Messages in this thread | | | Date | Sat, 13 Jan 2018 14:53:42 +0100 | From | Greg KH <> | Subject | Re: [PATCH 4.4 v2] x86/pti/efi: broken conversion from efi to kernel page table |
| |
On Fri, Jan 12, 2018 at 03:00:02PM -0500, Pavel Tatashin wrote: > In entry_64.S we have code like this: > > /* Unconditionally use kernel CR3 for do_nmi() */ > /* %rax is saved above, so OK to clobber here */ > ALTERNATIVE "jmp 2f", "movq %cr3, %rax", X86_FEATURE_KAISER > /* If PCID enabled, NOFLUSH now and NOFLUSH on return */ > ALTERNATIVE "", "bts $63, %rax", X86_FEATURE_PCID > pushq %rax > /* mask off "user" bit of pgd address and 12 PCID bits: */ > andq $(~(X86_CR3_PCID_ASID_MASK | KAISER_SHADOW_PGD_OFFSET)), %rax > movq %rax, %cr3 > 2: > > /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */ > call do_nmi > > With this instruction: > andq $(~(X86_CR3_PCID_ASID_MASK | KAISER_SHADOW_PGD_OFFSET)), %rax > > We unconditionally switch from whatever our CR3 was to kernel page table. > But, in arch/x86/platform/efi/efi_64.c We temporarily set a different page > table, that does not have the kernel page table with 0x1000 offset from it. > > Look in efi_thunk() and efi_thunk_set_virtual_address_map(). > > So, while CR3 points to the other page table, we get an NMI interrupt, > and clear 0x1000 from CR3, resulting in a bogus CR3 if the 0x1000 bit was > set. > > The efi page table comes from realmode/rm/trampoline_64.S: > > arch/x86/realmode/rm/trampoline_64.S > > 141 .bss > 142 .balign PAGE_SIZE > 143 GLOBAL(trampoline_pgd) .space PAGE_SIZE > > Notice: alignment is PAGE_SIZE, so after applying KAISER_SHADOW_PGD_OFFSET > which equal to PAGE_SIZE, we can get a different page table. > > But, even if we fix alignment, here the trampoline binary is later copied > into dynamically allocated memory in reserve_real_mode(), so we need to > fix that place as well. > > Fixes: 8a43ddfb93a0 ("KAISER: Kernel Address Isolation") > > Signed-off-by: Pavel Tatashin <pasha.tatashin@oracle.com> > Reviewed-by: Steven Sistare <steven.sistare@oracle.com> > --- > arch/x86/include/asm/kaiser.h | 10 ++++++++++ > arch/x86/realmode/init.c | 4 +++- > arch/x86/realmode/rm/trampoline_64.S | 3 ++- > 3 files changed, 15 insertions(+), 2 deletions(-) > > Changelog: > v1 - v2: Fixed compiling issue when PTI config is disabled.
This one is now queued up, thanks.
greg k-h
| |