[PATCH] x86/kexec: Disable global pages before writing to control page

[Ning, Hongyu]

On 2024/12/13 7:08, David Woodhouse wrote:
> From: David Woodhouse <dwmw at amazon.co.uk>
> 
> The kernel switches to a new set of page tables during kexec. The global
> mappings (_PAGE_GLOBAL==1) can remain in the TLB after this switch. This
> is generally not a problem because the new page tables use a different
> portion of the virtual address space than the normal kernel mappings.
> 
> The critical exception to that generalisation (and the only mapping
> which isn't an identity mapping) is the kexec control page itself —
> which was ROX in the original kernel mapping, but should be RWX in the
> new page tables. If there is a global TLB entry for that in its prior
> read-only state, it definitely needs to be flushed before attempting to
> write through that virtual mapping.
> 
> It would be possible to just avoid writing to the virtual address of the
> page and defer all writes until they can be done through the identity
> mapping. But there's no good reason to keep the old TLB entries around,
> as they can cause nothing but trouble.
> 
> Clear the PGE bit in %cr4 early, before storing data in the control page.
> 
> Fixes: 5a82223e0743 ("x86/kexec: Mark relocate_kernel page as ROX instead of RWX")
> Co-authored-by: Dave Hansen <dave.hansen at linux.intel.com>
> Reported-by: Nathan Chancellor <nathan at kernel.org>
> Reported-by: "Ning, Hongyu" <hongyu.ning at linux.intel.com>
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219592
> Signed-off-by: Dave Hansen <dave.hansen at linux.intel.com>
> Signed-off-by: David Woodhouse <dwmw at amazon.co.uk>
> Tested-by: Nathan Chancellor <nathan at kernel.org>

Tested-by: "Ning, Hongyu" <hongyu.ning at linux.intel.com>

> ---
> This supersedes the previous 'Only write through identity mapping of
> control page' patch as Dave's approach is much saner now he's actually
> figured out what's going on.
> 
> 
>   arch/x86/kernel/relocate_kernel_64.S | 12 +++++++++---
>   1 file changed, 9 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
> index 553d67845b84..cbadf0142fcb 100644
> --- a/arch/x86/kernel/relocate_kernel_64.S
> +++ b/arch/x86/kernel/relocate_kernel_64.S
> @@ -90,14 +90,20 @@ SYM_CODE_START_NOALIGN(relocate_kernel)
>   	movq	kexec_pa_table_page(%rip), %r9
>   	movq	%r9, %cr3
>   
> +	/* Leave CR4 in %r13 to enable the right paging mode later. */
> +	movq	%cr4, %r13
> +
> +	/* Disable global pages immediately to ensure this mapping is RWX */
> +	movq	%r13, %r12
> +	andq	$~(X86_CR4_PGE), %r12
> +	movq	%r12, %cr4
> +
>   	/* Save %rsp and CRs. */
> +	movq	%r13, saved_cr4(%rip)
>   	movq    %rsp, saved_rsp(%rip)
>   	movq	%rax, saved_cr3(%rip)
>   	movq	%cr0, %rax
>   	movq	%rax, saved_cr0(%rip)
> -	/* Leave CR4 in %r13 to enable the right paging mode later. */
> -	movq	%cr4, %r13
> -	movq	%r13, saved_cr4(%rip)
>   
>   	/* save indirection list for jumping back */
>   	movq	%rdi, pa_backup_pages_map(%rip)