Re: Verifier running out of memory on ieee1275/powerpc64

[Eric Snowberg]

> On Mar 19, 2020, at 10:37 AM, Stefan Berger <address@hidden> wrote:
> 
> On 3/18/20 6:17 PM, Simon Hardy wrote:
>>>> I was wondering whether it would not be possible to load the raw file
>>>> into memory, pass it to the firmware for hashing (and logging) via the
>>>> verifier, and if we do not trust that the firmware treated the file data
>>>> as a read-only array, load the file again into the same array right
>>>> after. This way we wouldn't need more memory. [*] However, I am not sure
>>>> how it fits into the architecture with the verifiers or whether the TPM
>>>> verifier would have to take on a special role (possibly with a flag)
>>>> then.
>>>> 
>>>> You didn't pick up on the idea of a bigger heap. Is there a problem with
>>>> the heap size somehow? My machine has GBs of memory, so it really
>>>> shouldn't be a problem to get memory.
>>> I think that's the problem to solve, at least for this platform, since none
>>> of the verifiers will work due to the memory exhaustion issue.
>> Increasing the heap size may be the easiest way for you to solve this
>> problem. I am not so familiar with the issues around doing this, but I
>> have seen recent discussion on this list.
> 
> I found the lsmmap command and it shows me some impressive memory ranges to 
> be known:
> 
> base_addr = 0x4000, length = 0x17c000, available RAM
> 
> base_addr = 0x1fffff, length = 0x1, available RAM
> 
> base_addr = 0x21ffff, length = 0x1, available RAM
> 
> base_addr = 0x2000000, length = 0x7bbf0000, available RAM
> 
> base_addr = 0x7feffffff, length = 0x1, available RAM
> 
> base_addr = 0x800903dc, length = 0x7ff6fc24, available RAM
> 
> There's more than needed memory here. It doesn't seem to be available for 
> grub_malloc, though.

On SPARC, I thought the code was never written to claim memory in different 
regions.
Does that same problem exist on PPC?

I ran into a lot of memory corruption problems with ofdisk.  I don’t know if 
this
will solve your problem, but you could try this patch:

https://lists.gnu.org/archive/html/grub-devel/2016-06/msg00035.html

I couldn’t get any new ieee1275 code to work without it.