Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <da7d3871-3b2f-1172-62a8-70f6856e4968@siemens.com>
Date:   Fri, 9 Jun 2023 08:40:03 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.11.0
Subject: Re: [PATCH v5 3/3] efi: Add tee-based EFI variable driver
Content-Language: en-US
To:     Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc:     Ard Biesheuvel <ardb@kernel.org>,
        Sumit Garg <sumit.garg@linaro.org>,
        Masahisa Kojima <masahisa.kojima@linaro.org>,
        Jens Wiklander <jens.wiklander@linaro.org>,
        linux-kernel@vger.kernel.org, op-tee@lists.trustedfirmware.org,
        Johan Hovold <johan+linaro@kernel.org>,
        Maxime Coquelin <mcoquelin.stm32@gmail.com>,
        Alexandre Torgue <alexandre.torgue@foss.st.com>,
        linux-efi@vger.kernel.org,
        linux-stm32@st-md-mailman.stormreply.com,
        linux-arm-kernel@lists.infradead.org,
        "Su, Bao Cheng (RC-CN DF FA R&D)" <baocheng.su@siemens.com>
References: <20230526010748.1222-1-masahisa.kojima@linaro.org>
 <CAC_iWj+E7-XK6dCeSn4205K0O3EZCLxCaC+adu-14ST6sdudfA@mail.gmail.com>
 <76da826f-b608-6add-5401-6de818b180e3@siemens.com>
 <CAFA6WYPCDRjFzsUMU=SNzEt88nT7Fcm1eOFL8z4HiQO+=2JeVA@mail.gmail.com>
 <cc6bd203-83ea-c247-0986-7fec6f327ee8@siemens.com>
 <CAC_iWjKZNHJxq4VMFnV7oQngwBBCQveh=s34u1LZ59YUqViPbw@mail.gmail.com>
 <CAC_iWjJMv68yLC606SBhMmBYkR4wVC8SvUcPvNM=RX_qL=9Bvw@mail.gmail.com>
 <b9b8c1d3-fc8e-df94-d12b-a9e3debf3418@siemens.com>
 <CAC_iWj+cP4RfDNu_n-ZOp7A62W34drLpPszN_hrkqF_aPTLtMg@mail.gmail.com>
 <871ece13-7d6e-44d4-3bda-317658202f6f@siemens.com>
 <CAC_iWjKgCJWgKU8tC3Nfn-0CgwGhw89B3JpTgsjkjDDOcWZEdw@mail.gmail.com>
 <CAMj1kXGbXdbDr6DbyuziSFuxMgAimjNnkhqy8C-S5AbxdnixuQ@mail.gmail.com>
 <CAC_iWjJ0uw_p9=6C+U+q8BNQgnDBgbDpcu8s8c80oB25i9y77w@mail.gmail.com>
 <3eb9bf84-4cf0-6cfe-9ad3-f7eef7d775fb@siemens.com>
 <CAC_iWjLdmmQ4+BVt_mOP5Ht9jDHQqoVV+-ATR-nDrmG37raGjQ@mail.gmail.com>
From:   Jan Kiszka <jan.kiszka@siemens.com>
In-Reply-To: <CAC_iWjLdmmQ4+BVt_mOP5Ht9jDHQqoVV+-ATR-nDrmG37raGjQ@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?bE43RWJVNzhzM0t1V25PWEdCdjhTbm10RVlOQUVRV20wNkVlMGdDUUwrZnhl?=
 =?utf-8?B?Y0wzMWRsTVQ2L2MzMzZUWVhLRUZlS29RaStQNStPNFlGWkpuRVd6aUg0dFQw?=
 =?utf-8?B?aENmQkdzbERIdWpjUVVSL0owYUROZ1FvS0dobTZyMTRBNlYzSTBvSXJWR2ZH?=
 =?utf-8?B?VnJGNml3VkhiVVYyaE8yM1d3ZUN1NEljUzBtR3JZc1BtVXU1UG16YURvZUtu?=
 =?utf-8?B?S2tCbHFERzZWT0pXVHF0ZkJuNjl0T0NmbWxZWnpZelgveU9NK1JjeGR3NSs2?=
 =?utf-8?B?TWhrdm82ZkVVVi9oWmhUZmR0T2NDMjgzdW1aK3BWMnRhM01BMnlUbExSTmkw?=
 =?utf-8?B?Q21CVTloNTJBSFB4cXk0ai9BN3NQT2RpYlE2L2NiNjQ3cTBjNk1jZkRzb01P?=
 =?utf-8?B?c2dWRmo5bXlWbDd4UGxNWXhWcldlcXdQeEJ3UnhPS0M0dEx4b2NUMTlwc1NS?=
 =?utf-8?B?UU9xRVl1cDdWazJXb3ZRbXJyNUl5cDhPSEp4dXZ0ckQ3cit3U1ZBSzV6N3RK?=
 =?utf-8?B?K2x4QllCNDZzaHp3eEFhQzg1NXRQV0lLekFkQTM5MUxZU2psWnl5Wnkyd1Ro?=
 =?utf-8?B?Y29iM0ZWVi9Mbkt5eVg0bC9yMEU4KzA1WWluNXlJSXFXQVNJZjBha1hPQnpJ?=
 =?utf-8?B?dStuZTRjSm42cDgwRlZmbXBpbDVSLytYaVpBT3kyKy9OUUYwY1Nrd29MZGJP?=
 =?utf-8?B?UnlOd1VBY2gzeEJGRzdBVUJHM3I3ZndXRGhuN3RJVGcxUFJHME1CQXAveFo0?=
 =?utf-8?B?ZHBzUEg1cUJvc2xOY0JaaGNlaFUzMjNQN0dCUVJIVTRUU2wwN0tDcGEveHBa?=
 =?utf-8?B?US9nR2UrVlFSbGN1MHZ0QXZRRXAyTnM1NkVoY3ppQ1JwUVQzVWZWVzJpY3BL?=
 =?utf-8?B?ajdUcXRHbnNCNFRyK3Zya2s4TFZ3bDdJNkxlNlZFb3M5clozOU1iUlNGL1hB?=
 =?utf-8?B?SVFGajJPV0x5TWJQWkVHSnBjRFhoQjVxaWdNVWdBS0dBNmtmQUg2dU5IT2xy?=
 =?utf-8?B?ZGhXU0JCd3VYT0Z2Zjh6bkhwNW5WTmpXaDF2cU9xV0lCdUt5Mm4vbDhtR1pW?=
 =?utf-8?B?VExVMzJKM3huZWtzeHQ5WTJnWDl6N3Z1NmRreWNiYjRTWHhDdGhQSFBuUURm?=
 =?utf-8?B?KytmSk1uZUZndjg1OEtrZVVlT0pTdnk3U2o1RzIxUXVvZ1lQczVOVVBYbS8v?=
 =?utf-8?B?eGtHTVBHSjkxcEpvL0JKV0VCRjZlZWRyUlhqdWt2THUvL0ZNd0QrUFllTHg1?=
 =?utf-8?B?WitudVYxNG9BU0R5NkpaN3EzbzVrRm5USU5EMkpudkdtMVRXcVFwZmNpVVoy?=
 =?utf-8?B?eWRZWHRlWXR6aG5veUpOdCtxRlBFWHd2NXBCL2padHVVczVaWkZKam5paUNl?=
 =?utf-8?B?eUE4UENGZmhocW9ETFZYelByVTZmZi9lZFdZeTdYV01VbGZRUDZJbmg2a2oz?=
 =?utf-8?B?bUpSQjNWMnVUc3lJMTN5MktyVUxaRGJEMFVoVmNadFplcjJXdzdlVFBja0NS?=
 =?utf-8?B?Ym0rWVpoYVg5anNlcElMTDhYRmcvYUZVemw0eWwwOHJCOHN0b2lINityazI1?=
 =?utf-8?B?Zm1FS3dCZDRxVFJNcXBQdkw5cGl3ekdWeXBJVGMxSVdrMWxCMndVeENSSW52?=
 =?utf-8?B?a3ZDN091NzNyYkNma2poMzJRZ0tHVHovblJSMWl3bmZIazBrR0xwcWhKSDYy?=
 =?utf-8?B?bzFrM0xjTlFGZjIyMzVRaUcwRkFuS0RuS1E0Qkp3V01YUlNhakdxSkRhRmpB?=
 =?utf-8?B?RVFyM1dJbElXNmtjTCtNcDBxOFBOZnRocHRxcitPMDJoSlBPdlB3YktRR2Qr?=
 =?utf-8?B?VEk4K1lIMnA5U0ZEQ0w4ZTJoc1RUOGFqaUVZVHpmcGY2TlorZkRhTGxKdW9P?=
 =?utf-8?B?NjVna2NwNndSU2ZhdUJSSGQzUEV4TTFwbGlTakJHc2dYbHFFdGdqVkRheTgr?=
 =?utf-8?B?TDhLZDVoVG9qeElIVmlpUnVYVDBFM2ZacFJzSjlYVTV6UlVtOTQyNE5UQnh6?=
 =?utf-8?B?WS9qZjJFdTc0R0VMTGZmeWlhV0JqcGpmUUNnV1JlMjUrQ0tvTlMvdDVWTDNr?=
 =?utf-8?B?Q1luN2I2ZzdzWGRSK2drR1lsZkJNTngvb3hyVGttSVpNY1lCRjZydCtrNjB1?=
 =?utf-8?Q?A7q6wn35UpLaPxs2X0rAJIllu?=
X-OriginatorOrg: siemens.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 365c997c-e45d-420c-aac9-08db68b45c9a
X-MS-Exchange-CrossTenant-AuthSource: AS4PR10MB6181.EURPRD10.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Jun 2023 06:40:06.1087
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: WlzwlCfqS3W7DKR3vKE90MdQBhEt8M5oPcNfXlLn8X9TQkq1gXzWcZprbsb8/6N3rxTJNVaF6oRFWqpG2Dy/5A==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR10MB7732
X-Spam-Status: No, score=-1.2 required=5.0 tests=BAYES_00,DKIMWL_WL_MED,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,
        NICE_REPLY_A,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,
        SPF_NONE,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=no
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 09.06.23 08:34, Ilias Apalodimas wrote:
> Hi Jan,
> 
> [...]
> 
>>> --- a/drivers/firmware/efi/vars.c
>>> +++ b/drivers/firmware/efi/vars.c
>>> @@ -123,7 +123,7 @@ EXPORT_SYMBOL_GPL(efivars_unregister);
>>>
>>>  bool efivar_supports_writes(void)
>>>  {
>>> -       return __efivars && __efivars->ops->set_variable;
>>> +       return __efivars && __efivars->ops->set_variable != set_variable_int;
>>>  }
>>>  EXPORT_SYMBOL_GPL(efivar_supports_writes);
>>>
>>> diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
>>> index e028fafa04f3..e40b5c4c5106 100644
>>> --- a/fs/efivarfs/super.c
>>> +++ b/fs/efivarfs/super.c
>>> @@ -242,9 +242,6 @@ static int efivarfs_fill_super(struct super_block
>>> *sb, struct fs_context *fc)
>>>         sb->s_d_op              = &efivarfs_d_ops;
>>>         sb->s_time_gran         = 1;
>>>
>>> -       if (!efivar_supports_writes())
>>> -               sb->s_flags |= SB_RDONLY;
>>> -
>>>         inode = efivarfs_get_inode(sb, NULL, S_IFDIR | 0755, 0, true);
>>>         if (!inode)
>>>                 return -ENOMEM;
>>> diff --git a/include/linux/efi.h b/include/linux/efi.h
>>> index 58d1c271d3b0..ec0ac6ef50a3 100644
>>> --- a/include/linux/efi.h
>>> +++ b/include/linux/efi.h
>>> @@ -1084,6 +1084,10 @@ int efivars_register(struct efivars *efivars,
>>>                      const struct efivar_operations *ops);
>>>  int efivars_unregister(struct efivars *efivars);
>>>
>>> +efi_status_t set_variable_int(efi_char16_t *name, efi_guid_t *vendor,
>>> +                             u32 attributes, unsigned long data_size,
>>> +                             void *data);
>>> +
>>>  void efivars_generic_ops_register(void);
>>>  void efivars_generic_ops_unregister(void);
>>>
>>> Thanks
>>> /Ilias
>>
>> As just written in my other reply: The root cause is the dependency on
>> tee-supplicant daemon. That needs to be resolved, and then also r/w
>> mounting will just work.
> 
> That's partially true.  If we solve the dependency your problem will
> go away only if everything gets compiled as built in.  But if you have
> them as modules there's still a chance you mount the efivarfs before
> installing all the modules.  In that case, you'll end up with the same
> problem no?

Obviously, this will need proper probing of the TA services in the
proper order so that the STMM driver is pulled in before efivarfs gets used.

> 
> That's why I think this patch (or a variation of it) is useful.  It
> solves the kernel panic you are seeing if you remount the efivarfs as
> RW and It unifies the way the kernel responds to userspace no matter
> what the firmware does with its setvariableRT service.

I'm not against fixes crashes, but the r/w issue is a different thing IMHO.

Jan

-- 
Siemens AG, Technology
Competence Center Embedded Linux