Linux-EFI Archive on lore.kernel.org
 help / color / Atom feed
From: Matt Fleming <matt@codeblueprint.co.uk>
To: Ingo Molnar <mingo@kernel.org>,
	Thomas Gleixner <tglx@linutronix.de>,
	"H. Peter Anvin" <hpa@zytor.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>,
	linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org,
	Leif Lindholm <leif.lindholm@linaro.org>,
	Catalin Marinas <catalin.marinas@arm.com>,
	Will Deacon <will.deacon@arm.com>,
	stable@vger.kernel.org, Matt Fleming <matt.fleming@intel.com>,
	Mark Rutland <mark.rutland@arm.com>,
	Mark Salter <msalter@redhat.com>
Subject: [PATCH 2/2] arm64/efi: Don't pad between EFI_MEMORY_RUNTIME regions
Date: Fri, 25 Sep 2015 23:02:19 +0100
Message-ID: <1443218539-7610-3-git-send-email-matt@codeblueprint.co.uk> (raw)
In-Reply-To: <1443218539-7610-1-git-send-email-matt@codeblueprint.co.uk>

From: Ard Biesheuvel <ard.biesheuvel@linaro.org>

The new Properties Table feature introduced in UEFIv2.5 may split
memory regions that cover PE/COFF memory images into separate code
and data regions. Since these regions only differ in the type (runtime
code vs runtime data) and the permission bits, but not in the memory
type attributes (UC/WC/WT/WB), the spec does not require them to be
aligned to 64 KB.

Since the relative offset of PE/COFF .text and .data segments cannot
be changed on the fly, this means that we can no longer pad out those
regions to be mappable using 64 KB pages.
Unfortunately, there is no annotation in the UEFI memory map that
identifies data regions that were split off from a code region, so we
must apply this logic to all adjacent runtime regions whose attributes
only differ in the permission bits.

So instead of rounding each memory region to 64 KB alignment at both
ends, only round down regions that are not directly preceded by another
runtime region with the same type attributes. Since the UEFI spec does
not mandate that the memory map be sorted, this means we also need to
sort it first.

Note that this change will result in all EFI_MEMORY_RUNTIME regions whose
start addresses are not aligned to the OS page size to be mapped with
executable permissions (i.e., on kernels compiled with 64 KB pages).
However, since these mappings are only active during the time that UEFI
Runtime Services are being invoked, the window for abuse is rather small.

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Tested-by: Mark Salter <msalter@redhat.com>
Reviewed-by: Mark Salter <msalter@redhat.com>
Cc: Leif Lindholm <leif.lindholm@linaro.org>
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Tested-by: Mark Rutland <mark.rutland@arm.com> [UEFI 2.4 only]
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: <stable@vger.kernel.org> # v4.0+
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
---
 arch/arm64/kernel/efi.c                 |  3 +-
 drivers/firmware/efi/libstub/arm-stub.c | 88 +++++++++++++++++++++++++++------
 2 files changed, 75 insertions(+), 16 deletions(-)

diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index e8ca6eaedd02..13671a9cf016 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -258,7 +258,8 @@ static bool __init efi_virtmap_init(void)
 		 */
 		if (!is_normal_ram(md))
 			prot = __pgprot(PROT_DEVICE_nGnRE);
-		else if (md->type == EFI_RUNTIME_SERVICES_CODE)
+		else if (md->type == EFI_RUNTIME_SERVICES_CODE ||
+			 !PAGE_ALIGNED(md->phys_addr))
 			prot = PAGE_KERNEL_EXEC;
 		else
 			prot = PAGE_KERNEL;
diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c
index e29560e6b40b..950c87f5d279 100644
--- a/drivers/firmware/efi/libstub/arm-stub.c
+++ b/drivers/firmware/efi/libstub/arm-stub.c
@@ -13,6 +13,7 @@
  */
 
 #include <linux/efi.h>
+#include <linux/sort.h>
 #include <asm/efi.h>
 
 #include "efistub.h"
@@ -305,6 +306,44 @@ fail:
  */
 #define EFI_RT_VIRTUAL_BASE	0x40000000
 
+static int cmp_mem_desc(const void *l, const void *r)
+{
+	const efi_memory_desc_t *left = l, *right = r;
+
+	return (left->phys_addr > right->phys_addr) ? 1 : -1;
+}
+
+/*
+ * Returns whether region @left ends exactly where region @right starts,
+ * or false if either argument is NULL.
+ */
+static bool regions_are_adjacent(efi_memory_desc_t *left,
+				 efi_memory_desc_t *right)
+{
+	u64 left_end;
+
+	if (left == NULL || right == NULL)
+		return false;
+
+	left_end = left->phys_addr + left->num_pages * EFI_PAGE_SIZE;
+
+	return left_end == right->phys_addr;
+}
+
+/*
+ * Returns whether region @left and region @right have compatible memory type
+ * mapping attributes, and are both EFI_MEMORY_RUNTIME regions.
+ */
+static bool regions_have_compatible_memory_type_attrs(efi_memory_desc_t *left,
+						      efi_memory_desc_t *right)
+{
+	static const u64 mem_type_mask = EFI_MEMORY_WB | EFI_MEMORY_WT |
+					 EFI_MEMORY_WC | EFI_MEMORY_UC |
+					 EFI_MEMORY_RUNTIME;
+
+	return ((left->attribute ^ right->attribute) & mem_type_mask) == 0;
+}
+
 /*
  * efi_get_virtmap() - create a virtual mapping for the EFI memory map
  *
@@ -317,33 +356,52 @@ void efi_get_virtmap(efi_memory_desc_t *memory_map, unsigned long map_size,
 		     int *count)
 {
 	u64 efi_virt_base = EFI_RT_VIRTUAL_BASE;
-	efi_memory_desc_t *out = runtime_map;
+	efi_memory_desc_t *in, *prev = NULL, *out = runtime_map;
 	int l;
 
-	for (l = 0; l < map_size; l += desc_size) {
-		efi_memory_desc_t *in = (void *)memory_map + l;
+	/*
+	 * To work around potential issues with the Properties Table feature
+	 * introduced in UEFI 2.5, which may split PE/COFF executable images
+	 * in memory into several RuntimeServicesCode and RuntimeServicesData
+	 * regions, we need to preserve the relative offsets between adjacent
+	 * EFI_MEMORY_RUNTIME regions with the same memory type attributes.
+	 * The easiest way to find adjacent regions is to sort the memory map
+	 * before traversing it.
+	 */
+	sort(memory_map, map_size / desc_size, desc_size, cmp_mem_desc, NULL);
+
+	for (l = 0; l < map_size; l += desc_size, prev = in) {
 		u64 paddr, size;
 
+		in = (void *)memory_map + l;
 		if (!(in->attribute & EFI_MEMORY_RUNTIME))
 			continue;
 
+		paddr = in->phys_addr;
+		size = in->num_pages * EFI_PAGE_SIZE;
+
 		/*
 		 * Make the mapping compatible with 64k pages: this allows
 		 * a 4k page size kernel to kexec a 64k page size kernel and
 		 * vice versa.
 		 */
-		paddr = round_down(in->phys_addr, SZ_64K);
-		size = round_up(in->num_pages * EFI_PAGE_SIZE +
-				in->phys_addr - paddr, SZ_64K);
-
-		/*
-		 * Avoid wasting memory on PTEs by choosing a virtual base that
-		 * is compatible with section mappings if this region has the
-		 * appropriate size and physical alignment. (Sections are 2 MB
-		 * on 4k granule kernels)
-		 */
-		if (IS_ALIGNED(in->phys_addr, SZ_2M) && size >= SZ_2M)
-			efi_virt_base = round_up(efi_virt_base, SZ_2M);
+		if (!regions_are_adjacent(prev, in) ||
+		    !regions_have_compatible_memory_type_attrs(prev, in)) {
+
+			paddr = round_down(in->phys_addr, SZ_64K);
+			size += in->phys_addr - paddr;
+
+			/*
+			 * Avoid wasting memory on PTEs by choosing a virtual
+			 * base that is compatible with section mappings if this
+			 * region has the appropriate size and physical
+			 * alignment. (Sections are 2 MB on 4k granule kernels)
+			 */
+			if (IS_ALIGNED(in->phys_addr, SZ_2M) && size >= SZ_2M)
+				efi_virt_base = round_up(efi_virt_base, SZ_2M);
+			else
+				efi_virt_base = round_up(efi_virt_base, SZ_64K);
+		}
 
 		in->virt_addr = efi_virt_base + in->phys_addr - paddr;
 		efi_virt_base += size;
-- 
2.1.0

  parent reply index

Thread overview: 48+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-09-25 22:02 [GIT PULL 0/2] EFI urgent fixes Matt Fleming
2015-09-25 22:02 ` [PATCH 1/2] x86/efi: Map EFI memmap entries in-order at runtime Matt Fleming
     [not found]   ` <1443218539-7610-2-git-send-email-matt-mF/unelCI9GS6iBeEJttW/XRex20P6io@public.gmane.org>
2015-09-26  5:56     ` Ingo Molnar
     [not found]       ` <20150926055643.GA25877-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2015-09-26  6:44         ` Ard Biesheuvel
2015-09-26 17:01         ` Andy Lutomirski
2015-09-26 17:20           ` H. Peter Anvin
     [not found]             ` <E40EBF14-FD9E-49C0-A7FB-951958F72F79-YMNOUZJC4hwAvxtiuMwx3w@public.gmane.org>
2015-09-26 18:15               ` Ard Biesheuvel
2015-09-26 19:49                 ` H. Peter Anvin
2015-09-26 19:57                   ` Matt Fleming
     [not found]                     ` <20150926195755.GC3144-mF/unelCI9GS6iBeEJttW/XRex20P6io@public.gmane.org>
2015-09-26 20:09                       ` Ard Biesheuvel
2015-09-26 20:19                         ` H. Peter Anvin
2015-09-27 16:30                           ` Andy Lutomirski
     [not found]                             ` <CALCETrUA6k-oHzuWA54VzEA1v63b5--JPCCuBoOxLisOtjUn+g-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2015-09-27 18:06                               ` Matthew Garrett
     [not found]                                 ` <20150927180633.GA29466-1xO5oi07KQx4cg9Nei1l7Q@public.gmane.org>
2015-09-28  6:16                                   ` Ingo Molnar
2015-09-28  6:41                                     ` Matthew Garrett
     [not found]                                       ` <20150928064143.GA7380-1xO5oi07KQx4cg9Nei1l7Q@public.gmane.org>
2015-09-29 21:58                                         ` Laszlo Ersek
2015-09-30  9:30                                           ` Ard Biesheuvel
     [not found]                                             ` <CAKv+Gu-enULj-OMRufB3OPSUVueM1843bD1CdFybaAS7xMUKgw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2015-09-30 16:43                                               ` Andy Lutomirski
2015-09-30 17:24                                                 ` James Bottomley
     [not found]                                     ` <20150928061646.GA21690-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2015-09-30  0:54                                       ` H. Peter Anvin
2015-09-26 19:55               ` Matt Fleming
2015-09-27  6:50           ` Ingo Molnar
2015-09-26 13:43       ` Matt Fleming
     [not found]         ` <20150926134329.GA3144-mF/unelCI9GS6iBeEJttW/XRex20P6io@public.gmane.org>
2015-09-27  7:03           ` Ingo Molnar
2015-09-28  6:49             ` Ard Biesheuvel
     [not found]               ` <CAKv+Gu8M2pmzfeA=NT4c44E6-PQvRKHZjEJt78mryGcp6bBD8w-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2015-09-28  8:22                 ` Ingo Molnar
     [not found]                   ` <20150928082245.GA28796-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2015-09-28  9:51                     ` Ard Biesheuvel
2015-09-29  9:12                       ` Ingo Molnar
2015-09-29 10:41                         ` Ard Biesheuvel
