LKML Archive on lore.kernel.org
 help / Atom feed
From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
To: linux-efi@vger.kernel.org, Ingo Molnar <mingo@kernel.org>,
	Thomas Gleixner <tglx@linutronix.de>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>,
	linux-kernel@vger.kernel.org, Andy Lutomirski <luto@kernel.org>,
	Arend van Spriel <arend.vanspriel@broadcom.com>,
	Bhupesh Sharma <bhsharma@redhat.com>,
	Borislav Petkov <bp@alien8.de>,
	Dave Hansen <dave.hansen@intel.com>,
	Eric Snowberg <eric.snowberg@oracle.com>,
	Hans de Goede <hdegoede@redhat.com>,
	Joe Perches <joe@perches.com>, Jon Hunter <jonathanh@nvidia.com>,
	Julien Thierry <julien.thierry@arm.com>,
	Marc Zyngier <marc.zyngier@arm.com>,
	Nathan Chancellor <natechancellor@gmail.com>,
	Peter Zijlstra <peterz@infradead.org>,
	Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>,
	Sedat Dilek <sedat.dilek@gmail.com>,
	YiFei Zhu <zhuyifei1999@gmail.com>
Subject: [PATCH 05/11] x86/efi: Unmap EFI boot services code/data regions from efi_pgd
Date: Thu, 29 Nov 2018 18:12:24 +0100
Message-ID: <20181129171230.18699-6-ard.biesheuvel@linaro.org> (raw)
In-Reply-To: <20181129171230.18699-1-ard.biesheuvel@linaro.org>

From: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>

efi_free_boot_services(), as the name suggests, frees EFI boot services
code/data regions but forgets to unmap these regions from efi_pgd. This
means that any code that's running in efi_pgd address space (e.g:
any EFI runtime service) would still be able to access these regions but
the contents of these regions would have long been over written by
someone else. So, it's important to unmap these regions. Hence,
introduce efi_unmap_pages() to unmap these regions from efi_pgd.

After unmapping EFI boot services code/data regions, any illegal access
by buggy firmware to these regions would result in page fault which will
be handled by EFI specific fault handler.

Signed-off-by: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Bhupesh Sharma <bhsharma@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
---
 arch/x86/platform/efi/quirks.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c
index 95e77a667ba5..09e811b9da26 100644
--- a/arch/x86/platform/efi/quirks.c
+++ b/arch/x86/platform/efi/quirks.c
@@ -369,6 +369,24 @@ void __init efi_reserve_boot_services(void)
 	}
 }
 
+/*
+ * Apart from having VA mappings for EFI boot services code/data regions,
+ * (duplicate) 1:1 mappings were also created as a quirk for buggy firmware. So,
+ * unmap both 1:1 and VA mappings.
+ */
+static void __init efi_unmap_pages(efi_memory_desc_t *md)
+{
+	pgd_t *pgd = efi_mm.pgd;
+	u64 pa = md->phys_addr;
+	u64 va = md->virt_addr;
+
+	if (kernel_unmap_pages_in_pgd(pgd, pa, md->num_pages))
+		pr_err("Failed to unmap 1:1 mapping for 0x%llx\n", pa);
+
+	if (kernel_unmap_pages_in_pgd(pgd, va, md->num_pages))
+		pr_err("Failed to unmap VA mapping for 0x%llx\n", va);
+}
+
 void __init efi_free_boot_services(void)
 {
 	phys_addr_t new_phys, new_size;
@@ -393,6 +411,13 @@ void __init efi_free_boot_services(void)
 			continue;
 		}
 
+		/*
+		 * Before calling set_virtual_address_map(), EFI boot services
+		 * code/data regions were mapped as a quirk for buggy firmware.
+		 * Unmap them from efi_pgd before freeing them up.
+		 */
+		efi_unmap_pages(md);
+
 		/*
 		 * Nasty quirk: if all sub-1MB memory is used for boot
 		 * services, we can get here without having allocated the
-- 
2.19.1


