From patchwork Fri Jan 3 11:39:35 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 206655 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B1027C2D0C2 for ; Fri, 3 Jan 2020 11:41:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7E78E21835 for ; Fri, 3 Jan 2020 11:41:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051697; bh=Q8weF/ruccANz+AO9p5Pr5ibKl+2BRCize4l+859iBI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=wkIzt5hXvNiKuO3P+2NJnVIFJEuHcp9ql+Se4vK9P3furR5IvfpKsnEm67ur22fbq 6Oy5dqot/o9T9csI5Qd+rPqtE479TzSf6tKDvg2MyJJqpBoaGePQR0LytEGAgq1bpW oAkMLudZWqfpG7oNAN7ORYmTm6oX0oUKwHl1Juks= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727698AbgACLkV (ORCPT ); Fri, 3 Jan 2020 06:40:21 -0500 Received: from mail.kernel.org ([198.145.29.99]:39482 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727664AbgACLkU (ORCPT ); Fri, 3 Jan 2020 06:40:20 -0500 Received: from localhost.localdomain (amontpellier-657-1-18-247.w109-210.abo.wanadoo.fr [109.210.65.247]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 71BF2227BF; Fri, 3 Jan 2020 11:40:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051620; bh=Q8weF/ruccANz+AO9p5Pr5ibKl+2BRCize4l+859iBI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WKzWMJ3sXj5aMPCAFO9ldnSsZWwqlS6jfhWhT9E5IFN+Etoevmz9b/SaZj4HnXr6n 04JwbjqnQf+QVUjYoHnoEFU8UJB1AXAmsi/YNlNr6MFhF5oxw647weHxtxhce2AM5x YHmrwhM5NR1qylSYfAQE1TSQoKhS8pdiCyj34e10= From: Ard Biesheuvel To: linux-efi@vger.kernel.org, Ingo Molnar , Thomas Gleixner Cc: Ard Biesheuvel , Ard Biesheuvel , linux-kernel@vger.kernel.org, Andy Lutomirski , Arvind Sankar , Matthew Garrett Subject: [PATCH 02/20] efi/libstub/x86: force 'hidden' visibility for extern declarations Date: Fri, 3 Jan 2020 12:39:35 +0100 Message-Id: <20200103113953.9571-3-ardb@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200103113953.9571-1-ardb@kernel.org> References: <20200103113953.9571-1-ardb@kernel.org> MIME-Version: 1.0 Sender: linux-efi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org Commit c3710de5065d ("efi/libstub/x86: Drop __efi_early() export and efi_config struct") introduced a reference from C code in eboot.c to the startup_32 symbol defined in the .S startup code. This results in a GOT based reference to startup_32, and since GOT entries carry absolute addresses, they need to be fixed up before they can be used. On modern toolchains (binutils 2.26 or later), this reference is relaxed into a R_386_GOTOFF relocation (or the analogous X86_64 one) which never uses the absolute address in the entry, and so we get away with not fixing up the GOT table before calling the EFI entry point. However, GCC 4.6 combined with a binutils of the era (2.24) will produce a true GOT indirected reference, resulting in a wrong value to be returned for the address of startup_32() if the boot code is not running at the address it was linked at. Fortunately, we can easily override this behavior, and force GCC to emit the GOTOFF relocations explicitly, by setting the visibility pragma 'hidden'. Signed-off-by: Ard Biesheuvel --- arch/x86/boot/compressed/eboot.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c index da04948d75ed..565ee4733579 100644 --- a/arch/x86/boot/compressed/eboot.c +++ b/arch/x86/boot/compressed/eboot.c @@ -6,6 +6,8 @@ * * ----------------------------------------------------------------------- */ +#pragma GCC visibility push(hidden) + #include #include From patchwork Fri Jan 3 11:39:37 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 206656 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 50CDFC32767 for ; Fri, 3 Jan 2020 11:41:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1CEE621835 for ; Fri, 3 Jan 2020 11:41:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051695; bh=2ZDafcrOFKSF2ybRq49KajpWushIOtD+aMmrNSMAiQM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=gzkQHpDbOWneHX/mDr4WCh2+EhCs7lavCCN62a0pYaMACN65XodQumcbAEhGwXop+ TDicXk3tjDQoIDSBQLS6oRsLmAxNMdxJu39IwrySXk/ZRn+q8Um6h+qVSfh5QDPlMb UIM7JE7EQJVtERiioNHKHVN6o6Ngp2Q5rsQK8M4I= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727710AbgACLkZ (ORCPT ); Fri, 3 Jan 2020 06:40:25 -0500 Received: from mail.kernel.org ([198.145.29.99]:39670 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727726AbgACLkY (ORCPT ); Fri, 3 Jan 2020 06:40:24 -0500 Received: from localhost.localdomain (amontpellier-657-1-18-247.w109-210.abo.wanadoo.fr [109.210.65.247]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 8E3E524649; Fri, 3 Jan 2020 11:40:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051624; bh=2ZDafcrOFKSF2ybRq49KajpWushIOtD+aMmrNSMAiQM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Z3XU3CX/9PcO9vjlhAP54CO0W7KCHeRLDWxVe7EmYZDGNEZYy0VzFjoF4p/HgVqZ0 EceYb2XWR0TSCUpTK++cE4gQny6i+NcoNcGpW/CzYeDxZjbi08BTKv4U+nIuLvZ3Pw EnI7TEFmrSWeEw3vnneMEdOmph9URiSeDtNq/Zg0= From: Ard Biesheuvel To: linux-efi@vger.kernel.org, Ingo Molnar , Thomas Gleixner Cc: Ard Biesheuvel , Ard Biesheuvel , linux-kernel@vger.kernel.org, Andy Lutomirski , Arvind Sankar , Matthew Garrett Subject: [PATCH 04/20] efi/x86: map the entire EFI vendor string before copying it Date: Fri, 3 Jan 2020 12:39:37 +0100 Message-Id: <20200103113953.9571-5-ardb@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200103113953.9571-1-ardb@kernel.org> References: <20200103113953.9571-1-ardb@kernel.org> MIME-Version: 1.0 Sender: linux-efi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org Fix a couple of issues with the way we map and copy the vendor string: - we map only 2 bytes, which usually works since you get at least a page, but if the vendor string happens to cross a page boundary, a crash will result - only call early_memunmap() if early_memremap() succeeded, or we will call it with a NULL address which it doesn't like, - while at it, switch to early_memremap_ro(), and array indexing rather than pointer dereferencing to read the CHAR16 characters. Fixes: 5b83683f32b1 ("x86: EFI runtime service support") Signed-off-by: Ard Biesheuvel --- arch/x86/platform/efi/efi.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c index d96953d9d4e7..3ce32c31bb61 100644 --- a/arch/x86/platform/efi/efi.c +++ b/arch/x86/platform/efi/efi.c @@ -541,7 +541,6 @@ void __init efi_init(void) efi_char16_t *c16; char vendor[100] = "unknown"; int i = 0; - void *tmp; #ifdef CONFIG_X86_32 if (boot_params.efi_info.efi_systab_hi || @@ -566,14 +565,16 @@ void __init efi_init(void) /* * Show what we know for posterity */ - c16 = tmp = early_memremap(efi.systab->fw_vendor, 2); + c16 = early_memremap_ro(efi.systab->fw_vendor, + sizeof(vendor) * sizeof(efi_char16_t)); if (c16) { - for (i = 0; i < sizeof(vendor) - 1 && *c16; ++i) - vendor[i] = *c16++; + for (i = 0; i < sizeof(vendor) - 1 && c16[i]; ++i) + vendor[i] = c16[i]; vendor[i] = '\0'; - } else + early_memunmap(c16, sizeof(vendor) * sizeof(efi_char16_t)); + } else { pr_err("Could not map the firmware vendor!\n"); - early_memunmap(tmp, 2); + } pr_info("EFI v%u.