--- /dev/null
+From 004e8dce9c5595697951f7cd0e9f66b35c92265e Mon Sep 17 00:00:00 2001
+From: Masami Hiramatsu <mhiramat@kernel.org>
+Date: Fri, 6 Sep 2019 22:14:20 +0900
+Subject: x86: kprobes: Prohibit probing on instruction which has emulate prefix
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+commit 004e8dce9c5595697951f7cd0e9f66b35c92265e upstream.
+
+Prohibit probing on instruction which has XEN_EMULATE_PREFIX
+or KVM's emulate prefix. Since that prefix is a marker for Xen
+and KVM, if we modify the marker by kprobe's int3, that doesn't
+work as expected.
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Juergen Gross <jgross@suse.com>
+Cc: x86@kernel.org
+Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Stefano Stabellini <sstabellini@kernel.org>
+Cc: Andrew Cooper <andrew.cooper3@citrix.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: xen-devel@lists.xenproject.org
+Cc: Randy Dunlap <rdunlap@infradead.org>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Link: https://lkml.kernel.org/r/156777566048.25081.6296162369492175325.stgit@devnote2
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index 43fc13c831af..4f13af7cbcdb 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -351,6 +351,10 @@ int __copy_instruction(u8 *dest, u8 *src, u8 *real, struct insn *insn)
+ kernel_insn_init(insn, dest, MAX_INSN_SIZE);
+ insn_get_length(insn);
+
++ /* We can not probe force emulate prefixed instruction */
++ if (insn_has_emulate_prefix(insn))
++ return 0;
++
+ /* Another subsystem puts a breakpoint, failed to recover */
+ if (insn->opcode.bytes[0] == BREAKPOINT_INSTRUCTION)
+ return 0;
--- /dev/null
+From 4d65adfcd1196818659d3bd9b42dccab291e1751 Mon Sep 17 00:00:00 2001
+From: Masami Hiramatsu <mhiramat@kernel.org>
+Date: Fri, 6 Sep 2019 22:14:10 +0900
+Subject: x86: xen: insn: Decode Xen and KVM emulate-prefix signature
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+commit 4d65adfcd1196818659d3bd9b42dccab291e1751 upstream.
+
+Decode Xen and KVM's emulate-prefix signature by x86 insn decoder.
+It is called "prefix" but actually not x86 instruction prefix, so
+this adds insn.emulate_prefix_size field instead of reusing
+insn.prefixes.
+
+If x86 decoder finds a special sequence of instructions of
+XEN_EMULATE_PREFIX and 'ud2a; .ascii "kvm"', it just counts the
+length, set insn.emulate_prefix_size and fold it with the next
+instruction. In other words, the signature and the next instruction
+is treated as a single instruction.
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Juergen Gross <jgross@suse.com>
+Cc: x86@kernel.org
+Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Stefano Stabellini <sstabellini@kernel.org>
+Cc: Andrew Cooper <andrew.cooper3@citrix.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: xen-devel@lists.xenproject.org
+Cc: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lkml.kernel.org/r/156777564986.25081.4964537658500952557.stgit@devnote2
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+diff --git a/arch/x86/include/asm/insn.h b/arch/x86/include/asm/insn.h
+index 154f27be8bfc..5c1ae3eff9d4 100644
+--- a/arch/x86/include/asm/insn.h
++++ b/arch/x86/include/asm/insn.h
+@@ -45,6 +45,7 @@ struct insn {
+ struct insn_field immediate2; /* for 64bit imm or seg16 */
+ };
+
++ int emulate_prefix_size;
+ insn_attr_t attr;
+ unsigned char opnd_bytes;
+ unsigned char addr_bytes;
+@@ -128,6 +129,11 @@ static inline int insn_is_evex(struct insn *insn)
+ return (insn->vex_prefix.nbytes == 4);
+ }
+
++static inline int insn_has_emulate_prefix(struct insn *insn)
++{
++ return !!insn->emulate_prefix_size;
++}
++
