linux-kernel - Re: [PATCH 0/4] EFI 1:1 mapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 03 Jun 2013 09:18:06 -0700
From:	James Bottomley <James.Bottomley@...senPartnership.com>
To:	Matthew Garrett <mjg59@...f.ucam.org>
Cc:	Borislav Petkov <bp@...en8.de>,
	Linux EFI <linux-efi@...r.kernel.org>,
	Matt Fleming <matt@...sole-pimps.org>,
	Jiri Kosina <jkosina@...e.cz>, X86-ML <x86@...nel.org>,
	LKML <linux-kernel@...r.kernel.org>, Borislav Petkov <bp@...e.de>
Subject: Re: [PATCH 0/4] EFI 1:1 mapping

On Mon, 2013-06-03 at 16:21 +0100, Matthew Garrett wrote:
> On Mon, Jun 03, 2013 at 07:38:02AM -0700, James Bottomley wrote:
> > On Mon, 2013-06-03 at 15:30 +0100, Matthew Garrett wrote:
> > > Windows calls SetVirtualAddressMap(), so the only way these systems have 
> > > been tested is with SetVirtualAddressMap().
> > 
> > I know, but that's not what I said.
> > 
> > If you look at the implementation, SetVirtualAddressMap() does a massive
> > pointer chase through the images.  It not only tries to relocate the
> > text and data, but it also tries to relocate all the users of the data.
> > Some of these sources of data are boot time and some runtime.  Those
> > both need to be relocated by a separate pointer chase.  What we saw with
> > the QueryVariableInfo() problem was that a boot time pointer wasn't
> > relocated.  That's got to mean that windows only calls QueryVariableInfo
> > from runtime.
> 
> Sure.
> 
> > My point is that if we elect to call SetVirtualAddressMap() we'll be
> > restricted to only making the calls at boot time that windows does
> > otherwise we'll end up with these unrelocated pointers.  That's a huge
> > nasty verification burden on us.  Alternatively, if we never call
> > SetVirtualAddressMap() it seems to me that we just don't have to worry
> > about pointer relocation issues.  Thus, I think it would be better we
> > use the 1:1 mapping instead of calling SetVirtualAddressMap().
> 
> Some hardware just arbitrarily fails some calls if 
> SetVirtualAddressMap() isn't called. As you pointed out, the only 
> situation that these systems are ever tested in is the one where calls 
> are made in roughly the same order as Windows, ie:
> 
> Calls made in boot services:
> 
> GetTime()
> Getvariable()
> ExitBootServices()
> 
> Calls made in runtime:
> 
> SetVirtualAddressMap()
> GetNextVariable()
> GetVariable()
> SetVariable()
> 
> So far I haven't been able to convince Windows to make any other runtime 
> calls, which makes me a little unhappy about even calling 
> QueryVariableInfo() during runtime, but on the other hand our options 
> there are either to call it or to kill Samsungs, so I think we're stuck 
> with it. But, overall, refusing to call SetVirtualAddressMap() simply 
> isn't an option.

I don't entirely buy that.  All EFI programs run with the physical
address map, therefore every API an EFI program uses is also tested, at
boot time only, obviously.  However, the ExitBootServices() code seems
to be much simpler, so I don't think it will cause too many bugs.  The
UEFI test suites also seem to try UEFI calls before and after
ExitBootServices(), so I think relying on a 1:1 mapping looks safer to
me.

James



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/