From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 5B54AC433F5 for ; Thu, 25 Nov 2021 20:41:09 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 1808982FE5; Thu, 25 Nov 2021 21:41:06 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="ZJ7Hf1YM"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 42DE783257; Thu, 25 Nov 2021 21:41:04 +0100 (CET) Received: from mail-wm1-x334.google.com (mail-wm1-x334.google.com [IPv6:2a00:1450:4864:20::334]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 14E1A82FA2 for ; Thu, 25 Nov 2021 21:41:00 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-wm1-x334.google.com with SMTP id m25-20020a7bcb99000000b0033aa12cdd33so1532785wmi.1 for ; Thu, 25 Nov 2021 12:41:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=AwpOz96jUG1WahBJeSrVOgnhBiYkt4U6fBgtvfvPEUo=; b=ZJ7Hf1YMKR9Akrk1zCgzCH4CQ248YeDkm5IbQKY/4Qutf5ag7k38dtHJ20uQH/TtJl /hbiN9AXhk7Qu+azebYcJJSvsXz4KjiHplXYoH46SgLfYi3iUxGKTHl1pCVMY2eQxlww tuD9IggZYk5g5JsMTSk1JFiNsBomCl4J2b2TkxRdGZTMuGploiwUtAMsX/gROmUeyfpB RZnp8+T77UqsDB0TEb+6ezjsFlxMcG+YhQGx+thUTwgjJQottcm7Xg2Va24jRvgaHQ22 JO8Mb0wHtzWYXEhqzZdcna8qBG78L/zjKsCGzH2Yg5qIs2X7rkNGpNT82+Q3k34boO29 qvtA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=AwpOz96jUG1WahBJeSrVOgnhBiYkt4U6fBgtvfvPEUo=; b=QOsyaU0iv91iQdOiWPwfixseDvJC4KgujXb5J9gelffjBcUli0NiP6eLFouIPPcf6h 86JiCPRlKYzSxeqAzVaAGPP+OJA3BK5m9GJVF7FpBNnTZgokf1UNxsg6gJFy82CBVz1J YOkc3NXEZrdvypzA17wy/sHEwJgEaiywEL5bjwVDO+EaMZmyjkwDZx8tFSHnh7px/+v6 B4Gn4ogKqXyepcPldaTr1syftJJYgvMzW0pnNxLAFcPVlL36LSmWf17fbJ9wAfw5qjPy N/OI7rit1K03zfwaabDHrmsrUBPW69f96wb4udIvPrLA9uRdZdJaSApW6EaA93zbbvEe GZXg== X-Gm-Message-State: AOAM533Gj7uLQKaqOSHYDhLJWdJ1+iJNu2NgQWZ5/6/chqg3OiLfakIi flMjpsmDrcqVDbHA6RLqt0KHnA== X-Google-Smtp-Source: ABdhPJyyV4wy+/CiYOYEyRZPPicFuI5sUTDHBYq2WOxXToo2Zjqv6h+pj69+b6Uz6B8I3SegplaQuQ== X-Received: by 2002:a7b:c8c2:: with SMTP id f2mr10801236wml.63.1637872859605; Thu, 25 Nov 2021 12:40:59 -0800 (PST) Received: from enceladus (ppp-94-66-220-227.home.otenet.gr. [94.66.220.227]) by smtp.gmail.com with ESMTPSA id c16sm3611256wrx.96.2021.11.25.12.40.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Nov 2021 12:40:59 -0800 (PST) Date: Thu, 25 Nov 2021 22:40:56 +0200 From: Ilias Apalodimas To: Heinrich Schuchardt Cc: u-boot@lists.denx.de, Simon Glass , Ruchika Gupta , Alexander Graf , Masahisa Kojima , Tom Rini Subject: Re: [PATCH v2] efi_loader: check tcg2 protocol installation outside the TCG protocol Message-ID: References: <20211125113628.29609-1-masahisa.kojima@linaro.org> <4d7b1c20-fd4a-cfed-4a7d-d584a73de312@gmx.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4d7b1c20-fd4a-cfed-4a7d-d584a73de312@gmx.de> X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.37 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean Hi Heinrich, [...] > > > u32 len; > > > @@ -962,6 +976,9 @@ efi_status_t tcg2_measure_pe_image(void *efi, u64 efi_size, > > > IMAGE_NT_HEADERS32 *nt; > > > struct efi_handler *handler; > > > > > > + if (!is_tcg2_protocol_installed()) > > > + return EFI_NOT_READY; > > > + > > > ret = platform_get_tpm2_device(&dev); > > > if (ret != EFI_SUCCESS) > > > return ret; > > > @@ -2140,6 +2157,9 @@ efi_status_t efi_tcg2_measure_efi_app_invocation(struct efi_loaded_image_obj *ha > > > u32 event = 0; > > > struct smbios_entry *entry; > > > > > > + if (!is_tcg2_protocol_installed()) > > > + return EFI_NOT_READY; > > > + > > > if (tcg2_efi_app_invoked) > > > return EFI_SUCCESS; > > > > > > @@ -2190,6 +2210,9 @@ efi_status_t efi_tcg2_measure_efi_app_exit(void) > > > efi_status_t ret; > > > struct udevice *dev; > > > > > > + if (!is_tcg2_protocol_installed()) > > > > [...] > > > > Heinrich, this whole patch is needed because installing the tcg2 protocol > > always returns EFI_SUCCESS. The reason is that some sandbox tests with > > sandbox_tpm used to fail. Do you want to keep this or perhaps just failing > > the boot now is the protocol fails to install is an option ? > > Which test failed? It's been a while, but if my memory serves me correctly, during the protocol installation we need to call: efi_init_event_log() -> create_specid_event() -> tpm2_get_pcr_info() -> tpm2_get_capability(). That get_capability call wasn't supported in sandbox. So the result was EFI TCG2 stopping the boot process. Simon did fix a few things on sandbox since then, but I can't remember if capabilities was one of them. > > We should consistently test the TCG2 protocol using swtpm both on QEMU > and on the sandbox. I am still waiting for Tom to apply > > [U-BOOT-TEST-HOOKS,1/1] Enable TPMv2 emulation > https://patchwork.ozlabs.org/project/uboot/patch/20211115101106.36479-1-heinrich.schuchardt@canonical.com/ > > to move to that target. > > Until then we can disable the tcg2 test or the TCG2 protocol on the sandbox. That would be fine by me. Not stopping the boot on failures introduces the need for patches like this. So you suggest we drop this and just fail the boot ? Thanks /Ilias > > Best regards > > Heinrich