From: Lennart Poettering <mzxreary@0pointer.de>
To: Pingfan Liu <piliu@redhat.com>
Cc: Ard Biesheuvel <ardb@kernel.org>,
Jan Hendrik Farr <kernel@jfarr.cc>,
Philipp Rudo <prudo@redhat.com>,
Jarkko Sakkinen <jarkko@kernel.org>,
Eric Biederman <ebiederm@xmission.com>,
Baoquan He <bhe@redhat.com>, Dave Young <dyoung@redhat.com>,
Mark Rutland <mark.rutland@arm.com>,
Will Deacon <will@kernel.org>,
Catalin Marinas <catalin.marinas@arm.com>,
kexec@lists.infradead.org, linux-efi@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [RFCv2 0/9] UEFI emulator for kexec
Date: Mon, 26 Aug 2024 15:39:59 +0200 [thread overview]
Message-ID: <ZsyFr8V6yizMiBTw@gardel-login> (raw)
In-Reply-To: <CAF+s44SQtRxZz=2eSJ-xP44ORLqvq0doEQ8qrw+1RaKFhoje8w@mail.gmail.com>
On Do, 22.08.24 22:29, Pingfan Liu (piliu@redhat.com) wrote:
> > Hmm, I'd really think about this with some priority. The measurement
> > stuff should not be an afterthought, it typically has major
> > implications on how you design your transitions, because measurements
> > of some component always need to happen *before* you pass control to
> > it, otherwise they are pointless.
> >
>
> At present, my emulator returns false to is_efi_secure_boot(), so
> systemd-stub does not care about the measurement, and moves on.
>
> Could you enlighten me about how systemd utilizes the measurement? I
> grepped 'TPM2_PCR_KERNEL_CONFIG', and saw the systemd-stub asks to
> extend PCR. But where is the value checked? I guess the systemd will
> hang if the check fails.
systemd's "systemd-pcrlock" tool will look for measurements like that
and generate disk encryption TPM policies from that.
Lennart
--
Lennart Poettering, Berlin
next prev parent reply other threads:[~2024-08-26 13:40 UTC|newest]
Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-08-19 14:53 [RFCv2 0/9] UEFI emulator for kexec Pingfan Liu
2024-08-19 14:53 ` [RFCv2 1/9] efi/libstub: Ask efi_random_alloc() to skip unusable memory Pingfan Liu
2024-08-19 18:00 ` Jarkko Sakkinen
2024-08-20 0:58 ` Pingfan Liu
2024-08-28 13:28 ` Ard Biesheuvel
2024-08-19 14:53 ` [RFCv2 2/9] efi/libstub: Complete efi_simple_text_output_protocol Pingfan Liu
2024-08-19 14:53 ` [RFCv2 3/9] efi/emulator: Initial rountines to emulate EFI boot time service Pingfan Liu
2024-08-19 14:53 ` [RFCv2 4/9] efi/emulator: Turn on mmu for arm64 Pingfan Liu
2024-08-19 14:53 ` [RFCv2 5/9] kexec: Introduce kexec_pe_image to parse and load PE file Pingfan Liu
2024-08-19 14:53 ` [RFCv2 6/9] arm64: kexec: Introduce a new member param_mem to kimage_arch Pingfan Liu
2024-08-19 14:53 ` [RFCv2 7/9] arm64: mm: Change to prototype of Pingfan Liu
2024-08-19 14:53 ` [RFCv2 8/9] arm64: kexec: Prepare page table for emulator Pingfan Liu
2024-08-19 14:53 ` [RFCv2 9/9] arm64: kexec: Enable kexec_pe_image Pingfan Liu
2024-08-21 14:27 ` [RFCv2 0/9] UEFI emulator for kexec Lennart Poettering
2024-08-22 5:42 ` Pingfan Liu
2024-08-22 6:16 ` Dave Young
2024-08-22 10:51 ` Pingfan Liu
2024-08-22 11:54 ` Dave Young
2024-08-22 10:56 ` Jan Hendrik Farr
2024-08-22 12:04 ` Dave Young
2024-08-22 8:23 ` Lennart Poettering
2024-08-22 10:45 ` Pingfan Liu
2024-08-22 11:42 ` Jan Hendrik Farr
2024-08-22 11:45 ` Lennart Poettering
2024-08-22 14:29 ` Pingfan Liu
2024-08-26 13:39 ` Lennart Poettering [this message]
2024-09-09 13:38 ` Pingfan Liu
2024-09-10 7:06 ` Lennart Poettering
2024-08-28 17:08 ` Ard Biesheuvel
2024-09-02 5:40 ` Pingfan Liu
2024-09-06 10:54 ` Philipp Rudo
2024-09-07 11:27 ` Jarkko Sakkinen
2024-09-07 11:31 ` Jarkko Sakkinen
2024-09-07 11:41 ` Jarkko Sakkinen
2024-09-09 13:55 ` Philipp Rudo
2024-09-09 17:09 ` Jarkko Sakkinen
2024-09-09 9:48 ` Lennart Poettering
2024-09-09 10:42 ` Jan Hendrik Farr
2024-09-09 13:49 ` Philipp Rudo
2024-09-09 14:04 ` Ard Biesheuvel
2024-09-09 14:37 ` Jan Hendrik Farr
2024-09-10 7:54 ` Lennart Poettering
2024-10-08 11:59 ` Pingfan Liu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZsyFr8V6yizMiBTw@gardel-login \
--to=mzxreary@0pointer.de \
--cc=ardb@kernel.org \
--cc=bhe@redhat.com \
--cc=catalin.marinas@arm.com \
--cc=dyoung@redhat.com \
--cc=ebiederm@xmission.com \
--cc=jarkko@kernel.org \
--cc=kernel@jfarr.cc \
--cc=kexec@lists.infradead.org \
--cc=linux-efi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=piliu@redhat.com \
--cc=prudo@redhat.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox