[PATCH] x86: add missing verify_cpu to 32bit wakeup

[Kees Cook]

Some BIOSes will reset the Intel XD_DISABLE MSR bit when resuming from S3,
which can interact poorly with ebba638ae723d8a8fc2f7abce5ec18b688b791d7.
In 32bit PAE mode, this can lead to a fault when EFER is restored by
the kernel wakeup routines, due to it setting the NX bit for a CPU
that (thanks to the BIOS reset) now incorrectly thinks it lacks the NX
feature. 64bit wakeup already handled this through its common call path
that would hit verify_cpu(). 32bit has a separate path for restoring
CPU state on S3 wakeup, and needed to call verify_cpu() to handle this
situation.

Signed-off-by: Kees Cook <kees.cook@xxxxxxxxxxxxx>
Cc: stable@xxxxxxxxxx
---
 arch/x86/kernel/acpi/realmode/wakeup.S |    4 ++++
 arch/x86/kernel/verify_cpu.S           |    1 +
 2 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/arch/x86/kernel/acpi/realmode/wakeup.S b/arch/x86/kernel/acpi/realmode/wakeup.S
index ead21b6..19698da 100644
--- a/arch/x86/kernel/acpi/realmode/wakeup.S
+++ b/arch/x86/kernel/acpi/realmode/wakeup.S
@@ -94,6 +94,9 @@ wakeup_code:
 	/* Do any other stuff... */
 
 #ifndef CONFIG_64BIT
+	/* Recheck NX bit overrides (64bit path does this in trampoline) */
+	call	verify_cpu
+
 	/* This could also be done in C code... */
 	movl	pmode_cr3, %eax
 	movl	%eax, %cr3
@@ -117,6 +120,7 @@ wakeup_code:
 	movl	pmode_cr0, %eax
 	movl	%eax, %cr0
 	jmp	pmode_return
+# include "../../verify_cpu.S"
 #else
 	pushw	$0
 	pushw	trampoline_segment
diff --git a/arch/x86/kernel/verify_cpu.S b/arch/x86/kernel/verify_cpu.S
index b9242ba..50c5edd 100644
--- a/arch/x86/kernel/verify_cpu.S
+++ b/arch/x86/kernel/verify_cpu.S
@@ -20,6 +20,7 @@
  *	arch/x86/boot/compressed/head_64.S: Boot cpu verification
  *	arch/x86/kernel/trampoline_64.S: secondary processor verification
  *	arch/x86/kernel/head_32.S: processor startup
+ *	arch/x86/kernel/acpi/realmode/wakeup.S: 32bit processor resume
  *
  *	verify_cpu, returns the status of longmode and SSE in register %eax.
  *		0: Success    1: Failure
-- 
1.7.4.1

-- 
Kees Cook
Ubuntu Security Team
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/