mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git
synced 2026-04-27 03:49:57 -04:00
8436112341
When transitioning from 5-level to 4-level paging, the existing code
incorrectly accesses page table entries by directly dereferencing CR3 and
applying PAGE_MASK. This approach has several issues:
- __native_read_cr3() returns the raw CR3 register value, which on x86_64
includes not just the physical address but also flags Bits above the
physical address width of the system (i.e. above __PHYSICAL_MASK_SHIFT) are
also not masked.
- The pgd value is masked by PAGE_SIZE which doesn't take into account the
higher bits such as _PAGE_BIT_NOPTISHADOW.
Replace this with proper accessor functions:
- native_read_cr3_pa(): Uses CR3_ADDR_MASK to additionally mask metadata out
of CR3 (like SME or LAM bits). All remaining bits are real address bits or
reserved and must be 0.
- mask pgd value with PTE_PFN_MASK instead of PAGE_MASK, accounting for flags
above bit 51 (_PAGE_BIT_NOPTISHADOW in particular). Bits below 51, but above
the max physical address are reserved and must be 0.
Fixes: cb1c9e02b0 ("x86/efistub: Perform 4/5 level paging switch from the stub")
Reported-by: Michael van der Westhuizen <rmikey@meta.com>
Reported-by: Tobias Fleig <tfleig@meta.com>
Co-developed-by: Kiryl Shutsemau <kas@kernel.org>
Signed-off-by: Kiryl Shutsemau <kas@kernel.org>
Signed-off-by: Usama Arif <usamaarif642@gmail.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://patch.msgid.link/20251103141002.2280812-3-usamaarif642@gmail.com
96 lines
2.8 KiB
C
96 lines
2.8 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
#include <linux/efi.h>
|
|
|
|
#include <asm/boot.h>
|
|
#include <asm/desc.h>
|
|
#include <asm/efi.h>
|
|
|
|
#include "efistub.h"
|
|
#include "x86-stub.h"
|
|
|
|
bool efi_no5lvl;
|
|
|
|
static void (*la57_toggle)(void *cr3);
|
|
|
|
static const struct desc_struct gdt[] = {
|
|
[GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(DESC_CODE32, 0, 0xfffff),
|
|
[GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(DESC_CODE64, 0, 0xfffff),
|
|
};
|
|
|
|
/*
|
|
* Enabling (or disabling) 5 level paging is tricky, because it can only be
|
|
* done from 32-bit mode with paging disabled. This means not only that the
|
|
* code itself must be running from 32-bit addressable physical memory, but
|
|
* also that the root page table must be 32-bit addressable, as programming
|
|
* a 64-bit value into CR3 when running in 32-bit mode is not supported.
|
|
*/
|
|
efi_status_t efi_setup_5level_paging(void)
|
|
{
|
|
u8 tmpl_size = (u8 *)&trampoline_ljmp_imm_offset - (u8 *)&trampoline_32bit_src;
|
|
efi_status_t status;
|
|
u8 *la57_code;
|
|
|
|
if (!efi_is_64bit())
|
|
return EFI_SUCCESS;
|
|
|
|
/* check for 5 level paging support */
|
|
if (native_cpuid_eax(0) < 7 ||
|
|
!(native_cpuid_ecx(7) & (1 << (X86_FEATURE_LA57 & 31))))
|
|
return EFI_SUCCESS;
|
|
|
|
/* allocate some 32-bit addressable memory for code and a page table */
|
|
status = efi_allocate_pages(2 * PAGE_SIZE, (unsigned long *)&la57_code,
|
|
U32_MAX);
|
|
if (status != EFI_SUCCESS)
|
|
return status;
|
|
|
|
la57_toggle = memcpy(la57_code, trampoline_32bit_src, tmpl_size);
|
|
memset(la57_code + tmpl_size, 0x90, PAGE_SIZE - tmpl_size);
|
|
|
|
/*
|
|
* To avoid the need to allocate a 32-bit addressable stack, the
|
|
* trampoline uses a LJMP instruction to switch back to long mode.
|
|
* LJMP takes an absolute destination address, which needs to be
|
|
* fixed up at runtime.
|
|
*/
|
|
*(u32 *)&la57_code[trampoline_ljmp_imm_offset] += (unsigned long)la57_code;
|
|
|
|
efi_adjust_memory_range_protection((unsigned long)la57_toggle, PAGE_SIZE);
|
|
|
|
return EFI_SUCCESS;
|
|
}
|
|
|
|
void efi_5level_switch(void)
|
|
{
|
|
bool want_la57 = !efi_no5lvl;
|
|
bool have_la57 = native_read_cr4() & X86_CR4_LA57;
|
|
bool need_toggle = want_la57 ^ have_la57;
|
|
u64 *pgt = (void *)la57_toggle + PAGE_SIZE;
|
|
pgd_t *cr3 = (pgd_t *)native_read_cr3_pa();
|
|
u64 *new_cr3;
|
|
|
|
if (!la57_toggle || !need_toggle)
|
|
return;
|
|
|
|
if (!have_la57) {
|
|
/*
|
|
* 5 level paging will be enabled, so a root level page needs
|
|
* to be allocated from the 32-bit addressable physical region,
|
|
* with its first entry referring to the existing hierarchy.
|
|
*/
|
|
new_cr3 = memset(pgt, 0, PAGE_SIZE);
|
|
new_cr3[0] = (u64)cr3 | _PAGE_TABLE_NOENC;
|
|
} else {
|
|
/* take the new root table pointer from the current entry #0 */
|
|
new_cr3 = (u64 *)(native_pgd_val(cr3[0]) & PTE_PFN_MASK);
|
|
|
|
/* copy the new root table if it is not 32-bit addressable */
|
|
if ((u64)new_cr3 > U32_MAX)
|
|
new_cr3 = memcpy(pgt, new_cr3, PAGE_SIZE);
|
|
}
|
|
|
|
native_load_gdt(&(struct desc_ptr){ sizeof(gdt) - 1, (u64)gdt });
|
|
|
|
la57_toggle(new_cr3);
|
|
}
|