All of lore.kernel.org
 help / color / mirror / Atom feed
From: James Morse <james.morse@arm.com>
To: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: "linux-efi@vger.kernel.org" <linux-efi@vger.kernel.org>,
	Mark Rutland <mark.rutland@arm.com>,
	kernel-hardening@lists.openwall.com,
	Matt Fleming <matt@codeblueprint.co.uk>,
	Leif Lindholm <leif.lindholm@linaro.org>,
	Borislav Petkov <bp@alien8.de>, Roy Franz <rfranz@cavium.com>,
	Ingo Molnar <mingo@kernel.org>,
	"linux-arm-kernel@lists.infradead.org"
	<linux-arm-kernel@lists.infradead.org>,
	Catalin Marinas <catalin.marinas@arm.com>
Subject: [kernel-hardening] Re: [PATCH 4/4] ef/libstub: arm/arm64: randomize the base of the UEFI rt services region
Date: Fri, 07 Apr 2017 17:11:52 +0100	[thread overview]
Message-ID: <58E7BA48.70903@arm.com> (raw)
In-Reply-To: <CAKv+Gu9CpCWHT=3KboPTtuZVDundtGheKawS=iV_P756RFbaDg@mail.gmail.com>

Hi Ard,

On 07/04/17 16:51, Ard Biesheuvel wrote:
> That is quite interesting, to be honest, because that patch should
> effectively be a NOP on systems that do not implement
> EFI_RNG_PROTOCOL.
> 
> Could you run this from the UEFI shell please?
> 
> http://people.linaro.org/~ard.biesheuvel/RngTest.efi

As you predicted:

Shell> RngTest.efi
UEFI RNG Protocol Testing :
----------------------------
 -- Locate UEFI RNG Protocol : [Fail - Status = Not Found]
Error reported: Not Found


> I would expect it to report that it has no EFI_RNG_PROTOCOL
> implementation. Could you also check whether the working kernel still
> works /after/ having executed that utility?

The broken kernel remains broken after running that test. reboot. The working
kernel continues to work after running that test.

(On Monday) I will try with just these efi changes on v4.11-rc. to try and
eliminate everything else in linux-next.

This is one of those firmware versions that prints lots of
> efi: [Firmware Bug]: IRQ flags corrupted (0x00000140=>0x00000100) by EFI
get_variable


Thanks,

James

WARNING: multiple messages have this Message-ID (diff)
From: James Morse <james.morse@arm.com>
To: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: "linux-efi@vger.kernel.org" <linux-efi@vger.kernel.org>,
	Mark Rutland <mark.rutland@arm.com>,
	kernel-hardening@lists.openwall.com,
	Matt Fleming <matt@codeblueprint.co.uk>,
	Leif Lindholm <leif.lindholm@linaro.org>,
	Borislav Petkov <bp@alien8.de>, Roy Franz <rfranz@cavium.com>,
	Ingo Molnar <mingo@kernel.org>,
	"linux-arm-kernel@lists.infradead.org"
	<linux-arm-kernel@lists.infradead.org>,
	Catalin Marinas <catalin.marinas@arm.com>
Subject: Re: [PATCH 4/4] ef/libstub: arm/arm64: randomize the base of the UEFI rt services region
Date: Fri, 07 Apr 2017 17:11:52 +0100	[thread overview]
Message-ID: <58E7BA48.70903@arm.com> (raw)
In-Reply-To: <CAKv+Gu9CpCWHT=3KboPTtuZVDundtGheKawS=iV_P756RFbaDg@mail.gmail.com>

Hi Ard,

On 07/04/17 16:51, Ard Biesheuvel wrote:
> That is quite interesting, to be honest, because that patch should
> effectively be a NOP on systems that do not implement
> EFI_RNG_PROTOCOL.
> 
> Could you run this from the UEFI shell please?
> 
> http://people.linaro.org/~ard.biesheuvel/RngTest.efi

As you predicted:

Shell> RngTest.efi
UEFI RNG Protocol Testing :
----------------------------
 -- Locate UEFI RNG Protocol : [Fail - Status = Not Found]
Error reported: Not Found


> I would expect it to report that it has no EFI_RNG_PROTOCOL
> implementation. Could you also check whether the working kernel still
> works /after/ having executed that utility?

The broken kernel remains broken after running that test. reboot. The working
kernel continues to work after running that test.

(On Monday) I will try with just these efi changes on v4.11-rc. to try and
eliminate everything else in linux-next.

This is one of those firmware versions that prints lots of
> efi: [Firmware Bug]: IRQ flags corrupted (0x00000140=>0x00000100) by EFI
get_variable


Thanks,

James

WARNING: multiple messages have this Message-ID (diff)
From: james.morse@arm.com (James Morse)
To: linux-arm-kernel@lists.infradead.org
Subject: [PATCH 4/4] ef/libstub: arm/arm64: randomize the base of the UEFI rt services region
Date: Fri, 07 Apr 2017 17:11:52 +0100	[thread overview]
Message-ID: <58E7BA48.70903@arm.com> (raw)
In-Reply-To: <CAKv+Gu9CpCWHT=3KboPTtuZVDundtGheKawS=iV_P756RFbaDg@mail.gmail.com>

Hi Ard,

On 07/04/17 16:51, Ard Biesheuvel wrote:
> That is quite interesting, to be honest, because that patch should
> effectively be a NOP on systems that do not implement
> EFI_RNG_PROTOCOL.
> 
> Could you run this from the UEFI shell please?
> 
> http://people.linaro.org/~ard.biesheuvel/RngTest.efi

As you predicted:

Shell> RngTest.efi
UEFI RNG Protocol Testing :
----------------------------
 -- Locate UEFI RNG Protocol : [Fail - Status = Not Found]
Error reported: Not Found


> I would expect it to report that it has no EFI_RNG_PROTOCOL
> implementation. Could you also check whether the working kernel still
> works /after/ having executed that utility?

The broken kernel remains broken after running that test. reboot. The working
kernel continues to work after running that test.

(On Monday) I will try with just these efi changes on v4.11-rc. to try and
eliminate everything else in linux-next.

This is one of those firmware versions that prints lots of
> efi: [Firmware Bug]: IRQ flags corrupted (0x00000140=>0x00000100) by EFI
get_variable


Thanks,

James

  reply	other threads:[~2017-04-07 16:11 UTC|newest]

Thread overview: 33+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-03-24 13:24 [kernel-hardening] [PATCH 0/4] efi: libstub enhancements for cmdline parsing and kaslr Ard Biesheuvel
2017-03-24 13:24 ` Ard Biesheuvel
2017-03-24 13:24 ` Ard Biesheuvel
2017-03-24 13:24 ` [kernel-hardening] [PATCH 1/4] efi/libstub: fix harmless command line parsing bug Ard Biesheuvel
2017-03-24 13:24   ` Ard Biesheuvel
2017-03-24 13:24   ` Ard Biesheuvel
2017-03-24 13:24 ` [kernel-hardening] [PATCH 2/4] efi/libstub: unify command line param parsing Ard Biesheuvel
2017-03-24 13:24   ` Ard Biesheuvel
2017-03-24 13:24   ` Ard Biesheuvel
2017-03-24 13:24 ` [kernel-hardening] [PATCH 3/4] efi/libstub: arm/arm64: disable debug prints on 'quiet' cmdline arg Ard Biesheuvel
2017-03-24 13:24   ` Ard Biesheuvel
2017-03-24 13:24   ` Ard Biesheuvel
2017-03-24 14:15   ` [kernel-hardening] " Mark Rutland
2017-03-24 14:15     ` Mark Rutland
2017-03-24 14:15     ` Mark Rutland
2017-03-24 13:24 ` [kernel-hardening] [PATCH 4/4] ef/libstub: arm/arm64: randomize the base of the UEFI rt services region Ard Biesheuvel
2017-03-24 13:24   ` Ard Biesheuvel
2017-03-24 13:24   ` Ard Biesheuvel
2017-04-07 15:47   ` [kernel-hardening] " James Morse
2017-04-07 15:47     ` James Morse
2017-04-07 15:47     ` James Morse
2017-04-07 15:51     ` [kernel-hardening] " Ard Biesheuvel
2017-04-07 15:51       ` Ard Biesheuvel
2017-04-07 15:51       ` Ard Biesheuvel
2017-04-07 16:11       ` James Morse [this message]
2017-04-07 16:11         ` James Morse
2017-04-07 16:11         ` James Morse
2017-04-10  9:41       ` [kernel-hardening] " Mark Rutland
2017-04-10  9:41         ` Mark Rutland
2017-04-10  9:41         ` Mark Rutland
2017-04-10  9:44         ` [kernel-hardening] " Ard Biesheuvel
2017-04-10  9:44           ` Ard Biesheuvel
2017-04-10  9:44           ` Ard Biesheuvel

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=58E7BA48.70903@arm.com \
    --to=james.morse@arm.com \
    --cc=ard.biesheuvel@linaro.org \
    --cc=bp@alien8.de \
    --cc=catalin.marinas@arm.com \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=leif.lindholm@linaro.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-efi@vger.kernel.org \
    --cc=mark.rutland@arm.com \
    --cc=matt@codeblueprint.co.uk \
    --cc=mingo@kernel.org \
    --cc=rfranz@cavium.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.