From 2c493ac8c347167eec9e4e985d2b58d5fa6fd420 Mon Sep 17 00:00:00 2001 From: Ard Biesheuvel Date: Sun, 11 Oct 2026 13:20:48 +0200 Subject: lkdtm: Add more EFI runtime tests Two bugs were found in the arm64 EFI runtime support that weren't caught by LKDTM. The existing EFI_RUNTIME_CRASH test instructs the firmware to write to kernel memory that is mapped read-only, which usually fails as expected. However, this does not exercise the runtime mapping logic in the kernel, nor the fault recovery logic when the faulting address is inside the EFI runtime memory regions itself. So add two more test cases: - a write to R/O memory test that uses the firmware's own executable memory as an output buffer - a branch to memory that is occupied by the firmware's runtime services function table, which is usually mapped non-execute. This depends on the EFI memory attributes table having been exposed by the firmware and having been taken into account by the runtime mapping code, so this is used as a prerequisite by the new tests, otherwise it produces an XFAIL. Reviewed-by: Kees Cook Signed-off-by: Ard Biesheuvel --- include/linux/efi.h | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'include/linux') diff --git a/include/linux/efi.h b/include/linux/efi.h index cd8728702e93..cc1df1577d5f 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h @@ -631,6 +631,8 @@ typedef struct { extern unsigned long __ro_after_init efi_rng_seed; /* RNG Seed table */ +enum efi_rts_ids; + /* * All runtime access to EFI goes through this structure: */ @@ -667,6 +669,10 @@ extern struct efi { efi_get_next_high_mono_count_t *get_next_high_mono_count; efi_reset_system_t *reset_system; +#if IS_ENABLED(CONFIG_LKDTM) + efi_status_t (*lkdtm_rt_test)(enum efi_rts_ids id); +#endif + struct efi_memory_map memmap; unsigned long flags; } efi; @@ -1254,6 +1260,10 @@ enum efi_rts_ids { EFI_UPDATE_CAPSULE, EFI_QUERY_CAPSULE_CAPS, EFI_ACPI_PRM_HANDLER, +#if IS_ENABLED(CONFIG_LKDTM) + EFI_LKDTM_RUNTIME_RO_TEST, + EFI_LKDTM_RUNTIME_NX_TEST, +#endif }; union efi_rts_args; -- cgit v1.2.3