Re: [PATCH v2 0/5] tpm: Support boot measurements

Heinrich Schuchardt
2023-01-09T23:35:11Z

On 1/9/23 22:55, Eddie James wrote:
> This series adds support for measuring the boot images more generically
> than the existing EFI support. Several EFI functions have been moved to
> the TPM layer. The series includes optional measurement from the bootm
> command.
> A new test case has been added for the bootm measurement to test the new
> path, and the sandbox TPM2 driver has been updated to support this use
> case.
>
> Changes since v1:
> - Refactor TPM layer functions to allow EFI system to use them, and
> remove duplicate EFI functions.
> - Add test case
> - Drop #ifdefs for bootm
> - Add devicetree measurement config option
> - Update sandbox TPM driver

This looks like a useful feature to me. Some questions remain:

How about the booti and bootz commands. Are they covered by the change?

What are the consequences of your changes for UEFI FIT images (cf.
CONFIG_BOOTM_EFI)?

>
> Eddie James (5):
> tpm: Fix spelling for tpmu_ha union
> tpm: Support boot measurements
> bootm: Support boot measurement
> tpm: sandbox: Update for needed TPM2 capabilities
> test: Add sandbox TPM boot measurement

I am missing the documentation changes. These should describe which
changes in the device-tree and in the configuration are needed to enable
measurements. This should be in doc/usage/

@Ilias:
Could you contribute the UEFI part for the document, please.

Best regards

Heinrich

>
> arch/sandbox/dts/test.dts | 12 +
> boot/Kconfig | 23 ++
> boot/bootm.c | 64 +++
> cmd/bootm.c | 2 +
> configs/sandbox_defconfig | 1 +
> drivers/tpm/tpm2_tis_sandbox.c | 100 +++--
> include/bootm.h | 2 +
> include/efi_tcg2.h | 44 --
> include/image.h | 1 +
> include/test/suites.h | 1 +
> include/tpm-v2.h | 215 +++++++++-
> lib/efi_loader/efi_tcg2.c | 362 +----------------
> lib/tpm-v2.c | 708 +++++++++++++++++++++++++++++++++
> test/boot/Makefile | 1 +
> test/boot/measurement.c | 66 +++
> test/cmd_ut.c | 2 +
> 16 files changed, 1187 insertions(+), 417 deletions(-)
> create mode 100644 test/boot/measurement.c
>