From patchwork Wed Sep 9 07:06:54 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 53300 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-lb0-f197.google.com (mail-lb0-f197.google.com [209.85.217.197]) by patches.linaro.org (Postfix) with ESMTPS id 4301122B05 for ; Wed, 9 Sep 2015 07:09:35 +0000 (UTC) Received: by lbbmp1 with SMTP id mp1sf390694lbb.2 for ; Wed, 09 Sep 2015 00:09:34 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:delivered-to:from:to:subject:date:message-id :in-reply-to:references:precedence:list-id:list-unsubscribe :list-archive:list-post:list-help:list-subscribe:cc:mime-version :content-type:content-transfer-encoding:sender:errors-to :x-original-sender:x-original-authentication-results:mailing-list; bh=RIN9n5v6isOnt9qXE1v6MMu2ee+LTETu0ZMXNyvKx2o=; b=hndKI88GwkzGvwfuBmfFcnCw2uKAJVzeMl6C5DGmzwI8oVxLi1Cy2rIf/PTjFdDy8m BK+9e+vqsJt276sxIU4W7Uswy+uR98SgEjECW2S1IrOb8xzjK3VQ/4PBFuUulZhjWS9V cM5ZrKmkfcrJrY+YrLMiEo+QxnDHDOa+GBV5VHI/G0OHSJsGkzGpcE4iAZ0VhOvV04V/ AJ8lZvmZnzOGWogzxtnbPnJujSfZIi5ooUKLHuva3f/57OOHr3Es1DAO4dsYkUazYoyG OuUAjzKOK0u/ak0qdLDNWyD46NuSstQ4MiANQ8bgoZ1vs9XjW0RLqKiOFdIzq5yvhdxu dKXw== X-Gm-Message-State: ALoCoQmUtjeS+LuP2Duv7UNW+fCKXQyZK4Lr2PqjwFdo1GdQs8M+mu2MXcBtaYsYFAZyhNjRVhYL X-Received: by 10.194.93.198 with SMTP id cw6mr7682972wjb.3.1441782574235; Wed, 09 Sep 2015 00:09:34 -0700 (PDT) X-BeenThere: patchwork-forward@linaro.org Received: by 10.153.11.162 with SMTP id ej2ls5081lad.101.gmail; Wed, 09 Sep 2015 00:09:33 -0700 (PDT) X-Received: by 10.112.132.74 with SMTP id os10mr11835168lbb.40.1441782573798; Wed, 09 Sep 2015 00:09:33 -0700 (PDT) Received: from mail-lb0-f174.google.com (mail-lb0-f174.google.com. [209.85.217.174]) by mx.google.com with ESMTPS id x5si5791746lal.70.2015.09.09.00.09.33 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 09 Sep 2015 00:09:33 -0700 (PDT) Received-SPF: pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.217.174 as permitted sender) client-ip=209.85.217.174; Received: by lbcao8 with SMTP id ao8so577769lbc.3 for ; Wed, 09 Sep 2015 00:09:33 -0700 (PDT) X-Received: by 10.112.77.10 with SMTP id o10mr27305633lbw.73.1441782573674; Wed, 09 Sep 2015 00:09:33 -0700 (PDT) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patch@linaro.org Received: by 10.112.59.35 with SMTP id w3csp141524lbq; Wed, 9 Sep 2015 00:09:32 -0700 (PDT) X-Received: by 10.194.238.202 with SMTP id vm10mr47199729wjc.96.1441782572835; Wed, 09 Sep 2015 00:09:32 -0700 (PDT) Received: from bombadil.infradead.org (bombadil.infradead.org. [2001:1868:205::9]) by mx.google.com with ESMTPS id cw8si2917129wib.62.2015.09.09.00.09.32 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 09 Sep 2015 00:09:32 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-arm-kernel-bounces+patch=linaro.org@lists.infradead.org designates 2001:1868:205::9 as permitted sender) client-ip=2001:1868:205::9; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1ZZZTa-0003O7-Pd; Wed, 09 Sep 2015 07:07:26 +0000 Received: from mail-wi0-f169.google.com ([209.85.212.169]) by bombadil.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1ZZZTX-0003K3-Ng for linux-arm-kernel@lists.infradead.org; Wed, 09 Sep 2015 07:07:24 +0000 Received: by wiclk2 with SMTP id lk2so10027286wic.1 for ; Wed, 09 Sep 2015 00:07:00 -0700 (PDT) X-Received: by 10.180.12.195 with SMTP id a3mr25685363wic.71.1441782420172; Wed, 09 Sep 2015 00:07:00 -0700 (PDT) Received: from localhost.localdomain (cag06-7-83-153-85-71.fbx.proxad.net. [83.153.85.71]) by smtp.gmail.com with ESMTPSA id pg5sm2804355wjb.21.2015.09.09.00.06.58 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 09 Sep 2015 00:06:59 -0700 (PDT) From: Ard Biesheuvel To: linux-arm-kernel@lists.infradead.org, linux-efi@vger.kernel.org, matt.fleming@intel.com, leif.lindholm@linaro.org, mark.rutland@arm.com, catalin.marinas@arm.com, will.deacon@arm.com, msalter@redhat.com Subject: [PATCH v2] arm64/efi: don't pad between EFI_MEMORY_RUNTIME regions Date: Wed, 9 Sep 2015 09:06:54 +0200 Message-Id: <1441782414-16284-1-git-send-email-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1441371986-4554-1-git-send-email-ard.biesheuvel@linaro.org> References: <1441371986-4554-1-git-send-email-ard.biesheuvel@linaro.