patches/kernel/0024-init-x86-Move-mem_encrypt_init-into-arch_cpu_finaliz.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Thomas Gleixner <tglx@linutronix.de>
   3 Date: Wed, 14 Jun 2023 01:39:41 +0200
   4 Subject: [PATCH] init, x86: Move mem_encrypt_init() into
   5  arch_cpu_finalize_init()
   6
   7 Invoke the X86ism mem_encrypt_init() from X86 arch_cpu_finalize_init() and
   8 remove the weak fallback from the core code.
   9
  10 No functional change.
  11
  12 Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  13 Link: https://lore.kernel.org/r/20230613224545.670360645@linutronix.de
  14
  15 (backported from commit 439e17576eb47f26b78c5bbc72e344d4206d2327)
  16 [cascardo: really remove mem_encrypt_init from init/main.c]
  17 CVE-2022-40982
  18 Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
  19 Acked-by: Roxana Nicolescu <roxana.nicolescu@canonical.com>
  20 Acked-by: Stefan Bader <stefan.bader@canonical.com>
  21 Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
  22 (cherry picked from commit 439b49f26bc9ee74a3ac4b356c12d41f68c49cbd)
  23 Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
  24 ---
  25  arch/x86/include/asm/mem_encrypt.h |  7 ++++---
  26  arch/x86/kernel/cpu/common.c       | 11 +++++++++++
  27  init/main.c                        | 11 -----------
  28  3 files changed, 15 insertions(+), 14 deletions(-)
  29
  30 diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h
  31 index 72ca90552b6a..a95914f479b8 100644
  32 --- a/arch/x86/include/asm/mem_encrypt.h
  33 +++ b/arch/x86/include/asm/mem_encrypt.h
  34 @@ -51,6 +51,8 @@ void __init mem_encrypt_free_decrypted_mem(void);
  35
  36  void __init sev_es_init_vc_handling(void);
  37
  38 +void __init mem_encrypt_init(void);
  39 +
  40  #define __bss_decrypted __section(".bss..decrypted")
  41
  42  #else  /* !CONFIG_AMD_MEM_ENCRYPT */
  43 @@ -82,13 +84,12 @@ early_set_mem_enc_dec_hypercall(unsigned long vaddr, int npages, bool enc) {}
  44
  45  static inline void mem_encrypt_free_decrypted_mem(void) { }
  46
  47 +static inline void mem_encrypt_init(void) { }
  48 +
  49  #define __bss_decrypted
  50
  51  #endif /* CONFIG_AMD_MEM_ENCRYPT */
  52
  53 -/* Architecture __weak replacement functions */
  54 -void __init mem_encrypt_init(void);
  55 -
  56  void add_encrypt_protection_map(void);
  57
  58  /*
  59 diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
  60 index 0f32ecfbdeb1..637817d0d819 100644
  61 --- a/arch/x86/kernel/cpu/common.c
  62 +++ b/arch/x86/kernel/cpu/common.c
  63 @@ -18,6 +18,7 @@
  64  #include <linux/init.h>
  65  #include <linux/kprobes.h>
  66  #include <linux/kgdb.h>
  67 +#include <linux/mem_encrypt.h>
  68  #include <linux/smp.h>
  69  #include <linux/cpu.h>
  70  #include <linux/io.h>
  71 @@ -2412,4 +2413,14 @@ void __init arch_cpu_finalize_init(void)
  72         } else {
  73                 fpu__init_check_bugs();
  74         }
  75 +
  76 +       /*
  77 +        * This needs to be called before any devices perform DMA
  78 +        * operations that might use the SWIOTLB bounce buffers. It will
  79 +        * mark the bounce buffers as decrypted so that their usage will
  80 +        * not cause "plain-text" data to be decrypted when accessed. It
  81 +        * must be called after late_time_init() so that Hyper-V x86/x64
  82 +        * hypercalls work when the SWIOTLB bounce buffers are decrypted.
  83 +        */
  84 +       mem_encrypt_init();
  85  }
  86 diff --git a/init/main.c b/init/main.c
  87 index 967584e8c3af..7533b4da4fb2 100644
  88 --- a/init/main.c
  89 +++ b/init/main.c
  90 @@ -96,7 +96,6 @@
  91  #include <linux/cache.h>
  92  #include <linux/rodata_test.h>
  93  #include <linux/jump_label.h>
  94 -#include <linux/mem_encrypt.h>
  95  #include <linux/kcsan.h>
  96  #include <linux/init_syscalls.h>
  97  #include <linux/stackdepot.h>
  98 @@ -783,8 +782,6 @@ void __init __weak thread_stack_cache_init(void)
  99  }
 100  #endif
 101
 102 -void __init __weak mem_encrypt_init(void) { }
 103 -
 104  void __init __weak poking_init(void) { }
 105
 106  void __init __weak pgtable_cache_init(void) { }
 107 @@ -1087,14 +1084,6 @@ asmlinkage __visible void __init __no_sanitize_address start_kernel(void)
 108          */
 109         locking_selftest();
 110
 111 -       /*
 112 -        * This needs to be called before any devices perform DMA
 113 -        * operations that might use the SWIOTLB bounce buffers. It will
 114 -        * mark the bounce buffers as decrypted so that their usage will
 115 -        * not cause "plain-text" data to be decrypted when accessed.
 116 -        */
 117 -       mem_encrypt_init();
 118 -
 119  #ifdef CONFIG_BLK_DEV_INITRD
 120         if (initrd_start && !initrd_below_start_ok &&
 121             page_to_pfn(virt_to_page((void *)initrd_start)) < min_low_pfn) {