Call GetEventLog before ExitBootServices

If we are not able to retrieve the TPM event logs from the ACPI table, check the EFI configuration table (Linux-specific GUID).

The format version of the log is now returned by the provider function.

Signed-off-by Thiebaud Weksteen <[email protected]>

With TPM 1.2, the ACPI table ("TCPA") has two fields to recover the Event Log Area (LAML and LASA). These logs are useful to understand and rebuild the final values of PCRs.

With TPM 2.0, the ACPI table ("TPM2") does not contain these fields anymore. The recommended method is now to call the GetEventLog EFI protocol before ExitBootServices.

Implement this method within the EFI stub and create a copy of the logs for the TPM device using a Linux-specific EFI configuration table (LINUX_EFI_TPM_EVENT_LOG). This will create /sys/kernel/security/tpm0/binary_bios_measurements for TPM 2.0 devices (similarly to the current behaviour for TPM 1.2 devices).

Two formats for the log entries exist: TPM 1.2 (SHA1) and TPM 2.0 (Crypto Agile). This patch set only retrieves the first type of logs. The second type will be implemented in a subsequent patch set.

According to the specifications[1], once GetEventLog has been called, future events shall be stored in a separate EFI configuration table (EFI_TCG2_FINAL_EVENTS_TABLE). Events stored in this table are not processed in this patch set as they are stored in the Crypto Agile format. These could eventually be merged with the new table for a unified view of the logs from userspace.

[1] TCG EFI Protocol Specification, Revision 00.13, March 30, 2016
https://trustedcomputinggroup.org/wp-content/uploads/EFI-Protocol-Specification-rev13-160330final.pdf

-------------------------------------------------------------------------------

Patchset Changelog:

Version 3:
- Move event log providers (acpi and of) to tpm_eventlog_*.c
- Move efi changes from PATCH 3 to PATCH 2
- Change return value of tpm_read_log_acpi and tpm_read_log_of
- Change iounmap to memunmap calls
- Use log_tbl as variable name for consistency
- Fix kbuild failures

Version 2:
- Move tpm_eventlog.h to top include directory, add commit for this.
- Use EFI_LOADER_DATA to store the configuration table
- Whitespace and new lines fixes

Thiebaud Weksteen (5):
tpm: move tpm_eventlog.h outside of drivers folder
tpm: rename event log provider files
tpm: add event log format version
efi: call get_event_log before ExitBootServices
tpm: parse TPM event logs based on EFI table

 arch/x86/boot/compressed/eboot.c                   |  1 +
 drivers/char/tpm/Makefile                          |  5 +-
 drivers/char/tpm/tpm-chip.c                        |  3 +-
 drivers/char/tpm/tpm-interface.c                   |  2 +-
 drivers/char/tpm/tpm.h                             | 35 ++++++++--
 drivers/char/tpm/tpm1_eventlog.c                   | 13 +++-
 drivers/char/tpm/tpm2_eventlog.c                   |  2 +-
 .../char/tpm/{tpm_acpi.c => tpm_eventlog_acpi.c}   |  4 +-
 drivers/char/tpm/tpm_eventlog_efi.c                | 66 ++++++++++++++++++
 drivers/char/tpm/{tpm_of.c => tpm_eventlog_of.c}   |  6 +-
 drivers/firmware/efi/Makefile                      |  2 +-
 drivers/firmware/efi/efi.c                         |  4 ++
 drivers/firmware/efi/libstub/Makefile              |  3 +-
 drivers/firmware/efi/libstub/tpm.c                 | 81 ++++++++++++++++++++++
 drivers/firmware/efi/tpm.c                         | 40 +++++++++++

 include/linux/efi.h                                | 46 ++++++++++++
 {drivers/char/tpm => include/linux}/tpm_eventlog.h | 35 +++-------
 17 files changed, 304 insertions(+), 44 deletions(-)
 rename drivers/char/tpm/{tpm_acpi.c => tpm_eventlog_acpi.c} (97%)
 create mode 100644 drivers/char/tpm/tpm_eventlog_efi.c
 rename drivers/char/tpm/{tpm_of.c => tpm_eventlog_of.c} (93%)
 create mode 100644 drivers/firmware/efi/tpm.c
 rename {drivers/char/tpm => include/linux}/tpm_eventlog.h (77%)

Signature · 1 line

2.14.1.821.g8fa685d3b7-goog

Rename the current TPM Event Log provider files (ACPI and OF) for clarity.

Signed-off-by Thiebaud Weksteen <[email protected]>

---
 drivers/char/tpm/Makefile                            | 4 ++--
 drivers/char/tpm/{tpm_acpi.c => tpm_eventlog_acpi.c} | 0
 drivers/char/tpm/{tpm_of.c => tpm_eventlog_of.c}     | 0
 3 files changed, 2 insertions(+), 2 deletions(-)
 rename drivers/char/tpm/{tpm_acpi.c => tpm_eventlog_acpi.c} (100%)
 rename drivers/char/tpm/{tpm_of.c => tpm_eventlog_of.c} (100%)

With TPM 1.2, the ACPI table ("TCPA") has two fields to recover the Event Log Area (LAML and LASA). These logs are useful to understand and rebuild the final values of PCRs.

With TPM 2.0, the ACPI table ("TPM2") does not contain these fields anymore. The recommended method is now to call the GetEventLog EFI protocol before ExitBootServices.

Implement this method within the EFI stub and create a copy of the logs for the TPM device using a Linux-specific EFI configuration table (LINUX_EFI_TPM_EVENT_LOG). This will create /sys/kernel/security/tpm0/binary_bios_measurements for TPM 2.0 devices (similarly to the current behaviour for TPM 1.2 devices).

Two formats for the log entries exist: TPM 1.2 (SHA1) and TPM 2.0 (Crypto Agile). This patch set only retrieves the first type of logs. The second type will be implemented in a subsequent patch set.

According to the specifications[1], once GetEventLog has been called, future events shall be stored in a separate EFI configuration table (EFI_TCG2_FINAL_EVENTS_TABLE). Events stored in this table are not processed in this patch set as they are stored in the Crypto Agile format. These could eventually be merged with the new table for a unified view of the logs from userspace.

[1] TCG EFI Protocol Specification, Revision 00.13, March 30, 2016
https://trustedcomputinggroup.org/wp-content/uploads/EFI-Protocol-Specification-rev13-160330final.pdf

-------------------------------------------------------------------------------

Patchset Changelog:

Version 3:
- Move event log providers (acpi and of) to tpm_eventlog_*.c
- Move efi changes from PATCH 3 to PATCH 2
- Change return value of tpm_read_log_acpi and tpm_read_log_of
- Change iounmap to memunmap calls
- Use log_tbl as variable name for consistency
- Fix kbuild failures

With TPM 2.0 specification, the event logs may only be accessible by calling an EFI Boot Service. Modify the EFI stub to copy the log area to a new Linux-specific EFI configuration table so it remains accessible once booted.

When calling this service, it is possible to specify the expected format of the logs: TPM 1.2 (SHA1) or TPM 2.0 ("Crypto Agile"). For now, only the first format is retrieved.

Signed-off-by Thiebaud Weksteen <[email protected]>

Quoted 10 lines · Thiebaud Weksteen

With TPM 2.0 specification, the event logs may only be accessible by calling an EFI Boot Service. Modify the EFI stub to copy the log area to a new Linux-specific EFI configuration table so it remains accessible once booted.

When calling this service, it is possible to specify the expected format of the logs: TPM 1.2 (SHA1) or TPM 2.0 ("Crypto Agile"). For now, only the first format is retrieved.

Signed-off-by Thiebaud Weksteen <[email protected]>

Does not apply:

Applying: tpm: move tpm_eventlog.h outside of drivers folder
Applying: tpm: rename event log provider files
Applying: tpm: add event log format version
Applying: efi: call get_event_log before ExitBootServices
error: sha1 information is lacking or useless (drivers/firmware/efi/efi.c).
error: could not build fake ancestor
Patch failed at 0004 efi: call get_event_log before ExitBootServices The copy of the patch that failed is found in: .git/rebase-apply/patch When you have resolved this problem, run "git am --continue". If you prefer to skip this patch, run "git am --skip" instead. To restore the original branch and stop patching, run "git am --abort".

Just rebased my tree to the latest security-next.

/Jarkko

Quoted 26 lines · Jarkko Sakkinen

Quoted 10 lines · Thiebaud Weksteen

With TPM 2.0 specification, the event logs may only be accessible by calling an EFI Boot Service. Modify the EFI stub to copy the log area to a new Linux-specific EFI configuration table so it remains accessible once booted.

When calling this service, it is possible to specify the expected format of the logs: TPM 1.2 (SHA1) or TPM 2.0 ("Crypto Agile"). For now, only the first format is retrieved.

Signed-off-by Thiebaud Weksteen <[email protected]>

Does not apply:

Applying: tpm: move tpm_eventlog.h outside of drivers folder
Applying: tpm: rename event log provider files
Applying: tpm: add event log format version
Applying: efi: call get_event_log before ExitBootServices
error: sha1 information is lacking or useless (drivers/firmware/efi/efi.c).
error: could not build fake ancestor
Patch failed at 0004 efi: call get_event_log before ExitBootServices The copy of the patch that failed is found in: .git/rebase-apply/patch When you have resolved this problem, run "git am --continue". If you prefer to skip this patch, run "git am --skip" instead. To restore the original branch and stop patching, run "git am --abort".

Quoted 1 line

Just rebased my tree to the latest security-next.

It applies fine on security/next-general which is more up-to-date. (security/next does not include ccc829ba3624beb9a703fc995d016b836d9eead8 on which this patch set is based)

Quoted 28 lines · Thiebaud Weksteen

Quoted 26 lines · Jarkko Sakkinen

Quoted 10 lines · Thiebaud Weksteen

With TPM 2.0 specification, the event logs may only be accessible by calling an EFI Boot Service. Modify the EFI stub to copy the log area to a new Linux-specific EFI configuration table so it remains accessible once booted.

When calling this service, it is possible to specify the expected format of the logs: TPM 1.2 (SHA1) or TPM 2.0 ("Crypto Agile"). For now, only the first format is retrieved.

Signed-off-by Thiebaud Weksteen <[email protected]>

Does not apply:

Applying: tpm: move tpm_eventlog.h outside of drivers folder
Applying: tpm: rename event log provider files
Applying: tpm: add event log format version
Applying: efi: call get_event_log before ExitBootServices
error: sha1 information is lacking or useless (drivers/firmware/efi/efi.c).
error: could not build fake ancestor
Patch failed at 0004 efi: call get_event_log before ExitBootServices The copy of the patch that failed is found in: .git/rebase-apply/patch When you have resolved this problem, run "git am --continue". If you prefer to skip this patch, run "git am --skip" instead. To restore the original branch and stop patching, run "git am --abort".

Quoted 6 lines

Quoted 1 line

Just rebased my tree to the latest security-next.

It applies fine on security/next-general which is more up-to-date. (security/next does not include ccc829ba3624beb9a703fc995d016b836d9eead8 on which this patch set is based)

Thanks, my bad, I though that I had it updated.

I'll update my tree and retry.

/Jarkko

Quoted 36 lines · Jarkko Sakkinen

Quoted 28 lines · Thiebaud Weksteen

Quoted 26 lines · Jarkko Sakkinen

Quoted 10 lines · Thiebaud Weksteen

With TPM 2.0 specification, the event logs may only be accessible by calling an EFI Boot Service. Modify the EFI stub to copy the log area to a new Linux-specific EFI configuration table so it remains accessible once booted.

When calling this service, it is possible to specify the expected format of the logs: TPM 1.2 (SHA1) or TPM 2.0 ("Crypto Agile"). For now, only the first format is retrieved.

Signed-off-by Thiebaud Weksteen <[email protected]>

Does not apply:

Applying: tpm: move tpm_eventlog.h outside of drivers folder
Applying: tpm: rename event log provider files
Applying: tpm: add event log format version
Applying: efi: call get_event_log before ExitBootServices
error: sha1 information is lacking or useless (drivers/firmware/efi/efi.c).
error: could not build fake ancestor
Patch failed at 0004 efi: call get_event_log before ExitBootServices The copy of the patch that failed is found in: .git/rebase-apply/patch When you have resolved this problem, run "git am --continue". If you prefer to skip this patch, run "git am --skip" instead. To restore the original branch and stop patching, run "git am --abort".

Quoted 6 lines

Quoted 1 line

Just rebased my tree to the latest security-next.

It applies fine on security/next-general which is more up-to-date. (security/next does not include ccc829ba3624beb9a703fc995d016b836d9eead8 on which this patch set is based)

Quoted 5 lines

Thanks, my bad, I though that I had it updated.

I'll update my tree and retry.

/Jarkko

My master is up to date with security/next.

Still get the same result:

$ git am -3 ~/Downloads/v3-4-5-efi-call-get_event_log-before-ExitBootServices.patch
Applying: efi: call get_event_log before ExitBootServices
error: sha1 information is lacking or useless (drivers/firmware/efi/efi.c).
error: could not build fake ancestor
Patch failed at 0001 efi: call get_event_log before ExitBootServices
The copy of the patch that failed is found in: .git/rebase-apply/patch
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

Maybe you have some other trees fetched in your local GIT so that it finds the ancestors? Anyway, cannot test this at this point.

/Jarkko

Quoted 36 lines · Jarkko Sakkinen

Quoted 28 lines · Thiebaud Weksteen

Quoted 26 lines · Jarkko Sakkinen

Quoted 10 lines · Thiebaud Weksteen

With TPM 2.0 specification, the event logs may only be accessible by calling an EFI Boot Service. Modify the EFI stub to copy the log area to a new Linux-specific EFI configuration table so it remains accessible once booted.

When calling this service, it is possible to specify the expected format of the logs: TPM 1.2 (SHA1) or TPM 2.0 ("Crypto Agile"). For now, only the first format is retrieved.

Signed-off-by Thiebaud Weksteen <[email protected]>

Does not apply:

Applying: tpm: move tpm_eventlog.h outside of drivers folder
Applying: tpm: rename event log provider files
Applying: tpm: add event log format version
Applying: efi: call get_event_log before ExitBootServices
error: sha1 information is lacking or useless (drivers/firmware/efi/efi.c).
error: could not build fake ancestor
Patch failed at 0004 efi: call get_event_log before ExitBootServices The copy of the patch that failed is found in: .git/rebase-apply/patch When you have resolved this problem, run "git am --continue". If you prefer to skip this patch, run "git am --skip" instead. To restore the original branch and stop patching, run "git am --abort".

Quoted 6 lines

Quoted 1 line

Just rebased my tree to the latest security-next.

It applies fine on security/next-general which is more up-to-date. (security/next does not include ccc829ba3624beb9a703fc995d016b836d9eead8 on which this patch set is based)

Quoted 5 lines

Thanks, my bad, I though that I had it updated.

I'll update my tree and retry.

/Jarkko

My master is up to date with security/next.

Still get the same result:

$ git am -3 ~/Downloads/v3-4-5-efi-call-get_event_log-before-ExitBootServices.patch
Applying: efi: call get_event_log before ExitBootServices
error: sha1 information is lacking or useless (drivers/firmware/efi/efi.c).
error: could not build fake ancestor
Patch failed at 0001 efi: call get_event_log before ExitBootServices
The copy of the patch that failed is found in: .git/rebase-apply/patch
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

Maybe you have some other trees fetched in your local GIT so that it finds the ancestors? Anyway, cannot test this at this point.

/Jarkko

Quoted 57 lines · Jarkko Sakkinen

Quoted 36 lines · Jarkko Sakkinen

Quoted 28 lines · Thiebaud Weksteen

Quoted 26 lines · Jarkko Sakkinen

Quoted 10 lines · Thiebaud Weksteen

With TPM 2.0 specification, the event logs may only be accessible by calling an EFI Boot Service. Modify the EFI stub to copy the log area to a new Linux-specific EFI configuration table so it remains accessible once booted.

When calling this service, it is possible to specify the expected format of the logs: TPM 1.2 (SHA1) or TPM 2.0 ("Crypto Agile"). For now, only the first format is retrieved.

Signed-off-by Thiebaud Weksteen <[email protected]>

Does not apply:

Applying: tpm: move tpm_eventlog.h outside of drivers folder
Applying: tpm: rename event log provider files
Applying: tpm: add event log format version
Applying: efi: call get_event_log before ExitBootServices
error: sha1 information is lacking or useless (drivers/firmware/efi/efi.c).
error: could not build fake ancestor
Patch failed at 0004 efi: call get_event_log before ExitBootServices The copy of the patch that failed is found in: .git/rebase-apply/patch When you have resolved this problem, run "git am --continue". If you prefer to skip this patch, run "git am --skip" instead. To restore the original branch and stop patching, run "git am --abort".

Quoted 6 lines

Quoted 1 line

Just rebased my tree to the latest security-next.

It applies fine on security/next-general which is more up-to-date. (security/next does not include ccc829ba3624beb9a703fc995d016b836d9eead8 on which this patch set is based)

Quoted 5 lines

Thanks, my bad, I though that I had it updated.

I'll update my tree and retry.

/Jarkko

My master is up to date with security/next.

Still get the same result:

$ git am -3 ~/Downloads/v3-4-5-efi-call-get_event_log-before-ExitBootServices.patch
Applying: efi: call get_event_log before ExitBootServices
error: sha1 information is lacking or useless (drivers/firmware/efi/efi.c).
error: could not build fake ancestor
Patch failed at 0001 efi: call get_event_log before ExitBootServices
The copy of the patch that failed is found in: .git/rebase-apply/patch
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

Quoted 4 lines

Maybe you have some other trees fetched in your local GIT so that it finds the ancestors? Anyway, cannot test this at this point.

/Jarkko

The security/next branch still does not contain the commit I mentioned (ccc829ba3624beb9a703fc995d016b836d9eead8), which is already part of torvalds/master now.

 $ git branch -a --contains ccc829ba3624beb9a703fc995d016b836d9eead8
  efi_tpm2_eventlog
  master
  remotes/linux-next/akpm
  remotes/linux-next/akpm-base
  remotes/linux-next/master
  remotes/linux-next/stable
  remotes/security/fixes-v4.14-rc3
  remotes/security/fixes-v4.14-rc4
  remotes/security/next-general
  remotes/security/next-testing
  remotes/torvalds/master

Is there any reason why you are trying to merge on that specific branch and not next-general or next-testing? Would you know the purpose of all these next-* branches?

Thanks,
Thiebaud

The way I've agreed with James Morris to have my tree is to be rooted to security trees next branch.

James, what actions should we take?

Quoted 4 lines · Jarkko Sakkinen

The way I've agreed with James Morris to have my tree is to be rooted to security trees next branch.

James, what actions should we take?

This process has changed recently -- I posted to lsm but forgot to post to linux-integrity.

http://kernsec.org/pipermail/linux-security-module-archive/2017-September/003356.html

Summary: please track the next-general branch in my tree for your development, it replaces 'next'.

- James

Signature · 2 lines

James Morris
<[email protected]>

Quoted 10 lines · James Morris

Quoted 4 lines · Jarkko Sakkinen

The way I've agreed with James Morris to have my tree is to be rooted to security trees next branch.

James, what actions should we take?

This process has changed recently -- I posted to lsm but forgot to post to linux-integrity.

Quoted 10 lines

http://kernsec.org/pipermail/linux-security-module-archive/2017-September/003356.html

Summary: please track the next-general branch in my tree for your development, it replaces 'next'.

- James

Signature · 2 lines

James Morris
<jmorris-gx6/[email protected]>

Ah I'm subscribed to that list but lately been busy getting a huge patch set to platform-driver-x86 [1] for review, which has prioritized out reading much else than linux-integrity.

Thank you. I'll retry the patches tomorrow.

/Jarkko

Quoted 26 lines · Jarkko Sakkinen

Quoted 10 lines · James Morris

Quoted 4 lines · Jarkko Sakkinen

The way I've agreed with James Morris to have my tree is to be rooted to security trees next branch.

James, what actions should we take?

This process has changed recently -- I posted to lsm but forgot to post to linux-integrity.

Quoted 10 lines

http://kernsec.org/pipermail/linux-security-module-archive/2017-September/003356.html

Summary: please track the next-general branch in my tree for your development, it replaces 'next'.

- James

Signature · 2 lines

James Morris
<[email protected]>

Ah I'm subscribed to that list but lately been busy getting a huge patch set to platform-driver-x86 [1] for review, which has prioritized out reading much else than linux-integrity.

Quoted 3 lines

Thank you. I'll retry the patches tomorrow.

/Jarkko

[1] http://www.spinics.net/lists/platform-driver-x86/msg13260.html

/Jarkko

Now all Thiebaud's patches have been applied to the master of

git://git.infradead.org/users/jjs/linux-tpmdd.git

Testing is still pending.

/Jarkko

On Thu, Oct 12, 2017 at 1:38 PM, Jarkko Sakkinen <jarkko.sakkinen-VuQAYsv1563Yd54FQh9/[email protected]> wrote:

[snip]

Quoted 7 lines

Now all Thiebaud's patches have been applied to the master of

git://git.infradead.org/users/jjs/linux-tpmdd.git

Testing is still pending.

I provided my reviewed and tested by tags for the patches but I noticed that weren't picked. Probably my fault though since I answered to the cover letter instead of the individual patches.

Quoted 1 line

/Jarkko

Best regards,
Javier

Quoted 10 lines · James Morris

Quoted 4 lines · Jarkko Sakkinen

The way I've agreed with James Morris to have my tree is to be rooted to security trees next branch.

James, what actions should we take?

This process has changed recently -- I posted to lsm but forgot to post to linux-integrity.

Quoted 10 lines

http://kernsec.org/pipermail/linux-security-module-archive/2017-September/003356.html

Summary: please track the next-general branch in my tree for your development, it replaces 'next'.

- James

Signature · 2 lines

James Morris
<jmorris-gx6/[email protected]>

Ah I'm subscribed to that list but lately been busy getting a huge patch set to platform-driver-x86 [1] for review, which has prioritized out reading much else than linux-integrity.

Thank you. I'll retry the patches tomorrow.

/Jarkko

Quoted 13 lines · Javier Martinez Canillas

On Thu, Oct 12, 2017 at 1:38 PM, Jarkko Sakkinen
<[email protected]> wrote:

[snip]

Quoted 7 lines

Now all Thiebaud's patches have been applied to the master of

git://git.infradead.org/users/jjs/linux-tpmdd.git

Testing is still pending.

Quoted 8 lines

I provided my reviewed and tested by tags for the patches but I noticed that weren't picked. Probably my fault though since I answered to the cover letter instead of the individual patches.

Quoted 1 line

/Jarkko

Best regards,
Javier

I will add it. The master branch is bleeding edge where tags might be sometimes (*not* usually) missing. The next branch is the one that goes to linux-next.

I'll check all tags from patchwork before moving any of these to next.

/Jarkko

Quoted 22 lines · Jarkko Sakkinen

Quoted 10 lines · James Morris

Quoted 4 lines · Jarkko Sakkinen

The way I've agreed with James Morris to have my tree is to be rooted to security trees next branch.

James, what actions should we take?

This process has changed recently -- I posted to lsm but forgot to post to linux-integrity.

Quoted 10 lines

http://kernsec.org/pipermail/linux-security-module-archive/2017-September/003356.html

Summary: please track the next-general branch in my tree for your development, it replaces 'next'.

