From: Thiebaud Weksteen <tweek@google.com> To: linux-efi@vger.kernel.org, linux-integrity@vger.kernel.org, tpmdd-devel@lists.sourceforge.net Cc: ard.biesheuvel@linaro.org, matt@codeblueprint.co.uk, linux-kernel@vger.kernel.org, mjg59@google.com, peterhuewe@gmx.de, jarkko.sakkinen@linux.intel.com, jgunthorpe@obsidianresearch.com, tpmdd@selhorst.net, Thiebaud Weksteen <tweek@google.com> Subject: [PATCH v3 0/5] Call GetEventLog before ExitBootServices Date: Wed, 20 Sep 2017 10:13:35 +0200 [thread overview] Message-ID: <20170920081340.7413-1-tweek@google.com> (raw) With TPM 1.2, the ACPI table ("TCPA") has two fields to recover the Event Log Area (LAML and LASA). These logs are useful to understand and rebuild the final values of PCRs. With TPM 2.0, the ACPI table ("TPM2") does not contain these fields anymore. The recommended method is now to call the GetEventLog EFI protocol before ExitBootServices. Implement this method within the EFI stub and create a copy of the logs for the TPM device using a Linux-specific EFI configuration table (LINUX_EFI_TPM_EVENT_LOG). This will create /sys/kernel/security/tpm0/binary_bios_measurements for TPM 2.0 devices (similarly to the current behaviour for TPM 1.2 devices). Two formats for the log entries exist: TPM 1.2 (SHA1) and TPM 2.0 (Crypto Agile). This patch set only retrieves the first type of logs. The second type will be implemented in a subsequent patch set. According to the specifications[1], once GetEventLog has been called, future events shall be stored in a separate EFI configuration table (EFI_TCG2_FINAL_EVENTS_TABLE). Events stored in this table are not processed in this patch set as they are stored in the Crypto Agile format. These could eventually be merged with the new table for a unified view of the logs from userspace. [1] TCG EFI Protocol Specification, Revision 00.13, March 30, 2016 https://trustedcomputinggroup.org/wp-content/uploads/EFI-Protocol-Specification-rev13-160330final.pdf ------------------------------------------------------------------------------- Patchset Changelog: Version 3: - Move event log providers (acpi and of) to tpm_eventlog_*.c - Move efi changes from PATCH 3 to PATCH 2 - Change return value of tpm_read_log_acpi and tpm_read_log_of - Change iounmap to memunmap calls - Use log_tbl as variable name for consistency - Fix kbuild failures Version 2: - Move tpm_eventlog.h to top include directory, add commit for this. - Use EFI_LOADER_DATA to store the configuration table - Whitespace and new lines fixes Thiebaud Weksteen (5): tpm: move tpm_eventlog.h outside of drivers folder tpm: rename event log provider files tpm: add event log format version efi: call get_event_log before ExitBootServices tpm: parse TPM event logs based on EFI table arch/x86/boot/compressed/eboot.c | 1 + drivers/char/tpm/Makefile | 5 +- drivers/char/tpm/tpm-chip.c | 3 +- drivers/char/tpm/tpm-interface.c | 2 +- drivers/char/tpm/tpm.h | 35 ++++++++-- drivers/char/tpm/tpm1_eventlog.c | 13 +++- drivers/char/tpm/tpm2_eventlog.c | 2 +- .../char/tpm/{tpm_acpi.c => tpm_eventlog_acpi.c} | 4 +- drivers/char/tpm/tpm_eventlog_efi.c | 66 ++++++++++++++++++ drivers/char/tpm/{tpm_of.c => tpm_eventlog_of.c} | 6 +- drivers/firmware/efi/Makefile | 2 +- drivers/firmware/efi/efi.c | 4 ++ drivers/firmware/efi/libstub/Makefile | 3 +- drivers/firmware/efi/libstub/tpm.c | 81 ++++++++++++++++++++++ drivers/firmware/efi/tpm.c | 40 +++++++++++ include/linux/efi.h | 46 ++++++++++++ {drivers/char/tpm => include/linux}/tpm_eventlog.h | 35 +++------- 17 files changed, 304 insertions(+), 44 deletions(-) rename drivers/char/tpm/{tpm_acpi.c => tpm_eventlog_acpi.c} (97%) create mode 100644 drivers/char/tpm/tpm_eventlog_efi.c rename drivers/char/tpm/{tpm_of.c => tpm_eventlog_of.c} (93%) create mode 100644 drivers/firmware/efi/tpm.c rename {drivers/char/tpm => include/linux}/tpm_eventlog.h (77%) -- 2.14.1.821.g8fa685d3b7-goog
