Re: [PATCH 1/2] x86: Fix kernel panic when booting with XD disabled in uEFI firmware

[Matt Fleming <matt@codeblueprint.co.uk>]

On Mon, 07 Dec, at 11:10:43PM, Kosuke Tatsukawa wrote:
> 
> Thank you pointing that out.
> 
> linux-4.4-rc3 booted without a problem on a real server even with XD
> turned off by the firmware.  I didn't notice this before because I was
> using an older version of the kernel on the real server, and doing
> investigation on a KVM guest.
> 
> The "noexec=off" kernel parameter still seems to come up with EFI
> runtime service disabled though.  Do you think this should be left alone
> as an disadvantage for using a bad option?

Good question.

I couldn't find any other examples of code that returns an error if
PAGE_NX isn't supported either by the hardware or via the noexec
command line option. Things like set_memory_x() and set_memory_nx()
return success without actually doing anything.

While I'm all for using hardware security features wherever possible,
such as force-enabling it in commit 04633df0c43d ("x86/cpu: Call
verify_cpu() after having entered long mode too"), if the user has
explicitly turned it off on the kernel command line, we should still
try and provide EFI services.

Borislav, what do you think about stripping PAGE_NX from 'page_flags'
in kernel_map_pages_in_pgd() if NX isn't supported, rather than
returning EINVAL? At least that way EFI runtime services would still
work.