Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 31 Jul 2023 12:07:13 +0200
From:   Borislav Petkov <bp@alien8.de>
To:     Ard Biesheuvel <ardb@kernel.org>,
        "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc:     linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org,
        Evgeniy Baskov <baskov@ispras.ru>,
        Andy Lutomirski <luto@kernel.org>,
        Dave Hansen <dave.hansen@linux.intel.com>,
        Ingo Molnar <mingo@redhat.com>,
        Peter Zijlstra <peterz@infradead.org>,
        Thomas Gleixner <tglx@linutronix.de>,
        Alexey Khoroshilov <khoroshilov@ispras.ru>,
        Peter Jones <pjones@redhat.com>,
        Gerd Hoffmann <kraxel@redhat.com>,
        Dave Young <dyoung@redhat.com>,
        Mario Limonciello <mario.limonciello@amd.com>,
        Kees Cook <keescook@chromium.org>,
        Tom Lendacky <thomas.lendacky@amd.com>,
        "Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Joerg Roedel <jroedel@suse.de>
Subject: Re: [PATCH v7 01/22] x86/decompressor: Don't rely on upper 32 bits
 of GPRs being preserved
Message-ID: <20230731100713.GAZMeH0RvXfNclFqMO@fat_crate.local>
References: <20230728090916.1538550-1-ardb@kernel.org>
 <20230728090916.1538550-2-ardb@kernel.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <20230728090916.1538550-2-ardb@kernel.org>
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Fri, Jul 28, 2023 at 11:08:55AM +0200, Ard Biesheuvel wrote:
> The 4-to-5 level mode switch trampoline disables long mode and paging i=
n
> order to be able to flick the LA57 bit. According to section 3.4.1.1 of
> the x86 architecture manual [0], we should not rely on 64-bit GPRs

Please use passive voice in your commit message: no "we" or "I", etc,
and describe your changes in imperative mood.

> retaining the upper 32 bits of their contents across such a mode switch=
.
>=20
> Given that RBP, RBX and RSI are live at this point, let's preserve them
> on the stack, along with the return address that might be above 4G as
> well.
>=20
> [0] Intel=C2=AE 64 and IA-32 Architectures Software Developer=E2=80=99s=
 Manual, Volume 1: Basic Architecture
>=20
>   "Because the upper 32 bits of 64-bit general-purpose registers are
>    undefined in 32-bit modes, the upper 32 bits of any general-purpose
>    register are not preserved when switching from 64-bit mode to a 32-b=
it
>    mode (to protected mode or compatibility mode). Software must not
>    depend on these bits to maintain a value after a 64-bit to 32-bit
>    mode switch."
>=20
> Fixes: 194a9749c73d650c ("x86/boot/compressed/64: Handle 5-level paging=
 boot if kernel is above 4G")
> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> ---
>  arch/x86/boot/compressed/head_64.S | 23 +++++++++++++++-----
>  1 file changed, 17 insertions(+), 6 deletions(-)
>=20
> diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compres=
sed/head_64.S
> index 03c4328a88cbd5d0..f7c11a0018477de8 100644
> --- a/arch/x86/boot/compressed/head_64.S
> +++ b/arch/x86/boot/compressed/head_64.S
> @@ -459,11 +459,22 @@ SYM_CODE_START(startup_64)
>  	/* Save the trampoline address in RCX */
>  	movq	%rax, %rcx
> =20
> +	/* Set up 32-bit addressable stack */
> +	leaq	TRAMPOLINE_32BIT_STACK_END(%rcx), %rsp
> +
>  	/*
> -	 * Load the address of trampoline_return() into RDI.
> -	 * It will be used by the trampoline to return to the main code.
> +	 * Load the address of trampoline_return() into RDI and push it onto
> +	 * the stack so it will survive 32-bit truncation due to the 32-bit

I think you should explain here what that SDM excerpt above says so that
it is clear what "32-bit truncation" is meant.

> +	 * protected mode switch. It will be used by the trampoline to return
> +	 * to the main code.
>  	 */
>  	leaq	trampoline_return(%rip), %rdi
> +	pushq	%rdi
> +
> +	/* Preserve other live 64-bit registers */
> +	pushq	%rbp
> +	pushq	%rbx
> +	pushq	%rsi
> =20
>  	/* Switch to compatibility mode (CS.L =3D 0 CS.D =3D 1) via far retur=
n */
>  	pushq	$__KERNEL32_CS

What is more interesting is why is this trampoline crap unconditional?

/me goes and does git archeology...

194a9749c73d ("x86/boot/compressed/64: Handle 5-level paging boot if kern=
el is above 4G")

    We go through the trampoline even if we don't have to: if we're alrea=
dy
    in 5-level paging mode or if we don't need to switch to it. This way =
the
    trampoline gets tested on every boot.

Well, f*ck no.

All my machines don't have 5level pages. And I bet 5level pages is still
not in the majority of the machines out there.

This all needs to be abstracted away into a separate function which
exits early if no 5 level support.

Kirill, please fix this.

Thx.

--=20
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette