From nobody Sun Apr 12 02:53:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 931D0C00144 for ; Mon, 1 Aug 2022 16:39:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233350AbiHAQjP (ORCPT ); Mon, 1 Aug 2022 12:39:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60112 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232571AbiHAQjK (ORCPT ); Mon, 1 Aug 2022 12:39:10 -0400 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 68BCC30C for ; Mon, 1 Aug 2022 09:39:09 -0700 (PDT) Received: from localhost.localdomain (unknown [92.49.173.143]) by mail.ispras.ru (Postfix) with ESMTPSA id 73EC1407625D; Mon, 1 Aug 2022 16:39:07 +0000 (UTC) From: Evgeniy Baskov To: Borislav Petkov Cc: Evgeniy Baskov , Dave Hansen , Ingo Molnar , Thomas Gleixner , Andy Lutomirski , Peter Zijlstra , x86@kernel.org, linux-kernel@vger.kernel.org, Alexey Khoroshilov Subject: [PATCH 1/8] x86/boot: Align vmlinuz sections on page size Date: Mon, 1 Aug 2022 19:38:58 +0300 Message-Id: X-Mailer: git-send-email 2.35.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" To protect sections on page table level each section needs to be aligned on page size (4KB). Set sections alignment in linker script. Signed-off-by: Evgeniy Baskov diff --git a/arch/x86/boot/compressed/vmlinux.lds.S b/arch/x86/boot/compres= sed/vmlinux.lds.S index 112b2375d021..6be90f1a1198 100644 --- a/arch/x86/boot/compressed/vmlinux.lds.S +++ b/arch/x86/boot/compressed/vmlinux.lds.S @@ -27,21 +27,27 @@ SECTIONS HEAD_TEXT _ehead =3D . ; } + . =3D ALIGN(PAGE_SIZE); .rodata..compressed : { + _compressed =3D .; *(.rodata..compressed) + _ecompressed =3D .; } + . =3D ALIGN(PAGE_SIZE); .text : { _text =3D .; /* Text */ *(.text) *(.text.*) _etext =3D . ; } + . =3D ALIGN(PAGE_SIZE); .rodata : { _rodata =3D . ; *(.rodata) /* read-only data */ *(.rodata.*) _erodata =3D . ; } + . =3D ALIGN(PAGE_SIZE); .data : { _data =3D . ; *(.data) --=20 2.35.1 From nobody Sun Apr 12 02:53:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 56497C00144 for ; Mon, 1 Aug 2022 16:39:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233563AbiHAQjS (ORCPT ); Mon, 1 Aug 2022 12:39:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60124 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232898AbiHAQjK (ORCPT ); Mon, 1 Aug 2022 12:39:10 -0400 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D561B38D for ; Mon, 1 Aug 2022 09:39:09 -0700 (PDT) Received: from localhost.localdomain (unknown [92.49.173.143]) by mail.ispras.ru (Postfix) with ESMTPSA id E9E79407625E; Mon, 1 Aug 2022 16:39:07 +0000 (UTC) From: Evgeniy Baskov To: Borislav Petkov Cc: Evgeniy Baskov , Dave Hansen , Ingo Molnar , Thomas Gleixner , Andy Lutomirski , Peter Zijlstra , x86@kernel.org, linux-kernel@vger.kernel.org, Alexey Khoroshilov Subject: [PATCH 2/8] x86/build: Remove RWX sections and align on 4KB Date: Mon, 1 Aug 2022 19:38:59 +0300 Message-Id: X-Mailer: git-send-email 2.35.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Avoid creating sections with maximal privileges to prepare for W^X implementation. Align sections on page size (4KB) to allow protecting them in page table. Signed-off-by: Evgeniy Baskov diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S index 15f29053cec4..6587e0201b50 100644 --- a/arch/x86/kernel/vmlinux.lds.S +++ b/arch/x86/kernel/vmlinux.lds.S @@ -102,12 +102,11 @@ jiffies =3D jiffies_64; PHDRS { text PT_LOAD FLAGS(5); /* R_E */ data PT_LOAD FLAGS(6); /* RW_ */ -#ifdef CONFIG_X86_64 -#ifdef CONFIG_SMP +#if defined(CONFIG_X86_64) && defined(CONFIG_SMP) percpu PT_LOAD FLAGS(6); /* RW_ */ #endif - init PT_LOAD FLAGS(7); /* RWE */ -#endif + inittext PT_LOAD FLAGS(5); /* R_E */ + init PT_LOAD FLAGS(6); /* RW_ */ note PT_NOTE FLAGS(0); /* ___ */ } =20 @@ -226,9 +225,10 @@ SECTIONS #endif =20 INIT_TEXT_SECTION(PAGE_SIZE) -#ifdef CONFIG_X86_64 - :init -#endif + :inittext + + . =3D ALIGN(PAGE_SIZE); + =20 /* * Section for code used exclusively before alternatives are run. All @@ -240,6 +240,7 @@ SECTIONS .altinstr_aux : AT(ADDR(.altinstr_aux) - LOAD_OFFSET) { *(.altinstr_aux) } + :init =20 INIT_DATA_SECTION(16) =20 --=20 2.35.1 From nobody Sun Apr 12 02:53:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EE3DFC00144 for ; Mon, 1 Aug 2022 16:39:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233640AbiHAQjW (ORCPT ); Mon, 1 Aug 2022 12:39:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60126 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232909AbiHAQjL (ORCPT ); Mon, 1 Aug 2022 12:39:11 -0400 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5A2F3257 for ; Mon, 1 Aug 2022 09:39:10 -0700 (PDT) Received: from localhost.localdomain (unknown [92.49.173.143]) by mail.ispras.ru (Postfix) with ESMTPSA id 6BB4D407625F; Mon, 1 Aug 2022 16:39:08 +0000 (UTC) From: Evgeniy Baskov To: Borislav Petkov Cc: Evgeniy Baskov , Dave Hansen , Ingo Molnar , Thomas Gleixner , Andy Lutomirski , Peter Zijlstra , x86@kernel.org, linux-kernel@vger.kernel.org, Alexey Khoroshilov Subject: [PATCH 3/8] x86/boot: Set cr0 to known state in trampoline Date: Mon, 1 Aug 2022 19:39:00 +0300 Message-Id: X-Mailer: git-send-email 2.35.