lkml.org 
[lkml]   [2015]   [Oct]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v2] x86/mm: warn on W+x mappings

* Josh Triplett <josh@joshtriplett.org> wrote:

> On Wed, Oct 14, 2015 at 05:19:40PM +0200, Ingo Molnar wrote:
> >
> > * Josh Triplett <josh@joshtriplett.org> wrote:
> >
> > > On Mon, Oct 12, 2015 at 04:17:54PM +0200, Ingo Molnar wrote:
> > > > * Matt Fleming <matt@codeblueprint.co.uk> wrote:
> > > > > On Mon, 12 Oct, at 02:49:36PM, Ingo Molnar wrote:
> > > > > > So why not unmap them after bootup? Is there any reason to call into EFI code
> > > > > > while the system is up and running?
> > > > >
> > > > > That's where the runtime services code lives. So if you want things like EFI
> > > > > variables (used by the distro installer, among other things) you need to map the
> > > > > runtime regions.
> > > >
> > > > So EFI variables could be queried during bootup and saved on the Linux side.
> > >
> > > That wouldn't support writing to EFI variables. Or using the EFI
> > > capsule update system to update firmware.
> >
> > Well, if we know the location of those pages then we could map those 'rw-' - while
> > the rest would be mapped 'r-x'.
>
> We have no way to do so in the absence of the additional code/data
> separation information provided by more recent firmware.

But we could map those out via transparent page faults dynamically, as those
accesses happen. It should be maximally compatible AFAICS, even without the new
EFI extensions - and at no time would there be vulnerable 'rwx' mappings in the
kernel page tables.

Thanks,

Ingo


\
 
 \ /
  Last update: 2015-10-21 12:01    [W:0.083 / U:0.500 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site