From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail05.groups.io (mail05.groups.io [45.79.224.7]) by spool.mail.gandi.net (Postfix) with ESMTPS id DE1F4D810B3 for ; Wed, 15 Jan 2025 18:52:53 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=Sy2Zr+7wZ9wP9JdL+mLBpF9qE3NKmOvUv0GcVQv01jE=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Resent-Date:Resent-From:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20240830; t=1736967173; v=1; x=1737226372; b=lDIGlTPi2I00SnUPUuAV8+1sVJ6H3yqp8l28ediaJLjrwWmwu9glXLCPgrg/NSKSxu0y1WA+ nYTE4ZHSqd2yCTB4H7MaWsxIOimOdS26ZddTd8IumiFsa7mghKCVM0rADEgMFTj012gmY0tUKf8 2y1a/oJZKNjdcMzdRze1o8IaD4cEMesOTD3f+cMRKFbAJOXgADkryP+QFlfaE74b4hiLO/2Rak9 d/DUXDYzEFcg7OdRMVlLkkin9WUQ9NJXlqTjF87bibMa8pI6q0t/BQEGamcJy/fTYAbQGXvD3D1 GR4hjnu6K8IlzXCXOB+Kkd2flvotgo4DKosEgEvRLxvGA== X-Received: by 127.0.0.2 with SMTP id ysRCYY7687511xWUsLQcGdlJ; Wed, 15 Jan 2025 10:52:52 -0800 X-Received: from mail-qv1-f45.google.com (mail-qv1-f45.google.com [209.85.219.45]) by mx.groups.io with SMTP id smtpd.web10.33048.1736373618676435191 for ; Wed, 08 Jan 2025 14:00:18 -0800 X-Received: by mail-qv1-f45.google.com with SMTP id 6a1803df08f44-6dcdd9a3e54so2837026d6.3 for ; Wed, 08 Jan 2025 14:00:18 -0800 (PST) X-Forwarded-Encrypted: i=1; AJvYcCXCrt88e/3nM3zz6+x6P/0NyIwUzz68AvMvV6dDue2tjHEE//iCOAF1+6QpFb+00cwtW/HD2g==@edk2.groups.io X-Gm-Message-State: MliwMAQOx5t4cp45tfvU9hhhx7686176AA= X-Gm-Gg: ASbGncs9UiTh1gi1VA334tCbDuFqT2uBMa1wFZdVET9T+5eRNWtcW4hZzkrNFI1X2zM UA26R1UxnvgS+5pu6zPVz3F+Rde0mtn/jJUBHI7+/mcznEpc1BU7VXtFSEqls3IZtI3uEhbR83D lT7yzUsfQdGkQMcqFt/467+iKbr09q8oP2uLo72Gb/5bwhpmpRtqYzH3RZ4cOF6ayeu7SEjjGB1 T9eZm/+Hd/MaUv5eumqdVNa4pgSU0e5J4dxE8tX0xYyXA/QxT5SjK4= X-Google-Smtp-Source: AGHT+IF4hH60nxcnGXdqVmtHpLDsAQ0bc+xnqwT1KrZUp9d8EtouYvj31KMcJ5KbHMY1SOUkw+kr9g== X-Received: by 2002:a05:6214:e8b:b0:6d8:81cd:a0ce with SMTP id 6a1803df08f44-6df9b327016mr89269066d6.43.1736373617535; Wed, 08 Jan 2025 14:00:17 -0800 (PST) X-Received: from localhost ([2a03:2880:20ff:72::]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-6dd1813858csm194311126d6.70.2025.01.08.14.00.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 08 Jan 2025 14:00:16 -0800 (PST) From: "Usama Arif via groups.io" To: linux-efi@vger.kernel.org, devel@edk2.groups.io, kexec@lists.infradead.org Cc: ardb@kernel.org, hannes@cmpxchg.org, dyoung@redhat.com, x86@kernel.org, linux-kernel@vger.kernel.org, leitao@debian.org, gourry@gourry.net, kernel-team@meta.com, Usama Arif Subject: [edk2-devel] [RFC 0/2] efi/memattr: Fix memory corruption and warning issues Date: Wed, 8 Jan 2025 21:53:35 +0000 Message-ID: <20250108215957.3437660-1-usamaarif642@gmail.com> MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Resent-Date: Wed, 15 Jan 2025 10:52:51 -0800 Resent-From: usamaarif642@gmail.com Reply-To: devel@edk2.groups.io,usamaarif642@gmail.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: Content-Transfer-Encoding: 8bit X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20240830 header.b=lDIGlTPi; spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 45.79.224.7 as permitted sender) smtp.mailfrom=bounce@groups.io; dmarc=pass (policy=none) header.from=groups.io Since the patch with the warning in [1] was merged, a very significant number of kexec boots are producing the warning in our (Meta) fleet. I believe there are 2 problems, the warning itself might not be triggered on the right condition, and memory attributes table is getting corrupted. An example of the warning when its not triggered correctly and is fixed by patch 1: efi: memattr: [Firmware Bug]: Corrupted EFI Memory Attributes Table detected! (version == 2, desc_size == 48, num_entries == 48) An example of the warning when memory attributes table is getting corrupted and might possibly be fixed by patch 2: efi: memattr: [Firmware Bug]: Corrupted EFI Memory Attributes Table detected! (version == 1, desc_size == 2072184435, num_entries == 3248688968) Its clear that the desc size and num_entries are wrong. The logic behind patch 1 is explained in its commit message. The memory corruption is looking very similar to the problem that was fixed by 77d48d39e99170 ("efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption"), but this time with memattr table, where it might not be preserved during kexec. I have not been able to reproduce this in the test machine I have over the past couple of days (hence marked as RFC) , but its happening often