lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <5d530df3-7a7a-4cd7-bde6-92f733c7ae75@redhat.com> Date: Thu, 14 Sep 2017 12:21:59 +0200 From: Javier Martinez Canillas <javierm@...hat.com> To: Thiebaud Weksteen <tweek@...gle.com>, linux-efi@...r.kernel.org Cc: ard.biesheuvel@...aro.org, matt@...eblueprint.co.uk, linux-kernel@...r.kernel.org, mjg59@...gle.com, jgunthorpe@...idianresearch.com, tpmdd-devel@...ts.sourceforge.net, jarkko.sakkinen@...ux.intel.com, Peter Jones <pjones@...hat.com> Subject: Re: [tpmdd-devel] [PATCH v2 0/3] Call GetEventLog before ExitBootServices Hello Thiebaud, On 09/11/2017 12:00 PM, Thiebaud Weksteen via tpmdd-devel wrote: > With TPM 1.2, the ACPI table ("TCPA") has two fields to recover the Event Log > Area (LAML and LASA). These logs are useful to understand and rebuild the > final values of PCRs. > > With TPM 2.0, the ACPI table ("TPM2") does not contain these fields anymore. > The recommended method is now to call the GetEventLog EFI protocol before > ExitBootServices. > > Implement this method within the EFI stub and create copy of the logs for the > TPM device. This will create /sys/kernel/security/tpm0/binary_bios_measurements > for TPM 2.0 devices (similarly to the current behaviour for TPM 1.2 devices). > I've tested your patches on a system with an Intel PTT firmware based TPM2.0 and the measurements securityfs entry was correctly created and was able to read it: $ cat /sys/class/tpm/tpm0/device/description TPM 2.0 Device $ hexdump /sys/kernel/security/tpm0/binary_bios_measurements | head -n2 0000000 0000 0000 0008 0000 f504 15a0 1810 bf44 0000010 63d0 4fdb b8a4 f278 8dc7 c8aa 0014 0000 So please feel free to add: Tested-by: Javier Martinez Canillas <javierm@...hat.com> I also reviewed the patches and look good to me, I have just one question for patch #2, but I'll comment there. Best regards, -- Javier Martinez Canillas Software Engineer - Desktop Hardware Enablement Red Hat
Powered by blists - more mailing lists