From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.1 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4BBC5C3F68F for ; Thu, 19 Dec 2019 10:05:06 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id B9C3F2465E for ; Thu, 19 Dec 2019 10:05:05 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=c-s.fr header.i=@c-s.fr header.b="VRJrSe1w" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B9C3F2465E Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=c-s.fr Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 273768E0161; Thu, 19 Dec 2019 05:05:05 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 2234F8E00F5; Thu, 19 Dec 2019 05:05:05 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 0EB4D8E0161; Thu, 19 Dec 2019 05:05:05 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0147.hostedemail.com [216.40.44.147]) by kanga.kvack.org (Postfix) with ESMTP id ECF418E00F5 for ; Thu, 19 Dec 2019 05:05:04 -0500 (EST) Received: from smtpin16.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with SMTP id 5F922180AD815 for ; Thu, 19 Dec 2019 10:05:04 +0000 (UTC) X-FDA: 76281457728.16.metal56_837ebcd8b6c04 X-HE-Tag: metal56_837ebcd8b6c04 X-Filterd-Recvd-Size: 10665 Received: from pegase1.c-s.fr (pegase1.c-s.fr [93.17.236.30]) by imf33.hostedemail.com (Postfix) with ESMTP for ; Thu, 19 Dec 2019 10:05:03 +0000 (UTC) Received: from localhost (mailhub1-ext [192.168.12.233]) by localhost (Postfix) with ESMTP id 47dnYT0l6Gz9txdb; Thu, 19 Dec 2019 11:05:01 +0100 (CET) Authentication-Results: localhost; dkim=pass reason="1024-bit key; insecure key" header.d=c-s.fr header.i=@c-s.fr header.b=VRJrSe1w; dkim-adsp=pass; dkim-atps=neutral X-Virus-Scanned: Debian amavisd-new at c-s.fr Received: from pegase1.c-s.fr ([192.168.12.234]) by localhost (pegase1.c-s.fr [192.168.12.234]) (amavisd-new, port 10024) with ESMTP id LbMxqmJHojDe; Thu, 19 Dec 2019 11:05:01 +0100 (CET) Received: from messagerie.si.c-s.fr (messagerie.si.c-s.fr [192.168.25.192]) by pegase1.c-s.fr (Postfix) with ESMTP id 47dnYS6cvbz9txdX; Thu, 19 Dec 2019 11:05:00 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=c-s.fr; s=mail; t=1576749900; bh=aBMNlZSdHN9hHSwCigq8pLHNrlooKzHKv50c74v52kk=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=VRJrSe1wTEDdrnfpKL4V8FzQANse50QRQHj/A/jRUZxfh2fB3y6eso+pnKifd+m+l uf3opQa8MWDH7Wn7673WNyoxa9+bnL12nuWY8s4XEiIT4FjlQM1POzeGzvKkxVKxcf uVFrR/6i4OX2iMqW8yG1YakcfJD5VGya7OYgDaxM= Received: from localhost (localhost [127.0.0.1]) by messagerie.si.c-s.fr (Postfix) with ESMTP id E72858B7AC; Thu, 19 Dec 2019 11:05:01 +0100 (CET) X-Virus-Scanned: amavisd-new at c-s.fr Received: from messagerie.si.c-s.fr ([127.0.0.1]) by localhost (messagerie.si.c-s.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id 3wWYzfMEiS00; Thu, 19 Dec 2019 11:05:01 +0100 (CET) Received: from [192.168.4.90] (unknown [192.168.4.90]) by messagerie.si.c-s.fr (Postfix) with ESMTP id 33E8C8B787; Thu, 19 Dec 2019 11:05:01 +0100 (CET) Subject: Re: [PATCH v4 4/4] powerpc: Book3S 64-bit "heavyweight" KASAN support To: Daniel Axtens , linux-kernel@vger.kernel.org, linux-mm@kvack.org, linuxppc-dev@lists.ozlabs.org, kasan-dev@googlegroups.com, aneesh.kumar@linux.ibm.com, bsingharora@gmail.com Cc: Michael Ellerman References: <20191219003630.31288-1-dja@axtens.net> <20191219003630.31288-5-dja@axtens.net> <87bls4tzjn.fsf@dja-thinkpad.axtens.net> From: Christophe Leroy Message-ID: <4f2fffb3-5fb6-b5ea-a951-a7910f2439b8@c-s.fr> Date: Thu, 19 Dec 2019 11:05:00 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.9.1 MIME-Version: 1.0 In-Reply-To: <87bls4tzjn.fsf@dja-thinkpad.axtens.net> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: