linux-kernel - Re: [PATCH] tpm: efi: Don't create binary_bios

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 30 Oct 2020 14:41:10 +0800
From:   Kai-Heng Feng <kai.heng.feng@...onical.com>
To:     Tyler Hicks <tyhicks@...ux.microsoft.com>
Cc:     "Kenneth R . Crudup" <kenny@...ix.com>,
        Mimi Zohar <zohar@...ux.ibm.com>,
        Peter Huewe <peterhuewe@....de>,
        Jarkko Sakkinen <jarkko@...nel.org>,
        Jason Gunthorpe <jgg@...pe.ca>,
        linux-integrity@...r.kernel.org,
        open list <linux-kernel@...r.kernel.org>,
        linux-efi@...r.kernel.org,
        Thiébaud Weksteen <tweek@...gle.com>,
        Ard Biesheuvel <ardb@...nel.org>
Subject: Re: [PATCH] tpm: efi: Don't create binary_bios_measurements file for
 an empty log



> On Oct 29, 2020, at 01:39, Tyler Hicks <tyhicks@...ux.microsoft.com> wrote:
> 
> On 2020-10-28 11:30:11, Tyler Hicks wrote:
>> So, we need help from Kai, Kenneth, or Mimi to verify my assumption that
>> their firmware is providing an empty main event log and a populated
>> final event log.
> 
> Hi Kai, Kenneth, and Mimi - could one or two of you please follow these
> steps:
> 
> 1) Apply the proposed patch in the grandparent of this email so that
>   your kernel doesn't crash
> 2) Revert commit 7f3d176f5f7e ("tpm: Require that all digests are
>   present in TCG_PCR_EVENT2 structures") so that
>   __calc_tpm2_event_size() goes back to being less picky and may treat
>   a final log event as a valid event log header
> 3) Add some debugging warnings in efi_tpm_eventlog_init() to check for
>   an empty main event log and a populated final event log, as shown
>   below
> 4) Boot the resulting kernel build, look for the warnings, and report
>   back
> 
> diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c
> index c1955d320fec..c4d2dbd5ed42 100644
> --- a/drivers/firmware/efi/tpm.c
> +++ b/drivers/firmware/efi/tpm.c
> @@ -78,6 +78,9 @@ int __init efi_tpm_eventlog_init(void)
> 		goto out;
> 	}
> 
> +	WARN(!log_tbl->size && final_tbl->nr_events,
> +	     "nr_events = %llu\n", final_tbl->nr_events);
> +
> 	tbl_size = 0;
> 	if (final_tbl->nr_events != 0) {
> 		void *events = (void *)efi.tpm_final_log
> @@ -95,6 +98,8 @@ int __init efi_tpm_eventlog_init(void)
> 		goto out_calc;
> 	}
> 
> +	WARN(!log_tbl->size && tbl_size, "tbl_size = %d\n", tbl_size);
> +
> 	memblock_reserve((unsigned long)final_tbl,
> 			 tbl_size + sizeof(*final_tbl));
> 	efi_tpm_final_log_size = tbl_size;
> 
> For your convenience, I've created a branch with these changes on top of
> v5.9:
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/linux.git/log/?h=tpm/bin-bios-measurements-debug

Dmesg attached.

Kai-Heng

Download attachment "dmesg" of type "application/octet-stream" (81122 bytes)


> 
> Thank you!
> 
> Tyler