[PATCH] efi/runtime-wrappers: Don't park the worker after a recovered firmware fault

[PATCH] efi/runtime-wrappers: Don't park the worker after a recovered firmware fault

[Ard Biesheuvel]

From: Ard Biesheuvel <ardb@kernel.org>

Commit 4b2c033b5bc9 ("efi/runtime-wrappers: retire the worker if a wedged
call ever returns") parks the efi_rts_wq worker instead of completing the
call if EFI runtime services have been disabled by the time the firmware
returns. The assumption is that this only happens if __efi_queue_work()
has given up waiting for the call.

However, arm64 also disables EFI runtime services when it recovers from a
synchronous exception taken by the firmware: efi_runtime_fixup_exception()
clears EFI_RUNTIME_SERVICES and unwinds the call so that it returns
EFI_ABORTED to efi_call_rts(), while the caller is still waiting for the
completion. The worker now parks without signalling it, so the caller is
stuck for the full EFI_RTS_TIMEOUT of 120 seconds, after which it reports
that the firmware is wedged, which is misleading.

x86 is not affected, as it signals the completion from its page fault
handler before parking the worker.

So record explicitly that the caller has given up on the call, and only
park the worker in that case.

Fixes: 4b2c033b5bc9 ("efi/runtime-wrappers: retire the worker if a wedged call ever returns")
Cc: Breno Leitao <leitao@debian.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
I don't remember the details exactly, but I think this is probably my
fault, as I think I suggested using the EFI_RUNTIME_SERVICES flag to
signal that EFI runtime services are now considered broken.


 drivers/firmware/efi/runtime-wrappers.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c
index 740f422df337..33f256dd3d2c 100644
--- a/drivers/firmware/efi/runtime-wrappers.c
+++ b/drivers/firmware/efi/runtime-wrappers.c
@@ -126,6 +126,12 @@ struct efi_runtime_work efi_rts_work;
  */
 #define EFI_RTS_TIMEOUT		(120 * HZ)
 
+/*
+ * Set when __efi_queue_work() gives up waiting for a call that is wedged in
+ * firmware. EFI runtime services are disabled for good at that point.
+ */
+static bool efi_rts_abandoned;
+
 /*
  * efi_queue_work:	Queue EFI runtime service call and wait for completion
  * @_rts:		EFI runtime service function identifier
@@ -336,7 +342,12 @@ static void __nocfi efi_call_rts(struct work_struct *work)
 	efi_call_virt_check_flags(flags, efi_rts_work.caller);
 	arch_efi_call_virt_teardown();
 
-	if (!efi_enabled(EFI_RUNTIME_SERVICES))
+	/*
+	 * EFI runtime services may also have been disabled because the
+	 * firmware faulted, but the caller is still waiting for us in that
+	 * case. Only park the worker if the caller has given up on it.
+	 */
+	if (READ_ONCE(efi_rts_abandoned))
 		efi_rts_park_worker();
 
 	efi_rts_work.status = status;
@@ -373,6 +384,7 @@ static efi_status_t __efi_queue_work(enum efi_rts_ids id,
 					 EFI_RTS_TIMEOUT)) {
 		pr_err("EFI runtime service %d wedged in firmware; disabling EFI runtime services\n",
 		       id);
+		WRITE_ONCE(efi_rts_abandoned, true);
 		clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
 		return EFI_ABORTED;
 	}
-- 
2.56.0.385.gd3acb90ef8-goog

Re: [PATCH] efi/runtime-wrappers: Don't park the worker after a recovered firmware fault

[Breno Leitao]

On Fri, Oct 09, 2026 at 04:48:15PM +0200, Ard Biesheuvel wrote:
> From: Ard Biesheuvel <ardb@kernel.org>
> 
> Commit 4b2c033b5bc9 ("efi/runtime-wrappers: retire the worker if a wedged
> call ever returns") parks the efi_rts_wq worker instead of completing the
> call if EFI runtime services have been disabled by the time the firmware
> returns. The assumption is that this only happens if __efi_queue_work()
> has given up waiting for the call.
> 
> However, arm64 also disables EFI runtime services when it recovers from a
> synchronous exception taken by the firmware: efi_runtime_fixup_exception()
> clears EFI_RUNTIME_SERVICES and unwinds the call so that it returns
> EFI_ABORTED to efi_call_rts(), while the caller is still waiting for the
> completion. The worker now parks without signalling it, so the caller is
> stuck for the full EFI_RTS_TIMEOUT of 120 seconds, after which it reports
> that the firmware is wedged, which is misleading.
> 
> x86 is not affected, as it signals the completion from its page fault
> handler before parking the worker.
> 
> So record explicitly that the caller has given up on the call, and only
> park the worker in that case.
> 
> Fixes: 4b2c033b5bc9 ("efi/runtime-wrappers: retire the worker if a wedged call ever returns")
> Cc: Breno Leitao <leitao@debian.org>
> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>

Reviewed-by: Breno Leitao <leitao@debian.org>