Fixing error for using TSS with tboot 1.8.3(TPM 2.0)

This commit solves issue #83. tboot 1.8.3(TPM 2.0) creates a primary hierarchy handle and an object handle during boot process. However the resource manager of TSS seems to presume these handles as abnormal objects and returns an error code to the client.
To solve this problem, the resource manager is changed to show warning instead of returning an error to the client.

Hello, wcarthur1.
Thank you for the reply.
I am trying to enable tboot 1.8.3 with NUC5i5MYHE utilizing your TPM2.0-TSS, and it should run like,

Boot linux using tboot 1.8.3
Start the resource manager of TSS
Generate random numbers using tpm2_getrandom of sapi-tools in tpm2.0-tools

When I try to get a random number, the tpm2_getrandom of sapi-tools reports an error. It seems the error is due to responseRval(line 2066 in the RM.c) has TSS2_RESMGR_UNLOADED_OBJECTS, because testForLoadedSessionsOrObjectsRval gets TSS2_RESMGR_UNLOADED_OBJECTS(the failure) at line 2061 in the RM.c
However, this behavior doesn’t look right. I guess TSS should manage only the objects and the sessions that are created after TSS itself is started, and may not recognize the objects and the sessions that are created before it is started.
In other words, when linux is loaded, tboot creates an object handle and the RM doesn't know about this object. Consequently, the RM returns an error code to the client. If the RM is terminated abnormally due to an exception, the RM may not flush the objects and the sessions, and the restarted RM may have a same problem.
# Log messages from tboot 1.8.3
TBOOT: TPM:CreatePrimary creating hierarchy handle = 40000007
TBOOT: TPM:CreatePrimary created object handle = 80000000

In my opinion, the RM needs to identify the objects and the sessions that are created prior to the RM starts, and the RM needs to flush them.
Please let me know if I understand the codes wrong, and please let me show my new solution of this issue.
Thank you.

Below…
BTW, who do you work for?  Do you work for Intel?  If so, what group are you in?
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Seunghun Han<EMAIL_ADDRESS>Sent: Wednesday, December 9, 2015 1:22 AM
To: 01org/TPM2.0-TSS<EMAIL_ADDRESS>Subject: Re: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM 2.0) (#85)
Hello, wcarthur1.
Thank you for the reply.
I am trying to enable tboot 1.8.3 with NUC5i5MYHE utilizing your TPM2.0-TSS, and it should run like,

Boot linux using tboot 1.8.3
Start the resource manager of TSS
Generate random numbers using tpm2_getrandom of sapi-tools in tpm2.0-tools

When I try to get a random number, the tpm2_getrandom of sapi-tools reports an error. It seems the error is due to responseRval(line 2066 in the RM.c) has TSS2_RESMGR_UNLOADED_OBJECTS, because testForLoadedSessionsOrObjectsRval gets TSS2_RESMGR_UNLOADED_OBJECTS(the failure) at line 2061 in the RM.c
[Arthur, Will C] I do getRandom in my tpmclient test with the resource manager present and have no problems.
It sounds like your system has already done some operations to create keys, some other objects, or sessions before the resource manager was started and some of those objects are still loaded.  Can you verify that this is the case?  Can you send me a dump of the loaded handles that TestForLoadedHandles is seeing?  And can you identify who is creating them, e.g. BIOS, OS boot process, etc.?
Another thing to try would be to enable the RM very early in the boot cycle—that way, if the boot process is the culprit, it will be using the RM, which will clean up after each command.
Assuming my diagnosis is correct and that enabling the RM early in the boot cycle doesn’t fix this, there are some problems.  Since my RM assumes a clean slate for the TPM before each command, some commands may not be able to run if they require too many objects or sessions, given that some are already loaded.
Ways I can think of to handle this:

BIOS or whoever is creating these objects and/or sessions should evict them when it’s done. (My first choice)

The RM could, as part of its initialization process, unload any objects or sessions that are present (my 2nd choice)

The RM could be reworked to see if enough object/session slots are available before each command.  This is a path I tried before without success, and there are some other issues that make this solution highly undesirable and possibly impossible to implement.

However, this behavior doesn’t look right. I guess TSS should manage only the objects and the sessions that are created after TSS itself is started, and may not recognize the objects and the sessions that are created before it is started.
In other words, when linux is loaded, tboot creates an object handle and the RM doesn't know about this object. Consequently, the RM returns an error code to the client. If the RM is terminated abnormally due to an exception, the RM may not flush the objects and the sessions, and the restarted RM may have a same problem.
Log messages from tboot 1.8.3
TBOOT: TPM:CreatePrimary creating hierarchy handle = 40000007
TBOOT: TPM:CreatePrimary created object handle = 80000000
In my opinion, the RM needs to identify the objects and the sessions that are created prior to the RM starts, and the RM needs to flush them.
Please let me know if I understand the codes wrong, and please let me show my new solution of this issue.
Thank you.
—
Reply to this email directly or view it on GitHubhttps://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163122768.

Hello, wcarthur1.
Thank you for the reply.
I work for a security research institute of government. My team has designed a security platform for PC and I think that TPM 2.0 will be a core part of the security platform. So I am trying to enable tboot 1.8.3 with NUC5i5MYHE utilizing TPM2.0-TSS.
My test machine is booted using tboot 1.8.3, and tboot creates an object handle during boot process. I could find this object handle(0x80000000) in tboot logs(using txt-state command).
# Log messages from tboot 1.8.3
TBOOT: TPM: TPM Family 0x1
TBOOT: TPM: supported bank count = 2
TBOOT: TPM: bank alg = 00000004
TBOOT: TPM: bank alg = 0000000b
TBOOT: TPM: supported alg cout = 00000002
TBOOT: 		 00000004
TBOOT: 		 0000000B
TBOOT: TPM:CreatePrimary creating hierarchy handle = 40000007
TBOOT: TPM:CreatePrimary created object handle = 80000000              <== object handle for tboot
TBOOT: TPM attribute:
TBOOT: 	 extend policy 2
TBOOT: 	 current alg id 0x4
TBOOT: 	 timeout values: A: 750, B: 2000, C: 75000, D: 750

When I generate random numbers using tpm2_getrandom of sapi-tools in tpm2.0-tools, the RM dumps following error logs related to this object handle.
# The RM’s log
TPM2.0-TSS/resourcemgr$> ./resourcemgr
Initializing local TPM Interface
Initializing Resource Manager
maxActiveSessions = 32
gapMaxValue = 255
socket created:  0x4
bind to IP address:port:  <IP_ADDRESS>:2324
Other CMD server listening to socket:  0x4
socket created:  0x5
bind to IP address:port:  <IP_ADDRESS>:2323
TPM CMD server listening to socket:  0x5
Starting SockServer (TPM CMD), socket: 0x5.
Starting SockServer (Other CMD), socket: 0x4.

Accept socket:  0x7
Resource Manager Other CMD Server accepted client
Accept socket:  0x6
Resource Manager TPM CMD Server accepted client
||  Loaded transient object handles:
||  0x80000000, TpmCmdServer died (TPM CMD), rval: 0x00000000, socket: 0x6.
OtherCmdServer died (Other CMD), socket: 0x7.

# The tpm2_getrandom ’s log
tpm2.0-tools/sapi-tools$> ./tpm2_getrandom -s 10 -o a.txt
......TPM2_GetRandom Error. TPM Error:0xc6000......

I agree with your ideas and I think that y
our 2nd choice is better than others. As I mentioned in previous comment, if the RM is terminated abnormally due to an unexpected exception, the RM may not flush the objects that the RM has. In this case, the restarted RM also returns an error code because the new RM doesn’t know about previous handles. In my opinion, we should assume that the state before starting the RM is not always clean, and the RM needs to flush existing handles for robustness.
So I changed codes that the RM flushes all object handles when the RM is started, and it worked fine for all cases(with and without tboot).
If you don’t mind, please review attached patch codes.
Thank you.
This-commit-solves-issue-83.patch.txt

Hello, wcarthur1.
Thank you for the replay.
For attaching the RM's logs, I wrote a comment to the github.
Here is the link:
https://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163484218
Thank you.
Seunghun Han.
On Wed, Dec 9, 2015 at 11:40 PM, wcarthur1<EMAIL_ADDRESS>wrote:

Below…
BTW, who do you work for? Do you work for Intel? If so, what group are you
in?
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Seunghun Han<EMAIL_ADDRESS>Sent: Wednesday, December 9, 2015 1:22 AM
To: 01org/TPM2.0-TSS<EMAIL_ADDRESS>Subject: Re: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM
2.0) (#85)
Hello, wcarthur1.
Thank you for the reply.
I am trying to enable tboot 1.8.3 with NUC5i5MYHE utilizing your
TPM2.0-TSS, and it should run like,

Boot linux using tboot 1.8.3
Start the resource manager of TSS
Generate random numbers using tpm2_getrandom of sapi-tools in
tpm2.0-tools

When I try to get a random number, the tpm2_getrandom of sapi-tools
reports an error. It seems the error is due to responseRval(line 2066 in
the RM.c) has TSS2_RESMGR_UNLOADED_OBJECTS, because
testForLoadedSessionsOrObjectsRval gets TSS2_RESMGR_UNLOADED_OBJECTS(the
failure) at line 2061 in the RM.c
[Arthur, Will C] I do getRandom in my tpmclient test with the resource
manager present and have no problems.
It sounds like your system has already done some operations to create
keys, some other objects, or sessions before the resource manager was
started and some of those objects are still loaded. Can you verify that
this is the case? Can you send me a dump of the loaded handles that
TestForLoadedHandles is seeing? And can you identify who is creating them,
e.g. BIOS, OS boot process, etc.?
Another thing to try would be to enable the RM very early in the boot
cycle—that way, if the boot process is the culprit, it will be using the
RM, which will clean up after each command.
Assuming my diagnosis is correct and that enabling the RM early in the
boot cycle doesn’t fix this, there are some problems. Since my RM assumes a
clean slate for the TPM before each command, some commands may not be able
to run if they require too many objects or sessions, given that some are
already loaded.
Ways I can think of to handle this:

BIOS or whoever is creating these objects and/or sessions should evict
them when it’s done. (My first choice)

The RM could, as part of its initialization process, unload any objects
or sessions that are present (my 2nd choice)

The RM could be reworked to see if enough object/session slots are
available before each command. This is a path I tried before without
success, and there are some other issues that make this solution highly
undesirable and possibly impossible to implement.

However, this behavior doesn’t look right. I guess TSS should manage only
the objects and the sessions that are created after TSS itself is started,
and may not recognize the objects and the sessions that are created before
it is started.
In other words, when linux is loaded, tboot creates an object handle and
the RM doesn't know about this object. Consequently, the RM returns an
error code to the client. If the RM is terminated abnormally due to an
exception, the RM may not flush the objects and the sessions, and the
restarted RM may have a same problem.
Log messages from tboot 1.8.3
TBOOT: TPM:CreatePrimary creating hierarchy handle = 40000007
TBOOT: TPM:CreatePrimary created object handle = 80000000
In my opinion, the RM needs to identify the objects and the sessions that
are created prior to the RM starts, and the RM needs to flush them.
Please let me know if I understand the codes wrong, and please let me show
my new solution of this issue.
Thank you.
—
Reply to this email directly or view it on GitHub<
https://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163122768>.
—
Reply to this email directly or view it on GitHub
https://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163266607.

