From nobody Thu Dec 18 00:06:27 2025 Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 77BDA1DACBF for ; Mon, 16 Dec 2024 23:37:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=90.155.50.34 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1734392259; cv=none; b=V0pSr2BA38ww/Frz+FcRnqU8P02uphQ90ifDJ/1RBbzVmnqjrYyiMWTlb0c9nuEebKsk/TzdtR5vO+3EeQYaHrliS8hCzUuBjKs0S9SX7g0eif4goWV5wBlb+pQ6BkdNopiX1dziN8zYMvpMmeeEXxjOfyTPfGXl0aj/PNRvmKg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1734392259; c=relaxed/simple; bh=zkbYTmuZfQnBujK5vcetFookFFHLMepfdATcSMt8Pnk=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=q3WTR5o6RBD1rNgoKX3t0lJ8U6Rdh1iCsrzgmDf/LssPd9cMktBNwIkyEaK3+Jb3JnD6+vuUe/inNH2jMPgPkaaX29AU+NmT7RffY/EmsOU+yHHgUcBqEuuGEUeAtinfrBIXqs/D2l7nF9WjsKn0rrTrAz3Es32IUwZRpm/XASg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=infradead.org; spf=none smtp.mailfrom=casper.srs.infradead.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b=qvaNRGwU; arc=none smtp.client-ip=90.155.50.34 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=infradead.org Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=casper.srs.infradead.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="qvaNRGwU" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:To: From:Reply-To:Cc:Content-ID:Content-Description; bh=siK05iL8Sl6AWnRvb8/748kKl/nChwb5EZxS4049r5c=; b=qvaNRGwUFC5FsBbeIs6VVrSnBe WbdfBwGzFPGSuxtAJlPzlK3kEAsmjb3fbEYVnEQPt0u2zYf9NRL/ttY09zBY2hMIHU4u3m6aGDKII jkkzC7rJlMsFboQaNYUbNnRpJmg5RWJZKBwCxmSqjXkpjFmLcDTAAWAV4JllqeMO6JJCh7ASYUMtE ezZGQz/5KZZeKbL2Rdr8m8AsmR4b/oAng2yu1xaUfCKil0/pWZ1qi/Dm1yb5IPeiiJP+eeiesmw82 /xpgrD+l9ZN+m0Y3mvxYmmArGtoVytSqpPNVbulOqP+Y0OpE5O98zHpUfoJbXBZBWYgJc78/fyGGn q9pBrmJA==; Received: from [2001:8b0:10b:1::ebe] (helo=i7.infradead.org) by casper.infradead.org with esmtpsa (Exim 4.98 #2 (Red Hat Linux)) id 1tNKeA-000000034nU-1cjU; Mon, 16 Dec 2024 23:37:06 +0000 Received: from dwoodhou by i7.infradead.org with local (Exim 4.98 #2 (Red Hat Linux)) id 1tNKeA-0000000DeW3-00b8; Mon, 16 Dec 2024 23:37:06 +0000 From: David Woodhouse To: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Eric Biederman , David Woodhouse , Sourabh Jain , Hari Bathini , Michael Ellerman , Thomas Zimmermann , Andrew Morton , Baoquan He , Yuntao Wang , David Kaplan , Tao Liu , "Kirill A. Shutemov" , Kai Huang , Ard Biesheuvel , Josh Poimboeuf , Breno Leitao , Wei Yang , Rong Xu , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , linux-kernel@vger.kernel.org, kexec@lists.infradead.org, Simon Horman , Dave Young , Peter Zijlstra , bsz@amazon.de, nathan@kernel.org Subject: [PATCH 1/9] x86/kexec: Disable global pages before writing to control page Date: Mon, 16 Dec 2024 23:24:08 +0000 Message-ID: <20241216233704.3208607-2-dwmw2@infradead.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: <20241216233704.3208607-1-dwmw2@infradead.org> References: <20241216233704.3208607-1-dwmw2@infradead.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Sender: David Woodhouse X-SRS-Rewrite: SMTP reverse-path rewritten from by casper.infradead.org. See http://www.infradead.org/rpr.html From: David Woodhouse The kernel switches to a new set of page tables during kexec. The global mappings (_PAGE_GLOBAL=3D=3D1) can remain in the TLB after this switch. This is generally not a problem because the new page tables use a different portion of the virtual address space than the normal kernel mappings. The critical exception to that generalisation (and the only mapping which isn't an identity mapping) is the kexec control page itself =E2=80=94 which was ROX in the original kernel mapping, but should be RWX in the new page tables. If there is a global TLB entry for that in its prior read-only state, it definitely needs to be flushed before attempting to write through that virtual mapping. It would be possible to just avoid writing to the virtual address of the page and defer all writes until they can be done through the identity mapping. But there's no good reason to keep the old TLB entries around, as they can cause nothing but trouble. Clear the PGE bit in %cr4 early, before storing data in the control page. Fixes: 5a82223e0743 ("x86/kexec: Mark relocate_kernel page as ROX instead o= f RWX") Co-authored-by: Dave Hansen Reported-by: Nathan Chancellor Reported-by: "Ning, Hongyu" Closes: https://bugzilla.kernel.org/show_bug.cgi?id=3D219592 Signed-off-by: Dave Hansen Signed-off-by: David Woodhouse Tested-by: Nathan Chancellor Tested-by: "Ning, Hongyu" --- arch/x86/kernel/relocate_kernel_64.S | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocat= e_kernel_64.S index 8bc86a1e056a..9bd601dd8659 100644 --- a/arch/x86/kernel/relocate_kernel_64.S +++ b/arch/x86/kernel/relocate_kernel_64.S @@ -70,14 +70,20 @@ SYM_CODE_START_NOALIGN(relocate_kernel) movq kexec_pa_table_page(%rip), %r9 movq %r9, %cr3 =20 + /* Leave CR4 in %r13 to enable the right paging mode later. */ + movq %cr4, %r13 + + /* Disable global pages immediately to ensure this mapping is RWX */ + movq %r13, %r12 + andq $~(X86_CR4_PGE), %r12 + movq %r12, %cr4 + /* Save %rsp and CRs. */ + movq %r13, saved_cr4(%rip) movq %rsp, saved_rsp(%rip) movq %rax, saved_cr3(%rip) movq %cr0, %rax movq %rax, saved_cr0(%rip) - /* Leave CR4 in %r13 to enable the right paging mode later. */ - movq %cr4, %r13 - movq %r13, saved_cr4(%rip) =20 /* save indirection list for jumping back */ movq %rdi, pa_backup_pages_map(%rip) base-commit: 35aafa1d41cee0d3d50164561bca34befc1d9ce3 --=20 2.47.0