linux-kernel - Re: [REGRESSION] tpm_tis on Lenovo T410 broken in 2.6.38-rc6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110305164837.GB11120@thunk.org>
Date:	Sat, 5 Mar 2011 11:48:37 -0500
From:	Ted Ts'o <tytso@....edu>
To:	Rajiv Andrade <srajiv@...ux.vnet.ibm.com>
Cc:	Linus Torvalds <torvalds@...ux-foundation.org>,
	James Morris <jmorris@...ei.org>, linux-kernel@...r.kernel.org
Subject: Re: [REGRESSION] tpm_tis on Lenovo T410 broken in 2.6.38-rc6

On Fri, Mar 04, 2011 at 11:44:18AM -0300, Rajiv Andrade wrote:
> The bug was that when running the kernel with IMA, at boot time, it
> issues 3 TPM commands IIRC, given the 2 min timeout,
> when the TPM didn't respond due to it not working with interrupts
> for example, the boot hang for 6 minutes.

At boot time, why don't you just poll?  Maybe I'm missing something.

Or you could just simply use a different default timeout during the
boot sequence, or simply tell your IMA users to disable it, since if
you are just hacking the TPM to do a fast fail, the IMA is going to be
broken anyway, right?

> Thanks, it is. HZ isn't enough time for this TPM/setup to have short
> timeout commands to succeed, including
> the tpm_get_timeouts(). I was skeptic at first that this would be
> the reason since I have the same machine,
> and was working for me, the reason I asked for these parameters
> setup attempts.

Yes, but you're probably doing different TPM operations than I am....
I'm not trying to do IMA, I'm trying to login to a WPA2 protected
network where the private key needed to authenticate to the enterprise
wireless network is locked in the TPM.

						- Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/