linux-kernel - Re: [BUG] x86/efi: MMRs no longer properly mapped after switch to isolated page table

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 10 May 2016 12:35:11 -0500
From:	Alex Thorlton <athorlton@....com>
To:	Matt Fleming <matt@...eblueprint.co.uk>
Cc:	Alex Thorlton <athorlton@....com>, Borislav Petkov <bp@...e.de>,
	linux-kernel@...r.kernel.org, Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>, x86@...nel.org,
	linux-efi@...r.kernel.org, Russ Anderson <rja@....com>,
	Dimitri Sivanich <sivanich@....com>,
	mike travis <travis@....com>, Nathan Zimmer <nzimmer@....com>
Subject: Re: [BUG] x86/efi: MMRs no longer properly mapped after switch to
 isolated page table

On Mon, May 09, 2016 at 10:55:24PM +0100, Matt Fleming wrote:
> On Mon, 02 May, at 04:39:31PM, Alex Thorlton wrote:
> > 
> > If you think we're violating EFI rules by accessing these registers from
> > both sides of the fence, please let me know.  I'd like to make sure that
> > we get everything behaving the way it should be!
> 
> Oh no, I don't think this is violating the UEFI spec at all, but I do
> think it goes against the spirit of the way other implementations are
> designed; with maximum separation between firmware and kernel.

Understood.  Thanks!

> In a perfect world, I'd suggest mapping the MMR range in both the
> kernel and firmware, at different virtual address ranges, but have
> the firmware's version opaque to the kernel and only described by an
> EfiMemoryMappedIO region, or something. That is ignoring any region
> type conflicts that may arise.

The code I'm working on right now will do exactly this, so I think we're
on the right track there.  My solution is still a bit hacky, and we're
still working out some kinks with runtime EFI calls, but we're getting
closer.

I will send up an RFC patch with my findings as soon as we've worked out
our callback issues.  I'm working with our BIOS guys on this as we
speak.

Thanks again for the help, Matt!

- Alex