[PATCH 0/4 v3] measure initrd data loaded by the EFI stub

[PATCH 0/4 v3] measure initrd data loaded by the EFI stub

[Ilias Apalodimas]

Hi!

This is a respin of [1].
This enables initrd measuring when loaded directly by the kernel EFI stub.
It ensures that the initrd observed and used by the OS is the same one that
got measured into the TPM, which is difficult to guarantee in the current
otherwise.

There's a couple of changes compared to the original RFC:
- Ard fixed the x86 assembly for providing the extra arguments needed and I
  rebased it on top of 
  commit 22aa45cb465b ("x86/efi: Restore Firmware IDT before calling ExitBootServices()")
- Instead of EV_IPL we are now using EV_EVENT_TAG. EV_IPL was marked
  as deprecated up until the latest PC client spec [2] (and deprecated  in
  older revisions [3]).  It's current description is: 
  "It may be used by Boot Manager Code to measure events."

  EV_EVENT_TAG on the other hand seems more appropriate as it's defined as:
  "Used for PCRs defined for OS and application usage.  Defined for use by
  Host Platform Operating System or Software."
- We are only measuring the initrd if it was loaded using the LOAD_FILE2
  protocol.  This is not what we probably want in the long run, but let's
  only enforce the measurement on the new way of loading an initrd for now.

Questions:
- Since GRUB seems to be using PCRs 8/9 for it's EV_IPL events, maybe we should
  use something completely different?

I did test this on arm64 and x86_64 (incl mixed mode). Here's a snip of the
EventLog
<snip>
  - EventNum: 23
    PCRIndex: 9
    EventType: EV_EVENT_TAG
    DigestCount: 4
    Digests:
      - AlgorithmId: sha1
        Digest: "53fe403e0d763f6a4e3384e8112d6463e7ddf12b"
      - AlgorithmId: sha256
        Digest: "28f24eab8cb433e4b8cbce0f96b7ad0aa541a4b905f748491139e42f0adc8026"
      - AlgorithmId: sha384
        Digest: "848389ab172267dcf9a0b873c7534b3d969e915b525c9fe2b57db47f4ecd8283b18d6e0cff84099893d589447c2bea55"
      - AlgorithmId: sha512
        Digest: "438b254c92e6716a5a1ba0338f5e751f3dd27782481e5698911b4cd33a98efdd776459d56781c5ae4a8d0b9945246d04ab243d4dbe03f49542e2455ac66db584"
    EventSize: 21
    Event: "ec223b8f0d0000004c696e757820696e6974726400"
<snip>

[1] https://lore.kernel.org/linux-efi/20201102170634.20575-1-ardb@kernel.org/
[2] https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf
[3] https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf

Ard Biesheuvel (3):
  efi/libstub: add prototype of
    efi_tcg2_protocol::hash_log_extend_event()
  efi/libstub: x86/mixed: increase supported argument count
  efi/libstub: consolidate initrd handling across architectures

Ilias Apalodimas (1):
  efi/libstub: measure loaded initrd info into the TPM

 arch/x86/boot/compressed/efi_thunk_64.S       | 14 +++-
 arch/x86/include/asm/efi.h                    | 14 +++-
 arch/x86/platform/efi/efi_thunk_64.S          | 14 +++-
 .../firmware/efi/libstub/efi-stub-helper.c    | 73 ++++++++++++++++---
 drivers/firmware/efi/libstub/efi-stub.c       | 10 +--
 drivers/firmware/efi/libstub/efistub.h        | 30 +++++++-
 drivers/firmware/efi/libstub/x86-stub.c       | 26 +++----
 7 files changed, 134 insertions(+), 47 deletions(-)

-- 
2.33.1

[PATCH 1/4 v3] efi/libstub: add prototype of efi_tcg2_protocol::hash_log_extend_event()

[Ilias Apalodimas]

From: Ard Biesheuvel <ardb@kernel.org>

Define the right prototype for efi_tcg2_protocol::hash_log_extend_event()
and add the required structs so we can start using it to measure the initrd
into the TPM if it was loaded by the EFI stub itself.

Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
---
Changes since v1,2:
- None
Changes since Ard's RFC:
- Added event_tag related definitions
- added a missing __packed on efi_tcg2_event
 arch/x86/include/asm/efi.h             |  4 ++++
 drivers/firmware/efi/libstub/efistub.h | 29 +++++++++++++++++++++++++-
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
index 4d0b126835b8..85f156f8ef81 100644
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -308,6 +308,10 @@ static inline u32 efi64_convert_status(efi_status_t status)
 #define __efi64_argmap_query_mode(gop, mode, size, info)		\
 	((gop), (mode), efi64_zero_upper(size), efi64_zero_upper(info))
 
+/* TCG2 protocol */
+#define __efi64_argmap_hash_log_extend_event(prot, fl, addr, size, ev)	\
+	((prot), (fl), 0ULL, (u64)(addr), 0ULL, (u64)(size), 0ULL, ev)
+
 /*
  * The macros below handle the plumbing for the argument mapping. To add a
  * mapping for a specific EFI method, simply define a macro
diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h
index cde0a2ef507d..a2825c435158 100644
--- a/drivers/firmware/efi/libstub/efistub.h
+++ b/drivers/firmware/efi/libstub/efistub.h
@@ -667,6 +667,29 @@ union apple_properties_protocol {
 
 typedef u32 efi_tcg2_event_log_format;
 
+#define INITRD_EVENT_TAG_ID 0x8F3B22ECU
+#define EV_EVENT_TAG 0x00000006U
+#define EFI_TCG2_EVENT_HEADER_VERSION	0x1
+
+struct efi_tcg2_event {
+	u32		event_size;
+	struct {
+		u32	header_size;
+		u16	header_version;
+		u32	pcr_index;
+		u32	event_type;
+	} __packed event_header;
+	/* u8[] event follows here */
+} __packed;
+
+struct efi_tcg2_tagged_event {
+	u32 tagged_event_id;
+	u32 tagged_event_data_size;
+	/* u8  tagged event data follows here */
+} __packed;
+
+typedef struct efi_tcg2_event efi_tcg2_event_t;
+typedef struct efi_tcg2_tagged_event efi_tcg2_tagged_event_t;
 typedef union efi_tcg2_protocol efi_tcg2_protocol_t;
 
 union efi_tcg2_protocol {
@@ -677,7 +700,11 @@ union efi_tcg2_protocol {
 						       efi_physical_addr_t *,
 						       efi_physical_addr_t *,
 						       efi_bool_t *);
-		void *hash_log_extend_event;
+		efi_status_t (__efiapi *hash_log_extend_event)(efi_tcg2_protocol_t *,
+							       u64,
+							       efi_physical_addr_t,
+							       u64,
+							       const efi_tcg2_event_t *);
 		void *submit_command;
 		void *get_active_pcr_banks;
 		void *set_active_pcr_banks;
-- 
2.33.1

[PATCH 2/4 v3] efi/libstub: x86/mixed: increase supported argument count

[Ilias Apalodimas]

From: Ard Biesheuvel <ardb@kernel.org>

Increase the number of arguments supported by mixed mode calls, so that
we will be able to call into the TCG2 protocol to measure the initrd
and extend the associated PCR. This involves the TCG2 protocol's
hash_log_extend_event() method, which takes five arguments, three of
which are u64 and need to be split, producing a total of 8 outgoing

Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
---
Changes since v1,2:
- Rebased on top of 22aa45cb465b
 arch/x86/boot/compressed/efi_thunk_64.S | 14 +++++++++++---
 arch/x86/include/asm/efi.h              | 10 ++++++----
 arch/x86/platform/efi/efi_thunk_64.S    | 14 ++++++++++++--
 3 files changed, 29 insertions(+), 9 deletions(-)

diff --git a/arch/x86/boot/compressed/efi_thunk_64.S b/arch/x86/boot/compressed/efi_thunk_64.S
index 8bb92e9f4e97..d05f781d54f2 100644
--- a/arch/x86/boot/compressed/efi_thunk_64.S
+++ b/arch/x86/boot/compressed/efi_thunk_64.S
@@ -26,8 +26,6 @@ SYM_FUNC_START(__efi64_thunk)
 	push	%rbp
 	push	%rbx
 
-	leaq	1f(%rip), %rbp
-
 	movl	%ds, %eax
 	push	%rax
 	movl	%es, %eax
@@ -35,6 +33,11 @@ SYM_FUNC_START(__efi64_thunk)
 	movl	%ss, %eax
 	push	%rax
 
+	/* Copy args passed on stack */
+	movq	0x30(%rsp), %rbp
+	movq	0x38(%rsp), %rbx
+	movq	0x40(%rsp), %rax
+
 	/*
 	 * Convert x86-64 ABI params to i386 ABI
 	 */
@@ -44,13 +47,18 @@ SYM_FUNC_START(__efi64_thunk)
 	movl	%ecx, 0x8(%rsp)
 	movl	%r8d, 0xc(%rsp)
 	movl	%r9d, 0x10(%rsp)
+	movl	%ebp, 0x14(%rsp)
+	movl	%ebx, 0x18(%rsp)
+	movl	%eax, 0x1c(%rsp)
 
