From patchwork Tue Jul 16 22:15:26 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthew Garrett X-Patchwork-Id: 11046763 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 93DFB912 for ; Tue, 16 Jul 2019 22:15:33 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 83A5F285E8 for ; Tue, 16 Jul 2019 22:15:33 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 760C128647; Tue, 16 Jul 2019 22:15:33 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.5 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_HI,USER_IN_DEF_DKIM_WL autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BA96F28640 for ; Tue, 16 Jul 2019 22:15:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728601AbfGPWPc (ORCPT ); Tue, 16 Jul 2019 18:15:32 -0400 Received: from mail-vk1-f201.google.com ([209.85.221.201]:48869 "EHLO mail-vk1-f201.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728235AbfGPWPb (ORCPT ); Tue, 16 Jul 2019 18:15:31 -0400 Received: by mail-vk1-f201.google.com with SMTP id x71so1550369vkd.15 for ; Tue, 16 Jul 2019 15:15:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=MvZvD71NFoDIg+SfvI+3kyXWKLTiQPbfbya7b91g9Tg=; b=X3051l97q7WdCLQBVjol9cBje+bAR7tZU5T/uQTI1F/FjcmptyxJ/DI0gN43DQmodK 8PEmfGnt+6WTgIQGJPEbknwewiWMDNysfB7S8WaG+ibS5pZNpcozNsImHcmT+N20/e9z 14wyFoPxFqvojcSD28sj3c1kFpIlrj7UGtA2t/eQ7/DxeDCdKBxemvOLhB52W2Hiv3ye UvdvJCen5gHJc1hFcA+uE73xnhnwVj7H+guYZpN7p1+Fz8SCU4A0lyWm+0hsyQH/Y7mz Y2iq5jBkBXwbXUKRCyMItOv05b+n1Pd3w4skLHg/xSOCndPI6loxC1d6ym5c4tgYAZuV /0jA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=MvZvD71NFoDIg+SfvI+3kyXWKLTiQPbfbya7b91g9Tg=; b=XF4gaeVYuVpzS+DgxUZP0YIP/UbCy2+gNzClmhM1kuk+xD0MsT4QgRBryuNi6T6DLM g/PH59Z4UFQOKizScC5yDzZqztaiu9hzoolKbwgvwZJ3fAJzHJK4WzE8ZMEkcaPLdz4u bD6Pop+i2vcfj1iK+a4srmmM+td5WGO7yOI4FoyQrpgPaC1RpAEf4jQnFpEops83XSHB zRIG5zadMTrLI0kyw/Rry44YKFGgybFfvsLq2/Tb63Sd89r1I7Mo5mtzyPLAg1CeC70v 6g9vZvmIDXm8gIjEz5RolhAu6PgMuwnFFPz7jfB1F7xFYHjEUjohkm+8aucimnlObGCA +8JA== X-Gm-Message-State: APjAAAUMHVv3PSejJkxybUzxeiA0y4keG300zo/lYdKn0TjCjxRrv+02 r9h9h1SeGq/cvUadplNTF/44kzwAweg3GSHDqE3of4KjUDcpc7iq7aZjcw7zs/6V53Zz0ecfcpH MhpBNPVRg7SKQFsJ+5npBT7ttBBzjxAAkrKTWnlW2tWVl+suT1i746p9j3RKVs9qgvS7nHmo+99 YCCumV3fXE5kQ/PYbBbx1l5i6tBJg= X-Google-Smtp-Source: APXvYqw6McX1xHGssSeVCoIHR48jVhR7fZmFdqKqp5rprhARgbmWL/d86S4HD2lpgnw54uo5A4VlM/yzWLW0xCmQoSPvog== X-Received: by 2002:a1f:8513:: with SMTP id h19mr13430748vkd.92.1563315329685; Tue, 16 Jul 2019 15:15:29 -0700 (PDT) Date: Tue, 16 Jul 2019 15:15:26 -0700 In-Reply-To: <937ce9400ed86ad089d743dcca7b5926a7172566> Message-Id: <20190716221526.63422-1-matthewgarrett@google.com> Mime-Version: 1.0 References: <937ce9400ed86ad089d743dcca7b5926a7172566> X-Mailer: git-send-email 2.22.0.510.g264f2c817a-goog Subject: [RFC] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down From: Matthew Garrett To: linux-security-module@vger.kernel.org Cc: Matthew Garrett , Josh Boyer , David Howells , Kees Cook , Dave Young , linux-acpi@vger.kernel.org Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP From: Matthew Garrett How about this? It still results in the early boot environment trusting the RSDP parameter, but only for SRAT parsing - it'll be ignored everywhere in the kernel proper if lockdown is enforcing. This