From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754756AbbJNVDE (ORCPT ); Wed, 14 Oct 2015 17:03:04 -0400 Received: from mail-wi0-f179.google.com ([209.85.212.179]:37246 "EHLO mail-wi0-f179.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754744AbbJNVDA (ORCPT ); Wed, 14 Oct 2015 17:03:00 -0400 Date: Wed, 14 Oct 2015 22:02:57 +0100 From: Matt Fleming To: Ingo Molnar Cc: Borislav Petkov , Stephen Smalley , x86@kernel.org, linux-kernel@vger.kernel.org, keescook@chromium.org, Thomas Gleixner , "H. Peter Anvin" , Peter Zijlstra , Andy Lutomirski , Denys Vlasenko , Brian Gerst , linux-efi@vger.kernel.org, Ard Biesheuvel Subject: Re: [PATCH v2] x86/mm: warn on W+x mappings Message-ID: <20151014210257.GF2782@codeblueprint.co.uk> References: <5612CBE8.2010504@tycho.nsa.gov> <20151006073205.GA11115@gmail.com> <5613EAD5.2070405@tycho.nsa.gov> <20151012113605.GB7384@pd.tnic> <20151012124113.GD2579@codeblueprint.co.uk> <20151012124936.GA6260@gmail.com> <20151012125548.GE2579@codeblueprint.co.uk> <20151012141754.GA6621@gmail.com> <20151012144928.GF2579@codeblueprint.co.uk> <20151014151807.GA27013@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20151014151807.GA27013@gmail.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 14 Oct, at 05:18:07PM, Ingo Molnar wrote: > > * Matt Fleming wrote: > > > On Mon, 12 Oct, at 04:17:54PM, Ingo Molnar wrote: > > > > > > * Matt Fleming wrote: > > > > > > > On Mon, 12 Oct, at 02:49:36PM, Ingo Molnar wrote: > > > > > > > > > > > > > > > So why not unmap them after bootup? Is there any reason to call into EFI code > > > > > while the system is up and running? > > > > > > > > That's where the runtime services code lives. So if you want things like EFI > > > > variables (used by the distro installer, among other things) you need to map the > > > > runtime regions. > > > > > > So EFI variables could be queried during bootup and saved on the Linux side. > > > > Right, we could do that, but then we wouldn't be able to support > > creation/updating variables at runtime, such as when you install a > > distribution for the first time, or want to boot a new kernel filename > > directly from the firmware without a boot loader (and need to modify > > the BootXXXX variables). > > Do we know the precise position and address range of these variables? > > We could map them writable (but not executable), and the rest executable (but not > writable). The variables are stored in NVRAM, which we don't map into the kernel virtual address space. We have to initiate the transaction of writing to the variables by executing EFI runtime services. We obviously have buffers that we pass to the BIOS that contain variable data, but these should be NX anyway because they're regular kernel allocations. > That raises the question whether the same physical page ever mixes variables and > actual code - but the hope would be that it's suffiently page granular for this to > work. I don't think that would ever happen. -- Matt Fleming, Intel Open Source Technology Center