- James

Signature · 2 lines

James Morris
<[email protected]>

Quoted 7 lines

Ah I'm subscribed to that list but lately been busy getting a huge patch set to platform-driver-x86 [1] for review, which has prioritized out reading much else than linux-integrity.

Thank you. I'll retry the patches tomorrow.

/Jarkko

Cannot observer binary_bios_measuremens file.

What kind of hardware was used to develop/test this?

I tried it with Kabylake and PTT (firmware TPM).

/Jarkko

Quoted 37 lines · Jarkko Sakkinen

Quoted 22 lines · Jarkko Sakkinen

Quoted 12 lines · James Morris

Quoted 4 lines · Jarkko Sakkinen

The way I've agreed with James Morris to have my tree is to be rooted to security trees next branch.

James, what actions should we take?

This process has changed recently -- I posted to lsm but forgot to post to linux-integrity.

http://kernsec.org/pipermail/linux-security-module-archive/2017-September/003356.html

Quoted 8 lines

Summary: please track the next-general branch in my tree for your development, it replaces 'next'.

- James
--
James Morris
<jmorris-gx6/[email protected]>

Quoted 7 lines

Ah I'm subscribed to that list but lately been busy getting a huge patch set to platform-driver-x86 [1] for review, which has prioritized out reading much else than linux-integrity.

Thank you. I'll retry the patches tomorrow.

/Jarkko

Cannot observer binary_bios_measuremens file.

What kind of hardware was used to develop/test this?

I tried it with Kabylake and PTT (firmware TPM).

Quoted 1 line

/Jarkko

My guess would be wrong event log format.

At minimum this patch set should add a klog (info level) message to tell that unsupported event log format is being used.

/Jarkko

Quoted 38 lines · Jarkko Sakkinen

Quoted 37 lines · Jarkko Sakkinen

Quoted 22 lines · Jarkko Sakkinen

Quoted 12 lines · James Morris

Quoted 4 lines · Jarkko Sakkinen

The way I've agreed with James Morris to have my tree is to be rooted to security trees next branch.

James, what actions should we take?

This process has changed recently -- I posted to lsm but forgot to post to linux-integrity.

http://kernsec.org/pipermail/linux-security-module-archive/2017-September/003356.html

Quoted 8 lines

Summary: please track the next-general branch in my tree for your development, it replaces 'next'.

- James
--
James Morris
<jmorris-gx6/[email protected]>

Quoted 7 lines

Ah I'm subscribed to that list but lately been busy getting a huge patch set to platform-driver-x86 [1] for review, which has prioritized out reading much else than linux-integrity.

Thank you. I'll retry the patches tomorrow.

/Jarkko

Cannot observer binary_bios_measuremens file.

What kind of hardware was used to develop/test this?

I tried it with Kabylake and PTT (firmware TPM).

Quoted 8 lines

Quoted 1 line

/Jarkko

My guess would be wrong event log format.

At minimum this patch set should add a klog (info level) message to tell that unsupported event log format is being used.

/Jarkko

This patch was mainly developed and tested on Kabylake with PTT as well.

It could be a few things. Are you booting with the EFI stub? Is the TPM enabled within the BIOS? Does tpm_tis get loaded? Does it produce any log?
If the logs are recovered (but not parsed), you should already see an entry in the logs like:

efi: SMBIOS=0x7fed6000 ACPI=0x7ff00000 TPMEventLog=0x.....

Can you see the TPMEventLog part?

The issue with extra logging is that the log recovery happens within the EFI stub phase where limited logging is available (which I think has been limited to error and fatal message only).
For now, it cannot be a version mismatch as the stub will only request the version 1.2 format.

This patch was mainly developed and tested on Kabylake with PTT as well.

It could be a few things. Are you booting with the EFI stub? Is the TPM enabled within the BIOS? Does tpm_tis get loaded? Does it produce any log?

If the logs are recovered (but not parsed), you should already see an entry in the logs like:

efi: SMBIOS=0x7fed6000 ACPI=0x7ff00000 TPMEventLog=0x.....

Can you see the TPMEventLog part?

The issue with extra logging is that the log recovery happens within the EFI stub phase where limited logging is available (which I think has been limited to error and fatal message only).
For now, it cannot be a version mismatch as the stub will only request the version 1.2 format.

With TPM 2.0 specification, the event logs may only be accessible by calling an EFI Boot Service. Modify the EFI stub to copy the log area to a new Linux-specific EFI configuration table so it remains accessible once booted.

When calling this service, it is possible to specify the expected format of the logs: TPM 1.2 (SHA1) or TPM 2.0 ("Crypto Agile"). For now, only the first format is retrieved.

Signed-off-by Thiebaud Weksteen <[email protected]>

---
 arch/x86/boot/compressed/eboot.c      |  1 +
 drivers/firmware/efi/Makefile         |  2 +-
 drivers/firmware/efi/efi.c            |  4 ++
 drivers/firmware/efi/libstub/Makefile |  3 +-
 drivers/firmware/efi/libstub/tpm.c    | 81 +++++++++++++++++++++++++++++++++++
 drivers/firmware/efi/tpm.c            | 40 +++++++++++++++++
 include/linux/efi.h                   | 46 ++++++++++++++++++++
 7 files changed, 174 insertions(+), 3 deletions(-)
 create mode 100644 drivers/firmware/efi/tpm.c

arch/x86/boot/compressed/eboot.c +1 -0

index a1686f3dc295..ef6abe8b3788 100644
@@ -999,6 +999,7 @@ struct boot_params *efi_main(struct efi_config *c,
 
        /* Ask the firmware to clear memory on unclean shutdown */
        efi_enable_reset_attack_mitigation(sys_table);
+       efi_retrieve_tpm2_eventlog(sys_table);
 
        setup_graphics(boot_params);
 

drivers/firmware/efi/Makefile +1 -1

index 0329d319d89a..2f074b5cde87 100644
@@ -10,7 +10,7 @@
 KASAN_SANITIZE_runtime-wrappers.o      := n
 
 obj-$(CONFIG_ACPI_BGRT)                += efi-bgrt.o
-obj-$(CONFIG_EFI)                      += efi.o vars.o reboot.o memattr.o
+obj-$(CONFIG_EFI)                      += efi.o vars.o reboot.o memattr.o tpm.o
 obj-$(CONFIG_EFI)                      += capsule.o memmap.o
 obj-$(CONFIG_EFI_VARS)                 += efivars.o
 obj-$(CONFIG_EFI_ESRT)                 += esrt.o

drivers/firmware/efi/efi.c +4 -0

index f97f272e16ee..0308acfaaf76 100644
@@ -52,6 +52,7 @@ struct efi __read_mostly efi = {
        .properties_table       = EFI_INVALID_TABLE_ADDR,
        .mem_attr_table         = EFI_INVALID_TABLE_ADDR,
        .rng_seed               = EFI_INVALID_TABLE_ADDR,
+       .tpm_log                = EFI_INVALID_TABLE_ADDR
 };
 EXPORT_SYMBOL(efi);
 

@@ -444,6 +445,7 @@ static __initdata efi_config_table_type_t common_tables[] = {
        {EFI_PROPERTIES_TABLE_GUID, "PROP", &efi.properties_table},
        {EFI_MEMORY_ATTRIBUTES_TABLE_GUID, "MEMATTR", &efi.mem_attr_table},
        {LINUX_EFI_RANDOM_SEED_TABLE_GUID, "RNG", &efi.rng_seed},
+       {LINUX_EFI_TPM_EVENT_LOG_GUID, "TPMEventLog", &efi.tpm_log},
        {NULL_GUID, NULL, NULL},
 };
 

@@ -532,6 +534,8 @@ int __init efi_config_parse_tables(void *config_tables, int count, int sz,
        if (efi_enabled(EFI_MEMMAP))
                efi_memattr_init();
 
