From patchwork Wed Nov 17 09:10:41 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 519210 Delivered-To: patch@linaro.org Received: by 2002:ac0:c605:0:0:0:0:0 with SMTP id p5csp672724imj; Wed, 17 Nov 2021 01:10:54 -0800 (PST) X-Google-Smtp-Source: ABdhPJyotR5Vdc4nDGY/UKzzqbnXYGsY3FVcu/f5c//fAYESlYDZEb0BNhzTQ1QJgb72O7FYwB1h X-Received: by 2002:a17:906:489a:: with SMTP id v26mr19948847ejq.305.1637140254394; Wed, 17 Nov 2021 01:10:54 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1637140254; cv=none; d=google.com; s=arc-20160816; b=GYmP75LBCK3nJ86FGbwevefo8aZhQpRjiBglAAapW6sAJ5xbdg2kUrEPFIivkJR8yK ZW0QTv7qtsckPyuXErEjAK0airbFuXB+Jz+liur+g7/LF1nginV72XlX2TaMssLrBcmH XrCl7PsHAPr7LshlHvAlu/C+iCc4QCa7A6/mHZcl2+jDhHHz5b4V5GipRxPjNYZmV7Ar 3J+FX+F8ZG7nQShFJgFGu43fVQ2f0Q0CK1Dry0YVbyJhMX4mbdNWsnOR+opRF5wgCE1N la5IZl/aKi+62TRfYa6fOR/z+2dc+/TJNsI3VgkzXexN2U68+KkmTbUXcWG2Qj08RHr8 Xw/g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:message-id:date:subject:cc:to:from:dkim-signature; bh=bEwpJr0KsxO4vEsmoBgrt2W61qrXxS8JlKo6+GkPCMo=; b=RsGs5ybPjCVXdjQP/6YbbXSUA4PzqouQhb/Zb6mXPWFdu8vtHyiokZcV/L+odZRuLR 0lCFfl8QqvL5Lms5sMKSeUAATLFBooiOMsa5QzenM232jWQvYmrI1WoWCM3Qu+qb0y6W sz9aC044UWSNOw4tv0i+eubJNaXhTBcorR96ugatVsOkk8SMNr7zEfJyNC5oVl9JDye2 hBK15AkXF4O+oGUDL5K/Q6gHiYvGFiL1F7CshvIpOzRC45QkBxVKMm7glyuii7xdzi3p pmxoLVgYn1aNTWj5gPEQjQu7NlLGEp2isUbxpeDdptUxZubIyYrrKoHYTMdS57Re+gU3 ljMw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=A7HPyJEi; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [2a01:238:438b:c500:173d:9f52:ddab:ee01]) by mx.google.com with ESMTPS id s20si31561434ejn.774.2021.11.17.01.10.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 Nov 2021 01:10:54 -0800 (PST) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=A7HPyJEi; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 3C06983305; Wed, 17 Nov 2021 10:10:53 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="A7HPyJEi"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 7C5CB82EBB; Wed, 17 Nov 2021 10:10:50 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-wm1-x32f.google.com (mail-wm1-x32f.google.com [IPv6:2a00:1450:4864:20::32f]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id A0BB382D95 for ; Wed, 17 Nov 2021 10:10:44 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-wm1-x32f.google.com with SMTP id 133so1533545wme.0 for ; Wed, 17 Nov 2021 01:10:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=bEwpJr0KsxO4vEsmoBgrt2W61qrXxS8JlKo6+GkPCMo=; b=A7HPyJEiAudrLw/NhGPuTFPegLr3wM0sHQZnQTCFXB2gPLmUfZFB/rm0WwWr5sPKjC f2KFpuiPvAhV+tO87qqZH6ywLIkZQiaUaL3d5qczWWXA6wKXKedNEvzW7PWy+i6zjL5x gV8qN+a0uW2Y5+BodqcGLrFMG0UjOfvPQqoCO4yR3AWJxP55GxtRSX3dOVGXfEErnrCM LCkuJj43qCoqEB+IYjbPPx2KRFJ+/E4SlxttovOu0VqMisvLOraxsRyqGpbDvTlomwKq gVtCWg+tvR0rv6v2cLYobYiJdQqCPAnMP0JhF8tS+gzmu5/TWd1f0u+e/zRFsD8+xTt3 6ffA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=bEwpJr0KsxO4vEsmoBgrt2W61qrXxS8JlKo6+GkPCMo=; b=5+ksa20f8PsKubeRpmAktRGPoJlr1I7t4EWjxcfR5hyps7u3i13WZ8rS5/sVoDcQkP FrgUPJ1kJ/a5YuMWc/Mmpt/9CFXMiOGfRHfGZ2LOfPD+Uhn+okexS40BA/uUK2ENUYZ/ IteEXlZedgY64gtV+DUpv1ihBQkV4UBliF737GmYz9HoKgwxcUZdP4FEY/F/Iw/ZVOKt XCxHp4lVV7JvRaEOFV3Ahih1OdfT8nYlI5oXZ4MyEZXLv370Ggv3/Izihq9L+8hfoYH4 9+5xosntRQX3DaFSWpbxzPFVIV7I1O3iLvn2djgsDLnLL5Av0oLMVV09dx6RiIeynkZM bKLg== X-Gm-Message-State: AOAM533zdUhtnVZCK15C96TzdF4jbubD1OGBJOWSke3DSCSVLi07kN5i MaD6FL3y/XsNbDb7QWnS4+f8uF4Af+tR+A== X-Received: by 2002:a05:600c:4e45:: with SMTP id e5mr64618225wmq.43.1637140244103; Wed, 17 Nov 2021 01:10:44 -0800 (PST) Received: from localhost.localdomain (ppp-94-66-220-79.home.otenet.gr. [94.66.220.79]) by smtp.gmail.com with ESMTPSA id n4sm23413922wri.41.2021.11.17.01.10.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 Nov 2021 01:10:43 -0800 (PST) From: Ilias Apalodimas To: xypron.glpk@gmx.de Cc: Ilias Apalodimas , Alexander Graf , u-boot@lists.denx.de Subject: [PATCH] efi_loader: fix FinalEvents table if an EFI uses GetEventLog Date: Wed, 17 Nov 2021 11:10:41 +0200 Message-Id: <20211117091041.93577-1-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.33.1 MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.35 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean As described in the TCG spec [1] in sections 7.1.1 and 7.1.2 the FinalEvent table should include events after GetEventLog has been called. This currently works for us as long as the kernel is the only EFI application calling that. Specifically we only implement what's described in 7.1.1. So refactor the code a bit and support EFI application calling GetEventLog. Events will now be logged in both the EventLog and FinalEvent table as long as ExitBootServices haven't been invoked. [1] https://trustedcomputinggroup.org/wp-content/uploads/EFI-Protocol-Specification-rev13-160330final.pdf Signed-off-by: Ilias Apalodimas --- lib/efi_loader/efi_tcg2.c | 90 ++++++++++++++++++++++++++------------- 1 file changed, 61 insertions(+), 29 deletions(-) diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c index 189e4a5ba59c..215f4b2b04b8 100644 --- a/lib/efi_loader/efi_tcg2.c +++ b/lib/efi_loader/efi_tcg2.c @@ -34,6 +34,7 @@ struct event_log_buffer { size_t final_pos; /* final events config table position */ size_t last_event_size; bool get_event_called; + bool ebs_called; bool truncated; }; @@ -186,39 +187,29 @@ static efi_status_t tcg2_pcr_extend(struct udevice *dev, u32 pcr_index, return EFI_SUCCESS; } -/* tcg2_agile_log_append - Append an agile event to out eventlog +/* put_event - Append an agile event to an eventlog * * @pcr_index: PCR index * @event_type: type of event added * @digest_list: list of digest algorithms to add * @size: size of event * @event: event to add + * @log: log buffer to append the event * - * @Return: status code */ -static efi_status_t tcg2_agile_log_append(u32 pcr_index, u32 event_type, - struct tpml_digest_values *digest_list, - u32 size, u8 event[]) +static void put_event(u32 pcr_index, u32 event_type, + struct tpml_digest_values *digest_list, u32 size, + u8 event[], void *log) { - void *log = (void *)((uintptr_t)event_log.buffer + event_log.pos); size_t pos; size_t i; u32 event_size; - if (event_log.get_event_called) - log = (void *)((uintptr_t)event_log.final_buffer + - event_log.final_pos); - /* * size refers to the length of event[] only, we need to check against * the final tcg_pcr_event2 size */ event_size = size + tcg_event_final_size(digest_list); - if (event_log.pos + event_size > TPM2_EVENT_LOG_SIZE || - event_log.final_pos + event_size > TPM2_EVENT_LOG_SIZE) { - event_log.truncated = true; - return EFI_VOLUME_FULL; - } put_unaligned_le32(pcr_index, log); pos = offsetof(struct tcg_pcr_event2, event_type); @@ -242,25 +233,64 @@ static efi_status_t tcg2_agile_log_append(u32 pcr_index, u32 event_type, memcpy((void *)((uintptr_t)log + pos), event, size); pos += size; - /* make sure the calculated buffer is what we checked against */ + /* + * make sure the calculated buffer is what we checked against + * This check should never fail. It checks the code above is + * calculating the right length for the event we are adding + * */ if (pos != event_size) - return EFI_INVALID_PARAMETER; + log_err("Appending to the EventLog failed\n"); - /* if GetEventLog hasn't been called update the normal log */ - if (!event_log.get_event_called) { - event_log.pos += pos; - event_log.last_event_size = pos; - } else { - /* if GetEventLog has been called update config table log */ - struct efi_tcg2_final_events_table *final_event; +} - final_event = - (struct efi_tcg2_final_events_table *)(event_log.final_buffer); - final_event->number_of_events++; - event_log.final_pos += pos; +/* tcg2_agile_log_append - Append an agile event to an eventlog + * + * @pcr_index: PCR index + * @event_type: type of event added + * @digest_list: list of digest algorithms to add + * @size: size of event + * @event: event to add + * @log: log buffer to append the event + * + * @Return: status code + */ +static efi_status_t tcg2_agile_log_append(u32 pcr_index, u32 event_type, + struct tpml_digest_values *digest_list, + u32 size, u8 event[]) +{ + void *log = (void *)((uintptr_t)event_log.buffer + event_log.pos); + u32 event_size = size + tcg_event_final_size(digest_list); + struct efi_tcg2_final_events_table *final_event; + efi_status_t ret = EFI_SUCCESS; + + /* if ExitBootServices hasn't been called update the normal log */ + if (!event_log.ebs_called) { + if (event_log.truncated || + event_log.pos + event_size > TPM2_EVENT_LOG_SIZE) { + event_log.truncated = true; + return EFI_VOLUME_FULL; + } + put_event(pcr_index, event_type, digest_list, size, event, log); + event_log.pos += event_size; + event_log.last_event_size = event_size; } - return EFI_SUCCESS; + if (!event_log.get_event_called) + return ret; + + /* if GetEventLog has been called update FinalEventLog as well */ + if (event_log.final_pos + event_size > TPM2_EVENT_LOG_SIZE) + return EFI_VOLUME_FULL; + + log = (void *)((uintptr_t)event_log.final_buffer + event_log.final_pos); + put_event(pcr_index, event_type, digest_list, size, event, log); + + final_event = + (struct efi_tcg2_final_events_table *)event_log.final_buffer; + final_event->number_of_events++; + event_log.final_pos += event_size; + + return ret; } /** @@ -1303,6 +1333,7 @@ static efi_status_t efi_init_event_log(void) event_log.pos = 0; event_log.last_event_size = 0; event_log.get_event_called = false; + event_log.ebs_called = false; event_log.truncated = false; /* @@ -1792,6 +1823,7 @@ efi_tcg2_notify_exit_boot_services(struct efi_event *event, void *context) EFI_ENTRY("%p, %p", event, context); + event_log.ebs_called = true; ret = platform_get_tpm2_device(&dev); if (ret != EFI_SUCCESS) goto out;