lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <9e876a7c73574bc29a769998d87acd7c5a0f72cc.camel@infradead.org>
Date: Mon, 06 Jan 2025 16:13:22 +0000
From: David Woodhouse <dwmw2@...radead.org>
To: Ard Biesheuvel <ardb@...nel.org>
Cc: Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, 
 Borislav Petkov <bp@...en8.de>, Dave Hansen <dave.hansen@...ux.intel.com>,
 x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>, Eric Biederman
 <ebiederm@...ssion.com>, Sourabh Jain <sourabhjain@...ux.ibm.com>, Hari
 Bathini <hbathini@...ux.ibm.com>, Michael Ellerman <mpe@...erman.id.au>,
 Thomas Zimmermann <tzimmermann@...e.de>, Andrew Morton
 <akpm@...ux-foundation.org>, Baoquan He <bhe@...hat.com>, Yuntao Wang
 <ytcoode@...il.com>, David Kaplan <david.kaplan@....com>, Tao Liu
 <ltao@...hat.com>, "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>, 
 Kai Huang <kai.huang@...el.com>, Josh Poimboeuf <jpoimboe@...nel.org>,
 Breno Leitao <leitao@...ian.org>,  Wei Yang <richard.weiyang@...il.com>,
 Rong Xu <xur@...gle.com>, Thomas Weißschuh
 <thomas.weissschuh@...utronix.de>, linux-kernel@...r.kernel.org, 
 kexec@...ts.infradead.org, Simon Horman <horms@...nel.org>, Dave Young
 <dyoung@...hat.com>, Peter Zijlstra <peterz@...radead.org>, bsz@...zon.de, 
 nathan@...nel.org
Subject: Re: [PATCH 8/9] x86/kexec: Cope with relocate_kernel() not being at
 the start of the page

On Mon, 2025-01-06 at 17:09 +0100, Ard Biesheuvel wrote:
> 
> I suppose you're referring to
> 
> #ifdef CONFIG_KEXEC_JUMP
>         /* Saved in save_processor_state. */
>         movq    $saved_context, %rax
>         lgdt    saved_context_gdt_desc(%rax)
> #endif
> 
> Any reason not to simply use
> 
>         lgdt    saved_context+saved_context_gdt_desc(%rip)
> 
> here?

Because the %rip isn't what you (and the linker) think it is.

This code is copied into a control page which is allocated as part of
the kexec kimage. It can only access things within that same page via
%rip. (Which is not as much of a restriction as it sounds, as for most
of its execution the rest of the kernel isn't even present in the page
tables).

Download attachment "smime.p7s" of type "application/pkcs7-signature" (5069 bytes)

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