| Message ID | d266338a0eae1f673802e41d7230c4c92c3532b3.1739866028.git.maciej.wieczor-retman@intel.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [v2,01/14] kasan: sw_tags: Use arithmetic shift for shadow computation | expand |
On Tue, Feb 18, 2025 at 9:20 AM Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com> wrote: > > Make CONFIG_KASAN_SW_TAGS available for x86 machines if they have > ADDRESS_MASKING enabled (LAM) as that works similarly to Top-Byte Ignore > (TBI) that allows the software tag-based mode on arm64 platform. > > Set scale macro based on KASAN mode: in software tag-based mode 32 bytes > of memory map to one shadow byte and 16 in generic mode. These should be 16 and 8. > > Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com> > --- > Changelog v2: > - Remove KASAN dense code. > > arch/x86/Kconfig | 6 ++++++ > arch/x86/boot/compressed/misc.h | 1 + > arch/x86/include/asm/kasan.h | 2 +- > arch/x86/kernel/setup.c | 2 ++ > 4 files changed, 10 insertions(+), 1 deletion(-) > > diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig > index f4ef64bf824a..dc48eb5b664f 100644 > --- a/arch/x86/Kconfig > +++ b/arch/x86/Kconfig > @@ -195,6 +195,7 @@ config X86 > select HAVE_ARCH_JUMP_LABEL_RELATIVE > select HAVE_ARCH_KASAN if X86_64 > select HAVE_ARCH_KASAN_VMALLOC if X86_64 > + select HAVE_ARCH_KASAN_SW_TAGS if ADDRESS_MASKING > select HAVE_ARCH_KFENCE > select HAVE_ARCH_KMSAN if X86_64 > select HAVE_ARCH_KGDB > @@ -402,6 +403,11 @@ config KASAN_SHADOW_OFFSET > hex > default 0xdffffc0000000000 if KASAN_GENERIC > > +config KASAN_SHADOW_SCALE_SHIFT > + int > + default 4 if KASAN_SW_TAGS > + default 3 What's the purpose of this config option? I think we can just change the value of the KASAN_SHADOW_SCALE_SHIFT define when KASAN_SW_TAGS is enabled. > + > config HAVE_INTEL_TXT > def_bool y > depends on INTEL_IOMMU && ACPI > diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h > index dd8d1a85f671..f6a87e9ad200 100644 > --- a/arch/x86/boot/compressed/misc.h > +++ b/arch/x86/boot/compressed/misc.h > @@ -13,6 +13,7 @@ > #undef CONFIG_PARAVIRT_SPINLOCKS > #undef CONFIG_KASAN > #undef CONFIG_KASAN_GENERIC > +#undef CONFIG_KASAN_SW_TAGS > > #define __NO_FORTIFY > > diff --git a/arch/x86/include/asm/kasan.h b/arch/x86/include/asm/kasan.h > index 4bfd3641af84..cfc31e4a2f70 100644 > --- a/arch/x86/include/asm/kasan.h > +++ b/arch/x86/include/asm/kasan.h > @@ -6,7 +6,7 @@ > #include <linux/kasan-tags.h> > #include <linux/types.h> > > -#define KASAN_SHADOW_SCALE_SHIFT 3 > +#define KASAN_SHADOW_SCALE_SHIFT CONFIG_KASAN_SHADOW_SCALE_SHIFT > > /* > * Compiler uses shadow offset assuming that addresses start > diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c > index cebee310e200..768990c573ea 100644 > --- a/arch/x86/kernel/setup.c > +++ b/arch/x86/kernel/setup.c > @@ -1124,6 +1124,8 @@ void __init setup_arch(char **cmdline_p) > > kasan_init(); > > + kasan_init_sw_tags(); > + > /* > * Sync back kernel address range. > * > -- > 2.47.1 >
Hello,
by this commit, we noticed below config diff with its parent
(
* 3742b7b32f28b x86: Make software tag-based kasan available
* 0ef701bc87cdd x86: runtime_const used for KASAN_SHADOW_END <-- parent
)
@@ -293,7 +293,7 @@ CONFIG_ARCH_HAS_CPU_RELAX=y
CONFIG_ARCH_HIBERNATION_POSSIBLE=y
CONFIG_ARCH_SUSPEND_POSSIBLE=y
CONFIG_AUDIT_ARCH=y
-CONFIG_KASAN_SHADOW_OFFSET=0xdffffc0000000000
+CONFIG_KASAN_SHADOW_SCALE_SHIFT=4
CONFIG_ARCH_SUPPORTS_UPROBES=y
CONFIG_FIX_EARLYCON_MEM=y
CONFIG_PGTABLE_LEVELS=5
@@ -5387,13 +5387,15 @@ CONFIG_DEBUG_KMAP_LOCAL=y
CONFIG_ARCH_SUPPORTS_KMAP_LOCAL_FORCE_MAP=y
CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP=y
CONFIG_HAVE_ARCH_KASAN=y
+CONFIG_HAVE_ARCH_KASAN_SW_TAGS=y
CONFIG_HAVE_ARCH_KASAN_VMALLOC=y
CONFIG_CC_HAS_KASAN_GENERIC=y
CONFIG_CC_HAS_KASAN_SW_TAGS=y
CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y
CONFIG_KASAN=y
CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX=y
-CONFIG_KASAN_GENERIC=y
+# CONFIG_KASAN_GENERIC is not set
+CONFIG_KASAN_SW_TAGS=y
# CONFIG_KASAN_OUTLINE is not set
CONFIG_KASAN_INLINE=y
# CONFIG_KASAN_STACK is not set
below full report FYI.
kernel test robot noticed "Oops:general_protection_fault,probably_for_non-canonical_address#:#[##]PREEMPT_KASAN" on:
commit: 3742b7b32f28b574e97da7c4f50593877b99e95c ("[PATCH v2 14/14] x86: Make software tag-based kasan available")
url: https://github.com/intel-lab-lkp/linux/commits/Maciej-Wieczor-Retman/kasan-sw_tags-Use-arithmetic-shift-for-shadow-computation/20250218-162135
base: https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git 882b86fd4e0d49bf91148dbadcdbece19ded40e6
patch link: https://lore.kernel.org/all/d266338a0eae1f673802e41d7230c4c92c3532b3.1739866028.git.maciej.wieczor-retman@intel.com/
patch subject: [PATCH v2 14/14] x86: Make software tag-based kasan available
in testcase: boot
config: x86_64-randconfig-161-20250219
compiler: clang-19
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
(please refer to attached dmesg/kmsg for entire log/backtrace)
+--------------------------------------------------------------------------------------+------------+------------+
| | 0ef701bc87 | 3742b7b32f |
+--------------------------------------------------------------------------------------+------------+------------+
| boot_successes | 21 | 0 |
| boot_failures | 0 | 18 |
| Oops:general_protection_fault,probably_for_non-canonical_address#:#[##]PREEMPT_KASAN | 0 | 17 |
| RIP:stack_depot_save_flags | 0 | 17 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 17 |
| KASAN:maybe_wild-memory-access_in_range[#-#] | 0 | 2 |
+--------------------------------------------------------------------------------------+------------+------------+
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202502201048.208452a-lkp@intel.com
[ 11.050670][ T0] Oops: general protection fault, probably for non-canonical address 0xfbff888100044018: 0000 [#1] PREEMPT KASAN
[ 11.050681][ T0] KASAN: maybe wild-memory-access in range [0xbff8c81000440180-0xbff8c8100044018f]
[ 11.050690][ T0] CPU: 0 UID: 0 PID: 0 Comm: swapper Tainted: G T 6.14.0-rc2-00036-g3742b7b32f28 #2
[ 11.050700][ T0] Tainted: [T]=RANDSTRUCT
[ 11.050704][ T0] RIP: 0010:stack_depot_save_flags (kbuild/src/smatch/lib/stackdepot.c:335)
[ 11.050720][ T0] Code: 85 48 85 c0 0f 84 cf 01 00 00 48 8b 0d 35 b0 35 02 4c 8d 24 08 41 81 e7 ff ff 01 00 89 ca c1 e2 0d 81 e2 00 00 fe 07 44 09 fa <89> 54 08 18 4c 89 24 08 4c 89 64 08 08 48 03 4d c0 48 89 0d 04 b0
All code
========
0: 85 48 85 test %ecx,-0x7b(%rax)
3: c0 0f 84 rorb $0x84,(%rdi)
6: cf iret
7: 01 00 add %eax,(%rax)
9: 00 48 8b add %cl,-0x75(%rax)
c: 0d 35 b0 35 02 or $0x235b035,%eax
11: 4c 8d 24 08 lea (%rax,%rcx,1),%r12
15: 41 81 e7 ff ff 01 00 and $0x1ffff,%r15d
1c: 89 ca mov %ecx,%edx
1e: c1 e2 0d shl $0xd,%edx
21: 81 e2 00 00 fe 07 and $0x7fe0000,%edx
27: 44 09 fa or %r15d,%edx
2a:* 89 54 08 18 mov %edx,0x18(%rax,%rcx,1) <-- trapping instruction
2e: 4c 89 24 08 mov %r12,(%rax,%rcx,1)
32: 4c 89 64 08 08 mov %r12,0x8(%rax,%rcx,1)
37: 48 03 4d c0 add -0x40(%rbp),%rcx
3b: 48 rex.W
3c: 89 .byte 0x89
3d: 0d .byte 0xd
3e: 04 b0 add $0xb0,%al
Code starting with the faulting instruction
===========================================
0: 89 54 08 18 mov %edx,0x18(%rax,%rcx,1)
4: 4c 89 24 08 mov %r12,(%rax,%rcx,1)
8: 4c 89 64 08 08 mov %r12,0x8(%rax,%rcx,1)
d: 48 03 4d c0 add -0x40(%rbp),%rcx
11: 48 rex.W
12: 89 .byte 0x89
13: 0d .byte 0xd
14: 04 b0 add $0xb0,%al
[ 11.050728][ T0] RSP: 0000:ffffffff84207b08 EFLAGS: 00010002
