This is a note to let you know that I've just added the patch titled
x86/boot/compressed: Move startup32_check_sev_cbit() into .text
to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
x86-boot-compressed-move-startup32_check_sev_cbit-into-.text.patch
and it can be found in the queue-6.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From b5d854cd4b6a314edd6c15dabc4233b84a0f8e5e Mon Sep 17 00:00:00 2001
From: Ard Biesheuvel <ardb@xxxxxxxxxx>
Date: Tue, 22 Nov 2022 17:10:13 +0100
Subject: x86/boot/compressed: Move startup32_check_sev_cbit() into .text
From: Ard Biesheuvel <ardb@xxxxxxxxxx>
commit b5d854cd4b6a314edd6c15dabc4233b84a0f8e5e upstream.
Move startup32_check_sev_cbit() into the .text section and turn it into
an ordinary function using the ordinary 32-bit calling convention,
instead of saving/restoring the registers that are known to be live at
the only call site. This improves maintainability, and makes it possible
to move this function out of head_64.S and into a separate compilation
unit that is specific to memory encryption.
Note that this requires the call site to be moved before the mixed mode
check, as %eax will be live otherwise.
Signed-off-by: Ard Biesheuvel <ardb@xxxxxxxxxx>
Signed-off-by: Borislav Petkov <bp@xxxxxxx>
Link: https://lore.kernel.org/r/20221122161017.2426828-14-ardb@xxxxxxxxxx
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
arch/x86/boot/compressed/head_64.S | 35 +++++++++++++++++++----------------
1 file changed, 19 insertions(+), 16 deletions(-)
--- a/arch/x86/boot/compressed/head_64.S
+++ b/arch/x86/boot/compressed/head_64.S
@@ -251,6 +251,11 @@ SYM_FUNC_START(startup_32)
movl $__BOOT_TSS, %eax
ltr %ax
+#ifdef CONFIG_AMD_MEM_ENCRYPT
+ /* Check if the C-bit position is correct when SEV is active */
+ call startup32_check_sev_cbit
+#endif
+
/*
* Setup for the jump to 64bit mode
*
@@ -268,8 +273,6 @@ SYM_FUNC_START(startup_32)
leal rva(startup_64_mixed_mode)(%ebp), %eax
1:
#endif
- /* Check if the C-bit position is correct when SEV is active */
- call startup32_check_sev_cbit
pushl $__KERNEL_CS
pushl %eax
@@ -740,16 +743,17 @@ SYM_DATA_END_LABEL(boot_idt, SYM_L_GLOBA
* succeed. An incorrect C-bit position will map all memory unencrypted, so that
* the compare will use the encrypted random data and fail.
*/
- __HEAD
-SYM_FUNC_START(startup32_check_sev_cbit)
#ifdef CONFIG_AMD_MEM_ENCRYPT
- pushl %eax
+ .text
+SYM_FUNC_START(startup32_check_sev_cbit)
pushl %ebx
- pushl %ecx
- pushl %edx
+ pushl %ebp
+
+ call 0f
+0: popl %ebp
/* Check for non-zero sev_status */
- movl rva(sev_status)(%ebp), %eax
+ movl (sev_status - 0b)(%ebp), %eax
testl %eax, %eax
jz 4f
@@ -764,17 +768,18 @@ SYM_FUNC_START(startup32_check_sev_cbit)
jnc 2b
/* Store to memory and keep it in the registers */
- movl %eax, rva(sev_check_data)(%ebp)
- movl %ebx, rva(sev_check_data+4)(%ebp)
+ leal (sev_check_data - 0b)(%ebp), %ebp
+ movl %eax, 0(%ebp)
+ movl %ebx, 4(%ebp)
/* Enable paging to see if encryption is active */
movl %cr0, %edx /* Backup %cr0 in %edx */
movl $(X86_CR0_PG | X86_CR0_PE), %ecx /* Enable Paging and Protected mode */
movl %ecx, %cr0