Below…
I’m going to add one of our TBOOT contacts here…
Ning, do you have a recommendation here?
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Seunghun Han<EMAIL_ADDRESS>Sent: Wednesday, December 9, 2015 11:20 PM
To: 01org/TPM2.0-TSS<EMAIL_ADDRESS>Cc: Arthur, Will C<EMAIL_ADDRESS>Subject: Re: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM 2.0) (#85)
Hello, wcarthur1.
Thank you for the reply.
I work for a security research institute of government. My team has designed a security platform for PC and I think that TPM 2.0 will be a core part of the security platform. So I am trying to enable tboot 1.8.3 with NUC5i5MYHE utilizing TPM2.0-TSS.
My test machine is booted using tboot 1.8.3, and tboot creates an object handle during boot process. I could find this object handle(0x80000000) in tboot logs(using txt-state command).
[Arthur, Will C] How is TBOOT using this object?  Does it need to use it later?
Log messages from tboot 1.8.3
TBOOT: TPM: TPM Family 0x1
TBOOT: TPM: supported bank count = 2
TBOOT: TPM: bank alg = 00000004
TBOOT: TPM: bank alg = 0000000b
TBOOT: TPM: supported alg cout = 00000002
TBOOT:       00000004
TBOOT:       0000000B
TBOOT: TPM:CreatePrimary creating hierarchy handle = 40000007
TBOOT: TPM:CreatePrimary created object handle = 80000000              <== object handle for tboot
TBOOT: TPM attribute:
TBOOT:   extend policy 2
TBOOT:   current alg id 0x4
TBOOT:   timeout values: A: 750, B: 2000, C: 75000, D: 750
When I generate random numbers using tpm2_getrandom of sapi-tools in tpm2.0-tools, the RM dumps following error logs related to this object handle.
The RM’s log
TPM2.0-TSS/resourcemgr$> ./resourcemgr
Initializing local TPM Interface
Initializing Resource Manager
maxActiveSessions = 32
gapMaxValue = 255
socket created:  0x4
bind to IP address:port:  <IP_ADDRESS>:2324
Other CMD server listening to socket:  0x4
socket created:  0x5
bind to IP address:port:  <IP_ADDRESS>:2323
TPM CMD server listening to socket:  0x5
Starting SockServer (TPM CMD), socket: 0x5.
Starting SockServer (Other CMD), socket: 0x4.
Accept socket:  0x7
Resource Manager Other CMD Server accepted client
Accept socket:  0x6
Resource Manager TPM CMD Server accepted client
||  Loaded transient object handles:
||  0x80000000, TpmCmdServer died (TPM CMD), rval: 0x00000000, socket: 0x6.
OtherCmdServer died (Other CMD), socket: 0x7.
The tpm2_getrandom ’s log
tpm2.0-tools/sapi-tools$> ./tpm2_getrandom -s 10 -o a.txt
......TPM2_GetRandom Error. TPM Error:0xc6000......
I agree with your ideas and I think that y
our 2nd choice is better than others.
[Arthur, Will C] That assumes that TBOOT:

doesn’t expect the object to be loaded and

it is NEVER going to use the object again.

Reasons:

If TBOOT plans to use the object later and expects it to already be loaded, the command that needs it loaded will fail.

Since the RM flushed the object, TBOOT can’t load the context since it doesn’t have the context (unless TBOOT first did a SaveContext).  Otherwise RM has the context and has no way to associate the context with a TCTI connection.

Options here:

Leave your changes to RM initialization.  This means that any process that creates objects and was started before RM was started will be unable to use those objects.  If the pre-RM init process needs to use the object later do one of the following:

a.  TBOOT changes (to save the context of the object)
b.  alter TBOOT code to start the RM before it creates an object.
c. alter the boot process to start the RM before TBOOT creates an object.

Remove your changes to RM initialization and do one of a, b, or c above.  This leaves the RM open to a failure like the one you’re seeing.  I probably prefer #1 above.  I’m trying to think if this is compatible with all environments that the RM might run in…

Thank you.
This-commit-solves-issue-83.patch.txthttps://github.com/01org/TPM2.0-TSS/files/57626/This-commit-solves-issue-83.patch.txt
—
Reply to this email directly or view it on GitHubhttps://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163484218.

[Arthur, Will C] How is TBOOT using this object?  Does it need to use it later?
[Ning] this is primary object created by tboot to create keys to seal tboot mem in a S3 resume, and unseal tboot mem after return from S3 resume.
Ning Sun
Intel Corporation
Tboot project: - http://sourceforge.net/projects/tboot/
Intel® TXT MLE DG: http://download.intel.com/technology/security/downloads/315168.pdf
From: Arthur, Will C
Sent: Thursday, December 10, 2015 5:29 AM
To: 01org/TPM2.0-TSS; 01org/TPM2.0-TSS; Sun, Ning
Cc: Wiseman, Monty; Sun, Ning
Subject: RE: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM 2.0) (#85)
Below…
I’m going to add one of our TBOOT contacts here…
Ning, do you have a recommendation here?
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Seunghun Han<EMAIL_ADDRESS>Sent: Wednesday, December 9, 2015 11:20 PM
To: 01org/TPM2.0-TSS <TPM2.0-TSS<EMAIL_ADDRESS>Cc: Arthur, Will C <will.c.arthur<EMAIL_ADDRESS>Subject: Re: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM 2.0) (#85)
Hello, wcarthur1.
Thank you for the reply.
I work for a security research institute of government. My team has designed a security platform for PC and I think that TPM 2.0 will be a core part of the security platform. So I am trying to enable tboot 1.8.3 with NUC5i5MYHE utilizing TPM2.0-TSS.
My test machine is booted using tboot 1.8.3, and tboot creates an object handle during boot process. I could find this object handle(0x80000000) in tboot logs(using txt-state command).
[Arthur, Will C] How is TBOOT using this object?  Does it need to use it later?
[Ning] this is primary object created by tboot to create keys to seal tboot mem in a S3 resume, and unseal tboot mem after return from S3 resume.
Log messages from tboot 1.8.3
TBOOT: TPM: TPM Family 0x1
TBOOT: TPM: supported bank count = 2
TBOOT: TPM: bank alg = 00000004
TBOOT: TPM: bank alg = 0000000b
TBOOT: TPM: supported alg cout = 00000002
TBOOT:       00000004
TBOOT:       0000000B
TBOOT: TPM:CreatePrimary creating hierarchy handle = 40000007
TBOOT: TPM:CreatePrimary created object handle = 80000000              <== object handle for tboot
TBOOT: TPM attribute:
TBOOT:   extend policy 2
TBOOT:   current alg id 0x4
TBOOT:   timeout values: A: 750, B: 2000, C: 75000, D: 750
When I generate random numbers using tpm2_getrandom of sapi-tools in tpm2.0-tools, the RM dumps following error logs related to this object handle.
The RM’s log
TPM2.0-TSS/resourcemgr$> ./resourcemgr
Initializing local TPM Interface
Initializing Resource Manager
maxActiveSessions = 32
gapMaxValue = 255
socket created:  0x4
bind to IP address:port:  <IP_ADDRESS>:2324
Other CMD server listening to socket:  0x4
socket created:  0x5
bind to IP address:port:  <IP_ADDRESS>:2323
TPM CMD server listening to socket:  0x5
Starting SockServer (TPM CMD), socket: 0x5.
Starting SockServer (Other CMD), socket: 0x4.
Accept socket:  0x7
Resource Manager Other CMD Server accepted client
Accept socket:  0x6
Resource Manager TPM CMD Server accepted client
||  Loaded transient object handles:
||  0x80000000, TpmCmdServer died (TPM CMD), rval: 0x00000000, socket: 0x6.
OtherCmdServer died (Other CMD), socket: 0x7.
The tpm2_getrandom ’s log
tpm2.0-tools/sapi-tools$> ./tpm2_getrandom -s 10 -o a.txt
......TPM2_GetRandom Error. TPM Error:0xc6000......
I agree with your ideas and I think that y
our 2nd choice is better than others.
[Arthur, Will C] That assumes that TBOOT:

doesn’t expect the object to be loaded and

it is NEVER going to use the object again.

Reasons:

If TBOOT plans to use the object later and expects it to already be loaded, the command that needs it loaded will fail.

Since the RM flushed the object, TBOOT can’t load the context since it doesn’t have the context (unless TBOOT first did a SaveContext).  Otherwise RM has the context and has no way to associate the context with a TCTI connection.

Options here:

Leave your changes to RM initialization.  This means that any process that creates objects and was started before RM was started will be unable to use those objects.  If the pre-RM init process needs to use the object later do one of the following:

a.  TBOOT changes (to save the context of the object)
b.  alter TBOOT code to start the RM before it creates an object.
c. alter the boot process to start the RM before TBOOT creates an object.

Remove your changes to RM initialization and do one of a, b, or c above.  This leaves the RM open to a failure like the one you’re seeing.  I probably prefer #1 above.  I’m trying to think if this is compatible with all environments that the RM might run in…

Thank you.
This-commit-solves-issue-83.patch.txthttps://github.com/01org/TPM2.0-TSS/files/57626/This-commit-solves-issue-83.patch.txt
—
Reply to this email directly or view it on GitHubhttps://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163484218.

Ning,
For this to be guaranteed to work correctly, TBOOT needs to start the resource manager before creating this key.
Otherwise, it will not be able to seal TBOOT before S3 and after S3 resume.
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Sun, Ning
Sent: Thursday, December 10, 2015 1:40 PM
To: Arthur, Will C<EMAIL_ADDRESS>01org/TPM2.0-TSS<EMAIL_ADDRESS>01org/TPM2.0-TSS<EMAIL_ADDRESS>Cc: Wiseman, Monty<EMAIL_ADDRESS>Subject: RE: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM 2.0) (#85)
[Arthur, Will C] How is TBOOT using this object?  Does it need to use it later?
[Ning] this is primary object created by tboot to create keys to seal tboot mem in a S3 resume, and unseal tboot mem after return from S3 resume.
Ning Sun
Intel Corporation
Tboot project: - http://sourceforge.net/projects/tboot/
Intel® TXT MLE DG: http://download.intel.com/technology/security/downloads/315168.pdf
From: Arthur, Will C
Sent: Thursday, December 10, 2015 5:29 AM
To: 01org/TPM2.0-TSS; 01org/TPM2.0-TSS; Sun, Ning
Cc: Wiseman, Monty; Sun, Ning
Subject: RE: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM 2.0) (#85)
Below…
I’m going to add one of our TBOOT contacts here…
Ning, do you have a recommendation here?
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Seunghun Han<EMAIL_ADDRESS>Sent: Wednesday, December 9, 2015 11:20 PM
To: 01org/TPM2.0-TSS <TPM2.0-TSS<EMAIL_ADDRESS>Cc: Arthur, Will C <will.c.arthur<EMAIL_ADDRESS>Subject: Re: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM 2.0) (#85)
Hello, wcarthur1.
Thank you for the reply.
I work for a security research institute of government. My team has designed a security platform for PC and I think that TPM 2.0 will be a core part of the security platform. So I am trying to enable tboot 1.8.3 with NUC5i5MYHE utilizing TPM2.0-TSS.
My test machine is booted using tboot 1.8.3, and tboot creates an object handle during boot process. I could find this object handle(0x80000000) in tboot logs(using txt-state command).
[Arthur, Will C] How is TBOOT using this object?  Does it need to use it later?
[Ning] this is primary object created by tboot to create keys to seal tboot mem in a S3 resume, and unseal tboot mem after return from S3 resume.
Log messages from tboot 1.8.3
TBOOT: TPM: TPM Family 0x1
TBOOT: TPM: supported bank count = 2
TBOOT: TPM: bank alg = 00000004
TBOOT: TPM: bank alg = 0000000b
TBOOT: TPM: supported alg cout = 00000002
TBOOT:       00000004
TBOOT:       0000000B
TBOOT: TPM:CreatePrimary creating hierarchy handle = 40000007
TBOOT: TPM:CreatePrimary created object handle = 80000000              <== object handle for tboot
TBOOT: TPM attribute:
TBOOT:   extend policy 2
TBOOT:   current alg id 0x4
TBOOT:   timeout values: A: 750, B: 2000, C: 75000, D: 750
When I generate random numbers using tpm2_getrandom of sapi-tools in tpm2.0-tools, the RM dumps following error logs related to this object handle.
The RM’s log
TPM2.0-TSS/resourcemgr$> ./resourcemgr
Initializing local TPM Interface
Initializing Resource Manager
maxActiveSessions = 32
gapMaxValue = 255
socket created:  0x4
bind to IP address:port:  <IP_ADDRESS>:2324
Other CMD server listening to socket:  0x4
socket created:  0x5
bind to IP address:port:  <IP_ADDRESS>:2323
TPM CMD server listening to socket:  0x5
Starting SockServer (TPM CMD), socket: 0x5.
Starting SockServer (Other CMD), socket: 0x4.
Accept socket:  0x7
Resource Manager Other CMD Server accepted client
Accept socket:  0x6
Resource Manager TPM CMD Server accepted client
||  Loaded transient object handles:
||  0x80000000, TpmCmdServer died (TPM CMD), rval: 0x00000000, socket: 0x6.
OtherCmdServer died (Other CMD), socket: 0x7.
The tpm2_getrandom ’s log
tpm2.0-tools/sapi-tools$> ./tpm2_getrandom -s 10 -o a.txt
......TPM2_GetRandom Error. TPM Error:0xc6000......
I agree with your ideas and I think that y
our 2nd choice is better than others.
[Arthur, Will C] That assumes that TBOOT:

doesn’t expect the object to be loaded and

it is NEVER going to use the object again.

