Re: [PATCH] Fix boot hang caused by buggy TPM support in some EFI firmwares

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, May 18, 2020 at 05:19:12PM -0500, Justin Forbes wrote:
> On Mon, May 18, 2020 at 3:48 PM Don Zickus <dzickus@xxxxxxxxxx> wrote:
> 
> > Hi Javier,
> >
> > We update the fedora kernel process to use a git tree to submit patches
> > now.
> >
> 
> This was a request for stable, which doesn't follow this process.  Javier
> asked before he sent it here.  It has been added and included in the 5.6.13
> builds.

Sorry about that Javier!  Thanks for explaining that to me Justin.

Cheers,
Don

> 
> Justin
> 
> 
> >
> > Can I ask you to spend a few minutes to read over the new steps
> >
> > https://cki-project.gitlab.io/kernel-ark/submitting-contributions.html
> >
> > and resubmit your request as a merge request?
> >
> > Hopefully after the initial setup, the steps are simple enough.
> >
> > Thanks in advance!
> >
> > Cheers,
> > Don
> >
> >
> > On Thu, May 14, 2020 at 05:44:56PM +0200, Javier Martinez Canillas wrote:
> > > ---
> > >  kernel.spec                                   |  3 +
> > >  ...log-version-before-reading-final-eve.patch | 76 +++++++++++++++++++
> > >  2 files changed, 79 insertions(+)
> > >  create mode 100644
> > tpm-check-event-log-version-before-reading-final-eve.patch
> > >
> > > diff --git a/kernel.spec b/kernel.spec
> > > index ce66ad47a5b..6ee76a76dbb 100644
> > > --- a/kernel.spec
> > > +++ b/kernel.spec
> > > @@ -911,6 +911,9 @@ Patch512:
> > drm-dp_mst-Fix-drm_dp_send_dpcd_write-return-code.patch
> > >  # CVE-2020-10711 rhbz 1825116 1834778
> > >  Patch513: net-netlabel-cope-with-NULL-catmap.patch
> > >
> > > +# https://bugzilla.redhat.com/show_bug.cgi?id=1779611
> > > +Patch514: tpm-check-event-log-version-before-reading-final-eve.patch
> > > +
> > >  # END OF PATCH DEFINITIONS
> > >
> > >  %endif
> > > diff --git a/tpm-check-event-log-version-before-reading-final-eve.patch
> > b/tpm-check-event-log-version-before-reading-final-eve.patch
> > > new file mode 100644
> > > index 00000000000..49010406034
> > > --- /dev/null
> > > +++ b/tpm-check-event-log-version-before-reading-final-eve.patch
> > > @@ -0,0 +1,76 @@
> > > +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
> > > +From: =?UTF-8?q?Lo=C3=AFc=20Yhuel?= <loic.yhuel@xxxxxxxxx>
> > > +Date: Tue, 12 May 2020 06:01:13 +0200
> > > +Subject: [PATCH] tpm: check event log version before reading final
> > events
> > > +MIME-Version: 1.0
> > > +Content-Type: text/plain; charset=UTF-8
> > > +Content-Transfer-Encoding: 8bit
> > > +
> > > +This fixes the boot issues since 5.3 on several Dell models when the TPM
> > > +is enabled. Depending on the exact grub binary, booting the kernel would
> > > +freeze early, or just report an error parsing the final events log.
> > > +
> > > +We get an event log in the SHA-1 format, which doesn't have a
> > > +tcg_efi_specid_event_head in the first event, and there is a final
> > events
> > > +table which doesn't match the crypto agile format.
> > > +__calc_tpm2_event_size reads bad "count" and "efispecid->num_algs", and
> > > +either fails, or loops long enough for the machine to be appear frozen.
> > > +
> > > +So we now only parse the final events table, which is per the spec
> > always
> > > +supposed to be in the crypto agile format, when we got a event log in
> > this
> > > +format.
> > > +
> > > +Fixes: c46f3405692de ("tpm: Reserve the TPM final events table")
> > > +Fixes: 166a2809d65b2 ("tpm: Don't duplicate events from the final event
> > log in the TCG2 log")
> > > +Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1779611
> > > +Signed-off-by: Loïc Yhuel <loic.yhuel@xxxxxxxxx>
> > > +Link:
> > https://lore.kernel.org/r/20200512040113.277768-1-loic.yhuel@xxxxxxxxx
> > > +Reviewed-by: Javier Martinez Canillas <javierm@xxxxxxxxxx>
> > > +Reviewed-by: Jerry Snitselaar <jsnitsel@xxxxxxxxxx>
> > > +Reviewed-by: Matthew Garrett <mjg59@xxxxxxxxxx>
> > > +Signed-off-by: Ard Biesheuvel <ardb@xxxxxxxxxx>
