Re: [PATCH] x86: fix q35 kernel measurements broken due to rng seeding

2023-02-02 Thread H. Peter Anvin
On February 2, 2023 7:17:01 AM PST, James Bottomley wrote: >On Thu, 2023-02-02 at 07:03 -0800, H. Peter Anvin wrote: >[...] >> NAK. We need to fix the actual problem of the kernel stomping on >> memory it shouldn't, not paper around it. > >This is a first boot situation, not kexec (I just updated

Re: [PATCH] x86: fix q35 kernel measurements broken due to rng seeding

2023-02-02 Thread H. Peter Anvin
On February 2, 2023 7:17:01 AM PST, James Bottomley wrote: >On Thu, 2023-02-02 at 07:03 -0800, H. Peter Anvin wrote: >[...] >> NAK. We need to fix the actual problem of the kernel stomping on >> memory it shouldn't, not paper around it. > >This is a first boot situation, not kexec (I just updated

Re: [PATCH] x86: fix q35 kernel measurements broken due to rng seeding

2023-02-02 Thread H. Peter Anvin
On February 2, 2023 7:17:01 AM PST, James Bottomley wrote: >On Thu, 2023-02-02 at 07:03 -0800, H. Peter Anvin wrote: >[...] >> NAK. We need to fix the actual problem of the kernel stomping on >> memory it shouldn't, not paper around it. > >This is a first boot situation, not kexec (I just updated

Re: [PATCH] x86: fix q35 kernel measurements broken due to rng seeding

2023-02-02 Thread James Bottomley
On Thu, 2023-02-02 at 07:03 -0800, H. Peter Anvin wrote: [...] > NAK. We need to fix the actual problem of the kernel stomping on > memory it shouldn't, not paper around it. This is a first boot situation, not kexec (I just updated kexec because it should use any new mechanism we propose). Unlike

Re: [PATCH] x86: fix q35 kernel measurements broken due to rng seeding

2023-02-02 Thread H. Peter Anvin
On February 2, 2023 6:38:12 AM PST, James Bottomley wrote: >On Wed, 2023-02-01 at 15:48 -0500, Jason A. Donenfeld wrote: >[...] >> But it sounds like you might now have a concrete suggestion on >> something even better. I'm CCing hpa, as this is his wheelhouse, and >> maybe you two can divise the

Re: [PATCH] x86: fix q35 kernel measurements broken due to rng seeding

2023-02-02 Thread James Bottomley
On Wed, 2023-02-01 at 15:48 -0500, Jason A. Donenfeld wrote: [...] > But it sounds like you might now have a concrete suggestion on > something even better. I'm CCing hpa, as this is his wheelhouse, and > maybe you two can divise the next step while I'm away. Maybe the pad9 > thing you mentioned is

Re: [PATCH] x86: fix q35 kernel measurements broken due to rng seeding

2023-02-01 Thread Jason A. Donenfeld
Hi James, On Wed, Feb 1, 2023, 15:39 James Bottomley wrote: > On Wed, 2023-02-01 at 12:51 -0500, Jason A. Donenfeld wrote: > > It's not a secret, but I have so little internet right now that I > > can't even load a webpage, and I'm on my phone, hence the short > > HTMLified emails. > > > > In br

Re: [PATCH] x86: fix q35 kernel measurements broken due to rng seeding

2023-02-01 Thread James Bottomley
On Wed, 2023-02-01 at 12:51 -0500, Jason A. Donenfeld wrote: > It's not a secret, but I have so little internet right now that I > can't even load a webpage, and I'm on my phone, hence the short > HTMLified emails. > > In brief, though, it gets rid of all modifications to the kernel > image all to

Re: [PATCH] x86: fix q35 kernel measurements broken due to rng seeding

2023-02-01 Thread Jason A. Donenfeld
It's not a secret, but I have so little internet right now that I can't even load a webpage, and I'm on my phone, hence the short HTMLified emails. In brief, though, it gets rid of all modifications to the kernel image all together, so it should fix your issue. On Wed, Feb 1, 2023, 10:24 James Bo

Re: [PATCH] x86: fix q35 kernel measurements broken due to rng seeding

2023-02-01 Thread James Bottomley
On Wed, 2023-02-01 at 16:50 +, Peter Maydell wrote: > On Wed, 1 Feb 2023 at 15:25, James Bottomley > wrote: > > > > On Wed, 2023-02-01 at 10:10 -0500, Jason A. Donenfeld wrote: > > > This is already fixed via the patch that MST just sent in his > > > pull. > > > So wait a few days for that to

