Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1033538AbbKFTd3 (ORCPT ); Fri, 6 Nov 2015 14:33:29 -0500 Received: from mail.skyhub.de ([78.46.96.112]:47500 "EHLO mail.skyhub.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1030342AbbKFTdY (ORCPT ); Fri, 6 Nov 2015 14:33:24 -0500 Date: Fri, 6 Nov 2015 20:33:15 +0100 From: Borislav Petkov To: Greg Kroah-Hartman Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org, Paolo Bonzini , Laszlo Ersek , "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , Andy Lutomirski , Matt Fleming Subject: Re: [PATCH 4.2 031/110] x86/setup: Extend low identity map to cover whole kernel range Message-ID: <20151106193314.GF19522@pd.tnic> References: <20151106191703.247930828@linuxfoundation.org> <20151106191704.836904806@linuxfoundation.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20151106191704.836904806@linuxfoundation.org> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 4634 Lines: 130 Hi Greg, this one is b0rked and a proper fix is still being discussed. You should drop it from the queue. On Fri, Nov 06, 2015 at 11:18:38AM -0800, Greg Kroah-Hartman wrote: > 4.2-stable review patch. If anyone has any objections, please let me know. > > ------------------ > > From: Paolo Bonzini > > commit f5f3497cad8c8416a74b9aaceb127908755d020a upstream. > > On 32-bit systems, the initial_page_table is reused by > efi_call_phys_prolog as an identity map to call > SetVirtualAddressMap. efi_call_phys_prolog takes care of > converting the current CPU's GDT to a physical address too. > > For PAE kernels the identity mapping is achieved by aliasing the > first PDPE for the kernel memory mapping into the first PDPE > of initial_page_table. This makes the EFI stub's trick "just work". > > However, for non-PAE kernels there is no guarantee that the identity > mapping in the initial_page_table extends as far as the GDT; in this > case, accesses to the GDT will cause a page fault (which quickly becomes > a triple fault). Fix this by copying the kernel mappings from > swapper_pg_dir to initial_page_table twice, both at PAGE_OFFSET and at > identity mapping. > > For some reason, this is only reproducible with QEMU's dynamic translation > mode, and not for example with KVM. However, even under KVM one can clearly > see that the page table is bogus: > > $ qemu-system-i386 -pflash OVMF.fd -M q35 vmlinuz0 -s -S -daemonize > $ gdb > (gdb) target remote localhost:1234 > (gdb) hb *0x02858f6f > Hardware assisted breakpoint 1 at 0x2858f6f > (gdb) c > Continuing. > > Breakpoint 1, 0x02858f6f in ?? () > (gdb) monitor info registers > ... > GDT= 0724e000 000000ff > IDT= fffbb000 000007ff > CR0=0005003b CR2=ff896000 CR3=032b7000 CR4=00000690 > ... > > The page directory is sane: > > (gdb) x/4wx 0x32b7000 > 0x32b7000: 0x03398063 0x03399063 0x0339a063 0x0339b063 > (gdb) x/4wx 0x3398000 > 0x3398000: 0x00000163 0x00001163 0x00002163 0x00003163 > (gdb) x/4wx 0x3399000 > 0x3399000: 0x00400003 0x00401003 0x00402003 0x00403003 > > but our particular page directory entry is empty: > > (gdb) x/1wx 0x32b7000 + (0x724e000 >> 22) * 4 > 0x32b7070: 0x00000000 > > [ It appears that you can skate past this issue if you don't receive > any interrupts while the bogus GDT pointer is loaded, or if you avoid > reloading the segment registers in general. > > Andy Lutomirski provides some additional insight: > > "AFAICT it's entirely permissible for the GDTR and/or LDT > descriptor to point to unmapped memory. Any attempt to use them > (segment loads, interrupts, IRET, etc) will try to access that memory > as if the access came from CPL 0 and, if the access fails, will > generate a valid page fault with CR2 pointing into the GDT or > LDT." > > Up until commit 23a0d4e8fa6d ("efi: Disable interrupts around EFI > calls, not in the epilog/prolog calls") interrupts were disabled > around the prolog and epilog calls, and the functional GDT was > re-installed before interrupts were re-enabled. > > Which explains why no one has hit this issue until now. ] > > Signed-off-by: Paolo Bonzini > Reported-by: Laszlo Ersek > Cc: Borislav Petkov > Cc: "H. Peter Anvin" > Cc: Thomas Gleixner > Cc: Ingo Molnar > Cc: Andy Lutomirski > Signed-off-by: Matt Fleming > [ Updated changelog. ] > Signed-off-by: Greg Kroah-Hartman > > --- > arch/x86/kernel/setup.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > --- a/arch/x86/kernel/setup.c > +++ b/arch/x86/kernel/setup.c > @@ -1198,6 +1198,14 @@ void __init setup_arch(char **cmdline_p) > clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY, > swapper_pg_dir + KERNEL_PGD_BOUNDARY, > KERNEL_PGD_PTRS); > + > + /* > + * sync back low identity map too. It is used for example > + * in the 32-bit EFI stub. > + */ > + clone_pgd_range(initial_page_table, > + swapper_pg_dir + KERNEL_PGD_BOUNDARY, > + KERNEL_PGD_PTRS); > #endif > > tboot_probe(); > > > -- Regards/Gruss, Boris. ECO tip #101: Trim your mails when you reply. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/