Re: [RFC][PATCH 09/24] x86/entry: Add C version of paranoid_entry/exit

[kernel test robot <lkp@intel.com>]

[-- Attachment #1: Type: text/plain, Size: 8873 bytes --]

Hi Alexandre,

[FYI, it's a private test report for your RFC patch.]
[auto build test ERROR on tip/x86/mm]
[also build test ERROR on v5.10-rc3 next-20201110]
[cannot apply to tip/x86/core tip/x86/asm]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Alexandre-Chartre/x86-pti-Defer-CR3-switch-to-C-code/20201109-225007
base:   https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git 1fcd009102ee02e217f2e7635ab65517d785da8e
config: x86_64-rhel-8.3 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-15) 9.3.0
reproduce (this is a W=1 build):
        # https://github.com/0day-ci/linux/commit/69f95ba9761ce51c88440c045c451f03d46e57d2
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Alexandre-Chartre/x86-pti-Defer-CR3-switch-to-C-code/20201109-225007
        git checkout 69f95ba9761ce51c88440c045c451f03d46e57d2
        # save the attached .config to linux build tree
        make W=1 ARCH=x86_64 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All errors (new ones prefixed by >>):

   arch/x86/entry/common.c:38:24: warning: no previous prototype for 'return_from_fork' [-Wmissing-prototypes]
      38 | __visible noinstr void return_from_fork(struct pt_regs *regs,
         |                        ^~~~~~~~~~~~~~~~
   arch/x86/entry/common.c:223:24: warning: no previous prototype for 'do_SYSENTER_32' [-Wmissing-prototypes]
     223 | __visible noinstr long do_SYSENTER_32(struct pt_regs *regs)
         |                        ^~~~~~~~~~~~~~
   arch/x86/entry/common.c: In function 'kernel_paranoid_entry':
>> arch/x86/entry/common.c:486:4: error: implicit declaration of function 'swapgs'; did you mean 'swap'? [-Werror=implicit-function-declaration]
     486 |    swapgs();
         |    ^~~~~~
         |    swap
   arch/x86/entry/common.c: In function 'kernel_paranoid_exit':
>> arch/x86/entry/common.c:544:3: error: implicit declaration of function 'swapgs_unsafe_stack' [-Werror=implicit-function-declaration]
     544 |   swapgs_unsafe_stack();
         |   ^~~~~~~~~~~~~~~~~~~
   cc1: some warnings being treated as errors

vim +486 arch/x86/entry/common.c

   390	
   391	/*
   392	 * "Paranoid" entry path from exception stack. Ensure that the CR3 and
   393	 * GS registers are correctly set for the kernel. Return GSBASE related
   394	 * information in kernel_entry_state depending on the availability of
   395	 * the FSGSBASE instructions:
   396	 *
   397	 * FSGSBASE	kernel_entry_state
   398	 *     N        swapgs=true -> SWAPGS on exit
   399	 *              swapgs=false -> no SWAPGS on exit
   400	 *
   401	 *     Y        gsbase=GSBASE value at entry, must be restored in
   402	 *              kernel_paranoid_exit()
   403	 *
   404	 * Note that per-cpu variables are accessed using the GS register,
   405	 * so paranoid entry code cannot access per-cpu variables before
   406	 * kernel_paranoid_entry() has been called.
   407	 */
   408	noinstr void kernel_paranoid_entry(struct kernel_entry_state *state)
   409	{
   410		unsigned long gsbase;
   411		unsigned int cpu;
   412	
   413		/*
   414		 * Save CR3 in the kernel entry state.  This value will be
   415		 * restored, verbatim, at exit.  Needed if the paranoid entry
   416		 * interrupted another entry that already switched to the user
   417		 * CR3 value but has not yet returned to userspace.
   418		 *
   419		 * This is also why CS (stashed in the "iret frame" by the
   420		 * hardware at entry) can not be used: this may be a return
   421		 * to kernel code, but with a user CR3 value.
   422		 *
   423		 * Switching CR3 does not depend on kernel GSBASE so it can
   424		 * be done before switching to the kernel GSBASE. This is
   425		 * required for FSGSBASE because the kernel GSBASE has to
   426		 * be retrieved from a kernel internal table.
   427		 */
   428		state->cr3 = save_and_switch_to_kernel_cr3();
   429	
   430		/*
   431		 * Handling GSBASE depends on the availability of FSGSBASE.
   432		 *
   433		 * Without FSGSBASE the kernel enforces that negative GSBASE
   434		 * values indicate kernel GSBASE. With FSGSBASE no assumptions
   435		 * can be made about the GSBASE value when entering from user
   436		 * space.
   437		 */
   438		if (static_cpu_has(X86_FEATURE_FSGSBASE)) {
   439			/*
   440			 * Read the current GSBASE and store it in the kernel
   441			 * entry state unconditionally, retrieve and set the
   442			 * current CPUs kernel GSBASE. The stored value has to
   443			 * be restored at exit unconditionally.
   444			 *
   445			 * The unconditional write to GS base below ensures that
   446			 * no subsequent loads based on a mispredicted GS base
   447			 * can happen, therefore no LFENCE is needed here.
   448			 */
   449			state->gsbase = rdgsbase();
   450	
   451			/*
   452			 * Fetch the per-CPU GSBASE value for this processor. We
   453			 * normally use %gs for accessing per-CPU data, but we
   454			 * are setting up %gs here and obviously can not use %gs
   455			 * itself to access per-CPU data.
   456			 */
   457			if (IS_ENABLED(CONFIG_SMP)) {
   458				/*
   459				 * Load CPU from the GDT. Do not use RDPID,
   460				 * because KVM loads guest's TSC_AUX on vm-entry
   461				 * and may not restore the host's value until
   462				 * the CPU returns to userspace. Thus the kernel
   463				 * would consume a guest's TSC_AUX if an NMI
   464				 * arrives while running KVM's run loop.
   465				 */
   466				asm_inline volatile ("lsl %[seg],%[p]"
   467						     : [p] "=r" (cpu)
   468						     : [seg] "r" (__CPUNODE_SEG));
   469	
   470				cpu &= VDSO_CPUNODE_MASK;
   471				gsbase = __per_cpu_offset[cpu];
   472			} else {
   473				gsbase = *pcpu_unit_offsets;
   474			}
   475	
   476			wrgsbase(gsbase);
   477	
   478		} else {
   479			/*
   480			 * The kernel-enforced convention is a negative GSBASE
   481			 * indicates a kernel value. No SWAPGS needed on entry
   482			 * and exit.
   483			 */
   484			rdmsrl(MSR_GS_BASE, gsbase);
   485			if (((long)gsbase) >= 0) {
 > 486				swapgs();
   487				/*
   488				 * Do an lfence to prevent GS speculation.
   489				 */
   490				alternative("", "lfence",
   491					    X86_FEATURE_FENCE_SWAPGS_KERNEL);
   492				state->swapgs = true;
   493			} else {
   494				state->swapgs = false;
   495			}
   496		}
   497	}
   498	
   499	/*
   500	 * "Paranoid" exit path from exception stack. Restore the CR3 and
   501	 * GS registers are as they were on entry. This is invoked only
   502	 * on return from IST interrupts that came from kernel space.
   503	 *
   504	 * We may be returning to very strange contexts (e.g. very early
   505	 * in syscall entry), so checking for preemption here would
   506	 * be complicated.  Fortunately, there's no good reason to try
   507	 * to handle preemption here.
   508	 *
   509	 * The kernel_entry_state contains the GSBASE related information
   510	 * depending on the availability of the FSGSBASE instructions:
   511	 *
   512	 * FSGSBASE	kernel_entry_state
   513	 *     N        swapgs=true  -> SWAPGS on exit
   514	 *              swapgs=false -> no SWAPGS on exit
   515	 *
   516	 *     Y        gsbase=GSBASE value at entry, must be restored
   517	 *              unconditionally
   518	 *
   519	 * Note that per-cpu variables are accessed using the GS register,
   520	 * so paranoid entry code cannot access per-cpu variables after
   521	 * kernel_paranoid_exit() has been called.
   522	 */
   523	noinstr void kernel_paranoid_exit(struct kernel_entry_state *state)
   524	{
   525		/*
   526		 * The order of operations is important. RESTORE_CR3 requires
   527		 * kernel GSBASE.
   528		 *
   529		 * NB to anyone to try to optimize this code: this code does
   530		 * not execute at all for exceptions from user mode. Those
   531		 * exceptions go through error_exit instead.
   532		 */
   533		restore_cr3(state->cr3);
   534	
   535		/* With FSGSBASE enabled, unconditionally restore GSBASE */
   536		if (static_cpu_has(X86_FEATURE_FSGSBASE)) {
   537			wrgsbase(state->gsbase);
   538			return;
   539		}
   540	
   541		/* On non-FSGSBASE systems, conditionally do SWAPGS */
   542		if (state->swapgs) {
   543			/* We are returning to a context with user GSBASE */
 > 544			swapgs_unsafe_stack();

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 41014 bytes --]