efi/x86-mixed: move unmitigated RET into .rodata

Browse source

Move the EFI mixed mode return trampoline RET into .rodata, so it is
normally mapped without executable permissions.  And given that this
snippet of code is really the only kernel code that we ever execute via
this 1:1 mapping, let's unmap the 1:1 mapping of the kernel .text, and
only map the page that covers the return trampoline with executable
permissions.

Note that the remainder of .rodata needs to remain mapped into the 1:1
mapping with RO/NX permissions, as literal GUIDs and strings may be
passed to the variable routines.

Acked-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>

...

This commit is contained in:

Ard Biesheuvel 2022-07-22 17:15:41 +02:00

parent 568035b01c

commit 6c3a9c9ae0

2 changed files with 23 additions and 8 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

18

arch/x86/platform/efi/efi_64.c

View file

13

arch/x86/platform/efi/efi_thunk_64.S

View file