From: Mark Rutland <mark.rutland@arm.com> To: linux-efi@vger.kernel.org Cc: ard.biesheuvel@linaro.org, catalin.marinas@arm.com, hpa@zytor.com, leif.lindholm@linaro.org, linux-arm-kernel@lists.infradead.org, linux@arm.linux.org.uk, linux-kernel@vger.kernel.org, mark.rutland@arm.com, matt@codeblueprint.co.uk, mingo@redhat.com, tglx@linutronix.de, will.deacon@arm.com Subject: [PATCHv3 1/5] efi/runtime-wrappers: detect FW irq flag corruption Date: Mon, 25 Apr 2016 14:46:30 +0100 [thread overview] Message-ID: <1461591994-14918-2-git-send-email-mark.rutland@arm.com> (raw) In-Reply-To: <1461591994-14918-1-git-send-email-mark.rutland@arm.com> The UEFI spec allows runtime services to be called with interrupts masked or unmasked, and if a runtime service function needs to mask interrupts, it must restore the mask to its original state before returning (i.e. from the PoV of the OS, this does not change across a call). Firmware should never unmask exceptions, as these may then be taken by the OS unexpectedly. Unfortunately, some firmware has been seen to unmask IRQs (and potentially other maskable exceptions) across runtime services calls, leaving irq flags corrupted after returning from a runtime services function call. This may be detected by the IRQ tracing code, but often goes unnoticed, leaving a potentially disastrous bug hidden. This patch detects when the irq flags are corrupted by an EFI runtime services call, logging the call and specific corruption to the console. While restoring the expected value of the flags is insufficient to avoid problems, we do so to avoid redundant warnings from elsewhere (e.g. IRQ tracing). The set of bits in flags which we want to check is architecture-specific (e.g. we want to check FIQ on arm64, but not the zero flag on x86), so each arch must provide ARCH_EFI_IRQ_FLAGS_MASK to describe those. In the absence of this mask, the check is a no-op, and we redundantly save the flags twice, but that will be short-lived as subsequent patches will implement this and remove the scaffolding. Signed-off-by: Mark Rutland <mark.rutland@arm.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Matt Fleming <matt@codeblueprint.co.uk> Cc: linux-efi@vger.kernel.org --- drivers/firmware/efi/runtime-wrappers.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c index a2c8e70..1f0277e 100644 --- a/drivers/firmware/efi/runtime-wrappers.c +++ b/drivers/firmware/efi/runtime-wrappers.c @@ -16,23 +16,55 @@ #include <linux/bug.h> #include <linux/efi.h> +#include <linux/irqflags.h> #include <linux/mutex.h> #include <linux/spinlock.h> +#include <linux/stringify.h> #include <asm/efi.h> +/* + * Temporary scaffolding until all users provide ARCH_EFI_IRQ_FLAGS_MASK. + */ +#ifdef ARCH_EFI_IRQ_FLAGS_MASK +static void efi_call_virt_check_flags(unsigned long flags, const char *call) +{ + unsigned long cur_flags; + bool mismatch; + + local_save_flags(cur_flags); + + mismatch = !!