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20150909_000723_942094_916A7BBD X-CRM114-Status: GOOD ( 24.11 ) X-Spam-Score: -2.6 (--) X-Spam-Report: SpamAssassin version 3.4.0 on bombadil.infradead.org summary: Content analysis details: (-2.6 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [209.85.212.169 listed in list.dnswl.org] -0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3) [209.85.212.169 listed in wl.mailspike.net] -0.0 SPF_PASS SPF: sender matches SPF record -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] -0.0 RCVD_IN_MSPIKE_WL Mailspike good senders X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: , List-Help: , List-Subscribe: , Cc: Ard Biesheuvel MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patch=linaro.org@lists.infradead.org X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: ard.biesheuvel@linaro.org X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.217.174 as permitted sender) smtp.mailfrom=patch+caf_=patchwork-forward=linaro.org@linaro.org Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org X-Google-Group-Id: 836684582541 The new Properties Table feature introduced in UEFIv2.5 may split memory regions that cover PE/COFF memory images into separate code and data regions. Since these regions only differ in the type (runtime code vs runtime data) and the permission bits, but not in the memory type attributes (UC/WC/WT/WB), the spec does not require them to be aligned to 64 KB. As the relative offset of PE/COFF .text and .data segments cannot be changed on the fly, this means that we can no longer pad out those regions to be mappable using 64 KB pages. Unfortunately, there is no annotation in the UEFI memory map that identifies data regions that were split off from a code region, so we must apply this logic to all adjacent runtime regions whose attributes only differ in the permission bits. So instead of rounding each memory region to 64 KB alignment at both ends, only round down regions that are not directly preceded by another runtime region with the same type attributes. Since the UEFI spec does not mandate that the memory map be sorted, this means we also need to sort it first. Signed-off-by: Ard Biesheuvel Tested-by: Mark Salter Reviewed-by: Mark Salter --- As discussed off list, this is the arm64 side of what we should backport to stable to prevent firmware that adheres to the current version of the UEFI v2.5 spec with the memprotect feature enabled from blowing up the system upon the first OS call into the runtime services. For arm64, we already map things in order, but since the spec does not mandate a sorted memory map, we need to sort it to be sure. This also allows us to easily find adjacent regions with < 64 KB granularity, which the current version of the spec allows if they only differ in permission bits (which the spec says are 'unused' on AArch64, which could be interpreted as 'allowed but ignored'). Changes since v1: - Ensure that we don't inadvertently set the XN bit on the preceding region at mapping time if we the OS is running with >4 KB pages. arch/arm64/kernel/efi.c | 3 +- drivers/firmware/efi/libstub/arm-stub.c | 62 +++++++++++++++----- 2 files changed, 49 insertions(+), 16 deletions(-) diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c index e8ca6eaedd02..13671a9cf016 100644 --- a/arch/arm64/kernel/efi.c +++ b/arch/arm64/kernel/efi.c @@ -258,7 +258,8 @@ static bool __init efi_virtmap_init(void) */ if (!is_normal_ram(md)) prot = __pgprot(PROT_DEVICE_nGnRE); - else if (md->type == EFI_RUNTIME_SERVICES_CODE) + else if (md->type == EFI_RUNTIME_SERVICES_CODE || + !PAGE_ALIGNED(md->phys_addr)) prot = PAGE_KERNEL_EXEC; else prot = PAGE_KERNEL; diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c index e29560e6b40b..cb4e9c4de952 100644 --- a/drivers/firmware/efi/libstub/arm-stub.c +++ b/drivers/firmware/efi/libstub/arm-stub.c @@ -13,6 +13,7 @@ */ #include +#include #include #include "efistub.h" @@ -305,6 +306,13 @@ fail: */ #define EFI_RT_VIRTUAL_BASE 0x40000000 +static int cmp_mem_desc(const void *a, const void *b) +{ + const efi_memory_desc_t *left = a, *right = b; + + return (left->phys_addr > right->phys_addr) ? 1 : -1; +} + /* * efi_get_virtmap() - create a virtual mapping for the EFI memory map * @@ -316,34 +324,58 @@ void efi_get_virtmap(efi_memory_desc_t *memory_map, unsigned long map_size, unsigned long desc_size, efi_memory_desc_t *runtime_map, int *count) { + static const u64 mem_type_mask = EFI_MEMORY_WB | EFI_MEMORY_WT | + EFI_MEMORY_WC | EFI_MEMORY_UC | + EFI_MEMORY_RUNTIME; + u64 efi_virt_base = EFI_RT_VIRTUAL_BASE; - efi_memory_desc_t *out = runtime_map; + efi_memory_desc_t *in, *prev = NULL, *out = runtime_map; int l; - for (l = 0; l < map_size; l += desc_size) { - efi_memory_desc_t *in = (void *)memory_map + l; + /* + * To work around potential issues with the Properties Table feature + * introduced in UEFI 2.5, which may split PE/COFF executable images + * in memory into several RuntimeServicesCode and RuntimeServicesData + * regions, we need to preserve the relative offsets between adjacent + * EFI_MEMORY_RUNTIME regions with the same memory type attributes. + * The easiest way to find adjacent regions is to sort the memory map + * before traversing it. + */ + sort(memory_map, map_size / desc_size, desc_size, cmp_mem_desc, NULL); + + for (l = 0; l < map_size; l += desc_size, prev = in) { u64 paddr, size; + in = (void *)memory_map + l; if (!(in->attribute & EFI_MEMORY_RUNTIME)) continue; + paddr = in->phys_addr; + size = in->num_pages * EFI_PAGE_SIZE; + /* * Make the mapping compatible with 64k pages: this allows * a 4k page size kernel to kexec a 64k page size kernel and * vice versa. */ - paddr = round_down(in->phys_addr, SZ_64K); - size = round_up(in->num_pages * EFI_PAGE_SIZE + - in->phys_addr - paddr, SZ_64K); - - /* - * Avoid wasting memory on PTEs by choosing a virtual base that - * is compatible with section mappings if this region has the - * appropriate size and physical alignment. (Sections are 2 MB - * on 4k granule kernels) - */ - if (IS_ALIGNED(in->phys_addr, SZ_2M) && size >= SZ_2M) - efi_virt_base = round_up(efi_virt_base, SZ_2M); + if (!prev || + ((prev->attribute ^ in->attribute) & mem_type_mask) != 0 || + paddr != (prev->phys_addr + prev->num_pages * EFI_PAGE_SIZE)) { + + paddr = round_down(in->phys_addr, SZ_64K); + size += in->phys_addr - paddr; + + /* + * Avoid wasting memory on PTEs by choosing a virtual + * base that is compatible with section mappings if this + * region has the appropriate size and physical + * alignment. (Sections are 2 MB on 4k granule kernels) + */ + if (IS_ALIGNED(in->phys_addr, SZ_2M) && size >= SZ_2M) + efi_virt_base = round_up(efi_virt_base, SZ_2M); + else + efi_virt_base = round_up(efi_virt_base, SZ_64K); + } in->virt_addr = efi_virt_base + in->phys_addr - paddr; efi_virt_base += size;