From patchwork Fri Jun 7 20:51:46 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthew Garrett X-Patchwork-Id: 10982757 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id BEE8815E6 for ; Fri, 7 Jun 2019 20:52:06 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A364028A99 for ; Fri, 7 Jun 2019 20:52:06 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9794D28B59; Fri, 7 Jun 2019 20:52:06 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.5 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI, USER_IN_DEF_DKIM_WL autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 25A0728A99 for ; Fri, 7 Jun 2019 20:52:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730016AbfFGUwF (ORCPT ); Fri, 7 Jun 2019 16:52:05 -0400 Received: from mail-qk1-f201.google.com ([209.85.222.201]:51495 "EHLO mail-qk1-f201.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729640AbfFGUwF (ORCPT ); Fri, 7 Jun 2019 16:52:05 -0400 Received: by mail-qk1-f201.google.com with SMTP id n126so2619499qkc.18 for ; Fri, 07 Jun 2019 13:52:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:message-id:mime-version:subject:from:to:cc; bh=oqbsRsWn+lQnRxXZU32fYir680/IiGRNUy7p5L8zLFI=; b=UZttm1p/WIT8JCZ/ttox/tS2Mt/NPmTQwUtwKpjK44/+VnCi5SzX1c92BwLeHuEmlJ rHmsub04+Ve9iWoi9nVh/TtTjoIToNeGDPXZ7+9xqAVvL6QSVmbDfDfPDE1rJWTXWp9R nEsbw/Yq6d+IN58qoH0ixZ2akLLfkGEAstNDG8FyjL8GeBsegtJqGsAFinzjVhpKdRg6 09yDeehQbCM3h0biK9BOia3H+ECFY4irebfu/eWthA5yGYNLXyNPVbp4rQy4a/RJBerI SlBYAEqi7x0BWoAG6pDyfZxpiXjmfzzrM1n0BLUDO8oUwSASyJQenQOKDR+I0e0mT8UZ ZTHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:message-id:mime-version:subject:from:to:cc; bh=oqbsRsWn+lQnRxXZU32fYir680/IiGRNUy7p5L8zLFI=; b=mB149jJR/LcJhwQ2y3naZA8UhNqUeNjU6edjhOpc+2TpQzgAvsltnmBT1S/NCd6Nre v1nwdTygH52tb2PdneDcDsDyqrS2DI0Fybeh4E1HnSGiriUJYycIRyMLkYIpZa9/HH+G ZIZmMIIPIad95nX1shrxGRWFqmlUkBu0MVfBP3t7Lbr3vYDHDAo8JPB/Dh4QNe9fe9K+ j4AGBEfG4I2y/nk5KPTHojv6ZdGGietCAVk2UQYFORhZc14XbO2xLRuZ8D1hmD/aCtME XMHtvDkfd6eZGBQ6iO/0sIQjw6ng6olED+WiOTp1KY59NoHO0NXhtCyXSbPtqwP+LA9V KbJw== X-Gm-Message-State: APjAAAVj713QvHe6l+rkX1I0MDf6Oj3OAZNjABaEg2HK4Xbhj5R5HPTz 7MqUndJEMFkQJ8YKeY87/XBxKXHN/aF7dXOQCqHLPfC48mF+7Ka+1gnZkNT84uuKvizmQH61ARs JnzolzkUcJ32TUNEqdxW+S3S4RAsPmXMXNLp7G0Sx9H6YbAe8/yZQfYL6W4OUT2Hwb61+hX38BA iwSDSTYJN4kPbjVxUxsZc= X-Google-Smtp-Source: APXvYqyV8OrlWrDFoL1lsF8h0Vxl4PaO+yiXlppqDfBbK4qEUZGyxMvuEfys1BCENICS6FJaRYPWcdHdDcq5FQ4QMPuGTQ== X-Received: by 2002:ad4:5345:: with SMTP id v5mr33982623qvs.103.1559940724590; Fri, 07 Jun 2019 13:52:04 -0700 (PDT) Date: Fri, 7 Jun 2019 13:51:46 -0700 Message-Id: <20190607205147.102904-1-matthewgarrett@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.22.0.rc2.383.gf4fbbf30c2-goog Subject: [PATCH V2 1/2] Abstract out support for locating an EFI config table From: Matthew Garrett To: linux-integrity@vger.kernel.org Cc: peterhuewe@gmx.de, jarkko.sakkinen@linux.intel.com, jgg@ziepe.ca, linux-efi@vger.kernel.org, ard.biesheuvel@linaro.org, Matthew Garrett , Matthew Garrett Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP We want to grab a pointer to the TPM final events table, so abstract out the existing code for finding an FDT table and make it generic. Signed-off-by: Matthew Garrett Reviewed-by: Ard Biesheuvel Reviewed-by: Jarkko Sakkinen --- .../firmware/efi/libstub/efi-stub-helper.c | 15 +++++++++++ drivers/firmware/efi/libstub/efistub.h | 2 ++ drivers/firmware/efi/libstub/fdt.c | 27 +++++++------------ 