[ 11.050735][ T0] RAX: fbff888100044000 RBX: 0000000000000000 RCX: 0000000000000000
[ 11.050765][ T0] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000
[ 11.050770][ T0] RBP: ffffffff84207b60 R08: ffff8883ee081360 R09: fbff888100044000
[ 11.050774][ T0] R10: 0000000000000000 R11: 0000000000000000 R12: fbff888100044000
[ 11.050779][ T0] R13: 00000000f44e9436 R14: ffffffff84207b70 R15: 0000000000000001
[ 11.050784][ T0] FS: 0000000000000000(0000) GS:ffffffff842fc000(0000) knlGS:0000000000000000
[ 11.050791][ T0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 11.050796][ T0] CR2: ffff88843ffff000 CR3: 00000000042cd000 CR4: 00000000000000b0
[ 11.050804][ T0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 11.050808][ T0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 11.050813][ T0] Call Trace:
[ 11.050816][ T0] <TASK>
[ 11.050821][ T0] ? __die_body (kbuild/src/smatch/arch/x86/kernel/dumpstack.c:421)
[ 11.050831][ T0] ? die_addr (kbuild/src/smatch/arch/x86/kernel/dumpstack.c:?)
[ 11.050838][ T0] ? exc_general_protection (kbuild/src/smatch/arch/x86/kernel/traps.c:789)
[ 11.050862][ T0] ? asm_exc_general_protection (kbuild/src/smatch/arch/x86/include/asm/idtentry.h:617)
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20250220/202502201048.208452a-lkp@intel.com
On Thu, Feb 20, 2025 at 12:31 AM Andrey Konovalov <andreyknvl@gmail.com> wrote: > > On Tue, Feb 18, 2025 at 9:20 AM Maciej Wieczor-Retman > <maciej.wieczor-retman@intel.com> wrote: > > > > Make CONFIG_KASAN_SW_TAGS available for x86 machines if they have > > ADDRESS_MASKING enabled (LAM) as that works similarly to Top-Byte Ignore > > (TBI) that allows the software tag-based mode on arm64 platform. > > > > Set scale macro based on KASAN mode: in software tag-based mode 32 bytes > > of memory map to one shadow byte and 16 in generic mode. > > These should be 16 and 8. > > > > > Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com> > > --- > > Changelog v2: > > - Remove KASAN dense code. > > > > arch/x86/Kconfig | 6 ++++++ > > arch/x86/boot/compressed/misc.h | 1 + > > arch/x86/include/asm/kasan.h | 2 +- > > arch/x86/kernel/setup.c | 2 ++ > > 4 files changed, 10 insertions(+), 1 deletion(-) > > > > diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig > > index f4ef64bf824a..dc48eb5b664f 100644 > > --- a/arch/x86/Kconfig > > +++ b/arch/x86/Kconfig > > @@ -195,6 +195,7 @@ config X86 > > select HAVE_ARCH_JUMP_LABEL_RELATIVE > > select HAVE_ARCH_KASAN if X86_64 > > select HAVE_ARCH_KASAN_VMALLOC if X86_64 > > + select HAVE_ARCH_KASAN_SW_TAGS if ADDRESS_MASKING > > select HAVE_ARCH_KFENCE > > select HAVE_ARCH_KMSAN if X86_64 > > select HAVE_ARCH_KGDB > > @@ -402,6 +403,11 @@ config KASAN_SHADOW_OFFSET > > hex > > default 0xdffffc0000000000 if KASAN_GENERIC > > > > +config KASAN_SHADOW_SCALE_SHIFT > > + int > > + default 4 if KASAN_SW_TAGS > > + default 3 > > What's the purpose of this config option? I think we can just change > the value of the KASAN_SHADOW_SCALE_SHIFT define when KASAN_SW_TAGS is > enabled. > > > > + > > config HAVE_INTEL_TXT > > def_bool y > > depends on INTEL_IOMMU && ACPI > > diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h > > index dd8d1a85f671..f6a87e9ad200 100644 > > --- a/arch/x86/boot/compressed/misc.h > > +++ b/arch/x86/boot/compressed/misc.h > > @@ -13,6 +13,7 @@ > > #undef