BACKPORT: arm64: efi: Execute runtime services from a dedicated stack
commit ff7a167961d1b97e0e205f245f806e564d3505e7 upstream. With the introduction of PRMT in the ACPI subsystem, the EFI rts workqueue is no longer the only caller of efi_call_virt_pointer() in the kernel. This means the EFI runtime services lock is no longer sufficient to manage concurrent calls into firmware, but also that firmware calls may occur that are not marshalled via the workqueue mechanism, but originate directly from the caller context. For added robustness, and to ensure that the runtime services have 8 KiB of stack space available as per the EFI spec, introduce a spinlock protected EFI runtime stack of 8 KiB, where the spinlock also ensures serialization between the EFI rts workqueue (which itself serializes EFI runtime calls) and other callers of efi_call_virt_pointer(). While at it, use the stack pivot to avoid reloading the shadow call stack pointer from the ordinary stack, as doing so could produce a gadget to defeat it. Bug: 260821414 Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Cc: Lee Jones <lee@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: Ie961576ae93cafc315cb37fb84cca0a6402eda59 (cherry picked from commit 67884a649c141a44d91400df6ca0a5ef55e1771a) [Lee: Swap-out the non-existent __vmalloc_node() for __vmalloc_node_range()]
This commit is contained in:
parent
a9acc03ab8
commit
96bc083042
3 changed files with 42 additions and 2 deletions
|
@ -25,6 +25,7 @@ int efi_set_mapping_permissions(struct mm_struct *mm, efi_memory_desc_t *md);
|
||||||
({ \
|
({ \
|
||||||
efi_virtmap_load(); \
|
efi_virtmap_load(); \
|
||||||
__efi_fpsimd_begin(); \
|
__efi_fpsimd_begin(); \
|
||||||
|
spin_lock(&efi_rt_lock); \
|
||||||
})
|
})
|
||||||
|
|
||||||
#define arch_efi_call_virt(p, f, args...) \
|
#define arch_efi_call_virt(p, f, args...) \
|
||||||
|
@ -36,10 +37,12 @@ int efi_set_mapping_permissions(struct mm_struct *mm, efi_memory_desc_t *md);
|
||||||
|
|
||||||
#define arch_efi_call_virt_teardown() \
|
#define arch_efi_call_virt_teardown() \
|
||||||
({ \
|
({ \
|
||||||
|
spin_unlock(&efi_rt_lock); \
|
||||||
__efi_fpsimd_end(); \
|
__efi_fpsimd_end(); \
|
||||||
efi_virtmap_unload(); \
|
efi_virtmap_unload(); \
|
||||||
})
|
})
|
||||||
|
|
||||||
|
extern spinlock_t efi_rt_lock;
|
||||||
efi_status_t __efi_rt_asm_wrapper(void *, const char *, ...);
|
efi_status_t __efi_rt_asm_wrapper(void *, const char *, ...);
|
||||||
|
|
||||||
#define ARCH_EFI_IRQ_FLAGS_MASK (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT)
|
#define ARCH_EFI_IRQ_FLAGS_MASK (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT)
|
||||||
|
|
|
@ -19,6 +19,12 @@ ENTRY(__efi_rt_asm_wrapper)
|
||||||
*/
|
*/
|
||||||
stp x1, x18, [sp, #16]
|
stp x1, x18, [sp, #16]
|
||||||
|
|
||||||
|
ldr_l x16, efi_rt_stack_top
|
||||||
|
mov sp, x16
|
||||||
|
#ifdef CONFIG_SHADOW_CALL_STACK
|
||||||
|
str x18, [sp, #-16]!
|
||||||
|
#endif
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* We are lucky enough that no EFI runtime services take more than
|
* We are lucky enough that no EFI runtime services take more than
|
||||||
* 5 arguments, so all are passed in registers rather than via the
|
* 5 arguments, so all are passed in registers rather than via the
|
||||||
|
@ -32,19 +38,22 @@ ENTRY(__efi_rt_asm_wrapper)
|
||||||
mov x4, x6
|
mov x4, x6
|
||||||
blr x8
|
blr x8
|
||||||
|
|
||||||
|
mov sp, x29
|
||||||
ldp x1, x2, [sp, #16]
|
ldp x1, x2, [sp, #16]
|
||||||
cmp x2, x18
|
cmp x2, x18
|
||||||
ldp x29, x30, [sp], #32
|
ldp x29, x30, [sp], #32
|
||||||
b.ne 0f
|
b.ne 0f
|
||||||
ret
|
ret
|
||||||
0:
|
0:
|
||||||
#ifdef CONFIG_SHADOW_CALL_STACK
|
|
||||||
/*
|
/*
|
||||||
* Restore x18 before returning to instrumented code. This is
|
* Restore x18 before returning to instrumented code. This is
|
||||||
* safe because the wrapper is called with preemption disabled and
|
* safe because the wrapper is called with preemption disabled and
|
||||||
* a separate shadow stack is used for interrupts.
|
* a separate shadow stack is used for interrupts.
|
||||||
*/
|
*/
|
||||||
mov x18, x2
|
#ifdef CONFIG_SHADOW_CALL_STACK
|
||||||
|
ldr_l x18, efi_rt_stack_top
|
||||||
|
ldr x18, [x18, #-16]
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
b efi_handle_corrupted_x18 // tail call
|
b efi_handle_corrupted_x18 // tail call
|
||||||
ENDPROC(__efi_rt_asm_wrapper)
|
ENDPROC(__efi_rt_asm_wrapper)
|
||||||
|
|
|
@ -148,3 +148,31 @@ asmlinkage efi_status_t efi_handle_corrupted_x18(efi_status_t s, const char *f)
|
||||||
pr_err_ratelimited(FW_BUG "register x18 corrupted by EFI %s\n", f);
|
pr_err_ratelimited(FW_BUG "register x18 corrupted by EFI %s\n", f);
|
||||||
return s;
|
return s;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
DEFINE_SPINLOCK(efi_rt_lock);
|
||||||
|
|
||||||
|
asmlinkage u64 *efi_rt_stack_top __ro_after_init;
|
||||||
|
|
||||||
|
/* EFI requires 8 KiB of stack space for runtime services */
|
||||||
|
_Static_assert(THREAD_SIZE >= SZ_8K);
|
||||||
|
|
||||||
|
static int __init arm64_efi_rt_init(void)
|
||||||
|
{
|
||||||
|
void *p;
|
||||||
|
|
||||||
|
if (!efi_enabled(EFI_RUNTIME_SERVICES))
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
p = __vmalloc_node_range(THREAD_SIZE, THREAD_ALIGN, VMALLOC_START,
|
||||||
|
VMALLOC_END, GFP_KERNEL, PAGE_KERNEL, 0,
|
||||||
|
NUMA_NO_NODE, &&l);
|
||||||
|
l: if (!p) {
|
||||||
|
pr_warn("Failed to allocate EFI runtime stack\n");
|
||||||
|
clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
|
||||||
|
return -ENOMEM;
|
||||||
|
}
|
||||||
|
|
||||||
|
efi_rt_stack_top = p + THREAD_SIZE;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
core_initcall(arm64_efi_rt_init);
|
||||||
|
|
Loading…
Reference in a new issue