This is a note to let you know that I've just added the patch titled
x86/decompressor: Pass pgtable address to trampoline directly
to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
x86-decompressor-pass-pgtable-address-to-trampoline-directly.patch
and it can be found in the queue-6.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From cb83cece57e1889109dd73ea08ee338668c9d1b8 Mon Sep 17 00:00:00 2001
From: Ard Biesheuvel <ardb@xxxxxxxxxx>
Date: Mon, 7 Aug 2023 18:27:11 +0200
Subject: x86/decompressor: Pass pgtable address to trampoline directly
From: Ard Biesheuvel <ardb@xxxxxxxxxx>
commit cb83cece57e1889109dd73ea08ee338668c9d1b8 upstream.
The only remaining use of the trampoline address by the trampoline
itself is deriving the page table address from it, and this involves
adding an offset of 0x0. So simplify this, and pass the new CR3 value
directly.
This makes the fact that the page table happens to be at the start of
the trampoline allocation an implementation detail of the caller.
Signed-off-by: Ard Biesheuvel <ardb@xxxxxxxxxx>
Signed-off-by: Borislav Petkov (AMD) <bp@xxxxxxxxx>
Link: https://lore.kernel.org/r/20230807162720.545787-15-ardb@xxxxxxxxxx
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
arch/x86/boot/compressed/head_64.S | 8 ++++----
arch/x86/boot/compressed/pgtable.h | 2 --
arch/x86/boot/compressed/pgtable_64.c | 9 ++++-----
3 files changed, 8 insertions(+), 11 deletions(-)
--- a/arch/x86/boot/compressed/head_64.S
+++ b/arch/x86/boot/compressed/head_64.S
@@ -539,8 +539,9 @@ SYM_FUNC_END(.Lrelocated)
* running in 64-bit mode.
*
* Return address is at the top of the stack (might be above 4G).
- * The first argument (EDI) contains the 32-bit addressable base of the
- * trampoline memory.
+ * The first argument (EDI) contains the address of the temporary PGD level
+ * page table in 32-bit addressable memory which will be programmed into
+ * register CR3.
*/
.section ".rodata", "a", @progbits
SYM_CODE_START(trampoline_32bit_src)
@@ -593,8 +594,7 @@ SYM_CODE_START(trampoline_32bit_src)
movl %eax, %cr0
/* Point CR3 to the trampoline's new top level page table */
- leal TRAMPOLINE_32BIT_PGTABLE_OFFSET(%edi), %eax
- movl %eax, %cr3
+ movl %edi, %cr3
/* Set EFER.LME=1 as a precaution in case hypervsior pulls the rug */
movl $MSR_EFER, %ecx
--- a/arch/x86/boot/compressed/pgtable.h
+++ b/arch/x86/boot/compressed/pgtable.h
@@ -3,8 +3,6 @@
#define TRAMPOLINE_32BIT_SIZE (2 * PAGE_SIZE)
-#define TRAMPOLINE_32BIT_PGTABLE_OFFSET 0
-
#define TRAMPOLINE_32BIT_CODE_OFFSET PAGE_SIZE
#define TRAMPOLINE_32BIT_CODE_SIZE 0xA0
--- a/arch/x86/boot/compressed/pgtable_64.c
+++ b/arch/x86/boot/compressed/pgtable_64.c
@@ -103,7 +103,7 @@ static unsigned long find_trampoline_pla
asmlinkage void configure_5level_paging(struct boot_params *bp)
{
- void (*toggle_la57)(void *trampoline);
+ void (*toggle_la57)(void *cr3);
bool l5_required = false;
/* Initialize boot_params. Required for cmdline_find_option_bool(). */
@@ -174,7 +174,7 @@ asmlinkage void configure_5level_paging(
* For 4- to 5-level paging transition, set up current CR3 as
* the first and the only entry in a new top-level page table.
*/
- trampoline_32bit[TRAMPOLINE_32BIT_PGTABLE_OFFSET] = __native_read_cr3() | _PAGE_TABLE_NOENC;
+ *trampoline_32bit = __native_read_cr3() | _PAGE_TABLE_NOENC;
} else {
unsigned long src;
@@ -187,8 +187,7 @@ asmlinkage void configure_5level_paging(
* may be above 4G.