Reasons:

If TBOOT plans to use the object later and expects it to already be loaded, the command that needs it loaded will fail.

Since the RM flushed the object, TBOOT can’t load the context since it doesn’t have the context (unless TBOOT first did a SaveContext).  Otherwise RM has the context and has no way to associate the context with a TCTI connection.

Options here:

Leave your changes to RM initialization.  This means that any process that creates objects and was started before RM was started will be unable to use those objects.  If the pre-RM init process needs to use the object later do one of the following:

a.  TBOOT changes (to save the context of the object)
b.  alter TBOOT code to start the RM before it creates an object.
c. alter the boot process to start the RM before TBOOT creates an object.

Remove your changes to RM initialization and do one of a, b, or c above.  This leaves the RM open to a failure like the one you’re seeing.  I probably prefer #1 above.  I’m trying to think if this is compatible with all environments that the RM might run in…

Thank you.
This-commit-solves-issue-83.patch.txthttps://github.com/01org/TPM2.0-TSS/files/57626/This-commit-solves-issue-83.patch.txt
—
Reply to this email directly or view it on GitHubhttps://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163484218.

wcarthur1 and Ning.
The object handle that Ning mentioned(handle2048 variable at tpm_20.c in
tboot source) is used for entering into S3 state and resuming from S3
state. But the object handle seems to be created from TPM_RH_NULL, which
means that the object handle could be created anytime when tboot needs.
I would like to suggest that tboot creates/flushes the object handle when
enters into/resumes from the S3 state. The patch that I sent
previously(FlushAllLoadedHandles() function) should work O.K, and it is
needed for robustness of the RM. It would not interfere tboot working, as
long as it gets/returns the handle whenever needs.
Ning, please let me know if I understand wrong. Otherwise, I could add some
modification to tpm_20.c file, so that tboot could create the object handle
as necessary.
Thank you.
On Fri, Dec 11, 2015 at 4:21 AM, wcarthur1<EMAIL_ADDRESS>wrote:

Ning,
For this to be guaranteed to work correctly, TBOOT needs to start the
resource manager before creating this key.
Otherwise, it will not be able to seal TBOOT before S3 and after S3
resume.
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Sun, Ning
Sent: Thursday, December 10, 2015 1:40 PM
To: Arthur, Will C<EMAIL_ADDRESS>01org/TPM2.0-TSS <
<EMAIL_ADDRESS>01org/TPM2.0-TSS<EMAIL_ADDRESS>Cc: Wiseman, Monty<EMAIL_ADDRESS>Subject: RE: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM
2.0) (#85)
[Arthur, Will C] How is TBOOT using this object? Does it need to use it
later?
[Ning] this is primary object created by tboot to create keys to seal
tboot mem in a S3 resume, and unseal tboot mem after return from S3 resume.
Ning Sun
Intel Corporation
Tboot project: - http://sourceforge.net/projects/tboot/
Intel® TXT MLE DG:
http://download.intel.com/technology/security/downloads/315168.pdf
From: Arthur, Will C
Sent: Thursday, December 10, 2015 5:29 AM
To: 01org/TPM2.0-TSS; 01org/TPM2.0-TSS; Sun, Ning
Cc: Wiseman, Monty; Sun, Ning
Subject: RE: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM
2.0) (#85)
Below…
I’m going to add one of our TBOOT contacts here…
Ning, do you have a recommendation here?
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Seunghun Han<EMAIL_ADDRESS>Sent: Wednesday, December 9, 2015 11:20 PM
To: 01org/TPM2.0-TSS<EMAIL_ADDRESS><EMAIL_ADDRESS>Cc: Arthur, Will C <will.c.arthur<EMAIL_ADDRESS>Subject: Re: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM
2.0) (#85)
Hello, wcarthur1.
Thank you for the reply.
I work for a security research institute of government. My team has
designed a security platform for PC and I think that TPM 2.0 will be a core
part of the security platform. So I am trying to enable tboot 1.8.3 with
NUC5i5MYHE utilizing TPM2.0-TSS.
My test machine is booted using tboot 1.8.3, and tboot creates an object
handle during boot process. I could find this object handle(0x80000000) in
tboot logs(using txt-state command).
[Arthur, Will C] How is TBOOT using this object? Does it need to use it
later?
[Ning] this is primary object created by tboot to create keys to seal
tboot mem in a S3 resume, and unseal tboot mem after return from S3 resume.
Log messages from tboot 1.8.3
TBOOT: TPM: TPM Family 0x1
TBOOT: TPM: supported bank count = 2
TBOOT: TPM: bank alg = 00000004
TBOOT: TPM: bank alg = 0000000b
TBOOT: TPM: supported alg cout = 00000002
TBOOT: 00000004
TBOOT: 0000000B
TBOOT: TPM:CreatePrimary creating hierarchy handle = 40000007
TBOOT: TPM:CreatePrimary created object handle = 80000000 <== object
handle for tboot
TBOOT: TPM attribute:
TBOOT: extend policy 2
TBOOT: current alg id 0x4
TBOOT: timeout values: A: 750, B: 2000, C: 75000, D: 750
When I generate random numbers using tpm2_getrandom of sapi-tools in
tpm2.0-tools, the RM dumps following error logs related to this object
handle.
The RM’s log
TPM2.0-TSS/resourcemgr$> ./resourcemgr
Initializing local TPM Interface
Initializing Resource Manager
maxActiveSessions = 32
gapMaxValue = 255
socket created: 0x4
bind to IP address:port: <IP_ADDRESS>:2324
Other CMD server listening to socket: 0x4
socket created: 0x5
bind to IP address:port: <IP_ADDRESS>:2323
TPM CMD server listening to socket: 0x5
Starting SockServer (TPM CMD), socket: 0x5.
Starting SockServer (Other CMD), socket: 0x4.
Accept socket: 0x7
Resource Manager Other CMD Server accepted client
Accept socket: 0x6
Resource Manager TPM CMD Server accepted client
|| Loaded transient object handles:
|| 0x80000000, TpmCmdServer died (TPM CMD), rval: 0x00000000, socket: 0x6.
OtherCmdServer died (Other CMD), socket: 0x7.
The tpm2_getrandom ’s log
tpm2.0-tools/sapi-tools$> ./tpm2_getrandom -s 10 -o a.txt
......TPM2_GetRandom Error. TPM Error:0xc6000......
I agree with your ideas and I think that y
our 2nd choice is better than others.
[Arthur, Will C] That assumes that TBOOT:

doesn’t expect the object to be loaded and

it is NEVER going to use the object again.

Reasons:

If TBOOT plans to use the object later and expects it to already be
loaded, the command that needs it loaded will fail.

Since the RM flushed the object, TBOOT can’t load the context since it
doesn’t have the context (unless TBOOT first did a SaveContext). Otherwise
RM has the context and has no way to associate the context with a TCTI
connection.

Options here:

Leave your changes to RM initialization. This means that any process
that creates objects and was started before RM was started will be unable
to use those objects. If the pre-RM init process needs to use the object
later do one of the following:

a. TBOOT changes (to save the context of the object)
b. alter TBOOT code to start the RM before it creates an object.
c. alter the boot process to start the RM before TBOOT creates an object.

Remove your changes to RM initialization and do one of a, b, or c
above. This leaves the RM open to a failure like the one you’re seeing. I
probably prefer #1 above. I’m trying to think if this is compatible with
all environments that the RM might run in…

Thank you.
This-commit-solves-issue-83.patch.txt<
https://github.com/01org/TPM2.0-TSS/files/57626/This-commit-solves-issue-83.patch.txt>
—
Reply to this email directly or view it on GitHub<
https://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163484218>.
—
Reply to this email directly or view it on GitHub
https://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163724410.

Ning and I met yesterday and agreed on some TBOOT changes.  Until those are incorporated into TBOOT, you will not be able to successfully S3 and resume.
As for your changes I like the change to flush any objects in the RM initialization.  I would like to suggest the following change:  please change the warning at the end of the RM receive call to an error like it was before.  Because this can cause problems that are hard to debug and confusing, I would this to be a very visible error.
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Seunghun Han<EMAIL_ADDRESS>Sent: Friday, December 11, 2015 5:20 AM
To: 01org/TPM2.0-TSS<EMAIL_ADDRESS>Cc: Arthur, Will C<EMAIL_ADDRESS>Subject: Re: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM 2.0) (#85)
wcarthur1 and Ning.
The object handle that Ning mentioned(handle2048 variable at tpm_20.c in
tboot source) is used for entering into S3 state and resuming from S3
state. But the object handle seems to be created from TPM_RH_NULL, which
means that the object handle could be created anytime when tboot needs.
I would like to suggest that tboot creates/flushes the object handle when
enters into/resumes from the S3 state. The patch that I sent
previously(FlushAllLoadedHandles() function) should work O.K, and it is
needed for robustness of the RM. It would not interfere tboot working, as
long as it gets/returns the handle whenever needs.
Ning, please let me know if I understand wrong. Otherwise, I could add some
modification to tpm_20.c file, so that tboot could create the object handle
as necessary.
Thank you.
On Fri, Dec 11, 2015 at 4:21 AM, wcarthur1 <notifications<EMAIL_ADDRESS>wrote:

Ning,
For this to be guaranteed to work correctly, TBOOT needs to start the
resource manager before creating this key.
Otherwise, it will not be able to seal TBOOT before S3 and after S3
resume.
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Sun, Ning
Sent: Thursday, December 10, 2015 1:40 PM
To: Arthur, Will C <will.c.arthur<EMAIL_ADDRESS>01org/TPM2.0-TSS <
reply<EMAIL_ADDRESS>01org/TPM2.0-TSS <TPM2.0-TSS<EMAIL_ADDRESS>Cc: Wiseman, Monty <monty.wiseman<EMAIL_ADDRESS>Subject: RE: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM
2.0) (#85)
[Arthur, Will C] How is TBOOT using this object? Does it need to use it
later?
[Ning] this is primary object created by tboot to create keys to seal
tboot mem in a S3 resume, and unseal tboot mem after return from S3 resume.
Ning Sun
Intel Corporation
Tboot project: - http://sourceforge.net/projects/tboot/
Intel® TXT MLE DG:
http://download.intel.com/technology/security/downloads/315168.pdf
From: Arthur, Will C
Sent: Thursday, December 10, 2015 5:29 AM
To: 01org/TPM2.0-TSS; 01org/TPM2.0-TSS; Sun, Ning
Cc: Wiseman, Monty; Sun, Ning
Subject: RE: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM
2.0) (#85)
Below…
I’m going to add one of our TBOOT contacts here…
Ning, do you have a recommendation here?
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Seunghun Han<EMAIL_ADDRESS>Sent: Wednesday, December 9, 2015 11:20 PM
To: 01org/TPM2.0-TSS<EMAIL_ADDRESS><EMAIL_ADDRESS>> TPM2.0-TSS<EMAIL_ADDRESS>Cc: Arthur, Will C <will.c.arthur@intel.com<mailto:will.c.arthur@intel.commailto:will.c.arthur<EMAIL_ADDRESS>Subject: Re: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM
2.0) (#85)
Hello, wcarthur1.
Thank you for the reply.
I work for a security research institute of government. My team has
designed a security platform for PC and I think that TPM 2.0 will be a core
part of the security platform. So I am trying to enable tboot 1.8.3 with
NUC5i5MYHE utilizing TPM2.0-TSS.
My test machine is booted using tboot 1.8.3, and tboot creates an object
handle during boot process. I could find this object handle(0x80000000) in
tboot logs(using txt-state command).
[Arthur, Will C] How is TBOOT using this object? Does it need to use it
later?
[Ning] this is primary object created by tboot to create keys to seal
tboot mem in a S3 resume, and unseal tboot mem after return from S3 resume.
Log messages from tboot 1.8.3
TBOOT: TPM: TPM Family 0x1
TBOOT: TPM: supported bank count = 2
TBOOT: TPM: bank alg = 00000004
TBOOT: TPM: bank alg = 0000000b
TBOOT: TPM: supported alg cout = 00000002
TBOOT: 00000004
TBOOT: 0000000B
TBOOT: TPM:CreatePrimary creating hierarchy handle = 40000007
TBOOT: TPM:CreatePrimary created object handle = 80000000 <== object
handle for tboot
TBOOT: TPM attribute:
TBOOT: extend policy 2
TBOOT: current alg id 0x4
TBOOT: timeout values: A: 750, B: 2000, C: 75000, D: 750
When I generate random numbers using tpm2_getrandom of sapi-tools in
tpm2.0-tools, the RM dumps following error logs related to this object
handle.
The RM’s log
TPM2.0-TSS/resourcemgr$> ./resourcemgr
Initializing local TPM Interface
Initializing Resource Manager
maxActiveSessions = 32
gapMaxValue = 255
socket created: 0x4
bind to IP address:port: <IP_ADDRESS>:2324
Other CMD server listening to socket: 0x4
socket created: 0x5
bind to IP address:port: <IP_ADDRESS>:2323
TPM CMD server listening to socket: 0x5
Starting SockServer (TPM CMD), socket: 0x5.
Starting SockServer (Other CMD), socket: 0x4.
Accept socket: 0x7
Resource Manager Other CMD Server accepted client
Accept socket: 0x6
Resource Manager TPM CMD Server accepted client
|| Loaded transient object handles:
|| 0x80000000, TpmCmdServer died (TPM CMD), rval: 0x00000000, socket: 0x6.
OtherCmdServer died (Other CMD), socket: 0x7.
The tpm2_getrandom ’s log
tpm2.0-tools/sapi-tools$> ./tpm2_getrandom -s 10 -o a.txt
......TPM2_GetRandom Error. TPM Error:0xc6000......
I agree with your ideas and I think that y
our 2nd choice is better than others.
[Arthur, Will C] That assumes that TBOOT:

