Skip to content

Commit 06e1a81

Browse files
torvaldstorvalds
committed
Merge tag 'efi-next-for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi
Pull EFI updates from Ard Biesheuvel: "A healthy mix of EFI contributions this time: - Performance tweaks for efifb earlycon (Andy) - Preparatory refactoring and cleanup work in the efivar layer, which is needed to accommodate the Snapdragon arm64 laptops that expose their EFI variable store via a TEE secure world API (Johan) - Enhancements to the EFI memory map handling so that Xen dom0 can safely access EFI configuration tables (Demi Marie) - Wire up the newly introduced IBT/BTI flag in the EFI memory attributes table, so that firmware that is generated with ENDBR/BTI landing pads will be mapped with enforcement enabled - Clean up how we check and print the EFI revision exposed by the firmware - Incorporate EFI memory attributes protocol definition and wire it up in the EFI zboot code (Evgeniy) This ensures that these images can execute under new and stricter rules regarding the default memory permissions for EFI page allocations (More work is in progress here) - CPER header cleanup (Dan Williams) - Use a raw spinlock to protect the EFI runtime services stack on arm64 to ensure the correct semantics under -rt (Pierre) - EFI framebuffer quirk for Lenovo Ideapad (Darrell)" * tag 'efi-next-for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: (24 commits) firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3 arm64: efi: Make efi_rt_lock a raw_spinlock efi: Add mixed-mode thunk recipe for GetMemoryAttributes efi: x86: Wire up IBT annotation in memory attributes table efi: arm64: Wire up BTI annotation in memory attributes table efi: Discover BTI support in runtime services regions efi/cper, cxl: Remove cxl_err.h efi: Use standard format for printing the EFI revision efi: Drop minimum EFI version check at boot efi: zboot: Use EFI protocol to remap code/data with the right attributes efi/libstub: Add memory attribute protocol definitions efi: efivars: prevent double registration efi: verify that variable services are supported efivarfs: always register filesystem efi: efivars: add efivars printk prefix efi: Warn if trying to reserve memory under Xen efi: Actually enable the ESRT under Xen efi: Apply allowlist to EFI configuration tables when running under Xen efi: xen: Implement memory descriptor lookup based on hypercall efi: memmap: Disregard bogus entries instead of returning them ...
2 parents f2b98d0 + e1d4471 commit 06e1a81

File tree

30 files changed

+389
-116
lines changed

30 files changed

+389
-116
lines changed

‎arch/arm/include/asm/efi.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ void efi_init(void);
2020
void arm_efi_init(void);
2121

2222
int efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md);
23-
int efi_set_mapping_permissions(struct mm_struct *mm, efi_memory_desc_t *md);
23+
int efi_set_mapping_permissions(struct mm_struct *mm, efi_memory_desc_t *md, bool);
2424

2525
#define arch_efi_call_virt_setup() efi_virtmap_load()
2626
#define arch_efi_call_virt_teardown() efi_virtmap_unload()

‎arch/arm/kernel/efi.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,8 @@ static int __init set_permissions(pte_t *ptep, unsigned long addr, void *data)
2323
}
2424

2525
int __init efi_set_mapping_permissions(struct mm_struct *mm,
26-
efi_memory_desc_t *md)
26+
efi_memory_desc_t *md,
27+
bool ignored)
2728
{
2829
unsigned long base, size;
2930

@@ -71,7 +72,7 @@ int __init efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md)
7172
* If stricter permissions were specified, apply them now.
7273
*/
7374
if (md->attribute & (EFI_MEMORY_RO | EFI_MEMORY_XP))
74-
return efi_set_mapping_permissions(mm, md);
75+
return efi_set_mapping_permissions(mm, md, false);
7576
return 0;
7677
}
7778

‎arch/arm64/include/asm/efi.h

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,14 @@ bool efi_runtime_fixup_exception(struct pt_regs *regs, const char *msg)
2727
#endif
2828

2929
int efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md);
30-
int efi_set_mapping_permissions(struct mm_struct *mm, efi_memory_desc_t *md);
30+
int efi_set_mapping_permissions(struct mm_struct *mm, efi_memory_desc_t *md,
31+
bool has_bti);
3132

3233
#define arch_efi_call_virt_setup() \
3334
({ \
3435
efi_virtmap_load(); \
3536
__efi_fpsimd_begin(); \
36-
spin_lock(&efi_rt_lock); \
37+
raw_spin_lock(&efi_rt_lock); \
3738
})
3839

