Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Feedback-ID: iac594737:Fastmail
Date:   Fri, 30 Sep 2022 12:38:44 -0400
From:   Demi Marie Obenour <demi@invisiblethingslab.com>
To:     Jan Beulich <jbeulich@suse.com>
Cc:     xen-devel@lists.xenproject.org, linux-kernel@vger.kernel.org,
        linux-efi@vger.kernel.org, Juergen Gross <jgross@suse.com>,
        Stefano Stabellini <sstabellini@kernel.org>,
        Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>,
        Ard Biesheuvel <ardb@kernel.org>,
        Kees Cook <keescook@chromium.org>,
        Anton Vorontsov <anton@enomsg.org>,
        Colin Cross <ccross@android.com>,
        Tony Luck <tony.luck@intel.com>,
        Marek =?utf-8?Q?Marczykowski-G=C3=B3recki?= 
        <marmarek@invisiblethingslab.com>
Subject: Re: [PATCH v4 1/2] Avoid using EFI tables Xen may have clobbered
Message-ID: <Yzcbs6TYsFQU/I4f@itl-email>
References: <cover.1664298147.git.demi@invisiblethingslab.com>
 <f3b624e99adfdbbfc1976a60a73a6b5950e1840d.1664298147.git.demi@invisiblethingslab.com>
 <282a225d-8782-0321-6f0e-19dd4510dc42@suse.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
        protocol="application/pgp-signature"; boundary="SGczFINJLmmUm2Ge"
Content-Disposition: inline
In-Reply-To: <282a225d-8782-0321-6f0e-19dd4510dc42@suse.com>
Precedence: bulk


--SGczFINJLmmUm2Ge
Content-Type: text/plain; protected-headers=v1; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Date: Fri, 30 Sep 2022 12:38:44 -0400
From: Demi Marie Obenour <demi@invisiblethingslab.com>
To: Jan Beulich <jbeulich@suse.com>
Cc: xen-devel@lists.xenproject.org, linux-kernel@vger.kernel.org,
	linux-efi@vger.kernel.org, Juergen Gross <jgross@suse.com>,
	Stefano Stabellini <sstabellini@kernel.org>,
	Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>,
	Ard Biesheuvel <ardb@kernel.org>, Kees Cook <keescook@chromium.org>,
	Anton Vorontsov <anton@enomsg.org>,
	Colin Cross <ccross@android.com>, Tony Luck <tony.luck@intel.com>,
	Marek =?utf-8?Q?Marczykowski-G=C3=B3recki?= <marmarek@invisiblethingslab.com>
Subject: Re: [PATCH v4 1/2] Avoid using EFI tables Xen may have clobbered

On Fri, Sep 30, 2022 at 08:44:21AM +0200, Jan Beulich wrote:
> On 30.09.2022 01:02, Demi Marie Obenour wrote:
> > Memory of type EFI_CONVENTIONAL_MEMORY, EFI_LOADER_CODE, EFI_LOADER_DAT=
A,
> > EFI_BOOT_SERVICES_CODE, and EFI_BOOT_SERVICES_DATA may be clobbered by
> > Xen before Linux gets to start using it.  Therefore, Linux under Xen
> > must not use EFI tables from such memory.  Most of the remaining EFI
> > memory types are not suitable for EFI tables, leaving only
> > EFI_ACPI_RECLAIM_MEMORY, EFI_RUNTIME_SERVICES_DATA, and
> > EFI_RUNTIME_SERVICES_CODE.  When running under Xen, Linux should only
> > use tables that are located in one of these types of memory.
> >=20
> > This patch ensures this, and also adds a function
> > (xen_config_table_memory_region_max()) that will be used later to
> > replace the usage of the EFI memory map in esrt.c when running under
> > Xen.  This function can also be used in mokvar-table.c and efi-bgrt.c,
> > but I have not implemented this.
> >=20
> > Signed-off-by: Demi Marie Obenour <demi@invisiblethingslab.com>
>=20
> In Xen we don't clobber EfiBootServices{Code,Data} when xen.efi was passed
> "-mapbs". Should we perhaps extend the interface such that Dom0 can then
> also use tables located in such regions, perhaps by faking
> EFI_MEMORY_RUNTIME in the attributes returned by XEN_FW_EFI_MEM_INFO?

I can add a check for EFI_MEMORY_RUNTIME, but only if I can require a Xen
version with https://lore.kernel.org/xen-devel/cc0fbcb4-5ea3-178c-e691-9acb=
7cc9a3a7@suse.com/t/#u.
This is easy in Qubes OS via RPM dependencies, but I am not sure if it
is suitable for upstream without a mechanism for dom0 to verify that the
patch has been included.
--=20
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab

--SGczFINJLmmUm2Ge
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEdodNnxM2uiJZBxxxsoi1X/+cIsEFAmM3G7MACgkQsoi1X/+c
IsGoBxAA1qb1ePsiOtinAK894ShZXnVAj3jNHthhWj963jYXw6jD9iX2hYAeRFvw
ViOU6LodPurxZl4DJpiOW738pLkTYWf6CDfA01oPf2PD9nUA+kdD1doldC3PQ5Pf
yBpX0cPWDmP7xnNzdHW/ogcBCBVs6RBwiVFJsklGfKtQ9CfxRCW0q9KGL+YJTkL8
uSNTPe1v+4Q+ZdXs0Qsn/Yj33mOcg7ECO00cT8lgfF4lV/xIvi8jTgWjHVlkK3Qs
yxhmIiH0tvdegEu4uLcA15EmcFNi+l3Dkx8WU1674wDy/ZG1DdLljbFRSxp3HUjq
i5G2sixSYHn/PH6f6b8mOJFwHDasyDnV3FZbE9oEXAhz8Qz1zp6BlCQ3g/bFTyhU
lTVoMNL6AuXFFQ9eRAy5YWcNc/Ypt2eg/IBPXZDBP35Uq/BhYdzVkrlWUvYBhm82
iPZ7yyUsmjots3iLJkHgmA85ZbSDV1oMallsRmosYgTiam9N4/F7eHM3kIAjmnMD
yDaD4rQBPYY7a8+GEXfdS1EirIR94Ysb+D6zuMl0f9onBg1eW22955zWYtCgo4pW
dNE0NoMzSwdwvHi6VIA51K9Qz/LJMtXiin01RSbmk0vVyIuOnmKQElueQmw8S97O
tcxYwdZ6+4h6CZr3Iez+UXsH1rvB89qlW7bdkS3ETJH2RgGCsOo=
=pxje
-----END PGP SIGNATURE-----

--SGczFINJLmmUm2Ge--