| Message ID | 20221106145354.3876410-1-ardb@kernel.org |
|---|---|
| State | Accepted |
| Commit | 9b9eaee9828fe98b030cf43ac50065a54a2f5d52 |
| Headers | show |
| Series | [v2] arm64: efi: Fix handling of misaligned runtime regions and drop warning | expand |
[ Note: in quoting the patch below, I removed the '-' lines, so the quoted part is really just all that remains after the patch ] On Sun, Nov 6, 2022 at 6:54 AM Ard Biesheuvel <ardb@kernel.org> wrote: > > + if (region_is_misaligned(md)) { > + static bool __initdata code_is_misaligned; > + > /* > + * Regions that are not aligned to the OS page size cannot be > + * mapped with strict permissions, as those might interfere > + * with the permissions that are needed by the adjacent > + * region's mapping. However, if we haven't encountered any > + * misaligned runtime code regions so far, we can safely use > + * non-executable permissions for non-code regions. > */ > + code_is_misaligned |= (type == EFI_RUNTIME_SERVICES_CODE); > + > + return code_is_misaligned ? pgprot_val(PAGE_KERNEL_EXEC) > + : pgprot_val(PAGE_KERNEL); > + } Ok, this seems like a nice improvement, in how it only does PAGE_KERNEL_EXEC if any of the regions end up being code. At the same time this is a much bigger change than just changing the WARN_ONCE() to pr_warn_once(), so rather than me applying it directly to my tree, I think I'd prefer it to go through the proper channels and the usual way. I'll still apply it to my private "this is the tree I actually boot on my M2" testing tree, since that has all the other Asahi patches too. That way I won't see the warning myself on that machine. So "Acked-by" on the patch, and I hope I'll see it with a future arm64 or EFI pull request (and I'll holler loudly if it actually causes any issues on my M2, but I obviously don't expect it to) Thanks, Linus
On Sun, 6 Nov 2022 at 20:38, Linus Torvalds <torvalds@linux-foundation.org> wrote: > > [ Note: in quoting the patch below, I removed the '-' lines, so the > quoted part is really just all that remains after the patch ] > > On Sun, Nov 6, 2022 at 6:54 AM Ard Biesheuvel <ardb@kernel.org> wrote: > > > > + if (region_is_misaligned(md)) { > > + static bool __initdata code_is_misaligned; > > + > > /* > > + * Regions that are not aligned to the OS page size cannot be > > + * mapped with strict permissions, as those might interfere > > + * with the permissions that are needed by the adjacent > > + * region's mapping. However, if we haven't encountered any > > + * misaligned runtime code regions so far, we can safely use > > + * non-executable permissions for non-code regions. > > */ > > + code_is_misaligned |= (type == EFI_RUNTIME_SERVICES_CODE); > > + > > + return code_is_misaligned ? pgprot_val(PAGE_KERNEL_EXEC) > > + : pgprot_val(PAGE_KERNEL); > > + } > > Ok, this seems like a nice improvement, in how it only does > PAGE_KERNEL_EXEC if any of the regions end up being code. > > At the same time this is a much bigger change than just changing the > WARN_ONCE() to pr_warn_once(), so rather than me applying it directly > to my tree, I think I'd prefer it to go through the proper channels > and the usual way. > > I'll still apply it to my private "this is the tree I actually boot on > my M2" testing tree, since that has all the other Asahi patches too. > That way I won't see the warning myself on that machine. > > So "Acked-by" on the patch, and I hope I'll see it with a future arm64 > or EFI pull request (and I'll holler loudly if it actually causes any > issues on my M2, but I obviously don't expect it to) > Thanks for the ack. I'll drop it in the EFI fixes branch and let it soak in -next for the week.
