Received-SPF: pass (google.com: domain of linux-kernel+bounces-138678-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Sender: Ingo Molnar <mingo.kernel.org@gmail.com>
Date: Wed, 10 Apr 2024 15:49:09 +0200
From: Ingo Molnar <mingo@kernel.org>
To: Ard Biesheuvel <ardb@kernel.org>
Cc: Ard Biesheuvel <ardb+git@google.com>, linux-kernel@vger.kernel.org,
	x86@kernel.org, Conrad Grobler <grobler@google.com>,
	Kevin Loughlin <kevinloughlin@google.com>
Subject: Re: [PATCH] x86/boot/64: Clear CR4.PGE to disable global 1:1 mappings
Message-ID: <ZhaY1bJhBlo/MyxE@gmail.com>
References: <20240410102520.348017-2-ardb+git@google.com>
 <ZhaM2N3EONa7tNgl@gmail.com>
 <CAMj1kXEFDqaHa-St+3k3N+Ngxn=u7ovf4wfYnPdL8xzJSoiibw@mail.gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAMj1kXEFDqaHa-St+3k3N+Ngxn=u7ovf4wfYnPdL8xzJSoiibw@mail.gmail.com>


* Ard Biesheuvel <ardb@kernel.org> wrote:

> On Wed, 10 Apr 2024 at 14:58, Ingo Molnar <mingo@kernel.org> wrote:
> >
> >
> > * Ard Biesheuvel <ardb+git@google.com> wrote:
> >
> > > From: Ard Biesheuvel <ardb@kernel.org>
> > >
> > > The early 64-bit boot code must be entered with a 1:1 mapping of the
> > > bootable image, but it cannot operate without a 1:1 mapping of all the
> > > assets in memory that it accesses, and therefore, it creates such
> > > mappings for all known assets upfront, and additional ones on demand
> > > when a page fault happens on a memory address.
> > >
> > > These mappings are created with the global bit G set, as the flags used
> > > to create page table descriptors are based on __PAGE_KERNEL_LARGE_EXEC
> > > defined by the core kernel, even though the context where these mappings
> > > are used is very different.
> > >
> > > This means that the TLB maintenance carried out by the decompressor is
> > > not sufficient if it is entered with CR4.PGE enabled, which has been
> > > observed to happen with the stage0 bootloader of project Oak. While this
> > > is a dubious practice if no global mappings are being used to begin
> > > with, the decompressor is clearly at fault here for creating global
> > > mappings and not performing the appropriate TLB maintenance.
> > >
> > > Since commit
> > >
> > >   f97b67a773cd84b ("x86/decompressor: Only call the trampoline when changing paging levels")
> > >
> > > CR4 is no longer modified by the decompressor if no change in the number
> > > of paging levels is needed. Before that, CR4 would always be set to a
> > > known value with PGE cleared.
> >
> > So if we do this for robustness & historical pre-f97b67a773cd84b
> > quirk-reliance's sake, I'd prefer if we loaded a known CR4 value again,
> > instead of just turning off the PGE bit.
> >
> > It's probably also a tiny bit faster, as no CR4 read has to be performed.
> >
> 
> Fair enough. I'll go and change that.

Thanks!

	Ingo