fr Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Le 19/12/2019 =C3=A0 10:50, Daniel Axtens a =C3=A9crit=C2=A0: > Christophe Leroy writes: >=20 >> On 12/19/2019 12:36 AM, Daniel Axtens wrote: >>> KASAN support on Book3S is a bit tricky to get right: >>> >>> - It would be good to support inline instrumentation so as to be a= ble to >>> catch stack issues that cannot be caught with outline mode. >>> >>> - Inline instrumentation requires a fixed offset. >>> >>> - Book3S runs code in real mode after booting. Most notably a lot = of KVM >>> runs in real mode, and it would be good to be able to instrument= it. >>> >>> - Because code runs in real mode after boot, the offset has to poi= nt to >>> valid memory both in and out of real mode. >>> >>> [ppc64 mm note: The kernel installs a linear mapping at effecti= ve >>> address c000... onward. This is a one-to-one mapping with physi= cal >>> memory from 0000... onward. Because of how memory accesses work= on >>> powerpc 64-bit Book3S, a kernel pointer in the linear map acces= ses the >>> same memory both with translations on (accessing as an 'effecti= ve >>> address'), and with translations off (accessing as a 'real >>> address'). This works in both guests and the hypervisor. For mo= re >>> details, see s5.7 of Book III of version 3 of the ISA, in parti= cular >>> the Storage Control Overview, s5.7.3, and s5.7.5 - noting that = this >>> KASAN implementation currently only supports Radix.] >>> >>> One approach is just to give up on inline instrumentation. This way a= ll >>> checks can be delayed until after everything set is up correctly, and= the >>> address-to-shadow calculations can be overridden. However, the featur= es and >>> speed boost provided by inline instrumentation are worth trying to do >>> better. >>> >>> If _at compile time_ it is known how much contiguous physical memory = a >>> system has, the top 1/8th of the first block of physical memory can b= e set >>> aside for the shadow. This is a big hammer and comes with 3 big >>> consequences: >>> >>> - there's no nice way to handle physically discontiguous memory, s= o only >>> the first physical memory block can be used. >>> >>> - kernels will simply fail to boot on machines with less memory th= an >>> specified when compiling. >>> >>> - kernels running on machines with more memory than specified when >>> compiling will simply ignore the extra memory. >>> >>> Implement and document KASAN this way. The current implementation is = Radix >>> only. >>> >>> Despite the limitations, it can still find bugs, >>> e.g. http://patchwork.ozlabs.org/patch/1103775/ >>> >>> At the moment, this physical memory limit must be set _even for outli= ne >>> mode_. This may be changed in a later series - a different implementa= tion >>> could be added for outline mode that dynamically allocates shadow at = a >>> fixed offset. For example, see https://patchwork.ozlabs.org/patch/795= 211/ >>> >>> Suggested-by: Michael Ellerman >>> Cc: Balbir Singh # ppc64 out-of-line radix ve= rsion >>> Cc: Christophe Leroy # ppc32 version >>> Signed-off-by: Daniel Axtens >>> >>> --- >>> Changes since v3: >>> - Address further feedback from Christophe. >>> - Drop changes to stack walking, it looks like the issue I observe= d is >>> related to that particular stack, not stack-walking generally. >>> >>> Changes since v2: >>> >>> - Address feedback from Christophe around cleanups and docs. >>> - Address feedback from Balbir: at this point I don't have a good = solution >>> for the issues you identify around the limitations of the inline= implementation >>> but I think that it's worth trying to get the stack instrumentat= ion support. >>> I'm happy to have an alternative and more flexible outline mode = - I had >>> envisoned this would be called 'lightweight' mode as it imposes = fewer restrictions. >>> I've linked to your implementation. I think it's best to add it = in a follow-up series. >>> - Made the default PHYS_MEM_SIZE_FOR_KASAN value 1024MB. I think m= ost people have >>> guests with at least that much memory in the Radix 64s case so i= t's a much >>> saner default - it means that if you just turn on KASAN without = reading the >>> docs you're much more likely to have a bootable kernel, which yo= u will never >>> have if the value is set to zero! I'm happy to bikeshed the valu= e if we want. >>> >>> Changes since v1: >>> - Landed kasan vmalloc support upstream >>> - Lots of feedback from Christophe. >>> >>> Changes since the rfc: >>> >>> - Boots real and virtual hardware, kvm works. >>> >>> - disabled reporting when we're checking the stack for exception >>> frames. The behaviour isn't wrong, just incompatible with KASAN. >>> >>> - Documentation! >>> >>> - Dropped old module stuff in favour of KASAN_VMALLOC. >>> >>> The bugs with ftrace and kuap were due to kernel bloat pushing >>> prom_init calls to be done via the plt. Because we did not have >>> a relocatable kernel, and they are done very early, this caused >>> everything to explode. Compile with CONFIG_RELOCATABLE! >>> --- >>> Documentation/dev-tools/kasan.rst | 8 +- >>> Documentation/powerpc/kasan.txt | 112 +++++++++++++++= +++- >>> arch/powerpc/Kconfig | 2 + >>> arch/powerpc/Kconfig.debug | 21 ++++ >>> arch/powerpc/Makefile | 11 ++ >>> arch/powerpc/include/asm/book3s/64/hash.h | 4 + >>> arch/powerpc/include/asm/book3s/64/pgtable.h | 7 ++ >>> arch/powerpc/include/asm/book3s/64/radix.h | 5 + >>> arch/powerpc/include/asm/kasan.h | 21 +++- >>> arch/powerpc/kernel/prom.c | 61 +++++++++- >>> arch/powerpc/mm/kasan/Makefile | 1 + >>> arch/powerpc/mm/kasan/init_book3s_64.c | 70 ++++++++++++ >>> arch/powerpc/platforms/Kconfig.cputype | 1 + >>> 13 files changed, 316 insertions(+), 8 deletions(-) >>> create mode 100644 arch/powerpc/mm/kasan/init_book3s_64.c >>> >>> diff --git a/arch/powerpc/include/asm/kasan.h b/arch/powerpc/include/= asm/kasan.h >>> index 296e51c2f066..f18268cbdc33 100644 >>> --- a/arch/powerpc/include/asm/kasan.h >>> +++ b/arch/powerpc/include/asm/kasan.h >>> @@ -2,6 +2,9 @@ >>> #ifndef __ASM_KASAN_H >>> #define __ASM_KASAN_H >>> =20 >>> +#include >>> +#include >> >> What do you need asm/pgtable.h for ? >> >> Build failure due to circular inclusion of asm/pgtable.h: >=20 > I see there's a lot of ppc32 stuff, I clearly need to bite the bullet > and get a ppc32 toolchain so I can squash these without chewing up any > more of your time. I'll sort that out and send a new spin. >=20 I'm using a powerpc64 toolchain to build both ppc32 and ppc64 kernels=20 (from https://mirrors.edge.kernel.org/pub/tools/crosstool/ ) Another thing, did you test PTDUMP stuff with KASAN ? It looks like=20 KASAN address markers don't depend on PPC32, but are only initialised by=20 populate_markers() for PPC32. Regarding kasan.h, I think we should be able to end up with something=20 where the definition of KASAN_SHADOW_OFFSET should only depend on the=20 existence of CONFIG_KASAN_SHADOW_OFFSET, and where only=20 KASAN_SHADOW_SIZE should depend on the target (ie PPC32 or BOOK3S64) Everything else should be common. KASAN_END should be START+SIZE. It looks like what you have called KASAN_SHADOW_SIZE is not similar to=20 what is called KASAN_SHADOW_SIZE for PPC32, as yours only covers the=20 SHADOW_SIZE for linear mem while PPC32 one covers the full space. Christophe