linux-kernel - Re: [PATCH v4] x86/boot: Use efi_setup_data for searching RSDP on kexec-ed kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 15 Apr 2019 23:14:34 +0000
From:   Junichi Nomura <j-nomura@...jp.nec.com>
To:     Borislav Petkov <bp@...en8.de>, Dave Young <dyoung@...hat.com>,
        Chao Fan <fanc.fnst@...fujitsu.com>,
        Baoquan He <bhe@...hat.com>
CC:     Kairui Song <kasong@...hat.com>, "x86@...nel.org" <x86@...nel.org>,
        "kexec@...ts.infradead.org" <kexec@...ts.infradead.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v4] x86/boot: Use efi_setup_data for searching RSDP on
 kexec-ed kernel

On 4/16/19 8:00 AM, Junichi Nomura wrote:
> On 4/15/19 7:25 PM, Borislav Petkov wrote:
>> On Mon, Apr 15, 2019 at 11:07:17AM +0200, Borislav Petkov wrote:
>>> On Mon, Apr 15, 2019 at 07:01:54AM +0000, Junichi Nomura wrote:
>>>> OK. Then I'll go back to v3 and make sure to hang when
>>>> something is wrong during kexec boot on EFI system.
>>>
>>> No need - I have it here locally. I'll clean it up and post it for
>>> review.
>>
>> Here it is. Ok, not ok?
> 
> Thank you.  Basically ok.
> I put some comments below about whether to hang or return.
> 
>> +static acpi_physical_address kexec_get_rsdp_addr(void)
>> +{
>> +	efi_system_table_64_t *systab;
>> +	struct efi_setup_data *esd;
>> +	struct efi_info *ei;
>> +	char *sig;
>> +
>> +	esd = (struct efi_setup_data *)get_kexec_setup_data_addr();
>> +	if (!esd)
>> +		return 0;
>> +
>> +	if (!esd->tables) {
>> +		debug_putstr("Wrong kexec SETUP_EFI data.\n");
>> +		return 0;
>> +	}
> 
> I thought we should hang here instead of return so that we
> don't run into efi_get_rsdp_addr() in case of kexec.
> 
>> +	ei = &boot_params->efi_info;
>> +	sig = (char *)&ei->efi_loader_signature;
>> +	if (strncmp(sig, EFI64_LOADER_SIGNATURE, 4)) {
>> +		debug_putstr("Wrong kexec EFI loader signature.\n");
>> +		return 0;
>> +	}
> 
> Same here.

One more question just for clarification.

I see kexec is only supported on 64bit kernel. But are we sure
we don't need to support kexec on EFI32 + 64bit kernel?

I don't have such an environment and as far as I tried with OVMF i386
and KVM guest, that combination doesn't work reliably even with v5.0.
So I suppose people don't care.

>> +	/* Get systab from boot params. */
>> +	systab = (efi_system_table_64_t *) (ei->efi_systab | ((__u64)ei->efi_systab_hi << 32));
>> +	if (!systab)
>> +		error("EFI system table not found in kexec boot_params.");
>> +
>> +	return __efi_get_rsdp_addr((unsigned long)esd->tables, systab->nr_tables, true);
> 
> Same here when __efi_get_rsdp_addr() returns 0.
> 
> I'm fine with either way, though.

-- 
Jun'ichi Nomura, NEC Corporation / NEC Solution Innovators, Ltd.