From patchwork Mon Apr 25 20:07:08 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matt Fleming X-Patchwork-Id: 66616 Delivered-To: patch@linaro.org Received: by 10.140.93.198 with SMTP id d64csp1233447qge; Mon, 25 Apr 2016 13:08:51 -0700 (PDT) X-Received: by 10.98.38.66 with SMTP id m63mr14357919pfm.57.1461614928025; Mon, 25 Apr 2016 13:08:48 -0700 (PDT) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id px5si8638929pab.182.2016.04.25.13.08.47; Mon, 25 Apr 2016 13:08:48 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@codeblueprint-co-uk.20150623.gappssmtp.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965136AbcDYUIn (ORCPT + 29 others); Mon, 25 Apr 2016 16:08:43 -0400 Received: from mail-wm0-f43.google.com ([74.125.82.43]:37384 "EHLO mail-wm0-f43.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965076AbcDYUI2 (ORCPT ); Mon, 25 Apr 2016 16:08:28 -0400 Received: by mail-wm0-f43.google.com with SMTP id n3so145616517wmn.0 for ; Mon, 25 Apr 2016 13:08:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=codeblueprint-co-uk.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=gDAGBxlkD6GIW7qWXFDF3MMZuuWw9LUnPC/16ORtKGI=; b=Hqte0fJgU+QgCP7/8Hhhm0giS4Z3qM39WoXqYqm6viYasiA/rQKRLxlxVrCg/ujAXw yLOFQlAQb7Opk0+rNoVEbrRFtj43N5sCXbU0pn9/HpmjqMFeCg5IY/iLTFqOrYZX3tA0 RWZY9+hStXQKanHJ4qJxHLJTG7EjuQsDjhh1XrGkwpBfKnDKSjJe5vbRsV4VwMCTGBld 4XNRNLylkhVi09sBbMlVeoKWCKXymNGuuQ0kjDVlMQBrHEXyBlXuyUdHl4ikhHyta5yH 1K7fNSmrz6Ttf6pox/EK8f1hCvmfWwM2+qkcY5ettkAN2MAukkrqYnp+aiE1tbpGW10N HgBA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=gDAGBxlkD6GIW7qWXFDF3MMZuuWw9LUnPC/16ORtKGI=; b=NGAxnWUBXcKZi5tmCLFYqKkCEEq9TupEWIj7OhVsls5VrVF2gtpVNUDlyqiTQ8mojM 9ODUeQ/aqLh1a1sNdB4BLLNC/I/RZAJaFjNPITMuafjOlXG9SAlRON41zfvefUMQ321K xML3j9nHkPZz5buiIavbMWnk1cpXB5OInaFvHMGizE7fiWl5RmfcGzNEENI6GjoOpwPL 7S/wMDg4KxZG2h6Psfe6IlEb6DVPHELAi82scPG+hljBtNWYnblIC72/mmd06pgAKk7q 53KbL7qFz3AC2ohTvfRB6/n0E0OKxmGtSx2CSLx/cCUwh9PVc9WKHkwVoGW/I7+q+Vav 8vYg== X-Gm-Message-State: AOPr4FXvIVh4aOsbQK8vcPWdXYgs3Sb44iSzlRJWX7MezxQ8gY4U0dXQOsLZKlZ0LG7Waw== X-Received: by 10.28.188.7 with SMTP id m7mr7031568wmf.37.1461614905349; Mon, 25 Apr 2016 13:08:25 -0700 (PDT) Received: from localhost (bcdc58e5.skybroadband.com. [188.220.88.229]) by smtp.gmail.com with ESMTPSA id gr4sm25098671wjd.23.2016.04.25.13.08.24 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 25 Apr 2016 13:08:24 -0700 (PDT) From: Matt Fleming To: Ingo Molnar , Thomas Gleixner , "H . Peter Anvin" Cc: Mark Rutland , Ard Biesheuvel , linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, Matt Fleming , Catalin Marinas , Leif Lindholm , Robin Murphy , Russell King , Will Deacon Subject: [PATCH 36/40] efi/runtime-wrappers: Detect firmware irq flag corruption Date: Mon, 25 Apr 2016 21:07:08 +0100 Message-Id: <1461614832-17633-37-git-send-email-matt@codeblueprint.co.uk> X-Mailer: git-send-email 2.7.3 In-Reply-To: <1461614832-17633-1-git-send-email-matt@codeblueprint.co.uk> References: <1461614832-17633-1-git-send-email-matt@codeblueprint.co.uk> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Mark Rutland The UEFI spec allows runtime services to be called with interrupts masked or unmasked, and if a runtime service function needs to mask interrupts, it must restore the mask to its original state