From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 67F95C61DA4 for ; Thu, 9 Feb 2023 15:49:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=NVeYqWRPuLhvxk2CKSzTXSn4NPJeRXiz+fsyQzShawY=; b=z3wD21Kwrf1bSk Fhl/W3GgTsXiuzeDVnP7AfFioYW3waBS1a/q2lEWBD1s1fKZ9s32kCW6MoI3WZCMLmmu6CJYeOIid 9bMipxnsvIATNxjcSsMUfE4ohLmw25D5pX7bzeO2x83o2Ey1KJ84JSwzPwJHExedtAkXwAuJljyaU 7tv2il65QQbrityTOr1E0BHditjgE2tEkrbnhUMY6z9qvqWQfKFQFUJskD7lMq6CjDvPK4/YSkw8N RHuLyp1o1EgGjb08C7JtS0x7+EZwpAf081r0gXBOrSi734snv+HAAQ1tz/6qUymsnuHtUQpp3FPSE 2lBp2SJOIq9CG9Zl7ttA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1pQ9AS-002HlJ-QO; Thu, 09 Feb 2023 15:49:00 +0000 Received: from dfw.source.kernel.org ([139.178.84.217]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1pQ9AP-002HkE-HU for linux-arm-kernel@lists.infradead.org; Thu, 09 Feb 2023 15:48:59 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5971661AED; Thu, 9 Feb 2023 15:48:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BD5A7C433D2; Thu, 9 Feb 2023 15:48:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1675957735; bh=d0cr5zp8UVGhD1K/k24duyIvnyEWqmNCPkFTqSYFItc=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=KgpzXPk2JaQMUjN6Z/Suo/4wvBvWDouHN41/e0tVLkTzPQ5fJiLAEXuogwGA+cZYQ 1O6xJuxeUoRhaWwdG3ZEKz8xBF37L8zo3o+MH5YqSbqT97+t3dtRITZ3cPQ1pOAzKL pIaDLwEJN3ojwkVvl+jl/EpRq5GqcyQeSeSi1CFa7jywBKbiG2biPgRKNnvu1d/4VP F2o+tqdCPf69918sLt+ee249jH6WX2xfi0La3y5prIuBv193OM5kxGj5zH9wFDB8QN KpT0wxtaKtJvn3aBDHC6aviR+t2D2cCbBJPWbPONBp9KD64DeBtysRIzpiTaLnc9f2 ThVFQ6DiTFv/w== Date: Thu, 9 Feb 2023 15:48:49 +0000 From: Will Deacon To: Ard Biesheuvel Cc: Mark Rutland , linux-efi@vger.kernel.org, linux-arm-kernel@lists.infradead.org, Catalin Marinas , Kees Cook , Peter Zijlstra , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Subject: Re: [PATCH v2 2/3] efi: arm64: Wire up BTI annotation in memory attributes table Message-ID: <20230209154849.GA14628@willie-the-truck> References: <20230206124938.272988-1-ardb@kernel.org> <20230206124938.272988-3-ardb@kernel.org> <20230208130007.GA13529@willie-the-truck> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230209_074857_698731_0B812899 X-CRM114-Status: GOOD ( 46.94 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Thu, Feb 09, 2023 at 03:21:55PM +0100, Ard Biesheuvel wrote: > On Wed, 8 Feb 2023 at 15:36, Ard Biesheuvel wrote: > > > > On Wed, 8 Feb 2023 at 15:25, Mark Rutland wrote: > > > > > > On Wed, Feb 08, 2023 at 02:03:45PM +0100, Ard Biesheuvel wrote: > > > > On Wed, 8 Feb 2023 at 14:00, Will Deacon wrote: > > > > > > > > > > On Mon, Feb 06, 2023 at 01:49:37PM +0100, Ard Biesheuvel wrote: > > > > > > UEFI v2.10 extends the EFI memory attributes table with a flag that > > > > > > indicates whether or not all RuntimeServicesCode regions were > > > > > > constructed with BTI landing pads, permitting the OS to map these > > > > > > regions with BTI restrictions enabled. > > > > > > > > > > > > So let's take this into account on arm64. > > > > > > > > > > > > Signed-off-by: Ard Biesheuvel > > > > > > Reviewed-by: Kees Cook > > > > > > --- > > > > > > arch/arm64/kernel/efi.c | 14 ++++++++++++-- > > > > > > arch/arm64/kernel/traps.c | 6 ++++++ > > > > > > 2 files changed, 