From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail05.groups.io (mail05.groups.io [45.79.224.7]) by spool.mail.gandi.net (Postfix) with ESMTPS id BD8F174003D for ; Wed, 11 Sep 2024 11:51:24 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=LpvkfmjEg1Yu/UKdfikN1BQd1whuMBgyLoIVn31D9aA=; c=relaxed/simple; d=groups.io; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject:To:Cc:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Resent-Date:Resent-From:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Type:Content-Transfer-Encoding; s=20240830; t=1726055484; v=1; x=1726314683; b=fZeC1RbwU0lJS0f7SRwY/IOiL9r7hNmoqP+Jaf18gZCWNms37GBuluSJeH2p9eUnGPAw1jL8 7ybEqzQQGLgAlVg2NtDxoMxVP96GLNxlrsHs0WwmctuMpQVmnolA3WAPLG52oTmvDFXXh3GsTJ0 0Q9//NjhpedRDiJ0N61OcY+WIfl+KJA2UlicLVmCA+5A3VcM5oMiVVnJBYLz0/FVdwHk4tGmU7f x3tE2OyT3Z8uVc2xJWh5M9b95kOxmPMxVPrrNHgAx6+gYJwTPrpm5Rz5/7tD4lZbipGQy95Y1xI PuNxMqBuES9QtT39V36qTUm9kbybbGK7WBj7zL2RpJNRg== X-Received: by 127.0.0.2 with SMTP id MVdxYY7687511x3EwWakHClE; Wed, 11 Sep 2024 04:51:23 -0700 X-Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by mx.groups.io with SMTP id smtpd.web11.19811.1726055477523806315 for ; Wed, 11 Sep 2024 04:51:17 -0700 X-Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id 3D5795C06A5 for ; Wed, 11 Sep 2024 11:51:13 +0000 (UTC) X-Received: by smtp.kernel.org (Postfix) with ESMTPSA id 04F55C4CED1 for ; Wed, 11 Sep 2024 11:51:16 +0000 (UTC) X-Received: by mail-lj1-f169.google.com with SMTP id 38308e7fff4ca-2f759b87f83so49738211fa.2 for ; Wed, 11 Sep 2024 04:51:15 -0700 (PDT) X-Forwarded-Encrypted: i=1; AJvYcCUX+JZ2kMPyvyxDpaDrJ5oTwg/znGIr1Js6v5ribWV9+udx4hZZC3YXfyqMPYRPu12Z/Tbhqg==@edk2.groups.io X-Gm-Message-State: tEg45ikUV0hnNRTqogR4N6KQx7686176AA= X-Google-Smtp-Source: AGHT+IGwbhZjGqOj6sOlVvxEtdzPPBl7wj7LtWnVpMe6yBubbv7XFzPAcVcy/8ieGc+uRemrmEZv58Pc2Xmv81kF6a0= X-Received: by 2002:a05:651c:2212:b0:2f6:9787:5fc0 with SMTP id 38308e7fff4ca-2f751faa255mr103181591fa.40.1726055474181; Wed, 11 Sep 2024 04:51:14 -0700 (PDT) MIME-Version: 1.0 References: <20240911104109.1831501-1-usamaarif642@gmail.com> In-Reply-To: <20240911104109.1831501-1-usamaarif642@gmail.com> From: "Ard Biesheuvel via groups.io" Date: Wed, 11 Sep 2024 13:51:02 +0200 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [edk2-devel] [RFC] efi/tpm: add efi.tpm_log as a reserved region in 820_table_firmware To: Usama Arif Cc: linux-efi@vger.kernel.org, devel@edk2.groups.io, kexec@lists.infradead.org, ebiederm@xmission.com, bhe@redhat.com, vgoyal@redhat.com, tglx@linutronix.de, dave.hansen@linux.intel.com, x86@kernel.org, linux-kernel@vger.kernel.org, leitao@debian.org, rmikey@meta.com, gourry@gourry.net Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Resent-Date: Wed, 11 Sep 2024 04:51:17 -0700 Resent-From: ardb@kernel.org Reply-To: devel@edk2.groups.io,ardb@kernel.org List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20240830 header.b=fZeC1Rbw; dmarc=pass (policy=none) header.from=groups.io; spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 45.79.224.7 as permitted sender) smtp.mailfrom=bounce@groups.io On Wed, 11 Sept 2024 at 12:41, Usama Arif wrote: > > Looking at the TPM spec [1] > > If the ACPI TPM2 table contains the address and size of the Platform > Firmware TCG log, firmware =E2=80=9Cpins=E2=80=9D the memory associated w= ith the > Platform FirmwareTCG log, and reports this memory as =E2=80=9CReserved=E2= =80=9D memory > via the INT 15h/E820 interface. > > It looks like the firmware should pass this as reserved in e820 memory > map. However, it doesn't seem to. The firmware being tested on is: > dmidecode -s bios-version > edk2-20240214-2.el9 > > When this area is not reserved, it comes up as usable in > /sys/firmware/memmap. This means that kexec, which uses that memmap > to find usable memory regions, can select the region where efi.tpm_log > is and overwrite it and relocate_kernel. > > Having a fix in firmware can be difficult to get through. As a secondary > fix, this patch marks that region as reserved in e820_table_firmware if i= t > is currently E820_TYPE_RAM so that kexec doesn't use it for kernel segmen= ts. > > [1] https://trustedcomputinggroup.org/wp-content/uploads/PC-ClientPlatfor= m_Profile_for_TPM_2p0_Systems_v49_161114_public-review.pdf > > Signed-off-by: Usama Arif I would expect the EFI memory map to E820 conversion implemented in the EFI stub to take care of this. If you are not booting via the EFI stub, the bootloader is performing this conversion, and so it should be done there instead. > --- > arch/x86/include/asm/e820/api.h | 2 ++ > arch/x86/kernel/e820.c | 6 ++++++ > arch/x86/platform/efi/efi.c | 9 +++++++++ > drivers/firmware/efi/tpm.c | 2 +- > include/linux/efi.h | 7 +++++++ > 5 files changed, 25 insertions(+), 1 deletion(-) > > diff --git a/arch/x86/include/asm/e820/api.h b/arch/x86/include/asm/e820/= api.h > index 2e74a7f0e935..4e9aa24f03bd 100644 > --- a/arch/x86/include/asm/e820/api.h > +++ b/arch/x86/include/asm/e820/api.h > @@ -16,6 +16,8 @@ extern bool e820__mapped_all(u64 start, u64 end, enum e= 820_type type); > > extern void e820__range_add (u64 start, u64 size, enum e820_type type)= ; > extern u64 e820__range_update(u64 start, u64 size, enum e820_type old_t= ype, enum e820_type new_type); > +extern u64 e820__range_update_firmware(u64 start, u64 size, enum e820_t= ype old_type, > + enum e820_type new_type); > extern u64 e820__range_remove(u64 start, u64 size, enum e820_type old_t= ype, bool check_type); > extern u64 e820__range_update_table(struct e820_table *t, u64 start, u6= 4 size, enum e820_type old_type, enum e820_type new_type); > > diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c > index 4893d30ce438..912400161623 100644 > --- a/arch/x86/kernel/e820.c > +++ b/arch/x86/kernel/e820.c > @@ -538,6 +538,12 @@ u64 __init e820__range_update_table(struct e820_tabl= e *t, u64 start, u64 size, > return __e820__range_update(t, start, size, old_type, new_type); > } > > +u64 __init e820__range_update_firmware(u64 start, u64 size, enum e820_ty= pe old_type, > + enum e820_type new_type) > +{ > + return __e820__range_update(e820_table_firmware, start, size, old= _type, new_type); > +} > + > /* Remove a range of memory from the E820 table: */ > u64 __init e820__range_remove(u64 start, u64 size, enum e820_type old_ty= pe, bool check_type) > { > diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c > index 88a96816de9a..aa95f77d7a30 100644 > --- a/arch/x86/platform/efi/efi.c > +++ b/arch/x86/platform/efi/efi.c > @@ -171,6 +171,15 @@ static void __init do_add_efi_memmap(void) > e820__update_table(e820_table); > } > > +/* Reserve firmware area if it was marked as RAM */ > +void arch_update_firmware_area(u64 addr, u64 size) > +{ > + if (e820__get_entry_type(addr, addr + size) =3D=3D E820_TYPE_RAM)= { > + e820__range_update_firmware(addr, size, E820_TYPE_RAM, E8= 20_TYPE_RESERVED); > + e820__update_table(e820_table_firmware); > + } > +} > + > /* > * Given add_efi_memmap defaults to 0 and there is no alternative > * e820 mechanism for soft-reserved memory, import the full EFI memory > diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c > index e8d69bd548f3..8e6e7131d718 100644 > --- a/drivers/firmware/efi/tpm.c > +++ b/drivers/firmware/efi/tpm.c > @@ -60,6 +60,7 @@ int __init efi_tpm_eventlog_init(void) > } > > tbl_size =3D sizeof(*log_tbl) + log_tbl->size; > + arch_update_firmware_area(efi.tpm_log, tbl_size); > memblock_reserve(efi.tpm_log, tbl_size); > > if (efi.tpm_final_log =3D=3D EFI_INVALID_TABLE_ADDR) { > @@ -107,4 +108,3 @@ int __init efi_tpm_eventlog_init(void) > early_memunmap(log_tbl, sizeof(*log_tbl)); > return ret; > } > - > diff --git a/include/linux/efi.h b/include/linux/efi.h > index 6bf3c4fe8511..9c239cdff771 100644 > --- a/include/linux/efi.h > +++ b/include/linux/efi.h > @@ -1371,4 +1371,11 @@ extern struct blocking_notifier_head efivar_ops_nh= ; > void efivars_generic_ops_register(void); > void efivars_generic_ops_unregister(void); > > +#ifdef CONFIG_X86_64 > +void __init arch_update_firmware_area(u64 addr, u64 size); > +#else > +static inline void __init arch_update_firmware_area(u64 addr, u64 size) > +{ > +} > +#endif > #endif /* _LINUX_EFI_H */ > -- > 2.43.5 > -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#120550): https://edk2.groups.io/g/devel/message/120550 Mute This Topic: https://groups.io/mt/108391994/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-