doesn’t expect the object to be loaded and

it is NEVER going to use the object again.

Reasons:

If TBOOT plans to use the object later and expects it to already be
loaded, the command that needs it loaded will fail.

Since the RM flushed the object, TBOOT can’t load the context since it
doesn’t have the context (unless TBOOT first did a SaveContext). Otherwise
RM has the context and has no way to associate the context with a TCTI
connection.

Options here:

Leave your changes to RM initialization. This means that any process
that creates objects and was started before RM was started will be unable
to use those objects. If the pre-RM init process needs to use the object
later do one of the following:

a. TBOOT changes (to save the context of the object)
b. alter TBOOT code to start the RM before it creates an object.
c. alter the boot process to start the RM before TBOOT creates an object.

Remove your changes to RM initialization and do one of a, b, or c
above. This leaves the RM open to a failure like the one you’re seeing. I
probably prefer #1 above. I’m trying to think if this is compatible with
all environments that the RM might run in…

Thank you.
This-commit-solves-issue-83.patch.txt<
https://github.com/01org/TPM2.0-TSS/files/57626/This-commit-solves-issue-83.patch.txt>
—
Reply to this email directly or view it on GitHub<
https://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163484218>.
—
Reply to this email directly or view it on GitHub
https://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163724410.

—
Reply to this email directly or view it on GitHubhttps://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163902127.

Hello, wcarthur1.
That’s good news to me. Thank you very much.
According to your suggestion, I will change the warning to the error like it was before and close this pull-request.
If you don’t mind, I would like to make new pull-request that previous patch code(This-commit-solves-issue-83.patch.txt) is applied. The patch has the codes that flush any objects in the RM initialization, and it works fine with/without tboot.
Please allow me to make new pull-request and review it.
Thank you.

Yes, that sounds good.
And thanks for helping with this issue!
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Seunghun Han<EMAIL_ADDRESS>Sent: Friday, December 11, 2015 9:19 AM
To: 01org/TPM2.0-TSS<EMAIL_ADDRESS>Cc: Arthur, Will C<EMAIL_ADDRESS>Subject: Re: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM 2.0) (#85)
Hello, wcarthur1.
That’s good news to me. Thank you very much.
According to your suggestion, I will change the warning to the error like it was before and close this pull-request.
If you don’t mind, I would like to make new pull-request that previous patch code(This-commit-solves-issue-83.patch.txthttps://github.com/01org/TPM2.0-TSS/files/57626/This-commit-solves-issue-83.patch.txt) is applied. The patch has the codes that flush any objects in the RM initialization, and it works fine with/without tboot.
Please allow me to make new pull-request and review it.
Thank you.
—
Reply to this email directly or view it on GitHubhttps://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163946129.

Hello, wcarthur1.
That’s good news to me. Thank you very much.
According to your suggestion, I will change the warning to the error like
it was before and close this pull-request.
If you don’t mind, I would like to make new pull-request that previous
patch code(
https://github.com/01org/TPM2.0-TSS/files/57626/This-commit-solves-issue-83.patch.txt)
is applied. The patch has the codes that flush any objects in the RM
initialization, and it works fine with/without tboot.
Please allow me to make new pull-request and review it.
Thank you.
On Fri, Dec 11, 2015 at 10:21 PM, wcarthur1<EMAIL_ADDRESS>wrote:

Ning and I met yesterday and agreed on some TBOOT changes. Until those are
incorporated into TBOOT, you will not be able to successfully S3 and
resume.
As for your changes I like the change to flush any objects in the RM
initialization. I would like to suggest the following change: please change
the warning at the end of the RM receive call to an error like it was
before. Because this can cause problems that are hard to debug and
confusing, I would this to be a very visible error.
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Seunghun Han<EMAIL_ADDRESS>Sent: Friday, December 11, 2015 5:20 AM
To: 01org/TPM2.0-TSS<EMAIL_ADDRESS>Cc: Arthur, Will C<EMAIL_ADDRESS>Subject: Re: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM
2.0) (#85)
wcarthur1 and Ning.
The object handle that Ning mentioned(handle2048 variable at tpm_20.c in
tboot source) is used for entering into S3 state and resuming from S3
state. But the object handle seems to be created from TPM_RH_NULL, which
means that the object handle could be created anytime when tboot needs.
I would like to suggest that tboot creates/flushes the object handle when
enters into/resumes from the S3 state. The patch that I sent
previously(FlushAllLoadedHandles() function) should work O.K, and it is
needed for robustness of the RM. It would not interfere tboot working, as
long as it gets/returns the handle whenever needs.
Ning, please let me know if I understand wrong. Otherwise, I could add
some
modification to tpm_20.c file, so that tboot could create the object
handle
as necessary.
Thank you.
On Fri, Dec 11, 2015 at 4:21 AM, wcarthur1<EMAIL_ADDRESS><EMAIL_ADDRESS>wrote:

Ning,
For this to be guaranteed to work correctly, TBOOT needs to start the
resource manager before creating this key.
Otherwise, it will not be able to seal TBOOT before S3 and after S3
resume.
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Sun, Ning
Sent: Thursday, December 10, 2015 1:40 PM
To: Arthur, Will C<EMAIL_ADDRESS><EMAIL_ADDRESS>01org/TPM2.0-TSS <
reply<EMAIL_ADDRESS>01org/TPM2.0-TSS<EMAIL_ADDRESS><EMAIL_ADDRESS>Cc: Wiseman, Monty<EMAIL_ADDRESS><EMAIL_ADDRESS>Subject: RE: [TPM2.0-TSS] Fixing error for using TSS with tboot
1.8.3(TPM
2.0) (#85)
[Arthur, Will C] How is TBOOT using this object? Does it need to use it
later?
[Ning] this is primary object created by tboot to create keys to seal
tboot mem in a S3 resume, and unseal tboot mem after return from S3
resume.
Ning Sun
Intel Corporation
Tboot project: - http://sourceforge.net/projects/tboot/
Intel® TXT MLE DG:
http://download.intel.com/technology/security/downloads/315168.pdf
From: Arthur, Will C
Sent: Thursday, December 10, 2015 5:29 AM
To: 01org/TPM2.0-TSS; 01org/TPM2.0-TSS; Sun, Ning
Cc: Wiseman, Monty; Sun, Ning
Subject: RE: [TPM2.0-TSS] Fixing error for using TSS with tboot
1.8.3(TPM
2.0) (#85)
Below…
I’m going to add one of our TBOOT contacts here…
Ning, do you have a recommendation here?
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Seunghun Han<EMAIL_ADDRESS>Sent: Wednesday, December 9, 2015 11:20 PM
To: 01org/TPM2.0-TSS<EMAIL_ADDRESS><EMAIL_ADDRESS>>
TPM2.0-TSS<EMAIL_ADDRESS>Cc: Arthur, Will C<EMAIL_ADDRESS>will.c.arthur<EMAIL_ADDRESS><EMAIL_ADDRESS>Subject: Re: [TPM2.0-TSS] Fixing error for using TSS with tboot
1.8.3(TPM
2.0) (#85)
Hello, wcarthur1.
Thank you for the reply.
I work for a security research institute of government. My team has
designed a security platform for PC and I think that TPM 2.0 will be a
core
part of the security platform. So I am trying to enable tboot 1.8.3 with
NUC5i5MYHE utilizing TPM2.0-TSS.
My test machine is booted using tboot 1.8.3, and tboot creates an object
handle during boot process. I could find this object handle(0x80000000)
in
tboot logs(using txt-state command).
[Arthur, Will C] How is TBOOT using this object? Does it need to use it
later?
[Ning] this is primary object created by tboot to create keys to seal
tboot mem in a S3 resume, and unseal tboot mem after return from S3
resume.
Log messages from tboot 1.8.3
TBOOT: TPM: TPM Family 0x1
TBOOT: TPM: supported bank count = 2
TBOOT: TPM: bank alg = 00000004
TBOOT: TPM: bank alg = 0000000b
TBOOT: TPM: supported alg cout = 00000002
TBOOT: 00000004
TBOOT: 0000000B
TBOOT: TPM:CreatePrimary creating hierarchy handle = 40000007
TBOOT: TPM:CreatePrimary created object handle = 80000000 <== object
handle for tboot
TBOOT: TPM attribute:
TBOOT: extend policy 2
TBOOT: current alg id 0x4
TBOOT: timeout values: A: 750, B: 2000, C: 75000, D: 750
When I generate random numbers using tpm2_getrandom of sapi-tools in
tpm2.0-tools, the RM dumps following error logs related to this object
handle.
The RM’s log
TPM2.0-TSS/resourcemgr$> ./resourcemgr
Initializing local TPM Interface
Initializing Resource Manager
maxActiveSessions = 32
gapMaxValue = 255
socket created: 0x4
bind to IP address:port: <IP_ADDRESS>:2324
Other CMD server listening to socket: 0x4
socket created: 0x5
bind to IP address:port: <IP_ADDRESS>:2323
TPM CMD server listening to socket: 0x5
Starting SockServer (TPM CMD), socket: 0x5.
Starting SockServer (Other CMD), socket: 0x4.
Accept socket: 0x7
Resource Manager Other CMD Server accepted client
Accept socket: 0x6
Resource Manager TPM CMD Server accepted client
|| Loaded transient object handles:
|| 0x80000000, TpmCmdServer died (TPM CMD), rval: 0x00000000, socket:
0x6.
OtherCmdServer died (Other CMD), socket: 0x7.
The tpm2_getrandom ’s log
tpm2.0-tools/sapi-tools$> ./tpm2_getrandom -s 10 -o a.txt
......TPM2_GetRandom Error. TPM Error:0xc6000......
I agree with your ideas and I think that y
our 2nd choice is better than others.
[Arthur, Will C] That assumes that TBOOT:

doesn’t expect the object to be loaded and

it is NEVER going to use the object again.

Reasons:

If TBOOT plans to use the object later and expects it to already be
loaded, the command that needs it loaded will fail.

Since the RM flushed the object, TBOOT can’t load the context since
it
doesn’t have the context (unless TBOOT first did a SaveContext).
Otherwise
RM has the context and has no way to associate the context with a TCTI
connection.

