linux-kernel - Re: [tip:x86/boot] x86/boot: Early parse RSDP and save it in boot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAKv+Gu9mm-w66ZZrd7WhuD3_iELS5vUJ0-1DtRq1GDjSsDNEVg@mail.gmail.com>
Date:   Mon, 11 Feb 2019 10:46:18 +0000
From:   Ard Biesheuvel <ard.biesheuvel@...aro.org>
To:     Borislav Petkov <bp@...en8.de>
Cc:     Chao Fan <fanc.fnst@...fujitsu.com>,
        Guenter Roeck <linux@...ck-us.net>,
        Thomas Gleixner <tglx@...utronix.de>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        Ingo Molnar <mingo@...hat.com>,
        "Lendacky, Thomas" <thomas.lendacky@....com>,
        Masahiro Yamada <yamada.masahiro@...ionext.com>,
        caoj.fnst@...fujitsu.com, Juergen Gross <jgross@...e.com>,
        Ingo Molnar <mingo@...nel.org>,
        Kees Cook <keescook@...omium.org>,
        "the arch/x86 maintainers" <x86@...nel.org>,
        "H. Peter Anvin" <hpa@...or.com>,
        linux-tip-commits@...r.kernel.org,
        Matt Fleming <matt@...eblueprint.co.uk>
Subject: Re: [tip:x86/boot] x86/boot: Early parse RSDP and save it in boot_params

On Mon, 11 Feb 2019 at 11:43, Borislav Petkov <bp@...en8.de> wrote:
>
> On Mon, Feb 11, 2019 at 11:24:26AM +0100, Borislav Petkov wrote:
> > It is only an observation for now though...
>
> Ok, now I did this:
>
>         for (i = 0; i < systab->nr_tables; i++) {
>                 acpi_physical_address table;
>                 void *config_tables;
>                 efi_guid_t guid;
>
>                 if ((unsigned long)systab->tables >> 32)                        <---
>                         asm volatile("1:\n jmp 1b");
>
>                 config_tables = (void *)(systab->tables + size * i);
>
> It did stop at the endless loop there which would mean that
> systab->tables is simply pointing somewhere into the weeds.
>


As I pointed out in my previous reply, systab will be the wrong type
on 32-bit firmware, it needs to be efi_system_table_32_t


> Asm is:
>
> ---
> # arch/x86/boot/compressed/acpi.c:96:                   asm volatile("1:\n jmp 1b");
> #APP
> # 96 "arch/x86/boot/compressed/acpi.c" 1
>         1:
>  jmp 1b
> # 0 "" 2
> #NO_APP
>         movq    112(%rcx), %rdi # systab_147->tables, _31
> .L29:
> # arch/x86/boot/compressed/acpi.c:98:           config_tables = (void *)(systab->tables + size * i);
>         addq    %r9, %rdi       # ivtmp.64, config_tables
> # arch/x86/boot/compressed/acpi.c:104:                  guid = tmp_table->guid;
> ---
>
> and RDI is
>
> rdi            0x630646870
>
> in gdb.
>
> systab itself gets computed to something low: 0x3fedb010.
>
> Hmmm. Could it be that that EDK BIOS image is buggy?
>
> [    0.000000] efi: EFI v2.70 by EDK II
> [    0.000000] efi:  SMBIOS=0x3feb9000  ACPI=0x3fee7000  ACPI 2.0=0x3fee7014  MEMATTR=0x3f524110
>
> --
> Regards/Gruss,
>     Boris.
>
> Good mailing practices for 400: avoid top-posting and trim the reply.