-	leaq	0x14(%rsp), %rbx
+	leaq	0x20(%rsp), %rbx
 	sgdt	(%rbx)
 
 	addq	$16, %rbx
 	sidt	(%rbx)
 
+	leaq	1f(%rip), %rbp
+
 	/*
 	 * Switch to IDT and GDT with 32-bit segments. This is the firmware GDT
 	 * and IDT that was installed when the kernel started executing. The
diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
index 85f156f8ef81..a323dbac9182 100644
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -46,13 +46,14 @@ extern unsigned long efi_mixed_mode_stack_pa;
 
 #define __efi_nargs(...) __efi_nargs_(__VA_ARGS__)
 #define __efi_nargs_(...) __efi_nargs__(0, ##__VA_ARGS__,	\
+	__efi_arg_sentinel(9), __efi_arg_sentinel(8),		\
 	__efi_arg_sentinel(7), __efi_arg_sentinel(6),		\
 	__efi_arg_sentinel(5), __efi_arg_sentinel(4),		\
 	__efi_arg_sentinel(3), __efi_arg_sentinel(2),		\
 	__efi_arg_sentinel(1), __efi_arg_sentinel(0))
-#define __efi_nargs__(_0, _1, _2, _3, _4, _5, _6, _7, n, ...)	\
+#define __efi_nargs__(_0, _1, _2, _3, _4, _5, _6, _7, _8, _9, n, ...)	\
 	__take_second_arg(n,					\
-		({ BUILD_BUG_ON_MSG(1, "__efi_nargs limit exceeded"); 8; }))
+		({ BUILD_BUG_ON_MSG(1, "__efi_nargs limit exceeded"); 10; }))
 #define __efi_arg_sentinel(n) , n
 
 /*
@@ -176,8 +177,9 @@ extern u64 efi_setup;
 extern efi_status_t __efi64_thunk(u32, ...);
 
 #define efi64_thunk(...) ({						\
-	__efi_nargs_check(efi64_thunk, 6, __VA_ARGS__);			\
-	__efi64_thunk(__VA_ARGS__);					\
+	u64 __pad[3]; /* must have space for 3 args on the stack */	\
+	__efi_nargs_check(efi64_thunk, 9, __VA_ARGS__);			\
+	__efi64_thunk(__VA_ARGS__, __pad);				\
 })
 
 static inline bool efi_is_mixed(void)
diff --git a/arch/x86/platform/efi/efi_thunk_64.S b/arch/x86/platform/efi/efi_thunk_64.S
index fd3dd1708eba..5b7c6e09954e 100644
--- a/arch/x86/platform/efi/efi_thunk_64.S
+++ b/arch/x86/platform/efi/efi_thunk_64.S
@@ -36,6 +36,17 @@ SYM_CODE_START(__efi64_thunk)
 	movq	efi_mixed_mode_stack_pa(%rip), %rsp
 	push	%rax
 
+	/*
+	 * Copy args passed via the stack
+	 */
+	subq	$0x24, %rsp
+	movq	0x18(%rax), %rbp
+	movq	0x20(%rax), %rbx
+	movq	0x28(%rax), %rax
+	movl	%ebp, 0x18(%rsp)
+	movl	%ebx, 0x1c(%rsp)
+	movl	%eax, 0x20(%rsp)
+
 	/*
 	 * Calculate the physical address of the kernel text.
 	 */
@@ -47,7 +58,6 @@ SYM_CODE_START(__efi64_thunk)
 	subq	%rax, %rbp
 	subq	%rax, %rbx
 
-	subq	$28, %rsp
 	movl	%ebx, 0x0(%rsp)		/* return address */
 	movl	%esi, 0x4(%rsp)
 	movl	%edx, 0x8(%rsp)
@@ -60,7 +70,7 @@ SYM_CODE_START(__efi64_thunk)
 	pushq	%rdi			/* EFI runtime service address */
 	lretq
 
-1:	movq	24(%rsp), %rsp
+1:	movq	0x20(%rsp), %rsp
 	pop	%rbx
 	pop	%rbp
 	retq
-- 
2.33.1

[PATCH 3/4 v3] efi/libstub: consolidate initrd handling across architectures

[Ilias Apalodimas]

From: Ard Biesheuvel <ardb@kernel.org>

Before adding TPM measurement of the initrd contents, refactor the
initrd handling slightly to be more self-contained and consistent.

Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
---
Changes since v1,2: 
- None
 .../firmware/efi/libstub/efi-stub-helper.c    | 13 +++++++---
 drivers/firmware/efi/libstub/efi-stub.c       | 10 ++-----
 drivers/firmware/efi/libstub/efistub.h        |  1 -
 drivers/firmware/efi/libstub/x86-stub.c       | 26 +++++++------------
 4 files changed, 21 insertions(+), 29 deletions(-)

diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
index d489bdc645fe..01677181453d 100644
--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -20,10 +20,10 @@
 
 bool efi_nochunk;
 bool efi_nokaslr = !IS_ENABLED(CONFIG_RANDOMIZE_BASE);
-bool efi_noinitrd;
 int efi_loglevel = CONSOLE_LOGLEVEL_DEFAULT;
 bool efi_novamap;
 
+static bool efi_noinitrd;
 static bool efi_nosoftreserve;
 static bool efi_disable_pci_dma = IS_ENABLED(CONFIG_EFI_DISABLE_PCI_DMA);
 
@@ -643,8 +643,10 @@ efi_status_t efi_load_initrd(efi_loaded_image_t *image,
 {
 	efi_status_t status;
 
-	if (!load_addr || !load_size)
-		return EFI_INVALID_PARAMETER;
+	if (efi_noinitrd) {
+		*load_addr = *load_size = 0;
+		return EFI_SUCCESS;
+	}
 
 	status = efi_load_initrd_dev_path(load_addr, load_size, hard_limit);
 	if (status == EFI_SUCCESS) {
@@ -655,7 +657,10 @@ efi_status_t efi_load_initrd(efi_loaded_image_t *image,
 		if (status == EFI_SUCCESS && *load_size > 0)
 			efi_info("Loaded initrd from command line option\n");
 	}
-
+	if (status != EFI_SUCCESS) {
+		efi_err("Failed to load initrd: 0x%lx\n", status);
+		*load_addr = *load_size = 0;
+	}
 	return status;
 }
 
diff --git a/drivers/firmware/efi/libstub/efi-stub.c b/drivers/firmware/efi/libstub/efi-stub.c
index 26e69788f27a..e87e7f1b1a33 100644
--- a/drivers/firmware/efi/libstub/efi-stub.c
+++ b/drivers/firmware/efi/libstub/efi-stub.c
@@ -134,7 +134,6 @@ efi_status_t __efiapi efi_pe_entry(efi_handle_t handle,
 	enum efi_secureboot_mode secure_boot;
 	struct screen_info *si;
 	efi_properties_table_t *prop_tbl;
-	unsigned long max_addr;
 
 	efi_system_table = sys_table_arg;
 
@@ -240,13 +239,8 @@ efi_status_t __efiapi efi_pe_entry(efi_handle_t handle,
 	if (!fdt_addr)
 		efi_info("Generating empty DTB\n");
 
-	if (!efi_noinitrd) {
-		max_addr = efi_get_max_initrd_addr(image_addr);
-		status = efi_load_initrd(image, &initrd_addr, &initrd_size,
-					 ULONG_MAX, max_addr);
-		if (status != EFI_SUCCESS)
-			efi_err("Failed to load initrd!\n");
-	}
+	efi_load_initrd(image, &initrd_addr, &initrd_size, ULONG_MAX,
+			efi_get_max_initrd_addr(image_addr));
 
 	efi_random_get_seed();
 
diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h
index a2825c435158..edb77b0621ea 100644
--- a/drivers/firmware/efi/libstub/efistub.h
+++ b/drivers/firmware/efi/libstub/efistub.h
@@ -31,7 +31,6 @@
 
 extern bool efi_nochunk;
 extern bool efi_nokaslr;
-extern bool efi_noinitrd;
 extern int efi_loglevel;
 extern bool efi_novamap;
 
diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi/libstub/x86-stub.c
index f14c4ff5839f..01ddd4502e28 100644
--- a/drivers/firmware/efi/libstub/x86-stub.c
+++ b/drivers/firmware/efi/libstub/x86-stub.c
@@ -673,6 +673,7 @@ unsigned long efi_main(efi_handle_t handle,
 	unsigned long bzimage_addr = (unsigned long)startup_32;
 	unsigned long buffer_start, buffer_end;
 	struct setup_header *hdr = &boot_params->hdr;
+	unsigned long addr, size;
 	efi_status_t status;
 
