linux-kernel - Re: [PATCH v2 1/1] x86/hyperv: Use Hyper-V entropy to seed guest random number generator

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 13 Mar 2024 22:33:05 -0600
From: "Jason A. Donenfeld" <Jason@...c4.com>
To: Michael Kelley <mhklinux@...look.com>
Cc: "haiyangz@...rosoft.com" <haiyangz@...rosoft.com>, "wei.liu@...nel.org" <wei.liu@...nel.org>, 
	"decui@...rosoft.com" <decui@...rosoft.com>, "tglx@...utronix.de" <tglx@...utronix.de>, 
	"mingo@...hat.com" <mingo@...hat.com>, "bp@...en8.de" <bp@...en8.de>, 
	"dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>, "hpa@...or.com" <hpa@...or.com>, 
	"arnd@...db.de" <arnd@...db.de>, "tytso@....edu" <tytso@....edu>, "x86@...nel.org" <x86@...nel.org>, 
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, 
	"linux-hyperv@...r.kernel.org" <linux-hyperv@...r.kernel.org>, 
	"linux-arch@...r.kernel.org" <linux-arch@...r.kernel.org>
Subject: Re: [PATCH v2 1/1] x86/hyperv: Use Hyper-V entropy to seed guest
 random number generator

Hi Michael,

On Wed, Mar 13, 2024 at 10:30 PM Michael Kelley <mhklinux@...look.com> wrote:
> By default, Linux doesn't verify checksums when accessing ACPI tables
> during early boot, though you can add "acpi_force_table_verification"
> to the kernel boot line.  The default is shown in dmesg like this:
>
> [    0.004419] ACPI: Early table checksum verification disabled
>
> The checksum of all tables is checked slightly later in boot, though
> it's after my entropy code has run.  Without the checksum fixup,
> this error is output:
>
> [    0.053752] ACPI BIOS Warning (bug): Incorrect checksum in table
>                 [OEM0] - 0x8B, should be 0x82 (20230628/utcksum-58)
>
> At this point, the checksum error doesn't really matter, but I
> don't want the warning showing up.  I need to experiment a
> bit, but probably the best approach is to set the data length to
> zero (and adjust the checksum) while leaving the rest of the ACPI
> table header intact.  It will be more difficult to make the table
> disappear entirely as it appears in a global list of ACPI tables.

That makes sense. If the length is getting set to zero and the data
itself zeroed, I would assume that the checksum evaluates to some
constant value (0? ~0? dunno how it's computed), so that should ease
things a bit.

Jason