1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (C) 2016 Linaro Ltd. <ard.biesheuvel@linaro.org> 4 */ 5 6 #define pr_fmt(fmt) "efi: memattr: " fmt 7 8 #include <linux/efi.h> 9 #include <linux/init.h> 10 #include <linux/io.h> 11 #include <linux/memblock.h> 12 13 #include <asm/early_ioremap.h> 14 15 static int __initdata tbl_size; 16 unsigned long __ro_after_init efi_mem_attr_table = EFI_INVALID_TABLE_ADDR; 17 18 /* 19 * Reserve the memory associated with the Memory Attributes configuration 20 * table, if it exists. 21 */ 22 void __init efi_memattr_init(void) 23 { 24 efi_memory_attributes_table_t *tbl; 25 26 if (efi_mem_attr_table == EFI_INVALID_TABLE_ADDR) 27 return; 28 29 tbl = early_memremap(efi_mem_attr_table, sizeof(*tbl)); 30 if (!tbl) { 31 pr_err("Failed to map EFI Memory Attributes table @ 0x%lx\n", 32 efi_mem_attr_table); 33 return; 34 } 35 36 if (tbl->version > 2) { 37 pr_warn("Unexpected EFI Memory Attributes table version %d\n", 38 tbl->version); 39 goto unmap; 40 } 41 42 /* 43 * The EFI memory attributes table descriptors might potentially be 44 * smaller than those used by the EFI memory map, as long as they can 45 * fit a efi_memory_desc_t. However, a larger descriptor size makes no 46 * sense, and might be an indication that the table is corrupted. 47 * 48 * The only exception is kexec_load(), where the EFI memory map is 49 * reconstructed by user space, and may use a smaller descriptor size 50 * than the original. Given that, ignoring this companion table is 51 * still the right thing to do here, but don't complain too loudly when 52 * this happens. 53 */ 54 if (tbl->desc_size < sizeof(efi_memory_desc_t) || 55 tbl->desc_size > efi.memmap.desc_size) { 56 pr_warn("Unexpected EFI Memory Attributes descriptor size %u (expected: %lu)\n", 57 tbl->desc_size, efi.memmap.desc_size); 58 goto unmap; 59 } 60 61 /* 62 * Sanity check: the Memory Attributes Table contains multiple entries 63 * for each EFI runtime services code or data region in the EFI memory 64 * map, each with the permission attributes that may be applied when 65 * mapping the region. There is no upper bound for the number of 66 * entries, as it could conceivably contain more entries than the EFI 67 * memory map itself. So pick an arbitrary limit of 64k, which is 68 * ludicrously high. This prevents a corrupted table from eating all 69 * system RAM. 70 */ 71 if (tbl->num_entries > SZ_64K) { 72 pr_warn(FW_BUG "Corrupted EFI Memory Attributes Table detected! (version == %u, desc_size == %u, num_entries == %u)\n", 73 tbl->version, tbl->desc_size, tbl->num_entries); 74 goto unmap; 75 } 76 77 tbl_size = sizeof(*tbl) + tbl->num_entries * tbl->desc_size; 78 memblock_reserve(efi_mem_attr_table, tbl_size); 79 set_bit(EFI_MEM_ATTR, &efi.flags); 80 81 unmap: 82 early_memunmap(tbl, sizeof(*tbl)); 83 } 84 85 /* 86 * Returns a copy @out of the UEFI memory descriptor @in if it is covered 87 * entirely by a UEFI memory map entry with matching attributes. The virtual 88 * address of @out is set according to the matching entry that was found. 89 */ 90 static bool entry_is_valid(const efi_memory_desc_t *in, efi_memory_desc_t *out) 91 { 92 u64 in_paddr = in->phys_addr; 93 u64 in_size = in->num_pages << EFI_PAGE_SHIFT; 94 efi_memory_desc_t *md; 95 96 *out = *in; 97 98 if (in->type != EFI_RUNTIME_SERVICES_CODE && 99 in->type != EFI_RUNTIME_SERVICES_DATA) { 100 pr_warn("Entry type should be RuntimeServiceCode/Data\n"); 101 return false; 102 } 103 104 if (PAGE_SIZE > EFI_PAGE_SIZE && 105 (!PAGE_ALIGNED(in->phys_addr) || 106 !PAGE_ALIGNED(in->num_pages << EFI_PAGE_SHIFT))) { 107 /* 108 * Since arm64 may execute with page sizes of up to 64 KB, the 109 * UEFI spec mandates that RuntimeServices memory regions must 110 * be 64 KB aligned. We need to validate this here since we will 111 * not be able to tighten permissions on such regions without 112 * affecting adjacent regions. 113 */ 114 pr_warn("Entry address region misaligned\n"); 115 return false; 116 } 117 118 for_each_efi_memory_desc(md) { 119 u64 md_paddr = md->phys_addr; 120 u64 md_size = md->num_pages << EFI_PAGE_SHIFT; 121 122 if (!(md->attribute & EFI_MEMORY_RUNTIME)) 123 continue; 124 if (md->virt_addr == 0 && md->phys_addr != 0) { 125 /* no virtual mapping has been installed by the stub */ 126 break; 127 } 128 129 if (md_paddr > in_paddr || (in_paddr - md_paddr) >= md_size) 130 continue; 131 132 /* 133 * This entry covers the start of @in, check whether 134 * it covers the end as well. 135 */ 136 if (md_paddr + md_size < in_paddr + in_size) { 137 pr_warn("Entry covers multiple EFI memory map regions\n"); 138 return false; 139 } 140 141 if (md->type != in->type) { 142 pr_warn("Entry type deviates from EFI memory map region type\n"); 143 return false; 144 } 145 146 out->virt_addr = in_paddr + (md->virt_addr - md_paddr); 147 148 return true; 149 } 150 151 pr_warn("No matching entry found in the EFI memory map\n"); 152 return false; 153 } 154 155 /* 156 * To be called after the EFI page tables have been populated. If a memory 157 * attributes table is available, its contents will be used to update the 158 * mappings with tightened permissions as described by the table. 159 * This requires the UEFI memory map to have already been populated with 160 * virtual addresses. 161 */ 162 int __init efi_memattr_apply_permissions(struct mm_struct *mm, 163 efi_memattr_perm_setter fn) 164 { 165 efi_memory_attributes_table_t *tbl; 166 bool has_bti = false; 167 int i, ret; 168 169 if (tbl_size <= sizeof(*tbl)) 170 return 0; 171 172 /* 173 * We need the EFI memory map to be setup so we can use it to 174 * lookup the virtual addresses of all entries in the of EFI 175 * Memory Attributes table. If it isn't available, this 176 * function should not be called. 177 */ 178 if (WARN_ON(!efi_enabled(EFI_MEMMAP))) 179 return 0; 180 181 tbl = memremap(efi_mem_attr_table, tbl_size, MEMREMAP_WB); 182 if (!tbl) { 183 pr_err("Failed to map EFI Memory Attributes table @ 0x%lx\n", 184 efi_mem_attr_table); 185 return -ENOMEM; 186 } 187 188 if (tbl->version > 1 && 189 (tbl->flags & EFI_MEMORY_ATTRIBUTES_FLAGS_RT_FORWARD_CONTROL_FLOW_GUARD)) 190 has_bti = true; 191 192 if (efi_enabled(EFI_DBG)) 193 pr_info("Processing EFI Memory Attributes table:\n"); 194 195 for (i = ret = 0; ret == 0 && i < tbl->num_entries; i++) { 196 efi_memory_desc_t md; 197 unsigned long size; 198 bool valid; 199 char buf[64]; 200 201 valid = entry_is_valid(efi_memdesc_ptr(tbl->entry, tbl->desc_size, i), 202 &md); 203 size = md.num_pages << EFI_PAGE_SHIFT; 204 if (efi_enabled(EFI_DBG) || !valid) 205 pr_info("%s 0x%012llx-0x%012llx %s\n", 206 valid ? "" : "!", md.phys_addr, 207 md.phys_addr + size - 1, 208 efi_md_typeattr_format(buf, sizeof(buf), &md)); 209 210 if (valid) { 211 ret = fn(mm, &md, has_bti); 212 if (ret) 213 pr_err("Error updating mappings, skipping subsequent md's\n"); 214 } 215 } 216 memunmap(tbl); 217 return ret; 218 } 219