Re: [PATCH 2/2] x86/efi: Map EFI_MEMORY_{XP,RO} memory region bits to EFI page tables

[Matt Fleming <matt-mF/unelCI9GS6iBeEJttW/XRex20P6io@public.gmane.org>]

On Fri, 29 Jan, at 05:04:40PM, Sai Praneeth Prakhya wrote:
> From: Sai Praneeth <sai.praneeth.prakhya-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
> 
> Now that we have EFI memory region bits that indicate which regions do
> not need execute permission or read/write permission in the page tables,
> let's use them.
> 
> We also check for EFI_NX_PE_DATA and only enforce the restrictive
> mappings if it's present (to allow us to ignore buggy firmware that sets
> bits it didn't mean to and to preserve backwards compatibility).
> 
> Instead of assuming that firmware would set appropriate attributes in
> memory descriptor like EFI_MEMORY_RO for code and EFI_MEMORY_XP for
> data, we can expect some firmware out there which might only set *type*
> in memory descriptor to be EFI_RUNTIME_SERVICES_CODE or
> EFI_RUNTIME_SERVICES_DATA leaving away attribute. This will lead to
> improper mappings of EFI runtime regions. In order to avoid it, we check
> attribute and type of memory descriptor to update mappings and moreover
> Windows works this way.
> 
> Cc: Borislav Petkov <bp-Gina5bIWoIWzQB+pC5nmwQ@public.gmane.org>
> Cc: Lee, Chun-Yi <jlee-IBi9RG/b67k@public.gmane.org>
> Cc: Ricardo Neri <ricardo.neri-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
> Cc: Ravi Shankar <ravi.v.shankar-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
> Signed-off-by: Matt Fleming <matt-mF/unelCI9GS6iBeEJttW/XRex20P6io@public.gmane.org>
> Signed-off-by: Sai Praneeth Prakhya <sai.praneeth.prakhya-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
> ---
>  arch/x86/include/asm/efi.h     |  2 +-
>  arch/x86/platform/efi/efi.c    |  9 +++++++--
>  arch/x86/platform/efi/efi_64.c | 45 ++++++++++++++++++++++++++++++++++++++----
>  3 files changed, 49 insertions(+), 7 deletions(-)

Applied.