in our prod. When this area is not reserved, it comes up as usable in /sys/firmware/memmap. This means that kexec, which uses that memmap to find usable memory regions, can select the region where efi_mem_attr_table is and overwrite it and relocate_kernel. Having a fix in firmware can be difficult to get through. The next ideal place would be in libstub. However, it looks like InstallMemoryAttributesTable [2] is not available as a boot service call option [3], [4], I tried to use install_configuration_table as a substitute, but its not valid and corrupts the MemoryAttributesTable. The prints I got from the below code in coverletter were: EFI stub: ERROR: KKK tbl 5f19e018 tbl_>version=1, tbl->num_entries 48 tbl->desc_size 48 EFI stub: ERROR: KKK2 tbl 67184018 tbl_>version=2048, tbl->num_entries 0 tbl->desc_size 0 which shows the table got corrupted. This can bee seen in the kernel boot as well after (with the version showing up as 2048). As a last option for a fix, the patch marks that region as reserved in e820_table_firmware if it is currently E820_TYPE_RAM so that kexec doesn't use it for kernel segments. [1] https://lore.kernel.org/all/20241031175822.2952471-2-ardb+git@google.com/ [2] https://github.com/tianocore/edk2/blob/master/MdeModulePkg/Core/Dxe/Misc/MemoryAttributesTable.c#L100 [3] https://github.com/tianocore/edk2/blob/42a141800c0c26a09d2344e84a89ce4097a263ae/MdeModulePkg/Core/Dxe/DxeMain/DxeMain.c#L41 [4] https://elixir.bootlin.com/linux/v6.12.6/source/drivers/firmware/efi/libstub/efistub.h#L327 diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h index d33ccbc4a2c6..a1a956f2d963 100644 --- a/drivers/firmware/efi/libstub/efistub.h +++ b/drivers/firmware/efi/libstub/efistub.h @@ -1143,6 +1143,7 @@ efi_enable_reset_attack_mitigation(void) { } #endif void efi_retrieve_eventlog(void); +void efi_mem_attr_init(void); struct screen_info *alloc_screen_info(void); struct screen_info *__alloc_screen_info(void); diff --git a/drivers/firmware/efi/libstub/mem.c b/drivers/firmware/efi/libstub/mem.c index 4f1fa302234d..c5b60aea342e 100644 --- a/drivers/firmware/efi/libstub/mem.c +++ b/drivers/firmware/efi/libstub/mem.c @@ -128,3 +128,35 @@ void efi_free(unsigned long size, unsigned long addr) nr_pages = round_up(size, EFI_ALLOC_ALIGN) / EFI_PAGE_SIZE; efi_bs_call(free_pages, addr, nr_pages); } + +void efi_mem_attr_init(void) +{ + efi_guid_t linux_mem_attr_guid = EFI_MEMORY_ATTRIBUTES_TABLE_GUID; + efi_memory_attributes_table_t *tbl = NULL; + efi_status_t status; + unsigned long size; + + tbl = get_efi_config_table(linux_mem_attr_guid); + efi_err("KKK tbl %lx tbl_>version=%d, tbl->num_entries %d tbl->desc_size %d\n", tbl, tbl->version, tbl->num_entries, tbl->desc_size); + + size = tbl->num_entries * tbl->desc_size; + status = efi_bs_call(allocate_pool, EFI_ACPI_RECLAIM_MEMORY, + sizeof(*tbl) + size, (void **)&tbl); + + if (status != EFI_SUCCESS) { + efi_err("Unable to allocate memory for event log\n"); + return; + } + + status = efi_bs_call(install_configuration_table, + &linux_mem_attr_guid, tbl); + + if (status != EFI_SUCCESS) + efi_err("Unable to install configuration table to update memory type\n"); + efi_bs_call(free_pool, tbl); + + /* verify if its the same table */ + tbl = get_efi_config_table(linux_mem_attr_guid); + efi_err("KKK2 tbl %lx tbl_>version=%d, tbl->num_entries %d tbl->desc_size %d\n", tbl, tbl->version, tbl->num_entries, tbl->desc_size); + +} diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi/libstub/x86-stub.c index f8e465da344d..c0c3d278451d 100644 --- a/drivers/firmware/efi/libstub/x86-stub.c +++ b/drivers/firmware/efi/libstub/x86-stub.c @@ -1036,6 +1036,8 @@ void __noreturn efi_stub_entry(efi_handle_t handle, efi_retrieve_eventlog(); + efi_mem_attr_init(); + setup_graphics(boot_params); setup_efi_pci(boot_params); Usama Arif (2): efi/memattr: Use desc_size instead of total size to check for corruption efi/memattr: add efi_mem_attr_table as a reserved region in 820_table_firmware arch/x86/include/asm/e820/api.h | 2 ++ arch/x86/kernel/e820.c | 6 ++++++ arch/x86/platform/efi/efi.c | 9 +++++++++ drivers/firmware/efi/memattr.c | 17 +++++++---------- include/linux/efi.h | 7 +++++++ 5 files changed, 31 insertions(+), 10 deletions(-) -- 2.43.5 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#120999): https://edk2.groups.io/g/devel/message/120999 Mute This Topic: https://groups.io/mt/110633384/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-