Commit 7572ac3c authored by Ard Biesheuvel's avatar Ard Biesheuvel
Browse files

arm64: efi: Revert "Recover from synchronous exceptions ..." 



This reverts commit 23715a26, which introduced some code in
assembler that manipulates both the ordinary and the shadow call stack
pointer in a way that could potentially be taken advantage of. So let's
revert it, and do a better job the next time around.

Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
parent 9b9eaee9

arch/arm64/include/asm/efi.h

+0 −8
Original line number Diff line number Diff line
@@ -14,16 +14,8 @@ 


#ifdef CONFIG_EFI

extern void efi_init(void);



bool efi_runtime_fixup_exception(struct pt_regs *regs, const char *msg);

#else

#define efi_init()



static inline

bool efi_runtime_fixup_exception(struct pt_regs *regs, const char *msg)

{

	return false;

}

#endif



int efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md);

arch/arm64/kernel/efi-rt-wrapper.S

+2 −31
Original line number Diff line number Diff line
@@ -6,7 +6,7 @@ 
#include <linux/linkage.h>



SYM_FUNC_START(__efi_rt_asm_wrapper)

	stp	x29, x30, [sp, #-112]!

	stp	x29, x30, [sp, #-32]!

	mov	x29, sp



	/*
@@ -16,20 +16,6 @@ SYM_FUNC_START(__efi_rt_asm_wrapper) 
	 */

	stp	x1, x18, [sp, #16]



	/*

	 * Preserve all callee saved registers and record the stack pointer

	 * value in a per-CPU variable so we can recover from synchronous

	 * exceptions occurring while running the firmware routines.

	 */

	stp	x19, x20, [sp, #32]

	stp	x21, x22, [sp, #48]

	stp	x23, x24, [sp, #64]

	stp	x25, x26, [sp, #80]

	stp	x27, x28, [sp, #96]



	adr_this_cpu	x8, __efi_rt_asm_recover_sp, x9

	str		x29, [x8]



	/*

	 * We are lucky enough that no EFI runtime services take more than

	 * 5 arguments, so all are passed in registers rather than via the
@@ -45,7 +31,7 @@ SYM_FUNC_START(__efi_rt_asm_wrapper) 


	ldp	x1, x2, [sp, #16]

	cmp	x2, x18

	ldp	x29, x30, [sp], #112

	ldp	x29, x30, [sp], #32

	b.ne	0f

	ret

0:
@@ -59,18 +45,3 @@ SYM_FUNC_START(__efi_rt_asm_wrapper) 
	mov	x18, x2

	b	efi_handle_corrupted_x18	// tail call

SYM_FUNC_END(__efi_rt_asm_wrapper)
 


SYM_FUNC_START(__efi_rt_asm_recover)

	ldr_this_cpu	x8, __efi_rt_asm_recover_sp, x9

	mov		sp, x8



	ldp	x0,  x18, [sp, #16]

	ldp	x19, x20, [sp, #32]

	ldp	x21, x22, [sp, #48]

	ldp	x23, x24, [sp, #64]

	ldp	x25, x26, [sp, #80]

	ldp	x27, x28, [sp, #96]

	ldp	x29, x30, [sp], #112



	b	efi_handle_runtime_exception

SYM_FUNC_END(__efi_rt_asm_recover)

arch/arm64/kernel/efi.c

+0 −26
Original line number Diff line number Diff line
@@ -9,7 +9,6 @@ 


#include <linux/efi.h>

#include <linux/init.h>

#include <linux/percpu.h>



#include <asm/efi.h>
@@ -145,28 +144,3 @@ asmlinkage efi_status_t efi_handle_corrupted_x18(efi_status_t s, const char *f) 
	pr_err_ratelimited(FW_BUG "register x18 corrupted by EFI %s\n", f);

	return s;

}
 


asmlinkage DEFINE_PER_CPU(u64, __efi_rt_asm_recover_sp);



asmlinkage efi_status_t __efi_rt_asm_recover(void);



asmlinkage efi_status_t efi_handle_runtime_exception(const char *f)

{

	pr_err(FW_BUG "Synchronous exception occurred in EFI runtime service %s()\n", f);

	clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);

	return EFI_ABORTED;

}



bool efi_runtime_fixup_exception(struct pt_regs *regs, const char *msg)

{

	 /* Check whether the exception occurred while running the firmware */

	if (current_work() != &efi_rts_work.work || regs->pc >= TASK_SIZE_64)

		return false;



	pr_err(FW_BUG "Unable to handle %s in EFI runtime service\n", msg);

	add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);

	dump_stack();



	regs->pc = (u64)__efi_rt_asm_recover;

	return true;

}

arch/arm64/mm/fault.c

+0 −4
Original line number Diff line number Diff line
@@ -30,7 +30,6 @@ 
#include <asm/bug.h>

#include <asm/cmpxchg.h>

#include <asm/cpufeature.h>

#include <asm/efi.h>

#include <asm/exception.h>

#include <asm/daifflags.h>

#include <asm/debug-monitors.h>
@@ -392,9 +391,6 @@ static void __do_kernel_fault(unsigned long addr, unsigned long esr, 
		msg = "paging request";

	}



	if (efi_runtime_fixup_exception(regs, msg))

		return;



	die_kernel_fault(msg, addr, esr, regs);

}