     [not found]                           ` <CAKv+Gu8GpaHRL8EZxJCs8dw8ngFVoYNP1Q=hqhZ=LOF+3vXPLw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2015-09-29 14:18                             ` Matt Fleming
     [not found]                         ` <20150929091230.GA2023-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2015-09-29 13:52                           ` Matt Fleming
2015-09-25 22:02 ` Matt Fleming [this message]
     [not found]   ` <1443218539-7610-3-git-send-email-matt-mF/unelCI9GS6iBeEJttW/XRex20P6io@public.gmane.org>
2015-09-26  6:01     ` [PATCH 2/2] arm64/efi: Don't pad between EFI_MEMORY_RUNTIME regions Ingo Molnar
     [not found]       ` <20150926060159.GB25877-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2015-09-26  7:08         ` Ard Biesheuvel
     [not found]           ` <CAKv+Gu_JRCmx5qKq7SDDq73BegVs3LKZwe+OdvTKb4YD_CURyw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2015-09-27  7:06             ` Ingo Molnar
2015-09-27 10:40               ` Borislav Petkov
2015-09-28  6:20                 ` Ingo Molnar
2015-09-29  9:31                 ` Dave Young
2015-09-29 10:24                   ` Borislav Petkov
     [not found]                 ` <20150927104014.GA7631-fF5Pk5pvG8Y@public.gmane.org>
2015-09-29 14:36                   ` Matt Fleming
     [not found]                     ` <20150929143612.GC4401-mF/unelCI9GS6iBeEJttW/XRex20P6io@public.gmane.org>
2015-09-30  0:56                       ` H. Peter Anvin
     [not found]                         ` <560B3327.9020801-YMNOUZJC4hwAvxtiuMwx3w@public.gmane.org>
2015-09-30  8:33                           ` Borislav Petkov
2015-09-30  1:03               ` H. Peter Anvin
2015-09-30  1:16                 ` Andy Lutomirski
2015-09-30  1:19                   ` H. Peter Anvin
     [not found]                   ` <CALCETrVvwxZN95swaUDG2fkz9brWV3BQkfMDtLJXZkTRpe8nRg-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2015-09-30  4:24                     ` Ard Biesheuvel
2015-10-01 10:44                 ` Ingo Molnar
  -- strict thread matches above, loose matches on Subject: below --
2015-06-30 10:17 [PATCH 0/2] arm64/efi: adapt to UEFI 2.5 properties table changes Ard Biesheuvel
     [not found] ` <1435659443-17625-1-git-send-email-ard.biesheuvel-QSEj5FYQhm4dnm+yROfE0A@public.gmane.org>
2015-06-30 10:17   ` [PATCH 2/2] arm64/efi: don't pad between EFI_MEMORY_RUNTIME regions Ard Biesheuvel

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1443218539-7610-3-git-send-email-matt@codeblueprint.co.uk \
    --to=matt@codeblueprint.co.uk \
    --cc=ard.biesheuvel@linaro.org \
    --cc=catalin.marinas@arm.com \
    --cc=hpa@zytor.com \
    --cc=leif.lindholm@linaro.org \
    --cc=linux-efi@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mark.rutland@arm.com \
    --cc=matt.fleming@intel.com \
    --cc=mingo@kernel.org \
    --cc=msalter@redhat.com \
    --cc=stable@vger.kernel.org \
    --cc=tglx@linutronix.de \
    --cc=will.deacon@arm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-EFI Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-efi/0 linux-efi/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-efi linux-efi/ https://lore.kernel.org/linux-efi \
		linux-efi@vger.kernel.org
	public-inbox-index linux-efi

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-efi


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git