x86/efi: Load fixmap GDT in efi_call_phys_epilog() before setting %cr3

groeck · KAGA-KOKO · commit cf40361ede6c · 2018-09-12T21:53:34.000+02:00
Commit eeb89e2 ("x86/efi: Load fixmap GDT in efi_call_phys_epilog()") moved loading the fixmap in efi_call_phys_epilog() after load_cr3() since it was assumed to be more logical. Turns out this is incorrect: In efi_call_phys_prolog(), the gdt with its physical address is loaded first, and when the %cr3 is reloaded in _epilog from initial_page_table to swapper_pg_dir again the gdt is no longer mapped. This results in a triple fault if an interrupt occurs after load_cr3() and before load_fixmap_gdt(0). Calling load_fixmap_gdt(0) first restores the execution order prior to commit eeb89e2 and fixes the problem. Fixes: eeb89e2 ("x86/efi: Load fixmap GDT in efi_call_phys_epilog()") Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: linux-efi@vger.kernel.org Cc: Andy Lutomirski <luto@amacapital.net> Cc: Joerg Roedel <jroedel@suse.de> Link: https://lkml.kernel.org/r/1536689892-21538-1-git-send-email-linux@roeck-us.net
diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c
@@ -85,10 +85,9 @@ pgd_t * __init efi_call_phys_prolog(void)
 
 void __init efi_call_phys_epilog(pgd_t *save_pgd)
 {
+	load_fixmap_gdt(0);
 	load_cr3(save_pgd);
 	__flush_tlb_all();
-
-	load_fixmap_gdt(0);
 }
 
 void __init efi_runtime_update_mappings(void)

Original file line number	Diff line number	Diff line change
`@@ -85,10 +85,9 @@ pgd_t * __init efi_call_phys_prolog(void)`
`85`	`85`
`86`	`86`	`void __init efi_call_phys_epilog(pgd_t *save_pgd)`
`87`	`87`	`{`
	`88`	`+ load_fixmap_gdt(0);`
`88`	`89`	`load_cr3(save_pgd);`
`89`	`90`	`__flush_tlb_all();`
`90`		`-`
`91`		`- load_fixmap_gdt(0);`
`92`	`91`	`}`
`93`	`92`
`94`	`93`	`void __init efi_runtime_update_mappings(void)`