linux-kernel - Re: [PATCH 4.4 v2] x86/pti/efi: broken conversion from efi to kernel page table

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 13 Jan 2018 14:53:42 +0100
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Pavel Tatashin <pasha.tatashin@...cle.com>
Cc:     steven.sistare@...cle.com, linux-kernel@...r.kernel.org,
        tglx@...utronix.de, mingo@...hat.com, hpa@...or.com,
        x86@...nel.org, jkosina@...e.cz, hughd@...gle.com,
        dave.hansen@...ux.intel.com, luto@...nel.org,
        torvalds@...ux-foundation.org
Subject: Re: [PATCH 4.4 v2] x86/pti/efi: broken conversion from efi to kernel
 page table

On Fri, Jan 12, 2018 at 03:00:02PM -0500, Pavel Tatashin wrote:
> In entry_64.S we have code like this:
> 
>     /* Unconditionally use kernel CR3 for do_nmi() */
>     /* %rax is saved above, so OK to clobber here */
>     ALTERNATIVE "jmp 2f", "movq %cr3, %rax", X86_FEATURE_KAISER
>     /* If PCID enabled, NOFLUSH now and NOFLUSH on return */
>     ALTERNATIVE "", "bts $63, %rax", X86_FEATURE_PCID
>     pushq   %rax
>     /* mask off "user" bit of pgd address and 12 PCID bits: */
>     andq    $(~(X86_CR3_PCID_ASID_MASK | KAISER_SHADOW_PGD_OFFSET)), %rax
>     movq    %rax, %cr3
> 2:
> 
>     /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
>     call    do_nmi
> 
> With this instruction:
>     andq    $(~(X86_CR3_PCID_ASID_MASK | KAISER_SHADOW_PGD_OFFSET)), %rax
> 
> We unconditionally switch from whatever our CR3 was to kernel page table.
> But, in arch/x86/platform/efi/efi_64.c We temporarily set a different page
> table, that does not have the kernel page table with 0x1000 offset from it.
> 
> Look in efi_thunk() and efi_thunk_set_virtual_address_map().
> 
> So, while CR3 points to the other page table, we get an NMI interrupt,
> and clear 0x1000 from CR3, resulting in a bogus CR3 if the 0x1000 bit was
> set.
> 
> The efi page table comes from realmode/rm/trampoline_64.S:
> 
> arch/x86/realmode/rm/trampoline_64.S
> 
> 141 .bss
> 142 .balign PAGE_SIZE
> 143 GLOBAL(trampoline_pgd) .space PAGE_SIZE
> 
> Notice: alignment is PAGE_SIZE, so after applying KAISER_SHADOW_PGD_OFFSET
> which equal to PAGE_SIZE, we can get a different page table.
> 
> But, even if we fix alignment, here the trampoline binary is later copied
> into dynamically allocated memory in reserve_real_mode(), so we need to
> fix that place as well.
> 
> Fixes: 8a43ddfb93a0 ("KAISER: Kernel Address Isolation")
> 
> Signed-off-by: Pavel Tatashin <pasha.tatashin@...cle.com>
> Reviewed-by: Steven Sistare <steven.sistare@...cle.com>
> ---
>  arch/x86/include/asm/kaiser.h        | 10 ++++++++++
>  arch/x86/realmode/init.c             |  4 +++-
>  arch/x86/realmode/rm/trampoline_64.S |  3 ++-
>  3 files changed, 15 insertions(+), 2 deletions(-)
> 
> Changelog:
> 	v1 - v2: Fixed compiling issue when PTI config is disabled.

This one is now queued up, thanks.

greg k-h