+       efi_tpm_eventlog_init();
+
        /* Parse the EFI Properties table if it exists */
        if (efi.properties_table != EFI_INVALID_TABLE_ADDR) {
                efi_properties_table_t *tbl;

drivers/firmware/efi/libstub/Makefile +1 -2

index dedf9bde44db..2abe6d22dc5f 100644
@@ -29,8 +29,7 @@ OBJECT_FILES_NON_STANDARD     := y
 # Prevents link failures: __sanitizer_cov_trace_pc() is not linked in.
 KCOV_INSTRUMENT                        := n
 
-lib-y                          := efi-stub-helper.o gop.o secureboot.o
-lib-$(CONFIG_RESET_ATTACK_MITIGATION) += tpm.o
+lib-y                          := efi-stub-helper.o gop.o secureboot.o tpm.o
 
 # include the stub's generic dependencies from lib/ when building for ARM/arm64
 arm-deps := fdt_rw.c fdt_ro.c fdt_wip.c fdt.c fdt_empty_tree.c fdt_sw.c sort.c

drivers/firmware/efi/libstub/tpm.c +81 -0

index 6224cdbc9669..da661bf8cb96 100644
@@ -4,15 +4,18 @@
  * Copyright (C) 2016 CoreOS, Inc
  * Copyright (C) 2017 Google, Inc.
  *     Matthew Garrett <[email protected]>
+ *     Thiebaud Weksteen <[email protected]>
  *
  * This file is part of the Linux kernel, and is made available under the
  * terms of the GNU General Public License version 2.
  */
 #include <linux/efi.h>
+#include <linux/tpm_eventlog.h>
 #include <asm/efi.h>
 
 #include "efistub.h"
 
+#ifdef CONFIG_RESET_ATTACK_MITIGATION
 static const efi_char16_t efi_MemoryOverWriteRequest_name[] = {
        'M', 'e', 'm', 'o', 'r', 'y', 'O', 'v', 'e', 'r', 'w', 'r', 'i', 't',
        'e', 'R', 'e', 'q', 'u', 'e', 's', 't', 'C', 'o', 'n', 't', 'r', 'o',

@@ -56,3 +59,81 @@ void efi_enable_reset_attack_mitigation(efi_system_table_t *sys_table_arg)
                    EFI_VARIABLE_BOOTSERVICE_ACCESS |
                    EFI_VARIABLE_RUNTIME_ACCESS, sizeof(val), &val);
 }
+
+#endif
+
+void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg)
+{
+       efi_guid_t tcg2_guid = EFI_TCG2_PROTOCOL_GUID;
+       efi_guid_t linux_eventlog_guid = LINUX_EFI_TPM_EVENT_LOG_GUID;
+       efi_status_t status;
+       efi_physical_addr_t log_location, log_last_entry;
+       struct linux_efi_tpm_eventlog *log_tbl;
+       unsigned long first_entry_addr, last_entry_addr;
+       size_t log_size, last_entry_size;
+       efi_bool_t truncated;
+       void *tcg2_protocol;
+
+       status = efi_call_early(locate_protocol, &tcg2_guid, NULL,
+                               &tcg2_protocol);
+       if (status != EFI_SUCCESS)
+               return;
+
+       status = efi_call_proto(efi_tcg2_protocol, get_event_log, tcg2_protocol,
+                               EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2,
+                               &log_location, &log_last_entry, &truncated);
+       if (status != EFI_SUCCESS)
+               return;
+
+       if (!log_location)
+               return;
+       first_entry_addr = (unsigned long) log_location;
+
+       /*
+        * We populate the EFI table even if the logs are empty.
+        */
+       if (!log_last_entry) {
+               log_size = 0;
+       } else {
+               last_entry_addr = (unsigned long) log_last_entry;
+               /*
+                * get_event_log only returns the address of the last entry.
+                * We need to calculate its size to deduce the full size of
+                * the logs.
+                */
+               last_entry_size = sizeof(struct tcpa_event) +
+                       ((struct tcpa_event *) last_entry_addr)->event_size;
+               log_size = log_last_entry - log_location + last_entry_size;
+       }
+
+       /* Allocate space for the logs and copy them. */
+       status = efi_call_early(allocate_pool, EFI_LOADER_DATA,
+                               sizeof(*log_tbl) + log_size,
+                               (void **) &log_tbl);
+
+       if (status != EFI_SUCCESS) {
+               efi_printk(sys_table_arg,
+                          "Unable to allocate memory for event log\n");
+               return;
+       }
+
+       memset(log_tbl, 0, sizeof(*log_tbl) + log_size);
+       log_tbl->size = log_size;
+       log_tbl->version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2;
+       memcpy(log_tbl->log, (void *) first_entry_addr, log_size);
+
+       status = efi_call_early(install_configuration_table,
+                               &linux_eventlog_guid, log_tbl);
+       if (status != EFI_SUCCESS)
+               goto err_free;
+       return;
+
+err_free:
+       efi_call_early(free_pool, log_tbl);
+}
+
+void efi_retrieve_tpm2_eventlog(efi_system_table_t *sys_table_arg)
+{
+       /* Only try to retrieve the logs in 1.2 format. */
+       efi_retrieve_tpm2_eventlog_1_2(sys_table_arg);
+}

drivers/firmware/efi/tpm.c new file +40 -0

new file mode 100644
index 000000000000..0cbeb3d46b18
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2017 Google, Inc.
+ *     Thiebaud Weksteen <[email protected]>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/efi.h>
+#include <linux/init.h>
+#include <linux/memblock.h>
+
+#include <asm/early_ioremap.h>
+
+/*
+ * Reserve the memory associated with the TPM Event Log configuration table.
+ */
+int __init efi_tpm_eventlog_init(void)
+{
+       struct linux_efi_tpm_eventlog *log_tbl;
+       unsigned int tbl_size;
+
+       if (efi.tpm_log == EFI_INVALID_TABLE_ADDR)
+               return 0;
+
+       log_tbl = early_memremap(efi.tpm_log, sizeof(*log_tbl));
+       if (!log_tbl) {
+               pr_err("Failed to map TPM Event Log table @ 0x%lx\n",
+                       efi.tpm_log);
+               efi.tpm_log = EFI_INVALID_TABLE_ADDR;
+               return -ENOMEM;
+       }
+
+       tbl_size = sizeof(*log_tbl) + log_tbl->size;
+       memblock_reserve(efi.tpm_log, tbl_size);
+       early_memunmap(log_tbl, sizeof(*log_tbl));
+       return 0;
+}
+

include/linux/efi.h +46 -1

index 8dc3d94a3e3c..c5805eb601b1 100644
@@ -472,6 +472,39 @@ typedef struct {
        u64 get_all;
 } apple_properties_protocol_64_t;
 
+typedef struct {
+       u32 get_capability;
+       u32 get_event_log;
+       u32 hash_log_extend_event;
+       u32 submit_command;
+       u32 get_active_pcr_banks;
+       u32 set_active_pcr_banks;
+       u32 get_result_of_set_active_pcr_banks;
+} efi_tcg2_protocol_32_t;
+
+typedef struct {
+       u64 get_capability;
+       u64 get_event_log;
+       u64 hash_log_extend_event;
+       u64 submit_command;
+       u64 get_active_pcr_banks;
+       u64 set_active_pcr_banks;
+       u64 get_result_of_set_active_pcr_banks;
+} efi_tcg2_protocol_64_t;
+
+typedef u32 efi_tcg2_event_log_format;
+
+typedef struct {
+       void *get_capability;
+       efi_status_t (*get_event_log)(efi_handle_t, efi_tcg2_event_log_format,
+               efi_physical_addr_t *, efi_physical_addr_t *, efi_bool_t *);
+       void *hash_log_extend_event;
+       void *submit_command;
+       void *get_active_pcr_banks;
+       void *set_active_pcr_banks;
+       void *get_result_of_set_active_pcr_banks;
+} efi_tcg2_protocol_t;
+
 /*
  * Types and defines for EFI ResetSystem
  */