Re: [PATCH] x86: fix q35 kernel measurements broken due to rng seeding

2023-02-01 Thread Peter Maydell
On Wed, 1 Feb 2023 at 15:25, James Bottomley wrote: > > On Wed, 2023-02-01 at 10:10 -0500, Jason A. Donenfeld wrote: > > This is already fixed via the patch that MST just sent in his pull. > > So wait a few days for that to be merged and it'll be all set. > > > > No need for this patch here. Do no

Re: [PATCH] x86: fix q35 kernel measurements broken due to rng seeding

2023-02-01 Thread Dov Murik
Hi Jason, James, On 01/02/2023 17:24, James Bottomley wrote: > On Wed, 2023-02-01 at 10:10 -0500, Jason A. Donenfeld wrote: >> This is already fixed via the patch that MST just sent in his pull. >> So wait a few days for that to be merged and it'll be all set. >> >> No need for this patch here. D

Re: [PATCH] x86: fix q35 kernel measurements broken due to rng seeding

2023-02-01 Thread James Bottomley
On Wed, 2023-02-01 at 10:10 -0500, Jason A. Donenfeld wrote: > This is already fixed via the patch that MST just sent in his pull. > So wait a few days for that to be merged and it'll be all set. > > No need for this patch here. Do not merge. If it's not a secret, would it be too much trouble to

Re: [PATCH] x86: fix q35 kernel measurements broken due to rng seeding

2023-02-01 Thread Daniel P . Berrangé
On Wed, Feb 01, 2023 at 09:56:35AM -0500, James Bottomley wrote: > On Wed, 2023-02-01 at 14:35 +, Daniel P. Berrangé wrote: > > On Wed, Feb 01, 2023 at 08:57:10AM -0500, James Bottomley wrote: > > > The origin commit for rng seeding 67f7e426e5 ("hw/i386: pass RNG > > > seed > > > via setup_data

Re: [PATCH] x86: fix q35 kernel measurements broken due to rng seeding

2023-02-01 Thread Jason A. Donenfeld
This patch is not needed. It is already fixed in a pending pull. Do not merge. On Wed, Feb 1, 2023, 09:57 James Bottomley wrote: > On Wed, 2023-02-01 at 14:35 +, Daniel P. Berrangé wrote: > > On Wed, Feb 01, 2023 at 08:57:10AM -0500, James Bottomley wrote: > > > The origin commit for rng see

Re: [PATCH] x86: fix q35 kernel measurements broken due to rng seeding

2023-02-01 Thread Jason A. Donenfeld
This is already fixed via the patch that MST just sent in his pull. So wait a few days for that to be merged and it'll be all set. No need for this patch here. Do not merge. On Wed, Feb 1, 2023, 08:57 James Bottomley wrote: > The origin commit for rng seeding 67f7e426e5 ("hw/i386: pass RNG seed

Re: [PATCH] x86: fix q35 kernel measurements broken due to rng seeding

2023-02-01 Thread James Bottomley
On Wed, 2023-02-01 at 14:35 +, Daniel P. Berrangé wrote: > On Wed, Feb 01, 2023 at 08:57:10AM -0500, James Bottomley wrote: > > The origin commit for rng seeding 67f7e426e5 ("hw/i386: pass RNG > > seed > > via setup_data entry") modifies the kernel image file to append a > > random seed.  Obvio

Re: [PATCH] x86: fix q35 kernel measurements broken due to rng seeding

2023-02-01 Thread Daniel P . Berrangé
On Wed, Feb 01, 2023 at 08:57:10AM -0500, James Bottomley wrote: > The origin commit for rng seeding 67f7e426e5 ("hw/i386: pass RNG seed > via setup_data entry") modifies the kernel image file to append a > random seed. Obviously this makes the hash of the kernel file > non-deterministic and so br

[PATCH] x86: fix q35 kernel measurements broken due to rng seeding

2023-02-01 Thread James Bottomley
The origin commit for rng seeding 67f7e426e5 ("hw/i386: pass RNG seed via setup_data entry") modifies the kernel image file to append a random seed. Obviously this makes the hash of the kernel file non-deterministic and so breaks both measured and some signed boots. The commit notes it's only for