+ /* Ensure this instruction is decoded completely */
+ static inline int insn_complete(struct insn *insn)
+ {
+diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c
+index 0b5862ba6a75..404279563891 100644
+--- a/arch/x86/lib/insn.c
++++ b/arch/x86/lib/insn.c
+@@ -13,6 +13,8 @@
+ #include <asm/inat.h>
+ #include <asm/insn.h>
+
++#include <asm/emulate_prefix.h>
++
+ /* Verify next sizeof(t) bytes can be on the same instruction */
+ #define validate_next(t, insn, n) \
+ ((insn)->next_byte + sizeof(t) + n <= (insn)->end_kaddr)
+@@ -58,6 +60,36 @@ void insn_init(struct insn *insn, const void *kaddr, int buf_len, int x86_64)
+ insn->addr_bytes = 4;
+ }
+
++static const insn_byte_t xen_prefix[] = { __XEN_EMULATE_PREFIX };
++static const insn_byte_t kvm_prefix[] = { __KVM_EMULATE_PREFIX };
++
++static int __insn_get_emulate_prefix(struct insn *insn,
++ const insn_byte_t *prefix, size_t len)
++{
++ size_t i;
++
++ for (i = 0; i < len; i++) {
++ if (peek_nbyte_next(insn_byte_t, insn, i) != prefix[i])
++ goto err_out;
++ }
++
++ insn->emulate_prefix_size = len;
++ insn->next_byte += len;
++
++ return 1;
++
++err_out:
++ return 0;
++}
++
++static void insn_get_emulate_prefix(struct insn *insn)
++{
++ if (__insn_get_emulate_prefix(insn, xen_prefix, sizeof(xen_prefix)))
++ return;
++
++ __insn_get_emulate_prefix(insn, kvm_prefix, sizeof(kvm_prefix));
++}
++
+ /**
+ * insn_get_prefixes - scan x86 instruction prefix bytes
+ * @insn: &struct insn containing instruction
+@@ -76,6 +108,8 @@ void insn_get_prefixes(struct insn *insn)
+ if (prefixes->got)
+ return;
+
++ insn_get_emulate_prefix(insn);
++
+ nb = 0;
+ lb = 0;
+ b = peek_next(insn_byte_t, insn);
+diff --git a/tools/arch/x86/include/asm/emulate_prefix.h b/tools/arch/x86/include/asm/emulate_prefix.h
+new file mode 100644
+index 000000000000..70f5b98a5286
+--- /dev/null
++++ b/tools/arch/x86/include/asm/emulate_prefix.h
+@@ -0,0 +1,14 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ASM_X86_EMULATE_PREFIX_H
++#define _ASM_X86_EMULATE_PREFIX_H
++
++/*
++ * Virt escape sequences to trigger instruction emulation;
++ * ideally these would decode to 'whole' instruction and not destroy
++ * the instruction stream; sadly this is not true for the 'kvm' one :/
++ */
++
++#define __XEN_EMULATE_PREFIX 0x0f,0x0b,0x78,0x65,0x6e /* ud2 ; .ascii "xen" */
++#define __KVM_EMULATE_PREFIX 0x0f,0x0b,0x6b,0x76,0x6d /* ud2 ; .ascii "kvm" */
++
++#endif
+diff --git a/tools/arch/x86/include/asm/insn.h b/tools/arch/x86/include/asm/insn.h
+index 37a4c390750b..568854b14d0a 100644
+--- a/tools/arch/x86/include/asm/insn.h
++++ b/tools/arch/x86/include/asm/insn.h
+@@ -45,6 +45,7 @@ struct insn {
+ struct insn_field immediate2; /* for 64bit imm or seg16 */
+ };
+
++ int emulate_prefix_size;
+ insn_attr_t attr;
+ unsigned char opnd_bytes;
+ unsigned char addr_bytes;
+@@ -128,6 +129,11 @@ static inline int insn_is_evex(struct insn *insn)
+ return (insn->vex_prefix.nbytes == 4);
+ }
+
++static inline int insn_has_emulate_prefix(struct insn *insn)
++{
++ return !!insn->emulate_prefix_size;
++}
++
+ /* Ensure this instruction is decoded completely */
+ static inline int insn_complete(struct insn *insn)
+ {
+diff --git a/tools/arch/x86/lib/insn.c b/tools/arch/x86/lib/insn.c
+index 79e048f1d902..0151dfc6da61 100644
+--- a/tools/arch/x86/lib/insn.c
++++ b/tools/arch/x86/lib/insn.c
+@@ -13,6 +13,8 @@
+ #include "../include/asm/inat.h"
+ #include "../include/asm/insn.h"
+
++#include "../include/asm/emulate_prefix.h"
++
+ /* Verify next sizeof(t) bytes can be on the same instruction */
+ #define validate_next(t, insn, n) \
+ ((insn)->next_byte + sizeof(t) + n <= (insn)->end_kaddr)
