[PATCH] lkdtm: Add more EFI runtime tests

[Ard Biesheuvel <ardb@kernel.org>]

Two bugs were found in the arm64 EFI runtime support that weren't caught
by LKDTM. The existing EFI_RUNTIME_CRASH test instructs the firmware to
write to kernel memory that is mapped read-only, which usually fails as
expected. However, this does not exercise the runtime mapping logic in
the kernel, nor the fault recovery logic when the faulting address is
inside the EFI runtime memory regions itself.

So add two more test cases:
- a write to R/O memory test that uses the firmware's own executable
  memory as an output buffer
- a branch to memory that is occupied by the firmware's runtime services
  function table, which is usually mapped non-execute.

This depends on the EFI memory attributes table having been exposed by
the firmware and having been taken into account by the runtime mapping
code, so this is used as a prerequisite by the new tests, otherwise it
produces an XFAIL.

Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
 drivers/firmware/efi/runtime-wrappers.c | 55 ++++++++++++++++++++
 drivers/misc/lkdtm/bugs.c               | 23 ++++++++
 include/linux/efi.h                     | 10 ++++
 3 files changed, 88 insertions(+)

diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c
index 33f256dd3d2c..7a43ea5f81b5 100644
--- a/drivers/firmware/efi/runtime-wrappers.c
+++ b/drivers/firmware/efi/runtime-wrappers.c
@@ -337,6 +337,29 @@ static void __nocfi efi_call_rts(struct work_struct *work)
 		 * function identifier into efi_rts_work->efi_rts_id
 		 */
 		pr_err("Requested executing invalid EFI Runtime Service.\n");
+		break;
+
+#ifdef CONFIG_LKDTM
+	case EFI_LKDTM_RUNTIME_RO_TEST:
+		/*
+		 * Call GetTime() with the output argument pointing to
+		 * executable memory, which should be mapped read-only in the
+		 * EFI page tables.
+		 */
+		status = arch_efi_call_virt(efi.runtime, get_time,
+					    (void *)efi.runtime->set_time,
+					    NULL);
+		break;
+	case EFI_LKDTM_RUNTIME_NX_TEST:
+		/*
+		 * Call efi.runtime, which points to a data object in a EFI
+		 * runtime region, as if it were a function pointer.
+		 */
+		struct { efi_status_t (__efiapi *fn)(int); } s = { (void *)efi.runtime };
+
+		status = arch_efi_call_virt((&s), fn, 0);
+		break;
+#endif
 	}
 
 	efi_call_virt_check_flags(flags, efi_rts_work.caller);
@@ -624,6 +647,34 @@ static efi_status_t virt_efi_query_capsule_caps(efi_capsule_header_t **capsules,
 	return status;
 }
 
+#ifdef CONFIG_LKDTM
+static efi_status_t efi_lkdtm_rt_test(enum efi_rts_ids id)
+{
+	efi_status_t status;
+
+	switch (id) {
+	case EFI_LKDTM_RUNTIME_RO_TEST:
+	    if (!efi.get_time ||
+		!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_TIME))
+		    return EFI_UNSUPPORTED;
+	    fallthrough;
+	case EFI_LKDTM_RUNTIME_NX_TEST:
+		if (!efi_enabled(EFI_MEM_ATTR) ||
+		    !efi_enabled(EFI_RUNTIME_SERVICES))
+			return EFI_UNSUPPORTED;
+		break;
+	default:
+		return EFI_UNSUPPORTED;
+	}
+
+	if (down_interruptible(&efi_runtime_lock))
+		return EFI_NOT_READY;
+	status = __efi_queue_work(id, NULL);
+	up(&efi_runtime_lock);
+	return status;
+}
+#endif
+
 void __init efi_native_runtime_setup(void)
 {
 	efi.get_time			    = virt_efi_get_time;
@@ -640,6 +691,10 @@ void __init efi_native_runtime_setup(void)
 	efi.query_variable_info_nonblocking = virt_efi_query_variable_info_nb;
 	efi.update_capsule		    = virt_efi_update_capsule;
 	efi.query_capsule_caps		    = virt_efi_query_capsule_caps;
+
+#ifdef CONFIG_LKDTM
+	efi.lkdtm_rt_test		    = efi_lkdtm_rt_test;
+#endif
 }
 
 #ifdef CONFIG_ACPI_PRMT
diff --git a/drivers/misc/lkdtm/bugs.c b/drivers/misc/lkdtm/bugs.c
index 3eca2ef64aff..7bcd88d05505 100644
--- a/drivers/misc/lkdtm/bugs.c
+++ b/drivers/misc/lkdtm/bugs.c
@@ -841,6 +841,27 @@ static void __maybe_unused lkdtm_EFI_RUNTIME_CRASH(void)
 		       status);
 }
 
+static void efi_rt_test(enum efi_rts_ids id, const char *desc)
+{
+	efi_status_t status = efi.lkdtm_rt_test(id);
+
+	if (status == EFI_UNSUPPORTED)
+		pr_err("XFAIL: Test not supported on this configuration\n");
+	else if (status != EFI_ABORTED || efi_enabled(EFI_RUNTIME_SERVICES))
+		pr_err("FAIL: EFI %s memory not caught (%#lx)\n",
+		       desc, status);
+}
+
+static void __maybe_unused lkdtm_EFI_RUNTIME_WRITE_TO_RO(void)
+{
+	efi_rt_test(EFI_LKDTM_RUNTIME_RO_TEST, "write to RO");
+}
+
+static void __maybe_unused lkdtm_EFI_RUNTIME_BRANCH_TO_NX(void)
+{
+	efi_rt_test(EFI_LKDTM_RUNTIME_NX_TEST, "branch to NX");
+}
+
 static struct crashtype crashtypes[] = {
 	CRASHTYPE(PANIC),
 	CRASHTYPE(PANIC_STOP_IRQOFF),
@@ -876,6 +897,8 @@ static struct crashtype crashtypes[] = {
 	CRASHTYPE(CORRUPT_PAC),
 #ifdef CONFIG_EFI
 	CRASHTYPE(EFI_RUNTIME_CRASH),
+	CRASHTYPE(EFI_RUNTIME_WRITE_TO_RO),
+	CRASHTYPE(EFI_RUNTIME_BRANCH_TO_NX),
 #endif
 };
 
diff --git a/include/linux/efi.h b/include/linux/efi.h
index fda81d7c4850..dfdb3352ad9d 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -631,6 +631,8 @@ typedef struct {
 
 extern unsigned long __ro_after_init efi_rng_seed;		/* RNG Seed table */
 
+enum efi_rts_ids;
+
 /*
  * All runtime access to EFI goes through this structure:
  */
@@ -666,6 +668,10 @@ extern struct efi {
 	efi_get_next_high_mono_count_t	*get_next_high_mono_count;
 	efi_reset_system_t		*reset_system;
 
+#ifdef CONFIG_LKDTM
+	efi_status_t			(*lkdtm_rt_test)(enum efi_rts_ids id);
+#endif
+
 	struct efi_memory_map		memmap;
 	unsigned long			flags;
 } efi;
@@ -1253,6 +1259,10 @@ enum efi_rts_ids {
 	EFI_UPDATE_CAPSULE,
 	EFI_QUERY_CAPSULE_CAPS,
 	EFI_ACPI_PRM_HANDLER,
+#ifdef CONFIG_LKDTM
+	EFI_LKDTM_RUNTIME_RO_TEST,
+	EFI_LKDTM_RUNTIME_NX_TEST,
+#endif
 };
 
 union efi_rts_args;
-- 
2.56.0.385.gd3acb90ef8-goog