linux-kernel - Re: [BUG][SEVERE] Enabling EFI runtime services causes panics in the T2 security chip on Macs equipped with it.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 11 Jan 2022 07:32:29 +0000
From:   Aditya Garg <gargaditya08@...e.com>
To:     Ard Biesheuvel <ardb@...nel.org>
CC:     "jk@...abs.org" <jk@...abs.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        "linux-efi@...r.kernel.org" <linux-efi@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Orlando Chamberlain <redecorating@...tonmail.com>,
        Aun-Ali Zaidi <admin@...eit.net>
Subject: Re: [BUG][SEVERE] Enabling EFI runtime services causes panics in the
 T2 security chip on Macs equipped with it.



> On 10-Jan-2022, at 11:15 PM, Ard Biesheuvel <ardb@...nel.org> wrote:
> 
> On Mon, 10 Jan 2022 at 17:37, Ard Biesheuvel <ardb@...nel.org> wrote:
>> 
>> On Mon, 10 Jan 2022 at 17:28, Aditya Garg <gargaditya08@...e.com> wrote:
> ...
>>>>> 
>>>>> This seems to be triggered by EFI_QUERY_VARIABLE_INFO here
>>>>> 
>>>> 
>>>> This is interesting. QueryVariableInfo() was introduced in EFI 2.00,
>>>> and for a very long time, Intel MACs would claim to implement EFI 1.10
>>>> only. This means Linux would never attempt to use QueryVariableInfo()
>>>> on such platforms.
>>>> 
>>>> Can you please check your boot log which revision it claims to implement now?
>>>> 
>>>> Mine says
>>>> 
>>>> efi: EFI v1.10 by Apple
>>> 
>>> Mine says
>>> 
>>> efi: EFI v2.40 by Apple
>>> 
> 
> Can you check whether things work as before after applying the change below?
Patch works for me Ard :)
I am able to boot without efi=norumtime now.
> 
> diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
> index 147c30a81f15..d7203355cc69 100644
> --- a/arch/x86/platform/efi/efi.c
> +++ b/arch/x86/platform/efi/efi.c
> @@ -399,7 +399,7 @@ static int __init efi_systab_init(unsigned long phys)
>                efi_nr_tables           = systab32->nr_tables;
>        }
> 
> -       efi.runtime_version = hdr->revision;
> +       efi.runtime_version = EFI_1_10_SYSTEM_TABLE_REVISION;
> 
>        efi_systab_report_header(hdr, efi_fw_vendor);
>        early_memunmap(p, size);