linux-kernel - Re: [PATCH 5.10 011/100] efi: runtime: avoid EFIv2 runtime services on Apple x86 machines

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220203205223.GA19153@duo.ucw.cz>
Date:   Thu, 3 Feb 2022 21:52:23 +0100
From:   Pavel Machek <pavel@...x.de>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Jeremy Kerr <jk@...abs.org>,
        Matthew Garrett <mjg59@...f.ucam.org>,
        Aditya Garg <gargaditya08@...e.com>,
        Orlando Chamberlain <redecorating@...tonmail.com>,
        Ard Biesheuvel <ardb@...nel.org>
Subject: Re: [PATCH 5.10 011/100] efi: runtime: avoid EFIv2 runtime services
 on Apple x86 machines

Hi!

> Aditya reports [0] that his recent MacbookPro crashes in the firmware
> when using the variable services at runtime. The culprit appears to be a
> call to QueryVariableInfo(), which we did not use to call on Apple x86
> machines in the past as they only upgraded from EFI v1.10 to EFI v2.40
> firmware fairly recently, and QueryVariableInfo() (along with
> UpdateCapsule() et al) was added in EFI v2.00.
> 
> The only runtime service introduced in EFI v2.00 that we actually use in
> Linux is QueryVariableInfo(), as the capsule based ones are optional,
> generally not used at runtime (all the LVFS/fwupd firmware update
> infrastructure uses helper EFI programs that invoke capsule update at
> boot time, not runtime), and not implemented by Apple machines in the
> first place. QueryVariableInfo() is used to 'safely' set variables,
> i.e., only when there is enough space. This prevents machines with buggy
> firmwares from corrupting their NVRAMs when they run out of space.
> 
> Given that Apple machines have been using EFI v1.10 services only for
> the longest time (the EFI v2.0 spec was released in 2006, and Linux
> support for the newly introduced runtime services was added in 2011, but
> the MacbookPro12,1 released in 2015 still claims to be EFI v1.10 only),
> let's avoid the EFI v2.0 ones on all Apple x86 machines.

So Apple x86 machines claim they support EFI v2 but really don't?

> +++ b/drivers/firmware/efi/efi.c
> @@ -719,6 +719,13 @@ void __init efi_systab_report_header(con
>  		systab_hdr->revision >> 16,
>  		systab_hdr->revision & 0xffff,
>  		vendor);
> +
> +	if (IS_ENABLED(CONFIG_X86_64) &&
> +	    systab_hdr->revision > EFI_1_10_SYSTEM_TABLE_REVISION &&
> +	    !strcmp(vendor, "Apple")) {
> +		pr_info("Apple Mac detected, using EFI v1.10 runtime services only\n");
> +		efi.runtime_version = EFI_1_10_SYSTEM_TABLE_REVISION;
> +	}
>  }

This problem is not 64-bit specific, right? Should it depend on
CONFIG_X86, instead?

Best regards,
								Pavel
-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

Download attachment "signature.asc" of type "application/pgp-signature" (196 bytes)