 	efi_system_table = sys_table_arg;
@@ -761,22 +762,15 @@ unsigned long efi_main(efi_handle_t handle,
 	 * arguments will be processed only if image is not NULL, which will be
 	 * the case only if we were loaded via the PE entry point.
 	 */
-	if (!efi_noinitrd) {
-		unsigned long addr, size;
-
-		status = efi_load_initrd(image, &addr, &size,
-					 hdr->initrd_addr_max, ULONG_MAX);
-
-		if (status != EFI_SUCCESS) {
-			efi_err("Failed to load initrd!\n");
-			goto fail;
-		}
-		if (size > 0) {
-			efi_set_u64_split(addr, &hdr->ramdisk_image,
-					  &boot_params->ext_ramdisk_image);
-			efi_set_u64_split(size, &hdr->ramdisk_size,
-					  &boot_params->ext_ramdisk_size);
-		}
+	status = efi_load_initrd(image, &addr, &size, hdr->initrd_addr_max,
+				 ULONG_MAX);
+	if (status != EFI_SUCCESS)
+		goto fail;
+	if (size > 0) {
+		efi_set_u64_split(addr, &hdr->ramdisk_image,
+				  &boot_params->ext_ramdisk_image);
+		efi_set_u64_split(size, &hdr->ramdisk_size,
+				  &boot_params->ext_ramdisk_size);
 	}
 
 	/*
-- 
2.33.1

[PATCH 4/4 v3] efi/libstub: measure loaded initrd info into the TPM

[Ilias Apalodimas]

In an effort to ensure the initrd observed and used by the OS is
the same one that was meant to be loaded, which is difficult to
guarantee otherwise, let's measure the initrd if the EFI stub and
specifically the newly introduced LOAD_FILE2 protocol was used.

Modify the initrd loading sequence so that the contents of the initrd
are measured into PCR9.  Note that the patch is currently using
EV_EVENT_TAG to create the eventlog entry instead of EV_IPL.  According
to the TCP PC Client specification this is used for PCRs defined for OS
and application usage.

Co-developed-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
---
Changes since v1,2:
- None
 .../firmware/efi/libstub/efi-stub-helper.c    | 72 +++++++++++++++----
 1 file changed, 58 insertions(+), 14 deletions(-)

diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
index 01677181453d..0bd01da1f0df 100644
--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -625,6 +625,47 @@ efi_status_t efi_load_initrd_cmdline(efi_loaded_image_t *image,
 				    load_addr, load_size);
 }
 
+static const struct {
+	efi_tcg2_event_t	event_data;
+	efi_tcg2_tagged_event_t tagged_event;
+	u8			tagged_event_data[];
+} initrd_tcg2_event = {
+	{
+		sizeof(initrd_tcg2_event) + sizeof("Linux initrd"),
+		{
+			sizeof(initrd_tcg2_event.event_data.event_header),
+			EFI_TCG2_EVENT_HEADER_VERSION,
+			9,
+			EV_EVENT_TAG,
+		},
+	},
+	{
+		INITRD_EVENT_TAG_ID,
+		sizeof("Linux initrd"),
+	},
+	"Linux initrd",
+};
+
+void efi_measure_initrd(unsigned long load_addr, unsigned long load_size)
+{
+	efi_guid_t tcg2_guid = EFI_TCG2_PROTOCOL_GUID;
+	efi_tcg2_protocol_t *tcg2 = NULL;
+	efi_status_t status;
+
+	efi_bs_call(locate_protocol, &tcg2_guid, NULL, (void **)&tcg2);
+	if (tcg2) {
+		status = efi_call_proto(tcg2, hash_log_extend_event,
+					0, load_addr, load_size,
+					&initrd_tcg2_event.event_data);
+		if (status != EFI_SUCCESS)
+			efi_warn("Failed to measure initrd data: 0x%lx\n",
+				 status);
+		else
+			efi_info("Measured initrd data into PCR %d\n",
+				 initrd_tcg2_event.event_data.event_header.pcr_index);
+	}
+}
+
 /**
  * efi_load_initrd() - Load initial RAM disk
  * @image:	EFI loaded image protocol
@@ -645,22 +686,25 @@ efi_status_t efi_load_initrd(efi_loaded_image_t *image,
 
 	if (efi_noinitrd) {
 		*load_addr = *load_size = 0;
-		return EFI_SUCCESS;
+		status = EFI_SUCCESS;
+	} else {
+		status = efi_load_initrd_dev_path(load_addr, load_size, hard_limit);
+		if (status == EFI_SUCCESS) {
+			efi_info("Loaded initrd from LINUX_EFI_INITRD_MEDIA_GUID device path\n");
+			if (*load_size > 0)
+				efi_measure_initrd(*load_addr, *load_size);
+		} else if (status == EFI_NOT_FOUND) {
+			status = efi_load_initrd_cmdline(image, load_addr, load_size,
+							 soft_limit, hard_limit);
+			if (status == EFI_SUCCESS && *load_size > 0)
+				efi_info("Loaded initrd from command line option\n");
+		}
+		if (status != EFI_SUCCESS) {
+			efi_err("Failed to load initrd: 0x%lx\n", status);
+			*load_addr = *load_size = 0;
+		}
 	}
 
