1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Copyright (C) 2016 Linaro Ltd. <ard.biesheuvel@linaro.org>
4 */
5
6 #define pr_fmt(fmt) "efi: memattr: " fmt
7
8 #include <linux/efi.h>
9 #include <linux/init.h>
10 #include <linux/io.h>
11 #include <linux/memblock.h>
12
13 #include <asm/early_ioremap.h>
14
15 static int __initdata tbl_size;
16 unsigned long __ro_after_init efi_mem_attr_table = EFI_INVALID_TABLE_ADDR;
17
18 /*
19 * Reserve the memory associated with the Memory Attributes configuration
20 * table, if it exists.
21 */
efi_memattr_init(void)22 void __init efi_memattr_init(void)
23 {
24 efi_memory_attributes_table_t *tbl;
25 unsigned long size;
26
27 if (efi_mem_attr_table == EFI_INVALID_TABLE_ADDR)
28 return;
29
30 tbl = early_memremap(efi_mem_attr_table, sizeof(*tbl));
31 if (!tbl) {
32 pr_err("Failed to map EFI Memory Attributes table @ 0x%lx\n",
33 efi_mem_attr_table);
34 return;
35 }
36
37 if (tbl->version > 2) {
38 pr_warn("Unexpected EFI Memory Attributes table version %d\n",
39 tbl->version);
40 goto unmap;
41 }
42
43
44 /*
45 * Sanity check: the Memory Attributes Table contains up to 3 entries
46 * for each entry of type EfiRuntimeServicesCode in the EFI memory map.
47 * So if the size of the table exceeds 3x the size of the entire EFI
48 * memory map, there is clearly something wrong, and the table should
49 * just be ignored altogether.
50 */
51 size = tbl->num_entries * tbl->desc_size;
52 if (size > 3 * efi.memmap.nr_map * efi.memmap.desc_size) {
53 pr_warn(FW_BUG "Corrupted EFI Memory Attributes Table detected! (version == %u, desc_size == %u, num_entries == %u)\n",
54 tbl->version, tbl->desc_size, tbl->num_entries);
55 goto unmap;
56 }
57
58 tbl_size = sizeof(*tbl) + size;
59 memblock_reserve(efi_mem_attr_table, tbl_size);
60 set_bit(EFI_MEM_ATTR, &efi.flags);
61
62 unmap:
63 early_memunmap(tbl, sizeof(*tbl));
64 }
65
66 /*
67 * Returns a copy @out of the UEFI memory descriptor @in if it is covered
68 * entirely by a UEFI memory map entry with matching attributes. The virtual
69 * address of @out is set according to the matching entry that was found.
70 */
entry_is_valid(const efi_memory_desc_t * in,efi_memory_desc_t * out)71 static bool entry_is_valid(const efi_memory_desc_t *in, efi_memory_desc_t *out)
72 {
73 u64 in_paddr = in->phys_addr;
74 u64 in_size = in->num_pages << EFI_PAGE_SHIFT;
75 efi_memory_desc_t *md;
76
77 *out = *in;
78
79 if (in->type != EFI_RUNTIME_SERVICES_CODE &&
80 in->type != EFI_RUNTIME_SERVICES_DATA) {
81 pr_warn("Entry type should be RuntimeServiceCode/Data\n");
82 return false;
83 }
84
85 if (PAGE_SIZE > EFI_PAGE_SIZE &&
86 (!PAGE_ALIGNED(in->phys_addr) ||
87 !PAGE_ALIGNED(in->num_pages << EFI_PAGE_SHIFT))) {
88 /*
89 * Since arm64 may execute with page sizes of up to 64 KB, the
90 * UEFI spec mandates that RuntimeServices memory regions must
91 * be 64 KB aligned. We need to validate this here since we will
92 * not be able to tighten permissions on such regions without
93 * affecting adjacent regions.
94 */
95 pr_warn("Entry address region misaligned\n");
96 return false;
97 }
98
99 for_each_efi_memory_desc(md) {
100 u64 md_paddr = md->phys_addr;
101 u64 md_size = md->num_pages << EFI_PAGE_SHIFT;
102
103 if (!(md->attribute & EFI_MEMORY_RUNTIME))
104 continue;
105 if (md->virt_addr == 0 && md->phys_addr != 0) {
106 /* no virtual mapping has been installed by the stub */
107 break;
108 }
109
110 if (md_paddr > in_paddr || (in_paddr - md_paddr) >= md_size)
111 continue;
112
113 /*
114 * This entry covers the start of @in, check whether
115 * it covers the end as well.
116 */
117 if (md_paddr + md_size < in_paddr + in_size) {
118 pr_warn("Entry covers multiple EFI memory map regions\n");
119 return false;
120 }
121
122 if (md->type != in->type) {
123 pr_warn("Entry type deviates from EFI memory map region type\n");
124 return false;
125 }
126
127 out->virt_addr = in_paddr + (md->virt_addr - md_paddr);
128
129 return true;
130 }
131
132 pr_warn("No matching entry found in the EFI memory map\n");
133 return false;
134 }
135
136 /*
137 * To be called after the EFI page tables have been populated. If a memory
138 * attributes table is available, its contents will be used to update the
139 * mappings with tightened permissions as described by the table.
140 * This requires the UEFI memory map to have already been populated with
141 * virtual addresses.
142 */
efi_memattr_apply_permissions(struct mm_struct * mm,efi_memattr_perm_setter fn)143 int __init efi_memattr_apply_permissions(struct mm_struct *mm,
144 efi_memattr_perm_setter fn)
145 {
146 efi_memory_attributes_table_t *tbl;
147 bool has_bti = false;
148 int i, ret;
149
150 if (tbl_size <= sizeof(*tbl))
151 return 0;
152
153 /*
154 * We need the EFI memory map to be setup so we can use it to
155 * lookup the virtual addresses of all entries in the of EFI
156 * Memory Attributes table. If it isn't available, this
157 * function should not be called.
158 */
159 if (WARN_ON(!efi_enabled(EFI_MEMMAP)))
160 return 0;
161
162 tbl = memremap(efi_mem_attr_table, tbl_size, MEMREMAP_WB);
163 if (!tbl) {
164 pr_err("Failed to map EFI Memory Attributes table @ 0x%lx\n",
165 efi_mem_attr_table);
166 return -ENOMEM;
167 }
168
169 if (tbl->version > 1 &&
170 (tbl->flags & EFI_MEMORY_ATTRIBUTES_FLAGS_RT_FORWARD_CONTROL_FLOW_GUARD))
171 has_bti = true;
172
173 if (efi_enabled(EFI_DBG))
174 pr_info("Processing EFI Memory Attributes table:\n");
175
176 for (i = ret = 0; ret == 0 && i < tbl->num_entries; i++) {
177 efi_memory_desc_t md;
178 unsigned long size;
179 bool valid;
180 char buf[64];
181
182 valid = entry_is_valid(efi_memdesc_ptr(tbl->entry, tbl->desc_size, i),
183 &md);
184 size = md.num_pages << EFI_PAGE_SHIFT;
185 if (efi_enabled(EFI_DBG) || !valid)
186 pr_info("%s 0x%012llx-0x%012llx %s\n",
187 valid ? "" : "!", md.phys_addr,
188 md.phys_addr + size - 1,
189 efi_md_typeattr_format(buf, sizeof(buf), &md));
190
191 if (valid) {
192 ret = fn(mm, &md, has_bti);
193 if (ret)
194 pr_err("Error updating mappings, skipping subsequent md's\n");
195 }
196 }
197 memunmap(tbl);
198 return ret;
199 }
200