From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ingo Molnar Subject: Re: [PATCH v2] x86/mm: warn on W+x mappings Date: Mon, 12 Oct 2015 16:17:54 +0200 Message-ID: <20151012141754.GA6621@gmail.com> References: <1443814185-21552-1-git-send-email-sds@tycho.nsa.gov> <20151003112701.GA4531@gmail.com> <5612CBE8.2010504@tycho.nsa.gov> <20151006073205.GA11115@gmail.com> <5613EAD5.2070405@tycho.nsa.gov> <20151012113605.GB7384@pd.tnic> <20151012124113.GD2579@codeblueprint.co.uk> <20151012124936.GA6260@gmail.com> <20151012125548.GE2579@codeblueprint.co.uk> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <20151012125548.GE2579-mF/unelCI9GS6iBeEJttW/XRex20P6io@public.gmane.org> Sender: linux-efi-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Matt Fleming Cc: Borislav Petkov , Stephen Smalley , x86-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org, Thomas Gleixner , "H. Peter Anvin" , Peter Zijlstra , Andy Lutomirski , Denys Vlasenko , Brian Gerst , linux-efi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Ard Biesheuvel List-Id: linux-efi@vger.kernel.org * Matt Fleming wrote: > On Mon, 12 Oct, at 02:49:36PM, Ingo Molnar wrote: > > > > > > So why not unmap them after bootup? Is there any reason to call into EFI code > > while the system is up and running? > > That's where the runtime services code lives. So if you want things like EFI > variables (used by the distro installer, among other things) you need to map the > runtime regions. So EFI variables could be queried during bootup and saved on the Linux side. Calling into firmware after the kernel has booted up is fragile in general - beyond W+X the security considerations. Thanks, Ingo