linux-kernel - Re: [RFC] efi/tpm: add efi.tpm_log as a reserved region in 820_table

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240912-sapphire-koala-of-focus-918cff@leitao>
Date: Thu, 12 Sep 2024 07:29:09 -0700
From: Breno Leitao <leitao@...ian.org>
To: Ard Biesheuvel <ardb@...nel.org>
Cc: Usama Arif <usamaarif642@...il.com>, linux-efi@...r.kernel.org,
	kexec@...ts.infradead.org, ebiederm@...ssion.com, bhe@...hat.com,
	vgoyal@...hat.com, tglx@...utronix.de, dave.hansen@...ux.intel.com,
	x86@...nel.org, linux-kernel@...r.kernel.org, rmikey@...a.com,
	gourry@...rry.net
Subject: Re: [RFC] efi/tpm: add efi.tpm_log as a reserved region in
 820_table_firmware

On Thu, Sep 12, 2024 at 03:10:43PM +0200, Ard Biesheuvel wrote:
> On Thu, 12 Sept 2024 at 15:03, Breno Leitao <leitao@...ian.org> wrote:
> > On Thu, Sep 12, 2024 at 12:51:57PM +0200, Ard Biesheuvel wrote:
> > > I don't see how this could be an EFI bug, given that it does not deal
> > > with E820 tables at all.
> >
> > I want to back up a little bit and make sure I am following the
> > discussion.
> >
> > From what I understand from previous discussion, we have an EFI bug as
> > the root cause of this issue.
> >
> > This happens because the EFI does NOT mark the EFI TPM event log memory
> > region as reserved (EFI_RESERVED_TYPE).
> 
> Why do you think EFI should use EFI_RESERVED_TYPE in this case?
> 
> The EFI spec is very clear that EFI_RESERVED_TYPE really shouldn't be
> used for anything by EFI itself. It is quite common for EFI
> configuration tables to be passed as EfiRuntimeServicesData (SMBIOS),
> EfiBootServicesData (ESRT) or EFiAcpiReclaim (ACPI tables).
> 
> Reserved memory is mostly for memory that even the firmware does not
> know what it is for, i.e., particular platform specific uses.
> 
> In general, it is up to the OS to ensure that EFI configuration tables
> that it cares about should be reserved in the correct way.

Thanks for the explanation.

So, if I understand what you meant here, the TPM event log memory range
shouldn't be listed as a memory region in EFI memory map (as passed by
the firmware to the OS).

Hence, this is not a EFI firmware bug, but a OS/Kernel bug.

Am I correct with the statements above?

Another question, looking at the Spec[1] it says:

	If the ACPI TPM2 table contains the address and size of the Platform Firmware TCG log,
	firmware “pins” the memory associated with the Platform Firmware TCG log, and reports
	this memory as “Reserved” memory via the INT 15h/E820 interface


What is the 'firmware' in the statement above, that says that reports
the memory as reserved? (Is it libstub?!)

Thank you so much for guiding us here,
--breno

[1] https://trustedcomputinggroup.org/wp-content/uploads/PC-ClientPlatform_Profile_for_TPM_2p0_Systems_v49_161114_public-review.pdf