3 files changed, 26 insertions(+), 18 deletions(-) diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c index e4610e72b78f..1db780c0f07b 100644 --- a/drivers/firmware/efi/libstub/efi-stub-helper.c +++ b/drivers/firmware/efi/libstub/efi-stub-helper.c @@ -926,3 +926,18 @@ efi_status_t efi_exit_boot_services(efi_system_table_t *sys_table_arg, fail: return status; } + +void *get_efi_config_table(efi_system_table_t *sys_table, efi_guid_t guid) +{ + efi_config_table_t *tables = (efi_config_table_t *)sys_table->tables; + int i; + + for (i = 0; i < sys_table->nr_tables; i++) { + if (efi_guidcmp(tables[i].guid, guid) != 0) + continue; + + return (void *)tables[i].table; + } + + return NULL; +} diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h index 1b1dfcaa6fb9..7f1556fd867d 100644 --- a/drivers/firmware/efi/libstub/efistub.h +++ b/drivers/firmware/efi/libstub/efistub.h @@ -65,6 +65,8 @@ efi_status_t check_platform_features(efi_system_table_t *sys_table_arg); efi_status_t efi_random_get_seed(efi_system_table_t *sys_table_arg); +void *get_efi_config_table(efi_system_table_t *sys_table, efi_guid_t guid); + /* Helper macros for the usual case of using simple C variables: */ #ifndef fdt_setprop_inplace_var #define fdt_setprop_inplace_var(fdt, node_offset, name, var) \ diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c index 5440ba17a1c5..0bf0190917e0 100644 --- a/drivers/firmware/efi/libstub/fdt.c +++ b/drivers/firmware/efi/libstub/fdt.c @@ -363,26 +363,17 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table, void *get_fdt(efi_system_table_t *sys_table, unsigned long *fdt_size) { - efi_guid_t fdt_guid = DEVICE_TREE_GUID; - efi_config_table_t *tables; - int i; + void *fdt; - tables = (efi_config_table_t *)sys_table->tables; + fdt = get_efi_config_table(sys_table, DEVICE_TREE_GUID); - for (i = 0; i < sys_table->nr_tables; i++) { - void *fdt; + if (!fdt) + return NULL; - if (efi_guidcmp(tables[i].guid, fdt_guid) != 0) - continue; - - fdt = (void *)tables[i].table; - if (fdt_check_header(fdt) != 0) { - pr_efi_err(sys_table, "Invalid header detected on UEFI supplied FDT, ignoring ...\n"); - return NULL; - } - *fdt_size = fdt_totalsize(fdt); - return fdt; + if (fdt_check_header(fdt) != 0) { + pr_efi_err(sys_table, "Invalid header detected on UEFI supplied FDT, ignoring ...\n"); + return NULL; } - - return NULL; + *fdt_size = fdt_totalsize(fdt); + return fdt; } From patchwork Fri Jun 7 20:51:47 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthew Garrett X-Patchwork-Id: 10982759 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 41AA815E6 for ; Fri, 7 Jun 2019 20:52:09 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2FB5328A99 for ; Fri, 7 Jun 2019 20:52:09 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 23F8928B59; Fri, 7 Jun 2019 20:52:09 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.5 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI, USER_IN_DEF_DKIM_WL autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 95B9828A99 for ; Fri, 7 Jun 2019 20:52:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730242AbfFGUwI (ORCPT ); Fri, 7 Jun 2019 16:52:08 -0400 Received: from mail-pf1-f202.google.com ([209.85.210.202]:36704 "EHLO mail-pf1-f202.