From: Ard Biesheuvel <ardb+git@google.com>
To: linux-kernel@vger.kernel.org
Cc: Ard Biesheuvel <ardb@kernel.org>,
Kevin Loughlin <kevinloughlin@google.com>,
Tom Lendacky <thomas.lendacky@amd.com>,
Dionna Glaze <dionnaglaze@google.com>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
Dave Hansen <dave.hansen@linux.intel.com>,
Andy Lutomirski <luto@kernel.org>, Arnd Bergmann <arnd@arndb.de>,
Nathan Chancellor <nathan@kernel.org>,
Nick Desaulniers <ndesaulniers@google.com>,
Justin Stitt <justinstitt@google.com>,
Kees Cook <keescook@chromium.org>,
Brian Gerst <brgerst@gmail.com>,
linux-arch@vger.kernel.org, llvm@lists.linux.dev
Subject: [PATCH v5 00/16] x86: Confine early 1:1 mapped startup code
Date: Wed, 21 Feb 2024 12:35:07 +0100 [thread overview]
Message-ID: <20240221113506.2565718-18-ardb+git@google.com> (raw)
From: Ard Biesheuvel <ardb@kernel.org>
This is a follow-up to [0] which implemented rigorous build time checks
to ensure that any code that is executed during early startup supports
running from the initial 1:1 mapping of memory, which is how the kernel
is entered from the decompressor or the EFI firmware.
Using PIC codegen and introducing new magic sections into generic code
would create a maintenance burden, and more experimentation is needed
there. One issue with PIC codegen is that it still permits the compiler
to make assumptions about the runtime address of global objects (modulo
runtime relocation), which is incompatible with how the kernel is
entered, i.e., running a fully linked and relocated executable from the
wrong runtime address.
The RIP_REL_REF() macro that was introduced recently [1] is actually
more appropriate for this use case, as it hides the access from the
compiler entirely, and so the compiler can never predict its result.
To make incremental progress on this, this v5 drops the special
instrumentation for .pi.text and PIC codegen, but retains all the
cleanup work on the startup code to make it more maintainable and more
obviously correct.
In particular, this involves:
- getting rid of early accesses to global objects, either by moving them
to the stack, deferring the access until later, or dropping the
globals entirely;
- moving all code that runs early via the 1:1 mapping into .head.text,
and moving code that does not out of it, so that build time checks can
be added later to ensure that no inadvertent absolute references were
emitted into code that does not tolerate them;
- removing fixup_pointer() and occurrences of __pa_symbol(), which rely
on the compiler emitting absolute references, and this is not
guaranteed. (Without -fpic, the compiler might still use RIP-relative
references in some cases)
Changes since v4 [2]:
- incorporate Boris's tweaked version of patch #1
- split __startup64() changes into multiple patches, and align more
closely with the original logic
- fix build for CONFIG_X86_5LEVEL=n
- add comment to clarify that CR4.PSE is always set deliberately
- add separate SME startup change to remove SME/SVE related calls from
the non-SME/SVE boot path (this can be backported more easily further
back than to where we need the changes for SVE guest boot)
Changes since v3:
- dropped half of the patches and added a couple of new ones
- applied feedback from Boris to patches that were retained, mostly
related to some minor oversights on my part, and to some style issues
[0] https://lkml.kernel.org/r/20240129180502.4069817-21-ardb%2Bgit%40google.com
[1] https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?h=x86/sev&id=1c811d403afd73f0
[2] https://lkml.kernel.org/r/20240213124143.1484862-13-ardb%2Bgit%40google.com
Cc: Kevin Loughlin <kevinloughlin@google.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Dionna Glaze <dionnaglaze@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Justin Stitt <justinstitt@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: linux-kernel@vger.kernel.org
Cc: linux-arch@vger.kernel.org
Cc: llvm@lists.linux.dev
Ard Biesheuvel (16):
x86/startup_64: Simplify global variable accesses in GDT/IDT
programming
x86/startup_64: Use RIP_REL_REF() to assign phys_base
x86/startup_64: Use RIP_REL_REF() to access early_dynamic_pgts[]
x86/startup_64: Use RIP_REL_REF() to access __supported_pte_mask
x86/startup_64: Use RIP_REL_REF() to access early page tables
x86/startup_64: Use RIP_REL_REF() to access early_top_pgt[]
x86/startup_64: Simplify CR4 handling in startup code
x86/startup_64: Defer assignment of 5-level paging global variables
x86/startup_64: Simplify calculation of initial page table address
x86/startup_64: Simplify virtual switch on primary boot
