From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1ogWji-00009F-3v for mharc-grub-devel@gnu.org; Thu, 06 Oct 2022 15:40:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:55980) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ogWjd-00008i-07 for grub-devel@gnu.org; Thu, 06 Oct 2022 15:40:45 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:3588) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ogWjZ-0005ww-3a for grub-devel@gnu.org; Thu, 06 Oct 2022 15:40:42 -0400 Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 296JDgNR018004; Thu, 6 Oct 2022 19:40:39 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=message-id : date : mime-version : subject : to : cc : references : from : in-reply-to : content-type : content-transfer-encoding; s=pp1; bh=QOtsBrgn97Q37zf/b+bYOYKV/IewYHw4pXM7ax8B9gg=; b=oQlaJXiEiRh+uCo3rTiJBm0+8ivqGMN0c/7c9T7kC7VtD+txhONLN3L8OYcvpEBsunHW wKG5sDqnE+gHIaamNyjDp8SHcPHyas0Aa/96ycb5hgfFfH7YR1WEl2Si10jdO5jMgFBX 7jdGOr8lTCLRvdzjpplkFV3AsohcRIUwemULd9YDkEhPMu/iHFpmCpaoziX6dIIpHGE6 Y3LOKhSfqsT04MfyEsa9avudBe4/G64f+F8WIUVbX0DoIbhmbBH8U+7qmoQ/jt56Cwxo 4IDX9RVX1pIDlKXPTrSDOVMZlmHV/63cTAlJbGMffj74k7RK3I79KEbEiRwf3y/Hz49M ew== Received: from ppma01wdc.us.ibm.com (fd.55.37a9.ip4.static.sl-reverse.com [169.55.85.253]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3k2500gsec-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 06 Oct 2022 19:40:38 +0000 Received: from pps.filterd (ppma01wdc.us.ibm.com [127.0.0.1]) by ppma01wdc.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 296Jadja005354; Thu, 6 Oct 2022 19:40:38 GMT Received: from b01cxnp23033.gho.pok.ibm.com (b01cxnp23033.gho.pok.ibm.com [9.57.198.28]) by ppma01wdc.us.ibm.com with ESMTP id 3jyqaehv7j-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 06 Oct 2022 19:40:38 +0000 Received: from smtpav04.wdc07v.mail.ibm.com ([9.208.128.116]) by b01cxnp23033.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 296JebOA62456256 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 6 Oct 2022 19:40:37 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1F21358054; Thu, 6 Oct 2022 19:40:37 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BBE5158045; Thu, 6 Oct 2022 19:40:36 +0000 (GMT) Received: from [9.47.158.152] (unknown [9.47.158.152]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Thu, 6 Oct 2022 19:40:36 +0000 (GMT) Message-ID: <5cf6c3ac-bb22-97d6-e11d-be4032601c03@linux.ibm.com> Date: Thu, 6 Oct 2022 15:40:36 -0400 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.12.0 Subject: Re: [PATCH] tpm: Disable tpm verifier if tpm is not present Content-Language: en-US To: The development of GNU GRUB Cc: Michael Chang References: <20220908042301.12515-1-mchang@suse.com> From: Stefan Berger In-Reply-To: <20220908042301.12515-1-mchang@suse.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-TM-AS-GCONF: 00 X-Proofpoint-GUID: U75prh0vMIV9esAS8Mj8BTe7LlqE5O_C X-Proofpoint-ORIG-GUID: U75prh0vMIV9esAS8Mj8BTe7LlqE5O_C X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1 definitions=2022-10-06_04,2022-10-06_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 adultscore=0 suspectscore=0 mlxlogscore=999 mlxscore=0 malwarescore=0 spamscore=0 lowpriorityscore=0 bulkscore=0 clxscore=1011 impostorscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2209130000 definitions=main-2210060114 Received-SPF: pass client-ip=148.163.158.5; envelope-from=stefanb@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -33 X-Spam_score: -3.4 X-Spam_bar: --- X-Spam_report: (-3.4 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-1.435, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Oct 2022 19:40:46 -0000 On 9/8/22 00:23, Michael Chang via Grub-devel wrote: > This helps to prevent out of memory error when reading large files via disablig > tpm device as verifier has to read all content into memory in one chunk to > measure the hash and extend to tpm. > > Signed-off-by: Michael Chang > --- > grub-core/commands/efi/tpm.c | 37 ++++++++++++++++++++++++++++++++++++ > grub-core/commands/tpm.c | 4 ++++ > include/grub/tpm.h | 1 + > 3 files changed, 42 insertions(+) > > diff --git a/grub-core/commands/efi/tpm.c b/grub-core/commands/efi/tpm.c > index ae09c1bf8b..4f0011f6f5 100644 > --- a/grub-core/commands/efi/tpm.c > +++ b/grub-core/commands/efi/tpm.c > @@ -287,3 +287,40 @@ grub_tpm_measure (unsigned char *buf, grub_size_t size, grub_uint8_t pcr, > else > return grub_tpm2_log_event (tpm_handle, buf, size, pcr, description); > } > + > +int > +grub_tpm_present () nit: void > +{ > + grub_efi_handle_t tpm_handle; > + grub_efi_uint8_t protocol_version; > + > + if (!grub_tpm_handle_find (&tpm_handle, &protocol_version)) > + return 0; > + > + if (protocol_version == 1) > + { > + grub_efi_tpm_protocol_t *tpm; > + > + tpm = grub_efi_open_protocol (tpm_handle, &tpm_guid, > + GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL); > + if (!tpm) > + { > + grub_dprintf ("tpm", "Cannot open TPM protocol\n"); > + return 0; > + } > + return grub_tpm1_present (tpm); > + } > + else > + { > + grub_efi_tpm2_protocol_t *tpm; > + > + tpm = grub_efi_open_protocol (tpm_handle, &tpm2_guid, > + GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL); > + if (!tpm) > + { > + grub_dprintf ("tpm", "Cannot open TPM protocol\n"); > + return 0; > + } > + return grub_tpm2_present (tpm); > + } > +} > diff --git a/grub-core/commands/tpm.c b/grub-core/commands/tpm.c > index 2052c36eab..cb8ed6b949 100644 > --- a/grub-core/commands/tpm.c > +++ b/grub-core/commands/tpm.c > @@ -86,10 +86,14 @@ struct grub_file_verifier grub_tpm_verifier = { > > GRUB_MOD_INIT (tpm) > { > + if (!grub_tpm_present()) > + return; > grub_verifier_register (&grub_tpm_verifier); > } > > GRUB_MOD_FINI (tpm) > { > + if (!grub_tpm_present()) > + return; > grub_verifier_unregister (&grub_tpm_verifier); > } > diff --git a/include/grub/tpm.h b/include/grub/tpm.h > index 5c285cbc52..c19fcbd0a6 100644 > --- a/include/grub/tpm.h > +++ b/include/grub/tpm.h > @@ -36,4 +36,5 @@ > > grub_err_t grub_tpm_measure (unsigned char *buf, grub_size_t size, > grub_uint8_t pcr, const char *description); > +int grub_tpm_present (void); > #endif Reviewed-by: Stefan Berger