From nobody Thu Dec 18 08:10:56 2025 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8D539218840; Thu, 5 Dec 2024 12:28:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733401696; cv=none; b=mYIjmhP1rRuvtO0FsfiboWtByS76SlIFMTx8Rx3OGa1HVDiWx4jcvwOwjurH6o6ui3amUz1w4lfu+se6GILMdnNBWTsS8kAcl+RSguPzQf/CTSLcjeRtg8bEJH/p+xwcJ6x6HjcbIGTzLVpQpNVx3vyIPNZy4/PYGMUaL7rS818= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733401696; c=relaxed/simple; bh=5H9h34fu7bc2Xlh5+woVeVVQrur6lELcah0M/Boyi1I=; h=Date:From:To:Subject:Cc:In-Reply-To:References:MIME-Version: Message-ID:Content-Type; b=KCqr/Khy69AQdjdbQHiRdbg9Jr9I+3ACeiVxG93OCoZB7o/3rkr+NDX9FoRy8LDqNQ+fu/N+S3hjuJV7Uq7fCav00g/01ACD4k/gyj/xK0D5kbvF12y4aVrgosrcUkTRi2cHgAxm/C0DckH7KXAwihhde/7JTDqYw8S0RR1BR3g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=K5NOSuHO; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=rYKwIom+; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="K5NOSuHO"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="rYKwIom+" Date: Thu, 05 Dec 2024 12:28:12 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1733401693; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=O2vdpVP0GQy/JMXiCG1982Ogra3dqtdMcqIMPlLaK9Q=; b=K5NOSuHOeFbQnPoaLKudosg7cdYtU//z/NsAFvJJT3sNl4MLymBF3qsX2S02Bh/J3kqBKc uwrDHLSbx7jSYBIVEf5I9+mn3F22ElWU+aDkuwwJm4fXArkIOWzGaSYvhaSLttqNi2Z3je X7ldVjiC+SrcIC4JELj4GZziuIU6CjoMrSe9FtUxwcAiu54xcGJy2iJUh3n1959Rdaw5/x VR+NoHlH36Ta9EEoDnxhEfaHqPfc2ZIHoxIbv0cicpzFdaymmBKb2DLBHQ/Mw2e8CpKucs JTErL5n5JCh7+PhMaXk92LWjUBWtLwBlgcUYbqJRjc6qhKzp1K3oHRHdLI1euA== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1733401693; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=O2vdpVP0GQy/JMXiCG1982Ogra3dqtdMcqIMPlLaK9Q=; b=rYKwIom+LgFCJv9lRth/YVvFwwVGpW184doQzZviaCR8BSXTZXPb2/K1CJYgPhS1bZ3e43 SuS4JJujztYxmhAw== From: "tip-bot2 for Ard Biesheuvel" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/boot] x86/boot/64: Avoid intentional absolute symbol references in .head.text Cc: Ard Biesheuvel , Ingo Molnar , Linus Torvalds , "H. Peter Anvin" , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20241205112804.3416920-12-ardb+git@google.com> References: <20241205112804.3416920-12-ardb+git@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <173340169220.412.17686240666441987984.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following commit has been merged into the x86/boot branch of tip: Commit-ID: 0d9b9a328cb605419ed046d341dc2a3d66ee0256 Gitweb: https://git.kernel.org/tip/0d9b9a328cb605419ed046d341dc2a3d6= 6ee0256 Author: Ard Biesheuvel AuthorDate: Thu, 05 Dec 2024 12:28:08 +01:00 Committer: Ingo Molnar CommitterDate: Thu, 05 Dec 2024 13:18:54 +01:00 x86/boot/64: Avoid intentional absolute symbol references in .head.text The code in .head.text executes from a 1:1 mapping and cannot generally refer to global variables using their kernel virtual addresses. However, there are some occurrences of such references that are valid: the kernel virtual addresses of _text and _end are needed to populate the page tables correctly, and some other section markers are used in a similar way. To avoid the need for making exceptions to the rule that .head.text must not contain any absolute symbol references, derive these addresses from the RIP-relative 1:1 mapped physical addresses, which can be safely determined using RIP_REL_REF(). Signed-off-by: Ard Biesheuvel Signed-off-by: Ingo Molnar Cc: Linus Torvalds Cc: "H. Peter Anvin" Link: https://lore.kernel.org/r/20241205112804.3416920-12-ardb+git@google.c= om --- arch/x86/kernel/head64.c | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c index