((cur_flags ^ flags) & ARCH_EFI_IRQ_FLAGS_MASK); + if (!WARN_ON_ONCE(mismatch)) + return; + + add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_NOW_UNRELIABLE); + pr_err_ratelimited(FW_BUG "IRQ flags corrupted (0x%08lx=>0x%08lx) by EFI %s\n", + flags, cur_flags, call); + local_irq_restore(flags); +} +#else /* ARCH_EFI_IRQ_FLAGS_MASK */ +static inline void efi_call_virt_check_flags(unsigned long flags, const char *call) {} +#endif /* ARCH_EFI_IRQ_FLAGS_MASK */ + #define efi_call_virt(f, args...) \ ({ \ efi_status_t __s; \ + unsigned long flags; \ arch_efi_call_virt_setup(); \ + local_save_flags(flags); \ __s = arch_efi_call_virt(f, args); \ + efi_call_virt_check_flags(flags, __stringify(f)); \ arch_efi_call_virt_teardown(); \ __s; \ }) #define __efi_call_virt(f, args...) \ ({ \ + unsigned long flags; \ arch_efi_call_virt_setup(); \ + local_save_flags(flags); \ arch_efi_call_virt(f, args); \ + efi_call_virt_check_flags(flags, __stringify(f)); \ arch_efi_call_virt_teardown(); \ }) -- 1.9.1
WARNING: multiple messages have this Message-ID (diff)
From: mark.rutland@arm.com (Mark Rutland) To: linux-arm-kernel@lists.infradead.org Subject: [PATCHv3 1/5] efi/runtime-wrappers: detect FW irq flag corruption Date: Mon, 25 Apr 2016 14:46:30 +0100 [thread overview] Message-ID: <1461591994-14918-2-git-send-email-mark.rutland@arm.com> (raw) In-Reply-To: <1461591994-14918-1-git-send-email-mark.rutland@arm.com> The UEFI spec allows runtime services to be called with interrupts masked or unmasked, and if a runtime service function needs to mask interrupts, it must restore the mask to its original state before returning (i.e. from the PoV of the OS, this does not change across a call). Firmware should never unmask exceptions, as these may then be taken by the OS unexpectedly. Unfortunately, some firmware has been seen to unmask IRQs (and potentially other maskable exceptions) across runtime services calls, leaving irq flags corrupted after returning from a runtime services function call. This may be detected by the IRQ tracing code, but often goes unnoticed, leaving a potentially disastrous bug hidden. This patch detects when the irq flags are corrupted by an EFI runtime services call, logging the call and specific corruption to the console. While restoring the expected value of the flags is insufficient to avoid problems, we do so to avoid redundant warnings from elsewhere (e.g. IRQ tracing). The set of bits in flags which we want to check is architecture-specific (e.g. we want to check FIQ on arm64, but not the zero flag on x86), so each arch must provide ARCH_EFI_IRQ_FLAGS_MASK to describe those. In the absence of this mask, the check is a no-op, and we redundantly save the flags twice, but that will be short-lived as subsequent patches will implement this and remove the scaffolding. Signed-off-by: Mark Rutland <mark.rutland@arm.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Matt Fleming <matt@codeblueprint.co.uk> Cc: linux-efi at vger.kernel.org --- drivers/firmware/efi/runtime-wrappers.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c index a2c8e70..1f0277e 100644 --- a/drivers/firmware/efi/runtime-wrappers.c +++ b/drivers/firmware/efi/runtime-wrappers.c @@ -16,23 +16,55 @@ #include <linux/bug.h> #include <linux/efi.h> +#include <linux/irqflags.h> #include <linux/mutex.h> #include <linux/spinlock.h> +#include <linux/stringify.h> #include <asm/efi.h> +/* + * Temporary scaffolding until all users provide ARCH_EFI_IRQ_FLAGS_MASK. + */ +#ifdef ARCH_EFI_IRQ_FLAGS_MASK +static void efi_call_virt_check_flags(unsigned long flags, const char *call) +{ + unsigned long cur_flags; + bool mismatch; + + local_save_flags(cur_flags); + + mismatch = !!