From: Siarhei Liakh <sliakh.lkml@gmail.com>
To: linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org
Cc: Arjan van de Ven <arjan@infradead.org>,
Andi Kleen <andi@firstfloor.org>,
Rusty Russell <rusty@rustcorp.com.au>,
Ingo Molnar <mingo@elte.hu>, James Morris <jmorris@namei.org>,
Andrew Morton <akpm@linux-foundation.org>, Andi Kleen <ak@muc.de>,
Thomas Gleixner <tglx@linutronix.de>,
"H. Peter Anvin" <hpa@zytor.com>,
linux-cris-kernel@axis.com, Roland Dreier <rdreier@cisco.com>
Subject: [PATCH] x86: Reducing footprint of BIOS32 service mappings
Date: Sun, 19 Jul 2009 20:42:21 -0400 [thread overview]
Message-ID: <817ecb6f0907191742i13df19afmc4e258a857c3b465@mail.gmail.com> (raw)
According to BIOS32 specification
(http://members.datafast.net.au/dft0802/specs/bios32.pdf), at most two
pages per BIOS32 service should be set executable and no pages need to
be writeable. This patch modifies bios32_service() to set proper page
access permissions at time of service discovery, as described in the
specification.
Further, hardcoded protection of memory area between 640k to 1Mb have
been removed from static_protections(), since only pages mentioned
above need to be executable, not whole BIOS region.
The patch have been developed for Linux 2.6.30 x86 by Siarhei Liakh
<sliakh.lkml@gmail.com> and Xuxian Jiang <jiang@cs.ncsu.edu>.
---
Signed-off-by: Siarhei Liakh <sliakh.lkml@gmail.com>
Signed-off-by: Xuxian Jiang <jiang@cs.ncsu.edu>
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index e17efed..9ce45d2 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -254,13 +254,6 @@ static inline pgprot_t
static_protections(pgprot_t prot, unsigned long address,
pgprot_t forbidden = __pgprot(0);
/*
- * The BIOS area between 640k and 1Mb needs to be executable for
- * PCI BIOS based config access (CONFIG_PCI_GOBIOS) support.
- */
- if (within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
- pgprot_val(forbidden) |= _PAGE_NX;
-
- /*
* The kernel text needs to be executable for obvious reasons
* Does not cover __inittext since that is gone later on. On
* 64bit we do not enforce !NX on the low mapping
diff --git a/arch/x86/pci/pcbios.c b/arch/x86/pci/pcbios.c
index 1c975cc..31a2653 100644
--- a/arch/x86/pci/pcbios.c
+++ b/arch/x86/pci/pcbios.c
@@ -8,6 +8,7 @@
#include <linux/uaccess.h>
#include <asm/pci_x86.h>
#include <asm/pci-functions.h>
+#include <asm/cacheflush.h>
/* BIOS32 signature: "_32_" */
#define BIOS32_SIGNATURE (('_' << 0) + ('3' << 8) + ('2' << 16) + ('_' << 24))
@@ -69,6 +70,7 @@ static unsigned long bios32_service(unsigned long service)
unsigned long length; /* %ecx */
unsigned long entry; /* %edx */
unsigned long flags;
+ unsigned long pg_address;
local_irq_save(flags);
__asm__("lcall *(%%edi); cld"
@@ -82,15 +84,21 @@ static unsigned long bios32_service(unsigned long service)
local_irq_restore(flags);
switch (return_code) {
- case 0:
- return address + entry;
- case 0x80: /* Not present */
- printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
- return 0;
- default: /* Shouldn't happen */
- printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
- service, return_code);
- return 0;
+ case 0: /* Service present, set proper page access */
+ address += entry;
+ pg_address = PFN_DOWN(address + PAGE_OFFSET) << PAGE_SHIFT;
+ set_memory_ro(pg_address, 2);
+ set_memory_x(pg_address, 2);
+ return address;
+ case 0x80: /* Not present */
+ printk(KERN_WARNING "bios32_service(0x%lx): not present\n",
+ service);
+ return 0;
+ default: /* Shouldn't happen */
+ printk(KERN_WARNING "bios32_service(0x%lx): "
+ "returned 0x%x -- BIOS bug!\n",
+ service, return_code);
+ return 0;
}
}
next reply other threads:[~2009-07-20 0:42 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-07-20 0:42 Siarhei Liakh [this message]
2009-07-20 0:53 ` [PATCH] x86: Reducing footprint of BIOS32 service mappings H. Peter Anvin
2009-07-20 1:02 ` Siarhei Liakh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=817ecb6f0907191742i13df19afmc4e258a857c3b465@mail.gmail.com \
--to=sliakh.lkml@gmail.com \
--cc=ak@muc.de \
--cc=akpm@linux-foundation.org \
--cc=andi@firstfloor.org \
--cc=arjan@infradead.org \
--cc=hpa@zytor.com \
--cc=jmorris@namei.org \
--cc=linux-cris-kernel@axis.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mingo@elte.hu \
--cc=rdreier@cisco.com \
--cc=rusty@rustcorp.com.au \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).