Options here:

Leave your changes to RM initialization. This means that any process
that creates objects and was started before RM was started will be
unable
to use those objects. If the pre-RM init process needs to use the object
later do one of the following:

a. TBOOT changes (to save the context of the object)
b. alter TBOOT code to start the RM before it creates an object.
c. alter the boot process to start the RM before TBOOT creates an
object.

Remove your changes to RM initialization and do one of a, b, or c
above. This leaves the RM open to a failure like the one you’re seeing.
I
probably prefer #1 above. I’m trying to think if this is compatible with
all environments that the RM might run in…

Thank you.
This-commit-solves-issue-83.patch.txt<

https://github.com/01org/TPM2.0-TSS/files/57626/This-commit-solves-issue-83.patch.txt>

—
Reply to this email directly or view it on GitHub<
https://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163484218>.
—
Reply to this email directly or view it on GitHub
https://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163724410.

—
Reply to this email directly or view it on GitHub<
https://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163902127>.
—
Reply to this email directly or view it on GitHub
https://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163935093.

I would like to review the pull request after you create it.  Always helps to have another set of eyes on the code.
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Seunghun Han<EMAIL_ADDRESS>Sent: Friday, December 11, 2015 9:21 AM
To: 01org/TPM2.0-TSS<EMAIL_ADDRESS>Cc: Arthur, Will C<EMAIL_ADDRESS>Subject: Re: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM 2.0) (#85)
Hello, wcarthur1.
That’s good news to me. Thank you very much.
According to your suggestion, I will change the warning to the error like
it was before and close this pull-request.
If you don’t mind, I would like to make new pull-request that previous
patch code(
https://github.com/01org/TPM2.0-TSS/files/57626/This-commit-solves-issue-83.patch.txt)
is applied. The patch has the codes that flush any objects in the RM
initialization, and it works fine with/without tboot.
Please allow me to make new pull-request and review it.
Thank you.
On Fri, Dec 11, 2015 at 10:21 PM, wcarthur1 <notifications<EMAIL_ADDRESS>wrote:

Ning and I met yesterday and agreed on some TBOOT changes. Until those are
incorporated into TBOOT, you will not be able to successfully S3 and
resume.
As for your changes I like the change to flush any objects in the RM
initialization. I would like to suggest the following change: please change
the warning at the end of the RM receive call to an error like it was
before. Because this can cause problems that are hard to debug and
confusing, I would this to be a very visible error.
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Seunghun Han<EMAIL_ADDRESS>Sent: Friday, December 11, 2015 5:20 AM
To: 01org/TPM2.0-TSS <TPM2.0-TSS<EMAIL_ADDRESS>Cc: Arthur, Will C <will.c.arthur<EMAIL_ADDRESS>Subject: Re: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM
2.0) (#85)
wcarthur1 and Ning.
The object handle that Ning mentioned(handle2048 variable at tpm_20.c in
tboot source) is used for entering into S3 state and resuming from S3
state. But the object handle seems to be created from TPM_RH_NULL, which
means that the object handle could be created anytime when tboot needs.
I would like to suggest that tboot creates/flushes the object handle when
enters into/resumes from the S3 state. The patch that I sent
previously(FlushAllLoadedHandles() function) should work O.K, and it is
needed for robustness of the RM. It would not interfere tboot working, as
long as it gets/returns the handle whenever needs.
Ning, please let me know if I understand wrong. Otherwise, I could add
some
modification to tpm_20.c file, so that tboot could create the object
handle
as necessary.
Thank you.
On Fri, Dec 11, 2015 at 4:21 AM, wcarthur1<EMAIL_ADDRESS><EMAIL_ADDRESS>><EMAIL_ADDRESS>wrote:

Ning,
For this to be guaranteed to work correctly, TBOOT needs to start the
resource manager before creating this key.
Otherwise, it will not be able to seal TBOOT before S3 and after S3
resume.
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Sun, Ning
Sent: Thursday, December 10, 2015 1:40 PM
To: Arthur, Will C<EMAIL_ADDRESS><EMAIL_ADDRESS>> will.c.arthur<EMAIL_ADDRESS>01org/TPM2.0-TSS <
reply@reply.github.com<mailto:reply@reply.github.commailto:reply<EMAIL_ADDRESS>01org/TPM2.0-TSS<EMAIL_ADDRESS><EMAIL_ADDRESS>> TPM2.0-TSS<EMAIL_ADDRESS>Cc: Wiseman, Monty<EMAIL_ADDRESS><EMAIL_ADDRESS>> monty.wiseman<EMAIL_ADDRESS>Subject: RE: [TPM2.0-TSS] Fixing error for using TSS with tboot
1.8.3(TPM
2.0) (#85)
[Arthur, Will C] How is TBOOT using this object? Does it need to use it
later?
[Ning] this is primary object created by tboot to create keys to seal
tboot mem in a S3 resume, and unseal tboot mem after return from S3
resume.
Ning Sun
Intel Corporation
Tboot project: - http://sourceforge.net/projects/tboot/
Intel® TXT MLE DG:
http://download.intel.com/technology/security/downloads/315168.pdf
From: Arthur, Will C
Sent: Thursday, December 10, 2015 5:29 AM
To: 01org/TPM2.0-TSS; 01org/TPM2.0-TSS; Sun, Ning
Cc: Wiseman, Monty; Sun, Ning
Subject: RE: [TPM2.0-TSS] Fixing error for using TSS with tboot
1.8.3(TPM
2.0) (#85)
Below…
I’m going to add one of our TBOOT contacts here…
Ning, do you have a recommendation here?
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Seunghun Han<EMAIL_ADDRESS>Sent: Wednesday, December 9, 2015 11:20 PM
To: 01org/TPM2.0-TSS<EMAIL_ADDRESS><EMAIL_ADDRESS>><EMAIL_ADDRESS>>
TPM2.0-TSS@noreply.github.com<mailto:TPM2.0-TSS@noreply.github.commailto:TPM2.0-TSS<EMAIL_ADDRESS>Cc: Arthur, Will C<EMAIL_ADDRESS><EMAIL_ADDRESS>> will.c.arthur@intel.com<mailto:will.c.arthur@intel.com%mailto:will.c.arthur<EMAIL_ADDRESS><EMAIL_ADDRESS>Subject: Re: [TPM2.0-TSS] Fixing error for using TSS with tboot
1.8.3(TPM
2.0) (#85)
Hello, wcarthur1.
Thank you for the reply.
I work for a security research institute of government. My team has
designed a security platform for PC and I think that TPM 2.0 will be a
core
part of the security platform. So I am trying to enable tboot 1.8.3 with
NUC5i5MYHE utilizing TPM2.0-TSS.
My test machine is booted using tboot 1.8.3, and tboot creates an object
handle during boot process. I could find this object handle(0x80000000)
in
tboot logs(using txt-state command).
[Arthur, Will C] How is TBOOT using this object? Does it need to use it
later?
[Ning] this is primary object created by tboot to create keys to seal
tboot mem in a S3 resume, and unseal tboot mem after return from S3
resume.
Log messages from tboot 1.8.3
TBOOT: TPM: TPM Family 0x1
TBOOT: TPM: supported bank count = 2
TBOOT: TPM: bank alg = 00000004
TBOOT: TPM: bank alg = 0000000b
TBOOT: TPM: supported alg cout = 00000002
TBOOT: 00000004
TBOOT: 0000000B
TBOOT: TPM:CreatePrimary creating hierarchy handle = 40000007
TBOOT: TPM:CreatePrimary created object handle = 80000000 <== object
handle for tboot
TBOOT: TPM attribute:
TBOOT: extend policy 2
TBOOT: current alg id 0x4
TBOOT: timeout values: A: 750, B: 2000, C: 75000, D: 750
When I generate random numbers using tpm2_getrandom of sapi-tools in
tpm2.0-tools, the RM dumps following error logs related to this object
handle.
The RM’s log
TPM2.0-TSS/resourcemgr$> ./resourcemgr
Initializing local TPM Interface
Initializing Resource Manager
maxActiveSessions = 32
gapMaxValue = 255
socket created: 0x4
bind to IP address:port: <IP_ADDRESS>:2324
Other CMD server listening to socket: 0x4
socket created: 0x5
bind to IP address:port: <IP_ADDRESS>:2323
TPM CMD server listening to socket: 0x5
Starting SockServer (TPM CMD), socket: 0x5.
Starting SockServer (Other CMD), socket: 0x4.
Accept socket: 0x7
Resource Manager Other CMD Server accepted client
Accept socket: 0x6
Resource Manager TPM CMD Server accepted client
|| Loaded transient object handles:
|| 0x80000000, TpmCmdServer died (TPM CMD), rval: 0x00000000, socket:
0x6.
OtherCmdServer died (Other CMD), socket: 0x7.
The tpm2_getrandom ’s log
tpm2.0-tools/sapi-tools$> ./tpm2_getrandom -s 10 -o a.txt
......TPM2_GetRandom Error. TPM Error:0xc6000......
I agree with your ideas and I think that y
our 2nd choice is better than others.
[Arthur, Will C] That assumes that TBOOT:

doesn’t expect the object to be loaded and

it is NEVER going to use the object again.

Reasons:

If TBOOT plans to use the object later and expects it to already be
loaded, the command that needs it loaded will fail.

Since the RM flushed the object, TBOOT can’t load the context since
it
doesn’t have the context (unless TBOOT first did a SaveContext).
Otherwise
RM has the context and has no way to associate the context with a TCTI
connection.

Options here:

Leave your changes to RM initialization. This means that any process
that creates objects and was started before RM was started will be
unable
to use those objects. If the pre-RM init process needs to use the object
later do one of the following:

a. TBOOT changes (to save the context of the object)
b. alter TBOOT code to start the RM before it creates an object.
c. alter the boot process to start the RM before TBOOT creates an
object.

Remove your changes to RM initialization and do one of a, b, or c
above. This leaves the RM open to a failure like the one you’re seeing.
I
probably prefer #1 above. I’m trying to think if this is compatible with
all environments that the RM might run in…

Thank you.
This-commit-solves-issue-83.patch.txt<

https://github.com/01org/TPM2.0-TSS/files/57626/This-commit-solves-issue-83.patch.txt>

—
Reply to this email directly or view it on GitHub<
https://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163484218>.
—
Reply to this email directly or view it on GitHub
https://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163724410.

—
Reply to this email directly or view it on GitHub<
https://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163902127>.
—
Reply to this email directly or view it on GitHub
https://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163935093.

—
Reply to this email directly or view it on GitHubhttps://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163946627.