option allows userspace to pass the RSDP address to the kernel, which makes it possible for a user to modify the workings of hardware. Reject the option when the kernel is locked down. This requires some reworking of the existing RSDP command line logic, since the early boot code also makes use of a command-line passed RSDP when locating the SRAT table before the lockdown code has been initialised. This is achieved by separating the command line RSDP path in the early boot code from the generic RSDP path, and then copying the command line RSDP into boot params in the kernel proper if lockdown is not enabled. If lockdown is enabled and an RSDP is provided on the command line, this will only be used when parsing SRAT (which shouldn't permit kernel code execution) and will be ignored in the rest of the kernel. (Modified by Matthew Garrett in order to handle the early boot RSDP environment) Signed-off-by: Josh Boyer Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook cc: Dave Young cc: linux-acpi@vger.kernel.org --- arch/x86/boot/compressed/acpi.c | 19 +++++++++++++------ arch/x86/include/asm/acpi.h | 9 +++++++++ arch/x86/include/asm/x86_init.h | 2 ++ arch/x86/kernel/acpi/boot.c | 5 +++++ arch/x86/kernel/x86_init.c | 1 + drivers/acpi/osl.c | 14 +++++++++++++- include/linux/acpi.h | 6 ++++++ 7 files changed, 49 insertions(+), 7 deletions(-) diff --git a/arch/x86/boot/compressed/acpi.c b/arch/x86/boot/compressed/acpi.c index 15255f388a85..149795c369f2 100644 --- a/arch/x86/boot/compressed/acpi.c +++ b/arch/x86/boot/compressed/acpi.c @@ -26,7 +26,7 @@ struct mem_vector immovable_mem[MAX_NUMNODES*2]; */ #define MAX_ADDR_LEN 19 -static acpi_physical_address get_acpi_rsdp(void) +static acpi_physical_address get_cmdline_acpi_rsdp(void) { acpi_physical_address addr = 0; @@ -278,10 +278,7 @@ acpi_physical_address get_rsdp_addr(void) { acpi_physical_address pa; - pa = get_acpi_rsdp(); - - if (!pa) - pa = boot_params->acpi_rsdp_addr; + pa = boot_params->acpi_rsdp_addr; /* * Try to get EFI data from setup_data. This can happen when we're a @@ -311,7 +308,17 @@ static unsigned long get_acpi_srat_table(void) char arg[10]; u8 *entry; - rsdp = (struct acpi_table_rsdp *)(long)boot_params->acpi_rsdp_addr; + /* + * Check whether we were given an RSDP on the command line. We don't + * stash this in boot params because the kernel itself may have + * different ideas about whether to trust a command-line parameter. + */ + rsdp = (struct acpi_table_rsdp *)get_cmdline_acpi_rsdp(); + + if (!rsdp) + rsdp = (struct acpi_table_rsdp *)(long) + boot_params->acpi_rsdp_addr; + if (!rsdp) return 0; diff --git a/arch/x86/include/asm/acpi.h b/arch/x86/include/asm/acpi.h index aac686e1e005..bc9693c9107e 100644 --- a/arch/x86/include/asm/acpi.h +++ b/arch/x86/include/asm/acpi.h @@ -117,6 +117,12 @@ static inline bool acpi_has_cpu_in_madt(void) return !!acpi_lapic; } +#define ACPI_HAVE_ARCH_SET_ROOT_POINTER +static inline void acpi_arch_set_root_pointer(u64 addr) +{ + x86_init.acpi.set_root_pointer(addr); +} + #define ACPI_HAVE_ARCH_GET_ROOT_POINTER static inline u64 acpi_arch_get_root_pointer(void) { @@ -125,6 +131,7 @@ static inline u64 acpi_arch_get_root_pointer(void) void acpi_generic_reduced_hw_init(void); +void