linux-kernel - [tip:efi/urgent] x86/efi: Fix 7th argument to efi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <tip-bea23c757f66d91dac8fdadd94da0cba6b0b66bc@git.kernel.org>
Date:	Mon, 16 May 2016 03:40:00 -0700
From:	tip-bot for Alex Thorlton <tipbot@...or.com>
To:	linux-tip-commits@...r.kernel.org
Cc:	torvalds@...ux-foundation.org, stable@...r.kernel.org,
	jolsa@...hat.com, bp@...e.de, alexander.shishkin@...ux.intel.com,
	vincent.weaver@...ne.edu, athorlton@....com, brgerst@...il.com,
	mingo@...nel.org, tglx@...utronix.de, rja@....com, hpa@...or.com,
	bp@...en8.de, eranian@...gle.com, dvlasenk@...hat.com,
	matt@...eblueprint.co.uk, luto@...capital.net, travis@....com,
	acme@...hat.com, sivanich@....com, ard.biesheuvel@...aro.org,
	linux-kernel@...r.kernel.org, peterz@...radead.org
Subject: [tip:efi/urgent] x86/efi: Fix 7th argument to efi_call()

Commit-ID:  bea23c757f66d91dac8fdadd94da0cba6b0b66bc
Gitweb:     http://git.kernel.org/tip/bea23c757f66d91dac8fdadd94da0cba6b0b66bc
Author:     Alex Thorlton <athorlton@....com>
AuthorDate: Fri, 13 May 2016 21:34:42 +0100
Committer:  Ingo Molnar <mingo@...nel.org>
CommitDate: Mon, 16 May 2016 12:38:06 +0200

x86/efi: Fix 7th argument to efi_call()

The efi_call() assembly code has a slight error that prevents us from
using arguments 7 and higher, which will be passed in on the stack:

        mov (%rsp), %rax
        mov 8(%rax), %rax
	...
        mov %rax, 40(%rsp)

This code goes and grabs the return address for the current stack frame,
and puts it on the stack, next to the 5th argument for the EFI runtime
call.  Considering the fact that having the return address in that
position on the stack makes no sense, I'm guessing that the intent of
this code was actually to grab an argument off the stack frame for this
call and place it into the frame for the next one.

The small change to that offset (i.e. 8(%rax) to 16(%rax)) ensures that
we grab the 7th argument off the stack, and pass it as the 6th argument
to the EFI runtime function that we're about to call.  This change gets
our EFI runtime calls that need to pass more than 6 arguments working
again.  SGI/UV is the only platform that passes more than 6 arguments.

Signed-off-by: Alex Thorlton <athorlton@....com>
[ Updated changelog. ]
Signed-off-by: Matt Fleming <matt@...eblueprint.co.uk>
Cc: <stable@...r.kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@...ux.intel.com>
Cc: Andy Lutomirski <luto@...capital.net>
Cc: Ard Biesheuvel <ard.biesheuvel@...aro.org>
Cc: Arnaldo Carvalho de Melo <acme@...hat.com>
Cc: Borislav Petkov <bp@...en8.de>
Cc: Borislav Petkov <bp@...e.de>
Cc: Brian Gerst <brgerst@...il.com>
Cc: Denys Vlasenko <dvlasenk@...hat.com>
Cc: Dimitri Sivanich <sivanich@....com>
Cc: H. Peter Anvin <hpa@...or.com>
Cc: Jiri Olsa <jolsa@...hat.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Mike Travis <travis@....com>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Russ Anderson <rja@....com>
Cc: Stephane Eranian <eranian@...gle.com>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: Vince Weaver <vincent.weaver@...ne.edu>
Cc: linux-efi@...r.kernel.org
Link: http://lkml.kernel.org/r/1463171682-13881-2-git-send-email-matt@codeblueprint.co.uk
Signed-off-by: Ingo Molnar <mingo@...nel.org>
---
 arch/x86/platform/efi/efi_stub_64.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/platform/efi/efi_stub_64.S b/arch/x86/platform/efi/efi_stub_64.S
index 92723ae..62938ff 100644
--- a/arch/x86/platform/efi/efi_stub_64.S
+++ b/arch/x86/platform/efi/efi_stub_64.S
@@ -43,7 +43,7 @@ ENTRY(efi_call)
 	FRAME_BEGIN
 	SAVE_XMM
 	mov (%rsp), %rax
-	mov 8(%rax), %rax
+	mov 16(%rax), %rax
 	subq $48, %rsp
 	mov %r9, 32(%rsp)
 	mov %rax, 40(%rsp)