• Josh Poimboeuf's avatar
    x86/kvm: Fix "missing ENDBR" BUG for fastop functions · 3d9606b0
    Josh Poimboeuf authored
    The following BUG was reported:
    
      traps: Missing ENDBR: andw_ax_dx+0x0/0x10 [kvm]
      ------------[ cut here ]------------
      kernel BUG at arch/x86/kernel/traps.c:253!
      invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
       <TASK>
       asm_exc_control_protection+0x2b/0x30
      RIP: 0010:andw_ax_dx+0x0/0x10 [kvm]
      Code: c3 cc cc cc cc 0f 1f 44 00 00 66 0f 1f 00 48 19 d0 c3 cc cc cc
            cc 0f 1f 40 00 f3 0f 1e fa 20 d0 c3 cc cc cc cc 0f 1f 44 00 00
            <66> 0f 1f 00 66 21 d0 c3 cc cc cc cc 0f 1f 40 00 66 0f 1f 00 21
            d0
    
       ? andb_al_dl+0x10/0x10 [kvm]
       ? fastop+0x5d/0xa0 [kvm]
       x86_emulate_insn+0x822/0x1060 [kvm]
       x86_emulate_instruction+0x46f/0x750 [kvm]
       complete_emulated_mmio+0x216/0x2c0 [kvm]
       kvm_arch_vcpu_ioctl_run+0x604/0x650 [kvm]
       kvm_vcpu_ioctl+0x2f4/0x6b0 [kvm]
       ? wake_up_q+0xa0/0xa0
    
    The BUG occurred because the ENDBR in the andw_ax_dx() fastop function
    had been incorrectly "sealed" (converted to a NOP) by apply_ibt_endbr().
    
    Objtool marked it to be sealed because KVM has no compile-time
    references to the function.  Instead KVM calculates its address at
    runtime.
    
    Prevent objtool from annotating fastop functions as sealable by creating
    throwaway dummy compile-time references to the functions.
    
    Fixes: 6649fa87 ("x86/ibt,kvm: Add ENDBR to fastops")
    Reported-by: default avatarPengfei Xu <pengfei.xu@intel.com>
    Debugged-by: default avatarPeter Zijlstra <peterz@infradead.org>
    Signed-off-by: default avatarJosh Poimboeuf <jpoimboe@kernel.org>
    Message-Id: <0d4116f90e9d0c1b754bb90c585e6f0415a1c508.1660837839.git.jpoimboe@kernel.org>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    3d9606b0
emulate.c 149 KB