Re: tip/master falls off NOP cliff with KPTI under KVM

[Alexey Dobriyan]

On Thu, Jan 11, 2018 at 01:08:14AM +0300, Alexey Dobriyan wrote:
> Sorry, if everyone posted this kvm boot fail.
> Adding "nopti" makes everything boot.
> 
> tip/master
> 
> 	commit 392b9cd85deec6e7f3e0fd97aac9aef2006c640b (HEAD, tip/master, tip/auto-latest)
> 	Merge: 6b34948099b2 07881166a892
> 
> 	    Merge branch 'sched/core'
> 
> debian 8.8 image
> 
> KVM:
> 
> 	qemu-system-x86_64 -smp cpus=2 -m 1024 ... -append 'root=/dev/sda1 ignore_loglevel console=ttyAMA0 console=ttyS0'
> 
> [    0.982804] Freeing unused kernel memory: 952K
> [    0.990333] x86/mm: Checked W+X mappings: passed, no W+X pages found.
> [    0.990980] x86/mm: Checking user space page tables
> [    0.998409] x86/mm: Checked W+X mappings: passed, no W+X pages found.
> [    1.003149] kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
> [    1.003815] BUG: unable to handle kernel paging request at fffffe0000007000
> [    1.004424] IP: 0xfffffe0000007000
> [    1.004727] PGD 3ffd8067 P4D 3ffd8067 PUD 3ffd7067 PMD 3fe15067 PTE 800000003fc09063
> [    1.005402] Oops: 0011 [#1] PREEMPT SMP PTI
> [    1.005775] CPU: 0 PID: 1 Comm: init Not tainted 4.15.0-rc7-00482-g392b9cd85dee #5
> [    1.006432] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc27 04/01/2014
> [    1.007239] RIP: 0010:0xfffffe0000007000
> [    1.007589] RSP: 0018:ffffc9000000bfd0 EFLAGS: 00010006
> [    1.008046] RAX: 000000000000000c RBX: 000055781b7fa040 RCX: 00007f78208d00bc
> [    1.008815] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff81400000
> [    1.009636] RBP: 000000000000000a R08: 000000000000037f R09: 0000000000000064
> [    1.010509] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffbc3eef99
> [    1.011225] R13: 0000000000000000 R14: 000055781b81cc03 R15: 0000000000001000
> [    1.011938] FS:  0000000000000000(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000
> [    1.012723] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [    1.013285] CR2: fffffe0000007000 CR3: 000000003da04000 CR4: 00000000000006b0
> [    1.013960] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [    1.014636] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [    1.015339] Call Trace:
> [    1.015595] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [    1.017500] RIP: 0xfffffe0000007000 RSP: ffffc9000000bfd0
> [    1.018037] CR2: fffffe0000007000

Bisection points to

	f3433c1010c6af61c9897f0f0447f81b991feac1 is the first bad commit
	commit f3433c1010c6af61c9897f0f0447f81b991feac1
	Author: David Woodhouse <dwmw@xxxxxxxxxxxx>
	Date:   Tue Jan 9 14:43:11 2018 +0000

	    x86/retpoline/entry: Convert entry assembler indirect jumps

RETPOLINE is enabled but build system is reporting that compiler doesn't
support it (Gentoo 6.4.0 p1.1)

Disabling CONFIG_RETPOLINE fixes boot.

And build system reports that "system may be insecure" even if RETPOLINE
is disabled.