*/
src = *(unsigned long *)__native_read_cr3() & PAGE_MASK;
- memcpy(trampoline_32bit + TRAMPOLINE_32BIT_PGTABLE_OFFSET / sizeof(unsigned long),
- (void *)src, PAGE_SIZE);
+ memcpy(trampoline_32bit, (void *)src, PAGE_SIZE);
}
toggle_la57(trampoline_32bit);
@@ -198,7 +197,7 @@ void cleanup_trampoline(void *pgtable)
{
void *trampoline_pgtable;
- trampoline_pgtable = trampoline_32bit + TRAMPOLINE_32BIT_PGTABLE_OFFSET / sizeof(unsigned long);
+ trampoline_pgtable = trampoline_32bit;
/*
* Move the top level page table out of trampoline memory,
Patches currently in stable-queue which might be from ardb@xxxxxxxxxx are
queue-6.1/x86-boot-compressed-avoid-touching-ecx-in-startup32_set_idt_entry.patch
queue-6.1/x86-boot-compressed-only-build-mem_encrypt.s-if-amd_mem_encrypt-y.patch
queue-6.1/efi-capsule-loader-fix-incorrect-allocation-size.patch
queue-6.1/x86-decompressor-move-global-symbol-references-to-c-code.patch
queue-6.1/x86-boot-compressed-move-startup32_load_idt-into-.text-section.patch
queue-6.1/x86-decompressor-only-call-the-trampoline-when-changing-paging-levels.patch
queue-6.1/x86-boot-compressed-rename-efi_thunk_64.s-to-efi-mixed.s.patch
queue-6.1/x86-decompressor-merge-trampoline-cleanup-with-switching-code.patch
queue-6.1/x86-boot-compressed-move-efi32_pe_entry-out-of-head_64.s.patch
queue-6.1/efi-verify-that-variable-services-are-supported.patch
queue-6.1/x86-decompressor-call-trampoline-directly-from-c-code.patch
queue-6.1/x86-boot-compressed-pull-global-variable-reference-into-startup32_load_idt.patch
queue-6.1/x86-boot-compressed-simplify-idt-gdt-preserve-restore-in-the-efi-thunk.patch
queue-6.1/x86-decompressor-assign-paging-related-global-variables-earlier.patch
queue-6.1/x86-boot-compressed-move-32-bit-entrypoint-code-into-.text-section.patch
queue-6.1/x86-boot-compressed-move-efi32_pe_entry-into-.text-section.patch
queue-6.1/x86-decompressor-avoid-the-need-for-a-stack-in-the-32-bit-trampoline.patch
queue-6.1/x86-boot-compressed-move-startup32_check_sev_cbit-out-of-head_64.s.patch
queue-6.1/x86-boot-compressed-efi-merge-multiple-definitions-of-image_offset-into-one.patch
queue-6.1/x86-boot-compressed-move-startup32_load_idt-out-of-head_64.s.patch
queue-6.1/decompress-use-8-byte-alignment.patch
queue-6.1/x86-boot-compressed-move-efi32_entry-out-of-head_64.s.patch
queue-6.1/efi-libstub-use-efi_loader_code-region-when-moving-the-kernel-in-memory.patch
queue-6.1/crypto-arm64-neonbs-fix-out-of-bounds-access-on-short-input.patch
queue-6.1/x86-boot-compressed-move-bootargs-parsing-out-of-32-bit-startup-code.patch
queue-6.1/efivarfs-request-at-most-512-bytes-for-variable-names.patch
queue-6.1/x86-boot-compressed-adhere-to-calling-convention-in-get_sev_encryption_bit.patch
queue-6.1/x86-boot-compressed-move-startup32_check_sev_cbit-into-.text.patch
queue-6.1/x86-decompressor-store-boot_params-pointer-in-callee-save-register.patch
queue-6.1/x86-efistub-branch-straight-to-kernel-entry-point-from-c-code.patch
queue-6.1/x86-decompressor-call-trampoline-as-a-normal-function.patch
queue-6.1/x86-decompressor-pass-pgtable-address-to-trampoline-directly.patch
queue-6.1/x86-decompressor-use-standard-calling-convention-for-trampoline.patch
queue-6.1/x86-efi-make-the-deprecated-efi-handover-protocol-optional.patch
