Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752669AbeAETzk (ORCPT + 1 other); Fri, 5 Jan 2018 14:55:40 -0500 Received: from mx1.redhat.com ([209.132.183.28]:57858 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751731AbeAETzj (ORCPT ); Fri, 5 Jan 2018 14:55:39 -0500 Date: Fri, 5 Jan 2018 20:55:35 +0100 From: Andrea Arcangeli To: Jiri Kosina Cc: Dave Hansen , Yisheng Xie , linux-kernel@vger.kernel.org, linux-mm@kvack.org, richard.fellner@student.tugraz.at, moritz.lipp@iaik.tugraz.at, daniel.gruss@iaik.tugraz.at, michael.schwarz@iaik.tugraz.at, luto@kernel.org, Linus Torvalds , keescook@google.com, hughd@google.com, x86@kernel.org Subject: Re: [PATCH 05/23] x86, kaiser: unmap kernel from userspace page tables (core patch) Message-ID: <20180105195535.GZ26807@redhat.com> References: <20171123003438.48A0EEDE@viggo.jf.intel.com> <20171123003447.1DB395E3@viggo.jf.intel.com> <93776eb2-b6d4-679a-280c-8ba558a69c34@linux.intel.com> <20a54a5f-f4e5-2126-fb73-6a995d13d52d@linux.intel.com> <282e2a56-ded1-6eb9-5ecb-22858c424bd7@linux.intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.9.2 (2017-12-15) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Fri, 05 Jan 2018 19:55:39 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: On Fri, Jan 05, 2018 at 08:17:17PM +0100, Jiri Kosina wrote: > On Fri, 5 Jan 2018, Dave Hansen wrote: > > > > --- a/arch/x86/platform/efi/efi_64.c > > > +++ b/arch/x86/platform/efi/efi_64.c > > > @@ -95,6 +95,12 @@ pgd_t * __init efi_call_phys_prolog(void > > > save_pgd[pgd] = *pgd_offset_k(pgd * PGDIR_SIZE); > > > vaddress = (unsigned long)__va(pgd * PGDIR_SIZE); > > > set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), *pgd_offset_k(vaddress)); > > > + /* > > > + * pgprot API doesn't clear it for PGD > > > + * > > > + * Will be brought back automatically in _epilog() > > > + */ > > > + pgd_offset_k(pgd * PGDIR_SIZE)->pgd &= ~_PAGE_NX; > > > } > > > __flush_tlb_all(); Upstream & downstream looks different, how the above looks completely different I don't know, but I got it and updating is easy. Great catch. > > > > Wait a sec... Where does the _PAGE_USER come from? Shouldn't we see > > the &init_mm in there and *not* set _PAGE_USER? > > That's because pgd_populate() uses _PAGE_TABLE and not _KERNPG_TABLE for > reasons that are behind me. For vsyscalls? I also had to single out warnings out of init_mm.pgd for the same reasons. How does the below (untested) look? >From ab949b80124588c4791568429cf8a234dda16340 Mon Sep 17 00:00:00 2001 From: Jiri Kosina Date: Fri, 5 Jan 2018 20:00:25 +0100 Subject: [RHEL7.5 PATCH 1/1] x86/kaiser/efi: unbreak EFI old_memmap old_memmap's efi_call_phys_prolog() calls set_pgd() with swapper PGD that has PAGE_USER set, which makes PTI set NX on it, and therefore EFI can't execute it's code. Fix that by forcefully clearing _PAGE_NX from the PGD (this can't be done by the pgprot API). _PAGE_NX will be automatically reintroduced in efi_call_phys_epilog(), as _set_pgd() will again notice that this is _PAGE_USER, and set _PAGE_NX on it. Signed-off-by: Jiri Kosina Signed-off-by: Andrea Arcangeli --- arch/x86/platform/efi/efi_64.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c index f951026ea2d2..395079128d98 100644 --- a/arch/x86/platform/efi/efi_64.c +++ b/arch/x86/platform/efi/efi_64.c @@ -110,6 +110,7 @@ void __init efi_call_phys_prelog(void) vaddr = (unsigned long)__va(pgd * PGDIR_SIZE); pgd_efi = pgd_offset_k(addr_pgd); save_pgd[pgd] = *pgd_efi; + pgd_efi->pgd &= ~_PAGE_NX; pud = pud_alloc(&init_mm, pgd_efi, addr_pgd); if (!pud) {