public inbox for stable@vger.kernel.org
 help / color / mirror / Atom feed
From: Nicolas Saenz Julienne <nsaenz@amazon.com>
To: Ard Biesheuvel <ardb@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>,
	Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
	Dave Hansen <dave.hansen@linux.intel.com>, <x86@kernel.org>,
	"H . Peter Anvin" <hpa@zytor.com>,
	Sai Praneeth <sai.praneeth.prakhya@intel.com>,
	Matt Fleming <matt@codeblueprint.co.uk>,
	<linux-efi@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
	<stanspas@amazon.de>, <nh-open-source@amazon.com>,
	Nicolas Saenz Julienne <nsaenz@amazon.com>,
	<stable@vger.kernel.org>
Subject: [PATCH] x86/efi: Apply EFI Memory Attributes after kexec
Date: Mon, 11 Nov 2024 21:45:27 +0000	[thread overview]
Message-ID: <20241111214527.18289-1-nsaenz@amazon.com> (raw)

Kexec bypasses EFI's switch to virtual mode. In exchange, it has its own
routine, kexec_enter_virtual_mode(), that replays the mappings made by
the original kernel. Unfortunately, the function fails to reinstate
EFI's memory attributes and runtime memory protections, which would've
otherwise been set after entering virtual mode. Remediate this by
calling efi_runtime_update_mappings() from it.

Cc: stable@vger.kernel.org
Fixes: 18141e89a76c ("x86/efi: Add support for EFI_MEMORY_ATTRIBUTES_TABLE")
Signed-off-by: Nicolas Saenz Julienne <nsaenz@amazon.com>

---

Notes:
- I tested the Memory Attributes path using QEMU/OVMF.

- Although care is taken to make sure the memory backing the EFI Memory
  Attributes table is preserved during runtime and reachable after kexec
  (see efi_memattr_init()). I don't see the same happening for the EFI
  properties table. Maybe it's just unnecessary as there's an assumption
  that the table will fall in memory preserved during runtime? Or for
  another reason? Otherwise, we'd need to make sure it isn't possible to
  set EFI_NX_PE_DATA on kexec.

 arch/x86/platform/efi/efi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index 88a96816de9a..b9b17892c495 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -784,6 +784,7 @@ static void __init kexec_enter_virtual_mode(void)
 
 	efi_sync_low_kernel_mappings();
 	efi_native_runtime_setup();
+	efi_runtime_update_mappings();
 #endif
 }
 
-- 
2.40.1


             reply	other threads:[~2024-11-11 21:45 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-11-11 21:45 Nicolas Saenz Julienne [this message]
2024-11-12  7:55 ` [PATCH] x86/efi: Apply EFI Memory Attributes after kexec Ard Biesheuvel
2024-11-12  9:01   ` Nicolas Saenz Julienne

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20241111214527.18289-1-nsaenz@amazon.com \
    --to=nsaenz@amazon.com \
    --cc=ardb@kernel.org \
    --cc=bp@alien8.de \
    --cc=dave.hansen@linux.intel.com \
    --cc=hpa@zytor.com \
    --cc=linux-efi@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=matt@codeblueprint.co.uk \
    --cc=mingo@redhat.com \
    --cc=nh-open-source@amazon.com \
    --cc=sai.praneeth.prakhya@intel.com \
    --cc=stable@vger.kernel.org \
    --cc=stanspas@amazon.de \
    --cc=tglx@linutronix.de \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox