[EFI,PCI] Allow disabling PCI busmastering on bridges during boot

Message ID	20191203004043.174977-1-matthewgarrett@google.com (mailing list archive)
State	Not Applicable, archived
Headers	show Return-Path: <SRS0=tXem=ZZ=vger.kernel.org=linux-pci-owner@kernel.org> Date: Mon, 2 Dec 2019 16:40:43 -0800 Message-Id: <20191203004043.174977-1-matthewgarrett@google.com> Mime-Version: 1.0 Subject: [PATCH] [EFI,PCI] Allow disabling PCI busmastering on bridges during boot From: Matthew Garrett <matthewgarrett@google.com> To: linux-efi@vger.kernel.org Cc: ard.biesheuvel@linaro.org, x86@kernel.org, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Matthew Garrett <matthewgarrett@google.com>, Matthew Garrett <mjg59@google.com> Content-Type: text/plain; charset="UTF-8" Sender: linux-pci-owner@vger.kernel.org Precedence: bulk
Series	[EFI,PCI] Allow disabling PCI busmastering on bridges during boot \| expand [EFI,PCI] Allow disabling PCI busmastering on bridges during boot

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 8dee8f68fe15..2d538f27f861 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -881,6 +881,11 @@ The feature only exists starting from Arch Perfmon v4 (Skylake and newer). + disable_busmaster= [X86, EFI] + Format: <int> + Disable the busmaster bit on all PCI bridges in the + EFI boot stub if 1, leave in the default state if 0. + disable_ddw [PPC/PSERIES] Disable Dynamic DMA Window support. Use this if to workaround buggy firmware. diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c index 82bc60c8acb2..2f5226b32a6e 100644 --- a/arch/x86/boot/compressed/eboot.c +++ b/arch/x86/boot/compressed/eboot.c @@ -137,6 +137,8 @@ static void setup_efi_pci(struct boot_params *params) struct setup_data *data; int i; + efi_pci_disable_bridge_busmaster(sys_table); + status = efi_call_early(locate_handle, EFI_LOCATE_BY_PROTOCOL, &pci_proto, NULL, &size, pci_handle); diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig index b248870a9806..b1651b40424e 100644 --- a/drivers/firmware/efi/Kconfig +++ b/drivers/firmware/efi/Kconfig @@ -194,6 +194,29 @@ config EFI_RCI2_TABLE Say Y here for Dell EMC PowerEdge systems. +config EFI_NO_BUSMASTER + bool "Clear Busmaster bit on PCI bridges before ExitBootServices()" + depends on X86 || COMPILE_TEST + help + Disable the busmaster bit in the control register on all PCI bridges + before calling ExitBootServices() and passing control to the runtime + kernel. System firmware may configure the IOMMU to prevent malicious + PCI devices from being able to attack the OS via DMA. However, since + firmware can't guarantee that the OS is IOMMU-aware, it will tear + down IOMMU configuration when ExitBootServices() is called. This + leaves a window between where a hostile device could still cause + damage before Linux configures the IOMMU again. + + If you say Y here, the EFI stub will clear the busmaster bit on all + PCI bridges before ExitBootServices() is called. This will prevent + any malicious PCI devices from being able to perform DMA until the + kernel reenables busmastering after configuring the IOMMU. + + This option will cause failures with some poorly behaved hardware + and should not be enabled without testing. The kernel commandline + option "disable_busmaster=0" or "disable_busmaster=1" may be used + to override this option. + endmenu config UEFI_CPER diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile index ee0661ddb25b..6536ee851334 100644 --- a/drivers/firmware/efi/libstub/Makefile +++ b/drivers/firmware/efi/libstub/Makefile @@ -38,7 +38,7 @@ OBJECT_FILES_NON_STANDARD := y # Prevents link failures: __sanitizer_cov_trace_pc() is not linked in. KCOV_INSTRUMENT := n -lib-y := efi-stub-helper.o gop.o secureboot.o tpm.o +lib-y := efi-stub-helper.o gop.o pci.o secureboot.o tpm.o # include the stub's generic dependencies from lib/ when building for ARM/arm64 arm-deps-y := fdt_rw.c fdt_ro.c fdt_wip.c fdt.c fdt_empty_tree.c fdt_sw.c diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c index 35dbc2791c97..69faeeba1cdb 100644 --- a/drivers/firmware/efi/libstub/efi-stub-helper.c +++ b/drivers/firmware/efi/libstub/efi-stub-helper.c @@ -32,6 +32,8 @@ static unsigned long __chunk_size = EFI_READ_CHUNK_SIZE; static int __section(.data) __nokaslr; static