%.02u by %s\n", efi.systab->hdr.revision >> 16, From patchwork Fri Jan 3 11:39:38 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 206664 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6A47EC2D0C2 for ; Fri, 3 Jan 2020 11:40:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3F08E21D7D for ; Fri, 3 Jan 2020 11:40:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051630; bh=Yy+0Y26bNsBKW5pM0oJe/s001o5+q6lON5VgSvebl0k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=uFQvTgDDGytMAn3OKwSOriaPgQ53j6NWCJ00zEtoYPrDl/Ek86Czpz/xiS8f5mvLS CQDqhGByzyuWVltegt5IX9S/N+2ytXPt2ERkXvhCOsmeOt6XwtHZFd8Sk73uT2IiUK r7hf2nH295u3KRAPeUELs07sH1suG/6Jso3snPm0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727754AbgACLk3 (ORCPT ); Fri, 3 Jan 2020 06:40:29 -0500 Received: from mail.kernel.org ([198.145.29.99]:39778 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727737AbgACLk1 (ORCPT ); Fri, 3 Jan 2020 06:40:27 -0500 Received: from localhost.localdomain (amontpellier-657-1-18-247.w109-210.abo.wanadoo.fr [109.210.65.247]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9C66B22314; Fri, 3 Jan 2020 11:40:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051626; bh=Yy+0Y26bNsBKW5pM0oJe/s001o5+q6lON5VgSvebl0k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=C2Eexyl5EQImX/YyREv+qTf2pRTcYk0EFNNc1DA+7PteX+s0KvoQH67gnjo1iHzg7 FW+BvYzccW/tnp8/QhqycRdjVam3n8H8op4qpNl8OLrMY4WxNfD79yBdoxP+LeucSg q3ehJSBPeI1vZiSvpB0qOTooI+09HIJ8yGRUEx9U= From: Ard Biesheuvel To: linux-efi@vger.kernel.org, Ingo Molnar , Thomas Gleixner Cc: Ard Biesheuvel , Ard Biesheuvel , linux-kernel@vger.kernel.org, Andy Lutomirski , Arvind Sankar , Matthew Garrett Subject: [PATCH 05/20] efi/x86: avoid redundant cast of EFI firmware service pointer Date: Fri, 3 Jan 2020 12:39:38 +0100 Message-Id: <20200103113953.9571-6-ardb@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200103113953.9571-1-ardb@kernel.org> References: <20200103113953.9571-1-ardb@kernel.org> MIME-Version: 1.0 Sender: linux-efi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org All EFI firmware call prototypes have been annotated as __efiapi, permitting us to attach attributes regarding the calling convention by overriding __efiapi to an architecture specific value. On 32-bit x86, EFI firmware calls use the plain calling convention where all arguments are passed via the stack, and cleaned up by the caller. Let's add this to the __efiapi definition so we no longer need to cast the function pointers before invoking them. Signed-off-by: Ard Biesheuvel --- arch/x86/include/asm/efi.h | 8 +------- include/linux/efi.h | 4 +++- 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h index b35b5d423e9d..09c3fc468793 100644 --- a/arch/x86/include/asm/efi.h +++ b/arch/x86/include/asm/efi.h @@ -51,13 +51,7 @@ extern asmlinkage unsigned long efi_call_phys(void *, ...); }) -/* - * Wrap all the virtual calls in a way that forces the parameters on the stack. - */ -#define arch_efi_call_virt(p, f, args...) \ -({ \ - ((efi_##f##_t __attribute__((regparm(0)))*) p->f)(args); \ -}) +#define arch_efi_call_virt(p, f, args...) p->f(args) #define efi_ioremap(addr, size, type, attr) ioremap_cache(addr, size) diff --git a/include/linux/efi.h b/include/linux/efi.h index 726673e98990..952c1659dfd9 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h @@ -48,8 +48,10 @@ typedef u16 efi_char16_t; /* UNICODE character */ typedef u64 efi_physical_addr_t; typedef void *efi_handle_t; -#ifdef CONFIG_X86_64 +#if defined(CONFIG_X86_64) #define __efiapi __attribute__((ms_abi)) +#elif defined(CONFIG_X86_32) +#define __efiapi __attribute__((regparm(0))) #else #define __efiapi #endif From patchwork Fri Jan 3 11:39:40 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 206657 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B27CDC2D0CE for ; Fri, 3 Jan 2020 11:41:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7C34321835 for ; Fri, 3 Jan 2020 11:41:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051690; bh=lYUfQEsb2sfLYHb6SW9R5l7XM17hhCTRql1Wy9aMfxE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=RBeWNQlVHV7Y5w5SA56f5IudFuhyw7geF8g9M/j0VBxxWRZmQancJTZYTPFVQs1Xi WoUPAs1RHsPjigucKO4tBhXx5BlUKjW2y6G7br49uGsM5RlODg6rIdxbI1FSfzTPmF bfpYtVwR72FLZY9fgXn75vCmveQFNJ3aj+L/GmTY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727726AbgACLkc (ORCPT ); Fri, 3 Jan 2020 06:40:32 -0500 Received: from mail.kernel.org ([198.145.29.99]:39964 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727777AbgACLkb (ORCPT ); Fri, 3 Jan 2020 06:40:31 -0500 Received: from localhost.localdomain (amontpellier-657-1-18-247.w109-210.abo.wanadoo.fr [109.210.65.247]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id BA09524650; Fri, 3 Jan 2020 11:40:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051630; bh=lYUfQEsb2sfLYHb6SW9R5l7XM17hhCTRql1Wy9aMfxE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ibY/VsxGSoe0krM3fpAyKrhSGOTZa/kF7b5THb1suLXA0SQtnV2pnAXpF3zWPCDCw HQ20uN/VmKy1yOOJzAUqE+J8NSIh9Nuxwe0KAfqdz4naeNB2gmZrIwceYeHI1/DiY8 QAsq4XbUSXbddbnORP0+IuJCWbPraAdXWXIypunY= From: Ard Biesheuvel To: linux-efi@vger.kernel.org, Ingo Molnar , Thomas Gleixner Cc: Ard Biesheuvel , Ard Biesheuvel , linux-kernel@vger.kernel.org, Andy Lutomirski , Arvind Sankar , Matthew Garrett Subject: [PATCH 07/20] efi/x86: split SetVirtualAddresMap() wrappers into 32 and 64 bit versions Date: Fri, 3 Jan 2020 12:39:40 +0100 Message-Id: <20200103113953.9571-8-ardb@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200103113953.9571-1-ardb@kernel.org> References: <20200103113953.9571-1-ardb@kernel.org> MIME-Version: 1.0 Sender: linux-efi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org Split the phys_efi_set_virtual_address_map() routine into 32 and 64 bit versions, so we can simplify them individually in subsequent patches. There is very little overlap between the logic anyway, and this has already been factored out in prolog/epilog routines which are completely different between 32 bit and 64 bit. So let's take it one step further, and get rid of the overlap completely. Signed-off-by: Ard Biesheuvel --- arch/x86/include/asm/efi.h | 8 ++--- arch/x86/platform/efi/efi.c | 30 ++---------------- arch/x86/platform/efi/efi_32.c | 21 ++++++++++--- arch/x86/platform/efi/efi_64.c | 56 ++++++++++++++++++++++------------ 4 files changed, 58 insertions(+), 57 deletions(-) diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h index 09c3fc468793..e29e5dc0b750 100644 --- a/arch/x86/include/asm/efi.h +++ b/arch/x86/include/asm/efi.h @@ -61,8 +61,6 @@ extern asmlinkage unsigned long efi_call_phys(void *, ...); extern asmlinkage u64 efi_call(void *fp, ...); -#define efi_call_phys(f, args...) efi_call((f), args) - /* * struct efi_scratch - Scratch space used while switching to/from efi_mm * @phys_stack: stack used during EFI Mixed Mode @@ -115,8 +113,6 @@ extern void __iomem *__init efi_ioremap(unsigned long addr, unsigned long size, extern struct efi_scratch efi_scratch; extern void __init efi_set_executable(efi_memory_desc_t *md, bool executable); extern int __init efi_memblock_x86_reserve_range(void); -extern pgd_t * __init efi_call_phys_prolog(void); -extern void __init efi_call_phys_epilog(pgd_t *save_pgd); extern void __init efi_print_memmap(void); extern void __init efi_memory_uc(u64 addr, unsigned long size); extern void __init efi_map_region(efi_memory_desc_t *md); @@ -177,6 +173,10 @@ extern efi_status_t efi_thunk_set_virtual_address_map( unsigned long descriptor_size, u32 descriptor_version, efi_memory_desc_t *virtual_map); +efi_status_t efi_set_virtual_address_map(unsigned long memory_map_size, + unsigned long descriptor_size, + u32 descriptor_version, + efi_memory_desc_t *virtual_map); /* arch specific definitions used by the stub code */ diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c index 3ce32c31bb61..50f8123e658a 100644 --- a/arch/x86/platform/efi/efi.c +++ b/arch/x86/platform/efi/efi.c @@ -54,7 +54,7 @@ #include #include -static struct efi efi_phys __initdata; +struct efi efi_phys __initdata; static efi_system_table_t efi_systab __initdata; static efi_config_table_type_t arch_tables[] __initdata = { @@ -97,32 +97,6 @@ static int __init setup_add_efi_memmap(char *arg) } early_param("add_efi_memmap", setup_add_efi_memmap); -static efi_status_t __init phys_efi_set_virtual_address_map( - unsigned long memory_map_size, - unsigned long descriptor_size, - u32 descriptor_version, - efi_memory_desc_t *virtual_map) -{ - efi_status_t status; - unsigned long