| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 26 Apr 2018 18:51:22 +0200
From: Ard Biesheuvel <ard.biesheuvel@...aro.org>
To: Hans de Goede <hdegoede@...hat.com>
Cc: "Luis R . Rodriguez" <mcgrof@...nel.org>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
Thomas Gleixner <tglx@...utronix.de>,
Ingo Molnar <mingo@...hat.com>,
"H . Peter Anvin" <hpa@...or.com>, Peter Jones <pjones@...hat.com>,
Dave Olsthoorn <dave@...aar.me>,
Will Deacon <will.deacon@....com>,
Andy Lutomirski <luto@...nel.org>,
Matt Fleming <matt@...eblueprint.co.uk>,
David Howells <dhowells@...hat.com>,
Mimi Zohar <zohar@...ux.vnet.ibm.com>,
Josh Triplett <josh@...htriplett.org>,
Dmitry Torokhov <dmitry.torokhov@...il.com>,
Martin Fuzzey <mfuzzey@...keon.com>,
Kalle Valo <kvalo@...eaurora.org>,
Arend Van Spriel <arend.vanspriel@...adcom.com>,
Linus Torvalds <torvalds@...ux-foundation.org>,
Nicolas Broeking <nbroeking@...com>,
Bjorn Andersson <bjorn.andersson@...aro.org>,
Torsten Duwe <duwe@...e.de>, Kees Cook <keescook@...omium.org>,
"the arch/x86 maintainers" <x86@...nel.org>,
linux-efi@...r.kernel.org,
Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v4 1/5] efi: Export boot-services code and data as debugfs-blobs
On 26 April 2018 at 14:06, Hans de Goede <hdegoede@...hat.com> wrote:
> Sometimes it is useful to be able to dump the efi boot-services code and
> data. This commit adds these as debugfs-blobs to /sys/kernel/debug/efi,
> but only if efi=debug is passed on the kernel-commandline as this requires
> not freeing those memory-regions, which costs 20+ MB of RAM.
>
> Reviewed-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> Signed-off-by: Hans de Goede <hdegoede@...hat.com>
> ---
> Changes in v4:
> -Add new EFI_BOOT_SERVICES flag and use it to determine if the boot-services
> memory segments are available (and thus if it makes sense to register the
> debugfs bits for them)
>
> Changes in v2:
> -Do not call pr_err on debugfs call failures
> ---
> arch/x86/platform/efi/efi.c | 1 +
> arch/x86/platform/efi/quirks.c | 4 +++
> drivers/firmware/efi/efi.c | 53 ++++++++++++++++++++++++++++++++++
> include/linux/efi.h | 1 +
> 4 files changed, 59 insertions(+)
>
> diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
> index 9061babfbc83..568b7ee3d323 100644
> --- a/arch/x86/platform/efi/efi.c
> +++ b/arch/x86/platform/efi/efi.c
> @@ -208,6 +208,7 @@ int __init efi_memblock_x86_reserve_range(void)
> efi.memmap.desc_version);
>
> memblock_reserve(pmap, efi.memmap.nr_map * efi.memmap.desc_size);
> + set_bit(EFI_BOOT_SERVICES, &efi.flags);
>
I think it would be better if the flag conveys whether boot services
regions are being preserved, because they will always exist when
EFI_BOOT is set.
The name should then reflect that as well, e.g., EFI_PRESERVE_BS_REGIONS.
> return 0;
> }
> diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c
> index 36c1f8b9f7e0..16bdb9e3b343 100644
> --- a/arch/x86/platform/efi/quirks.c
> +++ b/arch/x86/platform/efi/quirks.c
> @@ -376,6 +376,10 @@ void __init efi_free_boot_services(void)
> int num_entries = 0;
> void *new, *new_md;
>
> + /* Keep all regions for /sys/kernel/debug/efi */
> + if (efi_enabled(EFI_DBG))
> + return;
> +
Why is this only necessary when EFI_DBG is enabled? How are you
ensuring that the firmware is still in memory when the subsequent
patches start relying on that?
