From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0442C4332F for ; Thu, 20 Oct 2022 11:05:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231231AbiJTLFr (ORCPT ); Thu, 20 Oct 2022 07:05:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48558 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231233AbiJTLFm (ORCPT ); Thu, 20 Oct 2022 07:05:42 -0400 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 28ED011F4BC; Thu, 20 Oct 2022 04:05:31 -0700 (PDT) Received: from mail.ispras.ru (unknown [83.149.199.84]) by mail.ispras.ru (Postfix) with ESMTPSA id 0A0B040D403D; Thu, 20 Oct 2022 11:05:28 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.ispras.ru 0A0B040D403D DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ispras.ru; s=default; t=1666263928; bh=5nyZu9zbyZQkn1yMUyXsSQkh3IfzDySokwqJAcsKRCg=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=f3sXzuOR1nPhHEECi3o557B2M3QIspwU3OGXzVqGInFdxo605ltEoce4HANMYSMmM lT8OCKc1DicmXiXZG7CJVTJAJWpuDWPT1WVtw7hEkliT/UEPK07Txy1JzMIKL0Vo7n I/Zow9hRC77Wmwne4UyL4b0oRNg1lInSfI0/5Zqg= MIME-Version: 1.0 Date: Thu, 20 Oct 2022 14:05:27 +0300 From: Evgeniy Baskov To: Peter Jones Cc: Ard Biesheuvel , Borislav Petkov , Andy Lutomirski , Dave Hansen , Ingo Molnar , Peter Zijlstra , Thomas Gleixner , Alexey Khoroshilov , lvc-project@linuxtesting.org, x86@kernel.org, linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: Re: [PATCH 00/16] x86_64: Improvements at compressed kernel stage In-Reply-To: <20221018210447.sg3tddaujre6orgc@redhat.com> References: <20221018210447.sg3tddaujre6orgc@redhat.com> User-Agent: Roundcube Webmail/1.4.4 Message-ID: X-Sender: baskov@ispras.ru Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2022-10-19 00:04, Peter Jones wrote: > On Tue, Sep 06, 2022 at 01:41:04PM +0300, Evgeniy Baskov wrote: >> This patchset is aimed >> * to improve UEFI compatibility of compressed kernel code for x86_64 >> * to setup proper memory access attributes for code and rodata >> sections >> * to implement W^X protection policy throughout the whole execution >> of compressed kernel for EFISTUB code path. > > Hi Evgeniy, > > I've tested this set of patches with the Mu firmware that supports the > W^X > feature and a modified bootloader to also support it, and also with an > existing firmware and the grub2 build in fedora 36. On the firmware > without W^X support, this all works for me. With W^X support, it works > so long as I use CONFIG_EFI_STUB_EXTRACT_DIRECT, though I still need > some changes in grub's loader. IMO that's a big step forward. > > I can't currently make it work with W^X enabled but without direct > extraction, and I'm still investigating why not, but I figured I'd give > you a heads up. Hi Peter, Thank you for testing! Without direct extraction enabled this patch set does not implement total W^X and needs to allocate RWX memory regions, since it should go through common code path that relocates kernel. So if the firmware does not allow allocating RWX regions, it might prevent the kernel from booting, I think. I will look into that problem soon and let you know it I find anything. Thanks, Evgeniy Baskov