Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756244AbbLHM0D (ORCPT ); Tue, 8 Dec 2015 07:26:03 -0500 Received: from mail-wm0-f53.google.com ([74.125.82.53]:34798 "EHLO mail-wm0-f53.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755518AbbLHM0A (ORCPT ); Tue, 8 Dec 2015 07:26:00 -0500 Date: Tue, 8 Dec 2015 12:25:57 +0000 From: Matt Fleming To: Kosuke Tatsukawa Cc: Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , "x86@kernel.org" , "linux-efi@vger.kernel.org" , "linux-kernel@vger.kernel.org" , Borislav Petkov Subject: Re: [PATCH 1/2] x86: Fix kernel panic when booting with XD disabled in uEFI firmware Message-ID: <20151208122557.GA2518@codeblueprint.co.uk> References: <20151204164057.GE2514@codeblueprint.co.uk> <17EC94B0A072C34B8DCF0D30AD16044A0288EFC7@BPXM09GP.gisp.nec.co.jp> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <17EC94B0A072C34B8DCF0D30AD16044A0288EFC7@BPXM09GP.gisp.nec.co.jp> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1551 Lines: 35 On Mon, 07 Dec, at 11:10:43PM, Kosuke Tatsukawa wrote: > > Thank you pointing that out. > > linux-4.4-rc3 booted without a problem on a real server even with XD > turned off by the firmware. I didn't notice this before because I was > using an older version of the kernel on the real server, and doing > investigation on a KVM guest. > > The "noexec=off" kernel parameter still seems to come up with EFI > runtime service disabled though. Do you think this should be left alone > as an disadvantage for using a bad option? Good question. I couldn't find any other examples of code that returns an error if PAGE_NX isn't supported either by the hardware or via the noexec command line option. Things like set_memory_x() and set_memory_nx() return success without actually doing anything. While I'm all for using hardware security features wherever possible, such as force-enabling it in commit 04633df0c43d ("x86/cpu: Call verify_cpu() after having entered long mode too"), if the user has explicitly turned it off on the kernel command line, we should still try and provide EFI services. Borislav, what do you think about stripping PAGE_NX from 'page_flags' in kernel_map_pages_in_pgd() if NX isn't supported, rather than returning EINVAL? At least that way EFI runtime services would still work. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/