mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-18 16:44:33 +00:00
Code Issues Releases Wiki Activity
linux-stable/arch/x86/platform
History
Matt Fleming a5caa209ba x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down 
Beginning with UEFI v2.5 EFI_PROPERTIES_TABLE was introduced
that signals that the firmware PE/COFF loader supports splitting
code and data sections of PE/COFF images into separate EFI
memory map entries. This allows the kernel to map those regions
with strict memory protections, e.g. EFI_MEMORY_RO for code,
EFI_MEMORY_XP for data, etc.

Unfortunately, an unwritten requirement of this new feature is
that the regions need to be mapped with the same offsets
relative to each other as observed in the EFI memory map. If
this is not done crashes like this may occur,

  BUG: unable to handle kernel paging request at fffffffefe6086dd
  IP: [<fffffffefe6086dd>] 0xfffffffefe6086dd
  Call Trace:
   [<ffffffff8104c90e>] efi_call+0x7e/0x100
   [<ffffffff81602091>] ? virt_efi_set_variable+0x61/0x90
   [<ffffffff8104c583>] efi_delete_dummy_variable+0x63/0x70
   [<ffffffff81f4e4aa>] efi_enter_virtual_mode+0x383/0x392
   [<ffffffff81f37e1b>] start_kernel+0x38a/0x417
   [<ffffffff81f37495>] x86_64_start_reservations+0x2a/0x2c
   [<ffffffff81f37582>] x86_64_start_kernel+0xeb/0xef

Here 0xfffffffefe6086dd refers to an address the firmware
expects to be mapped but which the OS never claimed was mapped.
The issue is that included in these regions are relative
addresses to other regions which were emitted by the firmware
toolchain before the "splitting" of sections occurred at
runtime.

Needless to say, we don't satisfy this unwritten requirement on
x86_64 and instead map the EFI memory map entries in reverse
order. The above crash is almost certainly triggerable with any
kernel newer than v3.13 because that's when we rewrote the EFI
runtime region mapping code, in commit d2f7cbe7b2 ("x86/efi:
Runtime services virtual mapping"). For kernel versions before
v3.13 things may work by pure luck depending on the
fragmentation of the kernel virtual address space at the time we
map the EFI regions.

Instead of mapping the EFI memory map entries in reverse order,
where entry N has a higher virtual address than entry N+1, map
them in the same order as they appear in the EFI memory map to
preserve this relative offset between regions.

This patch has been kept as small as possible with the intention
that it should be applied aggressively to stable and
distribution kernels. It is very much a bugfix rather than
support for a new feature, since when EFI_PROPERTIES_TABLE is
enabled we must map things as outlined above to even boot - we
have no way of asking the firmware not to split the code/data
regions.

In fact, this patch doesn't even make use of the more strict
memory protections available in UEFI v2.5. That will come later.

Suggested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reported-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Cc: <stable@vger.kernel.org>
Cc: Borislav Petkov <bp@suse.de>
Cc: Chun-Yi <jlee@suse.com>
Cc: Dave Young <dyoung@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: James Bottomley <JBottomley@Odin.com>
Cc: Lee, Chun-Yi <jlee@suse.com>
Cc: Leif Lindholm <leif.lindholm@linaro.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Matthew Garrett <mjg59@srcf.ucam.org>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Peter Jones <pjones@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-kernel@vger.kernel.org
Link: http://lkml.kernel.org/r/1443218539-7610-2-git-send-email-matt@codeblueprint.co.uk
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-10-01 12:51:28 +02:00
..
atom x86/platform: Make atom/pmc_atom.c explicitly non-modular 2015-08-25 09:47:50 +02:00
ce4100 x86: ce4100, irq: Do not set legacy_pic to null_legacy_pic 2014-06-21 23:05:42 +02:00
efi x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down 2015-10-01 12:51:28 +02:00
geode x86/geode: Fix incorrect placement of __initdata tag 2013-10-01 13:21:27 +02:00
goldfish goldfish: platform device for x86 2013-01-21 12:09:19 -08:00
intel x86/platform/iosf_mbi: Add Intel Tangier PCI id 2015-07-16 17:48:48 +02:00
intel-mid Replace module_init with equivalent device_initcall in non modules. 2015-07-02 10:30:48 -07:00
intel-quark x86/intel/quark: Run IMR self-test on IMR capble hw only 2015-04-02 12:47:50 +02:00
iris x86: platform: iris: drop owner assignment from platform_drivers 2014-10-20 16:20:15 +02:00
olpc x86/olpc/xo15/sci: Use newly added power_supply_put API 2015-03-13 23:15:53 +01:00
scx200 X86: drivers: remove __dev* attributes. 2013-01-03 15:57:04 -08:00
sfi x86: Cleanup irq_domain ops 2015-04-24 15:36:55 +02:00
ts5500 x86/platform/ts5500: Add support for TS-5400 boards 2014-07-16 21:17:42 +02:00
uv kexec: split kexec_load syscall from kexec core code 2015-09-10 13:29:01 -07:00
Makefile x86/platform/iosf_mbi: Move to dedicated folder 2015-07-16 17:48:47 +02:00