linux-kernel - Re: [PATCH] x86_64/efi: Mapping Boot and Runtime EFI memory regions to different starting virtual address

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150730123116.GL15651@linux-rxt1.site>
Date:	Thu, 30 Jul 2015 20:31:16 +0800
From:	joeyli <jlee@...e.com>
To:	Matt Fleming <matt@...eblueprint.co.uk>
Cc:	Borislav Petkov <bp@...en8.de>, "H. Peter Anvin" <hpa@...or.com>,
	"Lee, Chun-Yi" <joeyli.kernel@...il.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>, x86@...nel.org,
	linux-efi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] x86_64/efi: Mapping Boot and Runtime EFI memory regions
 to different starting virtual address

On Thu, Jul 30, 2015 at 01:09:16PM +0100, Matt Fleming wrote:
> On Thu, 30 Jul, at 07:18:19PM, joeyli wrote:
> > 
> > In the above case, just simply accessing EFI variable through efivars to
> > reproduce issue:
> > 
> > linux-aiip:~ # hexdump -C /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c
> > Killed
> > 
> > [  257.856185] BUG: unable to handle kernel paging request at fffffffefd244e60		<=== address is in Runtime Data region
> > [  257.863200] IP: [<ffffffff81457cdd>] virt_efi_get_variable+0x5d/0xa0
> > [  257.869586] PGD 1a0c067 PUD 13b0ae063 PMD 13b0bc063 PTE 0
> > [  257.875056] Oops: 0000 [#1] SMP 
> > [...snip]
> > [  258.149804] RIP  [<ffffffff81457cdd>] virt_efi_get_variable+0x5d/0xa0
> > [  258.156273]  RSP <ffff8800ba07fd78>
> > [  258.159769] CR2: fffffffefd244e60
> > [  258.163090] ---[ end trace 9edb589760c07d3e ]---
> > 
> > 0xfffffffefd244e60 is covered by Runtime Data region after hibernate resumed:  
> > 
> > [    0.125865] efi: mem26: [Runtime Data       |RUN|  |  |  |   |WB|WT|WC|UC] pa=[0x00000000bb3e5000-0x00000000bb445000) va=[0xfffffffefd1e5000-0xfffffffefd245000) (0MB)
> > 										  					     			0xfffffffefd244e60
> > 
> > But this va address didn't mapped to any pa in hibernating kernel (image kernel):
> > 
> > [    0.111002] efi: mem24: [Runtime Code       |RUN|  |  |  |   |WB|WT|WC|UC] pa=[0x00000000bb385000-0x00000000bb3e5000) va=[0xfffffffefd585000-0xfffffffefd5e5000) (0MB)
> > [    0.125883] efi: mem25: [Runtime Data       |RUN|  |  |  |   |WB|WT|WC|UC] pa=[0x00000000bb3e5000-0x00000000bb445000) va=[0xfffffffefd3e5000-0xfffffffefd445000) (0MB)
> > 																                0xfffffffefd244e60	<=== no mapping
> > [    0.140764] efi: mem29: [Boot Data          |   |  |  |  |   |WB|WT|WC|UC] pa=[0x00000000bb7ff000-0x00000000bb800000) va=[0xfffffffefd1ff000-0xfffffffefd200000) (0MB)
> > 
> > 
> > So, when call EFI runtime services, got problem.
> 
> Why is the new kernel calling the EFI runtime services via the old
> mappings?
> 
> -- 
> Matt Fleming, Intel Open Source Technology Center

I think hibernate overwrite it.

Joey Lee
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/