linux-kernel - Re: [REGRESSION] GHES firmware can't be readonly - Was: Re: [PATCH v3 3/3] arm64: acpi: Enable ACPI CCEL support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aSRaME9ZO-nchE1I@willie-the-truck>
Date: Mon, 24 Nov 2025 13:14:24 +0000
From: Will Deacon <will@...nel.org>
To: Suzuki K Poulose <suzuki.poulose@....com>
Cc: Mauro Carvalho Chehab <mchehab+huawei@...nel.org>,
	Jonathan Cameron <Jonathan.Cameron@...wei.com>,
	linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
	linux-coco@...ts.linux.dev, catalin.marinas@....com,
	gshan@...hat.com, aneesh.kumar@...nel.org, sami.mujawar@....com,
	sudeep.holla@....com, steven.price@....com,
	regressions@...ts.linux.dev
Subject: Re: [REGRESSION] GHES firmware can't be readonly - Was: Re: [PATCH
 v3 3/3] arm64: acpi: Enable ACPI CCEL support

On Mon, Nov 24, 2025 at 05:21:00AM +0000, Suzuki K Poulose wrote:
> On 21/11/2025 21:46, Mauro Carvalho Chehab wrote:
> > Hi,
> > 
> > Em Thu, 18 Sep 2025 13:56:18 +0100
> > Suzuki K Poulose <suzuki.poulose@....com> escreveu:
> > 
> > > Add support for ACPI CCEL by handling the EfiACPIMemoryNVS type memory.
> > > As per UEFI specifications NVS memory is reserved for Firmware use even
> > > after exiting boot services. Thus map the region as read-only.
> > > 
> > > Cc: Sami Mujawar <sami.mujawar@....com>
> > > Cc: Will Deacon <will@...nel.org>
> > > Cc: Catalin Marinas <catalin.marinas@....com>
> > > Cc: Aneesh Kumar K.V <aneesh.kumar@...nel.org>
> > > Cc: Steven Price <steven.price@....com>
> > > Cc: Sudeep Holla <sudeep.holla@....com>
> > > Cc: Gavin Shan <gshan@...hat.com>
> > > Reviewed-by: Gavin Shan <gshan@...hat.com>
> > > Tested-by: Sami Mujawar <sami.mujawar@....com>
> > > Signed-off-by: Suzuki K Poulose <suzuki.poulose@....com>
> > > ---
> > >   arch/arm64/kernel/acpi.c | 10 ++++++++++
> > >   1 file changed, 10 insertions(+)
> > > 
> > > diff --git a/arch/arm64/kernel/acpi.c b/arch/arm64/kernel/acpi.c
> > > index 4d529ff7ba51..b3195b3b895f 100644
> > > --- a/arch/arm64/kernel/acpi.c
> > > +++ b/arch/arm64/kernel/acpi.c
> > > @@ -357,6 +357,16 @@ void __iomem *acpi_os_ioremap(acpi_physical_address phys, acpi_size size)
> > >   			 * as long as we take care not to create a writable
> > >   			 * mapping for executable code.
> > >   			 */
> > > +			fallthrough;
> > > +
> > > +		case EFI_ACPI_MEMORY_NVS:
> > > +			/*
> > > +			 * ACPI NVS marks an area reserved for use by the
> > > +			 * firmware, even after exiting the boot service.
> > > +			 * This may be used by the firmware for sharing dynamic
> > > +			 * tables/data (e.g., ACPI CCEL) with the OS. Map it
> > > +			 * as read-only.
> > > +			 */
> > >   			prot = PAGE_KERNEL_RO;
> > 
> > Please revert this change.
> > 
> > Making area reserved to be used by firmware breaks some APEI
> > notification mechanisms:
> 
> Thanks for the report. Clearly, we missed this case. I am happy for this
> patch to be reverted and we can work out the handling of NVS later.

I'll revert the change shortly.

Will