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Ensure WP bit to be set to prevent boot code from writing to non-writable memory pages. Signed-off-by: Evgeniy Baskov diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/= head_64.S index d33f060900d2..5273367283b7 100644 --- a/arch/x86/boot/compressed/head_64.S +++ b/arch/x86/boot/compressed/head_64.S @@ -619,9 +619,8 @@ SYM_CODE_START(trampoline_32bit_src) /* Set up new stack */ leal TRAMPOLINE_32BIT_STACK_END(%ecx), %esp =20 - /* Disable paging */ - movl %cr0, %eax - btrl $X86_CR0_PG_BIT, %eax + /* Disable paging and setup CR0 */ + movl $(CR0_STATE & ~X86_CR0_PG), %eax movl %eax, %cr0 =20 /* Check what paging mode we want to be in after the trampoline */ --=20 2.35.1 From nobody Sun Apr 12 02:53:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F32B4C00144 for ; Mon, 1 Aug 2022 16:39:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233669AbiHAQjY (ORCPT ); Mon, 1 Aug 2022 12:39:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60138 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233014AbiHAQjL (ORCPT ); Mon, 1 Aug 2022 12:39:11 -0400 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C733230C for ; Mon, 1 Aug 2022 09:39:10 -0700 (PDT) Received: from localhost.localdomain (unknown [92.49.173.143]) by mail.ispras.ru (Postfix) with ESMTPSA id E3BBD4076260; Mon, 1 Aug 2022 16:39:08 +0000 (UTC) From: Evgeniy Baskov To: Borislav Petkov Cc: Evgeniy Baskov , Dave Hansen , Ingo Molnar , Thomas Gleixner , Andy Lutomirski , Peter Zijlstra , x86@kernel.org, linux-kernel@vger.kernel.org, Alexey Khoroshilov Subject: [PATCH 4/8] x86/boot: Increase boot page table size Date: Mon, 1 Aug 2022 19:39:01 +0300 Message-Id: <41d46feb211e4e4a4c4ef150408ceedb35e94f21.1659369873.git.baskov@ispras.ru> X-Mailer: git-send-email 2.35.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Previous calculations ignored pages implicitly mapped by ACPI code, so theoretical upper limit is higher than was set. Using 4KB pages is desirable for better memory protection granularity. Approximately twice as much memory is required for those. Increase initial page table size to 64 4KB page tables. Signed-off-by: Evgeniy Baskov diff --git a/arch/x86/include/asm/boot.h b/arch/x86/include/asm/boot.h index 9191280d9ea3..024d972c248e 100644 --- a/arch/x86/include/asm/boot.h +++ b/arch/x86/include/asm/boot.h @@ -41,22 +41,24 @@ # define BOOT_STACK_SIZE 0x4000 =20 # define BOOT_INIT_PGT_SIZE (6*4096) -# ifdef CONFIG_RANDOMIZE_BASE /* * Assuming all cross the 512GB boundary: * 1 page for level4 - * (2+2)*4 pages for kernel, param, cmd_line, and randomized kernel - * 2 pages for first 2M (video RAM: CONFIG_X86_VERBOSE_BOOTUP). - * Total is 19 pages. + * (3+3)*2 pages for param and cmd_line + * (2+2+S)*2 pages for kernel and randomized kernel, where S is total numb= er + * of sections of kernel. Explanation: 2+2 are upper level page tables. + * We can have only S unaligned parts of section: 1 at the end of the = kernel + * and (S-1) at the section borders. The start address of the kernel is + * aligned, so an extra page table. There are at most S=3D6 sections in + * vmlinux ELF image. + * 3 pages for first 2M (video RAM: CONFIG_X86_VERBOSE_BOOTUP). + * Total is 36 pages. + * + * Some pages are also required for UEFI memory map and + * ACPI table mappings, so we need to add extra space. + * FIXME: Figure out exact amount of pages. */ -# ifdef CONFIG_X86_VERBOSE_BOOTUP -# define BOOT_PGT_SIZE (19*4096) -# else /* !CONFIG_X86_VERBOSE_BOOTUP */ -# define BOOT_PGT_SIZE (17*4096) -# endif -# else /* !CONFIG_RANDOMIZE_BASE */ -# define BOOT_PGT_SIZE BOOT_INIT_PGT_SIZE -# endif +# define BOOT_PGT_SIZE (64*4096) =20 #else /* !CONFIG_X86_64 */ # define BOOT_STACK_SIZE 0x1000 --=20 2.35.1 From nobody Sun Apr 12 02:53:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 763ECC00144 for ; Mon, 1 Aug 2022 16:39:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233796AbiHAQj1 (ORCPT ); Mon, 1 Aug 2022 12:39:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60166 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232400AbiHAQjM (ORCPT ); Mon, 1 Aug 2022 12:39:12 -0400 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 43BAE38D for ; Mon, 1 Aug 2022 09:39:11 -0700 (PDT) Received: from localhost.localdomain (unknown [92.49.173.143]) by mail.ispras.ru (Postfix) with ESMTPSA id 65C584076261; Mon, 1 Aug 2022 16:39:09 +0000 (UTC) From: Evgeniy Baskov To: Borislav Petkov Cc: Evgeniy Baskov , Dave Hansen , Ingo Molnar , Thomas Gleixner , Andy Lutomirski , Peter Zijlstra , x86@kernel.org, linux-kernel@vger.kernel.org, Alexey Khoroshilov Subject: [PATCH 5/8] x86/boot: Support 4KB pages for identity mapping Date: Mon, 1 Aug 2022 19:39:02 +0300 Message-Id: <8fa517a6bf6268a86febf76fd4b79dbaf6be6d09.1659369873.git.baskov@ispras.ru> X-Mailer: git-send-email 2.35.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Current identity mapping code only supports 2M and 1G pages. 