@@ -622,6 +655,7 @@ void efi_native_runtime_setup(void);
 #define EFI_MEMORY_ATTRIBUTES_TABLE_GUID       EFI_GUID(0xdcfa911d, 0x26eb, 0x469f,  0xa2, 0x20, 0x38, 0xb7, 0xdc, 0x46, 0x12, 0x20)
 #define EFI_CONSOLE_OUT_DEVICE_GUID            EFI_GUID(0xd3b36f2c, 0xd551, 0x11d4,  0x9a, 0x46, 0x00, 0x90, 0x27, 0x3f, 0xc1, 0x4d)
 #define APPLE_PROPERTIES_PROTOCOL_GUID         EFI_GUID(0x91bd12fe, 0xf6c3, 0x44fb,  0xa5, 0xb7, 0x51, 0x22, 0xab, 0x30, 0x3a, 0xe0)
+#define EFI_TCG2_PROTOCOL_GUID                 EFI_GUID(0x607f766c, 0x7455, 0x42be,  0x93, 0x0b, 0xe4, 0xd7, 0x6d, 0xb2, 0x72, 0x0f)
 
 #define EFI_IMAGE_SECURITY_DATABASE_GUID       EFI_GUID(0xd719b2cb, 0x3d3a, 0x4596,  0xa3, 0xbc, 0xda, 0xd0, 0x0e, 0x67, 0x65, 0x6f)
 #define EFI_SHIM_LOCK_GUID                     EFI_GUID(0x605dab50, 0xe046, 0x4300,  0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23)

@@ -634,6 +668,7 @@ void efi_native_runtime_setup(void);
 #define LINUX_EFI_ARM_SCREEN_INFO_TABLE_GUID   EFI_GUID(0xe03fc20a, 0x85dc, 0x406e,  0xb9, 0x0e, 0x4a, 0xb5, 0x02, 0x37, 0x1d, 0x95)
 #define LINUX_EFI_LOADER_ENTRY_GUID            EFI_GUID(0x4a67b082, 0x0a4c, 0x41cf,  0xb6, 0xc7, 0x44, 0x0b, 0x29, 0xbb, 0x8c, 0x4f)
 #define LINUX_EFI_RANDOM_SEED_TABLE_GUID       EFI_GUID(0x1ce1e5bc, 0x7ceb, 0x42f2,  0x81, 0xe5, 0x8a, 0xad, 0xf1, 0x80, 0xf5, 0x7b)
+#define LINUX_EFI_TPM_EVENT_LOG_GUID           EFI_GUID(0xb7799cb0, 0xeca2, 0x4943,  0x96, 0x67, 0x1f, 0xae, 0x07, 0xb7, 0x47, 0xfa)
 
 typedef struct {
        efi_guid_t guid;

@@ -908,6 +943,7 @@ extern struct efi {
        unsigned long properties_table; /* properties table */
        unsigned long mem_attr_table;   /* memory attributes table */
        unsigned long rng_seed;         /* UEFI firmware random seed */
+       unsigned long tpm_log;          /* TPM2 Event Log table */
        efi_get_time_t *get_time;
        efi_set_time_t *set_time;
        efi_get_wakeup_time_t *get_wakeup_time;

@@ -1504,6 +1540,8 @@ static inline void
 efi_enable_reset_attack_mitigation(efi_system_table_t *sys_table_arg) { }
 #endif
 
+void efi_retrieve_tpm2_eventlog(efi_system_table_t *sys_table);
+
 /*
  * Arch code can implement the following three template macros, avoiding
  * reptition for the void/non-void return cases of {__,}efi_call_virt():

@@ -1571,4 +1609,12 @@ struct linux_efi_random_seed {
        u8      bits[];
 };
 
+struct linux_efi_tpm_eventlog {
+       u32     size;
+       u8      version;
+       u8      log[];
+};
+
+extern int efi_tpm_eventlog_init(void);
+
 #endif /* _LINUX_EFI_H */
--

2.14.1.821.g8fa685d3b7-goog

Hi Thiebaud

On Wed, Sep 20, 2017 at 10:13 AM, Thiebaud Weksteen <[email protected]>

Quoted 7 lines

With TPM 2.0 specification, the event logs may only be accessible by calling an EFI Boot Service. Modify the EFI stub to copy the log area to a new Linux-specific EFI configuration table so it remains accessible once booted.

When calling this service, it is possible to specify the expected format of the logs: TPM 1.2 (SHA1) or TPM 2.0 ("Crypto Agile"). For now, only

Quoted 2 lines

first format is retrieved.

Do you have plans to add support for the crypto-agile format? I am working on uefi/ovmf support, and I am wondering if it is at all necessary to add support for the 1.2 format. What do you think? I can eventually try to work on 2.0 format support.

Thanks

Quoted 7 lines

Signed-off-by Thiebaud Weksteen <[email protected]>

---
 arch/x86/boot/compressed/eboot.c      |  1 +
 drivers/firmware/efi/Makefile         |  2 +-
 drivers/firmware/efi/efi.c            |  4 ++
 drivers/firmware/efi/libstub/Makefile |  3 +-
 drivers/firmware/efi/libstub/tpm.c    | 81

Review

Quoted 6 lines

 drivers/firmware/efi/tpm.c            | 40 +++++++++++++++++
 include/linux/efi.h                   | 46 ++++++++++++++++++++
 7 files changed, 174 insertions(+), 3 deletions(-)
 create mode 100644 drivers/firmware/efi/tpm.c

(quoted diff) +0 -0

Quoted 5 lines

index a1686f3dc295..ef6abe8b3788 100644

arch/x86/boot/compressed/eboot.c +0 -0

@@ -999,6 +999,7 @@ struct boot_params *efi_main(struct efi_config *c,
 

Review

Quoted 7 lines

arch/x86/boot/compressed/eboot.c +1 -0

        /* Ask the firmware to clear memory on unclean shutdown */
        efi_enable_reset_attack_mitigation(sys_table);
+       efi_retrieve_tpm2_eventlog(sys_table);
 
        setup_graphics(boot_params);
 

(quoted diff) +0 -0

drivers/firmware/efi/Makefile line 13

Quoted 8 lines

index 0329d319d89a..2f074b5cde87 100644

drivers/firmware/efi/Makefile +0 -1

@@ -10,7 +10,7 @@
 KASAN_SANITIZE_runtime-wrappers.o      := n
 
 obj-$(CONFIG_ACPI_BGRT)                += efi-bgrt.o
-obj-$(CONFIG_EFI)                      += efi.o vars.o reboot.o

drivers/firmware/efi/Makefile line 13

Quoted 1 line

drivers/firmware/efi/Makefile +1 -0

+obj-$(CONFIG_EFI)                      += efi.o vars.o reboot.o

Quoted 15 lines

drivers/firmware/efi/Makefile +0 -0

 obj-$(CONFIG_EFI)                      += capsule.o memmap.o
 obj-$(CONFIG_EFI_VARS)                 += efivars.o
 obj-$(CONFIG_EFI_ESRT)                 += esrt.o

drivers/firmware/efi/efi.c +1 -0

index f97f272e16ee..0308acfaaf76 100644
@@ -52,6 +52,7 @@ struct efi __read_mostly efi = {
        .properties_table       = EFI_INVALID_TABLE_ADDR,
        .mem_attr_table         = EFI_INVALID_TABLE_ADDR,
        .rng_seed               = EFI_INVALID_TABLE_ADDR,
+       .tpm_log                = EFI_INVALID_TABLE_ADDR
 };
 EXPORT_SYMBOL(efi);
 

drivers/firmware/efi/efi.c static __initdata efi_config_table_type_t

Quoted 1 line

drivers/firmware/efi/efi.c +0 -0

@@ -444,6 +445,7 @@ static __initdata efi_config_table_type_t

drivers/firmware/efi/efi.c static __initdata efi_config_table_type_t · line 446

Quoted 2 lines

drivers/firmware/efi/efi.c +0 -0

        {EFI_PROPERTIES_TABLE_GUID, "PROP", &efi.properties_table},
        {EFI_MEMORY_ATTRIBUTES_TABLE_GUID, "MEMATTR",

drivers/firmware/efi/efi.c int __init efi_config_parse_tables(void

Quoted 6 lines

drivers/firmware/efi/efi.c +1 -0

        {LINUX_EFI_RANDOM_SEED_TABLE_GUID, "RNG", &efi.rng_seed},
+       {LINUX_EFI_TPM_EVENT_LOG_GUID, "TPMEventLog", &efi.tpm_log},
        {NULL_GUID, NULL, NULL},
 };
 

