From nobody Sun Feb 8 17:41:43 2026 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A846C482F2; Sun, 6 Apr 2025 18:33:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743964384; cv=none; b=RlpCh76wrcG+jqakCiskKHQBJsGN+qVkW/enmM3a8FHozz8CpKdYR4T8RkLIsTI5y4BSeyTLLS8tgWWPX7ggOwA7gltZMh7Mhm2/gNYW+HCh/Zixu1p879pfuxkJ+pS0u7Lo+Q7aUkZt+8P2JcboU0zcQY623FEb4u0zZNoEhN4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743964384; c=relaxed/simple; bh=x6Ayw8L8ZP60aZPv5QH8Khfcj66Lmwhfo0ItobWxbdk=; h=Date:From:To:Subject:Cc:In-Reply-To:References:MIME-Version: Message-ID:Content-Type; b=cOo6WfDbEdlZ3sjNvXdTpM4pUb4jPd+VE4QgVSJF1ue3+iMKp3t3ewrEnQZyHmRed6WKWhl6nQIucxxx0/eFYezp7puZYZ75gAXQt82Id3Ly1AkB6vVDSYUnkv8Ut9JqfdDJcbNW4qGro3FY5j1o/viCcl2eY41V3wgHN/P4Qvo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=ZAJeNn8f; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=545mBrFz; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="ZAJeNn8f"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="545mBrFz" Date: Sun, 06 Apr 2025 18:33:00 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1743964380; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Tyz2uYt2pM28Tu4JsFFpPTG9zEJEPw/Qlsjh1Do73js=; b=ZAJeNn8f2xvuoPIC2j5MgUP68bl8VA+b8Gy05XN8kfvt1w4Ryv2sW/vVvROvUl68bWfASE SEeeAQd3S5ZX2fF+z8KxPwL4eMlxcPu7sKGlG0vyJm1MLZxEfu+J+wDj0U+mBVkMZyXXX7 GyHXUXg/Bcwov5TOWHMW0SQaCFJvuKeScQsWA/uUOq3jlMj7WtuS30Z/8eTTFOCiHf4gz+ ztqvryDzovXXfv9n+3d4eswjFnwhCQIWVUEVzFV+EaNj7eU42qWh0c5NIZsDVE+aJkATDc +g57qNEyw7eXtiTtO5TqaoWsf3ta4iMif99QN/e4ZTrDSWi3DsYAZVJY74ISXg== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1743964380; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Tyz2uYt2pM28Tu4JsFFpPTG9zEJEPw/Qlsjh1Do73js=; b=545mBrFzsYzHeqna36niRQLJWgow84CGDAqJhdjg/i2VsEbAsKp5VbQqAACChmB00QFCrO EREKW4KnTRoH2IDg== From: "tip-bot2 for Ard Biesheuvel" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/boot] x86/boot: Move the early GDT/IDT setup code into startup/ Cc: Ard Biesheuvel , Ingo Molnar , David Woodhouse , "H. Peter Anvin" , Kees Cook , Linus Torvalds , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20250401133416.1436741-12-ardb+git@google.com> References: <20250401133416.1436741-12-ardb+git@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <174396438008.31282.5734460975851851027.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following commit has been merged into the x86/boot branch of tip: Commit-ID: cc34e658c6db493c1524077e95b42d478de58f2b Gitweb: https://git.kernel.org/tip/cc34e658c6db493c1524077e95b42d478= de58f2b Author: Ard Biesheuvel AuthorDate: Tue, 01 Apr 2025 15:34:21 +02:00 Committer: Ingo Molnar CommitterDate: Sun, 06 Apr 2025 20:15:14 +02:00 x86/boot: Move the early GDT/IDT setup code into startup/ Move the early GDT/IDT setup code that runs long before the kernel virtual mapping is up into arch/x86/boot/startup/, and build it in a way that ensures that the code tolerates being called from the 1:1 mapping of memory. This allows the RIP_REL_REF() macro uses to be dropped, and removes the need for emitting the code into the special .head.text section. Also tweak the sed symbol matching pattern in the decompressor to match on lower case 't' or 'b', as these will be emitted by Clang for symbols with hidden linkage. Signed-off-by: Ard Biesheuvel Signed-off-by: Ingo Molnar Cc: David Woodhouse Cc: H. Peter Anvin Cc: Kees Cook Cc: Linus Torvalds Link: https://lore.kernel.org/r/20250401133416.1436741-12-ardb+git@google.c= om --- arch/x86/boot/compressed/Makefile | 2 +- arch/x86/boot/startup/Makefile | 15 +++++- arch/x86/boot/startup/gdt_idt.c | 82 ++++++++++++++++++++++++++++++- arch/x86/kernel/head64.c | 74 +--------------------------- 4 files changed, 98 insertions(+), 75 deletions(-) create mode 100644 arch/x86/boot/startup/gdt_idt.c diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/M= akefile index 37b85ce..0fcad7b 100644 --- a/arch/x86/boot/compressed/Makefile +++ b/arch/x86/boot/compressed/Makefile @@ -73,7 +73,7 @@ LDFLAGS_vmlinux +=3D -T hostprogs :=3D mkpiggy HOST_EXTRACFLAGS +=3D -I$(srctree)/tools/include =20 -sed-voffset :=3D -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|__start_rod= ata\|__bss_start\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p' +sed-voffset :=3D -e 's/^\([0-9a-fA-F]*\) [ABbCDGRSTtVW] \(_text\|__start_r= odata\|__bss_start\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p' =20 quiet_cmd_voffset =3D VOFFSET $@ cmd_voffset =3D $(NM) $< | sed -n $(sed-voffset) > $@ diff --git a/arch/x86/boot/startup/Makefile b/arch/x86/boot/startup/Makefile index 73946a3..34b324c 100644 --- a/arch/x86/boot/startup/Makefile +++ b/arch/x86/boot/startup/Makefile @@ -1,6 +1,21 @@ # SPDX-License-Identifier: GPL-2.0 =20 KBUILD_AFLAGS +=3D -D__DISABLE_EXPORTS +KBUILD_CFLAGS +=3D -D__DISABLE_EXPORTS -mcmodel=3Dsmall -fPIC \ + -Os -DDISABLE_BRANCH_PROFILING \ + $(DISABLE_STACKLEAK_PLUGIN) \ + -fno-stack-protector -D__NO_FORTIFY \ + -include $(srctree)/include/linux/hidden.h + +# disable ftrace hooks +KBUILD_CFLAGS :=3D $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) +KASAN_SANITIZE :=3D n +KCSAN_SANITIZE :=3D n +KMSAN_SANITIZE :=3D n +UBSAN_SANITIZE :=3D n +KCOV_INSTRUMENT :=3D n + +obj-$(CONFIG_X86_64) +=3D gdt_idt.o =20 lib-$(CONFIG_X86_64) +=3D la57toggle.o lib-$(CONFIG_EFI_MIXED) +=3D efi-mixed.o diff --git a/arch/x86/boot/startup/gdt_idt.c b/arch/x86/boot/startup/gdt_id= t.c new file mode 100644 index 0000000..b382d5d --- /dev/null +++ b/arch/x86/boot/startup/gdt_idt.c @@ -0,0 +1,82 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include +#include + +#include +#include +#include +#include + +/* + * Data structures and code used for IDT setup in head_64.S. The bringup-I= DT is + * used until the idt_table takes over. On the boot CPU this happens in + * x86_64_start_kernel(), on secondary CPUs in start_secondary(). In both = cases + * this happens in the functions called from head_64.S. + * + * The idt_table can't be used that early because all the code modifying i= t is + * in idt.c and can be instrumented by tracing or KASAN, which both don't = work + * during early CPU bringup. Also the idt_table has the runtime vectors + * configured which require certain CPU state to be setup already (like TS= S), + * which also hasn't happened yet in early CPU bringup. + */ +static gate_desc bringup_idt_table[NUM_EXCEPTION_VECTORS] __page_aligned_d= ata; + +/* This may run while still in the direct mapping */ +static void startup_64_load_idt(void *vc_handler) +{ + struct desc_ptr desc =3D { + .address =3D (unsigned long)bringup_idt_table, + .size =3D sizeof(bringup_idt_table) - 1, + }; + struct idt_data data; + gate_desc idt_desc; + + /* @vc_handler is set only for a VMM Communication Exception */ + if (vc_handler) { + init_idt_data(&data, X86_TRAP_VC, vc_handler); + idt_init_desc(&idt_desc, &data); + native_write_idt_entry((gate_desc *)desc.address, X86_TRAP_VC, &idt_desc= ); + } + + native_load_idt(&desc); +} + +/* This is used