  parent reply index

Thread overview: 50+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-11-29 17:12 [GIT PULL 00/11] EFI updates Ard Biesheuvel
2018-11-29 17:12 ` [PATCH 01/11] x86/efi: Allocate e820 buffer before calling efi_exit_boot_service Ard Biesheuvel
2018-11-30  7:29   ` Ingo Molnar
2018-11-30  8:26     ` Ard Biesheuvel
2018-11-30  8:36       ` Ingo Molnar
2018-11-30  9:55   ` [tip:efi/core] " tip-bot for Eric Snowberg
2018-11-29 17:12 ` [PATCH 02/11] efi/fdt: Indentation fix Ard Biesheuvel
2018-11-30  7:56   ` [PATCH] efi/fdt: More cleanups Ingo Molnar
2018-11-30  8:31     ` Ard Biesheuvel
2018-11-30  9:48       ` Ingo Molnar
2018-11-30  9:56   ` [tip:efi/core] efi/fdt: Indentation fix tip-bot for Julien Thierry
2018-11-29 17:12 ` [PATCH 03/11] efi/fdt: Simplify get_fdt flow Ard Biesheuvel
2018-11-30  9:57   ` [tip:efi/core] efi/fdt: Simplify the get_fdt() flow tip-bot for Julien Thierry
2018-11-29 17:12 ` [PATCH 04/11] x86/mm/pageattr: Introduce helper function to unmap EFI boot services Ard Biesheuvel
2018-11-30  9:58   ` [tip:efi/core] " tip-bot for Sai Praneeth Prakhya
2018-11-29 17:12 ` Ard Biesheuvel [this message]
2018-11-30  9:58   ` [tip:efi/core] x86/efi: Unmap EFI boot services code/data regions from efi_pgd tip-bot for Sai Praneeth Prakhya
2018-12-17 18:06     ` Prakhya, Sai Praneeth
2018-12-17 18:10       ` Ard Biesheuvel
2018-12-17 18:42         ` Prakhya, Sai Praneeth
2018-12-17 19:35           ` Ard Biesheuvel
2018-12-17 19:48             ` Prakhya, Sai Praneeth
2018-12-21 17:02               ` Ard Biesheuvel
2018-12-21 17:13                 ` Borislav Petkov
2018-12-21 17:26                   ` Ard Biesheuvel
2018-12-21 19:29                     ` Borislav Petkov
2018-12-22 11:07                       ` Ard Biesheuvel
2019-01-07 15:57                         ` Matt Fleming
2018-12-21 17:52                 ` Prakhya, Sai Praneeth
2018-11-29 17:12 ` [PATCH 06/11] x86/efi: Move efi_<reserve/free>_boot_services() to arch/x86 Ard Biesheuvel
2018-11-30  9:59   ` [tip:efi/core] " tip-bot for Sai Praneeth Prakhya
2018-11-29 17:12 ` [PATCH 07/11] efi/libstub: Disable some warnings for x86{,_64} Ard Biesheuvel
2018-11-30  9:59   ` [tip:efi/core] " tip-bot for Nathan Chancellor
2018-11-29 17:12 ` [PATCH 08/11] firmware: efi: add NULL pointer checks in efivars api functions Ard Biesheuvel
2018-11-30  8:11   ` Ingo Molnar
2018-11-30  8:37     ` Ard Biesheuvel
2018-11-30  9:56   ` [tip:efi/core] firmware/efi: Add NULL pointer checks in efivars API functions tip-bot for Arend van Spriel
2018-11-29 17:12 ` [PATCH 09/11] efi: permit multiple entries in persistent memreserve data structure Ard Biesheuvel
2018-11-30 10:00   ` [tip:efi/core] efi: Permit " tip-bot for Ard Biesheuvel
2018-11-29 17:12 ` [PATCH 10/11] efi: reduce the amount of memblock reservations for persistent allocations Ard Biesheuvel
2018-11-30  8:38   ` Ingo Molnar
2018-11-30  8:39     ` Ard Biesheuvel
2018-11-30 10:00   ` [tip:efi/core] efi: Reduce " tip-bot for Ard Biesheuvel
2018-11-29 17:12 ` [PATCH 11/11] efi/x86: earlyprintk - Fix infinite loop on some screen widths Ard Biesheuvel
2018-11-30  8:05   ` Ingo Molnar
2018-11-30  8:32     ` Ard Biesheuvel
2018-11-30  9:55   ` [tip:efi/core] x86/earlyprintk/efi: " tip-bot for YiFei Zhu
2018-11-29 18:27 ` [GIT PULL 00/11] EFI updates Prakhya, Sai Praneeth
2018-11-30 12:01   ` Ard Biesheuvel
2018-11-30 18:01     ` Prakhya, Sai Praneeth

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20181129171230.18699-6-ard.biesheuvel@linaro.org \
    --to=ard.biesheuvel@linaro.org \
    --cc=arend.vanspriel@broadcom.com \
    --cc=bhsharma@redhat.com \
    --cc=bp@alien8.de \
    --cc=dave.hansen@intel.com \
    --cc=eric.snowberg@oracle.com \
    --cc=hdegoede@redhat.com \
    --cc=joe@perches.com \
    --cc=jonathanh@nvidia.com \
    --cc=julien.thierry@arm.com \
    --cc=linux-efi@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@kernel.org \
    --cc=marc.zyngier@arm.com \
    --cc=mingo@kernel.org \
    --cc=natechancellor@gmail.com \
    --cc=peterz@infradead.org \
    --cc=sai.praneeth.prakhya@intel.com \
    --cc=sedat.dilek@gmail.com \
    --cc=tglx@linutronix.de \
    --cc=zhuyifei1999@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org linux-kernel@archiver.kernel.org
	public-inbox-index lkml


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/ public-inbox