@@ -532,6 +534,8 @@ int __init efi_config_parse_tables(void

Review

Quoted 9 lines

drivers/firmware/efi/efi.c +2 -0

        if (efi_enabled(EFI_MEMMAP))
                efi_memattr_init();
 
+       efi_tpm_eventlog_init();
+
        /* Parse the EFI Properties table if it exists */
        if (efi.properties_table != EFI_INVALID_TABLE_ADDR) {
                efi_properties_table_t *tbl;

(quoted diff) +0 -0

drivers/firmware/efi/libstub/Makefile OBJECT_FILES_NON_STANDARD := y · line 32

Quoted 10 lines

index dedf9bde44db..2abe6d22dc5f 100644

drivers/firmware/efi/libstub/Makefile +1 -2

@@ -29,8 +29,7 @@ OBJECT_FILES_NON_STANDARD     := y
 # Prevents link failures: __sanitizer_cov_trace_pc() is not linked in.
 KCOV_INSTRUMENT                        := n
 
-lib-y                          := efi-stub-helper.o gop.o secureboot.o
-lib-$(CONFIG_RESET_ATTACK_MITIGATION) += tpm.o
+lib-y                          := efi-stub-helper.o gop.o secureboot.o

drivers/firmware/efi/libstub/Makefile OBJECT_FILES_NON_STANDARD := y · line 33

Quoted 2 lines

drivers/firmware/efi/libstub/Makefile +0 -0

 # include the stub's generic dependencies from lib/ when building for

drivers/firmware/efi/libstub/Makefile OBJECT_FILES_NON_STANDARD := y · line 34

Quoted 1 line

drivers/firmware/efi/libstub/Makefile +0 -0

 arm-deps := fdt_rw.c fdt_ro.c fdt_wip.c fdt.c fdt_empty_tree.c

Review

Quoted 1 line

(quoted diff) +0 -0

drivers/firmware/efi/libstub/tpm.c line 9

Quoted 10 lines

index 6224cdbc9669..da661bf8cb96 100644

drivers/firmware/efi/libstub/tpm.c +1 -0

@@ -4,15 +4,18 @@
  * Copyright (C) 2016 CoreOS, Inc
  * Copyright (C) 2017 Google, Inc.
  *     Matthew Garrett <[email protected]>
+ *     Thiebaud Weksteen <[email protected]>
  *
  * This file is part of the Linux kernel, and is made available under

drivers/firmware/efi/libstub/tpm.c

Quoted 11 lines

drivers/firmware/efi/libstub/tpm.c +2 -0

  * terms of the GNU General Public License version 2.
  */
 #include <linux/efi.h>
+#include <linux/tpm_eventlog.h>
 #include <asm/efi.h>
 
 #include "efistub.h"
 
+#ifdef CONFIG_RESET_ATTACK_MITIGATION
 static const efi_char16_t efi_MemoryOverWriteRequest_name[] = {
        'M', 'e', 'm', 'o', 'r', 'y', 'O', 'v', 'e', 'r', 'w', 'r',

drivers/firmware/efi/libstub/tpm.c line 21

Quoted 1 line

drivers/firmware/efi/libstub/tpm.c +0 -0

        'e', 'R', 'e', 'q', 'u', 'e', 's', 't', 'C', 'o', 'n', 't',

drivers/firmware/efi/libstub/tpm.c void

Quoted 1 line

drivers/firmware/efi/libstub/tpm.c +0 -0

@@ -56,3 +59,81 @@ void

Quoted 16 lines

drivers/firmware/efi/libstub/tpm.c +13 -0

                    EFI_VARIABLE_BOOTSERVICE_ACCESS |
                    EFI_VARIABLE_RUNTIME_ACCESS, sizeof(val), &val);
 }
+
+#endif
+
+void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg)
+{
+       efi_guid_t tcg2_guid = EFI_TCG2_PROTOCOL_GUID;
+       efi_guid_t linux_eventlog_guid = LINUX_EFI_TPM_EVENT_LOG_GUID;
+       efi_status_t status;
+       efi_physical_addr_t log_location, log_last_entry;
+       struct linux_efi_tpm_eventlog *log_tbl;
+       unsigned long first_entry_addr, last_entry_addr;
+       size_t log_size, last_entry_size;
+       efi_bool_t truncated;

drivers/firmware/efi/libstub/tpm.c void efi_enable_reset_attack_mitigation(efi_system_table_t *sys_table_arg)

Quoted 8 lines

drivers/firmware/efi/libstub/tpm.c +8 -0

+       void *tcg2_protocol;
+
+       status = efi_call_early(locate_protocol, &tcg2_guid, NULL,
+                               &tcg2_protocol);
+       if (status != EFI_SUCCESS)
+               return;
+
+       status = efi_call_proto(efi_tcg2_protocol, get_event_log,

drivers/firmware/efi/libstub/tpm.c void · line 84

Quoted 2 lines

drivers/firmware/efi/libstub/tpm.c +2 -0

+                               EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2,
+                               &log_location, &log_last_entry,

Quoted 8 lines

drivers/firmware/efi/libstub/tpm.c +8 -0

+       if (status != EFI_SUCCESS)
+               return;
+
+       if (!log_location)
+               return;
+       first_entry_addr = (unsigned long) log_location;
+
+       /*

drivers/firmware/efi/libstub/tpm.c void efi_enable_reset_attack_mitigation(efi_system_table_t *sys_table_arg)

Quoted 8 lines

drivers/firmware/efi/libstub/tpm.c +8 -0

+        * We populate the EFI table even if the logs are empty.
+        */
+       if (!log_last_entry) {
+               log_size = 0;
+       } else {
+               last_entry_addr = (unsigned long) log_last_entry;
+               /*
+                * get_event_log only returns the address of the last

drivers/firmware/efi/libstub/tpm.c void · line 101

Quoted 1 line

drivers/firmware/efi/libstub/tpm.c +1 -0

+                * We need to calculate its size to deduce the full

drivers/firmware/efi/libstub/tpm.c void efi_enable_reset_attack_mitigation(efi_system_table_t *sys_table_arg)

Quoted 4 lines

drivers/firmware/efi/libstub/tpm.c +4 -0

+                * the logs.
+                */
+               last_entry_size = sizeof(struct tcpa_event) +
+                       ((struct tcpa_event *)

drivers/firmware/efi/libstub/tpm.c void · line 106

Quoted 1 line

drivers/firmware/efi/libstub/tpm.c +1 -0

+               log_size = log_last_entry - log_location +

Quoted 48 lines

drivers/firmware/efi/libstub/tpm.c +33 -0

+       }
+
+       /* Allocate space for the logs and copy them. */
+       status = efi_call_early(allocate_pool, EFI_LOADER_DATA,
+                               sizeof(*log_tbl) + log_size,
+                               (void **) &log_tbl);
+
+       if (status != EFI_SUCCESS) {
+               efi_printk(sys_table_arg,
+                          "Unable to allocate memory for event log\n");
+               return;
+       }
+
+       memset(log_tbl, 0, sizeof(*log_tbl) + log_size);
+       log_tbl->size = log_size;
+       log_tbl->version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2;
+       memcpy(log_tbl->log, (void *) first_entry_addr, log_size);
+
+       status = efi_call_early(install_configuration_table,
+                               &linux_eventlog_guid, log_tbl);
+       if (status != EFI_SUCCESS)
+               goto err_free;
+       return;
+
+err_free:
+       efi_call_early(free_pool, log_tbl);
+}
+
+void efi_retrieve_tpm2_eventlog(efi_system_table_t *sys_table_arg)
+{
+       /* Only try to retrieve the logs in 1.2 format. */
+       efi_retrieve_tpm2_eventlog_1_2(sys_table_arg);
+}

drivers/firmware/efi/tpm.c new file +9 -0

new file mode 100644
index 000000000000..0cbeb3d46b18
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2017 Google, Inc.
+ *     Thiebaud Weksteen <[email protected]>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+

drivers/firmware/efi/tpm.c

Quoted 8 lines

drivers/firmware/efi/tpm.c new file +8 -0

+#include <linux/efi.h>
+#include <linux/init.h>
+#include <linux/memblock.h>
+
+#include <asm/early_ioremap.h>
+
+/*
+ * Reserve the memory associated with the TPM Event Log configuration

