linux-kernel - Re: efi boot failures due to PTI with 32 bit builds and Intel CPUs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 30 Aug 2018 12:24:24 -0700
From:   Guenter Roeck <linux@...ck-us.net>
To:     Joerg Roedel <jroedel@...e.de>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Michal Hocko <mhocko@...e.com>,
        Andi Kleen <ak@...ux.intel.com>,
        the arch/x86 maintainers <x86@...nel.org>,
        Dave Hansen <dave.hansen@...el.com>,
        Pavel Machek <pavel@....cz>
Subject: Re: efi boot failures due to PTI with 32 bit builds and Intel CPUs

On Thu, Aug 30, 2018 at 08:46:39PM +0200, Joerg Roedel wrote:
> On Thu, Aug 30, 2018 at 11:21:49AM -0700, Linus Torvalds wrote:
> > On Thu, Aug 30, 2018 at 11:08 AM Joerg Roedel <jroedel@...e.de> wrote:
> > >
> > > Without a mapped GDT the #PF and #DF handlers also can't be started, so
> > > the machine triple-faults. Below diff fixes it for me, I'll send a
> > > proper patch tomorrow.
> > 
> > Hmm. Is there any reason why this code doesn't just use
> > 
> >         load_fixmap_gdt(0);
> 
> No idea, probably the function didn't exist when the code was written?
> I can change that when writing the patch.
> 
> > and shouldn't it do it after loading the new %cr3?
> 
> That seems more robust, yes. No sure if the old %cr3
> (initial_page_table) has the fixmap gdt mapped at all.

All three variants (hardcoded, call load_fixmap_gdt(0) first, call
load_fixmap_gdt(0) after load_cr3()) work for me. Feel free to add

Tested-by: Guenter Roeck <linux@...ck-us.net>

when you submit the patch.

Thanks a lot for tracking this down!

Guenter