linux-kernel - [PATCH RFC 1/5] efi/x86: Disable paging when booting via efistub

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 10 Nov 2021 13:46:09 +0300
From:   Baskov Evgeniy <baskov@...ras.ru>
To:     Ard Biesheuvel <ardb@...nel.org>
Cc:     Baskov Evgeniy <baskov@...ras.ru>, Borislav Petkov <bp@...en8.de>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Ingo Molnar <mingo@...hat.com>,
        Jonathan Corbet <corbet@....net>,
        Thomas Gleixner <tglx@...utronix.de>, x86@...nel.org,
        linux-doc@...r.kernel.org, linux-efi@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH RFC 1/5] efi/x86: Disable paging when booting via efistub

Some UEFI implementations protect lower 1M memory regions and memory
regions allocated by libstub from being executable, which prevents
Linux kernel from booting.

Disable paging after returning from efi_main() before jumping
to potentially relocated code to prevent page fault from happening.

Signed-off-by: Baskov Evgeniy <baskov@...ras.ru>
---
 arch/x86/boot/compressed/head_32.S | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
index 659fad53ca82..c66fccaa90a2 100644
--- a/arch/x86/boot/compressed/head_32.S
+++ b/arch/x86/boot/compressed/head_32.S
@@ -156,6 +156,18 @@ SYM_FUNC_START_ALIAS(efi_stub_entry)
 	add	$0x4, %esp
 	movl	8(%esp), %esi	/* save boot_params pointer */
 	call	efi_main
+
+#ifdef CONFIG_EFI_STRICT_PGTABLE
+	/*
+	 * Disable paging before jumping to relocated address to prevent
+	 * page faulting on EFI firmware versions that enforces restricted
+	 * permissions on identity page tables
+	 */
+	movl	%cr0, %ecx
+	btrl	$31, %ecx
+	movl	%ecx, %cr0
+#endif
+
 	/* efi_main returns the possibly relocated address of startup_32 */
 	jmp	*%eax
 SYM_FUNC_END(efi32_stub_entry)
-- 
2.33.1