linux-kernel - Re: [PATCH] efi/x86: Ensure that EFI_RUNTIME

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230802142523.t5o36uy3z366jh27@box.shutemov.name>
Date:   Wed, 2 Aug 2023 17:25:23 +0300
From:   "Kirill A . Shutemov" <kirill.shutemov@...ux.intel.com>
To:     Ard Biesheuvel <ardb@...nel.org>
Cc:     linux-efi@...r.kernel.org, linux-kernel@...r.kernel.org,
        x86@...nel.org
Subject: Re: [PATCH] efi/x86: Ensure that EFI_RUNTIME_MAP is enabled for kexec

On Wed, Aug 02, 2023 at 03:37:04PM +0200, Ard Biesheuvel wrote:
> CONFIG_EFI_RUNTIME_MAP needs to be enabled in order for kexec to be able
> to provide the required information about the EFI runtime mappings to
> the incoming kernel, regardless of whether kexec_load() or
> kexec_file_load() is being used. Without this information, kexec boot in
> EFI mode is not possible.
> 
> The CONFIG_EFI_RUNTIME_MAP option is currently directly configurable if
> CONFIG_EXPERT is enabled, so that it can be turned on for debugging
> purposes even if KEXEC is. However, the upshot of this is that it can
> also be disabled even when it shouldn't.
> 
> So tweak the Kconfig declarations to avoid this situation.
> 
> Reported-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
> Signed-off-by: Ard Biesheuvel <ardb@...nel.org>

With the patch 'make oldconfig' updates config to enable
EFI_NEED_RUNTIME_MAP.

Tested-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>

Thanks.
> ---
>  arch/x86/Kconfig | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> index 7422db4097701c96..616498cdc91e8f01 100644
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -2027,10 +2027,14 @@ config EFI_MAX_FAKE_MEM
>  	  Ranges can be set up to this value using comma-separated list.
>  	  The default value is 8.
>  
> +config EFI_NEED_RUNTIME_MAP
> +	def_bool y
> +	depends on EFI && KEXEC_CORE
> +	select EFI_RUNTIME_MAP
> +

Just curious, why not extend 'config EFI' with 'select EFI_RUNTIME_MAP if KEXEC_CORE'?
It seems functionally equivalent, but more concise.

>  config EFI_RUNTIME_MAP
>  	bool "Export EFI runtime maps to sysfs" if EXPERT
>  	depends on EFI
> -	default KEXEC_CORE
>  	help
>  	  Export EFI runtime memory regions to /sys/firmware/efi/runtime-map.
>  	  That memory map is required by the 2nd kernel to set up EFI virtual
> -- 
> 2.39.2
> 

-- 
  Kiryl Shutsemau / Kirill A. Shutemov