+@@ -58,6 +60,36 @@ void insn_init(struct insn *insn, const void *kaddr, int buf_len, int x86_64)
+ insn->addr_bytes = 4;
+ }
+
++static const insn_byte_t xen_prefix[] = { __XEN_EMULATE_PREFIX };
++static const insn_byte_t kvm_prefix[] = { __KVM_EMULATE_PREFIX };
++
++static int __insn_get_emulate_prefix(struct insn *insn,
++ const insn_byte_t *prefix, size_t len)
++{
++ size_t i;
++
++ for (i = 0; i < len; i++) {
++ if (peek_nbyte_next(insn_byte_t, insn, i) != prefix[i])
++ goto err_out;
++ }
++
++ insn->emulate_prefix_size = len;
++ insn->next_byte += len;
++
++ return 1;
++
++err_out:
++ return 0;
++}
++
++static void insn_get_emulate_prefix(struct insn *insn)
++{
++ if (__insn_get_emulate_prefix(insn, xen_prefix, sizeof(xen_prefix)))
++ return;
++
++ __insn_get_emulate_prefix(insn, kvm_prefix, sizeof(kvm_prefix));
++}
++
+ /**
+ * insn_get_prefixes - scan x86 instruction prefix bytes
+ * @insn: &struct insn containing instruction
+@@ -76,6 +108,8 @@ void insn_get_prefixes(struct insn *insn)
+ if (prefixes->got)
+ return;
+
++ insn_get_emulate_prefix(insn);
++
+ nb = 0;
+ lb = 0;
+ b = peek_next(insn_byte_t, insn);
+diff --git a/tools/objtool/sync-check.sh b/tools/objtool/sync-check.sh
+index 0a832e265a50..9bd04bbed01e 100755
+--- a/tools/objtool/sync-check.sh
++++ b/tools/objtool/sync-check.sh
+@@ -4,6 +4,7 @@
+ FILES='
+ arch/x86/include/asm/inat_types.h
+ arch/x86/include/asm/orc_types.h
++arch/x86/include/asm/emulate_prefix.h
+ arch/x86/lib/x86-opcode-map.txt
+ arch/x86/tools/gen-insn-attr-x86.awk
+ '
+@@ -46,6 +47,6 @@ done
+ check arch/x86/include/asm/inat.h '-I "^#include [\"<]\(asm/\)*inat_types.h[\">]"'
+ check arch/x86/include/asm/insn.h '-I "^#include [\"<]\(asm/\)*inat.h[\">]"'
+ check arch/x86/lib/inat.c '-I "^#include [\"<]\(../include/\)*asm/insn.h[\">]"'
+-check arch/x86/lib/insn.c '-I "^#include [\"<]\(../include/\)*asm/in\(at\|sn\).h[\">]"'
++check arch/x86/lib/insn.c '-I "^#include [\"<]\(../include/\)*asm/in\(at\|sn\).h[\">]" -I "^#include [\"<]\(../include/\)*asm/emulate_prefix.h[\">]"'
+
+ cd -
+diff --git a/tools/perf/check-headers.sh b/tools/perf/check-headers.sh
+index cea13cb987d0..499235a41162 100755
+--- a/tools/perf/check-headers.sh
++++ b/tools/perf/check-headers.sh
+@@ -28,6 +28,7 @@ arch/x86/include/asm/disabled-features.h
+ arch/x86/include/asm/required-features.h
+ arch/x86/include/asm/cpufeatures.h
+ arch/x86/include/asm/inat_types.h
++arch/x86/include/asm/emulate_prefix.h
+ arch/x86/include/uapi/asm/prctl.h
+ arch/x86/lib/x86-opcode-map.txt
+ arch/x86/tools/gen-insn-attr-x86.awk
+@@ -116,7 +117,7 @@ check lib/ctype.c '-I "^EXPORT_SYMBOL" -I "^#include <linux/export.h>" -B
+ check arch/x86/include/asm/inat.h '-I "^#include [\"<]\(asm/\)*inat_types.h[\">]"'
+ check arch/x86/include/asm/insn.h '-I "^#include [\"<]\(asm/\)*inat.h[\">]"'
+ check arch/x86/lib/inat.c '-I "^#include [\"<]\(../include/\)*asm/insn.h[\">]"'
+-check arch/x86/lib/insn.c '-I "^#include [\"<]\(../include/\)*asm/in\(at\|sn\).h[\">]"'
++check arch/x86/lib/insn.c '-I "^#include [\"<]\(../include/\)*asm/in\(at\|sn\).h[\">]" -I "^#include [\"<]\(../include/\)*asm/emulate_prefix.h[\">]"'
+
+ # diff non-symmetric files
+ check_2 tools/perf/arch/x86/entry/syscalls/syscall_64.tbl arch/x86/entry/syscalls/syscall_64.tbl
--- /dev/null
+From b3dc0695fa40c3b280230fb6fb7fb7a94ce28bf4 Mon Sep 17 00:00:00 2001
+From: Masami Hiramatsu <mhiramat@kernel.org>
+Date: Fri, 6 Sep 2019 22:13:59 +0900
+Subject: x86: xen: kvm: Gather the definition of emulate prefixes
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+commit b3dc0695fa40c3b280230fb6fb7fb7a94ce28bf4 upstream.
