From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8D46D79F4; Wed, 17 Jan 2024 11:55:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1705492534; cv=none; b=nDQe5W3A/1o7AtV36XSOEcTX9BGjWhFPGMtLxF1Zp2Qmh5sHEn6Ook+ejDgYgPNxiM6zq9oxmaV1Ven+9JmHXaY+zBTQZaPbuuw2b/Zwdrs3OTX1zM+f4jJITOivzXS3AUCDRIhDtXJSEpIzhLYYNulJQQ7mEz7f7Y+Bnzk51dg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1705492534; c=relaxed/simple; bh=iFQJhKlc7pXhEgIHUu0aIF0uaghXVnVqJojUh4IxmI4=; h=Received:DKIM-Signature:Received:X-Gm-Message-State: X-Google-Smtp-Source:X-Received:MIME-Version:References: In-Reply-To:From:Date:X-Gmail-Original-Message-ID:Message-ID: Subject:To:Cc:Content-Type; b=e5CU/0DcEKDelTjUGMZhsnezmo8UY8wr3KCVkXxNw/+Ibh7Ss6qlYxgas4hXLmwXVBVN0j4Z9vYJjeNl/+FdGgVgPyeF/q5506IXUNVONIaq2Q3/r9IE0gN9zzWDUrXbqy+wH34wBGdL0E/DzpBXgPw/xJhPhA/3SVHfjXeCFaI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=hr9FF8pO; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="hr9FF8pO" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 28114C43609; Wed, 17 Jan 2024 11:55:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1705492534; bh=iFQJhKlc7pXhEgIHUu0aIF0uaghXVnVqJojUh4IxmI4=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=hr9FF8pOz/m41+DPrnr7ykraOGAUvQ1Dtj6hs9/qXGXKGUtgRZ3JVMDFBpceRShgk u0DJc3CIPjH1bFzDtQU9VZxlC4MUfK/yiiTFVm913hKCpEqtRlZZeRkiJOV/WVkfvk aZLF9xbSpJtJBht/TQBGOW/672DHvVJ87APn14fYSNNjDuCBldKl6o5ZERDIj1aSer t3yZo88PGRle+JzI5mVCYH5YmYxIwSi5yly/TwykR0qctxWxW7lmmsojwSPTTzjcZf sYiE+54Prk6LaffWb1gBhrkwcF2PehHw2Go7p4EnLF0jV4wDWqy2oHhgzwig108TsX oTAcODF0cIv4w== Received: by mail-lf1-f50.google.com with SMTP id 2adb3069b0e04-50e7e55c0f6so13162845e87.0; Wed, 17 Jan 2024 03:55:34 -0800 (PST) X-Gm-Message-State: AOJu0YzdzmoBoC8XMWVkrRA9YGtA/vMrIQi6je6WW8mw4VliS6YwSQo5 WoeKsxUqoMY4q/K2QkZNNSinL5q8bQswSpQdyyg= X-Google-Smtp-Source: AGHT+IFFbBbG0vWj2p5uNkZ8YdHfDUfgFtYFIdSJ/4cUNnNIYeSKGVPWM4yfEBslovtfzq3JcgTd9I21iV96p3A1Vns= X-Received: by 2002:a05:6512:e9f:b0:50e:76dd:6071 with SMTP id bi31-20020a0565120e9f00b0050e76dd6071mr2598047lfb.257.1705492532199; Wed, 17 Jan 2024 03:55:32 -0800 (PST) Precedence: bulk X-Mailing-List: linux-coco@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <20240111223650.3502633-1-kevinloughlin@google.com> <20240115204634.GHZaWZqsVyU_fvn_RW@fat_crate.local> In-Reply-To: From: Ard Biesheuvel Date: Wed, 17 Jan 2024 12:55:20 +0100 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [RFC PATCH v2] x86/sev: enforce RIP-relative accesses in early SEV/SME code To: Andi Kleen Cc: Borislav Petkov , Kevin Loughlin , Thomas Gleixner , Ingo Molnar , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Andy Lutomirski , Peter Zijlstra , Nathan Chancellor , Nick Desaulniers , Bill Wendling , Justin Stitt , Tom Lendacky , Michael Kelley , Pankaj Gupta , Stephen Rothwell , Arnd Bergmann , Steve Rutherford , Alexander Shishkin , Hou Wenlong , Vegard Nossum , Josh Poimboeuf , Yuntao Wang , Wang Jinchao , David Woodhouse , Brian Gerst , Hugh Dickins , Joerg Roedel , Randy Dunlap , Bjorn Helgaas , Dionna Glaze , Brijesh Singh , Michael Roth , "Kirill A. Shutemov" , linux-kernel@vger.kernel.org, llvm@lists.linux.dev, linux-coco@lists.linux.dev, Ashish Kalra , Adam Dunlap , Peter Gonda , Jacob Xu , Sidharth Telang Content-Type: text/plain; charset="UTF-8" On Wed, 17 Jan 2024 at 12:39, Andi Kleen wrote: > > On Wed, Jan 17, 2024 at 11:59:14AM +0100, Ard Biesheuvel wrote: > > On Mon, 15 Jan 2024 at 21:47, Borislav Petkov wrote: > > > > > > On Thu, Jan 11, 2024 at 10:36:50PM +0000, Kevin Loughlin wrote: > > > > SEV/SME code can execute prior to page table fixups for kernel > > > > relocation. However, as with global variables accessed in > > > > __startup_64(), the compiler is not required to generate RIP-relative > > > > accesses for SEV/SME global variables, causing certain flavors of SEV > > > > hosts and guests built with clang to crash during boot. > > > > > > So, about that. If I understand my gcc toolchain folks correctly: > > > > > > mcmodel=kernel - everything fits into the high 31 bit of the address > > > space > > > > > > -fPIE/PIC - position independent > > > > > > And supplied both don't make a whole lotta of sense: if you're building > > > position-independent, then mcmodel=kernel would be overridden by the > > > first. > > > > > > I have no clue why clang enabled it... > > > > > > So, *actually* the proper fix here should be not to add this "fixed_up" > > > gunk everywhere but remove mcmodel=kernel from the build and simply do > > > -fPIE/PIC. > > For the SEV file this might not work because it also has functions > that get called later at runtime, and may need to reference real > globals. I doubt the linker could resolve that. > I don't think that should be a problem. If the code and data are within -/+ 2G of each other, RIP-relative references should always be in range. > For linking the whole kernel, I haven't seen the latest numbers, but > traditionally -fPIE/PIC cost some performance because globals get loaded > through the GOT instead of directly as immediates. That's why the original > x86-64 port went with -mcmodel=kernel. > We can tell the compiler to avoid the GOT (using 'hidden' visibility), and even if we don't, the amd64 psABI now defines linker relaxations that turn GOT loads into LEA instructions (which still bloat the code a bit but eliminate the GOT accesses in most cases).