f75a91c82d
commit ff7a167961d1b97e0e205f245f806e564d3505e7 upstream. With the introduction of PRMT in the ACPI subsystem, the EFI rts workqueue is no longer the only caller of efi_call_virt_pointer() in the kernel. This means the EFI runtime services lock is no longer sufficient to manage concurrent calls into firmware, but also that firmware calls may occur that are not marshalled via the workqueue mechanism, but originate directly from the caller context. For added robustness, and to ensure that the runtime services have 8 KiB of stack space available as per the EFI spec, introduce a spinlock protected EFI runtime stack of 8 KiB, where the spinlock also ensures serialization between the EFI rts workqueue (which itself serializes EFI runtime calls) and other callers of efi_call_virt_pointer(). While at it, use the stack pivot to avoid reloading the shadow call stack pointer from the ordinary stack, as doing so could produce a gadget to defeat it. Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Cc: Lee Jones <lee@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
59 lines
1.3 KiB
ArmAsm
59 lines
1.3 KiB
ArmAsm
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/*
|
|
* Copyright (C) 2018 Linaro Ltd <ard.biesheuvel@linaro.org>
|
|
*/
|
|
|
|
#include <linux/linkage.h>
|
|
|
|
SYM_FUNC_START(__efi_rt_asm_wrapper)
|
|
stp x29, x30, [sp, #-32]!
|
|
mov x29, sp
|
|
|
|
/*
|
|
* Register x18 is designated as the 'platform' register by the AAPCS,
|
|
* which means firmware running at the same exception level as the OS
|
|
* (such as UEFI) should never touch it.
|
|
*/
|
|
stp x1, x18, [sp, #16]
|
|
|
|
ldr_l x16, efi_rt_stack_top
|
|
mov sp, x16
|
|
#ifdef CONFIG_SHADOW_CALL_STACK
|
|
str x18, [sp, #-16]!
|
|
#endif
|
|
|
|
/*
|
|
* We are lucky enough that no EFI runtime services take more than
|
|
* 5 arguments, so all are passed in registers rather than via the
|
|
* stack.
|
|
*/
|
|
mov x8, x0
|
|
mov x0, x2
|
|
mov x1, x3
|
|
mov x2, x4
|
|
mov x3, x5
|
|
mov x4, x6
|
|
blr x8
|
|
|
|
mov sp, x29
|
|
ldp x1, x2, [sp, #16]
|
|
cmp x2, x18
|
|
ldp x29, x30, [sp], #32
|
|
b.ne 0f
|
|
ret
|
|
0:
|
|
/*
|
|
* With CONFIG_SHADOW_CALL_STACK, the kernel uses x18 to store a
|
|
* shadow stack pointer, which we need to restore before returning to
|
|
* potentially instrumented code. This is safe because the wrapper is
|
|
* called with preemption disabled and a separate shadow stack is used
|
|
* for interrupts.
|
|
*/
|
|
#ifdef CONFIG_SHADOW_CALL_STACK
|
|
ldr_l x18, efi_rt_stack_top
|
|
ldr x18, [x18, #-16]
|
|
#endif
|
|
|
|
b efi_handle_corrupted_x18 // tail call
|
|
SYM_FUNC_END(__efi_rt_asm_wrapper)
|