3940
#undef arch_efi_call_virt
@@ -42,12 +43,12 @@ int efi_set_mapping_permissions(struct mm_struct *mm, efi_memory_desc_t *md);
4243

4344
#define arch_efi_call_virt_teardown() \
4445
({ \
45-
spin_unlock(&efi_rt_lock); \
46+
raw_spin_unlock(&efi_rt_lock); \
4647
__efi_fpsimd_end(); \
4748
efi_virtmap_unload(); \
4849
})
4950

50-
extern spinlock_t efi_rt_lock;
51+
extern raw_spinlock_t efi_rt_lock;
5152
extern u64 *efi_rt_stack_top;
5253
efi_status_t __efi_rt_asm_wrapper(void *, const char *, ...);
5354

‎arch/arm64/kernel/efi.c

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -97,22 +97,34 @@ int __init efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md)
9797
return 0;
9898
}
9999

100+
struct set_perm_data {
101+
const efi_memory_desc_t *md;
102+
bool has_bti;
103+
};
104+
100105
static int __init set_permissions(pte_t *ptep, unsigned long addr, void *data)
101106
{
102-
efi_memory_desc_t *md = data;
107+
struct set_perm_data *spd = data;
108+
const efi_memory_desc_t *md = spd->md;
103109
pte_t pte = READ_ONCE(*ptep);
104110

105111
if (md->attribute & EFI_MEMORY_RO)
106112
pte = set_pte_bit(pte, __pgprot(PTE_RDONLY));
107113
if (md->attribute & EFI_MEMORY_XP)
108114
pte = set_pte_bit(pte, __pgprot(PTE_PXN));
115+
else if (IS_ENABLED(CONFIG_ARM64_BTI_KERNEL) &&
116+
system_supports_bti() && spd->has_bti)
117+
pte = set_pte_bit(pte, __pgprot(PTE_GP));
109118
set_pte(ptep, pte);
110119
return 0;
111120
}
112121

113122
int __init efi_set_mapping_permissions(struct mm_struct *mm,
114-
efi_memory_desc_t *md)
123+
efi_memory_desc_t *md,
124+
bool has_bti)
115125
{
126+
struct set_perm_data data = { md, has_bti };
127+
116128
BUG_ON(md->type != EFI_RUNTIME_SERVICES_CODE &&
117129
md->type != EFI_RUNTIME_SERVICES_DATA);
118130

@@ -128,7 +140,7 @@ int __init efi_set_mapping_permissions(struct mm_struct *mm,
128140
*/
129141
return apply_to_page_range(mm, md->virt_addr,
130142
md->num_pages << EFI_PAGE_SHIFT,
131-
set_permissions, md);
143+
set_permissions, &data);
132144
}
133145

134146
/*
@@ -146,7 +158,7 @@ asmlinkage efi_status_t efi_handle_corrupted_x18(efi_status_t s, const char *f)
146158
return s;
147159
}
148160

149-
DEFINE_SPINLOCK(efi_rt_lock);
161+
DEFINE_RAW_SPINLOCK(efi_rt_lock);
150162

151163
asmlinkage u64 *efi_rt_stack_top __ro_after_init;
152164

‎arch/arm64/kernel/traps.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
#include <linux/module.h>
1919
#include <linux/kexec.h>
2020
#include <linux/delay.h>
21+
#include <linux/efi.h>
2122
#include <linux/init.h>
2223
#include <linux/sched/signal.h>
2324
#include <linux/sched/debug.h>
@@ -34,6 +35,7 @@
3435
#include <asm/cpufeature.h>
3536
#include <asm/daifflags.h>
3637
#include <asm/debug-monitors.h>
38+
#include <asm/efi.h>
3739
#include <asm/esr.h>
3840
#include <asm/exception.h>
3941
#include <asm/extable.h>
@@ -491,6 +493,10 @@ void do_el0_bti(struct pt_regs *regs)
491493

492494
void do_el1_bti(struct pt_regs *regs, unsigned long esr)
493495
{
496+
if (efi_runtime_fixup_exception(regs, "BTI violation")) {
497+
regs->pstate &= ~PSR_BTYPE_MASK;
498+
return;
499+
}
494500
die("Oops - BTI", regs, esr);
495501
}
496502