flags; - pgd_t *save_pgd; - - save_pgd = efi_call_phys_prolog(); - if (!save_pgd) - return EFI_ABORTED; - - /* Disable interrupts around EFI calls: */ - local_irq_save(flags); - status = efi_call_phys(efi_phys.set_virtual_address_map, - memory_map_size, descriptor_size, - descriptor_version, virtual_map); - local_irq_restore(flags); - - efi_call_phys_epilog(save_pgd); - - return status; -} - void __init efi_find_mirror(void) { efi_memory_desc_t *md; @@ -1042,7 +1016,7 @@ static void __init __efi_enter_virtual_mode(void) efi_sync_low_kernel_mappings(); if (!efi_is_mixed()) { - status = phys_efi_set_virtual_address_map( + status = efi_set_virtual_address_map( efi.memmap.desc_size * count, efi.memmap.desc_size, efi.memmap.desc_version, diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c index 9959657127f4..185950ade0e9 100644 --- a/arch/x86/platform/efi/efi_32.c +++ b/arch/x86/platform/efi/efi_32.c @@ -66,9 +66,16 @@ void __init efi_map_region(efi_memory_desc_t *md) void __init efi_map_region_fixed(efi_memory_desc_t *md) {} void __init parse_efi_setup(u64 phys_addr, u32 data_len) {} -pgd_t * __init efi_call_phys_prolog(void) +extern struct efi efi_phys; + +efi_status_t __init efi_set_virtual_address_map(unsigned long memory_map_size, + unsigned long descriptor_size, + u32 descriptor_version, + efi_memory_desc_t *virtual_map) { struct desc_ptr gdt_descr; + efi_status_t status; + unsigned long flags; pgd_t *save_pgd; /* Current pgd is swapper_pg_dir, we'll restore it later: */ @@ -80,14 +87,18 @@ pgd_t * __init efi_call_phys_prolog(void) gdt_descr.size = GDT_SIZE - 1; load_gdt(&gdt_descr); - return save_pgd; -} + /* Disable interrupts around EFI calls: */ + local_irq_save(flags); + status = efi_call_phys(efi_phys.set_virtual_address_map, + memory_map_size, descriptor_size, + descriptor_version, virtual_map); + local_irq_restore(flags); -void __init efi_call_phys_epilog(pgd_t *save_pgd) -{ load_fixmap_gdt(0); load_cr3(save_pgd); __flush_tlb_all(); + + return status; } void __init efi_runtime_update_mappings(void) diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c index a72bbabbc595..a7f11d1ff7c4 100644 --- a/arch/x86/platform/efi/efi_64.c +++ b/arch/x86/platform/efi/efi_64.c @@ -72,9 +72,9 @@ static void __init early_code_mapping_set_exec(int executable) } } -void __init efi_old_memmap_phys_epilog(pgd_t *save_pgd); +static void __init efi_old_memmap_phys_epilog(pgd_t *save_pgd); -pgd_t * __init efi_old_memmap_phys_prolog(void) +static pgd_t * __init efi_old_memmap_phys_prolog(void) { unsigned long vaddr, addr_pgd, addr_p4d, addr_pud; pgd_t *save_pgd, *pgd_k, *pgd_efi; @@ -144,7 +144,7 @@ pgd_t * __init efi_old_memmap_phys_prolog(void) return NULL; } -void __init efi_old_memmap_phys_epilog(pgd_t *save_pgd) +static void __init efi_old_memmap_phys_epilog(pgd_t *save_pgd) { /* * After the lock is released, the original page table is restored. @@ -185,23 +185,6 @@ void __init efi_old_memmap_phys_epilog(pgd_t *save_pgd) early_code_mapping_set_exec(0); } -pgd_t * __init efi_call_phys_prolog(void) -{ - if (efi_enabled(EFI_OLD_MEMMAP)) - return efi_old_memmap_phys_prolog(); - - efi_switch_mm(&efi_mm); - return efi_mm.pgd; -} - -void __init efi_call_phys_epilog(pgd_t *save_pgd) -{ - if (efi_enabled(EFI_OLD_MEMMAP)) - efi_old_memmap_phys_epilog(save_pgd); - else - efi_switch_mm(efi_scratch.prev_mm); -} - EXPORT_SYMBOL_GPL(efi_mm); /* @@ -1018,3 +1001,36 @@ void efi_thunk_runtime_setup(void) efi.query_capsule_caps = efi_thunk_query_capsule_caps; } #endif /* CONFIG_EFI_MIXED */ + +efi_status_t __init efi_set_virtual_address_map(unsigned long memory_map_size, + unsigned long descriptor_size, + u32 descriptor_version, + efi_memory_desc_t *virtual_map) +{ + efi_status_t status; + unsigned long flags; + pgd_t *save_pgd = NULL; + + if (efi_enabled(EFI_OLD_MEMMAP)) { + save_pgd = efi_old_memmap_phys_prolog(); + if (!save_pgd) + return EFI_ABORTED; + } else { + efi_switch_mm(&efi_mm); + } + + /* Disable interrupts around EFI calls: */ + local_irq_save(flags); + status = efi_call(efi.systab->runtime->set_virtual_address_map, + memory_map_size, descriptor_size, + descriptor_version, virtual_map); + local_irq_restore(flags); + + + if (save_pgd) + efi_old_memmap_phys_epilog(save_pgd); + else + efi_switch_mm(efi_scratch.prev_mm); + + return status; +} From patchwork Fri Jan 3 11:39:42 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 206663 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A82ACC2D0C2 for ; Fri, 3 Jan 2020 11:40:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7E77621D7D for ; Fri, 3 Jan 2020 11:40:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051637; bh=ZGdQNY/m9AfSk+pXTJniPsz4ZCTpoChydYzo6TM28KQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=msX5MnHeJiSKKAO1tnIN5Dj5gkG8sx/l/V3ObeWnaBRSOQVyIvAxTWLTr/+sz9HJX yONACGcd3EI+p5nE5d/Cm2DYrQHgrQOisIP9J/OrslVQw6eghIhyDyXBT8SbFJbZNc sX6ceCrgaW3ddSo6g+RcYs8jdnmus5Iq8u8x0olM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727806AbgACLkh (ORCPT ); Fri, 3 Jan 2020 06:40:37 -0500 Received: from mail.kernel.org ([198.145.29.99]:40102 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727777AbgACLkg (ORCPT ); Fri, 3 Jan 2020 06:40:36 -0500 Received: from localhost.localdomain (amontpellier-657-1-18-247.w109-210.abo.wanadoo.fr [109.210.65.247]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DC7D724655; Fri, 3 Jan 2020 11:40:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051634; bh=ZGdQNY/m9AfSk+pXTJniPsz4ZCTpoChydYzo6TM28KQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JqXIcsleGh1sbnbDc6Z4fIuKO8/sF2C2TAlz4pOeLhhAx7xe0YnY/z4OYY0RSPgKR o9HpyPnt4tnC97qyji0nd35rpGxKuN9IMEAb4I8pgVcfc6Nh1LC3MJA2v+AEB0AOJk DfY/pzxthR/v3enCi56nZsPuT2IaV1YCUTjrkGak= From: Ard Biesheuvel To: linux-efi@vger.kernel.org, Ingo Molnar , Thomas Gleixner Cc: Ard Biesheuvel , Ard Biesheuvel , linux-kernel@vger.kernel.org, Andy Lutomirski , Arvind Sankar , Matthew Garrett Subject: [PATCH 09/20] efi/x86: simplify 64-bit EFI firmware call wrapper Date: Fri, 3 Jan 2020 12:39:42 +0100 Message-Id: <20200103113953.9571-10-ardb@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200103113953.9571-1-ardb@kernel.org> References: <20200103113953.9571-1-ardb@kernel.org> MIME-Version: 1.0 Sender: linux-efi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org The efi_call() wrapper used to invoke EFI runtime services serves a number of purposes: - realign the stack to 16 bytes - preserve FP and CR0 register state - translate from SysV to MS calling convention. Preserving CR0.TS is no longer necessary in Linux, and preserving the FP register state is also redundant in most cases, since efi_call() is almost always used from within the scope of a pair of kernel_fpu_begin()/ kernel_fpu_end() calls, with the exception of the early call to SetVirtualAddressMap() and the SGI UV support code. So let's add a pair of kernel_fpu_begin()/_end() calls there as well, and remove the unnecessary code from the assembly implementation of efi_call(), and only keep the pieces that deal with the stack alignment and the ABI translation. Signed-off-by: Ard Biesheuvel --- arch/x86/platform/efi/Makefile | 1 - arch/x86/platform/efi/efi_64.c | 3 +++ arch/x86/platform/efi/efi_stub_64.S | 39 +++-------------------------- arch/x86/platform/uv/bios_uv.c | 7 ++++-- 4 files changed, 12 insertions(+), 38 deletions(-) diff --git a/arch/x86/platform/efi/Makefile b/arch/x86/platform/efi/Makefile index fe29f3f5d384..7ec3a8b31f8b 100644 --- a/arch/x86/platform/efi/Makefile +++ b/arch/x86/platform/efi/Makefile @@ -1,6 +1,5 @@ # SPDX-License-Identifier: GPL-2.0 OBJECT_FILES_NON_STANDARD_efi_thunk_$(BITS).o := y -OBJECT_FILES_NON_STANDARD_efi_stub_$(BITS).o := y obj-$(CONFIG_EFI) += quirks.o efi.o