Re: [PATCHv2 1/3] x86, ptdump: Add section for EFI runtime services

[Borislav Petkov <bp@alien8.de>]

On Tue, Oct 07, 2014 at 07:07:48PM +0200, Mathias Krause wrote:
> What you can see here are actually the EFI runtime service mappings, not
> the ESP fix area. Check the addresses and compare them. You should find
> similarities ;) And, in fact, the EFI mappings are incomplete in the
> second dump, i.e. the vanilla kernel one, because of the enforced limit
> for the ESP fix area.
> 
> So, in your examples are actually *no* ESP fix area mappings as those
> would be r/o. In fact, I think, the above dumps are the result of a
> CONFIG_EFI_PGT_DUMP enabled kernel that dumps the page table after
> setting up the EFI mappings. There are no ESP fix mappings in this dump
> because those are only set up after the EFI runtime service mappings.

Ok, I think I know what the deal is:

So, the ptdump we do to dmesg very early at boot is the EFI pagetable which
shouldn't have espfix mappings...

> See the following code in init/main:
> 
>   #ifdef CONFIG_X86
>       if (efi_enabled(EFI_RUNTIME_SERVICES))
>           efi_enter_virtual_mode();
>   #endif
>   #ifdef CONFIG_X86_ESPFIX64
>       /* Should be run before the first non-init thread is created */
>       init_espfix_bsp();
>   #endif

... exactly because of this: we're setting up the EFI mappings in
the EFI page table before we do the espfix mappings in the *kernel*
pagetable which is a separate one.

So, if we have to be really correct about it, the first dump to dmesg
which comes down the efi_enter_virtual_mode() path shouldn't contain the
espfix area at all.

Later dumps from debugfs cannot select the EFI pagetable so they should
not be dumping the EFI runtime services.

I don't have a good idea about how to do that right now though, maybe
the address markers should have flags or so...

Thanks.

-- 
Regards/Gruss,
    Boris.

Sent from a fat crate under my desk. Formatting is fine.
--