From 718ee46ba4d95d28d50d3f6437afbbe2be531175 Mon Sep 17 00:00:00 2001 From: Breno Leitao Date: Tue, 16 Jun 2026 05:09:34 -0700 Subject: [PATCH 01/10] efi: fix stale reference to efi_recover_from_page_fault() efi_recover_from_page_fault() was renamed to efi_crash_gracefully_on_page_fault(), but the comment above enum efi_rts_ids was not updated. Use the current name. Fixes: c46f52231e79 ("x86/{fault,efi}: Fix and rename efi_recover_from_page_fault()") Signed-off-by: Breno Leitao Signed-off-by: Ard Biesheuvel --- include/linux/efi.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/linux/efi.h b/include/linux/efi.h index ccbc35479684..24221a842412 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h @@ -1212,8 +1212,8 @@ efi_call_acpi_prm_handler(efi_status_t (__efiapi *handler_addr)(u64, void *), /* * efi_runtime_service() function identifiers. - * "NONE" is used by efi_recover_from_page_fault() to check if the page - * fault happened while executing an efi runtime service. + * "NONE" is used by efi_crash_gracefully_on_page_fault() to check if the + * page fault happened while executing an efi runtime service. */ enum efi_rts_ids { EFI_NONE, From ecbccdbdab5d31e1e465e3f789d57bb34e5452cd Mon Sep 17 00:00:00 2001 From: Breno Leitao Date: Tue, 16 Jun 2026 05:09:35 -0700 Subject: [PATCH 02/10] efi/runtime-wrappers: factor out efi_rts_park_worker() x86's efi_crash_gracefully_on_page_fault() ends in an infinite schedule() loop so the kworker that faulted in firmware never runs efi_rts_wq again. A later change needs the same "park this worker forever" primitive on the runtime service timeout path, so factor the loop into a shared efi_rts_park_worker() and call it from the x86 page-fault handler. No functional change. Signed-off-by: Breno Leitao Signed-off-by: Ard Biesheuvel --- arch/x86/platform/efi/quirks.c | 9 +-------- drivers/firmware/efi/runtime-wrappers.c | 15 ++++++++++++++- include/linux/efi.h | 2 ++ tools/objtool/noreturns.h | 1 + 4 files changed, 18 insertions(+), 9 deletions(-) diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c index 90a065fcb1fa..02c56a02eb9b 100644 --- a/arch/x86/platform/efi/quirks.c +++ b/arch/x86/platform/efi/quirks.c @@ -832,12 +832,5 @@ void efi_crash_gracefully_on_page_fault(unsigned long phys_addr, clear_bit(EFI_RUNTIME_SERVICES, &efi.flags); pr_info("Froze efi_rts_wq and disabled EFI Runtime Services\n"); - /* - * Call schedule() in an infinite loop, so that any spurious wake ups - * will never run efi_rts_wq again. - */ - for (;;) { - set_current_state(TASK_IDLE); - schedule(); - } + efi_rts_park_worker(); } diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c index da8d29621644..dc2e5c370edc 100644 --- a/drivers/firmware/efi/runtime-wrappers.c +++ b/drivers/firmware/efi/runtime-wrappers.c @@ -202,7 +202,7 @@ void efi_call_virt_check_flags(unsigned long flags, const void *caller) */ static DEFINE_SEMAPHORE(efi_runtime_lock, 1); -static struct task_struct *efi_runtime_lock_owner; +static struct task_struct *efi_runtime_lock_owner __used; /* * Expose the EFI runtime lock to the UV platform @@ -211,6 +211,19 @@ static struct task_struct *efi_runtime_lock_owner; extern struct semaphore __efi_uv_runtime_lock __alias(efi_runtime_lock); #endif +/* + * Park a worker that must never run efi_rts_wq again: EFI runtime services + * have been disabled and its efi_rts_work is abandoned. Loop in schedule() + * so a spurious wakeup cannot resume it. + */ +void __noreturn efi_rts_park_worker(void) +{ + for (;;) { + set_current_state(TASK_IDLE); + schedule(); + } +} + /* * Calls the appropriate efi_runtime_service() with the appropriate * arguments. diff --git a/include/linux/efi.h b/include/linux/efi.h index 24221a842412..b3c83516593d 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h @@ -1256,6 +1256,8 @@ extern struct efi_runtime_work efi_rts_work; /* Workqueue to queue EFI Runtime Services */ extern struct workqueue_struct *efi_rts_wq; +void __noreturn efi_rts_park_worker(void); + struct linux_efi_memreserve { int size; // allocated size of the array atomic_t count; // number of entries used diff --git a/tools/objtool/noreturns.h b/tools/objtool/noreturns.h index 14f8ab653449..0e9dfd0a2446 100644 --- a/tools/objtool/noreturns.h +++ b/tools/objtool/noreturns.h @@ -26,6 +26,7 @@ NORETURN(cpu_startup_entry) NORETURN(do_exit) NORETURN(do_group_exit) NORETURN(do_task_dead) +NORETURN(efi_rts_park_worker) NORETURN(ex_handler_msr_mce) NORETURN(hlt_play_dead) NORETURN(hv_ghcb_terminate) From c554d4e534bbfc9d88ffdbfeea754b4111843608 Mon Sep 17 00:00:00 2001 From: Breno Leitao Date: Tue, 16 Jun 2026 05:09:36 -0700 Subject: [PATCH 03/10] efi/runtime-wrappers: handle queue_work() failure with goto exit Convert the queue_work() failure path in __efi_queue_work() to a goto exit instead of falling through to the wait and the WARN_ON_ONCE(status == EFI_ABORTED) below it. A failed queue_work() leaves the status at its initial EFI_ABORTED, so that warning would fire even though no call ran; it is meant for a completed call that returned EFI_ABORTED. No change for the common (successful enqueue) path. This also prepares __efi_queue_work() for the timeout handling added later. Signed-off-by: Breno Leitao Signed-off-by: Ard Biesheuvel --- drivers/firmware/efi/runtime-wrappers.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c index dc2e5c370edc..4ff51860ccf5 100644 --- a/drivers/firmware/efi/runtime-wrappers.c +++ b/drivers/firmware/efi/runtime-wrappers.c @@ -351,10 +351,12 @@ static efi_status_t __efi_queue_work(enum efi_rts_ids id, * queue_work() returns 0 if work was already on queue, * _ideally_ this should never happen. */ - if (queue_work(efi_rts_wq, &efi_rts_work.work)) - wait_for_completion(&efi_rts_work.efi_rts_comp); - else + if (!queue_work(efi_rts_wq, &efi_rts_work.work)) { pr_err("Failed to queue work to efi_rts_wq.\n"); + goto exit; + } + + wait_for_completion(&efi_rts_work.efi_rts_comp); WARN_ON_ONCE(efi_rts_work.status == EFI_ABORTED); exit: From 7f64cb373f3dcc20d0e27e273dae10975a94d7e8 Mon Sep 17 00:00:00 2001 From: Breno Leitao Date: Tue, 16 Jun 2026 05:09:37 -0700 Subject: [PATCH 04/10] efi/runtime-wrappers: check EFI_RUNTIME_SERVICES before using efi_rts_work Move the EFI_RUNTIME_SERVICES check to the top of __efi_queue_work() and return directly, so a caller that finds runtime services disabled returns without touching the shared efi_rts_work. No functional change. This prepares for bounding the wait, where a timeout will clear EFI_RUNTIME_SERVICES while the leaked worker still owns efi_rts_work; a later caller must then bail out before reinitialising it. Signed-off-by: Breno Leitao Signed-off-by: Ard Biesheuvel --- drivers/firmware/efi/runtime-wrappers.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c index 4ff51860ccf5..f2cfdbd81085 100644 --- a/drivers/firmware/efi/runtime-wrappers.c +++ b/drivers/firmware/efi/runtime-wrappers.c @@ -333,17 +333,16 @@ static void __nocfi efi_call_rts(struct work_struct *work) static efi_status_t __efi_queue_work(enum efi_rts_ids id, union efi_rts_args *args) { + if (!efi_enabled(EFI_RUNTIME_SERVICES)) { + pr_warn_once("EFI Runtime Services are disabled!\n"); + return EFI_DEVICE_ERROR; + } + efi_rts_work.efi_rts_id = id; efi_rts_work.args = args; efi_rts_work.caller = __builtin_return_address(0); efi_rts_work.status = EFI_ABORTED; - if (!efi_enabled(EFI_RUNTIME_SERVICES)) { - pr_warn_once("EFI Runtime Services are disabled!\n"); - efi_rts_work.status = EFI_DEVICE_ERROR; - goto exit; - } - init_completion(&efi_rts_work.efi_rts_comp); INIT_WORK(&efi_rts_work.work, efi_call_rts); From 60618389de92444b3b11a6385c306109fc89c46a Mon Sep 17 00:00:00 2001 From: Breno Leitao Date: Tue, 16 Jun 2026 05:09:38 -0700 Subject: [PATCH 05/10] efi/runtime-wrappers: bound the wait for EFI runtime service calls When an EFI runtime service hangs in firmware, the efi_rts_wq worker is stuck inside the call and cannot be cancelled. __efi_queue_work() then waits on the completion forever while holding efi_runtime_lock, so every later EFI caller is wedged until reboot; the only symptom is a "workqueue lockup" and tasks piling up on the semaphore. Replace wait_for_completion() with wait_for_completion_timeout() bounded by EFI_RTS_TIMEOUT (120 seconds). On timeout, clear EFI_RUNTIME_SERVICES and return EFI_ABORTED so later callers fail fast at the entry check instead of each paying another 120 seconds. The wedged worker is intentionally leaked and keeps ownership of efi_rts_work. A worker that only starts running after the timeout would otherwise dereference efi_rts_work.args, now pointing into the caller's freed stack frame, and hand stale pointers to firmware. Park it with efi_rts_park_worker() at the entry of efi_call_rts() when runtime services are already disabled, before it touches args or enters firmware. Known limitation: a worker already inside firmware when the timeout fires still holds efi_rts_args pointing into the caller's stack frame; if firmware unblocks afterwards and writes the output buffers, they land in reused memory. Firmware hung this long rarely recovers; a follow-up could bounce the buffers through kmalloc. Signed-off-by: Breno Leitao Signed-off-by: Ard Biesheuvel --- drivers/firmware/efi/runtime-wrappers.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c index f2cfdbd81085..bf18270519d2 100644 --- a/drivers/firmware/efi/runtime-wrappers.c +++ b/drivers/firmware/efi/runtime-wrappers.c @@ -118,6 +118,14 @@ union efi_rts_args { struct efi_runtime_work efi_rts_work; +/* + * Upper bound on how long we wait for a single EFI runtime service + * call to finish before declaring firmware wedged. Chosen to be longer + * than any plausible legitimate call (including UpdateCapsule on slow + * SPI-NOR) while still bounding userspace wait time. + */ +#define EFI_RTS_TIMEOUT (120 * HZ) + /* * efi_queue_work: Queue EFI runtime service call and wait for completion * @_rts: EFI runtime service function identifier @@ -234,6 +242,9 @@ static void __nocfi efi_call_rts(struct work_struct *work) efi_status_t status = EFI_NOT_FOUND; unsigned long flags; + if (!efi_enabled(EFI_RUNTIME_SERVICES)) + efi_rts_park_worker(); + efi_runtime_lock_owner = current; arch_efi_call_virt_setup(); @@ -355,7 +366,13 @@ static efi_status_t __efi_queue_work(enum efi_rts_ids id, goto exit; } - wait_for_completion(&efi_rts_work.efi_rts_comp); + if (!wait_for_completion_timeout(&efi_rts_work.efi_rts_comp, + EFI_RTS_TIMEOUT)) { + pr_err("EFI runtime service %d wedged in firmware; disabling EFI runtime services\n", + id); + clear_bit(EFI_RUNTIME_SERVICES, &efi.flags); + return EFI_ABORTED; + } WARN_ON_ONCE(efi_rts_work.status == EFI_ABORTED); exit: From bb50e70f4ffe12ad1710883603ba8109bb5d6dfd Mon Sep 17 00:00:00 2001 From: Breno Leitao Date: Tue, 16 Jun 2026 05:09:39 -0700 Subject: [PATCH 06/10] efi/runtime-wrappers: honour EFI_RUNTIME_SERVICES in the non-blocking paths Three wrappers call firmware directly instead of going through __efi_queue_work(), and none of them check whether runtime services are still enabled: virt_efi_set_variable_nb(), virt_efi_query_variable_info_nb() and virt_efi_reset_system(). Once a hang has cleared EFI_RUNTIME_SERVICES - or efi_recover_from_page_fault() has cleared it on a firmware page fault - these paths still enter the (possibly wedged) firmware, e.g. an EFI pstore write through the non-blocking SetVariable() variant, in violation of UEFI's non-reentrancy rules. reset_system() is reachable too: efi_reboot() only gates it on the static efi_rt_services_supported() mask, which does not track the runtime disable. Check efi_enabled(EFI_RUNTIME_SERVICES) in each before calling into firmware. Test it after taking efi_runtime_lock rather than before: the bit is only ever cleared at runtime while that lock is held, so checking it under the lock avoids racing with a concurrent timeout that clears the bit and drops the lock. Suggested-by: Ard Biesheuvel Signed-off-by: Breno Leitao Signed-off-by: Ard Biesheuvel --- drivers/firmware/efi/runtime-wrappers.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c index bf18270519d2..ce1f93e33e2c 100644 --- a/drivers/firmware/efi/runtime-wrappers.c +++ b/drivers/firmware/efi/runtime-wrappers.c @@ -480,6 +480,11 @@ virt_efi_set_variable_nb(efi_char16_t *name, efi_guid_t *vendor, u32 attr, if (down_trylock(&efi_runtime_lock)) return EFI_NOT_READY; + if (!efi_enabled(EFI_RUNTIME_SERVICES)) { + up(&efi_runtime_lock); + return EFI_DEVICE_ERROR; + } + efi_runtime_lock_owner = current; status = efi_call_virt_pointer(efi.runtime, set_variable, name, vendor, attr, data_size, data); @@ -519,6 +524,11 @@ virt_efi_query_variable_info_nb(u32 attr, u64 *storage_space, if (down_trylock(&efi_runtime_lock)) return EFI_NOT_READY; + if (!efi_enabled(EFI_RUNTIME_SERVICES)) { + up(&efi_runtime_lock); + return EFI_DEVICE_ERROR; + } + efi_runtime_lock_owner = current; status = efi_call_virt_pointer(efi.runtime, query_variable_info, attr, storage_space, remaining_space, @@ -549,6 +559,12 @@ virt_efi_reset_system(int reset_type, efi_status_t status, return; } + if (!efi_enabled(EFI_RUNTIME_SERVICES)) { + pr_warn("EFI Runtime Services are disabled, not invoking reset_system()\n"); + up(&efi_runtime_lock); + return; + } + efi_runtime_lock_owner = current; arch_efi_call_virt_setup(); efi_rts_work.efi_rts_id = EFI_RESET_SYSTEM; From 4b2c033b5bc971a6a1e3c5cd2fa44421eb2ff84e Mon Sep 17 00:00:00 2001 From: Breno Leitao Date: Tue, 16 Jun 2026 05:09:40 -0700 Subject: [PATCH 07/10] efi/runtime-wrappers: retire the worker if a wedged call ever returns When __efi_queue_work() times out it disables runtime services and returns, but the kworker is still blocked inside firmware. If the firmware eventually unblocks, efi_call_rts() would run its tail on an efi_rts_work that the timed-out caller has long abandoned: signalling a stale completion and clearing efi_runtime_lock_owner that may by then belong to another caller. If runtime services have been disabled by the time the call returns, park the worker with efi_rts_park_worker() instead, so it never touches efi_rts_work again or returns to the workqueue. Suggested-by: Ard Biesheuvel Signed-off-by: Breno Leitao Signed-off-by: Ard Biesheuvel --- drivers/firmware/efi/runtime-wrappers.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c index ce1f93e33e2c..2344b9d1e81f 100644 --- a/drivers/firmware/efi/runtime-wrappers.c +++ b/drivers/firmware/efi/runtime-wrappers.c @@ -336,6 +336,9 @@ static void __nocfi efi_call_rts(struct work_struct *work) efi_call_virt_check_flags(flags, efi_rts_work.caller); arch_efi_call_virt_teardown(); + if (!efi_enabled(EFI_RUNTIME_SERVICES)) + efi_rts_park_worker(); + efi_rts_work.status = status; complete(&efi_rts_work.efi_rts_comp); efi_runtime_lock_owner = NULL; From 01787ed2fde4ac42bc35339dae799a5abb094ed0 Mon Sep 17 00:00:00 2001 From: Vincent Mailhol Date: Wed, 22 Jul 2026 23:22:25 +0200 Subject: [PATCH 08/10] efi: make efi_guid_to_str() take a const GUID pointer efi_guid_to_str() only formats the GUID through the byte array passed to the UUID printf formatter. It does not modify the GUID contents. Make the input pointer const so callers can stringify GUIDs from const data without a cast. Signed-off-by: Vincent Mailhol Signed-off-by: Ard Biesheuvel --- include/linux/efi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/efi.h b/include/linux/efi.h index b3c83516593d..aa15ff88539b 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h @@ -705,7 +705,7 @@ efi_guidcmp (efi_guid_t left, efi_guid_t right) } static inline char * -efi_guid_to_str(efi_guid_t *guid, char *out) +efi_guid_to_str(const efi_guid_t *guid, char *out) { sprintf(out, "%pUl", guid->b); return out; From eb01ffabeb52251f821c18438af8a65391f7ac79 Mon Sep 17 00:00:00 2001 From: Pengpeng Hou Date: Mon, 6 Jul 2026 17:18:13 +0800 Subject: [PATCH 09/10] efi: apple-properties: validate setup data header length map_properties() remaps the Apple properties setup_data payload and then reads the properties header fields. Reject a truncated payload before checking the header version and length fields. Signed-off-by: Pengpeng Hou Reviewed-by: Lukas Wunner Signed-off-by: Ard Biesheuvel --- drivers/firmware/efi/apple-properties.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/efi/apple-properties.c b/drivers/firmware/efi/apple-properties.c index 2e525e17fba7..f401a04edf4c 100644 --- a/drivers/firmware/efi/apple-properties.c +++ b/drivers/firmware/efi/apple-properties.c @@ -207,7 +207,10 @@ static int __init map_properties(void) } properties = (struct properties_header *)data->data; - if (properties->version != 1) { + if (data_len < sizeof(*properties)) { + pr_err("truncated properties header\n"); + ret = -EINVAL; + } else if (properties->version != 1) { pr_err("unsupported version:\n"); print_hex_dump(KERN_ERR, pr_fmt(), DUMP_PREFIX_OFFSET, 16, 1, properties, data_len, true); From b2326338dc683e8c1067c0cbf7a47986c4190902 Mon Sep 17 00:00:00 2001 From: Ard Biesheuvel Date: Sat, 1 Aug 2026 17:28:04 +0300 Subject: [PATCH 10/10] efivarfs: Rate limit statfs() handler Ravi reports that statfs() may be called by unprivileged users on the efivarfs mount point, which may result in a flood of calls to the QueryVariableInfo() runtime service. These calls are disproportionately costly on x86 systems where the variable store is backed by SMM, as each SMM entry requires a rendez-vous of all the CPUs. So rate limit the calls to QueryVariableInfo() at twice per second, and return the most recently obtained value for calls that are elided. Cc: Reported-by: Ravi Bangoria Fixes: d86ff3333cb1 ("efivarfs: expose used and total size") Reviewed-by: Anisse Astier Signed-off-by: Ard Biesheuvel --- fs/efivarfs/super.c | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-) diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c index 733c19571f1c..8d33f11db2a1 100644 --- a/fs/efivarfs/super.c +++ b/fs/efivarfs/super.c @@ -89,12 +89,30 @@ static int efivarfs_statfs(struct dentry *dentry, struct kstatfs *buf) /* Some UEFI firmware does not implement QueryVariableInfo() */ storage_space = remaining_space = 0; if (efi_rt_services_supported(EFI_RT_SUPPORTED_QUERY_VARIABLE_INFO)) { - status = efivar_query_variable_info(attr, &storage_space, - &remaining_space, - &max_variable_size); - if (status != EFI_SUCCESS && status != EFI_UNSUPPORTED) - pr_warn_ratelimited("query_variable_info() failed: 0x%lx\n", - status); + static DEFINE_RATELIMIT_STATE(_rs, 2 * HZ, 5); + static u64 storage, remaining; + static DEFINE_SPINLOCK(lock); + + if (!__ratelimit(&_rs)) { + ratelimit_set_flags(&_rs, RATELIMIT_MSG_ON_RELEASE); + + spin_lock(&lock); + storage_space = storage; + remaining_space = remaining; + spin_unlock(&lock); + } else { + status = efivar_query_variable_info(attr, &storage_space, + &remaining_space, + &max_variable_size); + if (status != EFI_SUCCESS && status != EFI_UNSUPPORTED) + pr_warn("query_variable_info() failed: 0x%lx\n", + status); + + spin_lock(&lock); + storage = storage_space; + remaining = remaining_space; + spin_unlock(&lock); + } } /*