On Fri, 9 Dec 2022 at 11:51, Mark Rutland <mark.rutland@xxxxxxx> wrote: > > Hi Ard, > > One drive-by comment below... > > On Mon, Dec 05, 2022 at 09:12:09PM +0100, Ard Biesheuvel wrote: > > With the introduction of PRMT in the ACPI subsystem, the EFI rts > > workqueue is no longer the only caller of efi_call_virt_pointer() in the > > kernel. This means the EFI runtime services lock is no longer sufficient > > to manage concurrent calls into firmware, but also that firmware calls > > may occur that are not marshalled via the workqueue mechanism, but > > originate directly from the caller context. > > > > For added robustness, and to ensure that the runtime services have 8 KiB > > of stack space available as per the EFI spec, introduce a spinlock > > protected EFI runtime stack of 8 KiB, where the spinlock also ensures > > serialization between the EFI rts workqueue (which itself serializes EFI > > runtime calls) and other callers of efi_call_virt_pointer(). > > > > While at it, use the stack pivot to avoid reloading the shadow call > > stack pointer from the ordinary stack, as doing so could produce a > > gadget to defeat it. > > > > Signed-off-by: Ard Biesheuvel <ardb@xxxxxxxxxx> > > --- > > arch/arm64/include/asm/efi.h | 3 +++ > > arch/arm64/kernel/efi-rt-wrapper.S | 13 +++++++++- > > arch/arm64/kernel/efi.c | 25 ++++++++++++++++++++ > > We'll need to teach the stack unwinder about this, or if we take an exception > from the EFI stack, the backtrace will terminate as soon as it hits a frame > record on the EFI stack. > > In arch/arm64/kernel/stacktrace.c's arch_stack_walk(), that'll need to be added > to the array of stack bounds. Ideally we'd only add that when a thread is > making an EFI call. > Thanks, I'll look into that.
