Commit 9fc68b71 authored by Ard Biesheuvel's avatar Ard Biesheuvel Committed by Ingo Molnar

ARM/efi: Apply strict permissions for UEFI Runtime Services regions

Recent UEFI versions expose permission attributes for runtime services
memory regions, either in the UEFI memory map or in the separate memory
attributes table.  This allows the kernel to map these regions with
stricter permissions, rather than the RWX permissions that are used by
default. So wire this up in our mapping routine.
Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: default avatarMatt Fleming <matt@codeblueprint.co.uk>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Leif Lindholm <leif.lindholm@linaro.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Peter Jones <pjones@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Russell King <rmk+kernel@arm.linux.org.uk>
Cc: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will.deacon@arm.com>
Cc: linux-efi@vger.kernel.org
Link: http://lkml.kernel.org/r/1461614832-17633-11-git-send-email-matt@codeblueprint.co.ukSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
parent 24d45d1d
...@@ -22,6 +22,7 @@ ...@@ -22,6 +22,7 @@
void efi_init(void); void efi_init(void);
int efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md); int efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md);
int efi_set_mapping_permissions(struct mm_struct *mm, efi_memory_desc_t *md);
#define efi_call_virt(f, ...) \ #define efi_call_virt(f, ...) \
({ \ ({ \
......
...@@ -11,6 +11,41 @@ ...@@ -11,6 +11,41 @@
#include <asm/mach/map.h> #include <asm/mach/map.h>
#include <asm/mmu_context.h> #include <asm/mmu_context.h>
static int __init set_permissions(pte_t *ptep, pgtable_t token,
unsigned long addr, void *data)
{
efi_memory_desc_t *md = data;
pte_t pte = *ptep;
if (md->attribute & EFI_MEMORY_RO)
pte = set_pte_bit(pte, __pgprot(L_PTE_RDONLY));
if (md->attribute & EFI_MEMORY_XP)
pte = set_pte_bit(pte, __pgprot(L_PTE_XN));
set_pte_ext(ptep, pte, PTE_EXT_NG);
return 0;
}
int __init efi_set_mapping_permissions(struct mm_struct *mm,
efi_memory_desc_t *md)
{
unsigned long base, size;
base = md->virt_addr;
size = md->num_pages << EFI_PAGE_SHIFT;
/*
* We can only use apply_to_page_range() if we can guarantee that the
* entire region was mapped using pages. This should be the case if the
* region does not cover any naturally aligned SECTION_SIZE sized
* blocks.
*/
if (round_down(base + size, SECTION_SIZE) <
round_up(base, SECTION_SIZE) + SECTION_SIZE)
return apply_to_page_range(mm, base, size, set_permissions, md);
return 0;
}
int __init efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md) int __init efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md)
{ {
struct map_desc desc = { struct map_desc desc = {
...@@ -34,5 +69,11 @@ int __init efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md) ...@@ -34,5 +69,11 @@ int __init efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md)
desc.type = MT_DEVICE; desc.type = MT_DEVICE;
create_mapping_late(mm, &desc, true); create_mapping_late(mm, &desc, true);
/*
* If stricter permissions were specified, apply them now.
*/
if (md->attribute & (EFI_MEMORY_RO | EFI_MEMORY_XP))
return efi_set_mapping_permissions(mm, md);
return 0; return 0;
} }
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment