iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

arm64: efi: Revert "Recover from synchronous exceptions ..."

Browse Source 
This reverts commit 23715a26c8d81291, which introduced some code in
assembler that manipulates both the ordinary and the shadow call stack
pointer in a way that could potentially be taken advantage of. So let's
revert it, and do a better job the next time around.

Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
This commit is contained in:
Ard Biesheuvel 2022-11-30 17:37:17 +01:00
parent 9b9eaee982
commit 7572ac3c97
4 changed files with 2 additions and 69 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
arch/arm64/include/asm/efi.h
View File

@ -14,16 +14,8 @@
#ifdef CONFIG_EFI
extern void efi_init(void);
bool efi_runtime_fixup_exception(struct pt_regs *regs, const char *msg);
#else
#define efi_init()
static inline
bool efi_runtime_fixup_exception(struct pt_regs *regs, const char *msg)
{
return false;
}
#endif
int efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md);

33
arch/arm64/kernel/efi-rt-wrapper.S
View File

@ -6,7 +6,7 @@
#include <linux/linkage.h>
SYM_FUNC_START(__efi_rt_asm_wrapper)
stp x29, x30, [sp, #-112]!
stp x29, x30, [sp, #-32]!
mov x29, sp
/*
@ -16,20 +16,6 @@ SYM_FUNC_START(__efi_rt_asm_wrapper)
*/
stp x1, x18, [sp, #16]
/*
* Preserve all callee saved registers and record the stack pointer
* value in a per-CPU variable so we can recover from synchronous
* exceptions occurring while running the firmware routines.
*/
stp x19, x20, [sp, #32]
stp x21, x22, [sp, #48]
stp x23, x24, [sp, #64]
stp x25, x26, [sp, #80]
stp x27, x28, [sp, #96]
adr_this_cpu x8, __efi_rt_asm_recover_sp, x9
str x29, [x8]
/*
* We are lucky enough that no EFI runtime services take more than
* 5 arguments, so all are passed in registers rather than via the
@ -45,7 +31,7 @@ SYM_FUNC_START(__efi_rt_asm_wrapper)
ldp x1, x2, [sp, #16]
cmp x2, x18
ldp x29, x30, [sp], #112
ldp x29, x30, [sp], #32
b.ne 0f
ret
0:
@ -59,18 +45,3 @@ SYM_FUNC_START(__efi_rt_asm_wrapper)
mov x18, x2
b efi_handle_corrupted_x18 // tail call
SYM_FUNC_END(__efi_rt_asm_wrapper)
SYM_FUNC_START(__efi_rt_asm_recover)
ldr_this_cpu x8, __efi_rt_asm_recover_sp, x9
mov sp, x8
ldp x0, x18, [sp, #16]
ldp x19, x20, [sp, #32]
ldp x21, x22, [sp, #48]
ldp x23, x24, [sp, #64]
ldp x25, x26, [sp, #80]
ldp x27, x28, [sp, #96]
ldp x29, x30, [sp], #112
b efi_handle_runtime_exception
SYM_FUNC_END(__efi_rt_asm_recover)

26
arch/arm64/kernel/efi.c
View File

@ -9,7 +9,6 @@
#include <linux/efi.h>
#include <linux/init.h>
#include <linux/percpu.h>
#include <asm/efi.h>
@ -145,28 +144,3 @@ asmlinkage efi_status_t efi_handle_corrupted_x18(efi_status_t s, const char *f)
pr_err_ratelimited(FW_BUG "register x18 corrupted by EFI %s\n", f);
return s;
}
asmlinkage DEFINE_PER_CPU(u64, __efi_rt_asm_recover_sp);
asmlinkage efi_status_t __efi_rt_asm_recover(void);
asmlinkage efi_status_t efi_handle_runtime_exception(const char *f)
{
pr_err(FW_BUG "Synchronous exception occurred in EFI runtime service %s()\n", f);
clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
return EFI_ABORTED;
}
bool efi_runtime_fixup_exception(struct pt_regs *regs, const char *msg)
{
/* Check whether the exception occurred while running the firmware */
if (current_work() != &efi_rts_work.work || regs->pc >= TASK_SIZE_64)
return false;
pr_err(FW_BUG "Unable to handle %s in EFI runtime service\n", msg);
add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
dump_stack();
regs->pc = (u64)__efi_rt_asm_recover;
return true;
}

4
arch/arm64/mm/fault.c
View File

@ -30,7 +30,6 @@
#include <asm/bug.h>
#include <asm/cmpxchg.h>
#include <asm/cpufeature.h>
#include <asm/efi.h>
#include <asm/exception.h>
#include <asm/daifflags.h>
#include <asm/debug-monitors.h>
@ -392,9 +391,6 @@ static void __do_kernel_fault(unsigned long addr, unsigned long esr,
msg = "paging request";
}
if (efi_runtime_fixup_exception(regs, msg))
return;
die_kernel_fault(msg, addr, esr, regs);
}