| Message ID | 20200617190757.27081-2-john.s.andersen@intel.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | Paravirtualized Control Register pinning | expand |
Overall this looks pretty good. For all the maintainers on cc, we try to do internal reviews of these before they're submitted. This one got missed, sorry about that. On 6/17/20 12:07 PM, John Andersen wrote: > In identify_cpu when setting up SMEP/SMAP/UMIP call > cr4_set_bits_and_update_boot instead of cr4_set_bits. This ensures that > mmu_cr4_features contains those bits, and does not disable those > protections when in hibernation asm. When I'm writing comments, I try to use parenthesis for functions(), which leaves variable_names plain. I also try not to dive directly into the function names. This description assumes that the reader knows the subtle difference between cr4_set_bits_and_update_boot() and of cr4_set_bits(). A sentence or two of background here can save a reviewer a dive into the source code. > setup_arch updates mmu_cr4_features to save what identified features are > supported for later use in hibernation asm when cr4 needs to be modified > to toggle PGE. cr4 writes happen in restore_image and restore_registers. > setup_arch occurs before identify_cpu, this leads to mmu_cr4_features > not containing some of the cr4 features which were enabled via > identify_cpu when hibernation asm is executed. This fails to address the bigger picture. I assume you end up wanting this because without it hibernation is not compatible with CR pinning. Shouldn't that be mentioned? I also wonder why we even need two classes of cr4_set_bits(). Are there features we *want* to disable before entering the hibernation assembly? For instance, why not leave MCE enabled in there? What about PCIDs or OSPKE? Does it hurt? > On CPU bringup when cr4_set_bits_and_update_boot is called > mmu_cr4_features will now be written to. For the boot CPU, the > __ro_after_init on mmu_cr4_features does not cause a fault. However, > __ro_after_init was removed due to it triggering faults on non-boot > CPUs Before this patch, cr4_set_bits_and_update_boot() was only ever called during init. But, after this patch, it gets called later in boot and causes problems. We're surely not making _real_ updates to it, right? In that case the writes are superfluous and we would be better off just not writing to it (and retaining __ro_after_init) rather than allowing superfluous writes.
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index d07809286b95..921e67086a00 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -297,7 +297,7 @@ __setup("nosmep", setup_disable_smep); static __always_inline void setup_smep(struct cpuinfo_x86 *c) { if (cpu_has(c, X86_FEATURE_SMEP)) - cr4_set_bits(X86_CR4_SMEP); + cr4_set_bits_and_update_boot(X86_CR4_SMEP); } static __init int setup_disable_smap(char *arg) @@ -316,7 +316,7 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c) if (cpu_has(c, X86_FEATURE_SMAP)) { #ifdef CONFIG_X86_SMAP - cr4_set_bits(X86_CR4_SMAP); + cr4_set_bits_and_update_boot(X86_CR4_SMAP); #else cr4_clear_bits(X86_CR4_SMAP); #endif @@ -333,7 +333,7 @@ static __always_inline void setup_umip(struct cpuinfo_x86 *c) if (!cpu_has(c, X86_FEATURE_UMIP)) goto out; - cr4_set_bits(X86_CR4_UMIP); + cr4_set_bits_and_update_boot(X86_CR4_UMIP); pr_info_once("x86/cpu: User Mode Instruction Prevention (UMIP) activated\n"); diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c index a3767e74c758..d9c678b37a9b 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c @@ -138,9 +138,9 @@ EXPORT_SYMBOL(boot_cpu_data); #if !defined(CONFIG_X86_PAE) || defined(CONFIG_X86_64) -__visible unsigned long mmu_cr4_features __ro_after_init; +__visible unsigned long mmu_cr4_features; #else -__visible unsigned long mmu_cr4_features __ro_after_init = X86_CR4_PAE; +__visible unsigned long mmu_cr4_features = X86_CR4_PAE; #endif /* Boot loader ID and version as integers, for the benefit of proc_dointvec */
In identify_cpu when setting up SMEP/SMAP/UMIP call cr4_set_bits_and_update_boot instead of cr4_set_bits. This ensures that mmu_cr4_features contains those bits, and does not disable those protections when in hibernation asm. setup_arch updates mmu_cr4_features to save what identified features are supported for later use in hibernation asm when cr4 needs to be modified to toggle PGE. cr4 writes happen in restore_image and restore_registers. setup_arch occurs before identify_cpu, this leads to mmu_cr4_features not containing some of the cr4 features which were enabled via identify_cpu when hibernation asm is executed. On CPU bringup when cr4_set_bits_and_update_boot is called mmu_cr4_features will now be written to. For the boot CPU, the __ro_after_init on mmu_cr4_features does not cause a fault. However, __ro_after_init was removed due to it triggering faults on non-boot CPUs. Signed-off-by: John Andersen <john.s.andersen@intel.com> --- arch/x86/kernel/cpu/common.c | 6 +++--- arch/x86/kernel/setup.c | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-)