linux-kernel - Re: [PATCH v2 4/5] x86/boot/64: Explicitly map boot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 9 Oct 2020 16:49:07 +0200
From:   Joerg Roedel <jroedel@...e.de>
To:     Arvind Sankar <nivedita@...m.mit.edu>
Cc:     x86@...nel.org, Borislav Petkov <bp@...en8.de>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 4/5] x86/boot/64: Explicitly map boot_params and
 command line

On Thu, Oct 08, 2020 at 03:16:22PM -0400, Arvind Sankar wrote:
> Commits
> 
>   ca0e22d4f011 ("x86/boot/compressed/64: Always switch to own page table")
>   8570978ea030 ("x86/boot/compressed/64: Don't pre-map memory in KASLR code")
> 
> set up a new page table in the decompressor stub, but without explicit
> mappings for boot_params and the kernel command line, relying on the #PF
> handler instead.
> 
> This is fragile, as boot_params and the command line mappings are
> required for the main kernel. If EARLY_PRINTK and RANDOMIZE_BASE are
> disabled, a QEMU/OVMF boot never accesses the command line in the
> decompressor stub, and so it never gets mapped. The main kernel accesses
> it from the identity mapping if AMD_MEM_ENCRYPT is enabled, and will
> crash.
> 
> Fix this by adding back the explicit mapping of boot_params and the
> command line.
> 
> Note: the changes also removed the explicit mapping of the main kernel,
> with the result that .bss and .brk may not be in the identity mapping,
> but those don't get accessed by the main kernel before it switches to
> its own page tables.
> 
> Signed-off-by: Arvind Sankar <nivedita@...m.mit.edu>
> ---
>  arch/x86/boot/compressed/ident_map_64.c | 16 ++++++++++++++--
>  1 file changed, 14 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/x86/boot/compressed/ident_map_64.c b/arch/x86/boot/compressed/ident_map_64.c
> index fd957b2625e9..a3613857c532 100644
> --- a/arch/x86/boot/compressed/ident_map_64.c
> +++ b/arch/x86/boot/compressed/ident_map_64.c
> @@ -21,6 +21,7 @@
>  
>  #include "error.h"
>  #include "misc.h"
> +#include "cmdline.h"
>  
>  /* These actually do the work of building the kernel identity maps. */
>  #include <linux/pgtable.h>
> @@ -109,6 +110,8 @@ static void add_identity_map(unsigned long start, unsigned long end)
>  /* Locates and clears a region for a new top level page table. */
>  void initialize_identity_maps(void)
>  {
> +	unsigned long cmdline;
> +
>  	/* Exclude the encryption mask from __PHYSICAL_MASK */
>  	physical_mask &= ~sme_me_mask;
>  
> @@ -149,10 +152,19 @@ void initialize_identity_maps(void)
>  	}
>  
>  	/*
> -	 * New page-table is set up - map the kernel image and load it
> -	 * into cr3.
> +	 * New page-table is set up - map the kernel image, boot_params and the
> +	 * command line.
> +	 * The uncompressed kernel requires boot_params and the command line to
> +	 * be mapped in the identity mapping.
> +	 * Map them explicitly here in case the compressed kernel does not
> +	 * touch them, or does not touch all the pages covering them.
>  	 */
>  	add_identity_map((unsigned long)_head, (unsigned long)_end);
> +	add_identity_map((unsigned long)boot_params, (unsigned long)(boot_params + 1));
> +	cmdline = get_cmd_line_ptr();
> +	add_identity_map(cmdline, cmdline + COMMAND_LINE_SIZE);
> +
> +	/* Load the new page-table. */
>  	write_cr3(top_level_pgt);
>  }

Reviewed-by: Joerg Roedel <jroedel@...e.de>