From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matt Fleming Subject: Re: [PATCH v2] x86/mm: warn on W+x mappings Date: Thu, 15 Oct 2015 11:10:16 +0100 Message-ID: <20151015101016.GB2975@codeblueprint.co.uk> References: <5613EAD5.2070405@tycho.nsa.gov> <20151012113605.GB7384@pd.tnic> <20151012124113.GD2579@codeblueprint.co.uk> <20151012124936.GA6260@gmail.com> <20151012125548.GE2579@codeblueprint.co.uk> <20151012141754.GA6621@gmail.com> <20151012144928.GF2579@codeblueprint.co.uk> <20151014151807.GA27013@gmail.com> <20151014153522.GC8218@pd.tnic> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <20151014153522.GC8218-fF5Pk5pvG8Y@public.gmane.org> Sender: linux-efi-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Borislav Petkov Cc: Andy Lutomirski , Ingo Molnar , Stephen Smalley , X86 ML , "linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , Kees Cook , Thomas Gleixner , "H. Peter Anvin" , Peter Zijlstra , Andy Lutomirski , Denys Vlasenko , Brian Gerst , "linux-efi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , Ard Biesheuvel , Ricardo Neri , luv-hn68Rpc1hR1g9hUCZPvPmw@public.gmane.org List-Id: linux-efi@vger.kernel.org On Wed, 14 Oct, at 05:35:22PM, Borislav Petkov wrote: > On Wed, Oct 14, 2015 at 08:30:48AM -0700, Andy Lutomirski wrote: > > Can we just unmap these things until someone tries to do an EFI call, > > and then unmap them again after the call returns? We already switch > > pgds for EFI IIRC. > > hpa did mention an EFI-aware page fault handler at the time. I guess we > could do that too... We do this for the Linux UEFI Validation project kernel [1]. There, we do not map EFI Boot Services regions by default, only if the firmware tries to access them. This gives us the opporunity to print an error message if Boot Services regions are accessed after ExitBootServices() (which is the bug mjg59 describes in commit 916f676f8dc0 ("x86, efi: Retain boot service code until after switching to virtual mode")). But for the issue being discussed in this thread, the thing unmapping the EFI regions buys you is that they're no longer accessible from the x86 sleep/wakeup code paths, since those also use trampoline_pgd which is where the EFI page tables are mapped. And that's probably a good idea. [1] - https://git.kernel.org/cgit/linux/kernel/git/mfleming/efi.git/commit/?h=stable&id=9b78793058bf93958aa9529400cb2617ec1bc958 -- Matt Fleming, Intel Open Source Technology Center From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752419AbbJOKKX (ORCPT ); Thu, 15 Oct 2015 06:10:23 -0400 Received: from mail-wi0-f170.google.com ([209.85.212.170]:37493 "EHLO mail-wi0-f170.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751048AbbJOKKV (ORCPT ); Thu, 15 Oct 2015 06:10:21 -0400 Date: Thu, 15 Oct 2015 11:10:16 +0100 From: Matt Fleming To: Borislav Petkov Cc: Andy Lutomirski , Ingo Molnar , Stephen Smalley , X86 ML , "linux-kernel@vger.kernel.org" , Kees Cook , Thomas Gleixner , "H. Peter Anvin" , Peter Zijlstra , Andy Lutomirski , Denys Vlasenko , Brian Gerst , "linux-efi@vger.kernel.org" , Ard Biesheuvel , Ricardo Neri , luv@ml01.01.org Subject: Re: [PATCH v2] x86/mm: warn on W+x mappings Message-ID: <20151015101016.GB2975@codeblueprint.co.uk> References: <5613EAD5.2070405@tycho.nsa.gov> <20151012113605.GB7384@pd.tnic> <20151012124113.GD2579@codeblueprint.co.uk> <20151012124936.GA6260@gmail.com> <20151012125548.GE2579@codeblueprint.co.uk> <20151012141754.GA6621@gmail.com> <20151012144928.GF2579@codeblueprint.co.uk> <20151014151807.GA27013@gmail.com> <20151014153522.GC8218@pd.tnic> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20151014153522.GC8218@pd.tnic> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 14 Oct, at 05:35:22PM, Borislav Petkov wrote: > On Wed, Oct 14, 2015 at 08:30:48AM -0700, Andy Lutomirski wrote: > > Can we just unmap these things until someone tries to do an EFI call, > > and then unmap them again after the call returns? We already switch > > pgds for EFI IIRC. > > hpa did mention an EFI-aware page fault handler at the time. I guess we > could do that too... We do this for the Linux UEFI Validation project kernel [1]. There, we do not map EFI Boot Services regions by default, only if the firmware tries to access them. This gives us the opporunity to print an error message if Boot Services regions are accessed after ExitBootServices() (which is the bug mjg59 describes in commit 916f676f8dc0 ("x86, efi: Retain boot service code until after switching to virtual mode")). But for the issue being discussed in this thread, the thing unmapping the EFI regions buys you is that they're no longer accessible from the x86 sleep/wakeup code paths, since those also use trampoline_pgd which is where the EFI page tables are mapped. And that's probably a good idea. [1] - https://git.kernel.org/cgit/linux/kernel/git/mfleming/efi.git/commit/?h=stable&id=9b78793058bf93958aa9529400cb2617ec1bc958 -- Matt Fleming, Intel Open Source Technology Center