linux-kernel - [tip: x86/boot] x86/kexec: Disable global pages before writing to control page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <173693267429.31546.3478834571587592913.tip-bot2@tip-bot2>
Date: Wed, 15 Jan 2025 09:17:54 -0000
From: "tip-bot2 for David Woodhouse" <tip-bot2@...utronix.de>
To: linux-tip-commits@...r.kernel.org
Cc: Nathan Chancellor <nathan@...nel.org>,
 "Ning, Hongyu" <hongyu.ning@...ux.intel.com>,
 Dave Hansen <dave.hansen@...ux.intel.com>,
 David Woodhouse <dwmw@...zon.co.uk>, "Borislav Petkov (AMD)" <bp@...en8.de>,
 x86@...nel.org, linux-kernel@...r.kernel.org
Subject: [tip: x86/boot] x86/kexec: Disable global pages before writing to
 control page

The following commit has been merged into the x86/boot branch of tip:

Commit-ID:     d144d8a65286fb4a9f06ca80dea6e02e7d846558
Gitweb:        https://git.kernel.org/tip/d144d8a65286fb4a9f06ca80dea6e02e7d846558
Author:        David Woodhouse <dwmw@...zon.co.uk>
AuthorDate:    Thu, 09 Jan 2025 14:04:13 
Committer:     Borislav Petkov (AMD) <bp@...en8.de>
CommitterDate: Tue, 14 Jan 2025 12:46:17 +01:00

x86/kexec: Disable global pages before writing to control page

The kernel switches to a new set of page tables during kexec. The global
mappings (_PAGE_GLOBAL==1) can remain in the TLB after this switch. This
is generally not a problem because the new page tables use a different
portion of the virtual address space than the normal kernel mappings.

The critical exception to that generalisation (and the only mapping
which isn't an identity mapping) is the kexec control page itself —
which was ROX in the original kernel mapping, but should be RWX in the
new page tables. If there is a global TLB entry for that in its prior
read-only state, it definitely needs to be flushed before attempting to
write through that virtual mapping.

It would be possible to just avoid writing to the virtual address of the
page and defer all writes until they can be done through the identity
mapping. But there's no good reason to keep the old TLB entries around,
as they can cause nothing but trouble.

Clear the PGE bit in %cr4 early, before storing data in the control page.

Fixes: 5a82223e0743 ("x86/kexec: Mark relocate_kernel page as ROX instead of RWX")
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219592
Reported-by: Nathan Chancellor <nathan@...nel.org>
Reported-by: "Ning, Hongyu" <hongyu.ning@...ux.intel.com>
Co-developed-by: Dave Hansen <dave.hansen@...ux.intel.com>
Signed-off-by: Dave Hansen <dave.hansen@...ux.intel.com>
Signed-off-by: David Woodhouse <dwmw@...zon.co.uk>
Signed-off-by: Borislav Petkov (AMD) <bp@...en8.de>
Tested-by: Nathan Chancellor <nathan@...nel.org>
Tested-by: "Ning, Hongyu" <hongyu.ning@...ux.intel.com>
Link: https://lore.kernel.org/r/20250109140757.2841269-2-dwmw2@infradead.org
---
 arch/x86/kernel/relocate_kernel_64.S | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
index 8bc86a1..9bd601d 100644
--- a/arch/x86/kernel/relocate_kernel_64.S
+++ b/arch/x86/kernel/relocate_kernel_64.S
@@ -70,14 +70,20 @@ SYM_CODE_START_NOALIGN(relocate_kernel)
 	movq	kexec_pa_table_page(%rip), %r9
 	movq	%r9, %cr3
 
+	/* Leave CR4 in %r13 to enable the right paging mode later. */
+	movq	%cr4, %r13
+
+	/* Disable global pages immediately to ensure this mapping is RWX */
+	movq	%r13, %r12
+	andq	$~(X86_CR4_PGE), %r12
+	movq	%r12, %cr4
+
 	/* Save %rsp and CRs. */
+	movq	%r13, saved_cr4(%rip)
 	movq    %rsp, saved_rsp(%rip)
 	movq	%rax, saved_cr3(%rip)
 	movq	%cr0, %rax
 	movq	%rax, saved_cr0(%rip)
-	/* Leave CR4 in %r13 to enable the right paging mode later. */
-	movq	%cr4, %r13
-	movq	%r13, saved_cr4(%rip)
 
 	/* save indirection list for jumping back */
 	movq	%rdi, pa_backup_pages_map(%rip)