Skip to content
Commit a7a6a01f authored by Ard Biesheuvel's avatar Ard Biesheuvel
Browse files

x86/efistub: Give up if memory attribute protocol returns an error



The recently introduced EFI memory attributes protocol should be used
if it exists to ensure that the memory allocation created for the kernel
permits execution. This is needed for compatibility with tightened
requirements related to Windows logo certification for x86 PCs.

Currently, we simply strip the execute protect (XP) attribute from the
entire range, but this might be rejected under some firmware security
policies, and so in a subsequent patch, this will be changed to only
strip XP from the executable region that runs early, and make it
read-only (RO) as well.

In order to catch any issues early, ensure that the memory attribute
protocol works as intended, and give up if it produces spurious errors.

Note that the DXE services based fallback was always based on best
effort, so don't propagate any errors returned by that API.

Fixes: a1b87d54 ("x86/efistub: Avoid legacy decompressor when doing EFI boot")
Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
parent d2baf8cc
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment