Re: [PATCH v2] efi: Check the number of EFI configuration tables entries
On Tue, 2019-04-16 at 10:59 +0100, Rob Bradford wrote: > Only try and access the EFI configuration tables if there there are > any > reported. This allows EFI to be continued to used on systems where > there > are no configuration table entries. > > v2: Move return on nr_tables==0 earlier > > Signed-off-by: Rob Bradford > --- > arch/x86/platform/efi/quirks.c | 3 +++ > drivers/firmware/efi/efi.c | 3 +++ > 2 files changed, 6 insertions(+) > > diff --git a/arch/x86/platform/efi/quirks.c > b/arch/x86/platform/efi/quirks.c > index 95e77a667ba5..6b9a4792242b 100644 > --- a/arch/x86/platform/efi/quirks.c > +++ b/arch/x86/platform/efi/quirks.c > @@ -471,6 +471,9 @@ int __init efi_reuse_config(u64 tables, int > nr_tables) > void *p, *tablep; > struct efi_setup_data *data; > > + if (nr_tables == 0) > + return 0; > + > if (!efi_setup) > return 0; > > diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c > index 415849bab233..185424a8b879 100644 > --- a/drivers/firmware/efi/efi.c > +++ b/drivers/firmware/efi/efi.c > @@ -628,6 +628,9 @@ int __init > efi_config_init(efi_config_table_type_t *arch_tables) > void *config_tables; > int sz, ret; > > + if (efi.systab->nr_tables == 0) > + return 0; > + > if (efi_enabled(EFI_64BIT)) > sz = sizeof(efi_config_table_64_t); > else Any chance of getting this into the tree? Without this we can't boot the kernel in EFI mode on our KVM based hypervisor[1] & firmware[2] as it does not provide any tables, nor does it need to. Rob [1] https://github.com/intel/cloud-hypervisor [2] https://github.com/intel/rust-hypervisor-firmware
Re: [PATCH V7 0/4] Add support for crypto agile logs
On Mon, May 20, 2019 at 01:54:57PM -0700, Matthew Garrett wrote: > Identical to previous version except without the KSAN workaround - Ard > has a better solution for that. I'll check in detail through tomorrow but probably will get merged now that we have Ard's ack's (thanks Ard for all the trouble!) :-) /Jarkko
Re: [PATCH V7 2/4] tpm: Reserve the TPM final events table
On Mon, 20 May 2019 at 21:55, Matthew Garrett wrote:
>
> From: Matthew Garrett
>
> UEFI systems provide a boot services protocol for obtaining the TPM
> event log, but this is unusable after ExitBootServices() is called.
> Unfortunately ExitBootServices() itself triggers additional TPM events
> that then can't be obtained using this protocol. The platform provides a
> mechanism for the OS to obtain these events by recording them to a
> separate UEFI configuration table which the OS can then map.
>
> Unfortunately this table isn't self describing in terms of providing its
> length, so we need to parse the events inside it to figure out how long
> it is. Since the table isn't mapped at this point, we need to extend the
> length calculation function to be able to map the event as it goes
> along.
>
> (Fixes by Bartosz Szczepanek )
>
> Signed-off-by: Matthew Garrett
Acked-by: Ard Biesheuvel
> ---
> drivers/char/tpm/eventlog/tpm2.c | 2 +-
> drivers/firmware/efi/efi.c | 2 +
> drivers/firmware/efi/tpm.c | 62 ++-
> include/linux/efi.h | 9 +++
> include/linux/tpm_eventlog.h | 102 ---
> 5 files changed, 164 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/char/tpm/eventlog/tpm2.c
> b/drivers/char/tpm/eventlog/tpm2.c
> index 1a977bdd3bd2..de1d9f7e5a92 100644
> --- a/drivers/char/tpm/eventlog/tpm2.c
> +++ b/drivers/char/tpm/eventlog/tpm2.c
> @@ -40,7 +40,7 @@
> static size_t calc_tpm2_event_size(struct tcg_pcr_event2_head *event,
>struct tcg_pcr_event *event_header)
> {
> - return __calc_tpm2_event_size(event, event_header);
> + return __calc_tpm2_event_size(event, event_header, false);
> }
>
> static void *tpm2_bios_measurements_start(struct seq_file *m, loff_t *pos)
> diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
> index 55b77c576c42..6b11c41e0575 100644
> --- a/drivers/firmware/efi/efi.c
> +++ b/drivers/firmware/efi/efi.c
> @@ -53,6 +53,7 @@ struct efi __read_mostly efi = {
> .mem_attr_table = EFI_INVALID_TABLE_ADDR,
> .rng_seed = EFI_INVALID_TABLE_ADDR,
> .tpm_log= EFI_INVALID_TABLE_ADDR,
> + .tpm_final_log = EFI_INVALID_TABLE_ADDR,
> .mem_reserve= EFI_INVALID_TABLE_ADDR,
> };
> EXPORT_SYMBOL(efi);
> @@ -485,6 +486,7 @@ static __initdata efi_config_table_type_t common_tables[]
> = {
> {EFI_MEMORY_ATTRIBUTES_TABLE_GUID, "MEMATTR", _attr_table},
> {LINUX_EFI_RANDOM_SEED_TABLE_GUID, "RNG", _seed},
> {LINUX_EFI_TPM_EVENT_LOG_GUID, "TPMEventLog", _log},
> + {LINUX_EFI_TPM_FINAL_LOG_GUID, "TPMFinalLog", _final_log},
> {LINUX_EFI_MEMRESERVE_TABLE_GUID, "MEMRESERVE", _reserve},
> {NULL_GUID, NULL, NULL},
> };
> diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c
> index 3a689b40ccc0..2c912ea08166 100644
> --- a/drivers/firmware/efi/tpm.c
> +++ b/drivers/firmware/efi/tpm.c
> @@ -4,34 +4,90 @@
> * Thiebaud Weksteen
> */
>
> +#define TPM_MEMREMAP(start, size) early_memremap(start, size)
> +#define TPM_MEMUNMAP(start, size) early_memunmap(start, size)
> +
> #include
> #include
> #include
> +#include
>
> #include
>
> +int efi_tpm_final_log_size;
> +EXPORT_SYMBOL(efi_tpm_final_log_size);
> +
> +static int tpm2_calc_event_log_size(void *data, int count, void *size_info)
> +{
> + struct tcg_pcr_event2_head *header;
> + int event_size, size = 0;
> +
> + while (count > 0) {
> + header = data + size;
> + event_size = __calc_tpm2_event_size(header, size_info, true);
> + if (event_size == 0)
> + return -1;
> + size += event_size;
> + count--;
> + }
> +
> + return size;
> +}
> +
> /*
> * Reserve the memory associated with the TPM Event Log configuration table.
> */
> int __init efi_tpm_eventlog_init(void)
> {
> struct linux_efi_tpm_eventlog *log_tbl;
> + struct efi_tcg2_final_events_table *final_tbl;
> unsigned int tbl_size;
> + int ret = 0;
>
> - if (efi.tpm_log == EFI_INVALID_TABLE_ADDR)
> + if (efi.tpm_log == EFI_INVALID_TABLE_ADDR) {
> + /*
> +* We can't calculate the size of the final events without the
> +* first entry in the TPM log, so bail here.
> +*/
> return 0;
> + }
>
> log_tbl = early_memremap(efi.tpm_log, sizeof(*log_tbl));
> if (!log_tbl) {
> pr_err("Failed to map TPM Event Log table @ 0x%lx\n",
> - efi.tpm_log);
> + efi.tpm_log);
> efi.tpm_log = EFI_INVALID_TABLE_ADDR;
> return -ENOMEM;
> }
>
> tbl_size = sizeof(*log_tbl) + log_tbl->size;
> memblock_reserve(efi.tpm_log, tbl_size);
> +
> +
Re: [PATCH V7 4/4] efi: Attempt to get the TCG2 event log in the boot stub
On Mon, 20 May 2019 at 21:55, Matthew Garrett wrote:
>
> From: Matthew Garrett
>
> Right now we only attempt to obtain the SHA1-only event log. The
> protocol also supports a crypto agile log format, which contains digests
> for all algorithms in use. Attempt to obtain this first, and fall back
> to obtaining the older format if the system doesn't support it. This is
> lightly complicated by the event sizes being variable (as we don't know
> in advance which algorithms are in use), and the interface giving us
> back a pointer to the start of the final entry rather than a pointer to
> the end of the log - as a result, we need to parse the final entry to
> figure out its length in order to know how much data to copy up to the
> OS.
>
> Signed-off-by: Matthew Garrett
Provided that this gets a tested-by from Bartosz,
Acked-by: Ard Biesheuvel
> ---
> drivers/firmware/efi/libstub/tpm.c | 50 --
> 1 file changed, 33 insertions(+), 17 deletions(-)
>
> diff --git a/drivers/firmware/efi/libstub/tpm.c
> b/drivers/firmware/efi/libstub/tpm.c
> index 5bd04f75d8d6..6b3b507a54eb 100644
> --- a/drivers/firmware/efi/libstub/tpm.c
> +++ b/drivers/firmware/efi/libstub/tpm.c
> @@ -57,7 +57,7 @@ void efi_enable_reset_attack_mitigation(efi_system_table_t
> *sys_table_arg)
>
> #endif
>
> -static void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg)
> +void efi_retrieve_tpm2_eventlog(efi_system_table_t *sys_table_arg)
> {
> efi_guid_t tcg2_guid = EFI_TCG2_PROTOCOL_GUID;
> efi_guid_t linux_eventlog_guid = LINUX_EFI_TPM_EVENT_LOG_GUID;
> @@ -67,6 +67,7 @@ static void
> efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg)
> unsigned long first_entry_addr, last_entry_addr;
> size_t log_size, last_entry_size;
> efi_bool_t truncated;
> + int version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_2;
> void *tcg2_protocol = NULL;
>
> status = efi_call_early(locate_protocol, _guid, NULL,
> @@ -74,14 +75,20 @@ static void
> efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg)
> if (status != EFI_SUCCESS)
> return;
>
> - status = efi_call_proto(efi_tcg2_protocol, get_event_log,
> tcg2_protocol,
> - EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2,
> - _location, _last_entry, );
> - if (status != EFI_SUCCESS)
> - return;
> + status = efi_call_proto(efi_tcg2_protocol, get_event_log,
> + tcg2_protocol, version, _location,
> + _last_entry, );
> +
> + if (status != EFI_SUCCESS || !log_location) {
> + version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2;
> + status = efi_call_proto(efi_tcg2_protocol, get_event_log,
> + tcg2_protocol, version, _location,
> + _last_entry, );
> + if (status != EFI_SUCCESS || !log_location)
> + return;
> +
> + }
>
> - if (!log_location)
> - return;
> first_entry_addr = (unsigned long) log_location;
>
> /*
> @@ -96,8 +103,23 @@ static void
> efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg)
> * We need to calculate its size to deduce the full size of
> * the logs.
> */
> - last_entry_size = sizeof(struct tcpa_event) +
> - ((struct tcpa_event *) last_entry_addr)->event_size;
> + if (version == EFI_TCG2_EVENT_LOG_FORMAT_TCG_2) {
> + /*
> +* The TCG2 log format has variable length entries,
> +* and the information to decode the hash algorithms
> +* back into a size is contained in the first entry -
> +* pass a pointer to the final entry (to calculate its
> +* size) and the first entry (so we know how long each
> +* digest is)
> +*/
> + last_entry_size =
> + __calc_tpm2_event_size((void
> *)last_entry_addr,
> + (void
> *)(long)log_location,
> + false);
> + } else {
> + last_entry_size = sizeof(struct tcpa_event) +
> + ((struct tcpa_event *)
> last_entry_addr)->event_size;
> + }
> log_size = log_last_entry - log_location + last_entry_size;
> }
>
> @@ -114,7 +136,7 @@ static void
> efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg)
>
> memset(log_tbl, 0, sizeof(*log_tbl) + log_size);
> log_tbl->size = log_size;
> - log_tbl->version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2;
> +