> for_each_efi_memory_desc(md) {
> unsigned long long start = md->phys_addr;
> unsigned long long size = md->num_pages << EFI_PAGE_SHIFT;
> diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
> index 232f4915223b..498a720a7684 100644
> --- a/drivers/firmware/efi/efi.c
> +++ b/drivers/firmware/efi/efi.c
> @@ -18,6 +18,7 @@
> #include <linux/kobject.h>
> #include <linux/module.h>
> #include <linux/init.h>
> +#include <linux/debugfs.h>
> #include <linux/device.h>
> #include <linux/efi.h>
> #include <linux/of.h>
> @@ -325,6 +326,55 @@ static __init int efivar_ssdt_load(void)
> static inline int efivar_ssdt_load(void) { return 0; }
> #endif
>
> +#ifdef CONFIG_DEBUG_FS
> +
> +#define EFI_DEBUGFS_MAX_BLOBS 32
> +
> +static struct debugfs_blob_wrapper debugfs_blob[EFI_DEBUGFS_MAX_BLOBS];
> +
> +static void __init efi_debugfs_init(void)
> +{
> + struct dentry *efi_debugfs;
> + efi_memory_desc_t *md;
> + char name[32];
> + int type_count[EFI_BOOT_SERVICES_DATA + 1] = {};
> + int i = 0;
> +
> + efi_debugfs = debugfs_create_dir("efi", NULL);
> + if (IS_ERR_OR_NULL(efi_debugfs))
> + return;
> +
> + for_each_efi_memory_desc(md) {
> + switch (md->type) {
> + case EFI_BOOT_SERVICES_CODE:
> + snprintf(name, sizeof(name), "boot_services_code%d",
> + type_count[md->type]++);
> + break;
> + case EFI_BOOT_SERVICES_DATA:
> + snprintf(name, sizeof(name), "boot_services_data%d",
> + type_count[md->type]++);
> + break;
> + default:
> + continue;
> + }
> +
> + debugfs_blob[i].size = md->num_pages << EFI_PAGE_SHIFT;
> + debugfs_blob[i].data = memremap(md->phys_addr,
> + debugfs_blob[i].size,
> + MEMREMAP_WB);
> + if (!debugfs_blob[i].data)
> + continue;
> +
> + debugfs_create_blob(name, 0400, efi_debugfs, &debugfs_blob[i]);
> + i++;
> + if (i == EFI_DEBUGFS_MAX_BLOBS)
> + break;
> + }
> +}
> +#else
> +static inline void efi_debugfs_init(void) {}
> +#endif
> +
> /*
> * We register the efi subsystem with the firmware subsystem and the
> * efivars subsystem with the efi subsystem, if the system was booted with
> @@ -369,6 +419,9 @@ static int __init efisubsys_init(void)
> goto err_remove_group;
> }
>
> + if (efi_enabled(EFI_DBG) && efi_enabled(EFI_BOOT_SERVICES))
> + efi_debugfs_init();
> +
> return 0;
>
> err_remove_group:
> diff --git a/include/linux/efi.h b/include/linux/efi.h
> index f1b7d68ac460..396bf18ace5c 100644
> --- a/include/linux/efi.h
> +++ b/include/linux/efi.h
> @@ -1144,6 +1144,7 @@ extern int __init efi_setup_pcdp_console(char *);
> #define EFI_DBG 8 /* Print additional debug info at runtime */
> #define EFI_NX_PE_DATA 9 /* Can runtime data regions be mapped non-executable? */
> #define EFI_MEM_ATTR 10 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */
> +#define EFI_BOOT_SERVICES 11 /* Are EFI boot-services memory segments available? */
>
> #ifdef CONFIG_EFI
> /*
> --
> 2.17.0
>
Powered by blists - more mailing lists