From patchwork Mon Jun 10 12:24:38 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 13691962 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id B6273C27C55 for ; Mon, 10 Jun 2024 12:25:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Cc:To:From:Subject:Message-ID: Mime-Version:Date:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=w4QpLwrj56HIQvmfzXKBmZAN32r3EZPVVfBswgccWTI=; b=srm SV8knLKm7GineE9P3RPn+ZL1zuYURD5uEwAmfWIPdsVeArXb6JYtCvVApww23ekuRmp0MpkYDahjC B6CBPk8W2WQyGtxxsKswUXGrtqJPSscXkp2rXnpdqOYzKD6rHImOTPPJKIF8ges6GQXrnfOBqtNM8 VSmgOFt/ZPl0QNUWsp8DC9YcDtEyL5UiqLpdPhPCxUN2oJ2EzoTiBufiBXi4TRJjvJk6OSTwIxYGf /Exj0s282IGPFyT1CKr4b8BzRZ0VHhaznNBblSqa70y7LSANfuXXZamBBS4pQO7aJqLnpdKp8jgqd OUAEcjhcTf1UI2gbhVhqVcDDFhZUU9w==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1sGe55-00000005011-1Jmu; Mon, 10 Jun 2024 12:24:59 +0000 Received: from mail-yb1-xb49.google.com ([2607:f8b0:4864:20::b49]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1sGe4z-00000004zyO-2NdV for linux-arm-kernel@lists.infradead.org; Mon, 10 Jun 2024 12:24:57 +0000 Received: by mail-yb1-xb49.google.com with SMTP id 3f1490d57ef6-df78fddad5dso8328573276.2 for ; Mon, 10 Jun 2024 05:24:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1718022286; x=1718627086; darn=lists.infradead.org; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=arVT1UJjpDifIxa4uEm/zmcaSk9BsvyP57DfTAzOe68=; b=dO4JjqXQ3+CEo+QMoZfmi6ZjwsVylPXGeIAOJ2WAbVlJvQ5xXK0yZ29E1A/s7T6q7c FuWlrnLnLF9cieKds2kF2BgjK0O73L1Mbcn8DRHWhN/whtQuBaQGlnswqxdlJPpJHy2X nBBtSKKzAY9fapY2xjLdx8jCbtJHRYlu+m/PmKu+DW5MIgRv3Ds4HIJsH/hDSXMJMlvO OVyL444KVyKs0yW9xkaSBSX4QB8iWLsCSoPmfesyfGK+NgEOPLeFgw9W7kRnB7/Lb7O9 9hZE/zW+brCdtyNefUTpcXihOBL1oAdl1XQwPvGbYsSJtfgexJ7AqseGUC59B1/0vuj5 lnag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1718022286; x=1718627086; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=arVT1UJjpDifIxa4uEm/zmcaSk9BsvyP57DfTAzOe68=; b=RIcj2NZ6PfVgLqlwRluFZoMZfD6C5qfklqpa4iTwbmnI9ooeYXKjUsypbSZ6wJqs3Z AGncsPVkHtDs7AJ9cCunH7NsQ6GT7+eE+tNwVVhBZAJYP9RJpAiYV0vZZpafouZzIhgo ajL9+iq5M06Is9PEm8FtqsZ2oLi2jOah09YtqB4ZDq841DYnFPJhGhWqZYu1eP6ATpjC sKTAyXltaJejfifvYmr+KKKYa9etkXqIzIzezWsljb+o7y3ig8Gup37bAclZtN2v2bRm +Zq/Ajshlb3ie8Fkw3SZ4NTwQz4WnAv/oZnhGS4JcbiAR6PoD9XLjj7cEoZkAXUubHF+ ULyA== X-Gm-Message-State: AOJu0YzPb7HSQpIrcSh10N8EkY7C0YthAvKukDowgFaEfYWRWBi4Yk0n TuAugjD9hSM/OJt1yC0PcpalX+ek41Zu4IrxEtX7+eJqa0kwIy1J5iuFddCOw2hX7xA0yg== X-Google-Smtp-Source: AGHT+IFy4fbRMOr/D5J8Mb5DIZLL8qf8J1a9nL1lZPR65XOkeoC1GSF3L7mKwVVdHZBxRxLrQKLcHzk8 X-Received: from palermo.c.googlers.com ([fda3:e722:ac3:cc00:28:9cb1:c0a8:118a]) (user=ardb job=sendgmr) by 2002:a05:6902:2b8b:b0:dfa:849d:3a59 with SMTP id 3f1490d57ef6-dfaf667471bmr3293606276.13.1718022285824; Mon, 10 Jun 2024 05:24:45 -0700 (PDT) Date: Mon, 10 Jun 2024 14:24:38 +0200 Mime-Version: 1.0 X-Developer-Key: i=ardb@kernel.org; a=openpgp; fpr=F43D03328115A198C90016883D200E9CA6329909 X-Developer-Signature: v=1; a=openpgp-sha256; l=2514; i=ardb@kernel.org; h=from:subject; bh=vAdAgJhZ88ZG4Hss513g3YwUrqqEyDQZv4qPQ2fT/YE=; b=owGbwMvMwCFmkMcZplerG8N4Wi2JIS3tQzv314Nsr2KfVHF22yjY7PFVCbTY8X/dO2ax1vyLR wr3iip1lLIwiHEwyIopsgjM/vtu5+mJUrXOs2Rh5rAygQxh4OIUgIlwlzL8L49aFu9/c9ehzi2u CX7qp84E7IyYs+/uU41nMjHzn0XbZzAyvDpcPzuiKWrjxejV1juF9rHLBB0wzhWd6VfGJuxk5hP KAgA= X-Mailer: git-send-email 2.45.2.505.gda0bf45e8d-goog Message-ID: <20240610122437.2358778-2-ardb+git@google.com> Subject: [PATCH] efi/arm: Disable LPAE PAN when calling EFI runtime services From: Ard Biesheuvel To: linux-efi@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org, linux-hardening@vger.kernel.org, linux@armlinux.org.uk, Ard Biesheuvel , Kees Cook , Linus Walleij X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240610_052453_750218_C81D6244 X-CRM114-Status: GOOD ( 15.32 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org From: Ard Biesheuvel EFI runtime services are remapped into the lower 1 GiB of virtual address space at boot, so they are guaranteed to be able to co-exist with the kernel virtual mappings without the need to allocate space for them in the kernel's vmalloc region, which is rather small. This means those mappings are covered by TTBR0 when LPAE PAN is enabled, and so 'user' access must be enabled while such calls are in progress. To avoid the need to refactor the code that is shared between ARM, arm64 and other EFI architectures, fold this into efi_set_pgd(). Given that EFI runtime services are serialized and not pre-emptible, storing the flags into a global variable is reasonable here - efi_set_pgd() calls will always occur in pairs on a single CPU. Cc: Kees Cook Cc: Linus Walleij Signed-off-by: Ard Biesheuvel Reviewed-by: Linus Walleij --- arch/arm/include/asm/efi.h | 15 +++++++++++++++ arch/arm/kernel/efi.c | 4 ++++ 2 files changed, 19 insertions(+) diff --git a/arch/arm/include/asm/efi.h b/arch/arm/include/asm/efi.h index 78282ced5038..773fb072c040 100644 --- a/arch/arm/include/asm/efi.h +++ b/arch/arm/include/asm/efi.h @@ -14,6 +14,7 @@ #include #include #include +#include #ifdef CONFIG_EFI void efi_init(void); @@ -32,6 +33,20 @@ int efi_set_mapping_permissions(struct mm_struct *mm, efi_memory_desc_t *md, boo static inline void efi_set_pgd(struct mm_struct *mm) { check_and_switch_context(mm, NULL); + + if (IS_ENABLED(CONFIG_ARM_TTBR0_PAN)) { + extern unsigned int efi_arm_ttbr0_pan_flags; + + /* + * EFI runtime services are mapped in the lower TTBR0 region, + * so TTBR0 based PAN should be disabled while making a EFI + * runtime service call. + */ + if (mm != current->active_mm) + efi_arm_ttbr0_pan_flags = uaccess_save_and_enable(); + else + uaccess_restore(efi_arm_ttbr0_pan_flags); + } } void efi_virtmap_load(void); diff --git a/arch/arm/kernel/efi.c b/arch/arm/kernel/efi.c index 6f9ec7d28a71..6864338073e6 100644 --- a/arch/arm/kernel/efi.c +++ b/arch/arm/kernel/efi.c @@ -11,6 +11,10 @@ #include #include +#ifdef CONFIG_ARM_TTBR0_PAN +unsigned int efi_arm_ttbr0_pan_flags; +#endif + static int __init set_permissions(pte_t *ptep, unsigned long addr, void *data) { efi_memory_desc_t *md = data;