efi_$(BITS).o efi_stub_$(BITS).o obj-$(CONFIG_EFI_MIXED) += efi_thunk_$(BITS).o diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c index a7f11d1ff7c4..03565dad0c4b 100644 --- a/arch/x86/platform/efi/efi_64.c +++ b/arch/x86/platform/efi/efi_64.c @@ -1019,6 +1019,8 @@ efi_status_t __init efi_set_virtual_address_map(unsigned long memory_map_size, efi_switch_mm(&efi_mm); } + kernel_fpu_begin(); + /* Disable interrupts around EFI calls: */ local_irq_save(flags); status = efi_call(efi.systab->runtime->set_virtual_address_map, @@ -1026,6 +1028,7 @@ efi_status_t __init efi_set_virtual_address_map(unsigned long memory_map_size, descriptor_version, virtual_map); local_irq_restore(flags); + kernel_fpu_end(); if (save_pgd) efi_old_memmap_phys_epilog(save_pgd); diff --git a/arch/x86/platform/efi/efi_stub_64.S b/arch/x86/platform/efi/efi_stub_64.S index b1d2313fe3bf..e7e1020f4ccb 100644 --- a/arch/x86/platform/efi/efi_stub_64.S +++ b/arch/x86/platform/efi/efi_stub_64.S @@ -8,41 +8,12 @@ */ #include -#include -#include -#include -#include - -#define SAVE_XMM \ - mov %rsp, %rax; \ - subq $0x70, %rsp; \ - and $~0xf, %rsp; \ - mov %rax, (%rsp); \ - mov %cr0, %rax; \ - clts; \ - mov %rax, 0x8(%rsp); \ - movaps %xmm0, 0x60(%rsp); \ - movaps %xmm1, 0x50(%rsp); \ - movaps %xmm2, 0x40(%rsp); \ - movaps %xmm3, 0x30(%rsp); \ - movaps %xmm4, 0x20(%rsp); \ - movaps %xmm5, 0x10(%rsp) - -#define RESTORE_XMM \ - movaps 0x60(%rsp), %xmm0; \ - movaps 0x50(%rsp), %xmm1; \ - movaps 0x40(%rsp), %xmm2; \ - movaps 0x30(%rsp), %xmm3; \ - movaps 0x20(%rsp), %xmm4; \ - movaps 0x10(%rsp), %xmm5; \ - mov 0x8(%rsp), %rsi; \ - mov %rsi, %cr0; \ - mov (%rsp), %rsp +#include SYM_FUNC_START(efi_call) pushq %rbp movq %rsp, %rbp - SAVE_XMM + and $~0xf, %rsp mov 16(%rbp), %rax subq $48, %rsp mov %r9, 32(%rsp) @@ -50,9 +21,7 @@ SYM_FUNC_START(efi_call) mov %r8, %r9 mov %rcx, %r8 mov %rsi, %rcx - call *%rdi - addq $48, %rsp - RESTORE_XMM - popq %rbp + CALL_NOSPEC %rdi + leave ret SYM_FUNC_END(efi_call) diff --git a/arch/x86/platform/uv/bios_uv.c b/arch/x86/platform/uv/bios_uv.c index ece9cb9c1189..5c0e2eb5d87c 100644 --- a/arch/x86/platform/uv/bios_uv.c +++ b/arch/x86/platform/uv/bios_uv.c @@ -34,10 +34,13 @@ static s64 __uv_bios_call(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, * If EFI_OLD_MEMMAP is set, we need to fall back to using our old EFI * callback method, which uses efi_call() directly, with the kernel page tables: */ - if (unlikely(efi_enabled(EFI_OLD_MEMMAP))) + if (unlikely(efi_enabled(EFI_OLD_MEMMAP))) { + kernel_fpu_begin(); ret = efi_call((void *)__va(tab->function), (u64)which, a1, a2, a3, a4, a5); - else + kernel_fpu_end(); + } else { ret = efi_call_virt_pointer(tab, function, (u64)which, a1, a2, a3, a4, a5); + } return ret; } From patchwork Fri Jan 3 11:39:44 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 206658 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8ACBDC2D0CE for ; Fri, 3 Jan 2020 11:41:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6283621D7D for ; Fri, 3 Jan 2020 11:41:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051680; bh=30LNcCXGrHbjed7nFrjq4dhg8qri5X+a1jEAPmmUuXk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=dV7Ist9e4TyELnK27MJa8Gc30NqN9yod3gasInShI7jqdIexooANCdl2x91lh3Xhy 7XDPdMr9vYM9RRUW13rV/SmaDBtnhpGOdYHWQbMigxtTKwz0dp8ZFzGAOCkHqeKVPL VJCYlCX7XHLmQyMbi2TtZSVP8ybDD/Gu+KsCq7AE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727826AbgACLkj (ORCPT ); Fri, 3 Jan 2020 06:40:39 -0500 Received: from mail.kernel.org ([198.145.29.99]:40248 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727824AbgACLkj (ORCPT ); Fri, 3 Jan 2020 06:40:39 -0500 Received: from localhost.localdomain (amontpellier-657-1-18-247.w109-210.abo.wanadoo.fr [109.210.65.247]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0802722314; Fri, 3 Jan 2020 11:40:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051638; bh=30LNcCXGrHbjed7nFrjq4dhg8qri5X+a1jEAPmmUuXk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MFyCZ4tAexrywQvB989HwzlZlynIG0kaQPjSIm2W+U4XQHnfALOo+lY6BSFoVukce PojaAFcBXrODj+PX/Islw+JP74BCppTc1vN1W4URFRqEULOjE2yQ9zFni2ZvrkKfFU Cau/GbfAD9b+YmlZEYVlBs/vt8xO6bFI76OdPXO8= From: Ard Biesheuvel To: linux-efi@vger.kernel.org, Ingo Molnar , Thomas Gleixner Cc: Ard Biesheuvel , Ard Biesheuvel , linux-kernel@vger.kernel.org, Andy Lutomirski , Arvind Sankar , Matthew Garrett Subject: [PATCH 11/20] efi/x86: drop two near identical versions of efi_runtime_init() Date: Fri, 3 Jan 2020 12:39:44 +0100 Message-Id: <20200103113953.9571-12-ardb@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200103113953.9571-1-ardb@kernel.org> References: <20200103113953.9571-1-ardb@kernel.org> MIME-Version: 1.0 Sender: linux-efi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org The routines efi_runtime_init32() and efi_runtime_init64() are almost indistinguishable, and the only relevant difference is the offset in the runtime struct from where to obtain the physical address of the SetVirtualAddressMap() routine. However, this address is only used once, when installing the virtual address map that the OS will use to invoke EFI runtime services, and at the time of the call, we will necessarily be running with a 1:1 mapping, and so there is no need to do the map/unmap dance here to retrieve the address. In fact, in the preceding changes to these users, we stopped using the address recorded here entirely. So let's just get rid of all this code since it no longer serves a purpose. While at it, tweak the logic so that we handle unsupported and disable EFI runtime services in the same way, and unmap the EFI memory map in both cases. Signed-off-by: Ard Biesheuvel --- arch/x86/platform/efi/efi.c | 95 ++----------------------------------- include/linux/efi.h | 19 -------- 2 files changed, 5 insertions(+), 109 deletions(-) diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c index e4d3afac7be3..67cb0fd18777 100644 --- a/arch/x86/platform/efi/efi.c +++ b/arch/x86/platform/efi/efi.c @@ -429,87 +429,6 @@ static int __init efi_systab_init(void *phys) return 0; } -static int __init efi_runtime_init32(void) -{ - efi_runtime_services_32_t *runtime; - - runtime = early_memremap((unsigned long)efi.systab->runtime, - sizeof(efi_runtime_services_32_t)); - if (!runtime) { - pr_err("Could not map the runtime service table!\n"); - return -ENOMEM; - } - - /* - * We will only need *early* access to the SetVirtualAddressMap - * EFI runtime service. All other runtime services will be called - * via the virtual mapping. - */ - efi_phys.set_virtual_address_map = - (efi_set_virtual_address_map_t *) - (unsigned long)runtime->set_virtual_address_map; - early_memunmap(runtime, sizeof(efi_runtime_services_32_t)); - - return 0; -} - -static int __init efi_runtime_init64(void) -{ - efi_runtime_services_64_t *runtime; - - runtime = early_memremap((unsigned long)efi.systab->runtime, - sizeof(efi_runtime_services_64_t)); - if (!runtime) { - pr_err("Could not map the runtime service table!