From aa41b1998ecd50d59e3dd7d28e5d66218a7b9817 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Mon, 20 Jun 2022 16:37:42 +0400 Subject: [PATCH] Backport s_ContextSlotMask initialization fix Resolves: rhbz#2035731 --- ...g-state-initialize-s_ContextSlotMask.patch | 51 +++++++++++++++++++ libtpms.spec | 7 ++- 2 files changed, 57 insertions(+), 1 deletion(-) create mode 100644 0001-tpm2-When-writing-state-initialize-s_ContextSlotMask.patch diff --git a/0001-tpm2-When-writing-state-initialize-s_ContextSlotMask.patch b/0001-tpm2-When-writing-state-initialize-s_ContextSlotMask.patch new file mode 100644 index 0000000..59aaacc --- /dev/null +++ b/0001-tpm2-When-writing-state-initialize-s_ContextSlotMask.patch @@ -0,0 +1,51 @@ +From b662e6fd7169f31ef664ecd0b0b45547462e1e31 Mon Sep 17 00:00:00 2001 +From: Stefan Berger +Date: Tue, 4 Jan 2022 14:45:31 -0500 +Subject: [PATCH] tpm2: When writing state initialize s_ContextSlotMask if not + set + +If s_ContextSlotMask was not set since the TPM 2 was not initialized +by a call to TPM_Manufacture() or the state was not resumed, then +initialize the s_ContextSlotMask to 0xffff. + +This situation can occur if a VM with an attached swtpm was started +and the VM's firmware either doesn't support TPM or didn't get to +initialize the vTPM. + +The following commands recreated the issue with a SeaBIOS-only VM that +had no attached hard disk but an attached TPM 2: + +virsh start BIOS-only-VM ; virsh save BIOS-only-VM save.bin ; \ + virsh restore save.bin + +Error: Failed to restore domain from save.bin +error: internal error: qemu unexpectedly closed the monitor: \ +2022-01-04T19:26:18.835851Z qemu-system-x86_64: tpm-emulator: Setting the stateblob (type 2) failed with a TPM error 0x3 a parameter is bad +2022-01-04T19:26:18.835899Z qemu-system-x86_64: error while loading state for instance 0x0 of device 'tpm-emulator' +2022-01-04T19:26:18.835929Z qemu-system-x86_64: load of migration failed: Input/output error + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2035731 +Signed-off-by: Stefan Berger +--- + src/tpm2/NVMarshal.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/tpm2/NVMarshal.c b/src/tpm2/NVMarshal.c +index 996c73c..c7cd1e0 100644 +--- a/src/tpm2/NVMarshal.c ++++ b/src/tpm2/NVMarshal.c +@@ -1422,6 +1422,11 @@ STATE_RESET_DATA_Marshal(STATE_RESET_DATA *data, BYTE **buffer, INT32 *size) + written += UINT16_Marshal(&array_size, buffer, size); + for (i = 0; i < array_size; i++) + written += UINT16_Marshal(&data->contextArray[i], buffer, size); ++ ++ if (s_ContextSlotMask != 0x00ff && s_ContextSlotMask != 0xffff) { ++ /* TPM wasn't initialized, so s_ContextSlotMask wasn't set */ ++ s_ContextSlotMask = 0xffff; ++ } + written += UINT16_Marshal(&s_ContextSlotMask, buffer, size); + + written += UINT64_Marshal(&data->contextCounter, buffer, size); +-- +2.36.1 + diff --git a/libtpms.spec b/libtpms.spec index a4d391e..bf4da0e 100644 --- a/libtpms.spec +++ b/libtpms.spec @@ -3,7 +3,7 @@ Name: libtpms Version: 0.9.1 -Release: 1.%{gitdate}git%{gitversion}%{?dist} +Release: 2.%{gitdate}git%{gitversion}%{?dist} Summary: Library providing Trusted Platform Module (TPM) functionality License: BSD @@ -11,6 +11,7 @@ Url: http://github.com/stefanberger/libtpms Source0: libtpms-%{gitdate}.tar.xz Patch0001: 0001-tpm2-Do-not-call-EVP_PKEY_CTX_set0_rsa_oaep_label-fo.patch Patch0002: 0001-tpm2-Fix-size-check-in-CryptSecretDecrypt.patch +Patch0003: 0001-tpm2-When-writing-state-initialize-s_ContextSlotMask.patch BuildRequires: openssl-devel BuildRequires: pkgconfig gawk sed @@ -57,6 +58,10 @@ find %{buildroot} -type f -name '*.la' | xargs rm -f -- || : %{_mandir}/man3/* %changelog +* Mon Jun 20 2022 Marc-André Lureau - 0.9.1-2.20211126git1ff6fe1f43 +- Backport s_ContextSlotMask initialization fix + Resolves: rhbz#2035731 + * Mon Jun 13 2022 Marc-André Lureau - 0.9.1-1.20211126git1ff6fe1f43 - Backport RSA/OAEP fixes. Resolves: rhbz#2093651