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729891AbfFGUwI (ORCPT ); Fri, 7 Jun 2019 16:52:08 -0400 Received: by mail-pf1-f202.google.com with SMTP id d125so2308611pfd.3 for ; Fri, 07 Jun 2019 13:52:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=6pLYyhqQeuj0nfWPWmquK23yXvqtHKTh9c3OL20t7TU=; b=K+gicTh9STX7n0eBpP62LfAZKCIGfzW7hWLmg3hap4oYgXETFCRjP2eUQBqWGvhr/Y DubIzlkwCayAMYRdpZUgSDlvaw3wV3YtAj1ipL9RCiniZ7pj7jpf++6dPNL3uTHaYusY mkzGSWGZaovDPTGhSxYVhSN6GnYawqamKAp7t8jivW2ZxveW55pKlTSQSTsprvOIiUWw C2edFgu074EB7S/ztVWi78P4HEWsuru/ZYGtbko1xlR0k8/NkDtj5PxShnahLzWZjwKM kI6z0NYpVfw6bNpeEf/OeM8Chhzm3Y2L0NbhWgOCQcw7/akdDF841uyqESnznOJh3nah FSNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=6pLYyhqQeuj0nfWPWmquK23yXvqtHKTh9c3OL20t7TU=; b=kk8l3vin53OerOiojmWFJAY55e//osmO5Vi5MLAmx0llbedW4viSIllxLzmstDd8tu WFEeF98a/WYEEp9ArQE7y5I6Ui9k8wRaLqGy4V7BDhWdPE7vFmLiJSI3AQdgxYohha5U dtbCDtOhNcN0ks+fKsiwP7QS1vOBy/3QL1KkY52E3cNOibjGUthraQ1sKYxyhisiiUPy lXB4juVeNJhFa9E3EITU//Zo3jlOYErJ36Z5dkCd1MdwGrTXTgBFQDPfHodIUmLdFlQj M486GjV85PRbyAHMS+jS5VQcbP9yFHruBvLroIcX7x0LyqIKmDTvU7EiF3aboGixskqa 5Z9g== X-Gm-Message-State: APjAAAXHexSPeWrINxEntFnmjzUHj319sfAcAi5/NyoE8or0PZqJ0KAo hxpFB4hSvVa3D3BjfUftJY3YPL8vXf2kVg/nunNhM2+X/TgVpwrBgQXDhXJVsUYpntB3+GzFo+U z6QhXpHLByJJOa8e84lL7O41d04XgPIl3Ru89EyD/KV7Bf+XAqf4zVz7S3BDgpp1R8ewjRXiGWU SWkuyvxasRpVnJegLkM/8= X-Google-Smtp-Source: APXvYqw655nDWNbL1gUcMERF+BfXVE/8j1Nov0615++EmZODKPuPntXlIKE0cUgD21qdsQmaDChA4Q1k9Y85t1Pz5WDAeA== X-Received: by 2002:a63:2b92:: with SMTP id r140mr4811067pgr.363.1559940726994; Fri, 07 Jun 2019 13:52:06 -0700 (PDT) Date: Fri, 7 Jun 2019 13:51:47 -0700 In-Reply-To: <20190607205147.102904-1-matthewgarrett@google.com> Message-Id: <20190607205147.102904-2-matthewgarrett@google.com> Mime-Version: 1.0 References: <20190607205147.102904-1-matthewgarrett@google.com> X-Mailer: git-send-email 2.22.0.rc2.383.gf4fbbf30c2-goog Subject: [PATCH V2 2/2] tpm: Don't duplicate events from the final event log in the TCG2 log From: Matthew Garrett To: linux-integrity@vger.kernel.org Cc: peterhuewe@gmx.de, jarkko.sakkinen@linux.intel.com, jgg@ziepe.ca, linux-efi@vger.kernel.org, ard.biesheuvel@linaro.org, Matthew Garrett , Matthew Garrett , Joe Richey Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP After the first call to GetEventLog() on UEFI systems using the TCG2 crypto agile log format, any further log events (other than those triggered by ExitBootServices()) will be logged in both the main log and also in the Final Events Log. While the kernel only calls GetEventLog() immediately before ExitBootServices(), we can't control whether earlier parts of the boot process have done so. This will result in log entries that exist in both logs, and so the current approach of simply appending the Final Event Log to the main log will result in events being duplicated. We can avoid this problem by looking at the size of the Final Event Log just before we call ExitBootServices() and exporting this to the main kernel. The kernel can then skip over all events that occured before ExitBootServices() and only append events that were not also logged to the main log. Signed-off-by: Matthew Garrett Reported-by: Joe Richey Suggested-by: Joe Richey Acked-by: Ard Biesheuvel Reviewed-by: Jarkko Sakkinen --- drivers/char/tpm/eventlog/efi.c | 11 ++++++++++- drivers/firmware/efi/libstub/tpm.c | 30 ++++++++++++++++++++++++++++++ drivers/firmware/efi/tpm.c | 2 +- include/linux/efi.h | 1 + 4 files changed, 42 insertions(+), 2 deletions(-) diff --git a/drivers/char/tpm/eventlog/efi.c b/drivers/char/tpm/eventlog/efi.c index 9179cf6bdee9..be6540f2cb3d 100644 --- a/drivers/char/tpm/eventlog/efi.c +++ b/drivers/char/tpm/eventlog/efi.c @@ -80,6 +80,8 @@ int tpm_read_log_efi(struct tpm_chip *chip) goto out; } + efi_tpm_final_log_size -= log_tbl->final_events_preboot_size; + tmp = krealloc(log->bios_event_log, log_size + efi_tpm_final_log_size, GFP_KERNEL); @@ -90,8 +92,15 @@ int tpm_read_log_efi(struct tpm_chip *chip) } log->bios_event_log = tmp; + + /* + * Copy any of the final events log that didn't also end up in the + * main log. Events can be logged in both if events are generated + * between GetEventLog() and ExitBootServices(). + */ memcpy((void *)log->bios_event_log + log_size, - final_tbl->events, efi_tpm_final_log_size); + final_tbl->events + log_tbl->final_events_preboot_size, + efi_tpm_final_log_size); log->bios_event_log_end = log->bios_event_log + log_size + efi_tpm_final_log_size; diff --git a/drivers/firmware/efi/libstub/tpm.c b/drivers/firmware/efi/libstub/tpm.c index 6b3b507a54eb..eb9af83e4d59 100644 --- a/drivers/firmware/efi/libstub/tpm.c +++ b/drivers/firmware/efi/libstub/tpm.c @@ -64,11 +64,13 @@ void efi_retrieve_tpm2_eventlog(efi_system_table_t *sys_table_arg) efi_status_t status; efi_physical_addr_t log_location = 0, log_last_entry = 0; struct linux_efi_tpm_eventlog *log_tbl = NULL; + struct efi_tcg2_final_events_table *final_events_table; unsigned long first_entry_addr, last_entry_addr; size_t log_size, last_entry_size; efi_bool_t truncated; int version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_2; void *tcg2_protocol = NULL; + int final_events_size = 0; status = efi_call_early(locate_protocol, &tcg2_guid, NULL, &tcg2_protocol); @@ -134,8 +136,36 @@ void efi_retrieve_tpm2_eventlog(efi_system_table_t *sys_table_arg) return; } + /* + * Figure out whether any events have already been logged to the + * final events structure, and if so how much space they take up + */ + final_events_table = get_efi_config_table(sys_table_arg, + LINUX_EFI_TPM_FINAL_LOG_GUID); + if (final_events_table && final_events_table->nr_events) { + struct tcg_pcr_event2_head *header; + int offset; + void *data; + int event_size; + int i = final_events_table->nr_events; + + data = (void *)final_events_table; + offset = sizeof(final_events_table->version) + + sizeof(final_events_table->nr_events); + + while (i > 0) { + header = data + offset + final_events_size; + event_size = __calc_tpm2_event_size(header, + (void *)(long)log_location, + false); + final_events_size += event_size; + i--; + } + } + memset(log_tbl, 0, sizeof(*log_tbl) + log_size); log_tbl->size = log_size; + log_tbl->final_events_preboot_size = final_events_size; log_tbl->version = version; memcpy(log_tbl->log, (void *) first_entry_addr, log_size); diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c index 2c912ea08166..0bdceb5913aa 100644 --- a/drivers/firmware/efi/tpm.c +++ b/drivers/firmware/efi/tpm.c @@ -76,7 +76,7 @@ int __init efi_tpm_eventlog_init(void) goto out; } - tbl_size = tpm2_calc_event_log_size(efi.tpm_final_log + tbl_size = tpm2_calc_event_log_size((void *)efi.tpm_final_log + sizeof(final_tbl->version) + sizeof(final_tbl->nr_events), final_tbl->nr_events, diff --git a/include/linux/efi.h b/include/linux/efi.h index e33c70a52a9d..2a26004a9bdb 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h @@ -1703,6 +1703,7 @@ struct linux_efi_random_seed { struct linux_efi_tpm_eventlog { u32 size; + u32 final_events_preboot_size; u8 version; u8 log[]; };