x86_default_set_root_pointer(u64 addr); u64 x86_default_get_root_pointer(void); #else /* !CONFIG_ACPI */ @@ -138,6 +145,8 @@ static inline void disable_acpi(void) { } static inline void acpi_generic_reduced_hw_init(void) { } +static inline void x86_default_set_root_pointer(u64 addr) { } + static inline u64 x86_default_get_root_pointer(void) { return 0; diff --git a/arch/x86/include/asm/x86_init.h b/arch/x86/include/asm/x86_init.h index b85a7c54c6a1..d584128435cb 100644 --- a/arch/x86/include/asm/x86_init.h +++ b/arch/x86/include/asm/x86_init.h @@ -134,10 +134,12 @@ struct x86_hyper_init { /** * struct x86_init_acpi - x86 ACPI init functions + * @set_root_poitner: set RSDP address * @get_root_pointer: get RSDP address * @reduced_hw_early_init: hardware reduced platform early init */ struct x86_init_acpi { + void (*set_root_pointer)(u64 addr); u64 (*get_root_pointer)(void); void (*reduced_hw_early_init)(void); }; diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c index 17b33ef604f3..04205ce127a1 100644 --- a/arch/x86/kernel/acpi/boot.c +++ b/arch/x86/kernel/acpi/boot.c @@ -1760,6 +1760,11 @@ void __init arch_reserve_mem_area(acpi_physical_address addr, size_t size) e820__update_table_print(); } +void x86_default_set_root_pointer(u64 addr) +{ + boot_params.acpi_rsdp_addr = addr; +} + u64 x86_default_get_root_pointer(void) { return boot_params.acpi_rsdp_addr; diff --git a/arch/x86/kernel/x86_init.c b/arch/x86/kernel/x86_init.c index 50a2b492fdd6..d0b8f5585a73 100644 --- a/arch/x86/kernel/x86_init.c +++ b/arch/x86/kernel/x86_init.c @@ -95,6 +95,7 @@ struct x86_init_ops x86_init __initdata = { }, .acpi = { + .set_root_pointer = x86_default_set_root_pointer, .get_root_pointer = x86_default_get_root_pointer, .reduced_hw_early_init = acpi_generic_reduced_hw_init, }, diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c index 9c0edf2fc0dd..d43df3a3fa8d 100644 --- a/drivers/acpi/osl.c +++ b/drivers/acpi/osl.c @@ -26,6 +26,7 @@ #include #include #include +#include #include #include @@ -180,8 +181,19 @@ acpi_physical_address __init acpi_os_get_root_pointer(void) acpi_physical_address pa; #ifdef CONFIG_KEXEC - if (acpi_rsdp) + /* + * We may have been provided with an RSDP on the command line, + * but if a malicious user has done so they may be pointing us + * at modified ACPI tables that could alter kernel behaviour - + * so, we check the lockdown status before making use of + * it. If we trust it then also stash it in an architecture + * specific location (if appropriate) so it can be carried + * over further kexec()s. + */ + if (acpi_rsdp && !security_locked_down(LOCKDOWN_ACPI_TABLES)) { + acpi_arch_set_root_pointer(acpi_rsdp); return acpi_rsdp; + } #endif pa = acpi_arch_get_root_pointer(); if (pa) diff --git a/include/linux/acpi.h b/include/linux/acpi.h index 451e7b544342..e826f7311b2b 100644 --- a/include/linux/acpi.h +++ b/include/linux/acpi.h @@ -639,6 +639,12 @@ bool acpi_gtdt_c3stop(int type); int acpi_arch_timer_mem_init(struct arch_timer_mem *timer_mem, int *timer_count); #endif +#ifndef ACPI_HAVE_ARCH_SET_ROOT_POINTER +static inline void acpi_arch_set_root_pointer(u64 addr) +{ +} +#endif + #ifndef ACPI_HAVE_ARCH_GET_ROOT_POINTER static inline u64 acpi_arch_get_root_pointer(void) {