Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Thomas Gleixner <tglx@linutronix.de>
To:     Ard Biesheuvel <ardb@kernel.org>
Cc:     LKML <linux-kernel@vger.kernel.org>,
        =?utf-8?Q?Nikl=C4=81vs_Ko=C4=BCes?= =?utf-8?Q?=C5=86ikovs?= 
        <pinkflames.linux@gmail.com>, linux-efi@vger.kernel.org,
        x86@kernel.org, regressions@lists.linux.dev
Subject: Re: x86/efi: Make efi_set_virtual_address_map IBT safe
In-Reply-To: <CAMj1kXG0GZ8K4kVux3zQ6TXGoeQ8bwHq7JXbx-YXFbLSbD-6Gg@mail.gmail.com>
References: <87jzvm12q0.ffs@tglx>
 <CAMj1kXG0GZ8K4kVux3zQ6TXGoeQ8bwHq7JXbx-YXFbLSbD-6Gg@mail.gmail.com>
Date:   Thu, 29 Jun 2023 23:45:13 +0200
Message-ID: <878rc20wpi.ffs@tglx>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Thu, Jun 29 2023 at 23:42, Ard Biesheuvel wrote:
> On Thu, 29 Jun 2023 at 21:35, Thomas Gleixner <tglx@linutronix.de> wrote:
>> Nikl=C4=81vs reported a boot regression on an Alderlake machine and bise=
cted it
>> to commit 9df9d2f0471b ("init: Invoke arch_cpu_finalize_init() earlier").
>>
>> By moving the invocation of arch_cpu_finalize_init() further down he
>> identified that efi_enter_virtual_mode() is the function which causes
>> the boot hang.
>>
>> The main difference of the earlier invocation is that the boot CPU is
>> already fully initialized and mitigations and alternatives are applied.
>>
>> But the only really interesting change turned out to be IBT, which is
>> now enabled before efi_enter_virtual_mode(). "ibt=3Doff" on the kernel
>> command line cured the problem.
>>
>> Inspection of the involved calls in efi_enter_virtual_mode() unearthed t=
hat
>> efi_set_virtual_address_map() is the only place in the kernel which invo=
kes
>> an EFI call without the IBT safe wrapper. This went obviously unnoticed =
so
>> far as IBT was enabled later.
>>
>> Use arch_efi_call_virt() instead of efi_call() to cure that.
>>
>> Fixes: fe379fa4d199 ("x86/ibt: Disable IBT around firmware")
>> Fixes: 9df9d2f0471b ("init: Invoke arch_cpu_finalize_init() earlier")
>> Reported-by: Nikl=C4=81vs Ko=C4=BCes=C5=86ikovs <pinkflames.linux@gmail.=
com>
>> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
>> Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D217602
>
> Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
>
> I take it you'll send this straight to Linus?

I can do that.

Thanks,

        tglx