From patchwork Mon May 20 20:55:01 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthew Garrett X-Patchwork-Id: 10952339 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 992DC1395 for ; Mon, 20 May 2019 20:55:19 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 87F742871F for ; Mon, 20 May 2019 20:55:19 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7C43528896; Mon, 20 May 2019 20:55:19 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.5 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI, USER_IN_DEF_DKIM_WL autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0B5A82871F for ; Mon, 20 May 2019 20:55:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726990AbfETUzS (ORCPT ); Mon, 20 May 2019 16:55:18 -0400 Received: from mail-pg1-f202.google.com ([209.85.215.202]:56991 "EHLO mail-pg1-f202.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726979AbfETUzQ (ORCPT ); Mon, 20 May 2019 16:55:16 -0400 Received: by mail-pg1-f202.google.com with SMTP id r191so7454474pgr.23 for ; Mon, 20 May 2019 13:55:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=2S/gHsQaO08L1k/kaLAgP/iaI6c/d06OZBDkdH1Ekx0=; b=bn7WHiENp+Jgwq76sRokv6v0WVMG7P/MdlQ0xYiJJeuGCup45bH514LUOM4BaBFOuw hIy6lnvtRfymw2xIt/dCmLB5QS6fGxTOlZYBEXpo0fOw05p1vzBfpNRMnKilxoy8UJmN RundMf4Zidiv5pdMqiDJvIqlfmZe4p5XNL2Bn1ZR7Dqmvkh6yYJEVYefZZAvfG0DAdhn WVNDbeYz1YoQ3AbvTdCoacQlkFj8rWvYmubnWoAplDxM0LIxIKMh5grd4dEY/YsLNvRf rvu7FgRa2sS22ddDAmespjdjtj/wHQO2czYud2euSGrg99uYS6zQvwMyGrquZxSrhL+P d4xA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=2S/gHsQaO08L1k/kaLAgP/iaI6c/d06OZBDkdH1Ekx0=; b=nSgMg807v/T2sG55+KtHNgSGpOOEFa1gdfzqp5xUCfSC5nI8hYL/y+2Cuxo2Y97Xb7 OhhuCUJoB23gXwAE0pCBX5s0yJJvow+J4q2nNS7S5rbj94dRHWRZGpiIrV01ysf099fA +YacNoD6+VPtsjbfEk46prJl9Ra23AMHUU2mXXRAyux38RGitj9m423siMWncuM0ftpW BcTKIGQKMKvXE1PMhd4/Oau1QoJfZ/YFXTiQszUVmzjLGmKaHD2QZkq+384RXOLh4HvF j1etspMMmPTWHjNlGQ0YzGgM2kdbze+OJ1+LxhZDaRpCRJDlqFjzYVnnfxer8+0PYIwK idwQ== X-Gm-Message-State: APjAAAU5urIyxv7toDgjUHUeWXJzWTX4A7UhaTNrxquOpwTERV4pCxgF CD3Tc6X/rRTpCG5B8utIGHjgrCua+BTKmLlIEjQW1zBvS8nzALxpqi95LnRYl7PEeo/q5l6XVNc 5YLSXSv/qk4xYEMOx6Q7oO+G2Fd2VUpAgIcgV+paUGX4p60dDsxwkKi7acAaJ8pqnVvF6WqcB/i HRD0GFr9un0/VCmaSeFyA= X-Google-Smtp-Source: APXvYqzXluYerRenEIporaBqlL0VKRUEYZ6bb//DTlFcuJIwvPvXL8WLmsndEpl+oa5KGu6dGG7EK4vv+klAAzBgskcu3w== X-Received: by 2002:a63:1061:: with SMTP id 33mr51272273pgq.328.1558385715691; Mon, 20 May 2019 13:55:15 -0700 (PDT) Date: Mon, 20 May 2019 13:55:01 -0700 In-Reply-To: <20190520205501.177637-1-matthewgarrett@google.com> Message-Id: <20190520205501.177637-5-matthewgarrett@google.com> Mime-Version: 1.0 References: <20190520205501.177637-1-matthewgarrett@google.com> X-Mailer: git-send-email 2.21.0.1020.gf2820cf01a-goog Subject: [PATCH V7 4/4] efi: Attempt to get the TCG2 event log in the boot stub From: Matthew Garrett To: linux-integrity@vger.kernel.org Cc: peterhuewe@gmx.de, jarkko.sakkinen@linux.intel.com, jgg@ziepe.ca, roberto.sassu@huawei.com, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, tweek@google.com, bsz@semihalf.com, Matthew Garrett Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Matthew Garrett Right now we only attempt to obtain the SHA1-only event log. The protocol also supports a crypto agile log format, which contains digests for all algorithms in use. Attempt to obtain this first, and fall back to obtaining the older format if the system doesn't support it. This is lightly complicated by the event sizes being variable (as we don't know in advance which algorithms are in use), and the interface giving us back a pointer to the start of the final entry rather than a pointer to the end of the log - as a result, we need to parse the final entry to figure out its length in order to know how much data to copy up to the OS. Signed-off-by: Matthew Garrett Acked-by: Ard Biesheuvel --- drivers/firmware/efi/libstub/tpm.c | 50 ++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 17 deletions(-) diff --git a/drivers/firmware/efi/libstub/tpm.c b/drivers/firmware/efi/libstub/tpm.c index 5bd04f75d8d6..6b3b507a54eb 100644 --- a/drivers/firmware/efi/libstub/tpm.c +++ b/drivers/firmware/efi/libstub/tpm.c @@ -57,7 +57,7 @@ void efi_enable_reset_attack_mitigation(efi_system_table_t *sys_table_arg) #endif -static void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg) +void efi_retrieve_tpm2_eventlog(efi_system_table_t *sys_table_arg) { efi_guid_t tcg2_guid = EFI_TCG2_PROTOCOL_GUID; efi_guid_t linux_eventlog_guid = LINUX_EFI_TPM_EVENT_LOG_GUID; @@ -67,6 +67,7 @@ static void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg) unsigned long first_entry_addr, last_entry_addr; size_t log_size, last_entry_size; efi_bool_t truncated; + int version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_2; void *tcg2_protocol = NULL; status = efi_call_early(locate_protocol, &tcg2_guid, NULL, @@ -74,14 +75,20 @@ static void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg) if (status != EFI_SUCCESS) return; - status = efi_call_proto(efi_tcg2_protocol, get_event_log, tcg2_protocol, - EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2, - &log_location, &log_last_entry, &truncated); - if (status != EFI_SUCCESS) - return; + status = efi_call_proto(efi_tcg2_protocol, get_event_log, + tcg2_protocol, version, &log_location, + &log_last_entry, &truncated); + + if (status != EFI_SUCCESS || !log_location) { + version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2; + status = efi_call_proto(efi_tcg2_protocol, get_event_log, + tcg2_protocol, version, &log_location, + &log_last_entry, &truncated); + if (status != EFI_SUCCESS || !log_location) + return; + + } - if (!log_location) - return; first_entry_addr = (unsigned long) log_location; /* @@ -96,8 +103,23 @@ static void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg) * We need to calculate its size to deduce the full size of * the logs. */ - last_entry_size = sizeof(struct tcpa_event) + - ((struct tcpa_event *) last_entry_addr)->event_size; + if (version == EFI_TCG2_EVENT_LOG_FORMAT_TCG_2) { + /* + * The TCG2 log format has variable length entries, + * and the information to decode the hash algorithms + * back into a size is contained in the first entry - + * pass a pointer to the final entry (to calculate its + * size) and the first entry (so we know how long each + * digest is) + */ + last_entry_size = + __calc_tpm2_event_size((void *)last_entry_addr, + (void *)(long)log_location, + false); + } else { + last_entry_size = sizeof(struct tcpa_event) + + ((struct tcpa_event *) last_entry_addr)->event_size; + } log_size = log_last_entry - log_location + last_entry_size; } @@ -114,7 +136,7 @@ static void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg) memset(log_tbl, 0, sizeof(*log_tbl) + log_size); log_tbl->size = log_size; - log_tbl->version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2; + log_tbl->version = version; memcpy(log_tbl->log, (void *) first_entry_addr, log_size); status = efi_call_early(install_configuration_table, @@ -126,9 +148,3 @@ static void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg) err_free: efi_call_early(free_pool, log_tbl); } - -void efi_retrieve_tpm2_eventlog(efi_system_table_t *sys_table_arg) -{ - /* Only try to retrieve the logs in 1.2 format. */ - efi_retrieve_tpm2_eventlog_1_2(sys_table_arg); -}