linux-kernel - Re: [PATCH 1/3] tpm: protect against locality counter underflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <657ade76-98c5-4f93-9716-b471b31d07e2@oracle.com>
Date: Tue, 20 Feb 2024 14:57:59 -0800
From: ross.philipson@...cle.com
To: Jarkko Sakkinen <jarkko@...nel.org>,
        Lino Sanfilippo <l.sanfilippo@...bus.com>,
        Alexander Steffen <Alexander.Steffen@...ineon.com>,
        "Daniel P. Smith" <dpsmith@...rtussolutions.com>,
        Jason Gunthorpe <jgg@...pe.ca>, Sasha Levin <sashal@...nel.org>,
        linux-integrity@...r.kernel.org, linux-kernel@...r.kernel.org
Cc: Kanth Ghatraju <kanth.ghatraju@...cle.com>,
        Peter Huewe <peterhuewe@....de>
Subject: Re: [PATCH 1/3] tpm: protect against locality counter underflow

On 2/20/24 2:26 PM, Jarkko Sakkinen wrote:
> On Tue Feb 20, 2024 at 8:54 PM UTC, Lino Sanfilippo wrote:
>> for (i = 0; i <= MAX_LOCALITY; i++)
>> 	__tpm_tis_relinquish_locality(priv, i);
> 
> I'm pretty unfamiliar with Intel TXT so asking a dummy question:
> if Intel TXT uses locality 2 I suppose we should not try to
> relinquish it, or?

The TPM has five localities (0 - 4). Localities 1 - 4 are for DRTM 
support. For TXT, locality 4 is hard wired to the CPU - nothing else can 
touch it. Locality 3 is only ever accessible when the CPU is executing 
an AC (Authenticated Code) module. That leaves 1 and 2 for the DRTM 
software environment to use. If the DRTM software opens 1 or 2, it 
should close them before exiting the DRTM.

> 
> AFAIK, we don't have a symbol called MAX_LOCALITY.

Daniel added it in the patch set.

Thanks
Ross

> 
> BR, Jarkko