Hello, wcarthur1.
Following your suggestion, I made a new pull-request at
https://github.com/01org/TPM2.0-TSS/pull/86 .
Please review it and if you have any comment, please let me know.
Thank you.
========
Seunghun Han
National Security Research Institute
+82-42-870-4781
On Fri, Dec 11, 2015 at 11:23 PM, wcarthur1<EMAIL_ADDRESS>wrote:

I would like to review the pull request after you create it. Always helps to
have another set of eyes on the code.
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Seunghun Han<EMAIL_ADDRESS>Sent: Friday, December 11, 2015 9:21 AM
To: 01org/TPM2.0-TSS<EMAIL_ADDRESS>Cc: Arthur, Will C<EMAIL_ADDRESS>Subject: Re: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM
2.0) (#85)
Hello, wcarthur1.
That’s good news to me. Thank you very much.
According to your suggestion, I will change the warning to the error like
it was before and close this pull-request.
If you don’t mind, I would like to make new pull-request that previous
patch code(
https://github.com/01org/TPM2.0-TSS/files/57626/This-commit-solves-issue-83.patch.txt)
is applied. The patch has the codes that flush any objects in the RM
initialization, and it works fine with/without tboot.
Please allow me to make new pull-request and review it.
Thank you.
On Fri, Dec 11, 2015 at 10:21 PM, wcarthur1
<notifications<EMAIL_ADDRESS>wrote:

Ning and I met yesterday and agreed on some TBOOT changes. Until those are
incorporated into TBOOT, you will not be able to successfully S3 and
resume.
As for your changes I like the change to flush any objects in the RM
initialization. I would like to suggest the following change: please
change
the warning at the end of the RM receive call to an error like it was
before. Because this can cause problems that are hard to debug and
confusing, I would this to be a very visible error.
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Seunghun Han<EMAIL_ADDRESS>Sent: Friday, December 11, 2015 5:20 AM
To: 01org/TPM2.0-TSS
<TPM2.0-TSS<EMAIL_ADDRESS>Cc: Arthur, Will C
<will.c.arthur<EMAIL_ADDRESS>Subject: Re: [TPM2.0-TSS] Fixing error for using TSS with tboot 1.8.3(TPM
2.0) (#85)
wcarthur1 and Ning.
The object handle that Ning mentioned(handle2048 variable at tpm_20.c in
tboot source) is used for entering into S3 state and resuming from S3
state. But the object handle seems to be created from TPM_RH_NULL, which
means that the object handle could be created anytime when tboot needs.
I would like to suggest that tboot creates/flushes the object handle when
enters into/resumes from the S3 state. The patch that I sent
previously(FlushAllLoadedHandles() function) should work O.K, and it is
needed for robustness of the RM. It would not interfere tboot working, as
long as it gets/returns the handle whenever needs.
Ning, please let me know if I understand wrong. Otherwise, I could add
some
modification to tpm_20.c file, so that tboot could create the object
handle
as necessary.
Thank you.
On Fri, Dec 11, 2015 at 4:21 AM, wcarthur1<EMAIL_ADDRESS><EMAIL_ADDRESS>><EMAIL_ADDRESS>wrote:

Ning,
For this to be guaranteed to work correctly, TBOOT needs to start the
resource manager before creating this key.
Otherwise, it will not be able to seal TBOOT before S3 and after S3
resume.
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Sun, Ning
Sent: Thursday, December 10, 2015 1:40 PM
To: Arthur, Will C<EMAIL_ADDRESS><EMAIL_ADDRESS>>
will.c.arthur<EMAIL_ADDRESS>01org/TPM2.0-TSS
<
reply@reply.github.com<mailto:reply@reply.github.commailto:reply<EMAIL_ADDRESS>01org/TPM2.0-TSS<EMAIL_ADDRESS><EMAIL_ADDRESS>>
TPM2.0-TSS<EMAIL_ADDRESS>Cc: Wiseman, Monty<EMAIL_ADDRESS><EMAIL_ADDRESS>>
monty.wiseman<EMAIL_ADDRESS>Subject: RE: [TPM2.0-TSS] Fixing error for using TSS with tboot
1.8.3(TPM
2.0) (#85)
[Arthur, Will C] How is TBOOT using this object? Does it need to use it
later?
[Ning] this is primary object created by tboot to create keys to seal
tboot mem in a S3 resume, and unseal tboot mem after return from S3
resume.
Ning Sun
Intel Corporation
Tboot project: - http://sourceforge.net/projects/tboot/
Intel® TXT MLE DG:
http://download.intel.com/technology/security/downloads/315168.pdf
From: Arthur, Will C
Sent: Thursday, December 10, 2015 5:29 AM
To: 01org/TPM2.0-TSS; 01org/TPM2.0-TSS; Sun, Ning
Cc: Wiseman, Monty; Sun, Ning
Subject: RE: [TPM2.0-TSS] Fixing error for using TSS with tboot
1.8.3(TPM
2.0) (#85)
Below…
I’m going to add one of our TBOOT contacts here…
Ning, do you have a recommendation here?
Will Arthur
Intel Corporation
Server Security Firmware
803-216-2101
From: Seunghun Han<EMAIL_ADDRESS>Sent: Wednesday, December 9, 2015 11:20 PM
To: 01org/TPM2.0-TSS<EMAIL_ADDRESS><EMAIL_ADDRESS>>
<EMAIL_ADDRESS>>

TPM2.0-TSS@noreply.github.com<mailto:TPM2.0-TSS@noreply.github.commailto:TPM2.0-TSS<EMAIL_ADDRESS>
Cc: Arthur, Will C<EMAIL_ADDRESS><EMAIL_ADDRESS>>
will.c.arthur@intel.com<mailto:will.c.arthur@intel.com%mailto:will.c.arthur<EMAIL_ADDRESS><EMAIL_ADDRESS>Subject: Re: [TPM2.0-TSS] Fixing error for using TSS with tboot
1.8.3(TPM
2.0) (#85)
Hello, wcarthur1.
Thank you for the reply.
I work for a security research institute of government. My team has
designed a security platform for PC and I think that TPM 2.0 will be a
core
part of the security platform. So I am trying to enable tboot 1.8.3 with
NUC5i5MYHE utilizing TPM2.0-TSS.
My test machine is booted using tboot 1.8.3, and tboot creates an object
handle during boot process. I could find this object handle(0x80000000)
in
tboot logs(using txt-state command).
[Arthur, Will C] How is TBOOT using this object? Does it need to use it
later?
[Ning] this is primary object created by tboot to create keys to seal
tboot mem in a S3 resume, and unseal tboot mem after return from S3
resume.
Log messages from tboot 1.8.3
TBOOT: TPM: TPM Family 0x1
TBOOT: TPM: supported bank count = 2
TBOOT: TPM: bank alg = 00000004
TBOOT: TPM: bank alg = 0000000b
TBOOT: TPM: supported alg cout = 00000002
TBOOT: 00000004
TBOOT: 0000000B
TBOOT: TPM:CreatePrimary creating hierarchy handle = 40000007
TBOOT: TPM:CreatePrimary created object handle = 80000000 <== object
handle for tboot
TBOOT: TPM attribute:
TBOOT: extend policy 2
TBOOT: current alg id 0x4
TBOOT: timeout values: A: 750, B: 2000, C: 75000, D: 750
When I generate random numbers using tpm2_getrandom of sapi-tools in
tpm2.0-tools, the RM dumps following error logs related to this object
handle.
The RM’s log
TPM2.0-TSS/resourcemgr$> ./resourcemgr
Initializing local TPM Interface
Initializing Resource Manager
maxActiveSessions = 32
gapMaxValue = 255
socket created: 0x4
bind to IP address:port: <IP_ADDRESS>:2324
Other CMD server listening to socket: 0x4
socket created: 0x5
bind to IP address:port: <IP_ADDRESS>:2323
TPM CMD server listening to socket: 0x5
Starting SockServer (TPM CMD), socket: 0x5.
Starting SockServer (Other CMD), socket: 0x4.
Accept socket: 0x7
Resource Manager Other CMD Server accepted client
Accept socket: 0x6
Resource Manager TPM CMD Server accepted client
|| Loaded transient object handles:
|| 0x80000000, TpmCmdServer died (TPM CMD), rval: 0x00000000, socket:
0x6.
OtherCmdServer died (Other CMD), socket: 0x7.
The tpm2_getrandom ’s log
tpm2.0-tools/sapi-tools$> ./tpm2_getrandom -s 10 -o a.txt
......TPM2_GetRandom Error. TPM Error:0xc6000......
I agree with your ideas and I think that y
our 2nd choice is better than others.
[Arthur, Will C] That assumes that TBOOT:

doesn’t expect the object to be loaded and

it is NEVER going to use the object again.

Reasons:

If TBOOT plans to use the object later and expects it to already be
loaded, the command that needs it loaded will fail.

Since the RM flushed the object, TBOOT can’t load the context since
it
doesn’t have the context (unless TBOOT first did a SaveContext).
Otherwise
RM has the context and has no way to associate the context with a TCTI
connection.

Options here:

Leave your changes to RM initialization. This means that any process
that creates objects and was started before RM was started will be
unable
to use those objects. If the pre-RM init process needs to use the object
later do one of the following:

a. TBOOT changes (to save the context of the object)
b. alter TBOOT code to start the RM before it creates an object.
c. alter the boot process to start the RM before TBOOT creates an
object.

Remove your changes to RM initialization and do one of a, b, or c
above. This leaves the RM open to a failure like the one you’re seeing.
I
probably prefer #1 above. I’m trying to think if this is compatible with
all environments that the RM might run in…

Thank you.
This-commit-solves-issue-83.patch.txt<

https://github.com/01org/TPM2.0-TSS/files/57626/This-commit-solves-issue-83.patch.txt>

—
Reply to this email directly or view it on GitHub<
https://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163484218>.
—
Reply to this email directly or view it on GitHub
https://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163724410.

—
Reply to this email directly or view it on GitHub<
https://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163902127>.
—
Reply to this email directly or view it on GitHub
https://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163935093.

—
Reply to this email directly or view it on
GitHubhttps://github.com/01org/TPM2.0-TSS/pull/85#issuecomment-163946627.
—
Reply to this email directly or view it on GitHub.


ctx: add form file header

Pull Request Test Coverage Report for Build 86

2 of 25 (8.0%)  changed or added relevant lines in 2 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage decreased (-1.5%) to 49.082%

Changes Missing Coverage
Covered Lines
Changed/Added Lines
%

request.go
1
24
4.17%

Totals

Change from base Build 84:
-1.5%

Covered Lines:
401

Relevant Lines:
817

💛  - Coveralls


Missing: Queue implementation

This folder is missing an implementation of Queue

i would like to work on this issue @hanshulll please assign it to me


Add custom header for client identification to each API call

Is your feature request related to a problem? Please describe.
We're using a lot of python automation scripts, but when error rates increase on API calls it is difficult to identify the calling script.
Currently we need to go through the log files of all scripts to find which ones are failing or too chatty or implement wrong backoff/retry strategies.
Describe the solution you'd like
We would like to have the possibility to add a (set of) custom header(s) to the Dynatrace/Http_Client object(s)
e.g.: "x-python-automation: my-acme-script.py"
Describe alternatives you've considered
Alternatively a custom id could be added to the user-agent header, but I think that's not a huge difference in implementation to do that.

This might be a bit unusual but I think it should be trivial to let you specify a list of headers to add to all the requests it makes. I'll review to be sure and if so add this in.


Make VectorizeMMT4D generate "better" IR not involving 4D->2D vector.shape_cast

LGTM, it looks like it would easily fit as a "decomposition pattern" in core: https://reviews.llvm.org/D113907

Thanks for the review, and great to hear about the interest in having this pattern in core -- let's have this discussion soon!


RSpec/FactoryBot/AttributeDefinedStatically confusing autocorrect for here documents

FactoryBot.define do
  factory :something do
    text <<~EOF
            Some long
            Multiline text
    EOF
  end
end

Gets corrected to
FactoryBot.define do
  factory :something do
    text { <<~EOF }
            Some long
            Multiline text
    EOF
  end
end

This won't be a syntax issue either because  } is now taken as part of the document.

Is it an assumption? Can you please post the error?
What version of Ruby are you using?
 ruby -cw 1.rb
Syntax OK

$ ruby-parse 1.rb

(block
  (send
    (const nil :FactoryBot) :define)
  (args)
  (block
    (send nil :factory
      (sym :something))
    (args)
    (block
      (send nil :text)
      (args)
      (dstr
        (str "Some long\n")
        (str "Multiline text\n")))))

Simple check:
# 2.rb
s = 2.times.map { <<~TEXT }
  hello
  world
TEXT
puts s

$ ruby 2.rb
hello
world
hello
world

There's no assumption, please check the provided example carefully
There's no error. The correction puts a } in the here doc.
text { <<~EOF }
1.18.3 (using Parser <IP_ADDRESS>, rubocop-ast 1.7.0, running on ruby 2.6.6 x86_64-linux)
  - rubocop-rails 2.11.3
  - rubocop-rspec 2.4.0

Ruby 2.6.6
TargetRubyVersion is set to 2.6

It's not a mistake, it's Ruby syntax, even though it's weird at times. Not the weirdest to my memory.
foo(1, 2, <<~TEXT, 3) { |args| puts args }
  text goes here
TEXT

is valid, too.

This won't be a syntax issue either because } is now taken as part of the document.

This statement is false.

😮 That is my bad then, thanks for clarifying.
Still, I think it'd be much cleaner and less confusing to autocorrect to
FactoryBot.define do
  factory :something do
    text do
      <<~EOF
        Some long
        Multiline text
      EOF
    end
  end
end

Changed the title from "wrong" to "confusing" in case you'd keep a feature request open for this.

This is something I suggest you to play around with.
https://whitequark.org/blog/2013/04/26/lets-play-with-ruby-code/ is a good start.
Since Ruby's syntax has this concept of "identical syntax", two pieces of code that produce the same AST, the reverse transformation of AST to code can't retain some original touches.
Chances are the "styling" is tunable.


vagrant is suddenly prompting for a password

I ran vagrant box update and now this happens:
$ vagrant up
Bringing machine 'default' up with 'virtualbox' provider...
==> default: Removing hosts
==> default: Checking if box 'ubuntu/trusty64' is up to date...
==> default: VirtualBox VM is already running.
rwaldron at nova in ~/clonez/t2-compiler on master
$ vagrant ssh-config
Host default
  HostName <IP_ADDRESS>
  User vagrant
  Port 2222
  UserKnownHostsFile /dev/null
  StrictHostKeyChecking no
  PasswordAuthentication no
  IdentityFile /Users/rwaldron/clonez/t2-compiler/.vagrant/machines/default/virtualbox/private_key
  IdentitiesOnly yes
  LogLevel FATAL

rwaldron at nova in ~/clonez/t2-compiler on master
$ vagrant ssh
<EMAIL_ADDRESS>password:

Typed vagrant and it works, but I wonder why the change?

Turns out that only let's me through the door, once in:
$ ./compile.sh libjpeg
downloading package...
<EMAIL_ADDRESS>password:
total 12
drwxrwxr-x 3 vagrant vagrant 4096 Feb  3 19:32 .
drwxr-xr-x 3 vagrant root    4096 Feb  3 19:32 ..
drwxrwxr-x 2 vagrant vagrant 4096 Feb  3 19:32 build
npm ERR! Linux 3.13.0-65-generic
npm ERR! argv "/usr/bin/nodejs" "/usr/bin/npm" "pack" "libjpeg"
npm ERR! node v4.2.6
npm ERR! npm  v2.14.12
npm ERR! path /home/vagrant/.npm
npm ERR! code EACCES
npm ERR! errno -13
npm ERR! syscall mkdir

npm ERR! Error: EACCES: permission denied, mkdir '/home/vagrant/.npm'
npm ERR!     at Error (native)
npm ERR!  { [Error: EACCES: permission denied, mkdir '/home/vagrant/.npm']
npm ERR!   errno: -13,
npm ERR!   code: 'EACCES',
npm ERR!   syscall: 'mkdir',
npm ERR!   path: '/home/vagrant/.npm' }
npm ERR!
npm ERR! Please try running this command again as root/Administrator.

npm ERR! Please include the following file with any support request:
npm ERR!     /work/binary-module/npm-debug.log
tar: *.tgz: Cannot open: No such file or directory
tar: Error is not recoverable: exiting now
rm: cannot remove ‘*.tgz’: No such file or directory
Connection to <IP_ADDRESS> closed.


Fix redirect on folder rename

Seems like a regression where renaming a folder was not redirecting properly.

Good point. Have updated to use removeLeadingSlash. Lets revisit this and make it consistant


Geovista 0.2.0 with Conda install can't be launched as CLI app on Windows

🐛 Bug Report
Cannot run the Geovista CLI script on WIndows - not with the Conda prompt or from Conda Powershell
How to Reproduce
Create a Conda environment on WIndows with Geovista 0.2.0 then from any standard Windows shell attempt to run the Geovista script
Expected Behaviour
I expected the Geovista CLI to execute
Screenshots
Here is a screenshot of the standard Conda command line attempt:

Here is a screenshot of the Conda Powershell which attempts to find a Windows application to open the command line shell script:

Environment

OS & Version: Windows 11 Pro Version 10.0.22621 Build 22621
GeoVista Version: 0.2.0 (installed from conda-forge)

Additional Context

Click to expand this section...
On Windows most Conda packages that have a CLI script appear to have a corresponding executable file for running that script from command line. I'm afraid I don't know how those executables are created but that appears to be the standard way to launch a Python CLI script. See screenshot below:

I don't think this bash like shell script will work on Windows (it probably would if I ran from WSL but I don't want to resort to that).

@owenlamont Awesome, thanks for taking the time to raise this issue.
I must confess, at the moment I'm just focused on building and testing for linux, but I'll see if I can replicate this issue on a win environment :+1:

@owenlamont Hmmm okay... an easy thing for me to try is to see whether the issue you're experiencing is related specifically to the conda installation on windows.
I don't have explicit entry points defined in the geovista conda meta.yaml recipe. I was assuming the setuptools would just work it's magic across platforms, but perhaps that's a necessary step to take to ensure that the geovista entry point is registered correctly.
I'm going to bump the build of geovista in the conda-forge channel with a simple change to the meta.yaml, and we'll quickly see whether that makes a difference.
I'll ping you here when the new build of geovista is available. Would you be willing to install and test when it's available?

Also, if you have time, would you mind trying the following...
Create a new conda environment with just python and pip on Windows i.e.,
conda create -n testenv -c conda-forge python pip
then
conda activate testenv
then
pip install geovista
Do you see the same problem with the geovista CLI when installed directly with conda ?

@owenlamont I'm just rebuilding geovista on the conda-forge channel now and adding explicit entry_points to the package recipe.
I'll give you the heads-up when the re-build of 0.2.0 is available.
If you could then rinse and repeat by using conda to install it and call the CLI on Windows, and feedback, then that would be awesome 👍

See https://github.com/conda-forge/geovista-feedstock/pull/8

Ahhh there appears to be issues on conda-forge atm, see https://conda-forge.org/status/
The re-build may have to wait a wee bit until the conda-forge infra-structure is all operational again

I did try pip install geovista 0.2.0 into a conda environment and that does run okay as a CLI

So I check my Scripts path and the pip installed geovista did create an executable:

conda install of geovista 0.1.4 also had the same issue - I can see your new build of geovista 0.2 on conda-forge. I have to get mamba to update is cache before it sees it, I'll see if I can figure out how to do that.

Tested, thanks the new build resolves this issue. Conda install of Geovista creates a executable file in the Scripts directory the same as the pip install:

Yup, you're good to roll ...

Yeah that was the build I tested - just realised I needed to mamba clean -i to clear its index cache

I'll close this issue, thanks for resolving it so fast.

Pleasure. Thanks for feeding back and testing. Totally priceless 🍻

@owenlamont BTW ... just out of curiosity, what's your use-case for geovista?

I was interested in geospatial visualisation (I worked/work in industries for renewable energy and currently flood mapping) and I just like 3D rendering and PyVista. I was thinking of creating a geo-specialised version of PyVista before I discovered you'd already thought of that.

To answer your question more specifically rendering digital elevation maps is interesting, and since I'm currently interested in flood impacts being able to super-impose elevation maps of flood water levels over terrain and especially show buildings and other infrastructure on the terrain would be super relevant - although maybe outside the scope of what geovista is intended for. I'm still exploring the best (preferably Python based) technologies for doing that.

If you've got specific feature requests then I'd be keen to know. They might align with what other early adopter users want, and it'll help me prioritise banking features that are genuinely useful 👍
It's early days for geovista, but it's certainly an exciting space and I think there's huge potential.
Thanks again 😄

@all-contributors please add @owenlamont for bug and userTesting


Add our own config files

This is to make our configs cross-editor. To keep backward compatibility, configs from VS Code will still be used when the user is using VS Code as their editor.

A new config file can be put at the root of the project (in VS Code this is the first workspace root folder in the workspace). It can have any of the four names:

.spyglassconfig
.spyglassconfig.json
.spyglassrc
.spyglassrc.json


Storage Python 2019-04-01

Automation for azure-sdk-for-go

Automation for azure-sdk-for-ruby

Automation for azure-sdk-for-js

Automation for azure-sdk-for-java

Automation for azure-sdk-for-python

Can one of the admins verify this patch?


Terminology around token/denomination/ticker/symbol/decimals

From slack:

what are the correct terms for groups of these tokens: EUROe, TEST, ERC-20 EUROe (0x8A4826071983655805bF4f29828577Cd6b1aC0cB)?
is EUROe: fees token?
is TEST: consensus token?
are [EUROe, TEST]: native tokens? native denominations? paratime tokens? paratime balances?
is there a term non-fee tokens [TEST, [...]]?
are [EUROe, ERC-20 EUROe]: both ERC-20 tokens? (i.e. is EUROe also ERC-20 internally?)

Jernej:

EUROe and TEST are both exactly the same, they are sdk denominations; each of those can either be or not be a fee token. non-sdk denominations cannot be fee tokens.
EUROe is also the native token inside the EVM (because EVM only supports a single native token). any sdk denomination can be a native token, but once set, it is not possible to change it without possibly breaking all smart contracts.
ERC-20 EUROe I assume is just a deployed ERC-20 contract with the given name, nothing special.
in the future it will be possible to map any sdk denomination to an ERC-20 as well (to special fixed addresses), but this is currently not the case.

some code:
https://github.com/oasisprotocol/explorer/blob/b45547a7e2ebb88d7f8dc929ddd05863b5b56cbf/src/types/ticker.ts#L4-L14
https://github.com/oasisprotocol/explorer/blob/b45547a7e2ebb88d7f8dc929ddd05863b5b56cbf/src/config.ts#L22-L27
https://github.com/oasisprotocol/explorer/blob/b45547a7e2ebb88d7f8dc929ddd05863b5b56cbf/src/app/pages/ParatimeDashboardPage/ParaTimeSnapshot.tsx#L23-L24
https://github.com/oasisprotocol/explorer/blob/b45547a7e2ebb88d7f8dc929ddd05863b5b56cbf/src/app/components/Balance/hooks.ts#L53
https://github.com/oasisprotocol/explorer/blob/b45547a7e2ebb88d7f8dc929ddd05863b5b56cbf/src/app/components/Balance/hooks.ts#L7
https://github.com/oasisprotocol/explorer/blob/b45547a7e2ebb88d7f8dc929ddd05863b5b56cbf/src/app/components/RoundedBalance/__tests__/index.test.tsx#L40
https://github.com/oasisprotocol/explorer/blob/b45547a7e2ebb88d7f8dc929ddd05863b5b56cbf/src/app/utils/getRPCAccountBalances.ts#L37


fix error in association type in the solution extend --add-ecpList …

…command
Description
Fixes a likely copy/paste error in the type of association followed for DashUI ecpList objects being added to the project with a solution extend --add-ecpList command
Type of Change

[X] Bug Fix
[ ] New Feature
[ ] Breaking Change
[ ] Refactor
[ ] Documentation
[ ] Other (please describe)

Checklist

[X] I have read the contributing guidelines
[X] Existing issues have been referenced (where applicable)
[X] I have verified this change is not present in other open pull requests
[X] Functionality is documented
[X] All code style checks pass
[ ] New code contribution is covered by automated tests
[X] All new and existing tests pass

an improved version of this change was merged elsewhere, in https://github.com/cisco-open/fsoc/commit/de356eb3d2d49253a316e62134b2a8732cd205e8


Add support for the V4 API model

Currently the getStatus() method never returns Updating in the dashboard, since the device.status is never Downloading in the MC era.
Only the image installs get the Downloading status.
Resolves: #9
Resolves: #10
Change-type: major
See: https://www.flowdock.com/app/rulemotion/resin-frontend/threads/DW6Dm0QcS27o3TJbVivqzkeiaMX
Signed-off-by: Thodoris Greasidis<EMAIL_ADDRESS>

@resin-ci retest

@resin-ci retest

@resin-ci retest

@resin-ci retest

@resin-ci retest


Added expectations to server request test cases

Description

Added XCTestExpectation to request handler. Changed how server tests is waiting for requests to finish.
Motivation and Context

IBM-Swift/Kitura#86
How Has This Been Tested?

Checklist:

[x] I have submitted a CLA form
[ ] If applicable, I have updated the documentation accordingly.
[] If applicable, I have added tests to cover my changes.

You'll need this to pass on Linux as well. Check out this PR for the API for expectations on Linux: https://github.com/apple/swift-corelibs-xctest/pull/43.  You can use #if os(Linux) to run system dependent code.

This one fixed it. It's actually sort of strange to see different API for the same library.

This is great! Everything is working fine. We can merge this is in right now.

It's actually sort of strange to see different API for the same library.

