linux-kernel - RE: [PATCH] x86/efi: Restore Firmware IDT in before ExitBootServices()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <cdd7869a14ad4021acfacffa3918981c@AcuMS.aculab.com>
Date:   Fri, 20 Aug 2021 15:46:11 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Ard Biesheuvel' <ardb@...nel.org>, Joerg Roedel <joro@...tes.org>
CC:     "x86@...nel.org" <x86@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        "hpa@...or.com" <hpa@...or.com>, Joerg Roedel <jroedel@...e.de>,
        Kees Cook <keescook@...omium.org>,
        Andy Lutomirski <luto@...nel.org>,
        Uros Bizjak <ubizjak@...il.com>,
        Arvind Sankar <nivedita@...m.mit.edu>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Fabio Aiuto <fabioaiuto83@...il.com>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>
Subject: RE: [PATCH] x86/efi: Restore Firmware IDT in before
 ExitBootServices()

From: Ard Biesheuvel
> Sent: 20 August 2021 12:32
> 
> On Fri, 20 Aug 2021 at 12:19, Joerg Roedel <joro@...tes.org> wrote:
> >
> > On Fri, Aug 20, 2021 at 09:02:46AM +0000, David Laight wrote:
> > > So allocate and initialise the Linux IDT - so entries can be added.
> > > But don't execute 'lidt' until later on.
> >
> > The IDT is needed in this path to handle #VC exceptions caused by CPUID
> > instructions. So loading the IDT later is not an option.
> >
> 
> That does raise a question, though. Does changing the IDT interfere
> with the ability of the UEFI boot services to receive and handle the
> timer interrupt? Because before ExitBootServices(), that is owned by
> the firmware, and UEFI heavily relies on it for everything (event
> handling, polling mode block/network drivers, etc)
> 
> If restoring the IDT temporarily just papers over this by creating
> tiny windows where the timer interrupt starts working again, this is
> bad, and we need to figure out another way to address the original
> problem.

Could the whole thing be flipped?

So load a temporary IDT so that you can detect invalid instructions
and restore the UEFI IDT immediately afterwards?

I'm guessing the GDT is changed in order to access all of physical
memory (well enough to load the kernel).
Could that be done using the LDT?
It is unlikely that the UEFI cares about that?

Is this 32bit non-paged code?
Running that with a physical memory offset made my head hurt.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)