-	status = efi_load_initrd_dev_path(load_addr, load_size, hard_limit);
-	if (status == EFI_SUCCESS) {
-		efi_info("Loaded initrd from LINUX_EFI_INITRD_MEDIA_GUID device path\n");
-	} else if (status == EFI_NOT_FOUND) {
-		status = efi_load_initrd_cmdline(image, load_addr, load_size,
-						 soft_limit, hard_limit);
-		if (status == EFI_SUCCESS && *load_size > 0)
-			efi_info("Loaded initrd from command line option\n");
-	}
-	if (status != EFI_SUCCESS) {
-		efi_err("Failed to load initrd: 0x%lx\n", status);
-		*load_addr = *load_size = 0;
-	}
 	return status;
 }
 
-- 
2.33.1

Re: [PATCH 0/4 v3] measure initrd data loaded by the EFI stub

[Ard Biesheuvel]

On Fri, 19 Nov 2021 at 12:48, Ilias Apalodimas
<ilias.apalodimas@linaro.org> wrote:
>
> Hi!
>
> This is a respin of [1].
> This enables initrd measuring when loaded directly by the kernel EFI stub.
> It ensures that the initrd observed and used by the OS is the same one that
> got measured into the TPM, which is difficult to guarantee in the current
> otherwise.
>
> There's a couple of changes compared to the original RFC:
> - Ard fixed the x86 assembly for providing the extra arguments needed and I
>   rebased it on top of
>   commit 22aa45cb465b ("x86/efi: Restore Firmware IDT before calling ExitBootServices()")
> - Instead of EV_IPL we are now using EV_EVENT_TAG. EV_IPL was marked
>   as deprecated up until the latest PC client spec [2] (and deprecated  in
>   older revisions [3]).  It's current description is:
>   "It may be used by Boot Manager Code to measure events."
>
>   EV_EVENT_TAG on the other hand seems more appropriate as it's defined as:
>   "Used for PCRs defined for OS and application usage.  Defined for use by
>   Host Platform Operating System or Software."
> - We are only measuring the initrd if it was loaded using the LOAD_FILE2
>   protocol.  This is not what we probably want in the long run, but let's
>   only enforce the measurement on the new way of loading an initrd for now.
>
> Questions:
> - Since GRUB seems to be using PCRs 8/9 for it's EV_IPL events, maybe we should
>   use something completely different?
>

Thanks for continuing to work on this.

I think using PCRs 8/9 is fine - if one upgrades to a new version of
the kernel that implements this change, the PCRs will change in any
case.

The only thing that is unclear to me is whether we should measure some
kind of separator event if no initrd is loaded at all - IIRC, this
came up before but I don't remember what the conclusion was in the
end.


> I did test this on arm64 and x86_64 (incl mixed mode). Here's a snip of the
> EventLog
> <snip>
>   - EventNum: 23
>     PCRIndex: 9
>     EventType: EV_EVENT_TAG
>     DigestCount: 4
>     Digests:
>       - AlgorithmId: sha1
>         Digest: "53fe403e0d763f6a4e3384e8112d6463e7ddf12b"
>       - AlgorithmId: sha256
>         Digest: "28f24eab8cb433e4b8cbce0f96b7ad0aa541a4b905f748491139e42f0adc8026"
>       - AlgorithmId: sha384
>         Digest: "848389ab172267dcf9a0b873c7534b3d969e915b525c9fe2b57db47f4ecd8283b18d6e0cff84099893d589447c2bea55"
>       - AlgorithmId: sha512
>         Digest: "438b254c92e6716a5a1ba0338f5e751f3dd27782481e5698911b4cd33a98efdd776459d56781c5ae4a8d0b9945246d04ab243d4dbe03f49542e2455ac66db584"
>     EventSize: 21
>     Event: "ec223b8f0d0000004c696e757820696e6974726400"
> <snip>
>
> [1] https://lore.kernel.org/linux-efi/20201102170634.20575-1-ardb@kernel.org/
> [2] https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf
> [3] https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf
>
> Ard Biesheuvel (3):
>   efi/libstub: add prototype of
>     efi_tcg2_protocol::hash_log_extend_event()
>   efi/libstub: x86/mixed: increase supported argument count
>   efi/libstub: consolidate initrd handling across architectures
>
> Ilias Apalodimas (1):
>   efi/libstub: measure loaded initrd info into the TPM
>
>  arch/x86/boot/compressed/efi_thunk_64.S       | 14 +++-
>  arch/x86/include/asm/efi.h                    | 14 +++-
>  arch/x86/platform/efi/efi_thunk_64.S          | 14 +++-
>  .../firmware/efi/libstub/efi-stub-helper.c    | 73 ++++++++++++++++---
>  drivers/firmware/efi/libstub/efi-stub.c       | 10 +--
>  drivers/firmware/efi/libstub/efistub.h        | 30 +++++++-
>  drivers/firmware/efi/libstub/x86-stub.c       | 26 +++----
>  7 files changed, 134 insertions(+), 47 deletions(-)
>
> --
> 2.33.1
>

Re: [PATCH 0/4 v3] measure initrd data loaded by the EFI stub

[Ilias Apalodimas]

Hi Ard,

On Sun, Nov 21, 2021 at 05:12:00PM +0100, Ard Biesheuvel wrote:
> On Fri, 19 Nov 2021 at 12:48, Ilias Apalodimas
> <ilias.apalodimas@linaro.org> wrote:
> >
> > Hi!
> >
> > This is a respin of [1].
> > This enables initrd measuring when loaded directly by the kernel EFI stub.
> > It ensures that the initrd observed and used by the OS is the same one that
> > got measured into the TPM, which is difficult to guarantee in the current
> > otherwise.
> >
> > There's a couple of changes compared to the original RFC:
> > - Ard fixed the x86 assembly for providing the extra arguments needed and I
> >   rebased it on top of
> >   commit 22aa45cb465b ("x86/efi: Restore Firmware IDT before calling ExitBootServices()")
> > - Instead of EV_IPL we are now using EV_EVENT_TAG. EV_IPL was marked
> >   as deprecated up until the latest PC client spec [2] (and deprecated  in
> >   older revisions [3]).  It's current description is:
> >   "It may be used by Boot Manager Code to measure events."
> >
> >   EV_EVENT_TAG on the other hand seems more appropriate as it's defined as:
> >   "Used for PCRs defined for OS and application usage.  Defined for use by
> >   Host Platform Operating System or Software."
> > - We are only measuring the initrd if it was loaded using the LOAD_FILE2
> >   protocol.  This is not what we probably want in the long run, but let's
> >   only enforce the measurement on the new way of loading an initrd for now.
> >
> > Questions:
> > - Since GRUB seems to be using PCRs 8/9 for it's EV_IPL events, maybe we should
> >   use something completely different?
> >
>
> Thanks for continuing to work on this.

You're welcome!

>
> I think using PCRs 8/9 is fine - if one upgrades to a new version of
> the kernel that implements this change, the PCRs will change in any
> case.

The reasoning here is leave distros unaffected.  Yes the PCRs will
change regardless in a kernel update.  However distros might already
have infrastructure to seal keys factoring in PCRs 8 and 9.  Keeping
in mind the initrd is likely to change without changing GRUB,  we
could allow them to opt-in on the initrd measurement using PCR10 (up
to 15).

>
> The only thing that is unclear to me is whether we should measure some
> kind of separator event if no initrd is loaded at all - IIRC, this
> came up before but I don't remember what the conclusion was in the
> end.
>

I think we ended up saying along the lines of "We need more
discussion.  Let's check what Windows is doing".  I did have a look on
that Eventlog James included,  but my windows understanding is
mediocre at best.  OTOH separators are used for PCRs 0-7 and they
either indicate errors or delimit actions during the boot process.  We
already have separators before EBS so I skipped it for the initrd.
Moreover I found nothing relevant to the spec wrt to tagged events and
separators  (apart from a mention to a Specification for Conventional
BIOS).
Delimiting actions during the boot process is useful for example when
you want a key sealed against specific PCRs extended by the firmware,
while not allowing later boot stages access it.   I can't think of
such a usage for the initrd.  Obviously if anyone can and it makes
sense I'll go add it.