‎arch/ia64/kernel/efi.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -525,7 +525,7 @@ efi_init (void)
525525
*/
526526
if (efi_systab == NULL)
527527
panic("Whoa! Can't find EFI system table.\n");
528-
if (efi_systab_check_header(&efi_systab->hdr, 1))
528+
if (efi_systab_check_header(&efi_systab->hdr))
529529
panic("Whoa! EFI system table signature incorrect\n");
530530

531531
efi_systab_report_header(&efi_systab->hdr, efi_systab->fw_vendor);

‎arch/riscv/include/asm/efi.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ extern void efi_init(void);
1919
#endif
2020

2121
int efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md);
22-
int efi_set_mapping_permissions(struct mm_struct *mm, efi_memory_desc_t *md);
22+
int efi_set_mapping_permissions(struct mm_struct *mm, efi_memory_desc_t *md, bool);
2323

2424
#define arch_efi_call_virt_setup() ({ \
2525
sync_kernel_mappings(efi_mm.pgd); \

‎arch/riscv/kernel/efi.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,8 @@ static int __init set_permissions(pte_t *ptep, unsigned long addr, void *data)
7878
}
7979

8080
int __init efi_set_mapping_permissions(struct mm_struct *mm,
81-
efi_memory_desc_t *md)
81+
efi_memory_desc_t *md,
82+
bool ignored)
8283
{
8384
BUG_ON(md->type != EFI_RUNTIME_SERVICES_CODE &&
8485
md->type != EFI_RUNTIME_SERVICES_DATA);

‎arch/x86/include/asm/efi.h

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,8 @@ static inline void efi_fpu_end(void)
106106

107107
extern asmlinkage u64 __efi_call(void *fp, ...);
108108

109+
extern bool efi_disable_ibt_for_runtime;
110+
109111
#define efi_call(...) ({ \
110112
__efi_nargs_check(efi_call, 7, __VA_ARGS__); \
111113
__efi_call(__VA_ARGS__); \
@@ -121,7 +123,7 @@ extern asmlinkage u64 __efi_call(void *fp, ...);
121123

122124
#undef arch_efi_call_virt
123125
#define arch_efi_call_virt(p, f, args...) ({ \
124-
u64 ret, ibt = ibt_save(); \
126+
u64 ret, ibt = ibt_save(efi_disable_ibt_for_runtime); \
125127
ret = efi_call((void *)p->f, args); \
126128
ibt_restore(ibt); \
127129
ret; \
@@ -335,6 +337,16 @@ static inline u32 efi64_convert_status(efi_status_t status)
335337
#define __efi64_argmap_open_volume(prot, file) \
336338
((prot), efi64_zero_upper(file))
337339

340+
/* Memory Attribute Protocol */
341+
#define __efi64_argmap_get_memory_attributes(protocol, phys, size, flags) \
342+
((protocol), __efi64_split(phys), __efi64_split(size), (flags))
343+
344+
#define __efi64_argmap_set_memory_attributes(protocol, phys, size, flags) \
345+
((protocol), __efi64_split(phys), __efi64_split(size), __efi64_split(flags))
346+
347+
#define __efi64_argmap_clear_memory_attributes(protocol, phys, size, flags) \
348+
((protocol), __efi64_split(phys), __efi64_split(size), __efi64_split(flags))
349+
338350
/*
339351
* The macros below handle the plumbing for the argument mapping. To add a
340352
* mapping for a specific EFI method, simply define a macro

‎arch/x86/include/asm/ibt.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ static inline bool is_endbr(u32 val)
7474
return val == gen_endbr();
7575
}
7676

77-
extern __noendbr u64 ibt_save(void);
77+
extern __noendbr u64 ibt_save(bool disable);
7878
extern __noendbr void ibt_restore(u64 save);
7979

8080
#else /* __ASSEMBLY__ */
@@ -100,7 +100,7 @@ extern __noendbr void ibt_restore(u64 save);
100100

101101
static inline bool is_endbr(u32 val) { return false; }
102102

103-
static inline u64 ibt_save(void) { return 0; }
103+
static inline u64 ibt_save(bool disable) { return 0; }
104104
static inline void ibt_restore(u64 save) { }
105105

106106
#else /* __ASSEMBLY__ */

‎arch/x86/kernel/apm_32.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -609,7 +609,7 @@ static long __apm_bios_call(void *_call)
609609