4KB pages are desirable for better memory protection granularity in compressed kernel code. Change identity mapping code to support 4KB pages and memory remapping with different attributes. Signed-off-by: Evgeniy Baskov diff --git a/arch/x86/include/asm/init.h b/arch/x86/include/asm/init.h index 5f1d3c421f68..a8277ee82c51 100644 --- a/arch/x86/include/asm/init.h +++ b/arch/x86/include/asm/init.h @@ -8,6 +8,7 @@ struct x86_mapping_info { unsigned long page_flag; /* page flag for PMD or PUD entry */ unsigned long offset; /* ident mapping offset */ bool direct_gbpages; /* PUD level 1GB page support */ + bool allow_4kpages; /* Allow more granular mappings with 4K pages */ unsigned long kernpg_flag; /* kernel pagetable flag override */ }; =20 diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c index 968d7005f4a7..177cd43c8db9 100644 --- a/arch/x86/mm/ident_map.c +++ b/arch/x86/mm/ident_map.c @@ -2,26 +2,130 @@ /* * Helper routines for building identity mapping page tables. This is * included by both the compressed kernel and the regular kernel. + * */ =20 -static void ident_pmd_init(struct x86_mapping_info *info, pmd_t *pmd_page, - unsigned long addr, unsigned long end) +static void ident_pte_init(struct x86_mapping_info *info, pte_t *pte_page, + unsigned long addr, unsigned long end, + unsigned long flags) { - addr &=3D PMD_MASK; - for (; addr < end; addr +=3D PMD_SIZE) { + addr &=3D PAGE_MASK; + for (; addr < end; addr +=3D PAGE_SIZE) { + pte_t *pte =3D pte_page + pte_index(addr); + + set_pte(pte, __pte((addr - info->offset) | flags)); + } +} + +pte_t *ident_split_large_pmd(struct x86_mapping_info *info, + pmd_t *pmdp, unsigned long page_addr) +{ + unsigned long pmd_addr, page_flags; + pte_t *pte; + + pte =3D (pte_t *)info->alloc_pgt_page(info->context); + if (!pte) + return NULL; + + pmd_addr =3D page_addr & PMD_MASK; + + /* Not a large page - clear PSE flag */ + page_flags =3D pmd_flags(*pmdp) & ~_PSE; + ident_pte_init(info, pte, pmd_addr, pmd_addr + PMD_SIZE, page_flags); + + return pte; +} + +static int ident_pmd_init(struct x86_mapping_info *info, pmd_t *pmd_page, + unsigned long addr, unsigned long end, + unsigned long flags) +{ + unsigned long next; + bool new_table =3D 0; + + for (; addr < end; addr =3D next) { pmd_t *pmd =3D pmd_page + pmd_index(addr); + pte_t *pte; =20 - if (pmd_present(*pmd)) + next =3D (addr & PMD_MASK) + PMD_SIZE; + if (next > end) + next =3D end; + + /* + * Use 2M pages if 4k pages are not allowed or + * we are not mapping extra, i.e. address and size are aligned. + */ + + if (!info->allow_4kpages || + (!(addr & PMD_MASK) && next =3D=3D addr + PMD_SIZE)) { + + pmd_t pmdval; + + addr &=3D PMD_MASK; + pmdval =3D __pmd((addr - info->offset) | flags | _PSE); + set_pmd(pmd, pmdval); continue; + } + + /* + * If currently mapped page is large, we need to split it. + * The case when we don't can remap 2M page to 2M page + * with different flags is already covered above. + * + * If there's nothing mapped to desired address, + * we need to allocate new page table. + */ =20 - set_pmd(pmd, __pmd((addr - info->offset) | info->page_flag)); + if (pmd_large(*pmd)) { + pte =3D ident_split_large_pmd(info, pmd, addr); + new_table =3D 1; + } else if (!pmd_present(*pmd)) { + pte =3D (pte_t *)info->alloc_pgt_page(info->context); + new_table =3D 1; + } else { + pte =3D pte_offset_kernel(pmd, 0); + new_table =3D 0; + } + + if (!pte) + return -ENOMEM; + + ident_pte_init(info, pte, addr, next, flags); + + if (new_table) + set_pmd(pmd, __pmd(__pa(pte) | info->kernpg_flag)); } + + return 0; } =20 + +pmd_t *ident_split_large_pud(struct x86_mapping_info *info, + pud_t *pudp, unsigned long page_addr) +{ + unsigned long pud_addr, page_flags; + pmd_t *pmd; + + pmd =3D (pmd_t *)info->alloc_pgt_page(info->context); + if (!pmd) + return NULL; + + pud_addr =3D page_addr & PUD_MASK; + + /* Not a large page - clear PSE flag */ + page_flags =3D pud_flags(*pudp) & ~_PSE; + ident_pmd_init(info, pmd, pud_addr, pud_addr + PUD_SIZE, page_flags); + + return pmd; +} + + static int ident_pud_init(struct x86_mapping_info *info, pud_t *pud_page, unsigned long addr, unsigned long end) { unsigned long next; + bool new_table =3D 0; + int result; =20 for (; addr < end; addr =3D next) { pud_t *pud =3D pud_page + pud_index(addr); @@ -31,28 +135,39 @@ static int ident_pud_init(struct x86_mapping_info *inf= o, pud_t *pud_page, if (next > end) next =3D end; =20 + /* Use 1G pages only if forced, even if they are supported. */ if (info->direct_gbpages) { pud_t pudval; - - if (pud_present(*pud)) - continue; + unsigned long flags; =20 addr &=3D PUD_MASK; - pudval =3D __pud((addr - info->offset) | info->page_flag); + flags =3D info->page_flag | _PSE; + pudval =3D __pud((addr - info->offset) | flags); + set_pud(pud, pudval); continue; } =20 - if (pud_present(*pud)) { + if (pud_large(*pud)) { + pmd =3D ident_split_large_pud(info, pud, addr); + new_table =3D 1; + } else if (!pud_present(*pud)) { + pmd =3D (pmd_t *)info->alloc_pgt_page(info->context); + new_table =3D 1; + } else { pmd =3D pmd_offset(pud, 0); - ident_pmd_init(info, pmd, addr, next); - continue; + new_table =3D 0; } - pmd =3D (pmd_t *)info->alloc_pgt_page(info->context); + if (!pmd) return -ENOMEM; - ident_pmd_init(info, pmd, addr, next); - set_pud(pud, __pud(__pa(pmd) | info->kernpg_flag)); + + result =3D ident_pmd_init(info, pmd, addr, next, info->page_flag); + if (result) + return result; + + if (new_table) + set_pud(pud, __pud(__pa(pmd) | info->kernpg_flag)); } =20 return 0; @@ -63,6 +178,7 @@ static int ident_p4d_init(struct x86_mapping_info *info,= p4d_t *p4d_page, { unsigned long next; int result; + bool new_table =3D 0; =20 for (; addr < end; addr =3D next) { p4d_t *p4d =3D p4d_page + p4d_index(addr); @@ -72,15 +188,14 @@ static int ident_p4d_init(struct x86_mapping_info *inf= o, p4d_t *p4d_page, if (next > end) next =3D end; =20 - if (p4d_present(*p4d)) { + if (!p4d_present(*p4d)) { + pud =3D (pud_t *)info->alloc_pgt_page(info->context); + new_table =3D 1; + } else { pud =3D pud_offset(p4d, 0); - result =3D ident_pud_init(info, pud, addr, next); - if (result) - return result; - - continue; + new_table =3D 0; } - pud =3D (pud_t *)info->alloc_pgt_page(info->context); + if (!pud) return -ENOMEM; =20 @@ -88,19 +203,22 @@ static int ident_p4d_init(struct x86_mapping_info *inf= o, p4d_t *p4d_page, if (result) return result; =20 - set_p4d(p4d, __p4d(__pa(pud) | info->kernpg_flag)); + if (new_table) + set_p4d(p4d, __p4d(__pa(pud) | info->kernpg_flag)); } =20 return 0; } =20 -int kernel_ident_mapping_init(struct x86_mapping_info *info, pgd_t *pgd_pa= ge, - unsigned long pstart, unsigned long pend) +int kernel_ident_mapping_init(struct x86_mapping_info *info, + pgd_t *pgd_page, unsigned long pstart, + unsigned long pend) { unsigned long addr =3D pstart + info->offset; unsigned long end =3D pend + info->offset; unsigned long next; int result; + bool new_table; =20 /* Set the default pagetable flags if not supplied */ if (!info->kernpg_flag) @@ -117,20 +235,24 @@ int kernel_ident_mapping_init(struct x86_mapping_info= *info, pgd_t *pgd_page, if (next > end) next =3D end; =20 - if (pgd_present(*pgd)) { + if (!pgd_present(*pgd)) { + p4d =3D (p4d_t *)info->alloc_pgt_page(info->context); + new_table =3D 1; + } else { p4d =3D p4d_offset(pgd, 0); - result =3D ident_p4d_init(info, p4d, addr, next); - if (result) - return result; - continue; + new_table =3D 0; } =20 - p4d =3D (p4d_t *)info->alloc_pgt_page(info->context); if (!p4d) return -ENOMEM; + result =3D ident_p4d_init(info, p4d, addr, next); if (result) return result; + + if (!new_table) + continue; + if (pgtable_l5_enabled()) { set_pgd(pgd, __pgd(__pa(p4d) | info->kernpg_flag)); } else { --=20 2.35.1 From nobody Sun Apr 12 02:53:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB2CDC19F2B for ; Mon, 1 Aug 2022 16:39:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233517AbiHAQjj (ORCPT ); Mon, 1 Aug 2022 12:39:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60220 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233298AbiHAQjO (ORCPT ); Mon, 1 Aug 2022 12:39:14 -0400 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2167330C for ; Mon, 1 Aug 2022 09:39:11 -0700 (PDT) Received: from localhost.localdomain (unknown [92.49.173.143]) by mail.ispras.ru (Postfix) with ESMTPSA id DFDBA4076262; Mon, 1 Aug 2022 16:39:09 +0000 (UTC) From: Evgeniy Baskov To: Borislav Petkov Cc: Evgeniy Baskov , Dave Hansen , Ingo Molnar , Thomas Gleixner , Andy Lutomirski , Peter Zijlstra , x86@kernel.org, linux-kernel@vger.kernel.org, Alexey Khoroshilov Subject: [PATCH 6/8] x86/boot: Setup memory protection for bzImage code Date: Mon, 1 Aug 2022 19:39:03 +0300 Message-Id: <0c4ba2220e3c992d65b567fcc21f298f551c9198.1659369873.git.baskov@ispras.ru> X-Mailer: git-send-email 2.35.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Use previously added code to use 4KB pages for mapping. Map compressed and uncompressed kernel with appropriate memory protection attributes. For compressed kernel set them up manually. For uncompressed kernel used flags specified in ELF header. Move 'boot/compressed/pgtable.h' to common headers to make it accessible from EFISTUB code. Signed-off-by: Evgeniy Baskov delete mode 100644 arch/x86/boot/compressed/pgtable.h create mode 100644 arch/x86/include/asm/shared/pgtable.h diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/= head_64.S index 5273367283b7..4cc1463b98e8 100644 --- a/arch/x86/boot/compressed/head_64.S +++ b/arch/x86/boot/compressed/head_64.S @@ -35,7 +35,7 @@ #include #include #include -#include "pgtable.h" +#include =20 /* * Locally defined symbols should be marked hidden: diff --git a/arch/x86/boot/compressed/ident_map_64.c b/arch/x86/boot/compre= ssed/ident_map_64.c index d4a314cc50d6..04022c080114 100644 --- a/arch/x86/boot/compressed/ident_map_64.c +++ b/arch/x86/boot/compressed/ident_map_64.c @@ -28,6 +28,7 @@ #include #include #include +#include /* Use the static base for this part of the boot process */ #undef __PAGE_OFFSET #define __PAGE_OFFSET __PAGE_OFFSET_BASE @@ -86,24 +87,45 @@ phys_addr_t physical_mask =3D (1ULL << __PHYSICAL_MASK_= SHIFT) - 1; * Due to relocation, pointers must be assigned at run time not build time. */ static struct x86_mapping_info mapping_info; +static bool has_nx; =20 /* * Adds the specified range to the identity mappings. */ -void kernel_add_identity_map(unsigned long start, unsigned long end) +unsigned long kernel_add_identity_map(unsigned long start, + unsigned long end, + unsigned int flags) { int ret; =20 /* Align boundary to 2M. */ - start =3D round_down(start, PMD_SIZE); - end =3D round_up(end, PMD_SIZE); + start =3D round_down(start, PAGE_SIZE); + end =3D round_up(end, PAGE_SIZE); if (start >=3D end) - return; + return start; + + /* Enforce W^X -- just stop booting with error on violation. */ + if ((flags & (MAP_EXEC | MAP_WRITE)) =3D=3D (MAP_EXEC | MAP_WRITE)) + error("Error: W^X violation\n"); + + bool nx =3D !