linux-kernel - Re: [BUG SEVERE] Failure to enable EFI Runtime services on T2 Macs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 8 Feb 2022 15:03:20 +0100
From:   Ard Biesheuvel <ardb@...nel.org>
To:     Aditya Garg <gargaditya08@...e.com>
Cc:     Jeremy Kerr <jk@...abs.org>, Matthew Garrett <mjg59@...f.ucam.org>,
        Orlando Chamberlain <redecorating@...tonmail.com>,
        Aun-Ali Zaidi <admin@...eit.net>,
        "linux-efi@...r.kernel.org" <linux-efi@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [BUG SEVERE] Failure to enable EFI Runtime services on T2 Macs

On Tue, 8 Feb 2022 at 14:55, Aditya Garg <gargaditya08@...e.com> wrote:
>
> On using some specific kernel configuration, on Macs with the T2 Security chip, EFI Runtime services fail to start. Some logs which may be useful are as follows :-
>
> Feb 08 17:11:11 MacBook kernel: [Firmware Bug]: Page fault caused by firmware at PA: 0xffffa79840068000
> Feb 08 17:11:11 MacBook kernel: WARNING: CPU: 11 PID: 150 at arch/x86/platform/efi/quirks.c:735 efi_crash_gracefully_on_page_fault+0x50/0xd0

This means the firmware is broken. There is very little we can do
about this beyond disabling EFI runtime services entirely on such
systems.

...

> The kernel configuration where this bug is seen is on https://github.com/t2linux/T2-Ubuntu-Kernel/blob/Mainline/templates/default-config
>
> I had an old kernel configuration, where I did not face this issue and was easily able to write to the NVRAM. That kernel configuration is on https://github.com/t2linux/T2-Ubuntu-Kernel/blob/b5c20b8c7689251dd943e22dbe02cef9020db8d1/templates/default-config
>
> I believe these lines in the kernel config, which are present in the former but absent in the latter are causing the issue :-
>
...

> Especially CONFIG_LOAD_UEFI_KEYS=y is which I guess may be the culprit.
>

Yes, that seems likely.

> I request you to reply to my issue as soon as possible
>

Please stop demanding attention like this, even though it is thinly
veiled as courteous.

If you want to run bleeding edge kernels on non-standard EFI hardware,
you have to be able to sort yourself out to some extent. I am the
EFI-on-Linux maintainer, but that doesn't mean I work for you and have
to be on call to fix your problems.