WARNING: multiple messages have this Message-ID (diff)
From: Thiebaud Weksteen <tweek-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org> To: linux-efi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-integrity-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, tpmdd-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org Cc: ard.biesheuvel-QSEj5FYQhm4dnm+yROfE0A@public.gmane.org, matt-mF/unelCI9GS6iBeEJttW/XRex20P6io@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, mjg59-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org, peterhuewe-Mmb7MZpHnFY@public.gmane.org, jarkko.sakkinen-VuQAYsv1563Yd54FQh9/CA@public.gmane.org, jgunthorpe-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org, tpmdd-yWjUBOtONefk1uMJSBkQmQ@public.gmane.org, Thiebaud Weksteen <tweek-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org> Subject: [PATCH v3 0/5] Call GetEventLog before ExitBootServices Date: Wed, 20 Sep 2017 10:13:35 +0200 [thread overview] Message-ID: <20170920081340.7413-1-tweek@google.com> (raw) With TPM 1.2, the ACPI table ("TCPA") has two fields to recover the Event Log Area (LAML and LASA). These logs are useful to understand and rebuild the final values of PCRs. With TPM 2.0, the ACPI table ("TPM2") does not contain these fields anymore. The recommended method is now to call the GetEventLog EFI protocol before ExitBootServices. Implement this method within the EFI stub and create a copy of the logs for the TPM device using a Linux-specific EFI configuration table (LINUX_EFI_TPM_EVENT_LOG). This will create /sys/kernel/security/tpm0/binary_bios_measurements for TPM 2.0 devices (similarly to the current behaviour for TPM 1.2 devices). Two formats for the log entries exist: TPM 1.2 (SHA1) and TPM 2.0 (Crypto Agile). This patch set only retrieves the first type of logs. The second type will be implemented in a subsequent patch set. According to the specifications[1], once GetEventLog has been called, future events shall be stored in a separate EFI configuration table (EFI_TCG2_FINAL_EVENTS_TABLE). Events stored in this table are not processed in this patch set as they are stored in the Crypto Agile format. These could eventually be merged with the new table for a unified view of the logs from userspace. [1] TCG EFI Protocol Specification, Revision 00.13, March 30, 2016 https://trustedcomputinggroup.org/wp-content/uploads/EFI-Protocol-Specification-rev13-160330final.pdf ------------------------------------------------------------------------------- Patchset Changelog: Version 3: - Move event log providers (acpi and of) to tpm_eventlog_*.c - Move efi changes from PATCH 3 to PATCH 2 - Change return value of tpm_read_log_acpi and tpm_read_log_of - Change iounmap to memunmap calls - Use log_tbl as variable name for consistency - Fix kbuild failures Version 2: - Move tpm_eventlog.h to top include directory, add commit for this. - Use EFI_LOADER_DATA to store the configuration table - Whitespace and new lines fixes Thiebaud Weksteen (5): tpm: move tpm_eventlog.h outside of drivers folder tpm: rename event log provider files tpm: add event log format version efi: call get_event_log before ExitBootServices tpm: parse TPM event logs based on EFI table arch/x86/boot/compressed/eboot.c | 1 + drivers/char/tpm/Makefile | 5 +- drivers/char/tpm/tpm-chip.c | 3 +- drivers/char/tpm/tpm-interface.c | 2 +- drivers/char/tpm/tpm.h | 35 ++++++++-- drivers/char/tpm/tpm1_eventlog.c | 13 +++- drivers/char/tpm/tpm2_eventlog.c | 2 +- .../char/tpm/{tpm_acpi.c => tpm_eventlog_acpi.c} | 4 +- drivers/char/tpm/tpm_eventlog_efi.c | 66 ++++++++++++++++++ drivers/char/tpm/{tpm_of.c => tpm_eventlog_of.c} | 6 +- drivers/firmware/efi/Makefile | 2 +- drivers/firmware/efi/efi.c | 4 ++ drivers/firmware/efi/libstub/Makefile | 3 +- drivers/firmware/efi/libstub/tpm.c | 81 ++++++++++++++++++++++ drivers/firmware/efi/tpm.c | 40 +++++++++++ include/linux/efi.h | 46 ++++++++++++ {drivers/char/tpm => include/linux}/tpm_eventlog.h | 35 +++------- 17 files changed, 304 insertions(+), 44 deletions(-) rename drivers/char/tpm/{tpm_acpi.c => tpm_eventlog_acpi.c} (97%) create mode 100644 drivers/char/tpm/tpm_eventlog_efi.c rename drivers/char/tpm/{tpm_of.c => tpm_eventlog_of.c} (93%) create mode 100644 drivers/firmware/efi/tpm.c rename {drivers/char/tpm => include/linux}/tpm_eventlog.h (77%) -- 2.14.1.821.g8fa685d3b7-goog
next reply other threads:[~2017-09-20 8:14 UTC|newest] Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-09-20 8:13 Thiebaud Weksteen [this message] 2017-09-20 8:13 ` [PATCH v3 0/5] Call GetEventLog before ExitBootServices Thiebaud Weksteen 2017-09-20 8:13 ` [PATCH v3 1/5] tpm: move tpm_eventlog.h outside of drivers folder Thiebaud Weksteen 2017-09-20 8:13 ` Thiebaud Weksteen 2017-09-20 8:13 ` [PATCH v3 2/5] tpm: rename event log provider files Thiebaud Weksteen 2017-09-20 8:13 ` Thiebaud Weksteen via tpmdd-devel 2017-09-26 11:10 ` Jarkko Sakkinen 2017-09-20 8:13 ` [PATCH v3 3/5] tpm: add event log format version Thiebaud Weksteen 2017-09-20 8:13 ` Thiebaud Weksteen via tpmdd-devel 2017-09-20 8:13 ` [PATCH v3 4/5] efi: call get_event_log before ExitBootServices Thiebaud Weksteen 2017-09-20 8:13 ` Thiebaud Weksteen via tpmdd-devel 2017-09-26 11:45 ` Jarkko Sakkinen 2017-09-26 11:45 ` Jarkko Sakkinen 2017-09-26 12:49 ` Thiebaud Weksteen 2017-09-29 17:16 ` Jarkko Sakkinen 2017-10-04 10:51 ` Jarkko Sakkinen 2017-10-04 10:51 ` Jarkko Sakkinen 2017-10-04 11:12 ` Thiebaud Weksteen 2017-10-10 14:14 ` Jarkko Sakkinen 2017-10-11 1:54 ` James Morris 2017-10-11 1:54 ` James Morris 2017-10-11 11:52 ` Jarkko Sakkinen 2017-10-11 11:53 ` Jarkko Sakkinen 2017-10-11 11:53 ` Jarkko Sakkinen 2017-10-12 11:38 ` Jarkko Sakkinen 2017-10-12 15:03 ` Javier Martinez Canillas 2017-10-12 15:03 ` Javier Martinez Canillas 2017-10-13 19:47 ` Jarkko Sakkinen 2017-10-13 19:47 ` Jarkko Sakkinen 2017-10-16 11:34 ` Jarkko Sakkinen 2017-10-16 11:28 ` Jarkko Sakkinen 2017-10-16 11:28 ` Jarkko Sakkinen 2017-10-16 11:49 ` Jarkko Sakkinen 2017-10-17 8:00 ` Thiebaud Weksteen 2017-10-17 8:00 ` Thiebaud Weksteen 2017-10-18 15:11 ` Jarkko Sakkinen 2017-10-18 15:11 ` Jarkko Sakkinen 2017-10-26 18:58 ` Jarkko Sakkinen 2017-10-26 18:58 ` Jarkko Sakkinen 2017-10-04 11:20 ` Jarkko Sakkinen 2017-10-04 11:20 ` Jarkko Sakkinen 2018-03-05 15:40 ` Marc-André Lureau 2018-03-05 15:40 ` Marc-André Lureau 2018-03-06 10:15 ` Thiebaud Weksteen 2018-03-06 10:15 ` Thiebaud Weksteen 2017-09-20 8:13 ` [PATCH v3 5/5] tpm: parse TPM event logs based on EFI table Thiebaud Weksteen 2017-09-20 16:40 ` Jason Gunthorpe 2017-09-20 16:40 ` Jason Gunthorpe 2017-09-21 15:13 ` [PATCH v3 0/5] Call GetEventLog before ExitBootServices Jarkko Sakkinen 2017-09-21 15:13 ` Jarkko Sakkinen 2017-09-26 11:17 ` [tpmdd-devel] " Javier Martinez Canillas 2017-09-26 11:17 ` Javier Martinez Canillas
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20170920081340.7413-1-tweek@google.com \ --to=tweek@google.com \ --cc=ard.biesheuvel@linaro.org \ --cc=jarkko.sakkinen@linux.intel.com \ --cc=jgunthorpe@obsidianresearch.com \ --cc=linux-efi@vger.kernel.org \ --cc=linux-integrity@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=matt@codeblueprint.co.uk \ --cc=mjg59@google.com \ --cc=peterhuewe@gmx.de \ --cc=tpmdd-devel@lists.sourceforge.net \ --cc=tpmdd@selhorst.net \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.