\n"); - return -ENOMEM; - } - - /* - * We will only need *early* access to the SetVirtualAddressMap - * EFI runtime service. All other runtime services will be called - * via the virtual mapping. - */ - efi_phys.set_virtual_address_map = - (efi_set_virtual_address_map_t *) - (unsigned long)runtime->set_virtual_address_map; - early_memunmap(runtime, sizeof(efi_runtime_services_64_t)); - - return 0; -} - -static int __init efi_runtime_init(void) -{ - int rv; - - /* - * Check out the runtime services table. We need to map - * the runtime services table so that we can grab the physical - * address of several of the EFI runtime functions, needed to - * set the firmware into virtual mode. - * - * When EFI_PARAVIRT is in force then we could not map runtime - * service memory region because we do not have direct access to it. - * However, runtime services are available through proxy functions - * (e.g. in case of Xen dom0 EFI implementation they call special - * hypercall which executes relevant EFI functions) and that is why - * they are always enabled. - */ - - if (!efi_enabled(EFI_PARAVIRT)) { - if (efi_enabled(EFI_64BIT)) - rv = efi_runtime_init64(); - else - rv = efi_runtime_init32(); - - if (rv) - return rv; - } - - set_bit(EFI_RUNTIME_SERVICES, &efi.flags); - - return 0; -} - void __init efi_init(void) { efi_char16_t *c16; @@ -567,13 +486,13 @@ void __init efi_init(void) if (!efi_runtime_supported()) pr_info("No EFI runtime due to 32/64-bit mismatch with kernel\n"); - else { - if (efi_runtime_disabled() || efi_runtime_init()) { - efi_memmap_unmap(); - return; - } + + if (!efi_runtime_supported() || efi_runtime_disabled()) { + efi_memmap_unmap(); + return; } + set_bit(EFI_RUNTIME_SERVICES, &efi.flags); efi_clean_memmap(); if (efi_enabled(EFI_DBG)) @@ -934,8 +853,6 @@ static void __init kexec_enter_virtual_mode(void) efi_native_runtime_setup(); - efi.set_virtual_address_map = NULL; - if (efi_enabled(EFI_OLD_MEMMAP) && (__supported_pte_mask & _PAGE_NX)) runtime_code_page_mkexec(); #endif @@ -1040,8 +957,6 @@ static void __init __efi_enter_virtual_mode(void) else efi_thunk_runtime_setup(); - efi.set_virtual_address_map = NULL; - /* * Apply more restrictive page table mapping attributes now that * SVAM() has been called and the firmware has performed all diff --git a/include/linux/efi.h b/include/linux/efi.h index 952c1659dfd9..ee68ea6f85ff 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h @@ -539,24 +539,6 @@ typedef struct { u32 query_variable_info; } efi_runtime_services_32_t; -typedef struct { - efi_table_hdr_t hdr; - u64 get_time; - u64 set_time; - u64 get_wakeup_time; - u64 set_wakeup_time; - u64 set_virtual_address_map; - u64 convert_pointer; - u64 get_variable; - u64 get_next_variable; - u64 set_variable; - u64 get_next_high_mono_count; - u64 reset_system; - u64 update_capsule; - u64 query_capsule_caps; - u64 query_variable_info; -} efi_runtime_services_64_t; - typedef efi_status_t efi_get_time_t (efi_time_t *tm, efi_time_cap_t *tc); typedef efi_status_t efi_set_time_t (efi_time_t *tm); typedef efi_status_t efi_get_wakeup_time_t (efi_bool_t *enabled, efi_bool_t *pending, @@ -946,7 +928,6 @@ extern struct efi { efi_query_capsule_caps_t *query_capsule_caps; efi_get_next_high_mono_count_t *get_next_high_mono_count; efi_reset_system_t *reset_system; - efi_set_virtual_address_map_t *set_virtual_address_map; struct efi_memory_map memmap; unsigned long flags; } efi; From patchwork Fri Jan 3 11:39:46 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 206659 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 37C73C2D0C2 for ; Fri, 3 Jan 2020 11:41:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0CB1921D7D for ; Fri, 3 Jan 2020 11:41:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051680; bh=Hc6UcQ9UpT/kVsHpfR+qryCfdpE3qLzn7SldrCucIX8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=IIEhyL5xcc2u0nqDAyh1MzO9syizDBFD4zTAn8y6JybFLdqShjd+6Kke35W/VrXSo arpskZVPtJT/5tLjQQIuieVXQnpX2mP4S73az53GrktzDX2q0AOkJ96yAn/Njyq7N+ X2xgFgD27Qg/MJVse+BrEPOCcwS/nio6PVw3Y9tg= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727876AbgACLlP (ORCPT ); Fri, 3 Jan 2020 06:41:15 -0500 Received: from mail.kernel.org ([198.145.29.99]:40418 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727841AbgACLkn (ORCPT ); Fri, 3 Jan 2020 06:40:43 -0500 Received: from localhost.localdomain (amontpellier-657-1-18-247.w109-210.abo.wanadoo.fr [109.210.65.247]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 269892464B; Fri, 3 Jan 2020 11:40:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051642; bh=Hc6UcQ9UpT/kVsHpfR+qryCfdpE3qLzn7SldrCucIX8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ii790vAP0OPeIIlLjwcHHtH/Ks7PQ+Dtw3t1mC4olvTHfFIGuQk++kQWf5SDFCCfn iWmGrQWDHkC+CTqCo8p9hJPSPKZBZz8vigTRj8T3JQu2mfMBy1aC5Y2veux74cl9j1 WGdwYSGVSxkfHU/1PMgBEPCF6kx7e+QknpY6Vahw= From: Ard Biesheuvel To: linux-efi@vger.kernel.org, Ingo Molnar , Thomas Gleixner Cc: Ard Biesheuvel , Ard Biesheuvel , linux-kernel@vger.kernel.org, Andy Lutomirski , Arvind Sankar , Matthew Garrett Subject: [PATCH 13/20] efi/x86: don't panic or BUG() on non-critical error conditions Date: Fri, 3 Jan 2020 12:39:46 +0100 Message-Id: <20200103113953.9571-14-ardb@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200103113953.9571-1-ardb@kernel.org> References: <20200103113953.9571-1-ardb@kernel.org> MIME-Version: 1.0 Sender: linux-efi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org The logic in __efi_enter_virtual_mode() does a number of steps in sequence, all of which may fail in one way or the other. In most cases, we simply print an error and disable EFI runtime services support, but in some cases, we BUG() or panic() and bring down the system when encountering conditions that we could easily handle in the same way. While at it, replace a pointless page-to-virt-phys conversion with one that goes straight from struct page to physical. Signed-off-by: Ard Biesheuvel --- arch/x86/platform/efi/efi.c | 28 ++++++++++++++-------------- arch/x86/platform/efi/efi_64.c | 9 +++++---- 2 files changed, 19 insertions(+), 18 deletions(-) diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c index 53ed0b123641..4f539bfdc051 100644 --- a/arch/x86/platform/efi/efi.c +++ b/arch/x86/platform/efi/efi.c @@ -889,16 +889,14 @@ static void __init __efi_enter_virtual_mode(void) if (efi_alloc_page_tables()) { pr_err("Failed to allocate EFI page tables\n"); - clear_bit(EFI_RUNTIME_SERVICES, &efi.flags); - return; + goto err; } efi_merge_regions(); new_memmap = efi_map_regions(&count, &pg_shift); if (!new_memmap) { pr_err("Error reallocating memory, EFI runtime non-functional!\n"); - clear_bit(EFI_RUNTIME_SERVICES, &efi.flags); - return; + goto err; } pa = __pa(new_memmap); @@ -912,8 +910,7 @@ static void __init __efi_enter_virtual_mode(void) if (efi_memmap_init_late(pa, efi.memmap.desc_size * count)) { pr_err("Failed to remap late EFI memory map\n"); - clear_bit(EFI_RUNTIME_SERVICES, &efi.flags); - return; + goto err; } if (efi_enabled(EFI_DBG)) { @@ -921,12 +918,11 @@ static void __init __efi_enter_virtual_mode(void) efi_print_memmap(); } - BUG_ON(!efi.systab); + if (WARN_ON(!efi.systab)) + goto err; - if (efi_setup_page_tables(pa, 1 << pg_shift)) { - clear_bit(EFI_RUNTIME_SERVICES, &efi.flags); - return; - } + if (efi_setup_page_tables(pa, 1 << pg_shift)) + goto err; efi_sync_low_kernel_mappings(); @@ -935,9 +931,9 @@ static void __init __efi_enter_virtual_mode(void) efi.memmap.desc_version, (efi_memory_desc_t *)pa); if (status != EFI_SUCCESS) { - pr_alert("Unable to switch EFI into virtual mode (status=%lx)!\n", - status); - panic("EFI call to SetVirtualAddressMap() failed!"); + pr_err("Unable to switch EFI into virtual mode (status=%lx)!\n", + status); + goto err; } efi_free_boot_services(); @@ -964,6 +960,10 @@ static void __init __efi_enter_virtual_mode(void) /* clean DUMMY object */ efi_delete_dummy_variable(); + return; + +err: + clear_bit(EFI_RUNTIME_SERVICES, &efi.flags); } void __init efi_enter_virtual_mode(void) diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c index 910e9ec03b09..c13fa2150976 100644 --- a/arch/x86/platform/efi/efi_64.c +++ b/arch/x86/platform/efi/efi_64.c @@ -384,11 +384,12 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) return 0; page = alloc_page(GFP_KERNEL|__GFP_DMA32); - if (!page) - panic("Unable to allocate EFI runtime stack < 4GB\n"); + if (!page) { + pr_err("Unable to allocate EFI runtime stack < 4GB\n"); + return 1; + } - efi_scratch.phys_stack = virt_to_phys(page_address(page)); - efi_scratch.phys_stack += PAGE_SIZE; /* stack grows down */ + efi_scratch.phys_stack = page_to_phys(page + 1); /* stack grows down */ npages = (_etext - _text) >> PAGE_SHIFT; text = __pa(_text); From patchwork Fri Jan 3 11:39:48 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 206660 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1879C2D0CE for ; Fri, 3 Jan 2020 11:41:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 9ED5B21D7D for ; Fri, 3 Jan 2020 11:41:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051673; bh=Lz3g1HD3Aatv1rI/ib8wH2Clkm6CnbIojyw9mtMeti4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=VC4+v+UldCBRZStfvrZCDYB0/azcCk9hCxgszx864ily8WzC+rX+NzKDBzDKsZCH/ BLloQZSCvtIq3ngqfLrI0Or+dttKzLUD2qNrlxKqN6o6xxxOzKEAtbZXLag7Wkkrpz llxrLWXigqI3lwjEj8QvVycxJDPf6jqqRK1QAyl0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727870AbgACLks (ORCPT ); Fri, 3 Jan 2020 06:40:48 -0500 Received: from mail.kernel.org ([198.145.29.99]:40564 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727867AbgACLkr (ORCPT ); Fri, 3 Jan 2020 06:40:47 -0500 Received: from localhost.localdomain (amontpellier-657-1-18-247.w109-210.abo.wanadoo.fr [109.210.65.247]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 477BC24655; Fri, 3 Jan 2020 11:40:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051646; bh=Lz3g1HD3Aatv1rI/ib8wH2Clkm6CnbIojyw9mtMeti4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=d6z0GCcVk2Vv6RGIoMQRWBW/RMkR4arL3K5ql1kLHMVXzbYbyDc7tO7WfV6DADQ8n H4XTTHl/iK8ECE48KlecGzv77+BzxhbqLgQmE5UVrjnin8CyRI+6QwHHfR27nRFJEY 8wJC2NPumB+10o/6ZojCc4InSREVuW2XOoLY/YGk= From: Ard Biesheuvel To: linux-efi@vger.kernel.org, Ingo Molnar , Thomas Gleixner Cc: Ard Biesheuvel , Ard Biesheuvel , linux-kernel@vger.kernel.org, Andy Lutomirski , Arvind Sankar , Matthew Garrett Subject: [PATCH 15/20] efi/x86: Check number of arguments to variadic functions Date: Fri, 3 Jan 2020 12:39:48 +0100 Message-Id: <20200103113953.9571-16-ardb@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200103113953.9571-1-ardb@kernel.org> References: <20200103113953.9571-1-ardb@kernel.org> MIME-Version: 1.0 Sender: linux-efi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org From: Arvind Sankar On x86 we need to thunk through assembler stubs to call the EFI services for mixed mode, and for runtime services in 64-bit mode. The assembler stubs have limits on how many arguments it handles. Introduce a few macros to check that we do not try to pass too many arguments to the stubs. Signed-off-by: Arvind Sankar Signed-off-by: Ard Biesheuvel --- arch/x86/boot/compressed/efi_thunk_64.S | 4 +- arch/x86/include/asm/efi.h | 54 ++++++++++++++++++++++++- arch/x86/platform/efi/efi_stub_64.S | 4 +- arch/x86/platform/efi/efi_thunk_64.S | 4 +- 4 files changed, 58 insertions(+), 8 deletions(-) diff --git a/arch/x86/boot/compressed/efi_thunk_64.S b/arch/x86/boot/compressed/efi_thunk_64.S index 6d95eb6b8912..d040ff5458e5 100644 --- a/arch/x86/boot/compressed/efi_thunk_64.S +++ b/arch/x86/boot/compressed/efi_thunk_64.S @@ -23,7 +23,7 @@ .code64 .text -SYM_FUNC_START(efi64_thunk) +SYM_FUNC_START(__efi64_thunk) push %rbp push %rbx @@ -95,7 +95,7 @@ SYM_FUNC_START(efi64_thunk) pop %rbx pop %rbp ret -SYM_FUNC_END(efi64_thunk) +SYM_FUNC_END(__efi64_thunk) .code32 /* diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h index e7e9c6e057f9..cfc450085584 100644 --- a/arch/x86/include/asm/efi.h +++ b/arch/x86/include/asm/efi.h @@ -8,6 +8,7 @@ #include #include #include +#include /* * We map the EFI regions needed for runtime services non-contiguously, @@ -34,6 +35,45 @@ #define ARCH_EFI_IRQ_FLAGS_MASK X86_EFLAGS_IF +/* + * The EFI services are called through variadic functions in many cases. These + * functions are implemented in assembler and support only a fixed number of + * arguments. The macros below allows us to check at build time that we don't + * try to call them with too many arguments. + * + * __efi_nargs() will return the number of arguments if it is 7 or less, and + * cause a BUILD_BUG otherwise. The limitations of the C preprocessor make it + * impossible to calculate the exact number of arguments beyond some + * pre-defined limit. The maximum number of arguments currently supported by + * any of the thunks is 7, so this is good enough for now and can be extended + * in the obvious way if we ever need more. + */ + +#define __efi_nargs(...) __efi_nargs_(__VA_ARGS__) +#define __efi_nargs_(...) __efi_nargs__(0, ##__VA_ARGS__, \ + __efi_arg_sentinel(7), __efi_arg_sentinel(6), \ + __efi_arg_sentinel(5), __efi_arg_sentinel(4), \ + __efi_arg_sentinel(3), __efi_arg_sentinel(2), \ + __efi_arg_sentinel(1), __efi_arg_sentinel(0)) +#define __efi_nargs__(_0, _1, _2, _3, _4, _5, _6, _7, n, ...) \ + __take_second_arg(n, \ + ({ BUILD_BUG_ON_MSG(1, "__efi_nargs limit exceeded"); 8; })) +#define __efi_arg_sentinel(n) , n + +/* + * __efi_nargs_check(f, n, ...) will cause a BUILD_BUG if the ellipsis + * represents more than n arguments. + */ + +#define __efi_nargs_check(f, n, ...) \ + __efi_nargs_check_(f, __efi_nargs(__VA_ARGS__), n) +#define __efi_nargs_check_(f, p, n) __efi_nargs_check__(f, p, n) +#define __efi_nargs_check__(f, p, n) ({ \ + BUILD_BUG_ON_MSG( \ + (p) > (n), \ + #f " called with too many arguments (" #p ">" #n ")"); \ +}) + #ifdef CONFIG_X86_32 #define arch_efi_call_virt_setup() \ ({ \ @@ -56,7 +96,12 @@ #define EFI_LOADER_SIGNATURE "EL64" -extern asmlinkage u64 efi_call(void *fp, ...); +extern asmlinkage u64 __efi_call(void *fp, ...); + +#define efi_call(...) ({ \ + __efi_nargs_check(efi_call, 7, __VA_ARGS__); \ + __efi_call(__VA_ARGS__); \ +}) /* * struct efi_scratch - Scratch space used while switching to/from efi_mm @@ -139,7 +184,12 @@ struct efi_setup_data { extern u64 efi_setup; #ifdef CONFIG_EFI -extern efi_status_t efi64_thunk(u32, ...); +extern efi_status_t __efi64_thunk(u32, ...); + +#define efi64_thunk(...) ({ \ + __efi_nargs_check(efi64_thunk, 6, __VA_ARGS__); \ + __efi64_thunk(__VA_ARGS__); \ +}) static inline bool efi_is_mixed(void) { diff --git a/arch/x86/platform/efi/efi_stub_64.S b/arch/x86/platform/efi/efi_stub_64.S index e7e1020f4ccb..15da118f04f0 100644 --- a/arch/x86/platform/efi/efi_stub_64.S +++ b/arch/x86/platform/efi/efi_stub_64.S @@ -10,7 +10,7 @@ #include #include -SYM_FUNC_START(efi_call) +SYM_FUNC_START(__efi_call) pushq %rbp movq %rsp, %rbp and $~0xf, %rsp @@ -24,4 +24,4 @@ SYM_FUNC_START(efi_call) CALL_NOSPEC %rdi leave ret -SYM_FUNC_END(efi_call) +SYM_FUNC_END(__efi_call) diff --git a/arch/x86/platform/efi/efi_thunk_64.S b/arch/x86/platform/efi/efi_thunk_64.S index 162b35729633..26f0da238c1c 100644 --- a/arch/x86/platform/efi/efi_thunk_64.S +++ b/arch/x86/platform/efi/efi_thunk_64.S @@ -25,7 +25,7 @@ .text .code64 -SYM_CODE_START(efi64_thunk) +SYM_CODE_START(__efi64_thunk) push %rbp push %rbx @@ -69,4 +69,4 @@ SYM_CODE_START(efi64_thunk) 2: pushl $__KERNEL_CS pushl %ebp lret -SYM_CODE_END(efi64_thunk) +SYM_CODE_END(__efi64_thunk) From patchwork Fri Jan 3 11:39:50 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 206661 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D896CC32767 for ; Fri, 3 Jan 2020 11:41:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A778A21D7D for ; Fri, 3 Jan 2020 11:41:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051666; bh=+/7bsBsUL6q1f4aR9CC5qcxzfCwiWqGHzi8/OncfOBA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=blQMoQmCv2POOpTUxheGnWBP44h1CnYE6NSLhAbupS1lbq9RnjVtGvRnfLxlY9/is K5vpfU7gjvftCCWN2fK3W/xyUoalEL/F1TQD7zr2O5bws8fkK4JfRENOhV8Nafhp41 CbyjNlKtWAoyo4hatmLTqgZW2hzirdbSlCQqXnJs= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727891AbgACLky (ORCPT ); Fri, 3 Jan 2020 