> > > +---
> > > + drivers/firmware/efi/libstub/tpm.c | 5 +++--
> > > + drivers/firmware/efi/tpm.c         | 3 ++-
> > > + 2 files changed, 5 insertions(+), 3 deletions(-)
> > > +
> > > +diff --git a/drivers/firmware/efi/libstub/tpm.c
> > b/drivers/firmware/efi/libstub/tpm.c
> > > +index 1d59e103a2e..e9a684637b7 100644
> > > +--- a/drivers/firmware/efi/libstub/tpm.c
> > > ++++ b/drivers/firmware/efi/libstub/tpm.c
> > > +@@ -54,7 +54,7 @@ void efi_retrieve_tpm2_eventlog(void)
> > > +     efi_status_t status;
> > > +     efi_physical_addr_t log_location = 0, log_last_entry = 0;
> > > +     struct linux_efi_tpm_eventlog *log_tbl = NULL;
> > > +-    struct efi_tcg2_final_events_table *final_events_table;
> > > ++    struct efi_tcg2_final_events_table *final_events_table = NULL;
> > > +     unsigned long first_entry_addr, last_entry_addr;
> > > +     size_t log_size, last_entry_size;
> > > +     efi_bool_t truncated;
> > > +@@ -127,7 +127,8 @@ void efi_retrieve_tpm2_eventlog(void)
> > > +      * Figure out whether any events have already been logged to the
> > > +      * final events structure, and if so how much space they take up
> > > +      */
> > > +-    final_events_table =
> > get_efi_config_table(LINUX_EFI_TPM_FINAL_LOG_GUID);
> > > ++    if (version == EFI_TCG2_EVENT_LOG_FORMAT_TCG_2)
> > > ++            final_events_table =
> > get_efi_config_table(LINUX_EFI_TPM_FINAL_LOG_GUID);
> > > +     if (final_events_table && final_events_table->nr_events) {
> > > +             struct tcg_pcr_event2_head *header;
> > > +             int offset;
> > > +diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c
> > > +index 55b031d2c98..77e101a395e 100644
> > > +--- a/drivers/firmware/efi/tpm.c
> > > ++++ b/drivers/firmware/efi/tpm.c
> > > +@@ -62,7 +62,8 @@ int __init efi_tpm_eventlog_init(void)
> > > +     tbl_size = sizeof(*log_tbl) + log_tbl->size;
> > > +     memblock_reserve(efi.tpm_log, tbl_size);
> > > +
> > > +-    if (efi.tpm_final_log == EFI_INVALID_TABLE_ADDR)
> > > ++    if (efi.tpm_final_log == EFI_INVALID_TABLE_ADDR ||
> > > ++        log_tbl->version != EFI_TCG2_EVENT_LOG_FORMAT_TCG_2)
> > > +             goto out;
> > > +
> > > +     final_tbl = early_memremap(efi.tpm_final_log, sizeof(*final_tbl));
> > > +--
> > > +2.26.2
> > > +
> > > --
> > > 2.26.2
> > > _______________________________________________
> > > kernel mailing list -- kernel@xxxxxxxxxxxxxxxxxxxxxxx
> > > To unsubscribe send an email to kernel-leave@xxxxxxxxxxxxxxxxxxxxxxx
> > > Fedora Code of Conduct:
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> > https://lists.fedoraproject.org/archives/list/kernel@xxxxxxxxxxxxxxxxxxxxxxx
> > _______________________________________________
> > kernel mailing list -- kernel@xxxxxxxxxxxxxxxxxxxxxxx
> > To unsubscribe send an email to kernel-leave@xxxxxxxxxxxxxxxxxxxxxxx
> > Fedora Code of Conduct:
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedoraproject.org/archives/list/kernel@xxxxxxxxxxxxxxxxxxxxxxx
> >
> _______________________________________________
> kernel mailing list -- kernel@xxxxxxxxxxxxxxxxxxxxxxx
> To unsubscribe send an email to kernel-leave@xxxxxxxxxxxxxxxxxxxxxxx
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/kernel@xxxxxxxxxxxxxxxxxxxxxxx
_______________________________________________
kernel mailing list -- kernel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to kernel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/kernel@xxxxxxxxxxxxxxxxxxxxxxx




[Index of Archives]     [Fedora General Discussion]     [Older Fedora Users Archive]     [Fedora Advisory Board]     [Fedora Security]     [Fedora Devel Java]     [Fedora Legacy]     [Fedora Desktop]     [ATA RAID]     [Fedora Marketing]     [Fedora Mentors]     [Fedora Package Announce]     [Fedora Package Review]     [Fedora Music]     [Fedora Packaging]     [Centos]     [Fedora SELinux]     [Coolkey]     [Yum Users]     [Tux]     [Yosemite News]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [USB]     [Asterisk PBX]

  Powered by Linux