linux-kernel - Re: [tip:x86/boot] x86/boot: Early parse RSDP and save it in boot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190211104254.GB19618@zn.tnic>
Date:   Mon, 11 Feb 2019 11:42:54 +0100
From:   Borislav Petkov <bp@...en8.de>
To:     Ard Biesheuvel <ard.biesheuvel@...aro.org>
Cc:     Chao Fan <fanc.fnst@...fujitsu.com>,
        Guenter Roeck <linux@...ck-us.net>,
        Thomas Gleixner <tglx@...utronix.de>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        Ingo Molnar <mingo@...hat.com>,
        "Lendacky, Thomas" <thomas.lendacky@....com>,
        Masahiro Yamada <yamada.masahiro@...ionext.com>,
        caoj.fnst@...fujitsu.com, Juergen Gross <jgross@...e.com>,
        Ingo Molnar <mingo@...nel.org>,
        Kees Cook <keescook@...omium.org>,
        the arch/x86 maintainers <x86@...nel.org>,
        "H. Peter Anvin" <hpa@...or.com>,
        linux-tip-commits@...r.kernel.org,
        Matt Fleming <matt@...eblueprint.co.uk>
Subject: Re: [tip:x86/boot] x86/boot: Early parse RSDP and save it in
 boot_params

On Mon, Feb 11, 2019 at 11:24:26AM +0100, Borislav Petkov wrote:
> It is only an observation for now though...

Ok, now I did this:

        for (i = 0; i < systab->nr_tables; i++) {
                acpi_physical_address table;
                void *config_tables;
                efi_guid_t guid;

                if ((unsigned long)systab->tables >> 32)			<---
                        asm volatile("1:\n jmp 1b");

                config_tables = (void *)(systab->tables + size * i);

It did stop at the endless loop there which would mean that
systab->tables is simply pointing somewhere into the weeds.

Asm is:

---
# arch/x86/boot/compressed/acpi.c:96: 			asm volatile("1:\n jmp 1b");
#APP
# 96 "arch/x86/boot/compressed/acpi.c" 1
	1:
 jmp 1b
# 0 "" 2
#NO_APP
	movq	112(%rcx), %rdi	# systab_147->tables, _31
.L29:
# arch/x86/boot/compressed/acpi.c:98: 		config_tables = (void *)(systab->tables + size * i);
	addq	%r9, %rdi	# ivtmp.64, config_tables
# arch/x86/boot/compressed/acpi.c:104: 			guid = tmp_table->guid;
---

and RDI is

rdi            0x630646870

in gdb.

systab itself gets computed to something low: 0x3fedb010.

Hmmm. Could it be that that EDK BIOS image is buggy?

[    0.000000] efi: EFI v2.70 by EDK II
[    0.000000] efi:  SMBIOS=0x3feb9000  ACPI=0x3fee7000  ACPI 2.0=0x3fee7014  MEMATTR=0x3f524110

-- 
Regards/Gruss,
    Boris.

Good mailing practices for 400: avoid top-posting and trim the reply.