boris break; diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h index 9b7fda6..ec05f9c 100644 --- a/arch/x86/include/asm/desc.h +++ b/arch/x86/include/asm/desc.h @@ -39,6 +39,7 @@ extern struct desc_ptr idt_descr; extern gate_desc idt_table[]; extern const struct desc_ptr debug_idt_descr; extern gate_desc debug_idt_table[]; +extern pgprot_t pg_fixmap_gdt_flags; struct gdt_page { struct desc_struct gdt[GDT_ENTRIES]; diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index bff2f8b..2682355 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -450,16 +450,16 @@ void load_percpu_segment(int cpu) /* On 64-bit the GDT remapping is read-only */ #ifdef CONFIG_X86_64 -#define PAGE_FIXMAP_GDT PAGE_KERNEL_RO +pgprot_t pg_fixmap_gdt_flags = PAGE_KERNEL_RO; #else -#define PAGE_FIXMAP_GDT PAGE_KERNEL +pgprot_t pg_fixmap_gdt_flags = PAGE_KERNEL; #endif /* Setup the fixmap mapping only once per-processor */ static inline void setup_fixmap_gdt(int cpu) { __set_fixmap(get_cpu_gdt_ro_index(cpu), - __pa(get_cpu_gdt_rw(cpu)), PAGE_FIXMAP_GDT); + __pa(get_cpu_gdt_rw(cpu)), pg_fixmap_gdt_flags); } /* Load the original GDT from the per-cpu structure */ diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index f46d47b..8871bcd 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -2051,7 +2051,7 @@ static bool update_transition_efer(struct vcpu_vmx *vmx, int efer_offset) */ static unsigned long segment_base(u16 selector) { - struct desc_ptr *gdt = this_cpu_ptr(&host_gdt); + //struct desc_ptr *gdt = this_cpu_ptr(&host_gdt); struct desc_struct *table; unsigned long v; diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c index 4951fcf..2dc5f97 100644 --- a/arch/x86/xen/enlighten.c +++ b/arch/x86/xen/enlighten.c @@ -1545,6 +1545,9 @@ asmlinkage __visible void __init xen_start_kernel(void) */ xen_initial_gdt = &per_cpu(gdt_page, 0); + /* GDT can only be remapped RO. */ + pg_fixmap_gdt_flags = PAGE_KERNEL_RO; + xen_smp_init(); #ifdef CONFIG_ACPI_NUMA diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c index 37cb5aa..ebbfe00 100644 --- a/arch/x86/xen/mmu.c +++ b/arch/x86/xen/mmu.c @@ -2326,6 +2326,7 @@ static void xen_set_fixmap(unsigned idx, phys_addr_t phys, pgprot_t prot) #endif case FIX_TEXT_POKE0: case FIX_TEXT_POKE1: + case FIX_GDT_REMAP_BEGIN ... FIX_GDT_REMAP_END: /* All local page mappings */ pte = pfn_pte(phys, prot);