(flags & MAP_EXEC) && has_nx; + bool ro =3D !(flags & MAP_WRITE); + + mapping_info.page_flag =3D sme_me_mask | (nx ? + (ro ? __PAGE_KERNEL_RO : __PAGE_KERNEL) : + (ro ? __PAGE_KERNEL_ROX : __PAGE_KERNEL_EXEC)); =20 /* Build the mapping. */ - ret =3D kernel_ident_mapping_init(&mapping_info, (pgd_t *)top_level_pgt, = start, end); + ret =3D kernel_ident_mapping_init(&mapping_info, + (pgd_t *)top_level_pgt, + start, end); if (ret) error("Error: kernel_ident_mapping_init() failed\n"); + + if (!(flags & MAP_NOFLUSH)) + write_cr3(top_level_pgt); + + return start; } =20 /* Locates and clears a region for a new top level page table. */ @@ -112,14 +134,17 @@ void initialize_identity_maps(void *rmode) unsigned long cmdline; struct setup_data *sd; =20 + boot_params =3D rmode; + /* Exclude the encryption mask from __PHYSICAL_MASK */ physical_mask &=3D ~sme_me_mask; =20 /* Init mapping_info with run-time function/buffer pointers. */ mapping_info.alloc_pgt_page =3D alloc_pgt_page; mapping_info.context =3D &pgt_data; - mapping_info.page_flag =3D __PAGE_KERNEL_LARGE_EXEC | sme_me_mask; + mapping_info.page_flag =3D __PAGE_KERNEL_EXEC | sme_me_mask; mapping_info.kernpg_flag =3D _KERNPG_TABLE; + mapping_info.allow_4kpages =3D 1; =20 /* * It should be impossible for this not to already be true, @@ -151,18 +176,46 @@ void initialize_identity_maps(void *rmode) top_level_pgt =3D (unsigned long)alloc_pgt_page(&pgt_data); } =20 + /* + * Check if this CPU supports NX flag and use + * it appropriately for identity mappings. + */ + + has_nx =3D native_cpuid_edx(0x80000001) & (1 << 20); + if (!has_nx) + debug_putstr("NX bit is not supported.\n"); + /* * New page-table is set up - map the kernel image, boot_params and the * command line. The uncompressed kernel requires boot_params and the - * command line to be mapped in the identity mapping. Map them - * explicitly here in case the compressed kernel does not touch them, - * or does not touch all the pages covering them. + * command line to be mapped in the identity mapping. + * Every other accessed memory region is mapped later, if required. */ - kernel_add_identity_map((unsigned long)_head, (unsigned long)_end); - boot_params =3D rmode; - kernel_add_identity_map((unsigned long)boot_params, (unsigned long)(boot_= params + 1)); + extern char _head[], _ehead[]; + kernel_add_identity_map((unsigned long)_head, + (unsigned long)_ehead, MAP_EXEC | MAP_NOFLUSH); + + extern char _compressed[], _ecompressed[]; + kernel_add_identity_map((unsigned long)_compressed, + (unsigned long)_ecompressed, MAP_WRITE | MAP_NOFLUSH); + + extern char _text[], _etext[]; + kernel_add_identity_map((unsigned long)_text, + (unsigned long)_etext, MAP_EXEC | MAP_NOFLUSH); + + extern char _rodata[], _erodata[]; + kernel_add_identity_map((unsigned long)_rodata, + (unsigned long)_erodata, MAP_NOFLUSH); + + extern char _data[], _end[]; + kernel_add_identity_map((unsigned long)_data, + (unsigned long)_end, MAP_WRITE | MAP_NOFLUSH); + + kernel_add_identity_map((unsigned long)boot_params, + (unsigned long)(boot_params + 1), MAP_WRITE | MAP_NOFLUSH); + cmdline =3D get_cmd_line_ptr(); - kernel_add_identity_map(cmdline, cmdline + COMMAND_LINE_SIZE); + kernel_add_identity_map(cmdline, cmdline + COMMAND_LINE_SIZE, MAP_NOFLUSH= ); =20 /* * Also map the setup_data entries passed via boot_params in case they @@ -172,7 +225,7 @@ void initialize_identity_maps(void *rmode) while (sd) { unsigned long sd_addr =3D (unsigned long)sd; =20 - kernel_add_identity_map(sd_addr, sd_addr + sizeof(*sd) + sd->len); + kernel_add_identity_map(sd_addr, sd_addr + sizeof(*sd) + sd->len, MAP_NO= FLUSH); sd =3D (struct setup_data *)sd->next; } =20 @@ -185,26 +238,11 @@ void initialize_identity_maps(void *rmode) static pte_t *split_large_pmd(struct x86_mapping_info *info, pmd_t *pmdp, unsigned long __address) { - unsigned long page_flags; - unsigned long address; - pte_t *pte; - pmd_t pmd; - int i; - - pte =3D (pte_t *)info->alloc_pgt_page(info->context); + unsigned long address =3D __address & PMD_MASK; + pte_t *pte =3D ident_split_large_pmd(info, pmdp, address); if (!pte) return NULL; =20 - address =3D __address & PMD_MASK; - /* No large page - clear PSE flag */ - page_flags =3D info->page_flag & ~_PAGE_PSE; - - /* Populate the PTEs */ - for (i =3D 0; i < PTRS_PER_PMD; i++) { - set_pte(&pte[i], __pte(address | page_flags)); - address +=3D PAGE_SIZE; - } - /* * Ideally we need to clear the large PMD first and do a TLB * flush before we write the new PMD. But the 2M range of the @@ -214,7 +252,7 @@ static pte_t *split_large_pmd(struct x86_mapping_info *= info, * also the only user of the page-table, so there is no chance * of a TLB multihit. */ - pmd =3D __pmd((unsigned long)pte | info->kernpg_flag); + pmd_t pmd =3D __pmd((unsigned long)pte | info->kernpg_flag); set_pmd(pmdp, pmd); /* Flush TLB to establish