| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20250504095230.2932860-25-ardb+git@google.com>
Date: Sun, 4 May 2025 11:52:30 +0200
From: Ard Biesheuvel <ardb+git@...gle.com>
To: linux-kernel@...r.kernel.org
Cc: linux-efi@...r.kernel.org, x86@...nel.org,
Ard Biesheuvel <ardb@...nel.org>, Borislav Petkov <bp@...en8.de>, Ingo Molnar <mingo@...nel.org>,
Dionna Amalie Glaze <dionnaglaze@...gle.com>, Kevin Loughlin <kevinloughlin@...gle.com>,
Tom Lendacky <thomas.lendacky@....com>
Subject: [RFT PATCH v2 00/23] x86: strict separation of startup code
From: Ard Biesheuvel <ardb@...nel.org>
This RFT series implements a strict separation between startup code and
ordinary code, where startup code is built in a way that tolerates being
invoked from the initial 1:1 mapping of memory.
The existsing approach of emitting this code into .head.text and
checking for absolute relocations in that section is not 100% safe, and
produces diagnostics that are sometimes difficult to interpret.
Instead, rely on symbol prefixes, similar to how this is implemented for
the EFI stub and for the startup code in the arm64 port. This ensures
that startup code can only call other startup code, unless a special
symbol alias is emitted that exposes a non-startup routine to the
startup code.
This is somewhat intrusive, as there are many data objects that are
referenced both by startup code and by ordinary code, and an alias needs
to be emitted for each of those. If startup code references anything
that has not been made available to it explicitly, a build time link
error will occur.
This ultimately allows the .head.text section to be dropped entirely, as
it no longer has a special significance. Instead, code that only
executes at boot is emitted into .init.text as it should.
Change since RFC/v1:
- Include a major disentanglement/refactor of the SEV-SNP startup code,
so that only code that really needs to run from the 1:1 mapping is
included in the startup/ code
- Incorporate some early notes from Ingo
Build tested defconfig and allmodconfig
!!! Boot tested on non-SEV guest ONLY !!!!
Again, I will need to lean on Tom to determine whether this breaks
SEV-SNP guest boot. As I mentioned before, I am still waiting for
SEV-SNP capable hardware to be delivered.
Cc: Borislav Petkov <bp@...en8.de>
Cc: Ingo Molnar <mingo@...nel.org>
Cc: Dionna Amalie Glaze <dionnaglaze@...gle.com>
Cc: Kevin Loughlin <kevinloughlin@...gle.com>
Cc: Tom Lendacky <thomas.lendacky@....com>
Ard Biesheuvel (23):
x86/boot: Move early_setup_gdt() back into head64.c
x86/boot: Disregard __supported_pte_mask in __startup_64()
x86/boot: Drop global variables keeping track of LA57 state
x86/sev: Make sev_snp_enabled() a static function
x86/sev: Move instruction decoder into separate source file
x86/sev: Disentangle #VC handling code from startup code
x86/sev: Separate MSR and GHCB based snp_cpuid() via a callback
x86/sev: Fall back to early page state change code only during boot
x86/sev: Move GHCB page based HV communication out of startup code
x86/sev: Use boot SVSM CA for all startup and init code
x86/boot: Drop redundant RMPADJUST in SEV SVSM presence check
x86/sev: Unify SEV-SNP hypervisor feature check
x86/linkage: Add SYM_PIC_ALIAS() macro helper to emit symbol aliases
x86/boot: Add a bunch of PIC aliases
x86/boot: Provide __pti_set_user_pgtbl() to startup code
x86/sev: Provide PIC aliases for SEV related data objects
x86/sev: Move __sev_[get|put]_ghcb() into separate noinstr object
x86/sev: Export startup routines for ordinary use
x86/boot: Created a confined code area for startup code
x86/boot: Move startup code out of __head section
x86/boot: Disallow absolute symbol references in startup code
x86/boot: Revert "Reject absolute references in .head.text"
x86/boot: Get rid of the .head.text section
arch/x86/boot/compressed/Makefile | 6 +-
arch/x86/boot/compressed/misc.h | 12 +-
arch/x86/boot/compressed/pgtable_64.c | 12 -
arch/x86/boot/compressed/sev-handle-vc.c | 134 +++
arch/x86/boot/compressed/sev.c | 210 +---
arch/x86/boot/compressed/sev.h | 21 +-
arch/x86/boot/compressed/vmlinux.lds.S | 1 +
arch/x86/boot/startup/Makefile | 21 +
arch/x86/boot/startup/exports.h | 14 +
arch/x86/boot/startup/gdt_idt.c | 17 +-
arch/x86/boot/startup/map_kernel.c | 18 +-
arch/x86/boot/startup/sev-shared.c | 804 +-------------
arch/x86/boot/startup/sev-startup.c | 1169 +-------------------
arch/x86/boot/startup/sme.c | 45 +-
arch/x86/coco/core.c | 2 +
arch/x86/coco/sev/Makefile | 6 +-
arch/x86/coco/sev/core.c | 189 +++-
arch/x86/coco/sev/{sev-nmi.c => sev-noinstr.c} | 74 ++
arch/x86/coco/sev/vc-handle.c | 1060 ++++++++++++++++++
arch/x86/coco/sev/vc-shared.c | 614 ++++++++++
arch/x86/include/asm/init.h | 6 -
arch/x86/include/asm/linkage.h | 10 +
arch/x86/include/asm/pgtable_64_types.h | 43 +-
arch/x86/include/asm/setup.h | 2 +
arch/x86/include/asm/sev-internal.h | 30 +-
arch/x86/include/asm/sev.h | 78 ++
arch/x86/kernel/cpu/common.c | 3 +-
arch/x86/kernel/head64.c | 27 +-
arch/x86/kernel/head_32.S | 2 +-
arch/x86/kernel/head_64.S | 18 +-
arch/x86/kernel/setup.c | 1 +
arch/x86/kernel/vmlinux.lds.S | 11 +-
arch/x86/lib/memcpy_64.S | 1 +
arch/x86/lib/memset_64.S | 1 +
arch/x86/lib/retpoline.S | 2 +
arch/x86/mm/kasan_init_64.c | 3 -
arch/x86/mm/mem_encrypt_amd.c | 2 +
arch/x86/mm/mem_encrypt_boot.S | 6 +-
arch/x86/mm/pgtable.c | 1 +
arch/x86/platform/pvh/head.S | 2 +-
arch/x86/tools/relocs.c | 8 +-
tools/objtool/arch/x86/decode.c | 6 +-
42 files changed, 2367 insertions(+), 2325 deletions(-)
create mode 100644 arch/x86/boot/compressed/sev-handle-vc.c
create mode 100644 arch/x86/boot/startup/exports.h
rename arch/x86/coco/sev/{sev-nmi.c => sev-noinstr.c} (61%)
create mode 100644 arch/x86/coco/sev/vc-handle.c
create mode 100644 arch/x86/coco/sev/vc-shared.c
base-commit: 18ea89eae404d119ced26d80ac3e62255ce15409
--
2.49.0.906.g1f30a19c02-goog
Powered by blists - more mailing lists