before returning (i.e. from the PoV of the OS, this does not change across a call). Firmware should never unmask exceptions, as these may then be taken by the OS unexpectedly. Unfortunately, some firmware has been seen to unmask IRQs (and potentially other maskable exceptions) across runtime services calls, leaving irq flags corrupted after returning from a runtime services function call. This may be detected by the IRQ tracing code, but often goes unnoticed, leaving a potentially disastrous bug hidden. This patch detects when the irq flags are corrupted by an EFI runtime services call, logging the call and specific corruption to the console. While restoring the expected value of the flags is insufficient to avoid problems, we do so to avoid redundant warnings from elsewhere (e.g. IRQ tracing). The set of bits in flags which we want to check is architecture-specific (e.g. we want to check FIQ on arm64, but not the zero flag on x86), so each arch must provide ARCH_EFI_IRQ_FLAGS_MASK to describe those. In the absence of this mask, the check is a no-op, and we redundantly save the flags twice, but that will be short-lived as subsequent patches will implement this and remove the scaffolding. Signed-off-by: Mark Rutland Cc: Ard Biesheuvel Cc: Matt Fleming Cc: linux-efi@vger.kernel.org Cc: Catalin Marinas Cc: "H. Peter Anvin" Cc: Leif Lindholm Cc: Russell King Cc: Thomas Gleixner Cc: Will Deacon Cc: Robin Murphy Signed-off-by: Matt Fleming --- drivers/firmware/efi/runtime-wrappers.c | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) -- 2.7.3 diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c index b9ece374d4d3..89dcdb3a16a2 100644 --- a/drivers/firmware/efi/runtime-wrappers.c +++ b/drivers/firmware/efi/runtime-wrappers.c @@ -16,11 +16,36 @@ #include #include +#include #include #include +#include #include /* + * Temporary scaffolding until all users provide ARCH_EFI_IRQ_FLAGS_MASK. + */ +#ifdef ARCH_EFI_IRQ_FLAGS_MASK +static void efi_call_virt_check_flags(unsigned long flags, const char *call) +{ + unsigned long cur_flags, mismatch; + + local_save_flags(cur_flags); + + mismatch = flags ^ cur_flags; + if (!WARN_ON_ONCE(mismatch & ARCH_EFI_IRQ_FLAGS_MASK)) + return; + + add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_NOW_UNRELIABLE); + pr_err_ratelimited(FW_BUG "IRQ flags corrupted (0x%08lx=>0x%08lx) by EFI %s\n", + flags, cur_flags, call); + local_irq_restore(flags); +} +#else /* ARCH_EFI_IRQ_FLAGS_MASK */ +static inline void efi_call_virt_check_flags(unsigned long flags, const char *call) {} +#endif /* ARCH_EFI_IRQ_FLAGS_MASK */ + +/* * Arch code can implement the following three template macros, avoiding * reptition for the void/non-void return cases of {__,}efi_call_virt: * @@ -43,16 +68,22 @@ #define efi_call_virt(f, args...) \ ({ \ efi_status_t __s; \ + unsigned long flags; \ arch_efi_call_virt_setup(); \ + local_save_flags(flags); \ __s = arch_efi_call_virt(f, args); \ + efi_call_virt_check_flags(flags, __stringify(f)); \ arch_efi_call_virt_teardown(); \ __s; \ }) #define __efi_call_virt(f, args...) \ ({ \ + unsigned long flags; \ arch_efi_call_virt_setup(); \ + local_save_flags(flags); \ arch_efi_call_virt(f, args); \ + efi_call_virt_check_flags(flags, __stringify(f)); \ arch_efi_call_virt_teardown(); \ })