06:40:54 -0500 Received: from mail.kernel.org ([198.145.29.99]:40728 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727890AbgACLkw (ORCPT ); Fri, 3 Jan 2020 06:40:52 -0500 Received: from localhost.localdomain (amontpellier-657-1-18-247.w109-210.abo.wanadoo.fr [109.210.65.247]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 69AC924676; Fri, 3 Jan 2020 11:40:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051651; bh=+/7bsBsUL6q1f4aR9CC5qcxzfCwiWqGHzi8/OncfOBA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=D1C/DCX0VmlQjLs5B7CjGO8wR7siZyOKkOj5ZqEo61sRKAvAzFTlpmoFy5tbGBuyd 9xEKIUOrivQs4jA/hL/dNaXEURrNBxF6dhkSNKpGQwG3lyDL6KUE7wFzsmoxcnvfCB RBZXYvHIfzO1cuEZc3iqfy3Jhx/RMX/lKNtxnZ5c= From: Ard Biesheuvel To: linux-efi@vger.kernel.org, Ingo Molnar , Thomas Gleixner Cc: Ard Biesheuvel , Ard Biesheuvel , linux-kernel@vger.kernel.org, Andy Lutomirski , Arvind Sankar , Matthew Garrett , Matthew Garrett Subject: [PATCH 17/20] efi: Allow disabling PCI busmastering on bridges during boot Date: Fri, 3 Jan 2020 12:39:50 +0100 Message-Id: <20200103113953.9571-18-ardb@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200103113953.9571-1-ardb@kernel.org> References: <20200103113953.9571-1-ardb@kernel.org> MIME-Version: 1.0 Sender: linux-efi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org From: Matthew Garrett Add an option to disable the busmaster bit in the control register on all PCI bridges before calling ExitBootServices() and passing control to the runtime kernel. System firmware may configure the IOMMU to prevent malicious PCI devices from being able to attack the OS via DMA. However, since firmware can't guarantee that the OS is IOMMU-aware, it will tear down IOMMU configuration when ExitBootServices() is called. This leaves a window between where a hostile device could still cause damage before Linux configures the IOMMU again. If CONFIG_EFI_DISABLE_PCI_DMA is enabled or "efi=disable_early_pci_dma" is passed on the command line, the EFI stub will clear the busmaster bit on all PCI bridges before ExitBootServices() is called. This will prevent any malicious PCI devices from being able to perform DMA until the kernel reenables busmastering after configuring the IOMMU. This option may cause failures with some poorly behaved hardware and should not be enabled without testing. The kernel commandline options "efi=disable_early_pci_dma" or "efi=no_disable_early_pci_dma" may be used to override the default. Note that PCI devices downstream from PCI bridges are disconnected from their drivers first, using the UEFI driver model API, so that DMA can be disabled safely at the bridge level. Cc: Andy Lutomirski Cc: Arvind Sankar Co-developed-by: Matthew Garrett Signed-off-by: Matthew Garrett [ardb: disconnect PCI I/O handles first, as suggested by Arvind] Signed-off-by: Ard Biesheuvel --- .../admin-guide/kernel-parameters.txt | 7 +- arch/x86/include/asm/efi.h | 5 + drivers/firmware/efi/Kconfig | 22 ++++ drivers/firmware/efi/libstub/Makefile | 2 +- .../firmware/efi/libstub/efi-stub-helper.c | 15 +++ drivers/firmware/efi/libstub/pci.c | 114 ++++++++++++++++++ include/linux/efi.h | 6 +- 7 files changed, 168 insertions(+), 3 deletions(-) create mode 100644 drivers/firmware/efi/libstub/pci.c diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index ade4e6ec23e0..994632ae48de 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -1165,7 +1165,8 @@ efi= [EFI] Format: { "old_map", "nochunk", "noruntime", "debug", - "nosoftreserve" } + "nosoftreserve", "disable_early_pci_dma", + "no_disable_early_pci_dma" } old_map [X86-64]: switch to the old ioremap-based EFI runtime services mapping. 32-bit still uses this one by default. @@ -1180,6 +1181,10 @@ claim. Specify efi=nosoftreserve to disable this reservation and treat the memory by its base type (i.e. EFI_CONVENTIONAL_MEMORY / "System RAM"). + disable_early_pci_dma: Disable the busmaster bit on all + PCI bridges while in the EFI boot stub + no_disable_early_pci_dma: Leave the busmaster bit set + on all PCI bridges while in the EFI boot stub efi_no_storage_paranoia [EFI; X86] Using this parameter you can use more than 50% of diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h index 166f0386719e..383f7a0fc170 100644 --- a/arch/x86/include/asm/efi.h +++ b/arch/x86/include/asm/efi.h @@ -283,6 +283,11 @@ static inline void *efi64_zero_upper(void *p) #define __efi64_argmap_locate_protocol(protocol, reg, interface) \ ((protocol), (reg), efi64_zero_upper(interface)) +/* PCI I/O */ +#define __efi64_argmap_get_location(protocol, seg, bus, dev, func) \ + ((protocol), efi64_zero_upper(seg), efi64_zero_upper(bus), \ + efi64_zero_upper(dev), efi64_zero_upper(func)) + /* * The macros below handle the plumbing for the argument mapping. To add a * mapping for a specific EFI method, simply define a macro diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig index bcc378c19ebe..ecc83e2f032c 100644 --- a/drivers/firmware/efi/Kconfig +++ b/drivers/firmware/efi/Kconfig @@ -215,6 +215,28 @@ config EFI_RCI2_TABLE Say Y here for Dell EMC PowerEdge systems. +config EFI_DISABLE_PCI_DMA + bool "Clear Busmaster bit on PCI bridges during ExitBootServices()" + help + Disable the busmaster bit in the control register on all PCI bridges + while calling ExitBootServices() and passing control to the runtime + kernel. System firmware may configure the IOMMU to prevent malicious + PCI devices from being able to attack the OS via DMA. However, since + firmware can't guarantee that the OS is IOMMU-aware, it will tear + down IOMMU configuration when ExitBootServices() is called. This + leaves a window between where a hostile device could still cause + damage before Linux configures the IOMMU again. + + If you say Y here, the EFI stub will clear the busmaster bit on all + PCI bridges before ExitBootServices() is called. This will prevent + any malicious PCI devices from being able to perform DMA until the + kernel reenables busmastering after configuring the IOMMU. + + This option will cause failures with some poorly behaved hardware + and should not be enabled without testing. The kernel commandline + options "efi=disable_early_pci_dma" or "efi=no_disable_early_pci_dma" + may be used to override this option. + endmenu config UEFI_CPER diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile index c35f893897e1..98a81576213d 100644 --- a/drivers/firmware/efi/libstub/Makefile +++ b/drivers/firmware/efi/libstub/Makefile @@ -39,7 +39,7 @@ OBJECT_FILES_NON_STANDARD := y KCOV_INSTRUMENT := n lib-y := efi-stub-helper.o gop.o secureboot.o tpm.o \ - random.o + random.o pci.o # include the stub's generic dependencies from lib/ when building for ARM/arm64 arm-deps-y := fdt_rw.c fdt_ro.c fdt_wip.c fdt.c fdt_empty_tree.c fdt_sw.c diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c index fcc45ee94e02..74ddfb496140 100644 --- a/drivers/firmware/efi/libstub/efi-stub-helper.c +++ b/drivers/firmware/efi/libstub/efi-stub-helper.c @@ -33,6 +33,8 @@ static bool __efistub_global efi_nokaslr; static bool __efistub_global efi_quiet; static bool __efistub_global efi_novamap; static bool __efistub_global efi_nosoftreserve; +static bool __efistub_global efi_disable_pci_dma = + IS_ENABLED(CONFIG_EFI_DISABLE_PCI_DMA); bool __pure nokaslr(void) { @@ -490,6 +492,16 @@ efi_status_t efi_parse_options(char const *cmdline) efi_nosoftreserve = true; } + if (!strncmp(str, "disable_early_pci_dma", 21)) { + str += strlen("disable_early_pci_dma"); + efi_disable_pci_dma = true; + } + + if (!strncmp(str, "no_disable_early_pci_dma", 24)) { + str += strlen("no_disable_early_pci_dma"); + efi_disable_pci_dma = false; + } + /* Group words together, delimited by "," */ while (*str && *str != ' ' && *str != ',') str++; @@ -876,6 +888,9 @@ efi_status_t efi_exit_boot_services(void *handle, if (status != EFI_SUCCESS) goto free_map; + if (efi_disable_pci_dma) + efi_pci_disable_bridge_busmaster(); + status = efi_bs_call(exit_boot_services, handle, *map->key_ptr); if (status == EFI_INVALID_PARAMETER) { diff --git a/drivers/firmware/efi/libstub/pci.c b/drivers/firmware/efi/libstub/pci.c new file mode 100644 index 000000000000..b025e59b94df --- /dev/null +++ b/drivers/firmware/efi/libstub/pci.c @@ -0,0 +1,114 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * PCI-related functions used by the EFI stub on multiple + * architectures. + * + * Copyright 2019 Google, LLC + */ + +#include +#include + +#include + +#include "efistub.h" + +void efi_pci_disable_bridge_busmaster(void) +{ + efi_guid_t pci_proto = EFI_PCI_IO_PROTOCOL_GUID; + unsigned long pci_handle_size = 0; + efi_handle_t *pci_handle = NULL; + efi_handle_t handle; + efi_status_t status; + u16 class, command; + int i; + + status = efi_bs_call(locate_handle, EFI_LOCATE_BY_PROTOCOL, &pci_proto, + NULL, &pci_handle_size, NULL); + + if (status != EFI_BUFFER_TOO_SMALL) { + if (status != EFI_SUCCESS && status != EFI_NOT_FOUND) + pr_efi_err("Failed to locate PCI I/O handles'\n"); + return; + } + + status = efi_bs_call(allocate_pool, EFI_LOADER_DATA, pci_handle_size, + (void **)&pci_handle); + if (status != EFI_SUCCESS) { + pr_efi_err("Failed to allocate memory for 'pci_handle'\n"); + return; + } + + status = efi_bs_call(locate_handle, EFI_LOCATE_BY_PROTOCOL, &pci_proto, + NULL, &pci_handle_size, pci_handle); + if (status != EFI_SUCCESS) { + pr_efi_err("Failed to locate PCI I/O handles'\n"); + goto free_handle; + } + + for_each_efi_handle(handle, pci_handle, pci_handle_size, i) { + efi_pci_io_protocol_t *pci; + unsigned long segment_nr, bus_nr, device_nr, func_nr; + + status = efi_bs_call(handle_protocol, handle, &pci_proto, + (void **)&pci); + if (status != EFI_SUCCESS) + continue; + + /* + * Disregard devices living on bus 0 - these are not behind a + * bridge so no point in disconnecting them from their drivers. + */ + status = efi_call_proto(pci, get_location, &segment_nr, &bus_nr, + &device_nr, &func_nr); + if (status != EFI_SUCCESS || bus_nr == 0) + continue; + + /* + * Don't disconnect VGA controllers so we don't risk losing + * access to the framebuffer. Drivers for true PCIe graphics + * controllers that are behind a PCIe root port do not use + * DMA to implement the GOP framebuffer anyway [although they + * may use it in their implentation of Gop->Blt()], and so + * disabling DMA in the PCI bridge should not interfere with + * normal operation of the device. + */ + status = efi_call_proto(pci, pci.read, EfiPciIoWidthUint16, + PCI_CLASS_DEVICE, 1, &class); + if (status != EFI_SUCCESS || class == PCI_CLASS_DISPLAY_VGA) + continue; + + /* Disconnect this handle from all its drivers */ + efi_bs_call(disconnect_controller, handle, NULL, NULL); + } + + for_each_efi_handle(handle, pci_handle, pci_handle_size, i) { + efi_pci_io_protocol_t *pci; + + status = efi_bs_call(handle_protocol, handle, &pci_proto, + (void **)&pci); + if (status != EFI_SUCCESS || !pci) + continue; + + status = efi_call_proto(pci, pci.read, EfiPciIoWidthUint16, + PCI_CLASS_DEVICE, 1, &class); + + if (status != EFI_SUCCESS || class != PCI_CLASS_BRIDGE_PCI) + continue; + + /* Disable busmastering */ + status = efi_call_proto(pci, pci.read, EfiPciIoWidthUint16, + PCI_COMMAND, 1, &command); + if (status != EFI_SUCCESS || !(command & PCI_COMMAND_MASTER)) + continue; + + command &= ~PCI_COMMAND_MASTER; + status = efi_call_proto(pci, pci.write, EfiPciIoWidthUint16, + PCI_COMMAND, 1, &command); + if (status != EFI_SUCCESS) + pr_efi_err("Failed to disable PCI busmastering\n"); + } + +free_handle: + efi_bs_call(free_pool, pci_handle); +} diff --git a/include/linux/efi.h b/include/linux/efi.h index ee68ea6f85ff..7e8e25b1d11c 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h @@ -319,7 +319,9 @@ typedef union { void *stall; void *set_watchdog_timer; void *connect_controller; - void *disconnect_controller; + efi_status_t (__efiapi *disconnect_controller)(efi_handle_t, + efi_handle_t, + efi_handle_t); void *open_protocol; void *close_protocol; void *open_protocol_information; @@ -1692,4 +1694,6 @@ struct linux_efi_memreserve { #define EFI_MEMRESERVE_COUNT(size) (((size) - sizeof(struct linux_efi_memreserve)) \ / sizeof(((struct linux_efi_memreserve *)0)->entry[0])) +void efi_pci_disable_bridge_busmaster(void); + #endif /* _LINUX_EFI_H */ From patchwork Fri Jan 3 11:39:52 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 206662 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A822CC3F68F for ; Fri, 3 Jan 2020 11:41:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 730EA2464B for ; Fri, 3 Jan 2020 11:41:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051666; bh=f7ymohb97S6b58KJNRXy0ZTCMS6AMDRFCM6vKzcZbSc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=eCBlSajAplGsqyOqyEymShERGHGQUPWEUqXjL/N5azltyxusE4agNt2bAP1192O+q oK6cSpb0oRMzhGOepVGANuZAfL9QLyPeKWH0W0ZczVmT3bbZ1fyx+KXTSN7SuZZg0O xzMjzG2fBAG21fuifvnpo3fyMFrJVoX0hKsHImRE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727907AbgACLk5 (ORCPT ); Fri, 3 Jan 2020 06:40:57 -0500 Received: from mail.kernel.org ([198.145.29.99]:40902 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727890AbgACLk4 (ORCPT ); Fri, 3 Jan 2020 06:40:56 -0500 Received: from localhost.localdomain (amontpellier-657-1-18-247.w109-210.abo.wanadoo.fr [109.210.65.247]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id AF79824653; Fri, 3 Jan 2020 11:40:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578051655; bh=f7ymohb97S6b58KJNRXy0ZTCMS6AMDRFCM6vKzcZbSc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Bn/D8MffaovgfJrEgBR2/9qNzhjo27d/6t/OQ9z/zdLOm7PGiphRgUkP6ofpL0ZVd ZyL8zKpKiJnh0xix0u+tOhxRAtnrlPAPFiU4tyDIfEMacQZnJGcSIXyzMFMMCHU+dD 7TA9cBVdwd0ZyGgfaWcC8Zov07IJBQS2fq9Xf38A= From: Ard Biesheuvel To: linux-efi@vger.kernel.org, Ingo Molnar , Thomas Gleixner Cc: Ard Biesheuvel , Ard Biesheuvel , linux-kernel@vger.kernel.org, Andy Lutomirski , Arvind Sankar , Matthew Garrett Subject: [PATCH 19/20] efi/x86: don't map the entire kernel text RW for mixed mode Date: Fri, 3 Jan 2020 12:39:52 +0100 Message-Id: <20200103113953.9571-20-ardb@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200103113953.9571-1-ardb@kernel.org> References: <20200103113953.9571-1-ardb@kernel.org> MIME-Version: 1.0 Sender: linux-efi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org The mixed mode thunking routine requires a part of it to be mapped 1:1, and for this reason, we currently map the entire kernel .text read/write in the EFI page tables, which is bad. In fact, the kernel_map_pages_in_pgd() invocation that installs this mapping is entirely redundant, since all of DRAM is already 1:1 mapped read/write in the EFI page tables when we reach this point, which means that .rodata is mapped read-write as well. So let's remap both .text and .rodata read-only in the EFI page tables. Signed-off-by: Ard Biesheuvel --- arch/x86/platform/efi/efi_64.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c index c13fa2150976..6ec58ff60b56 100644 --- a/arch/x86/platform/efi/efi_64.c +++ b/arch/x86/platform/efi/efi_64.c @@ -391,11 +391,11 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) efi_scratch.phys_stack = page_to_phys(page + 1); /* stack grows down */ - npages = (_etext - _text) >> PAGE_SHIFT; + npages = (__end_rodata_aligned - _text) >> PAGE_SHIFT; text = __pa(_text); pfn = text >> PAGE_SHIFT; - pf = _PAGE_RW | _PAGE_ENC; + pf = _PAGE_ENC; if (kernel_map_pages_in_pgd(pgd, pfn, text, npages, pf)) { pr_err("Failed to map kernel text 1:1\n"); return 1;