+
+Gather the emulate prefixes, which forcibly make the following
+instruction emulated on virtualization, in one place.
+
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Juergen Gross <jgross@suse.com>
+Cc: x86@kernel.org
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: Andrew Cooper <andrew.cooper3@citrix.com>
+Cc: Stefano Stabellini <sstabellini@kernel.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: xen-devel@lists.xenproject.org
+Cc: Randy Dunlap <rdunlap@infradead.org>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Link: https://lkml.kernel.org/r/156777563917.25081.7286628561790289995.stgit@devnote2
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+diff --git a/arch/x86/include/asm/emulate_prefix.h b/arch/x86/include/asm/emulate_prefix.h
+new file mode 100644
+index 000000000000..70f5b98a5286
+--- /dev/null
++++ b/arch/x86/include/asm/emulate_prefix.h
+@@ -0,0 +1,14 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ASM_X86_EMULATE_PREFIX_H
++#define _ASM_X86_EMULATE_PREFIX_H
++
++/*
++ * Virt escape sequences to trigger instruction emulation;
++ * ideally these would decode to 'whole' instruction and not destroy
++ * the instruction stream; sadly this is not true for the 'kvm' one :/
++ */
++
++#define __XEN_EMULATE_PREFIX 0x0f,0x0b,0x78,0x65,0x6e /* ud2 ; .ascii "xen" */
++#define __KVM_EMULATE_PREFIX 0x0f,0x0b,0x6b,0x76,0x6d /* ud2 ; .ascii "kvm" */
++
++#endif
+diff --git a/arch/x86/include/asm/xen/interface.h b/arch/x86/include/asm/xen/interface.h
+index 62ca03ef5c65..9139b3e86316 100644
+--- a/arch/x86/include/asm/xen/interface.h
++++ b/arch/x86/include/asm/xen/interface.h
+@@ -379,12 +379,9 @@ struct xen_pmu_arch {
+ * Prefix forces emulation of some non-trapping instructions.
+ * Currently only CPUID.
+ */
+-#ifdef __ASSEMBLY__
+-#define XEN_EMULATE_PREFIX .byte 0x0f,0x0b,0x78,0x65,0x6e ;
+-#define XEN_CPUID XEN_EMULATE_PREFIX cpuid
+-#else
+-#define XEN_EMULATE_PREFIX ".byte 0x0f,0x0b,0x78,0x65,0x6e ; "
+-#define XEN_CPUID XEN_EMULATE_PREFIX "cpuid"
+-#endif
++#include <asm/emulate_prefix.h>
++
++#define XEN_EMULATE_PREFIX __ASM_FORM(.byte __XEN_EMULATE_PREFIX ;)
++#define XEN_CPUID XEN_EMULATE_PREFIX __ASM_FORM(cpuid)
+
+ #endif /* _ASM_X86_XEN_INTERFACE_H */
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 661e2bf38526..777574f547c0 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -68,6 +68,7 @@
+ #include <asm/mshyperv.h>
+ #include <asm/hypervisor.h>
+ #include <asm/intel_pt.h>
++#include <asm/emulate_prefix.h>
+ #include <clocksource/hyperv_timer.h>
+
+ #define CREATE_TRACE_POINTS
+@@ -5446,6 +5447,7 @@ EXPORT_SYMBOL_GPL(kvm_write_guest_virt_system);
+
+ int handle_ud(struct kvm_vcpu *vcpu)
+ {
++ static const char kvm_emulate_prefix[] = { __KVM_EMULATE_PREFIX };
+ int emul_type = EMULTYPE_TRAP_UD;
+ char sig[5]; /* ud2; .ascii "kvm" */
+ struct x86_exception e;
+@@ -5453,7 +5455,7 @@ int handle_ud(struct kvm_vcpu *vcpu)
+ if (force_emulation_prefix &&
+ kvm_read_guest_virt(vcpu, kvm_get_linear_rip(vcpu),
+ sig, sizeof(sig), &e) == 0 &&
+- memcmp(sig, "\xf\xbkvm", sizeof(sig)) == 0) {
++ memcmp(sig, kvm_emulate_prefix, sizeof(sig)) == 0) {
+ kvm_rip_write(vcpu, kvm_rip_read(vcpu) + sizeof(sig));
+ emul_type = EMULTYPE_TRAP_UD_FORCED;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