when running on kernel addresses */ +void early_setup_idt(void) +{ + void *handler =3D NULL; + + if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) { + setup_ghcb(); + handler =3D vc_boot_ghcb; + } + + startup_64_load_idt(handler); +} + +/* + * Setup boot CPU state needed before kernel switches to virtual addresses. + */ +void __init startup_64_setup_gdt_idt(void) +{ + void *handler =3D NULL; + + struct desc_ptr startup_gdt_descr =3D { + .address =3D (__force unsigned long)gdt_page.gdt, + .size =3D GDT_SIZE - 1, + }; + + /* Load GDT */ + native_load_gdt(&startup_gdt_descr); + + /* New GDT is live - reload data segment registers */ + asm volatile("movl %%eax, %%ds\n" + "movl %%eax, %%ss\n" + "movl %%eax, %%es\n" : : "a"(__KERNEL_DS) : "memory"); + + if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) + handler =3D vc_no_ghcb; + + startup_64_load_idt(handler); +} diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c index fa9b633..5b993b5 100644 --- a/arch/x86/kernel/head64.c +++ b/arch/x86/kernel/head64.c @@ -512,77 +512,3 @@ void __init __noreturn x86_64_start_reservations(char = *real_mode_data) =20 start_kernel(); } - -/* - * Data structures and code used for IDT setup in head_64.S. The bringup-I= DT is - * used until the idt_table takes over. On the boot CPU this happens in - * x86_64_start_kernel(), on secondary CPUs in start_secondary(). In both = cases - * this happens in the functions called from head_64.S. - * - * The idt_table can't be used that early because all the code modifying i= t is - * in idt.c and can be instrumented by tracing or KASAN, which both don't = work - * during early CPU bringup. Also the idt_table has the runtime vectors - * configured which require certain CPU state to be setup already (like TS= S), - * which also hasn't happened yet in early CPU bringup. - */ -static gate_desc bringup_idt_table[NUM_EXCEPTION_VECTORS] __page_aligned_d= ata; - -/* This may run while still in the direct mapping */ -static void __head startup_64_load_idt(void *vc_handler) -{ - struct desc_ptr desc =3D { - .address =3D (unsigned long)&RIP_REL_REF(bringup_idt_table), - .size =3D sizeof(bringup_idt_table) - 1, - }; - struct idt_data data; - gate_desc idt_desc; - - /* @vc_handler is set only for a VMM Communication Exception */ - if (vc_handler) { - init_idt_data(&data, X86_TRAP_VC, vc_handler); - idt_init_desc(&idt_desc, &data); - native_write_idt_entry((gate_desc *)desc.address, X86_TRAP_VC, &idt_desc= ); - } - - native_load_idt(&desc); -} - -/* This is used when running on kernel addresses */ -void early_setup_idt(void) -{ - void *handler =3D NULL; - - if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) { - setup_ghcb(); - handler =3D vc_boot_ghcb; - } - - startup_64_load_idt(handler); -} - -/* - * Setup boot CPU state needed before kernel switches to virtual addresses. - */ -void __head startup_64_setup_gdt_idt(void) -{ - struct desc_struct *gdt =3D (void *)(__force unsigned long)gdt_page.gdt; - void *handler =3D NULL; - - struct desc_ptr startup_gdt_descr =3D { - .address =3D (unsigned long)&RIP_REL_REF(*gdt), - .size =3D GDT_SIZE - 1, - }; - - /* Load GDT */ - native_load_gdt(&startup_gdt_descr); - - /* New GDT is live - reload data segment registers */ - asm volatile("movl %%eax, %%ds\n" - "movl %%eax, %%ss\n" - "movl %%eax, %%es\n" : : "a"(__KERNEL_DS) : "memory"); - - if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) - handler =3D &RIP_REL_REF(vc_no_ghcb); - - startup_64_load_idt(handler); -}