x86/sme: Avoid SME/SVE related checks on non-SME/SVE platforms
efi/libstub: Add generic support for parsing mem_encrypt=
x86/boot: Move mem_encrypt= parsing to the decompressor
x86/sme: Move early SME kernel encryption handling into .head.text
x86/sev: Move early startup code into .head.text section
x86/startup_64: Drop global variables keeping track of LA57 state
arch/x86/boot/compressed/misc.c | 15 ++
arch/x86/boot/compressed/misc.h | 4 -
arch/x86/boot/compressed/pgtable_64.c | 12 --
arch/x86/boot/compressed/sev.c | 3 +
arch/x86/boot/compressed/vmlinux.lds.S | 1 +
arch/x86/include/asm/mem_encrypt.h | 8 +-
arch/x86/include/asm/pgtable_64_types.h | 43 ++---
arch/x86/include/asm/setup.h | 2 +-
arch/x86/include/asm/sev.h | 10 +-
arch/x86/include/uapi/asm/bootparam.h | 1 +
arch/x86/kernel/cpu/common.c | 2 -
arch/x86/kernel/head64.c | 195 ++++++--------------
arch/x86/kernel/head_64.S | 95 ++++------
arch/x86/kernel/sev-shared.c | 23 +--
arch/x86/kernel/sev.c | 14 +-
arch/x86/lib/Makefile | 13 --
arch/x86/mm/kasan_init_64.c | 3 -
arch/x86/mm/mem_encrypt_identity.c | 89 +++------
drivers/firmware/efi/libstub/efi-stub-helper.c | 8 +
drivers/firmware/efi/libstub/efistub.h | 2 +-
drivers/firmware/efi/libstub/x86-stub.c | 3 +
21 files changed, 203 insertions(+), 343 deletions(-)
base-commit: ee8ff8768735edc3e013837c4416f819543ddc17
--
2.44.0.rc0.258.g7320e95886-goog
next reply other threads:[~2024-02-21 11:35 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-21 11:35 Ard Biesheuvel [this message]
2024-02-21 11:35 ` [PATCH v5 01/16] x86/startup_64: Simplify global variable accesses in GDT/IDT programming Ard Biesheuvel
2024-02-26 12:12 ` [tip: x86/boot] x86/boot/64: " tip-bot2 for Ard Biesheuvel
2024-02-21 11:35 ` [PATCH v5 02/16] x86/startup_64: Use RIP_REL_REF() to assign phys_base Ard Biesheuvel
2024-02-26 12:12 ` [tip: x86/boot] x86/boot/64: Use RIP_REL_REF() to assign 'phys_base' tip-bot2 for Ard Biesheuvel
2024-02-21 11:35 ` [PATCH v5 03/16] x86/startup_64: Use RIP_REL_REF() to access early_dynamic_pgts[] Ard Biesheuvel
2024-02-26 12:12 ` [tip: x86/boot] x86/boot/64: " tip-bot2 for Ard Biesheuvel
2024-02-21 11:35 ` [PATCH v5 04/16] x86/startup_64: Use RIP_REL_REF() to access __supported_pte_mask Ard Biesheuvel
2024-02-26 12:12 ` [tip: x86/boot] x86/boot/64: Use RIP_REL_REF() to access '__supported_pte_mask' tip-bot2 for Ard Biesheuvel
2024-02-21 11:35 ` [PATCH v5 05/16] x86/startup_64: Use RIP_REL_REF() to access early page tables Ard Biesheuvel
2024-02-26 12:12 ` [tip: x86/boot] x86/boot/64: " tip-bot2 for Ard Biesheuvel
2024-02-21 11:35 ` [PATCH v5 06/16] x86/startup_64: Use RIP_REL_REF() to access early_top_pgt[] Ard Biesheuvel
2024-02-26 12:12 ` [tip: x86/boot] x86/boot/64: " tip-bot2 for Ard Biesheuvel
2024-02-21 11:35 ` [PATCH v5 07/16] x86/startup_64: Simplify CR4 handling in startup code Ard Biesheuvel
2024-02-21 14:52 ` Brian Gerst
2024-02-21 11:35 ` [PATCH v5 08/16] x86/startup_64: Defer assignment of 5-level paging global variables Ard Biesheuvel
2024-02-21 11:35 ` [PATCH v5 09/16] x86/startup_64: Simplify calculation of initial page table address Ard Biesheuvel
2024-02-21 11:35 ` [PATCH v5 10/16] x86/startup_64: Simplify virtual switch on primary boot Ard Biesheuvel
2024-02-23 13:11 ` Ard Biesheuvel
2024-02-21 11:35 ` [PATCH v5 11/16] x86/sme: Avoid SME/SVE related checks on non-SME/SVE platforms Ard Biesheuvel
2024-02-21 11:35 ` [PATCH v5 12/16] efi/libstub: Add generic support for parsing mem_encrypt= Ard Biesheuvel
2024-02-21 11:35 ` [PATCH v5 13/16] x86/boot: Move mem_encrypt= parsing to the decompressor Ard Biesheuvel
2024-02-21 11:35 ` [PATCH v5 14/16] x86/sme: Move early SME kernel encryption handling into .head.text Ard Biesheuvel
2024-02-21 11:35 ` [PATCH v5 15/16] x86/sev: Move early startup code into .head.text section Ard Biesheuvel
2024-02-21 11:35 ` [PATCH v5 16/16] x86/startup_64: Drop global variables keeping track of LA57 state Ard Biesheuvel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240221113506.2565718-18-ardb+git@google.com \
--to=ardb+git@google.com \
--cc=ardb@kernel.org \
--cc=arnd@arndb.de \
--cc=bp@alien8.de \
--cc=brgerst@gmail.com \
--cc=dave.hansen@linux.intel.com \
--cc=dionnaglaze@google.com \
--cc=justinstitt@google.com \
--cc=keescook@chromium.org \
--cc=kevinloughlin@google.com \
--cc=linux-arch@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=llvm@lists.linux.dev \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=tglx@linutronix.de \
--cc=thomas.lendacky@amd.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.