[PATCH v4 resend 0/7] arm64: Make EFI calls preemptible

Ard Biesheuvel
2025-10-15T21:01:03Z

The arm64 port permits the use of the baseline FP/SIMD register file in
kernel mode, and no longer requires preemption to be disabled. Now that
the EFI spec is being clarified to state that EFI runtime services may
only use baseline FP/SIMD, the fact that EFI may code may use FP/SIMD
registers (while executing at the same privilege level as the kernel) is
no longer a reason to disable preemption when invoking them.

This means that the only remaining reason for disabling preemption is
the fact that the active mm is swapped out and replaced with efi_mm in a
way that is hidden from the scheduler, and so scheduling is not
supported currently. However, given that virtually all (*) EFI runtime
calls are made from the efi_rts_wq workqueue, the efi_mm can simply be
loaded into the workqueue worker kthread while the call is in progress,
and this does not require preemption to be disabled.

Note that this is only a partial solution in terms of RT guarantees,
given that the runtime services execute at the same privilege level as
the kernel, and can therefore disable interrupts (and therefore
preemption) directly. But it should prevent scheduling latency spikes
for EFI calls that simply take a long time to run to completion.

No changes since v4, rebase to v6.18-rc1 only.

Changes since v3:
- Abandon changes that disallow EFI runtime calls in hardirq or NMI
context, as these might occur when EFI pstore records an OOPS into the
EFI variable store. Note that this suggests that preserving/restoring
userland SVE state in such cases is rather futile, but this can be
revisited at a later time.
- Drop the lock in the arch wrapper, which has become redundant now that
all EFI calls are serialized under the efi_runtime_lock semaphore
- Add code comment to patch #4 to explain the kludge
- Add some acks from Will

Changes since v2:
- Permit ordinary kernel mode FP/SIMD with IRQs disabled, so that the
special EFI case only deals with invocations in hardirq or NMI context
- Disallow EFI runtime calls in hardirq or NMI context, so that the
special FP/SIMD handling for EFI can be dropped entirely
- Use a mutex rather than a semaphore for the arm64 EFI runtime lock,
now that it is never trylock()ed in IRQ or NMI context.

Changes since v1/RFC:
- Disable uaccess for SWPAN before updating the preserved TTBR0 value
- Document why disabling migration is needed
- Rebase onto v6.17-rc1

(*) only efi_reset_system() and EFI pstore invoke EFI runtime services
without going through the workqueue, and the latter only when saving
a kernel oops log to the EFI varstore

Cc: Will Deacon <will@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Pierre Gondois <Pierre.Gondois@arm.com>
Cc: Sami Mujawar <Sami.Mujawar@arm.com>

Ard Biesheuvel (7):
efi: Add missing static initializer for efi_mm::cpus_allowed_lock
efi/runtime-wrappers: Keep track of the efi_runtime_lock owner
arm64/fpsimd: Don't warn when EFI execution context is preemptible
arm64/fpsimd: Permit kernel mode NEON with IRQs off
arm64/efi: Drop efi_rt_lock spinlock from EFI arch wrapper
arm64/efi: Move uaccess en/disable out of efi_set_pgd()
arm64/efi: Call EFI runtime services without disabling preemption

arch/arm64/include/asm/efi.h | 13 ++----
arch/arm64/include/asm/simd.h | 2 +-
arch/arm64/kernel/efi.c | 46 +++++++++++++++++---
arch/arm64/kernel/fpsimd.c | 29 ++++++++----
drivers/firmware/efi/efi.c | 3 ++
drivers/firmware/efi/runtime-wrappers.c | 17 +++++++-
include/linux/efi.h | 2 +
7 files changed, 86 insertions(+), 26 deletions(-)

base-commit: 3a8660878839faadb4f1a6dd72c3179c1df56787
--
2.51.0.869.ge66316f041-goog