On Wed, 14 Oct, at 05:35:22PM, Borislav Petkov wrote: > On Wed, Oct 14, 2015 at 08:30:48AM -0700, Andy Lutomirski wrote: > > Can we just unmap these things until someone tries to do an EFI call, > > and then unmap them again after the call returns? We already switch > > pgds for EFI IIRC. > > hpa did mention an EFI-aware page fault handler at the time. I guess we > could do that too... We do this for the Linux UEFI Validation project kernel [1]. There, we do not map EFI Boot Services regions by default, only if the firmware tries to access them. This gives us the opporunity to print an error message if Boot Services regions are accessed after ExitBootServices() (which is the bug mjg59 describes in commit 916f676f8dc0 ("x86, efi: Retain boot service code until after switching to virtual mode")). But for the issue being discussed in this thread, the thing unmapping the EFI regions buys you is that they're no longer accessible from the x86 sleep/wakeup code paths, since those also use trampoline_pgd which is where the EFI page tables are mapped. And that's probably a good idea. [1] - https://git.kernel.org/cgit/linux/kernel/git/mfleming/efi.git/commit/?h=stable&id=9b78793058bf93958aa9529400cb2617ec1bc958 -- Matt Fleming, Intel Open Source Technology Center -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html