On Sun, Nov 6, 2022 at 2:34 PM Ard Biesheuvel <ardb@kernel.org> wrote: > > > So "Acked-by" on the patch, and I hope I'll see it with a future arm64 > > or EFI pull request (and I'll holler loudly if it actually causes any > > issues on my M2, but I obviously don't expect it to) > > Thanks for the ack. I'll drop it in the EFI fixes branch and let it > soak in -next for the week. .. and I guess I might as well make it explicit that yes, my M2 is happy with the patch, rather than just that implicit silence about it. Linus
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c index e1be6c429810d0d5..a908a37f03678b6b 100644 --- a/arch/arm64/kernel/efi.c +++ b/arch/arm64/kernel/efi.c @@ -12,6 +12,14 @@ #include <asm/efi.h> +static bool region_is_misaligned(const efi_memory_desc_t *md) +{ + if (PAGE_SIZE == EFI_PAGE_SIZE) + return false; + return !PAGE_ALIGNED(md->phys_addr) || + !PAGE_ALIGNED(md->num_pages << EFI_PAGE_SHIFT); +} + /* * Only regions of type EFI_RUNTIME_SERVICES_CODE need to be * executable, everything else can be mapped with the XN bits @@ -25,14 +33,22 @@ static __init pteval_t create_mapping_protection(efi_memory_desc_t *md) if (type == EFI_MEMORY_MAPPED_IO) return PROT_DEVICE_nGnRE; - if (WARN_ONCE(!PAGE_ALIGNED(md->phys_addr), - "UEFI Runtime regions are not aligned to 64 KB -- buggy firmware?")) + if (region_is_misaligned(md)) { + static bool __initdata code_is_misaligned; + /* - * If the region is not aligned to the page size of the OS, we - * can not use strict permissions, since that would also affect - * the mapping attributes of the adjacent regions. + * Regions that are not aligned to the OS page size cannot be + * mapped with strict permissions, as those might interfere + * with the permissions that are needed by the adjacent + * region's mapping. However, if we haven't encountered any + * misaligned runtime code regions so far, we can safely use + * non-executable permissions for non-code regions. */ - return pgprot_val(PAGE_KERNEL_EXEC); + code_is_misaligned |= (type == EFI_RUNTIME_SERVICES_CODE); + + return code_is_misaligned ? pgprot_val(PAGE_KERNEL_EXEC) + : pgprot_val(PAGE_KERNEL); + } /* R-- */ if ((attr & (EFI_MEMORY_XP | EFI_MEMORY_RO)) == @@ -63,19 +79,16 @@ int __init efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md) bool page_mappings_only = (md->type == EFI_RUNTIME_SERVICES_CODE || md->type == EFI_RUNTIME_SERVICES_DATA); - if (!PAGE_ALIGNED(md->phys_addr) || - !PAGE_ALIGNED(md->num_pages << EFI_PAGE_SHIFT)) { - /* - * If the end address of this region is not aligned to page - * size, the mapping is rounded up, and may end up sharing a - * page frame with the next UEFI memory region. If we create - * a block entry now, we may need to split it again when mapping - * the next region, and support for that is going to be removed - * from the MMU routines. So avoid block mappings altogether in - * that case. - */ + /* + * If this region is not aligned to the page size used by the OS, the + * mapping will be rounded outwards, and may end up sharing a page + * frame with an adjacent runtime memory region. Given that the page + * table descriptor covering the shared page will be rewritten when the + * adjacent region gets mapped, we must avoid block mappings here so we + * don't have to worry about splitting them when that happens. + */ + if (region_is_misaligned(md)) page_mappings_only = true; - } create_pgd_mapping(mm, md->phys_addr, md->virt_addr, md->num_pages << EFI_PAGE_SHIFT, @@ -102,6 +115,9 @@ int __init efi_set_mapping_permissions(struct mm_struct *mm, BUG_ON(md->type != EFI_RUNTIME_SERVICES_CODE && md->type != EFI_RUNTIME_SERVICES_DATA); + if (region_is_misaligned(md)) + return 0; + /* * Calling apply_to_page_range() is only safe on regions that are * guaranteed to be mapped down to pages. Since we are only called
Currently, when mapping the EFI runtime regions in the EFI page tables, we complain about misaligned regions in a rather noisy way, using WARN(). Not only does this produce a lot of irrelevant clutter in the log, it is factually incorrect, as misaligned runtime regions are actually allowed by the EFI spec as long as they don't require conflicting memory types within the same 64k page. So let's drop the warning, and tweak the code so that we - take both the start and end of the region into account when checking for misalignment - only revert to RWX mappings for non-code regions if misaligned code regions are also known to exist. Cc: Heinrich Schuchardt <heinrich.schuchardt@canonical.com> Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org> --- Tested with uboot on QEMU/mach-virt using a 64k pagesize kernel build. More details after the patch. arch/arm64/kernel/efi.c | 52 +++++++++++++------- 1 file changed, 34 insertions(+), 18 deletions(-)