CONFIG_PARAVIRT_SPINLOCKS > > #undef CONFIG_KASAN > > #undef CONFIG_KASAN_GENERIC > > +#undef CONFIG_KASAN_SW_TAGS > > > > #define __NO_FORTIFY > > > > diff --git a/arch/x86/include/asm/kasan.h b/arch/x86/include/asm/kasan.h > > index 4bfd3641af84..cfc31e4a2f70 100644 > > --- a/arch/x86/include/asm/kasan.h > > +++ b/arch/x86/include/asm/kasan.h > > @@ -6,7 +6,7 @@ > > #include <linux/kasan-tags.h> > > #include <linux/types.h> > > > > -#define KASAN_SHADOW_SCALE_SHIFT 3 > > +#define KASAN_SHADOW_SCALE_SHIFT CONFIG_KASAN_SHADOW_SCALE_SHIFT > > > > /* > > * Compiler uses shadow offset assuming that addresses start > > diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c > > index cebee310e200..768990c573ea 100644 > > --- a/arch/x86/kernel/setup.c > > +++ b/arch/x86/kernel/setup.c > > @@ -1124,6 +1124,8 @@ void __init setup_arch(char **cmdline_p) > > > > kasan_init(); > > > > + kasan_init_sw_tags(); > > + > > /* > > * Sync back kernel address range. > > * > > -- > > 2.47.1 > > Also please update the descriptions of all related options in lib/Kconfig.kasan.
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index f4ef64bf824a..dc48eb5b664f 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -195,6 +195,7 @@ config X86 select HAVE_ARCH_JUMP_LABEL_RELATIVE select HAVE_ARCH_KASAN if X86_64 select HAVE_ARCH_KASAN_VMALLOC if X86_64 + select HAVE_ARCH_KASAN_SW_TAGS if ADDRESS_MASKING select HAVE_ARCH_KFENCE select HAVE_ARCH_KMSAN if X86_64 select HAVE_ARCH_KGDB @@ -402,6 +403,11 @@ config KASAN_SHADOW_OFFSET hex default 0xdffffc0000000000 if KASAN_GENERIC +config KASAN_SHADOW_SCALE_SHIFT + int + default 4 if KASAN_SW_TAGS + default 3 + config HAVE_INTEL_TXT def_bool y depends on INTEL_IOMMU && ACPI diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h index dd8d1a85f671..f6a87e9ad200 100644 --- a/arch/x86/boot/compressed/misc.h +++ b/arch/x86/boot/compressed/misc.h @@ -13,6 +13,7 @@ #undef CONFIG_PARAVIRT_SPINLOCKS #undef CONFIG_KASAN #undef CONFIG_KASAN_GENERIC +#undef CONFIG_KASAN_SW_TAGS #define __NO_FORTIFY diff --git a/arch/x86/include/asm/kasan.h b/arch/x86/include/asm/kasan.h index 4bfd3641af84..cfc31e4a2f70 100644 --- a/arch/x86/include/asm/kasan.h +++ b/arch/x86/include/asm/kasan.h @@ -6,7 +6,7 @@ #include <linux/kasan-tags.h> #include <linux/types.h> -#define KASAN_SHADOW_SCALE_SHIFT 3 +#define KASAN_SHADOW_SCALE_SHIFT CONFIG_KASAN_SHADOW_SCALE_SHIFT /* * Compiler uses shadow offset assuming that addresses start diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c index cebee310e200..768990c573ea 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c @@ -1124,6 +1124,8 @@ void __init setup_arch(char **cmdline_p) kasan_init(); + kasan_init_sw_tags(); + /* * Sync back kernel address range. *
Make CONFIG_KASAN_SW_TAGS available for x86 machines if they have ADDRESS_MASKING enabled (LAM) as that works similarly to Top-Byte Ignore (TBI) that allows the software tag-based mode on arm64 platform. Set scale macro based on KASAN mode: in software tag-based mode 32 bytes of memory map to one shadow byte and 16 in generic mode. Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com> --- Changelog v2: - Remove KASAN dense code. arch/x86/Kconfig | 6 ++++++ arch/x86/boot/compressed/misc.h | 1 + arch/x86/include/asm/kasan.h | 2 +- arch/x86/kernel/setup.c | 2 ++ 4 files changed, 10 insertions(+), 1 deletion(-)