From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ard Biesheuvel Subject: Re: Regression from efi: call get_event_log before ExitBootServices Date: Mon, 12 Mar 2018 14:56:08 +0000 Message-ID: References: <01000161fc0b4755-df0621f4-ab5d-479a-b425-adf98427a308-000000@email.amazonses.com> <0100016206a68850-bd5c96b3-f275-46ea-98b1-1317e02a5d6e-000000@email.amazonses.com> <29c1640a-cf19-ca19-7de9-96f202edfb5a@redhat.com> <010001620bafa06b-41525407-603e-40a9-ba11-6033b2f5dcc7-000000@email.amazonses.com> <010001621a9e5069-0b1a6328-97e4-4396-9438-b90f5b8c82a4-000000@email.amazonses.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="001a114a85969ab76f05673857d4" Return-path: In-Reply-To: <010001621a9e5069-0b1a6328-97e4-4396-9438-b90f5b8c82a4-000000@email.amazonses.com> Sender: linux-kernel-owner@vger.kernel.org To: Jeremy Cline Cc: Thiebaud Weksteen , Hans de Goede , Javier Martinez Canillas , Jarkko Sakkinen , linux-efi@vger.kernel.org, linux-integrity@vger.kernel.org, tpmdd-devel@lists.sourceforge.net, Linux Kernel Mailing List List-Id: tpmdd-devel@lists.sourceforge.net --001a114a85969ab76f05673857d4 Content-Type: text/plain; charset="UTF-8" On 12 March 2018 at 14:30, Jeremy Cline wrote: > On 03/12/2018 07:08 AM, Ard Biesheuvel wrote: >> On 10 March 2018 at 10:45, Thiebaud Weksteen wrote: >>> On Fri, Mar 9, 2018 at 5:54 PM Jeremy Cline wrote: >>> >>>> On Fri, Mar 09, 2018 at 10:43:50AM +0000, Thiebaud Weksteen wrote: >>>>> Thanks a lot for trying out the patch! >>>>> >>>>> Please don't modify your install at this stage, I think we are hitting a >>>>> firmware bug and that would be awesome if we can fix how we are >>> handling it. >>>>> So, if we reach that stage in the function it could either be that: >>>>> * The allocation did not succeed, somehow, but the firmware still >>> returned >>>>> EFI_SUCCEED. >>>>> * The size requested is incorrect (I'm thinking something like a 1G of >>>>> log). This would be due to either a miscalculation of log_size >>> (possible) >>>>> or; the returned values of GetEventLog are not correct. >>>>> I'm sending a patch to add checks for these. Could you please apply and >>>>> retest? >>>>> Again, thanks for helping debugging this. >>> >>>> No problem, thanks for the help :) >>> >>>> With the new patch: >>> >>>> Locating the TCG2Protocol >>>> Calling GetEventLog on TCG2Protocol >>>> Log returned >>>> log_location is not empty >>>> log_size != 0 >>>> log_size < 1M >>>> Allocating memory for storing the logs >>>> Returned from memory allocation >>>> Copying log to new location >>> >>>> And then it hangs. I added a couple more print statements: >>> >>>> diff --git a/drivers/firmware/efi/libstub/tpm.c >>> b/drivers/firmware/efi/libstub/tpm.c >>>> index ee3fac109078..1ab5638bc50e 100644 >>>> --- a/drivers/firmware/efi/libstub/tpm.c >>>> +++ b/drivers/firmware/efi/libstub/tpm.c >>>> @@ -148,8 +148,11 @@ void >>> efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg) >>>> efi_printk(sys_table_arg, "Copying log to new location\n"); >>> >>>> memset(log_tbl, 0, sizeof(*log_tbl) + log_size); >>>> + efi_printk(sys_table_arg, "Successfully memset log_tbl to 0\n"); >>>> log_tbl->size = log_size; >>>> + efi_printk(sys_table_arg, "Set log_tbl->size\n"); >>>> log_tbl->version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2; >>>> + efi_printk(sys_table_arg, "Set log_tbl-version\n"); >>>> memcpy(log_tbl->log, (void *) first_entry_addr, log_size); >>> >>>> efi_printk(sys_table_arg, "Installing the log into the >>> configuration table\n"); >>> >>>> and it's hanging at "memset(log_tbl, 0, sizeof(*log_tbl) + log_size);" >>> >>> Thanks. Well, it looks like the memory that is supposedly allocated is not >>> usable. I'm thinking this is a firmware bug. >>> Ard, would you agree on this assumption? Thoughts on how to proceed? >>> >> >> I am rather puzzled why the allocate_pool() should succeed and the >> subsequent memset() should fail. This does not look like an issue that >> is intimately related to TPM2 support, rather an issue in the firmware >> that happens to get tickled after the change. >> >> Would you mind trying replacing EFI_LOADER_DATA with >> EFI_BOOT_SERVICES_DATA in the allocate_pool() call? > > Replacing EFI_LOADER_DATA with EFI_BOOT_SERVICES_DATA still hangs at the > memset() call. > Could you try the following please? (attached as well in case gmail mangles it) diff --git a/drivers/firmware/efi/libstub/tpm.c b/drivers/firmware/efi/libstub/tpm.c index 2298560cea72..30d960a344b7 100644 --- a/drivers/firmware/efi/libstub/tpm.c +++ b/drivers/firmware/efi/libstub/tpm.c @@ -70,6 +70,8 @@ void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg) size_t log_size, last_entry_size; efi_bool_t truncated; void *tcg2_protocol; + unsigned long num_pages; + efi_physical_addr_t log_tbl_alloc; status = efi_call_early(locate_protocol, &tcg2_guid, NULL, &tcg2_protocol); @@ -104,9 +106,12 @@ void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg) } /* Allocate space for the logs and copy them. */ - status = efi_call_early(allocate_pool, EFI_LOADER_DATA, - sizeof(*log_tbl) + log_size, - (void **) &log_tbl); + num_pages = DIV_ROUND_UP(sizeof(*log_tbl) + log_size, EFI_PAGE_SIZE); + status = efi_call_early(allocate_pages, + EFI_ALLOCATE_ANY_PAGES, + EFI_LOADER_DATA, + num_pages, + &log_tbl_alloc); if (status != EFI_SUCCESS) { efi_printk(sys_table_arg, @@ -114,6 +119,7 @@ void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg) return; } + log_tbl = (struct linux_efi_tpm_eventlog *)(unsigned long)log_tbl_alloc; memset(log_tbl, 0, sizeof(*log_tbl) + log_size); log_tbl->size = log_size; log_tbl->version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2; @@ -126,7 +132,7 @@ void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg) return; err_free: - efi_call_early(free_pool, log_tbl); + efi_call_early(free_pages, log_tbl_alloc, num_pages); } void efi_retrieve_tpm2_eventlog(efi_system_table_t *sys_table_arg) --001a114a85969ab76f05673857d4 Content-Type: text/x-patch; charset="US-ASCII"; name="efitpm.diff" Content-Disposition: attachment; filename="efitpm.diff" Content-Transfer-Encoding: base64 X-Attachment-Id: f_jeocnnyp0 ZGlmZiAtLWdpdCBhL2RyaXZlcnMvZmlybXdhcmUvZWZpL2xpYnN0dWIvdHBtLmMgYi9kcml2ZXJz L2Zpcm13YXJlL2VmaS9saWJzdHViL3RwbS5jCmluZGV4IDIyOTg1NjBjZWE3Mi4uMzBkOTYwYTM0 NGI3IDEwMDY0NAotLS0gYS9kcml2ZXJzL2Zpcm13YXJlL2VmaS9saWJzdHViL3RwbS5jCisrKyBi L2RyaXZlcnMvZmlybXdhcmUvZWZpL2xpYnN0dWIvdHBtLmMKQEAgLTcwLDYgKzcwLDggQEAgdm9p ZCBlZmlfcmV0cmlldmVfdHBtMl9ldmVudGxvZ18xXzIoZWZpX3N5c3RlbV90YWJsZV90ICpzeXNf dGFibGVfYXJnKQogCXNpemVfdCBsb2dfc2l6ZSwgbGFzdF9lbnRyeV9zaXplOwogCWVmaV9ib29s X3QgdHJ1bmNhdGVkOwogCXZvaWQgKnRjZzJfcHJvdG9jb2w7CisJdW5zaWduZWQgbG9uZyBudW1f cGFnZXM7CisJZWZpX3BoeXNpY2FsX2FkZHJfdCBsb2dfdGJsX2FsbG9jOwogCiAJc3RhdHVzID0g ZWZpX2NhbGxfZWFybHkobG9jYXRlX3Byb3RvY29sLCAmdGNnMl9ndWlkLCBOVUxMLAogCQkJCSZ0 Y2cyX3Byb3RvY29sKTsKQEAgLTEwNCw5ICsxMDYsMTIgQEAgdm9pZCBlZmlfcmV0cmlldmVfdHBt Ml9ldmVudGxvZ18xXzIoZWZpX3N5c3RlbV90YWJsZV90ICpzeXNfdGFibGVfYXJnKQogCX0KIAog CS8qIEFsbG9jYXRlIHNwYWNlIGZvciB0aGUgbG9ncyBhbmQgY29weSB0aGVtLiAqLwotCXN0YXR1 cyA9IGVmaV9jYWxsX2Vhcmx5KGFsbG9jYXRlX3Bvb2wsIEVGSV9MT0FERVJfREFUQSwKLQkJCQlz aXplb2YoKmxvZ190YmwpICsgbG9nX3NpemUsCi0JCQkJKHZvaWQgKiopICZsb2dfdGJsKTsKKwlu dW1fcGFnZXMgPSBESVZfUk9VTkRfVVAoc2l6ZW9mKCpsb2dfdGJsKSArIGxvZ19zaXplLCBFRklf UEFHRV9TSVpFKTsKKwlzdGF0dXMgPSBlZmlfY2FsbF9lYXJseShhbGxvY2F0ZV9wYWdlcywKKwkJ CQlFRklfQUxMT0NBVEVfQU5ZX1BBR0VTLAorCQkJCUVGSV9MT0FERVJfREFUQSwKKwkJCQludW1f cGFnZXMsCisJCQkJJmxvZ190YmxfYWxsb2MpOwogCiAJaWYgKHN0YXR1cyAhPSBFRklfU1VDQ0VT UykgewogCQllZmlfcHJpbnRrKHN5c190YWJsZV9hcmcsCkBAIC0xMTQsNiArMTE5LDcgQEAgdm9p ZCBlZmlfcmV0cmlldmVfdHBtMl9ldmVudGxvZ18xXzIoZWZpX3N5c3RlbV90YWJsZV90ICpzeXNf dGFibGVfYXJnKQogCQlyZXR1cm47CiAJfQogCisJbG9nX3RibCA9IChzdHJ1Y3QgbGludXhfZWZp X3RwbV9ldmVudGxvZyAqKSh1bnNpZ25lZCBsb25nKWxvZ190YmxfYWxsb2M7CiAJbWVtc2V0KGxv Z190YmwsIDAsIHNpemVvZigqbG9nX3RibCkgKyBsb2dfc2l6ZSk7CiAJbG9nX3RibC0+c2l6ZSA9 IGxvZ19zaXplOwogCWxvZ190YmwtPnZlcnNpb24gPSBFRklfVENHMl9FVkVOVF9MT0dfRk9STUFU X1RDR18xXzI7CkBAIC0xMjYsNyArMTMyLDcgQEAgdm9pZCBlZmlfcmV0cmlldmVfdHBtMl9ldmVu dGxvZ18xXzIoZWZpX3N5c3RlbV90YWJsZV90ICpzeXNfdGFibGVfYXJnKQogCXJldHVybjsKIAog ZXJyX2ZyZWU6Ci0JZWZpX2NhbGxfZWFybHkoZnJlZV9wb29sLCBsb2dfdGJsKTsKKwllZmlfY2Fs bF9lYXJseShmcmVlX3BhZ2VzLCBsb2dfdGJsX2FsbG9jLCBudW1fcGFnZXMpOwogfQogCiB2b2lk IGVmaV9yZXRyaWV2ZV90cG0yX2V2ZW50bG9nKGVmaV9zeXN0ZW1fdGFibGVfdCAqc3lzX3RhYmxl X2FyZykK --001a114a85969ab76f05673857d4--