linux-kernel - Re: UEFI EBS() failures on Lenovo T14s

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Z0idYMTrsKXOA6a1@hovoldconsulting.com>
Date: Thu, 28 Nov 2024 17:42:08 +0100
From: Johan Hovold <johan@...nel.org>
To: Ard Biesheuvel <ardb@...nel.org>
Cc: Leif Lindholm <leif.lindholm@....qualcomm.com>,
	Bjorn Andersson <andersson@...nel.org>,
	Ricardo Salveti <ricardo@...ndries.io>,
	Marc Zyngier <maz@...nel.org>, linux-efi@...r.kernel.org,
	linux-arm-msm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: UEFI EBS() failures on Lenovo T14s

On Thu, Nov 28, 2024 at 04:21:09PM +0100, Ard Biesheuvel wrote:
> On Thu, 28 Nov 2024 at 15:46, Johan Hovold <johan@...nel.org> wrote:
> >
> > On Thu, Nov 28, 2024 at 12:05:09PM +0100, Ard Biesheuvel wrote:
> >
> > > If you're happy to experiment more, you could try and register a
> > > notification for EFI_EVENT_GROUP_BEFORE_EXIT_BOOT_SERVICES using
> > > CreateEventEx(), and see if it gets called when ExitBootServices() is
> > > called. That would at least help narrow it down.
> >
> > Thanks for the suggestion.
> >
> > I see the notify function being called when I signal it as well as on
> > each ExitBootServices().
> 
> Interesting. That means the EDK2 fork is fairly recent.
> 
> FYI https://github.com/tianocore/edk2/pull/6481

Nice find.

> > With an efi_printk() in the callback ExitBootServices() fails as
> > expected, but with an empty function the kernel seems to start every
> > time.
> >
> > Interestingly, ExitBootServices() now succeeds also if I add back the
> > CloseEvent() call. In fact, it works also if I never signal the event
> > (i.e. if I just create and close the event).
> 
> Is it still invoked by the firmware if you closed the event before EBS()?

No, I just reconfirmed that then it is only called when I signal it
before closing (or never if don't signal the event).

Johan