610610
apm_irq_save(flags);
611611
firmware_restrict_branch_speculation_start();
612-
ibt = ibt_save();
612+
ibt = ibt_save(true);
613613
APM_DO_SAVE_SEGS;
614614
apm_bios_call_asm(call->func, call->ebx, call->ecx,
615615
&call->eax, &call->ebx, &call->ecx, &call->edx,
@@ -690,7 +690,7 @@ static long __apm_bios_call_simple(void *_call)
690690

691691
apm_irq_save(flags);
692692
firmware_restrict_branch_speculation_start();
693-
ibt = ibt_save();
693+
ibt = ibt_save(true);
694694
APM_DO_SAVE_SEGS;
695695
error = apm_bios_call_simple_asm(call->func, call->ebx, call->ecx,
696696
&call->eax);

‎arch/x86/kernel/cpu/common.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -571,13 +571,14 @@ __setup("nopku", setup_disable_pku);
571571

572572
#ifdef CONFIG_X86_KERNEL_IBT
573573

574-
__noendbr u64 ibt_save(void)
574+
__noendbr u64 ibt_save(bool disable)
575575
{
576576
u64 msr = 0;
577577

578578
if (cpu_feature_enabled(X86_FEATURE_IBT)) {
579579
rdmsrl(MSR_IA32_S_CET, msr);
580-
wrmsrl(MSR_IA32_S_CET, msr & ~CET_ENDBR_EN);
580+
if (disable)
581+
wrmsrl(MSR_IA32_S_CET, msr & ~CET_ENDBR_EN);
581582
}
582583

583584
return msr;

‎arch/x86/platform/efi/efi.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -380,7 +380,7 @@ static int __init efi_systab_init(unsigned long phys)
380380
return -ENOMEM;
381381
}
382382

383-
ret = efi_systab_check_header(hdr, 1);
383+
ret = efi_systab_check_header(hdr);
384384
if (ret) {
385385
early_memunmap(p, size);
386386
return ret;

‎arch/x86/platform/efi/efi_64.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -389,10 +389,15 @@ static int __init efi_update_mappings(efi_memory_desc_t *md, unsigned long pf)
389389
return err1 || err2;
390390
}
391391

392-
static int __init efi_update_mem_attr(struct mm_struct *mm, efi_memory_desc_t *md)
392+
bool efi_disable_ibt_for_runtime __ro_after_init = true;
393+
394+
static int __init efi_update_mem_attr(struct mm_struct *mm, efi_memory_desc_t *md,
395+
bool has_ibt)
393396
{
394397
unsigned long pf = 0;
395398

399+
efi_disable_ibt_for_runtime |= !has_ibt;
400+
396401
if (md->attribute & EFI_MEMORY_XP)
397402
pf |= _PAGE_NX;
398403

@@ -414,6 +419,7 @@ void __init efi_runtime_update_mappings(void)
414419
* exists, since it is intended to supersede EFI_PROPERTIES_TABLE.
415420
*/
416421
if (efi_enabled(EFI_MEM_ATTR)) {
422+
efi_disable_ibt_for_runtime = false;
417423
efi_memattr_apply_permissions(NULL, efi_update_mem_attr);
418424
return;
419425
}

‎drivers/firmware/efi/cper_cxl.c

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@
99

1010
#include <linux/cper.h>
1111
#include "cper_cxl.h"
12-
#include <linux/cxl_err.h>
1312

1413
#define PROT_ERR_VALID_AGENT_TYPE BIT_ULL(0)
1514
#define PROT_ERR_VALID_AGENT_ADDRESS BIT_ULL(1)
@@ -19,6 +18,17 @@
1918
#define PROT_ERR_VALID_DVSEC BIT_ULL(5)
2019
#define PROT_ERR_VALID_ERROR_LOG BIT_ULL(6)
2120

21+
/* CXL RAS Capability Structure, CXL v3.0 sec 8.2.4.16 */
22+
struct cxl_ras_capability_regs {
23+
u32 uncor_status;
24+
u32 uncor_mask;
25+
u32 uncor_severity;
26+
u32 cor_status;
27+
u32 cor_mask;
28+
u32 cap_control;
29+
u32 header_log[16];
30+
};
31+
2232
static const char * const prot_err_agent_type_strs[] = {
2333
"Restricted CXL Device",
2434
"Restricted CXL Host Downstream Port",

0 commit comments

Comments
 (0)