18 insertions(+), 2 deletions(-) > > > > > > > > > > > > diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c > > > > > > index 78ffd5aaddcbbaee..99971cd349f36310 100644 > > > > > > --- a/arch/arm64/kernel/efi.c > > > > > > +++ b/arch/arm64/kernel/efi.c > > > > > > @@ -96,15 +96,23 @@ int __init efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md) > > > > > > return 0; > > > > > > } > > > > > > > > > > > > +struct set_perm_data { > > > > > > + const efi_memory_desc_t *md; > > > > > > + bool has_bti; > > > > > > +}; > > > > > > + > > > > > > static int __init set_permissions(pte_t *ptep, unsigned long addr, void *data) > > > > > > { > > > > > > - efi_memory_desc_t *md = data; > > > > > > + struct set_perm_data *spd = data; > > > > > > + const efi_memory_desc_t *md = spd->md; > > > > > > pte_t pte = READ_ONCE(*ptep); > > > > > > > > > > > > if (md->attribute & EFI_MEMORY_RO) > > > > > > pte = set_pte_bit(pte, __pgprot(PTE_RDONLY)); > > > > > > if (md->attribute & EFI_MEMORY_XP) > > > > > > pte = set_pte_bit(pte, __pgprot(PTE_PXN)); > > > > > > + else if (system_supports_bti() && spd->has_bti) > > > > > > > > > > system_supports_bti() seems to check CONFIG_ARM64_BTI rather than > > > > > CONFIG_ARM64_BTI_KERNEL. In theory, I think this means we could have > > > > > mismatched BTI support, so it might be slightly more robust to use the > > > > > latter option here even thought the runtime services aren't kernel code. > > > > > > > > > > What do you think? > > > > > > > > v1 checked for CONFIG_ARM64_BTI_KERNEL as well, but I dropped it > > > > because we can do the enforcement even without it. > > > > > > > > I'm not sure how mismatched BTI support factors into that, though, > > > > given that CONFIG_ARM64_BTI_KERNEL is set at compile time. You mean > > > > mismatched between cores, right? > > > > > > I believe that there's no issue with mismatched CPUs, but there *might* might > > > be a different issue with the ordering of feature detection and usage of the > > > cap: > > > > > > * If CONFIG_ARM64_BTI_KERNEL=y, then the ARM64_BTI cap is detected as a strict > > > boot cpu feature, and secondaries without it will be rejected. > > > > > > * If CONFIG_ARM64_BTI_KERNEL=n then the ARM64_BTI cap is detected as a system > > > feature, and so we only set the cap bit after bringing all secondary CPUs > > > online, and only when *all* CPUs support it. > > > > > > The happens under setup_cpu_features(), called from smp_cpus_done(). > > > > > > So there's no issue with mismatch, but if system_supports_bti is called before > > > smp_cpus_done() on a CONFIG_ARM64_BTI_KERNEL kernel it will return false. When > > > do we set up the EFI mappings relative to that? > > > > > > > Currently it is an early initcall so before SMP, but that is not > > really necessary - the EFI table that carries this annotation is an > > overlay that could easily be applied later. > > > > OTOH, what is the penalty for setting the GP attribute and using the > > translation table on a core that does not implement BTI? > > I'll merge this with the CONFIG_ARM64_BTI_KERNEL check re-added, if > nobody minds? Reviewed-by: Will Deacon Will _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel