Re: [tboot-devel] tboot not picking the right ACM module on Dell Latitude E5470

[Lukasz H. <luk...@li...>]

Hi Timo

On Tue, 2021-08-24 at 12:19 +0300, Timo Lindfors wrote:
> [replying to an old email thread]
> 
> On Tue, 7 Apr 2020, Lukasz Hawrylko wrote:
> > Unfortunately, this bug is not reported anywhere. In real life scenarios
> > I don't see any benefits of loading multiple SINITs. In most cases you
> > have one SINIT that is dedicated to the platform.
> > 
> > I am not sure if that issue can be fixed without moving TBOOT log memory
> > pool somewhere else and that change will brake other tools. It will be
> > better to change documentation that only one SINIT can be loaded. I will
> > check who is the owner of TBOOT page in Fedora's wiki.
> 
> Just for the record I hit this issue again on HP Elitedesk 800 G2 in 
> UEFI-only mode. Loading
> 
> 2nd_gen_i5_i7_SINIT_51.BIN
> 3rd_gen_i5_i7_SINIT_67.BIN
> 4th_gen_i5_i7_SINIT_75.BIN
> 5th_gen_i5_i7_SINIT_79.BIN
> 6th_7th_gen_i5_i7-SINIT_79.bin
> 7th_8th_gen_i5_i7-SINIT_81.bin
> GM45_GS45_PM45_SINIT_51.BIN
> Q35_SINIT_51.BIN
> Q45_Q43_SINIT_51.BIN
> Xeon-5600-3500-SINIT-v1.1.bin
> Xeon-E7-8800-4800-2800-SINIT-v1.1.bin
> i5_i7_DUAL_SINIT_51.BIN
> i7_QUAD_SINIT_51.BIN
> 
> causes the system to reset at SENTER with
> 
> TBOOT: TXT.ERRORCODE: 0x80000007
> TBOOT: 	 processor error 0x7
> 

Patch with fix is already prepared, I am waiting for GRUB team to merge
new multiboot2 module tag to publish it.

In meantime, if you have a system when you are able to reproduce this
issue, may I ask you to test the fix?

You have to build GRUB2 with following patch:
https://lists.gnu.org/archive/html/grub-devel/2021-08/msg00073.html

Here is a patch for TBOOT that uses changes in GRUB:

diff -r 6736ab640540 -r 47180cb4492f tboot/common/boot.S
--- a/tboot/common/boot.S	Tue Jul 06 11:02:08 2021 +0200
+++ b/tboot/common/boot.S	Thu Aug 19 14:17:40 2021 +0200
@@ -113,6 +113,13 @@
                    FB_MAX_VRES,   /* height */ \
                    FB_BPP         /* depth */
 
+        /* Module load preference tag */
+        mb2ht_init MB2_HDR_TAG_MOD_LOAD_PREFERENCE,
MB2_HDR_TAG_OPTIONAL, \
+                   0x900000,      /* min_addr */ \
+                   0xFFFFFFFF,    /* max_addr */ \
+                   0x1000,        /* align */ \
+                   0              /* preference */
+
         /* Multiboot2 header end tag. */
         mb2ht_init MB2_HDR_TAG_END, MB2_HDR_TAG_REQUIRED
 
diff -r 6736ab640540 -r 47180cb4492f tboot/include/multiboot.h
--- a/tboot/include/multiboot.h	Tue Jul 06 11:02:08 2021 +0200
+++ b/tboot/include/multiboot.h	Thu Aug 19 14:17:40 2021 +0200
@@ -77,6 +77,7 @@
 #define MB2_HDR_TAG_CONSOLE_FLAGS	  4
 #define MB2_HDR_TAG_FRAMEBUFFER		  5
 #define MB2_HDR_TAG_MOD_ALIGN		  6
+#define MB2_HDR_TAG_MOD_LOAD_PREFERENCE 11
 
 #define MB2_HDR_TAG_REQUIRED      0
 #define MB2_HDR_TAG_OPTIONAL		  1


If this works, I think that there is no need to change anything in the
documentation, but just submit the patch to fix that issue.

Thanks,
Lukasz