linux-kernel - Re: [PATCH] x86/boot/64: Clear CR4.PGE to disable global 1:1 mappings

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 10 Apr 2024 15:46:03 +0200
From: Ard Biesheuvel <ardb@...nel.org>
To: Ingo Molnar <mingo@...nel.org>
Cc: Ard Biesheuvel <ardb+git@...gle.com>, linux-kernel@...r.kernel.org, x86@...nel.org, 
	Conrad Grobler <grobler@...gle.com>, Kevin Loughlin <kevinloughlin@...gle.com>
Subject: Re: [PATCH] x86/boot/64: Clear CR4.PGE to disable global 1:1 mappings

On Wed, 10 Apr 2024 at 14:58, Ingo Molnar <mingo@...nel.org> wrote:
>
>
> * Ard Biesheuvel <ardb+git@...gle.com> wrote:
>
> > From: Ard Biesheuvel <ardb@...nel.org>
> >
> > The early 64-bit boot code must be entered with a 1:1 mapping of the
> > bootable image, but it cannot operate without a 1:1 mapping of all the
> > assets in memory that it accesses, and therefore, it creates such
> > mappings for all known assets upfront, and additional ones on demand
> > when a page fault happens on a memory address.
> >
> > These mappings are created with the global bit G set, as the flags used
> > to create page table descriptors are based on __PAGE_KERNEL_LARGE_EXEC
> > defined by the core kernel, even though the context where these mappings
> > are used is very different.
> >
> > This means that the TLB maintenance carried out by the decompressor is
> > not sufficient if it is entered with CR4.PGE enabled, which has been
> > observed to happen with the stage0 bootloader of project Oak. While this
> > is a dubious practice if no global mappings are being used to begin
> > with, the decompressor is clearly at fault here for creating global
> > mappings and not performing the appropriate TLB maintenance.
> >
> > Since commit
> >
> >   f97b67a773cd84b ("x86/decompressor: Only call the trampoline when changing paging levels")
> >
> > CR4 is no longer modified by the decompressor if no change in the number
> > of paging levels is needed. Before that, CR4 would always be set to a
> > known value with PGE cleared.
>
> So if we do this for robustness & historical pre-f97b67a773cd84b
> quirk-reliance's sake, I'd prefer if we loaded a known CR4 value again,
> instead of just turning off the PGE bit.
>
> It's probably also a tiny bit faster, as no CR4 read has to be performed.
>

Fair enough. I'll go and change that.