((cur_flags ^ flags) & ARCH_EFI_IRQ_FLAGS_MASK); + if (!WARN_ON_ONCE(mismatch)) + return; + + add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_NOW_UNRELIABLE); + pr_err_ratelimited(FW_BUG "IRQ flags corrupted (0x%08lx=>0x%08lx) by EFI %s\n", + flags, cur_flags, call); + local_irq_restore(flags); +} +#else /* ARCH_EFI_IRQ_FLAGS_MASK */ +static inline void efi_call_virt_check_flags(unsigned long flags, const char *call) {} +#endif /* ARCH_EFI_IRQ_FLAGS_MASK */ + #define efi_call_virt(f, args...) \ ({ \ efi_status_t __s; \ + unsigned long flags; \ arch_efi_call_virt_setup(); \ + local_save_flags(flags); \ __s = arch_efi_call_virt(f, args); \ + efi_call_virt_check_flags(flags, __stringify(f)); \ arch_efi_call_virt_teardown(); \ __s; \ }) #define __efi_call_virt(f, args...) \ ({ \ + unsigned long flags; \ arch_efi_call_virt_setup(); \ + local_save_flags(flags); \ arch_efi_call_virt(f, args); \ + efi_call_virt_check_flags(flags, __stringify(f)); \ arch_efi_call_virt_teardown(); \ }) -- 1.9.1
next prev parent reply other threads:[~2016-04-25 13:46 UTC|newest] Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top 2016-04-25 13:46 [PATCHv3 0/5] efi: detect erroneous firmware IRQ manipulation Mark Rutland 2016-04-25 13:46 ` Mark Rutland 2016-04-25 13:46 ` Mark Rutland 2016-04-25 13:46 ` Mark Rutland [this message] 2016-04-25 13:46 ` [PATCHv3 1/5] efi/runtime-wrappers: detect FW irq flag corruption Mark Rutland 2016-04-25 14:12 ` Robin Murphy 2016-04-25 14:12 ` Robin Murphy 2016-04-25 14:12 ` Robin Murphy 2016-04-25 14:15 ` Matt Fleming 2016-04-25 14:15 ` Matt Fleming 2016-04-25 14:18 ` Ard Biesheuvel 2016-04-25 14:18 ` Ard Biesheuvel 2016-04-25 14:18 ` Ard Biesheuvel 2016-04-25 14:24 ` Matt Fleming 2016-04-25 14:24 ` Matt Fleming 2016-04-25 14:24 ` Matt Fleming 2016-04-25 14:27 ` Mark Rutland 2016-04-25 14:27 ` Mark Rutland 2016-04-25 14:27 ` Mark Rutland 2016-04-25 15:59 ` Matt Fleming 2016-04-25 15:59 ` Matt Fleming 2016-04-25 15:59 ` Matt Fleming 2016-04-25 16:03 ` Mark Rutland 2016-04-25 16:03 ` Mark Rutland 2016-04-25 16:03 ` Mark Rutland 2016-04-25 14:33 ` Robin Murphy 2016-04-25 14:33 ` Robin Murphy 2016-04-25 14:33 ` Robin Murphy 2016-04-25 13:46 ` [PATCHv3 2/5] arm64/efi: enable runtime call flag checking Mark Rutland 2016-04-25 13:46 ` Mark Rutland 2016-04-25 13:46 ` Mark Rutland 2016-04-25 13:54 ` Will Deacon 2016-04-25 13:54 ` Will Deacon 2016-04-25 13:46 ` [PATCHv3 3/5] arm/efi: " Mark Rutland 2016-04-25 13:46 ` Mark Rutland 2016-04-25 13:46 ` [PATCHv3 4/5] x86/efi: " Mark Rutland 2016-04-25 13:46 ` Mark Rutland 2016-04-25 13:46 ` [PATCHv3 5/5] efi/runtime-wrappers: remove ARCH_EFI_IRQ_FLAGS_MASK ifdef Mark Rutland 2016-04-25 13:46 ` Mark Rutland 2016-04-25 16:03 ` [PATCHv3 0/5] efi: detect erroneous firmware IRQ manipulation Matt Fleming 2016-04-25 16:03 ` Matt Fleming 2016-04-25 16:03 ` Matt Fleming
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1461591994-14918-2-git-send-email-mark.rutland@arm.com \ --to=mark.rutland@arm.com \ --cc=ard.biesheuvel@linaro.org \ --cc=catalin.marinas@arm.com \ --cc=hpa@zytor.com \ --cc=leif.lindholm@linaro.org \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-efi@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux@arm.linux.org.uk \ --cc=matt@codeblueprint.co.uk \ --cc=mingo@redhat.com \ --cc=tglx@linutronix.de \ --cc=will.deacon@arm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.