From: Sai Praneeth <sai.praneeth.prakhya@xxxxxxxxx> There may exist some buggy UEFI firmware implementations that access efi memory regions other than EFI_RUNTIME_SERVICES_<CODE/DATA> even after kernel has assumed control of the platform. This violates UEFI specification. If selected, this debug option will print a warning message if the UEFI firmware tries to access any memory regions which it shouldn't. Along with the warning, the kernel will also try to fixup/recover from the page fault triggered by firmware so that the machine doesn't hang. Signed-off-by: Sai Praneeth Prakhya <sai.praneeth.prakhya@xxxxxxxxx> Suggested-by: Matt Fleming <matt@xxxxxxxxxxxxxxxxxxx> Based-on-code-from: Ricardo Neri <ricardo.neri@xxxxxxxxx> Cc: Al Stone <astone@xxxxxxxxxx> Cc: Lee Chun-Yi <jlee@xxxxxxxx> Cc: Borislav Petkov <bp@xxxxxxxxx> Cc: Bhupesh Sharma <bhsharma@xxxxxxxxxx> Cc: Ard Biesheuvel <ard.biesheuvel@xxxxxxxxxx> --- arch/x86/Kconfig | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index f1dbb4ee19d7..9ff11ec65232 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -1957,6 +1957,23 @@ config EFI_MIXED If unsure, say N. +config EFI_WARN_ON_ILLEGAL_ACCESSES + bool "Warn about illegal memory accesses by firmware" + depends on EFI + help + Enable this debug feature so that the kernel can detect illegal + memory accesses by firmware and issue a warning. Also, + 1. If the illegally accessed region is EFI_BOOT_SERVICES_<CODE/DATA>, + the kernel fixes it up by mapping the requested region. + 2. If the illegally accessed region is any other region (Eg: + EFI_CONVENTIONAL_MEMORY or EFI_LOADER_<CODE/DATA>), then kernel + exits firmware context and disables EFI Runtime Services, so that + it will never again call buggy firmware. + Please see the UEFI specification for details on the expectations + of memory usage. + + If unsure, say N. + config SECCOMP def_bool y prompt "Enable seccomp to safely compute untrusted bytecode" -- 2.7.4 -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
