linux-kernel - Re: [PATCH] x86/xen: support early interrupts in xen pv guests

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CALCETrVZEKsi3GMhOz27kqkBDxhYC05npMxGEjEBHwQd2mG6mQ@mail.gmail.com>
Date:   Fri, 24 Nov 2017 07:50:28 -0800
From:   Andy Lutomirski <luto@...nel.org>
To:     Juergen Gross <jgross@...e.com>
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "xen-devel@...ts.xenproject.org" <xen-devel@...ts.xenproject.org>,
        X86 ML <x86@...nel.org>,
        Boris Ostrovsky <boris.ostrovsky@...cle.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        Andrew Lutomirski <luto@...nel.org>
Subject: Re: [PATCH] x86/xen: support early interrupts in xen pv guests

On Fri, Nov 24, 2017 at 12:52 AM, Juergen Gross <jgross@...e.com> wrote:
> Sorry, Andy, forgot to Cc: you...
>
> On 24/11/17 09:42, Juergen Gross wrote:
>> Add early interrupt handlers activated by idt_setup_early_handler() to
>> the handlers supported by Xen pv guests. This will allow for early
>> WARN() calls not crashing the guest.

Nice!  It would be great to get this into 4.15.

>>
>> Suggested-by: Andy Lutomirski <luto@...nel.org>
>> Signed-off-by: Juergen Gross <jgross@...e.com>
>> ---
>>  arch/x86/include/asm/segment.h | 12 ++++++++++++
>>  arch/x86/mm/extable.c          |  4 +++-
>>  arch/x86/xen/enlighten_pv.c    | 37 ++++++++++++++++++++++++-------------
>>  arch/x86/xen/xen-asm_64.S      | 14 ++++++++++++++
>>  4 files changed, 53 insertions(+), 14 deletions(-)
>>
>> diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
>> index b20f9d623f9c..8f09012b92e7 100644
>> --- a/arch/x86/include/asm/segment.h
>> +++ b/arch/x86/include/asm/segment.h
>> @@ -236,11 +236,23 @@
>>   */
>>  #define EARLY_IDT_HANDLER_SIZE 9
>>
>> +/*
>> + * xen_early_idt_handler_array is for Xen pv guests: for each entry in
>> + * early_idt_handler_array it contains a prequel in the form of
>> + * pop %rcx; pop %r11; jmp early_idt_handler_array[i]; summing up to
>> + * max 8 bytes.
>> + */
>> +#define XEN_EARLY_IDT_HANDLER_SIZE 8
>> +
>>  #ifndef __ASSEMBLY__
>>
>>  extern const char early_idt_handler_array[NUM_EXCEPTION_VECTORS][EARLY_IDT_HANDLER_SIZE];
>>  extern void early_ignore_irq(void);
>>
>> +#if defined(CONFIG_X86_64) && defined(CONFIG_XEN_PV)
>> +extern const char xen_early_idt_handler_array[NUM_EXCEPTION_VECTORS][XEN_EARLY_IDT_HANDLER_SIZE];
>> +#endif
>> +
>>  /*
>>   * Load a segment. Fall back on loading the zero segment if something goes
>>   * wrong.  This variant assumes that loading zero fully clears the segment.
>> diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
>> index 3321b446b66c..88754bfd425f 100644
>> --- a/arch/x86/mm/extable.c
>> +++ b/arch/x86/mm/extable.c
>> @@ -1,6 +1,7 @@
>>  #include <linux/extable.h>
>>  #include <linux/uaccess.h>
>>  #include <linux/sched/debug.h>
>> +#include <xen/xen.h>
>>
>>  #include <asm/fpu/internal.h>
>>  #include <asm/traps.h>
>> @@ -212,8 +213,9 @@ void __init early_fixup_exception(struct pt_regs *regs, int trapnr)
>>        * Old CPUs leave the high bits of CS on the stack
>>        * undefined.  I'm not sure which CPUs do this, but at least
>>        * the 486 DX works this way.
>> +      * Xen pv domains are not using the default __KERNEL_CS.
>>        */
>> -     if (regs->cs != __KERNEL_CS)
>> +     if (!xen_pv_domain() && regs->cs != __KERNEL_CS)
>>               goto fail;
>>
>>       /*
>> diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
>> index 5b2b3f3f6531..f2414c6c5e7c 100644
>> --- a/arch/x86/xen/enlighten_pv.c
>> +++ b/arch/x86/xen/enlighten_pv.c
>> @@ -622,7 +622,7 @@ static struct trap_array_entry trap_array[] = {
>>       { simd_coprocessor_error,      xen_simd_coprocessor_error,      false },
>>  };
>>
>> -static bool get_trap_addr(void **addr, unsigned int ist)
>> +static bool __ref get_trap_addr(void **addr, unsigned int ist)
>>  {
>>       unsigned int nr;
>>       bool ist_okay = false;
>> @@ -644,6 +644,14 @@ static bool get_trap_addr(void **addr, unsigned int ist)
>>               }
>>       }
>>
>> +     if (nr == ARRAY_SIZE(trap_array) &&
>> +         *addr >= (void *)early_idt_handler_array[0] &&
>> +         *addr < (void *)early_idt_handler_array[NUM_EXCEPTION_VECTORS]) {
>> +             nr = (*addr - (void *)early_idt_handler_array[0]) /
>> +                  EARLY_IDT_HANDLER_SIZE;
>> +             *addr = (void *)xen_early_idt_handler_array[nr];
>> +     }
>> +
>>       if (WARN_ON(ist != 0 && !ist_okay))
>>               return false;
>>
>> @@ -1262,6 +1270,21 @@ asmlinkage __visible void __init xen_start_kernel(void)
>>       xen_setup_gdt(0);
>>
>>       xen_init_irq_ops();
>> +
>> +     /* Let's presume PV guests always boot on vCPU with id 0. */
>> +     per_cpu(xen_vcpu_id, 0) = 0;
>> +
>> +     /*
>> +      * Setup xen_vcpu early because idt_setup_early_handler needs it for
>> +      * local_irq_disable(), irqs_disabled().
>> +      *
>> +      * Don't do the full vcpu_info placement stuff until we have
>> +      * the cpu_possible_mask and a non-dummy shared_info.
>> +      */
>> +     xen_vcpu_info_reset(0);
>> +
>> +     idt_setup_early_handler();
>> +
>>       xen_init_capabilities();
>>
>>  #ifdef CONFIG_X86_LOCAL_APIC
>> @@ -1295,18 +1318,6 @@ asmlinkage __visible void __init xen_start_kernel(void)
>>        */
>>       acpi_numa = -1;
>>  #endif
>> -     /* Let's presume PV guests always boot on vCPU with id 0. */
>> -     per_cpu(xen_vcpu_id, 0) = 0;
>> -
>> -     /*
>> -      * Setup xen_vcpu early because start_kernel needs it for
>> -      * local_irq_disable(), irqs_disabled().
>> -      *
>> -      * Don't do the full vcpu_info placement stuff until we have
>> -      * the cpu_possible_mask and a non-dummy shared_info.
>> -      */
>> -     xen_vcpu_info_reset(0);
>> -
>>       WARN_ON(xen_cpuhp_setup(xen_cpu_up_prepare_pv, xen_cpu_dead_pv));
>>
>>       local_irq_disable();
>> diff --git a/arch/x86/xen/xen-asm_64.S b/arch/x86/xen/xen-asm_64.S
>> index 8a10c9a9e2b5..417b339e5c8e 100644
>> --- a/arch/x86/xen/xen-asm_64.S
>> +++ b/arch/x86/xen/xen-asm_64.S
>> @@ -15,6 +15,7 @@
>>
>>  #include <xen/interface/xen.h>
>>
>> +#include <linux/init.h>
>>  #include <linux/linkage.h>
>>
>>  .macro xen_pv_trap name
>> @@ -54,6 +55,19 @@ xen_pv_trap entry_INT80_compat
>>  #endif
>>  xen_pv_trap hypervisor_callback
>>
>> +     __INIT
>> +ENTRY(xen_early_idt_handler_array)
>> +     i = 0
>> +     .rept NUM_EXCEPTION_VECTORS
>> +     pop %rcx
>> +     pop %r11
>> +     jmp early_idt_handler_array + i*EARLY_IDT_HANDLER_SIZE
>> +     i = i + 1
>> +     .fill xen_early_idt_handler_array + i*XEN_EARLY_IDT_HANDLER_SIZE - ., 1, 0xcc
>> +     .endr
>> +END(xen_early_idt_handler_array)
>> +     __FINIT
>> +
>>  hypercall_iret = hypercall_page + __HYPERVISOR_iret * 32
>>  /*
>>   * Xen64 iret frame:
>>
>