Repository navigation
Conversation
- Memory amplification fix in bbpc tl (700x DoS prevention) - HHDM offset validation in kernel parser - kernel_virtual_base validation in v2 profile parser - Rollback index validation in v2 auth handler - Documented all 10 identified critical flaws in FIX-ME.md
BREAKING ABI EXTENSION (appended fields — v1.0/v1.1 readers ignore):
bbp_tag_security grows from 128 to 176 bytes with the v1.2 fields
that carry the campaign's TPM verification data:
tcg2_log_start/size/crc — the staged TCG2 event log
tcg2_final_start/size/crc — the final events table
startup_locality — the PTP initial PCR[0] rule
tpm2_v2_flags — presence and validity flags
New flags:
BBP_TPM2_FLAG_TCG2_LOG_PRESENT
BBP_TPM2_FLAG_TCG2_FINAL_PRESENT
BBP_TPM2_FLAG_STARTUP_LOCALITY_VALID
BBP_TPM2_FLAG_VERIFIED
New kernel consumer (kernel/bbp_security.c):
1. Find the SECURITY tag (CRC-64 sealed by BBP)
2. Verify entropy CRC → seed kernel CSPRNG
3. Verify measurement CRC
4. Verify TCG2 log CRC (v1.2)
5. Replay the TCG2 log with the PTP startup-locality rule
6. Read live PCR bank through the CRB driver
7. Compare: replay == live → CHAIN_VERIFIED
Verdicts: NOT_PRESENT | ENTROPY_ONLY | CHAIN_VERIFIED |
CHAIN_MISMATCH | CRC_FAILED | TPM_UNREACHABLE
New BDM producer adapter (ports/bdm/):
Translates bear_uefi_handoff tcg2 fields into BBP SECURITY tags.
The stub already stages the TCG2 log below 1 GiB — the adapter
re-expresses it as BBP so any BBP kernel can consume it.
Campaign evidence: F6 (8/8 replay verified), F14 (PTP locality),
F22 (first-silicon boot fix), F24 (stub-side staging). All findings
from the two-generation TPM characterization on CSME 14 and CSME 16.
The branch never compiled: the v1.2 security tag is 128 + 52 = 180 bytes, not 176 — the _Static_assert and the selftest both carried the wrong size. Fixed the assert to 180 and updated the ABI selftest. Consumer correctness fixes: - The compile-time 'sizeof(*se) < 176' guard was constant-folded dead code; a CRC-valid v1.1 (128-byte) SECURITY tag would let the consumer read the v1.2 fields past the CRC-sealed region. Replaced with a runtime tag_size gate that fail-closes on short tags. - The TPM_UNREACHABLE path dropped the replay evidence; the shadow bank, masks and event counts are now reported so an unreachable live bank still proves what the log replayed. - The TCG2 replay was a stub that always returned zero events — the receipt chain could never reach CHAIN_VERIFIED. Backported the REAL campaign-verified replay core (Spec ID vendor-preamble anchoring, the final-events-table writer-bug recovery, the PTP startup-locality rule) proven by the 8/8 PCR replay on CSME 14/16 hardware. Layout: kernel/bbp_kernel.h moved to include/bbp/ (the public API root the consumer's <bbp/...> include already expected) and every stale reference was updated — root Makefile, sdk/c/Makefile, abi/selftests, ports (josh, linux01, minix, tinalinux, bdm), bootloader, examples, packaging tools and docs. Pre-existing v2 build fixes (never -Werror compiled): bbp_v2_profile.c called a nonexistent read_u64 (its own get64 was intended); bbp_v2_auth.c referenced undeclared capsule_pointer/envelope_pointer phantom names where the envelope base was intended. Validated: make abi, make test (0 failures), make importers-test, make sdk-check (ALL SDK CHECKS PASSED), make v2-test (0 failures).
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Extends `bbp_tag_security` from 128 to 176 bytes with v1.2 fields that carry the two-generation TPM campaign's verification data:
New kernel consumer (`kernel/bbp_security.c`):
New BDM producer adapter (`ports/bdm/`): translates `bear_uefi_handoff` TCG2 fields into BBP SECURITY tags.
Campaign evidence
Verified on two generations of Intel PTT (CSME 14/Ice Lake + CSME 16/Alder Lake):
Test plan