the new PMD */ write_cr3(top_level_pgt); @@ -377,5 +415,5 @@ void do_boot_page_fault(struct pt_regs *regs, unsigned = long error_code) * Error code is sane - now identity map the 2M region around * the faulting address. */ - kernel_add_identity_map(address, end); + kernel_add_identity_map(address, end, MAP_WRITE); } diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/mis= c.c index cf690d8712f4..49f6cc7a7bde 100644 --- a/arch/x86/boot/compressed/misc.c +++ b/arch/x86/boot/compressed/misc.c @@ -14,10 +14,10 @@ =20 #include "misc.h" #include "error.h" -#include "pgtable.h" #include "../string.h" #include "../voffset.h" #include +#include =20 /* * WARNING!! @@ -277,7 +277,8 @@ static inline void handle_relocations(void *output, uns= igned long output_len, { } #endif =20 -static void parse_elf(void *output) +static void parse_elf(void *output, unsigned long output_len, + unsigned long virt_addr) { #ifdef CONFIG_X86_64 Elf64_Ehdr ehdr; @@ -287,6 +288,7 @@ static void parse_elf(void *output) Elf32_Phdr *phdrs, *phdr; #endif void *dest; + unsigned long addr; int i; =20 memcpy(&ehdr, output, sizeof(ehdr)); @@ -323,7 +325,43 @@ static void parse_elf(void *output) #endif memmove(dest, output + phdr->p_offset, phdr->p_filesz); break; - default: /* Ignore other PT_* */ break; + default: + /* Ignore other PT_* */ + break; + } + } + + handle_relocations(output, output_len, virt_addr); + + for (i =3D 0; i < ehdr.e_phnum; i++) { + phdr =3D &phdrs[i]; + + switch (phdr->p_type) { + case PT_LOAD: +#ifdef CONFIG_RELOCATABLE + addr =3D (unsigned long)output; + addr +=3D (phdr->p_paddr - LOAD_PHYSICAL_ADDR); +#else + addr =3D phdr->p_paddr; +#endif + /* + * Simultaneously readable and writable segments are + * violating W^X, and should not be present in vmlinux image. + */ + if ((phdr->p_flags & (PF_X | PF_W)) =3D=3D (PF_X | PF_W)) + error("W^X violation for ELF segment"); + + unsigned int flags =3D MAP_PROTECT; + if (phdr->p_flags & PF_X) + flags |=3D MAP_EXEC; + if (phdr->p_flags & PF_W) + flags |=3D MAP_WRITE; + + kernel_add_identity_map(addr, addr + phdr->p_memsz, flags); + break; + default: + /* Ignore other PT_* */ + break; } } =20 @@ -434,6 +472,11 @@ asmlinkage __visible void *extract_kernel(void *rmode,= memptr heap, needed_size, &virt_addr); =20 + unsigned long phys_addr =3D (unsigned long)output; + output =3D (unsigned char *)kernel_add_identity_map(phys_addr, + phys_addr + needed_size, + MAP_ALLOC | MAP_WRITE); + /* Validate memory location choices. */ if ((unsigned long)output & (MIN_KERNEL_ALIGN - 1)) error("Destination physical address inappropriately aligned"); @@ -456,8 +499,7 @@ asmlinkage __visible void *extract_kernel(void *rmode, = memptr heap, debug_putstr("\nDecompressing Linux... "); __decompress(input_data, input_len, NULL, NULL, output, output_len, NULL, error); - parse_elf(output); - handle_relocations(output, output_len, virt_addr); + parse_elf(output, output_len, virt_addr); debug_putstr("done.\nBooting the kernel.\n"); =20 /* Disable exception handling before booting the kernel */ diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/mis= c.h index 4910bf230d7b..699b87b7813a 100644 --- a/arch/x86/boot/compressed/misc.h +++ b/arch/x86/boot/compressed/misc.h @@ -161,8 +161,20 @@ static inline int count_immovable_mem_regions(void) { = return 0; } #ifdef CONFIG_X86_5LEVEL extern unsigned int __pgtable_l5_enabled, pgdir_shift, ptrs_per_p4d; #endif -extern void kernel_add_identity_map(unsigned long start, unsigned long end= ); - +#ifdef CONFIG_X86_64 +extern unsigned long kernel_add_identity_map(unsigned long start, + unsigned long end, + unsigned int flags); +#else +static inline unsigned long kernel_add_identity_map(unsigned long start, + unsigned long end, + unsigned int flags) +{ + (void)flags; + (void)end; + return start; +} +#endif /* Used by PAGE_KERN* macros: */ extern pteval_t __default_kernel_pte_mask; =20 diff --git a/arch/x86/boot/compressed/pgtable.h b/arch/x86/boot/compressed/= pgtable.h deleted file mode 100644 index cc9b2529a086..000000000000 --- a/arch/x86/boot/compressed/pgtable.h +++ /dev/null @@ -1,20 +0,0 @@ -#ifndef BOOT_COMPRESSED_PAGETABLE_H -#define BOOT_COMPRESSED_PAGETABLE_H - -#define TRAMPOLINE_32BIT_SIZE (2 * PAGE_SIZE) - -#define TRAMPOLINE_32BIT_PGTABLE_OFFSET 0 - -#define TRAMPOLINE_32BIT_CODE_OFFSET PAGE_SIZE -#define TRAMPOLINE_32BIT_CODE_SIZE 0x80 - -#define TRAMPOLINE_32BIT_STACK_END TRAMPOLINE_32BIT_SIZE - -#ifndef __ASSEMBLER__ - -extern unsigned long *trampoline_32bit; - -extern void trampoline_32bit_src(void *return_ptr); - -#endif /* __ASSEMBLER__ */ -#endif /* BOOT_COMPRESSED_PAGETABLE_H */ diff --git a/arch/x86/boot/compressed/pgtable_64.c b/arch/x86/boot/compress= ed/pgtable_64.c index 2ac12ff4111b..c7cf5a1059a8 100644 --- a/arch/x86/boot/compressed/pgtable_64.c +++ b/arch/x86/boot/compressed/pgtable_64.c @@ -2,7 +2,7 @@ #include "misc.h" #include #include -#include "pgtable.h" +#include #include "../string.h" #include "efi.h" =20 diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c index 52f989f6acc2..82a10395cf22 100644 --- a/arch/x86/boot/compressed/sev.c +++ b/arch/x86/boot/compressed/sev.c @@ -13,6 +13,7 @@ #include "misc.h" =20 #include +#include #include #include #include @@ -427,10 +428,11 @@ void sev_prep_identity_maps(unsigned long top_level_p= gt) unsigned long cc_info_pa =3D boot_params->cc_blob_address; struct cc_blob_sev_info *cc_info; =20 - kernel_add_identity_map(cc_info_pa, cc_info_pa + sizeof(*cc_info)); + kernel_add_identity_map(cc_info_pa, cc_info_pa + sizeof(*cc_info), MAP_N= OFLUSH); =20 cc_info =3D (struct cc_blob_sev_info *)cc_info_pa; - kernel_add_identity_map(cc_info->cpuid_phys, cc_info->cpuid_phys + cc_in= fo->cpuid_len); + kernel_add_identity_map(cc_info->cpuid_phys, + cc_info->cpuid_phys + cc_info->cpuid_len, MAP_NOFLUSH); } =20 sev_verify_cbit(top_level_pgt); diff --git a/arch/x86/include/asm/shared/pgtable.h b/arch/x86/include/asm/s= hared/pgtable.h new file mode 100644 index 000000000000..6527dadf39d6 --- /dev/null +++ b/arch/x86/include/asm/shared/pgtable.h @@ -0,0 +1,30 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef ASM_SHARED_PAGETABLE_H +#define ASM_SHARED_PAGETABLE_H + +/* Boot time memory mapping flags used in compressed kernel */ +#define MAP_WRITE 0x02 /* Writable memory */ +#define MAP_EXEC 0x04 /* Executable memory */ +#define MAP_ALLOC 0x10 /* Range needs to be allocated */ +#define MAP_PROTECT 0x20 /* Set exact memory attributes for memory range */ +#define MAP_NOFLUSH 0x40 /* Avoid flushing TLB */ + +#define TRAMPOLINE_32BIT_SIZE (3 * PAGE_SIZE) + +#define TRAMPOLINE_32BIT_PLACEMENT_MAX (0xA0000) + +#define TRAMPOLINE_32BIT_PGTABLE_OFFSET 0 + +#define TRAMPOLINE_32BIT_CODE_OFFSET PAGE_SIZE +#define TRAMPOLINE_32BIT_CODE_SIZE 0x80 + +#define TRAMPOLINE_32BIT_STACK_END TRAMPOLINE_32BIT_SIZE + +#ifndef __ASSEMBLER__ + +extern unsigned long *trampoline_32bit; + +extern void trampoline_32bit_src(void *return_ptr); + +#endif /* __ASSEMBLER__ */ +#endif /* ASM_SHARED_PAGETABLE_H */ --=20 2.35.1 From nobody Sun Apr 12 02:53:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A6B10C00144 for ; Mon, 1 Aug 2022 16:39:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233918AbiHAQjf (ORCPT ); Mon, 1 Aug 2022 12:39:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60200 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233281AbiHAQjN (ORCPT ); Mon, 1 Aug 2022 12:39:13 -0400 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4DAA0C0B for ; Mon, 1 Aug 2022 09:39:12 -0700 (PDT) Received: from localhost.localdomain (unknown [92.49.173.143]) by mail.ispras.ru (Postfix) with ESMTPSA id 63EDA4076263; Mon, 1 Aug 2022 16:39:10 +0000 (UTC) From: Evgeniy Baskov To: Borislav Petkov Cc: Evgeniy Baskov , Dave Hansen , Ingo Molnar , Thomas Gleixner , Andy Lutomirski , Peter Zijlstra , x86@kernel.org, linux-kernel@vger.kernel.org, Alexey Khoroshilov Subject: [PATCH 7/8] x86/boot: Map memory explicitly Date: Mon, 1 Aug 2022 19:39:04 +0300 Message-Id: X-Mailer: git-send-email 2.35.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Implicit mappings hide possible memory errors, e.g. allocations for ACPI tables were not included in boot page table size. Replace all implicit mappings from page fault handler with explicit mappings. Signed-off-by: Evgeniy Baskov diff --git a/arch/x86/boot/compressed/acpi.c b/arch/x86/boot/compressed/acp= i.c index 9caf89063e77..633ac56262ee 100644 --- a/arch/x86/boot/compressed/acpi.c +++ b/arch/x86/boot/compressed/acpi.c @@ -93,6 +93,8 @@ static u8 *scan_mem_for_rsdp(u8 *start, u32 length) =20 end =3D start + length; =20 + kernel_add_identity_map((unsigned long)start, (unsigned long)end, 0); + /* Search from given start address for the requested length */ for (address =3D start; address < end; address +=3D ACPI_RSDP_SCAN_STEP) { /* @@ -128,6 +130,9 @@ static acpi_physical_address bios_get_rsdp_addr(void) unsigned long address; u8 *rsdp; =20 + kernel_add_identity_map((unsigned long)ACPI_EBDA_PTR_LOCATION, + (unsigned long)ACPI_EBDA_PTR_LOCATION + 2, 0); + /* Get the location of the Extended BIOS Data Area (EBDA) */ address =3D *(u16 *)ACPI_EBDA_PTR_LOCATION; address <<=3D 4; @@ -215,6 +220,9 @@ static unsigned long get_acpi_srat_table(void) if (!rsdp) return 0; =20 + kernel_add_identity_map((unsigned long)rsdp, + (unsigned long)(rsdp + 1), 0); + /* Get ACPI root table from RSDP.*/ if (!(cmdline_find_option("acpi", arg, sizeof(arg)) =3D=3D 4 && !strncmp(arg, "rsdt", 4)) && @@ -235,6 +243,9 @@ static unsigned long get_acpi_srat_table(void) if (len < sizeof(struct acpi_table_header) + size) return 0; =20 + kernel_add_identity_map((unsigned long)header, + (unsigned long)header + len, 0); + num_entries =3D (len - sizeof(struct acpi_table_header)) / size; entry =3D (u8 *)(root_table + sizeof(struct acpi_table_header)); =20 @@ -247,8 +258,16 @@ static unsigned long get_acpi_srat_table(void) if (acpi_table) { header =3D (struct acpi_table_header *)acpi_table; =20 - if (ACPI_COMPARE_NAMESEG(header->signature, ACPI_SIG_SRAT)) + kernel_add_identity_map(acpi_table, + acpi_table + sizeof(*header), + 0); + + if (ACPI_COMPARE_NAMESEG(header->signature, ACPI_SIG_SRAT)) { + kernel_add_identity_map(acpi_table, + acpi_table + header->length, + 0); return acpi_table; + } } entry +=3D size; } diff --git a/arch/x86/boot/compressed/efi.c b/arch/x86/boot/compressed/efi.c index 