All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
To: Gary Lin <glin@suse.com>
Cc: The development of GNU GRUB <grub-devel@gnu.org>,
	Daniel Kiper <daniel.kiper@oracle.com>,
	mchang@suse.com, patrick.colp@oracle.com,
	Stefan Berger <stefanb@linux.ibm.com>
Subject: Re: [PATCH v2 1/7] tss2: Add TPM2_PCR_Event command
Date: Thu, 17 Jul 2025 12:24:55 +0530	[thread overview]
Message-ID: <8DB4DF01-45C1-4647-A714-4C2CE4B56C22@linux.ibm.com> (raw)
In-Reply-To: <20250715053634.20799-2-glin@suse.com>


[-- Attachment #1.1: Type: text/plain, Size: 7131 bytes --]



> On 15 Jul 2025, at 11:06 AM, Gary Lin <glin@suse.com> wrote:
> 
> The TPM2_PCR_Event command is introduced to tss2 to allow the user to
> extend a specific PCR. The related data structure and unmarshal function
> are also introduced.
> 
> However, simply invoking TPM2_PCR_Event does not automatically record
> the event into the TPM event log. The TPM event log is primarily
> maintained by the system firmware (e.g., BIOS/UEFI). Therefore, for most
> standard use cases, the recommended method for extending PCRs and
> ensuring proper event logging is to utilize the system firmware
> functions.
> 
> There are specific scenarios where direct use of TPM2_PCR_Event becomes
> necessary. For instance, in environments lacking system firmware support
> for PCR extension, such as the grub-emu, TPM2_PCR_Event serves as the
> only available method to extend PCRs.
> 
> Signed-off-by: Gary Lin <glin@suse.com>

Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com <mailto:sudhakar@linux.ibm.com>>

> ---
> grub-core/lib/tss2/tpm2_cmd.c     | 51 +++++++++++++++++++++++++++++++
> grub-core/lib/tss2/tpm2_cmd.h     |  7 +++++
> grub-core/lib/tss2/tss2_mu.c      | 18 +++++++++++
> grub-core/lib/tss2/tss2_mu.h      |  4 +++
> grub-core/lib/tss2/tss2_structs.h |  7 +++++
> grub-core/lib/tss2/tss2_types.h   |  1 +
> 6 files changed, 88 insertions(+)
> 
> diff --git a/grub-core/lib/tss2/tpm2_cmd.c b/grub-core/lib/tss2/tpm2_cmd.c
> index 6d25db1ab..b682eb431 100644
> --- a/grub-core/lib/tss2/tpm2_cmd.c
> +++ b/grub-core/lib/tss2/tpm2_cmd.c
> @@ -575,6 +575,57 @@ grub_tpm2_flushcontext (const TPMI_DH_CONTEXT_t handle)
>   return TPM_RC_SUCCESS;
> }
> 
> +TPM_RC_t
> +grub_tpm2_pcr_event (const TPMI_DH_PCR_t pcrHandle,
> +		     const TPMS_AUTH_COMMAND_t *authCommand,
> +		     const TPM2B_EVENT_t *eventData,
> +		     TPML_DIGEST_VALUES_t *digests,
> +		     TPMS_AUTH_RESPONSE_t *authResponse)
> +{
> +  TPM_RC_t rc;
> +  struct grub_tpm2_buffer in;
> +  struct grub_tpm2_buffer out;
> +  TPML_DIGEST_VALUES_t digestsTmp;
> +  TPMS_AUTH_RESPONSE_t authResponseTmp;
> +  TPM_RC_t responseCode;
> +  grub_uint32_t parameterSize;
> +
> +  if (eventData == NULL)
> +    return TPM_RC_VALUE;
> +  if (authCommand == NULL)
> +    return TPM_RC_VALUE;
> +
> +  if (digests == NULL)
> +    digests = &digestsTmp;
> +  if (authResponse == NULL)
> +    authResponse = &authResponseTmp;
> +
> +  /* Marshal */
> +  grub_tpm2_buffer_init (&in);
> +  grub_tpm2_buffer_pack_u32 (&in, pcrHandle);
> +  grub_Tss2_MU_TPMS_AUTH_COMMAND_Marshal (&in, authCommand);
> +  grub_Tss2_MU_TPM2B_Marshal (&in, eventData->size, eventData->buffer);
> +  if (in.error == true)
> +    return TPM_RC_FAILURE;
> +
> +  /* Submit */
> +  grub_tpm2_buffer_init (&out);
> +  rc = tpm2_submit_command (TPM_ST_SESSIONS, TPM_CC_PCR_Event, &responseCode, &in, &out);
> +  if (rc != TPM_RC_SUCCESS)
> +    return rc;
> +  if (responseCode != TPM_RC_SUCCESS)
> +    return responseCode;
> +
> +  /* Unmarshal */
> +  grub_tpm2_buffer_unpack_u32 (&out, &parameterSize);
> +  grub_Tss2_MU_TPML_DIGEST_VALUE_Unmarshal (&out, digests);
> +  grub_Tss2_MU_TPMS_AUTH_RESPONSE_Unmarshal (&out, authResponse);
> +  if (out.error == true)
> +    return TPM_RC_FAILURE;
> +
> +  return TPM_RC_SUCCESS;
> +}
> +
> TPM_RC_t
> grub_tpm2_pcr_read (const TPMS_AUTH_COMMAND_t *authCommand,
> 		    const TPML_PCR_SELECTION_t *pcrSelectionIn,
> diff --git a/grub-core/lib/tss2/tpm2_cmd.h b/grub-core/lib/tss2/tpm2_cmd.h
> index 90b42efec..d7ad962ab 100644
> --- a/grub-core/lib/tss2/tpm2_cmd.h
> +++ b/grub-core/lib/tss2/tpm2_cmd.h
> @@ -89,6 +89,13 @@ grub_tpm2_unseal (const TPMI_DH_OBJECT_t item_handle,
> extern TPM_RC_t
> grub_tpm2_flushcontext (const TPMI_DH_CONTEXT_t handle);
> 
> +extern TPM_RC_t
> +grub_tpm2_pcr_event (const TPMI_DH_PCR_t pcrHandle,
> +		     const TPMS_AUTH_COMMAND_t *authCommand,
> +		     const TPM2B_EVENT_t *eventData,
> +		     TPML_DIGEST_VALUES_t *digests,
> +		     TPMS_AUTH_RESPONSE_t *authResponse);
> +
> extern TPM_RC_t
> grub_tpm2_pcr_read (const TPMS_AUTH_COMMAND_t *authCommand,
> 		    const TPML_PCR_SELECTION_t *pcrSelectionIn,
> diff --git a/grub-core/lib/tss2/tss2_mu.c b/grub-core/lib/tss2/tss2_mu.c
> index 816e5b37f..e544e62f9 100644
> --- a/grub-core/lib/tss2/tss2_mu.c
> +++ b/grub-core/lib/tss2/tss2_mu.c
> @@ -1118,6 +1118,24 @@ grub_Tss2_MU_TPML_DIGEST_Unmarshal (grub_tpm2_buffer_t buffer,
>     grub_Tss2_MU_TPM2B_DIGEST_Unmarshal (buffer, &digest->digests[i]);
> }
> 
> +void
> +grub_Tss2_MU_TPML_DIGEST_VALUE_Unmarshal (grub_tpm2_buffer_t buffer,
> +					  TPML_DIGEST_VALUES_t *digests)
> +{
> +  grub_uint32_t i;
> +
> +  grub_tpm2_buffer_unpack_u32 (buffer, &digests->count);
> +
> +  if (digests->count > TPM_NUM_PCR_BANKS)
> +    {
> +      buffer->error = true;
> +      return;
> +    }
> +
> +  for (i = 0; i < digests->count; i++)
> +    grub_Tss2_MU_TPMT_HA_Unmarshal (buffer, &digests->digests[i]);
> +}
> +
> void
> grub_Tss2_MU_TPMS_SIGNATURE_RSA_Unmarshal (grub_tpm2_buffer_t buffer,
>                                            TPMS_SIGNATURE_RSA_t *rsa)
> diff --git a/grub-core/lib/tss2/tss2_mu.h b/grub-core/lib/tss2/tss2_mu.h
> index 6440de57c..76eebc994 100644
> --- a/grub-core/lib/tss2/tss2_mu.h
> +++ b/grub-core/lib/tss2/tss2_mu.h
> @@ -380,6 +380,10 @@ extern void
> grub_Tss2_MU_TPML_DIGEST_Unmarshal (grub_tpm2_buffer_t buffer,
> 				    TPML_DIGEST_t *digest);
> 
> +extern void
> +grub_Tss2_MU_TPML_DIGEST_VALUE_Unmarshal (grub_tpm2_buffer_t buffer,
> +					  TPML_DIGEST_VALUES_t *digests);
> +
> extern void
> grub_Tss2_MU_TPMS_SIGNATURE_RSA_Unmarshal (grub_tpm2_buffer_t buffer,
>                                            TPMS_SIGNATURE_RSA_t *p);
> diff --git a/grub-core/lib/tss2/tss2_structs.h b/grub-core/lib/tss2/tss2_structs.h
> index 2eefba87c..0ac09f50f 100644
> --- a/grub-core/lib/tss2/tss2_structs.h
> +++ b/grub-core/lib/tss2/tss2_structs.h
> @@ -144,6 +144,13 @@ typedef struct TPML_DIGEST TPML_DIGEST_t;
> /* TPM2B_NONCE Type */
> typedef TPM2B_DIGEST_t TPM2B_NONCE_t;
> 
> +/* TPM2B_EVENT Structure */
> +struct TPM2B_EVENT {
> +    grub_uint16_t size;
> +    grub_uint8_t buffer[1024];
> +};
> +typedef struct TPM2B_EVENT TPM2B_EVENT_t;
> +
> /* TPMA_SESSION Structure */
> struct TPMA_SESSION
> {
> diff --git a/grub-core/lib/tss2/tss2_types.h b/grub-core/lib/tss2/tss2_types.h
> index bddde7191..52d304b90 100644
> --- a/grub-core/lib/tss2/tss2_types.h
> +++ b/grub-core/lib/tss2/tss2_types.h
> @@ -343,6 +343,7 @@ typedef grub_uint32_t TPM_CC_t;
> #define TPM_CC_NV_Write         ((TPM_CC_t) 0x00000137)
> #define TPM_CC_NV_UndefineSpace ((TPM_CC_t) 0x00000122)
> #define TPM_CC_GetCapability    ((TPM_CC_t) 0x0000017a)
> +#define TPM_CC_PCR_Event        ((TPM_CC_t) 0x0000013c)
> #define TPM_CC_PCR_Read         ((TPM_CC_t) 0x0000017e)
> #define TPM_CC_Load             ((TPM_CC_t) 0x00000157)
> #define TPM_CC_LoadExternal     ((TPM_CC_t) 0x00000167)
> -- 
> 2.43.0
> 


[-- Attachment #1.2: Type: text/html, Size: 11314 bytes --]

[-- Attachment #2: Type: text/plain, Size: 141 bytes --]

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

  reply	other threads:[~2025-07-17  6:55 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-07-15  5:36 [PATCH v2 0/7] TPM2 PCR Capping Gary Lin via Grub-devel
2025-07-15  5:36 ` [PATCH v2 1/7] tss2: Add TPM2_PCR_Event command Gary Lin via Grub-devel
2025-07-17  6:54   ` Sudhakar Kuppusamy [this message]
2025-07-15  5:36 ` [PATCH v2 2/7] tss2: Introduce grub_tcg2_cap_pcr() Gary Lin via Grub-devel
2025-07-17  6:55   ` Sudhakar Kuppusamy
2025-07-15  5:36 ` [PATCH v2 3/7] tss2: Implement grub_tcg2_cap_pcr() for EFI Gary Lin via Grub-devel
2025-07-17  7:14   ` Sudhakar Kuppusamy
2025-07-15  5:36 ` [PATCH v2 4/7] tss2: Implement grub_tcg2_cap_pcr() for ieee1275 Gary Lin via Grub-devel
2025-07-15  5:36 ` [PATCH v2 5/7] tss2: Implement grub_tcg2_cap_pcr() for EMU Gary Lin via Grub-devel
2025-07-17  7:30   ` Sudhakar Kuppusamy
2025-07-15  5:36 ` [PATCH v2 6/7] tpm2_key_protector: Support PCR capping Gary Lin via Grub-devel
2025-07-15  5:36 ` [PATCH v2 7/7] tests/tpm2_key_protector_test: Add a test for PCR Capping Gary Lin via Grub-devel

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=8DB4DF01-45C1-4647-A714-4C2CE4B56C22@linux.ibm.com \
    --to=sudhakar@linux.ibm.com \
    --cc=daniel.kiper@oracle.com \
    --cc=glin@suse.com \
    --cc=grub-devel@gnu.org \
    --cc=mchang@suse.com \
    --cc=patrick.colp@oracle.com \
    --cc=stefanb@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.