[PATCH] efi/arm: Disable LPAE PAN when calling EFI runtime services
Ard Biesheuvel
ardb at kernel.org
Tue Jun 11 07:08:18 PDT 2024
On Tue, 11 Jun 2024 at 15:17, Linus Walleij <linus.walleij at linaro.org> wrote:
>
> On Mon, Jun 10, 2024 at 2:24 PM Ard Biesheuvel <ardb+git at google.com> wrote:
>
> > From: Ard Biesheuvel <ardb at kernel.org>
> >
> > EFI runtime services are remapped into the lower 1 GiB of virtual
> > address space at boot, so they are guaranteed to be able to co-exist
> > with the kernel virtual mappings without the need to allocate space for
> > them in the kernel's vmalloc region, which is rather small.
> >
> > This means those mappings are covered by TTBR0 when LPAE PAN is enabled,
> > and so 'user' access must be enabled while such calls are in progress.
> >
> > To avoid the need to refactor the code that is shared between ARM, arm64
> > and other EFI architectures, fold this into efi_set_pgd(). Given that
> > EFI runtime services are serialized and not pre-emptible, storing the
> > flags into a global variable is reasonable here - efi_set_pgd() calls
> > will always occur in pairs on a single CPU.
> >
> > Cc: Kees Cook <keescook at chromium.org>
> > Cc: Linus Walleij <linus.walleij at linaro.org>
> > Signed-off-by: Ard Biesheuvel <ardb at kernel.org>
>
> Makes sense to me! Thanks for looking into this.
> Reviewed-by: Linus Walleij <linus.walleij at linaro.org>
>
Thanks, I'll queue this up as a EFI fix.
Note that I have to fix an error in the patch: CONFIG_ARM_TTBR0_PAN
does not exist, it should be CONFIG_CPU_TTBR0_PAN (and don't ask me
why it worked because it definitely did - probably forgot to do git
commit --amend)
More information about the linux-arm-kernel
mailing list