From patchwork Fri Apr 22 13:51:23 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 66449 Delivered-To: patch@linaro.org Received: by 10.140.93.198 with SMTP id d64csp734307qge; Fri, 22 Apr 2016 06:52:08 -0700 (PDT) X-Received: by 10.66.132.37 with SMTP id or5mr28704113pab.144.1461333121215; Fri, 22 Apr 2016 06:52:01 -0700 (PDT) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id d10si7849649pap.88.2016.04.22.06.52.00; Fri, 22 Apr 2016 06:52:01 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754239AbcDVNv6 (ORCPT + 29 others); Fri, 22 Apr 2016 09:51:58 -0400 Received: from foss.arm.com ([217.140.101.70]:34537 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754216AbcDVNv4 (ORCPT ); Fri, 22 Apr 2016 09:51:56 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 89566547; Fri, 22 Apr 2016 06:50:38 -0700 (PDT) Received: from leverpostej.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 0AAFF3F211; Fri, 22 Apr 2016 06:51:53 -0700 (PDT) From: Mark Rutland To: linux-efi@vger.kernel.org Cc: ard.biesheuvel@linaro.org, catalin.marinas@arm.com, hpa@zytor.com, leif.lindholm@linaro.org, linux-arm-kernel@lists.infradead.org, linux@arm.linux.org.uk, linux-kernel@vger.kernel.org, mark.rutland@arm.com, matt@codeblueprint.co.uk, mingo@redhat.com, tglx@linutronix.de, will.deacon@arm.com Subject: [PATCHv2 6/6] efi/runtime-wrappers: detect FW irq flag corruption Date: Fri, 22 Apr 2016 14:51:23 +0100 Message-Id: <1461333083-15529-7-git-send-email-mark.rutland@arm.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1461333083-15529-1-git-send-email-mark.rutland@arm.com> References: <1461333083-15529-1-git-send-email-mark.rutland@arm.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The UEFI spec allows runtime services to be called with interrupts masked or unmasked, and if a runtime service function needs to mask interrupts, it must restore the mask to its original state before returning (i.e. from the PoV of the OS, this does not change across a call). Firmware should never unmask exceptions, as these may then be taken by the OS unexpectedly. Unfortunately, some firmware has been seen to unmask IRQs (and potentially other maskable exceptions) across runtime services calls, leaving irq flags corrupted after returning from a runtime services function call. This may be detected by the IRQ tracing code, but often goes unnoticed, leaving a potentially disastrous bug hidden. This patch detects when the irq flags are corrupted by an EFI runtime services call, logging the call and specific corruption to the console. While restoring the expected value of the flags is insufficient to avoid problems, we do so to avoid redundant warnings from elsewhere (e.g. IRQ tracing). Signed-off-by: Mark Rutland Reviewed-by: Ard Biesheuvel Cc: Matt Fleming Cc: linux-efi@vger.kernel.org Cc: linux-kernel@vger.kernel.org --- drivers/firmware/efi/runtime-wrappers.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) I'm not sure about the LOCKDEP_NOW_UNRELIABLE here. If FW unmasks IRQs there's the potential for deadlock, but arguably by the time we've detected the flag corruption the danger has passed. I'm erring on the side of caution here setting it, but perhaps that's not the best idea? Mark. -- 1.9.1 diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c index a2c8e70..19e30b7 100644 --- a/drivers/firmware/efi/runtime-wrappers.c +++ b/drivers/firmware/efi/runtime-wrappers.c @@ -16,23 +16,45 @@ #include #include +#include #include #include +#include #include +static void efi_call_virt_check_flags(unsigned long flags, const char *call) +{ + unsigned long cur_flags; + + local_save_flags(cur_flags); + if (!WARN_ON_ONCE(cur_flags != flags)) + return; + + add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_NOW_UNRELIABLE); + pr_err_ratelimited(FW_BUG "IRQ flags corrupted (0x%08lx=>0x%08lx) by EFI %s\n", + flags, cur_flags, call); + local_irq_restore(flags); +} + #define efi_call_virt(f, args...) \ ({ \ efi_status_t __s; \ + unsigned long flags; \ arch_efi_call_virt_setup(); \ + local_save_flags(flags); \ __s = arch_efi_call_virt(f, args); \ + efi_call_virt_check_flags(flags, __stringify(f)); \ arch_efi_call_virt_teardown(); \ __s; \ }) #define __efi_call_virt(f, args...) \ ({ \ + unsigned long flags; \ arch_efi_call_virt_setup(); \ + local_save_flags(flags); \ arch_efi_call_virt(f, args); \ + efi_call_virt_check_flags(flags, __stringify(f)); \ arch_efi_call_virt_teardown(); \ })