Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752854AbcD1KgF (ORCPT ); Thu, 28 Apr 2016 06:36:05 -0400 Received: from terminus.zytor.com ([198.137.202.10]:47592 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752310AbcD1KgB (ORCPT ); Thu, 28 Apr 2016 06:36:01 -0400 Date: Thu, 28 Apr 2016 03:33:55 -0700 From: tip-bot for Ard Biesheuvel Message-ID: Cc: sai.praneeth.prakhya@intel.com, linux-kernel@vger.kernel.org, ard.biesheuvel@linaro.org, will.deacon@arm.com, bp@alien8.de, leif.lindholm@linaro.org, rmk+kernel@arm.linux.org.uk, matt@codeblueprint.co.uk, pjones@redhat.com, catalin.marinas@arm.com, hpa@zytor.com, mark.rutland@arm.com, mingo@kernel.org, peterz@infradead.org, tglx@linutronix.de Reply-To: mingo@kernel.org, mark.rutland@arm.com, peterz@infradead.org, tglx@linutronix.de, rmk+kernel@arm.linux.org.uk, leif.lindholm@linaro.org, catalin.marinas@arm.com, hpa@zytor.com, matt@codeblueprint.co.uk, pjones@redhat.com, bp@alien8.de, will.deacon@arm.com, linux-kernel@vger.kernel.org, sai.praneeth.prakhya@intel.com, ard.biesheuvel@linaro.org In-Reply-To: <1461614832-17633-11-git-send-email-matt@codeblueprint.co.uk> References: <1461614832-17633-11-git-send-email-matt@codeblueprint.co.uk> To: linux-tip-commits@vger.kernel.org Subject: [tip:efi/core] ARM/efi: Apply strict permissions for UEFI Runtime Services regions Git-Commit-ID: 9fc68b717c24a215a32c1b4e05b30433cafb2599 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3679 Lines: 105 Commit-ID: 9fc68b717c24a215a32c1b4e05b30433cafb2599 Gitweb: http://git.kernel.org/tip/9fc68b717c24a215a32c1b4e05b30433cafb2599 Author: Ard Biesheuvel AuthorDate: Mon, 25 Apr 2016 21:06:42 +0100 Committer: Ingo Molnar CommitDate: Thu, 28 Apr 2016 11:33:53 +0200 ARM/efi: Apply strict permissions for UEFI Runtime Services regions Recent UEFI versions expose permission attributes for runtime services memory regions, either in the UEFI memory map or in the separate memory attributes table. This allows the kernel to map these regions with stricter permissions, rather than the RWX permissions that are used by default. So wire this up in our mapping routine. Signed-off-by: Ard Biesheuvel Signed-off-by: Matt Fleming Cc: Borislav Petkov Cc: Catalin Marinas Cc: Leif Lindholm Cc: Mark Rutland Cc: Peter Jones Cc: Peter Zijlstra Cc: Russell King Cc: Sai Praneeth Prakhya Cc: Thomas Gleixner Cc: Will Deacon Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/1461614832-17633-11-git-send-email-matt@codeblueprint.co.uk Signed-off-by: Ingo Molnar --- arch/arm/include/asm/efi.h | 1 + arch/arm/kernel/efi.c | 41 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+) diff --git a/arch/arm/include/asm/efi.h b/arch/arm/include/asm/efi.h index e0eea72..b0c341d 100644 --- a/arch/arm/include/asm/efi.h +++ b/arch/arm/include/asm/efi.h @@ -22,6 +22,7 @@ void efi_init(void); int efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md); +int efi_set_mapping_permissions(struct mm_struct *mm, efi_memory_desc_t *md); #define efi_call_virt(f, ...) \ ({ \ diff --git a/arch/arm/kernel/efi.c b/arch/arm/kernel/efi.c index ff8a9d8..9f43ba0 100644 --- a/arch/arm/kernel/efi.c +++ b/arch/arm/kernel/efi.c @@ -11,6 +11,41 @@ #include #include +static int __init set_permissions(pte_t *ptep, pgtable_t token, + unsigned long addr, void *data) +{ + efi_memory_desc_t *md = data; + pte_t pte = *ptep; + + if (md->attribute & EFI_MEMORY_RO) + pte = set_pte_bit(pte, __pgprot(L_PTE_RDONLY)); + if (md->attribute & EFI_MEMORY_XP) + pte = set_pte_bit(pte, __pgprot(L_PTE_XN)); + set_pte_ext(ptep, pte, PTE_EXT_NG); + return 0; +} + +int __init efi_set_mapping_permissions(struct mm_struct *mm, + efi_memory_desc_t *md) +{ + unsigned long base, size; + + base = md->virt_addr; + size = md->num_pages << EFI_PAGE_SHIFT; + + /* + * We can only use apply_to_page_range() if we can guarantee that the + * entire region was mapped using pages. This should be the case if the + * region does not cover any naturally aligned SECTION_SIZE sized + * blocks. + */ + if (round_down(base + size, SECTION_SIZE) < + round_up(base, SECTION_SIZE) + SECTION_SIZE) + return apply_to_page_range(mm, base, size, set_permissions, md); + + return 0; +} + int __init efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md) { struct map_desc desc = { @@ -34,5 +69,11 @@ int __init efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md) desc.type = MT_DEVICE; create_mapping_late(mm, &desc, true); + + /* + * If stricter permissions were specified, apply them now. + */ + if (md->attribute & (EFI_MEMORY_RO | EFI_MEMORY_XP)) + return efi_set_mapping_permissions(mm, md); return 0; }