a7cd405..54f9a8f 100644 --- a/arch/x86/kernel/head64.c +++ b/arch/x86/kernel/head64.c @@ -91,9 +91,11 @@ static inline bool check_la57_support(void) return true; } =20 -static unsigned long __head sme_postprocess_startup(struct boot_params *bp= , pmdval_t *pmd) +static unsigned long __head sme_postprocess_startup(struct boot_params *bp, + pmdval_t *pmd, + unsigned long p2v_offset) { - unsigned long vaddr, vaddr_end; + unsigned long paddr, paddr_end; int i; =20 /* Encrypt the kernel and related (if SME is active) */ @@ -106,10 +108,10 @@ static unsigned long __head sme_postprocess_startup(s= truct boot_params *bp, pmdv * attribute. */ if (sme_get_me_mask()) { - vaddr =3D (unsigned long)__start_bss_decrypted; - vaddr_end =3D (unsigned long)__end_bss_decrypted; + paddr =3D (unsigned long)&RIP_REL_REF(__start_bss_decrypted); + paddr_end =3D (unsigned long)&RIP_REL_REF(__end_bss_decrypted); =20 - for (; vaddr < vaddr_end; vaddr +=3D PMD_SIZE) { + for (; paddr < paddr_end; paddr +=3D PMD_SIZE) { /* * On SNP, transition the page to shared in the RMP table so that * it is consistent with the page table attribute change. @@ -118,11 +120,11 @@ static unsigned long __head sme_postprocess_startup(s= truct boot_params *bp, pmdv * mapping (kernel .text). PVALIDATE, by way of * early_snp_set_memory_shared(), requires a valid virtual * address but the kernel is currently running off of the identity - * mapping so use __pa() to get a *currently* valid virtual address. + * mapping so use the PA to get a *currently* valid virtual address. */ - early_snp_set_memory_shared(__pa(vaddr), __pa(vaddr), PTRS_PER_PMD); + early_snp_set_memory_shared(paddr, paddr, PTRS_PER_PMD); =20 - i =3D pmd_index(vaddr); + i =3D pmd_index(paddr - p2v_offset); pmd[i] -=3D sme_get_me_mask(); } } @@ -146,6 +148,7 @@ unsigned long __head __startup_64(unsigned long p2v_off= set, { pmd_t (*early_pgts)[PTRS_PER_PMD] =3D RIP_REL_REF(early_dynamic_pgts); unsigned long physaddr =3D (unsigned long)&RIP_REL_REF(_text); + unsigned long va_text, va_end; unsigned long pgtable_flags; unsigned long load_delta; pgdval_t *pgd; @@ -172,6 +175,9 @@ unsigned long __head __startup_64(unsigned long p2v_off= set, if (load_delta & ~PMD_MASK) for (;;); =20 + va_text =3D physaddr - p2v_offset; + va_end =3D (unsigned long)&RIP_REL_REF(_end) - p2v_offset; + /* Include the SME encryption mask in the fixup value */ load_delta +=3D sme_get_me_mask(); =20 @@ -232,7 +238,7 @@ unsigned long __head __startup_64(unsigned long p2v_off= set, pmd_entry +=3D sme_get_me_mask(); pmd_entry +=3D physaddr; =20 - for (i =3D 0; i < DIV_ROUND_UP(_end - _text, PMD_SIZE); i++) { + for (i =3D 0; i < DIV_ROUND_UP(va_end - va_text, PMD_SIZE); i++) { int idx =3D i + (physaddr >> PMD_SHIFT); =20 pmd[idx % PTRS_PER_PMD] =3D pmd_entry + i * PMD_SIZE; @@ -257,11 +263,11 @@ unsigned long __head __startup_64(unsigned long p2v_o= ffset, pmd =3D &RIP_REL_REF(level2_kernel_pgt)->pmd; =20 /* invalidate pages before the kernel image */ - for (i =3D 0; i < pmd_index((unsigned long)_text); i++) + for (i =3D 0; i < pmd_index(va_text); i++) pmd[i] &=3D ~_PAGE_PRESENT; =20 /* fixup pages that are part of the kernel image */ - for (; i <=3D pmd_index((unsigned long)_end); i++) + for (; i <=3D pmd_index(va_end); i++) if (pmd[i] & _PAGE_PRESENT) pmd[i] +=3D load_delta; =20 @@ -269,7 +275,7 @@ unsigned long __head __startup_64(unsigned long p2v_off= set, for (; i < PTRS_PER_PMD; i++) pmd[i] &=3D ~_PAGE_PRESENT; =20 - return sme_postprocess_startup(bp, pmd); + return sme_postprocess_startup(bp, pmd, p2v_offset); } =20 /* Wipe all early page tables except for the kernel symbol map */