6edd034b0b30..ce70103fbbc0 100644 --- a/arch/x86/boot/compressed/efi.c +++ b/arch/x86/boot/compressed/efi.c @@ -57,10 +57,14 @@ enum efi_type efi_get_type(struct boot_params *bp) */ unsigned long efi_get_system_table(struct boot_params *bp) { - unsigned long sys_tbl_pa; + static unsigned long sys_tbl_pa __section(".data"); struct efi_info *ei; + unsigned long sys_tbl_size; enum efi_type et; =20 + if (sys_tbl_pa) + return sys_tbl_pa; + /* Get systab from boot params. */ ei =3D &bp->efi_info; #ifdef CONFIG_X86_64 @@ -73,6 +77,13 @@ unsigned long efi_get_system_table(struct boot_params *b= p) return 0; } =20 + if (efi_get_type(bp) =3D=3D EFI_TYPE_64) + sys_tbl_size =3D sizeof(efi_system_table_64_t); + else + sys_tbl_size =3D sizeof(efi_system_table_32_t); + + kernel_add_identity_map(sys_tbl_pa, sys_tbl_pa + sys_tbl_size, 0); + return sys_tbl_pa; } =20 @@ -92,6 +103,10 @@ static struct efi_setup_data *get_kexec_setup_data(stru= ct boot_params *bp, =20 pa_data =3D bp->hdr.setup_data; while (pa_data) { + unsigned long pa_data_end =3D pa_data + sizeof(struct setup_data) + + sizeof(struct efi_setup_data); + kernel_add_identity_map(pa_data, pa_data_end, 0); + data =3D (struct setup_data *)pa_data; if (data->type =3D=3D SETUP_EFI) { esd =3D (struct efi_setup_data *)(pa_data + sizeof(struct setup_data)); @@ -160,6 +175,8 @@ int efi_get_conf_table(struct boot_params *bp, unsigned= long *cfg_tbl_pa, return -EINVAL; } =20 + kernel_add_identity_map(*cfg_tbl_pa, *cfg_tbl_pa + *cfg_tbl_len, 0); + return 0; } =20 diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/ka= slr.c index 4a3f223973f4..073c7cfbd785 100644 --- a/arch/x86/boot/compressed/kaslr.c +++ b/arch/x86/boot/compressed/kaslr.c @@ -687,6 +687,8 @@ process_efi_entries(unsigned long minimum, unsigned lon= g image_size) u32 nr_desc; int i; =20 + kernel_add_identity_map((unsigned long)e, (unsigned long)(e + 1), 0); + signature =3D (char *)&e->efi_loader_signature; if (strncmp(signature, EFI32_LOADER_SIGNATURE, 4) && strncmp(signature, EFI64_LOADER_SIGNATURE, 4)) @@ -703,6 +705,8 @@ process_efi_entries(unsigned long minimum, unsigned lon= g image_size) pmap =3D (e->efi_memmap | ((__u64)e->efi_memmap_hi << 32)); #endif =20 + kernel_add_identity_map(pmap, pmap + e->efi_memmap_size, 0); + nr_desc =3D e->efi_memmap_size / e->efi_memdesc_size; for (i =3D 0; i < nr_desc; i++) { md =3D efi_early_memdesc_ptr(pmap, e->efi_memdesc_size, i); --=20 2.35.1 From nobody Sun Apr 12 02:53:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D669DC00144 for ; Mon, 1 Aug 2022 16:39:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233904AbiHAQjb (ORCPT ); Mon, 1 Aug 2022 12:39:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60202 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233274AbiHAQjN (ORCPT ); Mon, 1 Aug 2022 12:39:13 -0400 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A35FEC0C for ; Mon, 1 Aug 2022 09:39:12 -0700 (PDT) Received: from localhost.localdomain (unknown [92.49.173.143]) by mail.ispras.ru (Postfix) with ESMTPSA id D9A09407626A; Mon, 1 Aug 2022 16:39:10 +0000 (UTC) From: Evgeniy Baskov To: Borislav Petkov Cc: Evgeniy Baskov , Dave Hansen , Ingo Molnar , Thomas Gleixner , Andy Lutomirski , Peter Zijlstra , x86@kernel.org, linux-kernel@vger.kernel.org, Alexey Khoroshilov Subject: [PATCH 8/8] x86/boot: Remove mapping from page fault handler Date: Mon, 1 Aug 2022 19:39:05 +0300 Message-Id: <25ecf8d7109600757b69ea167cc964419878ec21.1659369873.git.baskov@ispras.ru> X-Mailer: git-send-email 2.35.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" After every implicit mapping is removed, this code is no longer needed. Remove memory mapping from page fault handler to ensure that there are no hidden invalid memory accesses. Signed-off-by: Evgeniy Baskov diff --git a/arch/x86/boot/compressed/ident_map_64.c b/arch/x86/boot/compre= ssed/ident_map_64.c index 04022c080114..ad24289cc224 100644 --- a/arch/x86/boot/compressed/ident_map_64.c +++ b/arch/x86/boot/compressed/ident_map_64.c @@ -393,27 +393,21 @@ void do_boot_page_fault(struct pt_regs *regs, unsigne= d long error_code) { unsigned long address =3D native_read_cr2(); unsigned long end; - bool ghcb_fault; + char *msg; =20 - ghcb_fault =3D sev_es_check_ghcb_fault(address); + if (sev_es_check_ghcb_fault(address)) + msg =3D "Page-fault on GHCB page:"; + else + msg =3D "Unexpected page-fault:"; =20 address &=3D PMD_MASK; end =3D address + PMD_SIZE; =20 /* - * Check for unexpected error codes. Unexpected are: - * - Faults on present pages - * - User faults - * - Reserved bits set - */ - if (error_code & (X86_PF_PROT | X86_PF_USER | X86_PF_RSVD)) - do_pf_error("Unexpected page-fault:", error_code, address, regs->ip); - else if (ghcb_fault) - do_pf_error("Page-fault on GHCB page:", error_code, address, regs->ip); - - /* - * Error code is sane - now identity map the 2M region around - * the faulting address. + * Since all memory allocations are made explicit + * now, every page fault at this stage is an + * error and the error handler is there only + * for debug purposes. */ - kernel_add_identity_map(address, end, MAP_WRITE); + do_pf_error(msg, error_code, address, regs->ip); } --=20 2.35.1