mbox series

[0/2] efi: Enable BTI for EFI runtimes services

Message ID 20230201132540.2196065-1-ardb@kernel.org
Headers show
Series efi: Enable BTI for EFI runtimes services | expand

Message

Ard Biesheuvel Feb. 1, 2023, 1:25 p.m. UTC 
The EFI spec v2.10 introduces a global flag in the memory attributes
table that indicates whether the EFI runtime code regions were emitted
with BTI landing pads, and can therefore tolerate being mapped with BTI
enforcement enabled.

Add the generic plumbing for this, and wire it up for arm64.

Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Mark Rutland <mark.rutland@arm.com>

Ard Biesheuvel (2):
  efi: Discover BTI support in runtime services regions
  efi: arm64: Wire up BTI annotation in memory attributes table

 arch/arm/include/asm/efi.h     |  2 +-
 arch/arm/kernel/efi.c          |  5 +++--
 arch/arm64/include/asm/efi.h   |  3 ++-
 arch/arm64/kernel/efi.c        | 18 +++++++++++++++---
 arch/riscv/include/asm/efi.h   |  2 +-
 arch/riscv/kernel/efi.c        |  3 ++-
 arch/x86/platform/efi/efi_64.c |  3 ++-
 drivers/firmware/efi/memattr.c |  9 +++++++--
 include/linux/efi.h            |  8 ++++++--
 9 files changed, 39 insertions(+), 14 deletions(-)

Comments

Kees Cook Feb. 2, 2023, 5:37 p.m. UTC | #1 
On Wed, Feb 01, 2023 at 02:25:38PM +0100, Ard Biesheuvel wrote:
> The EFI spec v2.10 introduces a global flag in the memory attributes
> table that indicates whether the EFI runtime code regions were emitted
> with BTI landing pads, and can therefore tolerate being mapped with BTI
> enforcement enabled.
> 
> Add the generic plumbing for this, and wire it up for arm64.

Looks nice! :)

Reviewed-by: Kees Cook <keescook@chromium.org>

> 
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Will Deacon <will@kernel.org>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Mark Rutland <mark.rutland@arm.com>
> 
> Ard Biesheuvel (2):
>   efi: Discover BTI support in runtime services regions
>   efi: arm64: Wire up BTI annotation in memory attributes table
> 
>  arch/arm/include/asm/efi.h     |  2 +-
>  arch/arm/kernel/efi.c          |  5 +++--
>  arch/arm64/include/asm/efi.h   |  3 ++-
>  arch/arm64/kernel/efi.c        | 18 +++++++++++++++---
>  arch/riscv/include/asm/efi.h   |  2 +-
>  arch/riscv/kernel/efi.c        |  3 ++-
>  arch/x86/platform/efi/efi_64.c |  3 ++-
>  drivers/firmware/efi/memattr.c |  9 +++++++--
>  include/linux/efi.h            |  8 ++++++--
>  9 files changed, 39 insertions(+), 14 deletions(-)
> 
> -- 
> 2.39.0
>
Ard Biesheuvel Feb. 4, 2023, 8:23 a.m. UTC | #2 
On Thu, 2 Feb 2023 at 18:37, Kees Cook <keescook@chromium.org> wrote:
>
> On Wed, Feb 01, 2023 at 02:25:38PM +0100, Ard Biesheuvel wrote:
> > The EFI spec v2.10 introduces a global flag in the memory attributes
> > table that indicates whether the EFI runtime code regions were emitted
> > with BTI landing pads, and can therefore tolerate being mapped with BTI
> > enforcement enabled.
> >
> > Add the generic plumbing for this, and wire it up for arm64.
>
> Looks nice! :)
>
> Reviewed-by: Kees Cook <keescook@chromium.org>
>

Thanks

I've queued these up now in efi/next


> >
> > Cc: Catalin Marinas <catalin.marinas@arm.com>
> > Cc: Will Deacon <will@kernel.org>
> > Cc: Kees Cook <keescook@chromium.org>
> > Cc: Mark Rutland <mark.rutland@arm.com>
> >
> > Ard Biesheuvel (2):
> >   efi: Discover BTI support in runtime services regions
> >   efi: arm64: Wire up BTI annotation in memory attributes table
> >
> >  arch/arm/include/asm/efi.h     |  2 +-
> >  arch/arm/kernel/efi.c          |  5 +++--
> >  arch/arm64/include/asm/efi.h   |  3 ++-
> >  arch/arm64/kernel/efi.c        | 18 +++++++++++++++---
> >  arch/riscv/include/asm/efi.h   |  2 +-
> >  arch/riscv/kernel/efi.c        |  3 ++-
> >  arch/x86/platform/efi/efi_64.c |  3 ++-
> >  drivers/firmware/efi/memattr.c |  9 +++++++--
> >  include/linux/efi.h            |  8 ++++++--
> >  9 files changed, 39 insertions(+), 14 deletions(-)
> >
> > --
> > 2.39.0
> >
>
> --
> Kees Cook