linux-kernel - Re: [PATCH RFC] tpm: disable hwrng for known-defective AMD RNGs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 10 Feb 2023 02:08:17 +0100
From:   "Jason A. Donenfeld" <Jason@...c4.com>
To:     Jarkko Sakkinen <jarkko@...nel.org>
Cc:     regressions@...ts.linux.dev, linux-integrity@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Mario Limonciello <mario.limonciello@....com>,
        Thorsten Leemhuis <regressions@...mhuis.info>,
        James Bottomley <James.Bottomley@...senpartnership.com>
Subject: Re: [PATCH RFC] tpm: disable hwrng for known-defective AMD RNGs

On Fri, Feb 10, 2023 at 02:54:36AM +0200, Jarkko Sakkinen wrote:
> On Thu, Feb 09, 2023 at 12:31:20PM -0300, Jason A. Donenfeld wrote:
> > Do not register a hwrng for certain AMD TPMs that are running an old
> 
> What do you mean by "certain AMD TPMs"?
> 
> > known-buggy revision. Do this by probing the TPM2_PT_MANUFACTURER,
> 
> Which revision?
> 
> > TPM2_PT_FIRMWARE_VERSION_1, and TPM2_PT_FIRMWARE_VERSION_2 properties,
> > and failing when an "AMD"-manufactured TPM2 chip is below a threshold.
> 
> What do you mean by "threshold"?
> 
> This also lacks desription of:
> 
> 1. What kind of changes are done.
> 2. Why do they they are reasonable.

YEP! And guess what? It doesn't matter at all one bit. Why? Because
Mario, the AMD engineer working on this, is tuned into the goal here and
he's the one who will be reworking this PoC draft into a real non-RFC
commit. We've been discussing this over on the bugzilla Thorsten sent to
you on Feb 2: https://bugzilla.kernel.org/show_bug.cgi?id=216989

> > BROKEN BROKEN BROKEN - I just made the version numbers up and haven't
> > tested this because I don't actually have hardware for it. I'm posting
> > this so that Mario can take over its development and submit a v2 himself
> > once he has confirmed the versioning info from inside AMD.
> 
> Is this paragraph meant for commit log?

Obviously not; did you read it?

Jason