int __section(.data) __quiet; static int __section(.data) __novamap; +static int __section(.data) __disable_busmaster = + IS_ENABLED(CONFIG_EFI_NO_BUSMASTER); int __pure nokaslr(void) { @@ -46,6 +48,11 @@ int __pure novamap(void) return __novamap; } +int __pure nobusmaster(void) +{ + return __disable_busmaster; +} + #define EFI_MMAP_NR_SLACK_SLOTS 8 struct file_info { @@ -458,6 +465,18 @@ efi_status_t efi_parse_options(char const *cmdline) if (str == cmdline || (str && str > cmdline && *(str - 1) == ' ')) __quiet = 1; + str = strstr(cmdline, "disable_busmaster="); + if (str) { + switch (*(str + strlen("disable_busmaster="))) { + case '0': + __disable_busmaster = 0; + break; + case '1': + __disable_busmaster = 1; + break; + } + } + /* * If no EFI parameters were specified on the cmdline we've got * nothing to do. diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h index 7f1556fd867d..12f5f80f6851 100644 --- a/drivers/firmware/efi/libstub/efistub.h +++ b/drivers/firmware/efi/libstub/efistub.h @@ -28,6 +28,7 @@ extern int __pure nokaslr(void); extern int __pure is_quiet(void); extern int __pure novamap(void); +extern int __pure nobusmaster(void); #define pr_efi(sys_table, msg) do { \ if (!is_quiet()) efi_printk(sys_table, "EFI stub: "msg); \ diff --git a/drivers/firmware/efi/libstub/pci.c b/drivers/firmware/efi/libstub/pci.c new file mode 100644 index 000000000000..dc0db8a1e248 --- /dev/null +++ b/drivers/firmware/efi/libstub/pci.c @@ -0,0 +1,88 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * PCI-related functions used by the EFI stub on multiple + * architectures. + * + * Copyright 2019 Google, LLC + */ + +#include <linux/efi.h> +#include <linux/pci.h> + +#include <asm/efi.h> + +#include "efistub.h" + +void efi_pci_disable_bridge_busmaster(efi_system_table_t *sys_table) +{ + efi_status_t status; + void **pci_handle = NULL; + efi_guid_t pci_proto = EFI_PCI_IO_PROTOCOL_GUID; + unsigned long size = 0; + unsigned long nr_pci; + u16 class, command; + int i; + + if (!nobusmaster()) + return; + + status = efi_call_early(locate_handle, + EFI_LOCATE_BY_PROTOCOL, + &pci_proto, NULL, &size, pci_handle); + + if (status == EFI_BUFFER_TOO_SMALL) { + status = efi_call_early(allocate_pool, + EFI_LOADER_DATA, + size, (void **)&pci_handle); + + if (status != EFI_SUCCESS) { + efi_printk(sys_table, "Failed to allocate memory for 'pci_handle'\n"); + return; + } + + status = efi_call_early(locate_handle, + EFI_LOCATE_BY_PROTOCOL, &pci_proto, + NULL, &size, pci_handle); + } + + if (status != EFI_SUCCESS) + goto free_handle; + + nr_pci = size / (efi_is_64bit() ? sizeof(u64) : sizeof(u32)); + for (i = 0; i < nr_pci; i++) { + efi_pci_io_protocol_t *pci = NULL; + + status = efi_call_early(handle_protocol, + efi_is_64bit() ? ((u64 *)pci_handle)[i] + : ((u32 *)pci_handle)[i], + &pci_proto, (void **)&pci); + if (status != EFI_SUCCESS || !pci) + continue; + + status = efi_call_proto(efi_pci_io_protocol, pci.read, pci, + EfiPciIoWidthUint16, PCI_CLASS_DEVICE, + 1, &class); + + if (status != EFI_SUCCESS || class != PCI_CLASS_BRIDGE_PCI) + continue; + + /* Disable busmastering */ + status = efi_call_proto(efi_pci_io_protocol, pci.read, pci, + EfiPciIoWidthUint16, PCI_COMMAND, 1, + &command); + if (status != EFI_SUCCESS || + !(command & PCI_COMMAND_MASTER)) + continue; + + command &= ~PCI_COMMAND_MASTER; + status = efi_call_proto(efi_pci_io_protocol, pci.write, pci, + EfiPciIoWidthUint16, PCI_COMMAND, 1, + &command); + if (status != EFI_SUCCESS) + efi_printk(sys_table, + "Failed to disable PCI busmastering\n"); + } + +free_handle: + efi_call_early(free_pool, pci_handle); +} diff --git a/include/linux/efi.h b/include/linux/efi.h index d87acf62958e..b0de9b4a0ad1 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h @@ -1647,6 +1647,8 @@ efi_enable_reset_attack_mitigation(efi_system_table_t *sys_table_arg) { } void efi_retrieve_tpm2_eventlog(efi_system_table_t *sys_table); +void efi_pci_disable_bridge_busmaster(efi_system_table_t *sys_table); + /* * Arch code can implement the following three template macros, avoiding * reptition for the void/non-void return cases of {__,}efi_call_virt():

[EFI,PCI] Allow disabling PCI busmastering on bridges during boot

Commit Message

Comments

Patch