Quoted 48 lines

drivers/firmware/efi/tpm.c new file +23 -0

+ */
+int __init efi_tpm_eventlog_init(void)
+{
+       struct linux_efi_tpm_eventlog *log_tbl;
+       unsigned int tbl_size;
+
+       if (efi.tpm_log == EFI_INVALID_TABLE_ADDR)
+               return 0;
+
+       log_tbl = early_memremap(efi.tpm_log, sizeof(*log_tbl));
+       if (!log_tbl) {
+               pr_err("Failed to map TPM Event Log table @ 0x%lx\n",
+                       efi.tpm_log);
+               efi.tpm_log = EFI_INVALID_TABLE_ADDR;
+               return -ENOMEM;
+       }
+
+       tbl_size = sizeof(*log_tbl) + log_tbl->size;
+       memblock_reserve(efi.tpm_log, tbl_size);
+       early_memunmap(log_tbl, sizeof(*log_tbl));
+       return 0;
+}
+

include/linux/efi.h +17 -0

index 8dc3d94a3e3c..c5805eb601b1 100644
@@ -472,6 +472,39 @@ typedef struct {
        u64 get_all;
 } apple_properties_protocol_64_t;
 
+typedef struct {
+       u32 get_capability;
+       u32 get_event_log;
+       u32 hash_log_extend_event;
+       u32 submit_command;
+       u32 get_active_pcr_banks;
+       u32 set_active_pcr_banks;
+       u32 get_result_of_set_active_pcr_banks;
+} efi_tcg2_protocol_32_t;
+
+typedef struct {
+       u64 get_capability;
+       u64 get_event_log;
+       u64 hash_log_extend_event;
+       u64 submit_command;
+       u64 get_active_pcr_banks;
+       u64 set_active_pcr_banks;

include/linux/efi.h typedef struct {

Quoted 8 lines

include/linux/efi.h +8 -0

+       u64 get_result_of_set_active_pcr_banks;
+} efi_tcg2_protocol_64_t;
+
+typedef u32 efi_tcg2_event_log_format;
+
+typedef struct {
+       void *get_capability;
+       efi_status_t (*get_event_log)(efi_handle_t,

include/linux/efi.h typedef struct { · line 500

Quoted 1 line

include/linux/efi.h +1 -0

+               efi_physical_addr_t *, efi_physical_addr_t *,

Quoted 4 lines

include/linux/efi.h +4 -0

+       void *hash_log_extend_event;
+       void *submit_command;
+       void *get_active_pcr_banks;
+       void *set_active_pcr_banks;

include/linux/efi.h void efi_native_runtime_setup(void); · line 655

Quoted 8 lines

include/linux/efi.h +3 -0

+       void *get_result_of_set_active_pcr_banks;
+} efi_tcg2_protocol_t;
+
 /*
  * Types and defines for EFI ResetSystem
  */

@@ -622,6 +655,7 @@ void efi_native_runtime_setup(void);
 #define EFI_MEMORY_ATTRIBUTES_TABLE_GUID       EFI_GUID(0xdcfa911d,

include/linux/efi.h void efi_native_runtime_setup(void); · line 656

Quoted 1 line

include/linux/efi.h +0 -0

 #define EFI_CONSOLE_OUT_DEVICE_GUID            EFI_GUID(0xd3b36f2c,

include/linux/efi.h void efi_native_runtime_setup(void); · line 657

Quoted 1 line

include/linux/efi.h +0 -0

 #define APPLE_PROPERTIES_PROTOCOL_GUID         EFI_GUID(0x91bd12fe,

include/linux/efi.h void efi_native_runtime_setup(void); · line 658

Quoted 1 line

include/linux/efi.h +1 -0

+#define EFI_TCG2_PROTOCOL_GUID                 EFI_GUID(0x607f766c,

include/linux/efi.h void efi_native_runtime_setup(void); · line 659

Quoted 2 lines

include/linux/efi.h +0 -0

 #define EFI_IMAGE_SECURITY_DATABASE_GUID       EFI_GUID(0xd719b2cb,

include/linux/efi.h void efi_native_runtime_setup(void); · line 660

Quoted 1 line

include/linux/efi.h +0 -0

 #define EFI_SHIM_LOCK_GUID                     EFI_GUID(0x605dab50,

include/linux/efi.h void efi_native_runtime_setup(void); · line 668

Quoted 2 lines

include/linux/efi.h +0 -0

@@ -634,6 +668,7 @@ void efi_native_runtime_setup(void);
 #define LINUX_EFI_ARM_SCREEN_INFO_TABLE_GUID   EFI_GUID(0xe03fc20a,

include/linux/efi.h void efi_native_runtime_setup(void); · line 669

Quoted 1 line

include/linux/efi.h +0 -0

 #define LINUX_EFI_LOADER_ENTRY_GUID            EFI_GUID(0x4a67b082,

include/linux/efi.h void efi_native_runtime_setup(void); · line 670

Quoted 1 line

include/linux/efi.h +0 -0

 #define LINUX_EFI_RANDOM_SEED_TABLE_GUID       EFI_GUID(0x1ce1e5bc,

include/linux/efi.h void efi_native_runtime_setup(void); · line 671

Quoted 1 line

include/linux/efi.h +1 -0

+#define LINUX_EFI_TPM_EVENT_LOG_GUID           EFI_GUID(0xb7799cb0,

include/linux/efi.h static inline void · line 1540

Quoted 13 lines

include/linux/efi.h +1 -0

 typedef struct {
        efi_guid_t guid;

@@ -908,6 +943,7 @@ extern struct efi {
        unsigned long properties_table; /* properties table */
        unsigned long mem_attr_table;   /* memory attributes table */
        unsigned long rng_seed;         /* UEFI firmware random seed */
+       unsigned long tpm_log;          /* TPM2 Event Log table */
        efi_get_time_t *get_time;
        efi_set_time_t *set_time;
        efi_get_wakeup_time_t *get_wakeup_time;

@@ -1504,6 +1540,8 @@ static inline void
 efi_enable_reset_attack_mitigation(efi_system_table_t *sys_table_arg)

include/linux/efi.h static inline void

Quoted 6 lines

include/linux/efi.h +2 -0

 #endif
 
+void efi_retrieve_tpm2_eventlog(efi_system_table_t *sys_table);
+
 /*
  * Arch code can implement the following three template macros,

include/linux/efi.h static inline void · line 1547

Quoted 1 line

include/linux/efi.h +0 -0

  * reptition for the void/non-void return cases of

Quoted 14 lines

include/linux/efi.h +8 -1

@@ -1571,4 +1609,12 @@ struct linux_efi_random_seed {
        u8      bits[];
 };
 
+struct linux_efi_tpm_eventlog {
+       u32     size;
+       u8      version;
+       u8      log[];
+};
+
+extern int efi_tpm_eventlog_init(void);
+
 #endif /* _LINUX_EFI_H */
--

Quoted 2 lines

2.14.1.821.g8fa685d3b7-goog

--
Marc-André Lureau