To clarify a bit here: swift-corelibs-xctest provides an API that matches the Swift 3 import rules for Objective-C. You're seeing two different APIs because the version of Swift you use on OS X is a version lower than 3.
Once you've updated to Swift 3 (I assume you're waiting for an official Swift 3 release, which I think is a good idea), you'll be able to use the exact same API across all platforms. In the meantime, sorry for the inconvenience!
I wonder if we can provide both APIs in the meantime, to make it easier for people working with corelibs-xctest now? /cc @mike-ferris-apple @briancroom

I created SR-1215 to track this issue. Thanks! Also, feel free to ping me or create a JIRA task for any other feedback you have on swift-corelibs-xctest. 👍

@modocache It looks to me like the issue here isn't actually trying to support Swift 2.2 and 3, but rather that the most recent Swift development snapshot doesn't include the corelibs-xctest changes (from https://github.com/apple/swift-corelibs-xctest/pull/88) required to make its API match the Swift 3 import rules. So this PR needed to use the Swift 2.2 API on Linux and the 3 API on Darwin. Once the next snapshot goes live, things should be unified again.
That being said, there may still be a case for corelibs-xctest exposing an API compatible with the 2.2 naming, but I would want to see a concrete case needing it, and this isn't it, I think.


[Master] Add interfaces to get guest power state from host

Get the guest power state from host  directly is needed by CIC onboarding.

@SeanHQF please help review

@jichenjc @bjhuangr please help review


Continuous Integration Features

This pull request adds some features that are useful for integrating our build system with Continuous Integration tools. These features include:

Provide a toolchain filter for build_release script to allow for easy compilation on multiple platforms (ex.  IAR is not supported on Linux, so this is not included when building on Linux)
Create HTML build report specifically for mbed library and tests (templates built with jinja2)
Reorganize test building by moving the building of required libraries (RTOS, Ethernet, etc) to the up front, before any tests are built. This removes redundancy and improves reporting.

I have been testing this on my own VMs and everything seems to be running smoothly. Let me know if you have any thoughts on how things have been organized.

Travis failed with an error as it installed only colorama and pretty table.
ImportError: No module named jinja2

I realize the irony in saying I'm not sure where to fix this, given that Travis is a Continuous Integration service :)
Is there a script that manages the pip module installation? Or does it run the setup.py in the repository root?

@bridadan  :-))))) Here .travis.yaml file:
---
python:
  - "2.7"
script: "python workspace_tools/build_travis.py"
install:
  - "sudo $TRAVIS_BUILD_DIR/travis/install_dependencies.sh > /dev/null"
  - sudo pip install colorama
  - sudo pip install prettytable

Add there jinja2

Ah, don't know how I missed it :P I pushed the changes and it looks like it's passing

OK great :)

I run one jenkins job with build_release script from this PR, all ok. Thanks


Checklist for 2022.04

Original announcement
Additions:

[ ] Make previous values in REPL accessible with $*N -190e303d-1292357d
[ ] Add INSIDE_EMACS environment variable for better embedding of the REPL
inside Emacs -76035de0
[ ] Add an IO::Path.dir-with-entries method, returning a Bool indicating
if the directory has any entries (without danger of resource leaking)
-8a1e7788
[ ] Implement will complain trait -a203a5af-2c2c5306-beeb9ffc-2baf8bc6

Removals:

[x] Remove the $?COMPILATION-ID constant as it was not documented and not
tested -b2a8bfc9;

(Compilation ID already not mentioned in docs)

No separate section for REPL, yes.


Update references to the new API in EF 9 with links to the API documentation

Issue or suggestion
Depends on the API documentation being published first

Add to our release checklist (post-release steps)? Also, we need to update the link to the API docs from the conceptual TOC as well.

This can be closed right? @AndriySvyryd

No. Someone still needs to go through and add links to the API docs from:

https://learn.microsoft.com/ef/core/what-is-new/ef-core-9.0/whatsnew
https://learn.microsoft.com/ef/core/what-is-new/ef-core-9.0/breaking-changes
https://learn.microsoft.com/ef/core/providers/cosmos/querying
https://learn.microsoft.com/ef/core/modeling/data-seeding


cannot read property 'trackScreenView' of undefined

React-Native: 0.42.3
react-native-google-analytics-bridge: 5.0.1
Hi,
I am using the module on both iOS and Android. iOS works but Android always throws an error whenever I attempt to track anything.
My code is simply
import { GoogleAnalyticsTracker } from 'react-native-google-analytics-bridge'

const tracker = new GoogleAnalyticsTracker('UA-XXXXXXXX-1')
tracker.trackScreenView('test')

I have installed all required SDKs/Tools through Android Studio and ran "rnpm link react-native-google-analytics-bridge". Regardless though _NativeBridges.GoogleAnalyticsBridge remains undefined. I have cleaned and rebuilt the project with no results. I have checked through the readme on the repo and cannot see any missed steps, could you recommend anything else?

Hi @retailos, this question comes up all the time, and most of the time the module has been incorrectly linked. See manual installation for details on how things should have been linked. By the way rnpm is deprecated, I recommend using react-native link.

@cbrevik Thanks for the tip I have checked through the manual installation again and can see the original rnpm link did not complete the MainApplication.java step. On completion it is all working.


DuckDuckGo - search

It seems supported (as per the code), but I can't find anything in the documentation. Is there a way to test it?
API: https://pypi.org/project/duckduckgo-search/

Thank you. We will update the tool documentation soon. Meanwhile, you can test using /metagpt/tools/search_engine_ddg.py.


feat: only allow timestamp type as time index

I hereby agree to the terms of the GreptimeDB CLA
What's changed and what's your intention?
Only allow timestamp type as time index.
Checklist

[ ]  I have written the necessary rustdoc comments.
[x]  I have added the necessary unit tests and integration tests.

Refer to a related PR or issue link (optional)
#1415

@MichaelScofield PTAL


[WIP] Add tooling to import database backup in lando

closes #1234

For anyone who would like to test this. I have a  marc_liberation.dump backup from production in bibdata1. You would need to pull the backup in your local and edit it as described https://github.com/pulibrary/bibdata#database-configuration
vi marc_liberation.dump :%s/marc_liberation_prod/marc_liberation_dev/g :wq so that the db name in the file changes from marc_liberation_prod to marc_liberation_dev.
Then I use lando db-import marc_liberation.dump. I can see the script loading the backup but it creates an empty database with name database.

closing this for now.


How to override ShowingRecords class template in gridview?

<span class="showing_records">
Showing records <?= $from ?>—<?= $to ?> of <?= $total ?>
</span>

check this issue #40


Specify SendMode

I personally had an issue with Error: value is out of range for 8 bits. Got undefined until sendMode property was specified

Thank you for this PR. The issue you have uncovered is actually a bug in the latest release of ton and ton-core libraries. It was resolved there so there is no need to fix the tutorial.


Flexible frontpage logic

Description

add homepage templates
Add components (w/documentation block)

all cards variants
Notification

add website settings

frontpage settings to add featured content

Add widgets & sidebar

Columns containers & single columns widget to build flexible layouts
Card link widget
Notification widget

Checklist

[x] My pull request has a descriptive title (not a vague title like Update index.md).
[x] My pull request targets the master branch of the repository.
[x] My commit messages follow best practices.
[x] My code follows the established code style of the repository.
[ ] I added tests for the changes I made (if applicable).
[ ] I added or updated documentation (if applicable).
[x] I tried running the project locally and verified that there are no
visible errors.

Developer Certificate of Origin

Developer Certificate of Origin
Developer Certificate of Origin
Version 1.1

Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
1 Letterman Drive
Suite D4700
San Francisco, CA, 94129

Everyone is permitted to copy and distribute verbatim copies of this
license document, but changing it is not allowed.

Developer's Certificate of Origin 1.1

By making a contribution to this project, I certify that:

(a) The contribution was created in whole or in part by me and I
    have the right to submit it under the open source license
    indicated in the file; or

(b) The contribution is based upon previous work that, to the best
    of my knowledge, is covered under an appropriate open source
    license and I have the right under that license to submit that
    work with modifications, whether created in whole or in part
    by me, under the same open source license (unless I am
    permitted to submit under a different license), as indicated
    in the file; or

(c) The contribution was provided directly to me by some other
    person who certified (a), (b) or (c) and I have not modified
    it.

(d) I understand and agree that this project and the contribution
    are public and that a record of the contribution (including all
    personal information I submit with it, including my sign-off) is
    maintained indefinitely and may be redistributed consistent with
    this project or the open source license(s) involved.

I trusted phpcbf to indentations, but it seems that doesn't work very well with that kind of syntax which I found more readable.
Thanks for your review!


after the update, the underscore is not displayed in the vscode terminal

Does this issue occur when all extensions are disabled?: Yes

VS Code Version:
Version: 1.89.0
Commit: b58957e67ee1e712cebf466b995adf4c5307b2bd
Date: 2024-05-01T02:08:25.066Z
Electron: 28.2.8
ElectronBuildId: 27744544
Chromium: 120.0.6099.291
Node.js: 18.18.2
V8: 12.0.267.19-electron.0
OS: Linux x64 6.5.0-28-generic snap
OS Version:  Linux nb-X 6.5.0-28-generic #29~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Apr  4 14:39:20 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

Steps to Reproduce:

open vscode terminal
send mkdir test_dir

_ isn't displayed in some cases like pwd or git checkout -b test_branch

it not displayed while typing, but if ctrl+c, ctrl+v it shows.

does changing terminal.integrated.gpuAcceleration help?

does changing terminal.integrated.gpuAcceleration help?

It helps when  set "canvas", previous setting was "auto"

I had this same problem when updating to the new version.  Setting terminal.integrated.gpuAcceleration to "canvas" helped.

Same issue, Linux.
setting terminal.integrated.gpuAcceleration to anything other than "off" fixed it. Was "auto", but now when I updated this setting once, I could not reproduce the issue with "auto", just with "off"

Looks like another regression. Same issue #123077 and #35901 before that. Changing font size fixes the display, though then you have to use a font size you did not want.

same here, debian linux 12, "off" uses font variant without underscore visible, any other setting works fine (but also uses little bit different font, change is visible during changing the setting)

Just updated and started having this same issue. If set to canvas it works, anything else don't
Ubuntu Noble

What has worked for me (each works separately):

Changing the font size to 13 or 15 (underscore is invisible on 14)
Changing the Terminal Integrated GPU Acceleration to on or canvas
Changing the Terminal Integrated Line Height to anything above 1.0625 (that seems to be the cutoff)
Changing the Terminal Font Family (every other one I tried seemed to work)
Changing the Terminal Integrated Font Weight to anything above 550 (close to bold, seems to be the cutoff)

I'm sticking with the Terminal Integrated GPU Acceleration to on right now, as it changes the least about my terminal's view.

This is happening is previously your setup would use the canvas renderer, which was removed as an option for auto in v1.89 and all together in v1.90. The canvas renderer includes some smarts about shifting underscores upwards when they sit particularly low which seems to be the case for some default fonts on Linux. This isn't actually a regression (https://github.com/xtermjs/xterm.js/issues/4067), it's just being hit by more people since the canvas renderer is gone.
Since these issues seem restricted to Linux, I'm thinking for the upcoming release I'll force lineHeight to be 1.1 by default on Linux. Then in the next release come up with a more robust solution for these fonts in https://github.com/xtermjs/xterm.js/issues/4067

Recommended workarounds:

Set "terminal.integrated.gpuAcceleration": "on" (this might not work)
Set "terminal.integrated.lineHeight": 1.1
Change "terminal.integrated.fontFamily"

I'm still seeing this issue in 1.90.2. The 1.1 workaround doesn't cut it for me. It has to be at least 1.15 for the underscore to be visible.

https://github.com/xtermjs/xterm.js/issues/5240 and https://github.com/xtermjs/xterm.js/issues/4067 are tracking trying to remove the overflow CSS rule to workaround this.

/duplicate https://github.com/microsoft/vscode/issues/159110


hello can use sphinx_rtd_theme  for mkdocs theme?

hello can use sphinx_rtd_theme  for mkdocs theme?

Mkdocs maintains a port of the theme https://www.mkdocs.org/#great-themes-available
https://github.com/mkdocs/mkdocs/tree/master/mkdocs/themes/readthedocs


fix: upgrade manifest version and update background script code according to the manifest version v3

Migrated manifest v2 to v3
Modified some code according to v3
Add a simpler version of the executed background script

This is related to #22