On 6/15/26 13:38, Ilias Apalodimas wrote:
Hi Ludwig,
On Mon, 15 Jun 2026 at 13:10, Ludwig Nussel <[email protected]> wrote:
On 6/11/26 11:57, Ilias Apalodimas wrote:
[...]
On Wed, 10 Jun 2026 at 13:52, Ludwig Nussel <[email protected]> wrote:
[...]
if (IS_ENABLED(CONFIG_MEASURED_BOOT)) {
- struct tcg2_event_log elog;
struct udevice *dev;
void *initrd_buf;
void *image_buf;
const char *s;
u32 rd_len;
- bool ign;
- elog.log_size = 0;
- ign = IS_ENABLED(CONFIG_MEASURE_IGNORE_LOG);
- ret = tcg2_measurement_init(&dev, &elog, ign);
- if (ret)
+ ret = tcg2_measurement_init(&dev, NULL);
I'd like the eventlog to be initialized before calling this (look below).
What if I removed the log parameter from those tcg2_* functions instead?
The event log belongs to the tpm device IMO, so should be initialized
with the device.
Measured boot EventLogs etc are primarily described by the TCG specs &
EFI and we only have a specification for it there. The DT describes on
how to pass it over to linux with sml-base etc.
However, in the EFI case the Eventlog is allocated as ACPI memory. So
you cannot allocate the EventLog a priori, until you figure out what
method you are using to boot. We also have use cases people using it
only for RNG, due to limited memory, so we can't just allocate it on
the device bringup. And lastly... Some first stage bootloaders do not
initialize the TPM & drivers. What they do is prepare an EventLog and
expect U-Boot to replay it once the TPM is up and running. In that
case we obviously need to preserve what we have instead of starting
from scratch.
Ack, we are on the same page here.
My main concern is that I *don't* want the EFI and non-EFI code to
deviate. I have some patches that I am playing around for quite some
time and rebased them last week for this reason [1]. If you think
those help your use case or make your life easier feel free to include
them.
Good idea and orthogonal to what I am doing I think. This duplication in
EFI stressed my brain too but I can't care about EFI right now :-)
IIUC you are centering the change around calling
tcg2_log_prepare_buffer() in efi_init_event_log(). What do you think
about aiming for tcg2_measurement_init() as central starting point
instead? That would allow to remove even more duplicated code.
It should be sufficient to have tcg2_measurement_init() accept an
optional pointer to pre-allocated log buffer memory. Attached patch
maybe explains the idea better (just as idea, won't compile).
I am not sure what the intention of the current api is tbh. The event
log basically documents when and how PCR registers were extended. We
have to build that log ourselves as the TPM doesn't do it for us. The
api weirdly allows to have partial local logs even though there's only
one set of PCR registers.
Where?
The elog parameters of tcg2_log_prepare_buffer() and tcg2_measure_data()
are not related to the dev parameter. So it looks like the intention is
to be able to call it on the same tpm but with different event logs.
cu
Ludwig
--
Ludwig Nussel
Siemens AG
www.siemens.com
diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c
index 1860dc50238..763199a6e8a 100644
--- a/lib/efi_loader/efi_tcg2.c
+++ b/lib/efi_loader/efi_tcg2.c
@@ -882,45 +882,24 @@ out:
}
/**
- * efi_append_scrtm_version - Append an S-CRTM EV_S_CRTM_VERSION event on the
- * eventlog and extend the PCRs
- *
- * @dev: TPM device
- *
- * @Return: status code
- */
-static efi_status_t efi_append_scrtm_version(struct udevice *dev)
-{
- efi_status_t ret;
-
- ret = measure_event(dev, 0, EV_S_CRTM_VERSION,
- strlen(version_string) + 1, (u8 *)version_string);
-
- return ret;
-}
-
-/**
- * efi_init_event_log() - initialize an eventlog
+ * efi_init_tpm() - initialize tpm and eventlog
*
* Return: status code
*/
-static efi_status_t efi_init_event_log(void)
+static efi_status_t efi_init_tpm(void)
{
/*
* vendor_info_size is currently set to 0, we need to change the length
* and allocate the flexible array member if this changes
*/
- struct tcg2_event_log elog;
struct udevice *dev;
+ char *buffer;
efi_status_t ret;
int rc;
- if (tcg2_platform_get_tpm2(&dev))
- return EFI_DEVICE_ERROR;
-
ret = efi_allocate_pool(EFI_BOOT_SERVICES_DATA,
CONFIG_TPM2_EVENT_LOG_SIZE,
- (void **)&event_log.buffer);
+ (void **)&buffer);
if (ret != EFI_SUCCESS)
return ret;
@@ -928,42 +907,14 @@ static efi_status_t efi_init_event_log(void)
* initialize log area as 0xff so the OS can easily figure out the
* last log entry
*/
- memset(event_log.buffer, 0xff, CONFIG_TPM2_EVENT_LOG_SIZE);
-
- /*
- * The log header is defined to be in SHA1 event log entry format.
- * Setup event header
- */
- event_log.pos = 0;
- event_log.last_event_size = 0;
- event_log.get_event_called = false;
- event_log.ebs_called = false;
- event_log.truncated = false;
+ memset(buffer, 0xff, CONFIG_TPM2_EVENT_LOG_SIZE);
- /*
- * Check if earlier firmware have passed any eventlog. Different
- * platforms can use different ways to do so.
- */
- elog.log = event_log.buffer;
- elog.log_size = CONFIG_TPM2_EVENT_LOG_SIZE;
- rc = tcg2_log_prepare_buffer(dev, &elog, false);
+ rc = tcg2_measurement_init(&dev, buffer, CONFIG_TPM2_EVENT_LOG_SIZE);
if (rc) {
ret = (rc == -ENOBUFS) ? EFI_BUFFER_TOO_SMALL : EFI_DEVICE_ERROR;
goto free_pool;
}
- event_log.pos = elog.log_position;
-
- /*
- * Add SCRTM version to the log if previous firmmware
- * doesn't pass an eventlog.
- */
- if (!elog.found) {
- ret = efi_append_scrtm_version(dev);
- if (ret != EFI_SUCCESS)
- goto free_pool;
- }
-
ret = create_final_event();
if (ret != EFI_SUCCESS)
goto free_pool;
@@ -1587,24 +1538,10 @@ out:
efi_status_t efi_tcg2_register(void)
{
efi_status_t ret = EFI_SUCCESS;
- struct udevice *dev;
struct efi_event *event;
u32 err;
- if (tcg2_platform_get_tpm2(&dev)) {
- log_warning("Missing TPMv2 device for EFI_TCG_PROTOCOL\n");
- return EFI_SUCCESS;
- }
-
- /* initialize the TPM as early as possible. */
- err = tpm_auto_start(dev);
- if (err) {
- ret = EFI_DEVICE_ERROR;
- log_err("TPM startup failed\n");
- goto fail;
- }
-
- ret = efi_init_event_log();
+ ret = efi_init_tpm();
if (ret != EFI_SUCCESS) {
tcg2_uninit();
goto fail;