- cmpl %eax, rva(sev_check_data)(%ebp)
+ cmpl %eax, 0(%ebp)
jne 3f
- cmpl %ebx, rva(sev_check_data+4)(%ebp)
+ cmpl %ebx, 4(%ebp)
jne 3f
movl %edx, %cr0 /* Restore previous %cr0 */
@@ -786,13 +791,11 @@ SYM_FUNC_START(startup32_check_sev_cbit)
jmp 3b
4:
- popl %edx
- popl %ecx
+ popl %ebp
popl %ebx
- popl %eax
-#endif
RET
SYM_FUNC_END(startup32_check_sev_cbit)
+#endif
/*
* Stack and heap for uncompression
Patches currently in stable-queue which might be from ardb@xxxxxxxxxx are
queue-6.1/x86-boot-compressed-avoid-touching-ecx-in-startup32_set_idt_entry.patch
queue-6.1/x86-boot-compressed-only-build-mem_encrypt.s-if-amd_mem_encrypt-y.patch
queue-6.1/efi-capsule-loader-fix-incorrect-allocation-size.patch
queue-6.1/x86-decompressor-move-global-symbol-references-to-c-code.patch
queue-6.1/x86-boot-compressed-move-startup32_load_idt-into-.text-section.patch
queue-6.1/x86-decompressor-only-call-the-trampoline-when-changing-paging-levels.patch
queue-6.1/x86-boot-compressed-rename-efi_thunk_64.s-to-efi-mixed.s.patch
queue-6.1/x86-decompressor-merge-trampoline-cleanup-with-switching-code.patch
queue-6.1/x86-boot-compressed-move-efi32_pe_entry-out-of-head_64.s.patch
queue-6.1/efi-verify-that-variable-services-are-supported.patch
queue-6.1/x86-decompressor-call-trampoline-directly-from-c-code.patch
queue-6.1/x86-boot-compressed-pull-global-variable-reference-into-startup32_load_idt.patch
queue-6.1/x86-boot-compressed-simplify-idt-gdt-preserve-restore-in-the-efi-thunk.patch
queue-6.1/x86-decompressor-assign-paging-related-global-variables-earlier.patch
queue-6.1/x86-boot-compressed-move-32-bit-entrypoint-code-into-.text-section.patch
queue-6.1/x86-boot-compressed-move-efi32_pe_entry-into-.text-section.patch
queue-6.1/x86-decompressor-avoid-the-need-for-a-stack-in-the-32-bit-trampoline.patch
queue-6.1/x86-boot-compressed-move-startup32_check_sev_cbit-out-of-head_64.s.patch
queue-6.1/x86-boot-compressed-efi-merge-multiple-definitions-of-image_offset-into-one.patch
queue-6.1/x86-boot-compressed-move-startup32_load_idt-out-of-head_64.s.patch
queue-6.1/decompress-use-8-byte-alignment.patch
queue-6.1/x86-boot-compressed-move-efi32_entry-out-of-head_64.s.patch
queue-6.1/efi-libstub-use-efi_loader_code-region-when-moving-the-kernel-in-memory.patch
queue-6.1/crypto-arm64-neonbs-fix-out-of-bounds-access-on-short-input.patch
queue-6.1/x86-boot-compressed-move-bootargs-parsing-out-of-32-bit-startup-code.patch
queue-6.1/efivarfs-request-at-most-512-bytes-for-variable-names.patch
queue-6.1/x86-boot-compressed-adhere-to-calling-convention-in-get_sev_encryption_bit.patch
queue-6.1/x86-boot-compressed-move-startup32_check_sev_cbit-into-.text.patch
queue-6.1/x86-decompressor-store-boot_params-pointer-in-callee-save-register.patch
queue-6.1/x86-efistub-branch-straight-to-kernel-entry-point-from-c-code.patch
queue-6.1/x86-decompressor-call-trampoline-as-a-normal-function.patch
queue-6.1/x86-decompressor-pass-pgtable-address-to-trampoline-directly.patch
queue-6.1/x86-decompressor-use-standard-calling-convention-for-trampoline.patch
queue-6.1/x86-efi-make-the-deprecated-efi-handover-protocol-optional.patch