Thanks!
/Ilias


>
> > I did test this on arm64 and x86_64 (incl mixed mode). Here's a snip of the
> > EventLog
> > <snip>
> >   - EventNum: 23
> >     PCRIndex: 9
> >     EventType: EV_EVENT_TAG
> >     DigestCount: 4
> >     Digests:
> >       - AlgorithmId: sha1
> >         Digest: "53fe403e0d763f6a4e3384e8112d6463e7ddf12b"
> >       - AlgorithmId: sha256
> >         Digest: "28f24eab8cb433e4b8cbce0f96b7ad0aa541a4b905f748491139e42f0adc8026"
> >       - AlgorithmId: sha384
> >         Digest: "848389ab172267dcf9a0b873c7534b3d969e915b525c9fe2b57db47f4ecd8283b18d6e0cff84099893d589447c2bea55"
> >       - AlgorithmId: sha512
> >         Digest: "438b254c92e6716a5a1ba0338f5e751f3dd27782481e5698911b4cd33a98efdd776459d56781c5ae4a8d0b9945246d04ab243d4dbe03f49542e2455ac66db584"
> >     EventSize: 21
> >     Event: "ec223b8f0d0000004c696e757820696e6974726400"
> > <snip>
> >
> > [1] https://lore.kernel.org/linux-efi/20201102170634.20575-1-ardb@kernel.org/
> > [2] https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf
> > [3] https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf
> >
> > Ard Biesheuvel (3):
> >   efi/libstub: add prototype of
> >     efi_tcg2_protocol::hash_log_extend_event()
> >   efi/libstub: x86/mixed: increase supported argument count
> >   efi/libstub: consolidate initrd handling across architectures
> >
> > Ilias Apalodimas (1):
> >   efi/libstub: measure loaded initrd info into the TPM
> >
> >  arch/x86/boot/compressed/efi_thunk_64.S       | 14 +++-
> >  arch/x86/include/asm/efi.h                    | 14 +++-
> >  arch/x86/platform/efi/efi_thunk_64.S          | 14 +++-
> >  .../firmware/efi/libstub/efi-stub-helper.c    | 73 ++++++++++++++++---
> >  drivers/firmware/efi/libstub/efi-stub.c       | 10 +--
> >  drivers/firmware/efi/libstub/efistub.h        | 30 +++++++-
> >  drivers/firmware/efi/libstub/x86-stub.c       | 26 +++----
> >  7 files changed, 134 insertions(+), 47 deletions(-)
> >
> > --
> > 2.33.1
> >

Re: [PATCH 0/4 v3] measure initrd data loaded by the EFI stub

[Ard Biesheuvel]

On Sun, 21 Nov 2021 at 19:37, Ilias Apalodimas
<ilias.apalodimas@linaro.org> wrote:
>
> Hi Ard,
>
> On Sun, Nov 21, 2021 at 05:12:00PM +0100, Ard Biesheuvel wrote:
> > On Fri, 19 Nov 2021 at 12:48, Ilias Apalodimas
> > <ilias.apalodimas@linaro.org> wrote:
> > >
> > > Hi!
> > >
> > > This is a respin of [1].
> > > This enables initrd measuring when loaded directly by the kernel EFI stub.
> > > It ensures that the initrd observed and used by the OS is the same one that
> > > got measured into the TPM, which is difficult to guarantee in the current
> > > otherwise.
> > >
> > > There's a couple of changes compared to the original RFC:
> > > - Ard fixed the x86 assembly for providing the extra arguments needed and I
> > >   rebased it on top of
> > >   commit 22aa45cb465b ("x86/efi: Restore Firmware IDT before calling ExitBootServices()")
> > > - Instead of EV_IPL we are now using EV_EVENT_TAG. EV_IPL was marked
> > >   as deprecated up until the latest PC client spec [2] (and deprecated  in
> > >   older revisions [3]).  It's current description is:
> > >   "It may be used by Boot Manager Code to measure events."
> > >
> > >   EV_EVENT_TAG on the other hand seems more appropriate as it's defined as:
> > >   "Used for PCRs defined for OS and application usage.  Defined for use by
> > >   Host Platform Operating System or Software."
> > > - We are only measuring the initrd if it was loaded using the LOAD_FILE2
> > >   protocol.  This is not what we probably want in the long run, but let's
> > >   only enforce the measurement on the new way of loading an initrd for now.
> > >
> > > Questions:
> > > - Since GRUB seems to be using PCRs 8/9 for it's EV_IPL events, maybe we should
> > >   use something completely different?
> > >
> >
> > Thanks for continuing to work on this.
>
> You're welcome!
>
> >
> > I think using PCRs 8/9 is fine - if one upgrades to a new version of
> > the kernel that implements this change, the PCRs will change in any
> > case.
>
> The reasoning here is leave distros unaffected.  Yes the PCRs will
> change regardless in a kernel update.  However distros might already
> have infrastructure to seal keys factoring in PCRs 8 and 9.  Keeping
> in mind the initrd is likely to change without changing GRUB,  we
> could allow them to opt-in on the initrd measurement using PCR10 (up
> to 15).
>
> >
> > The only thing that is unclear to me is whether we should measure some
> > kind of separator event if no initrd is loaded at all - IIRC, this
> > came up before but I don't remember what the conclusion was in the
> > end.
> >
>
> I think we ended up saying along the lines of "We need more
> discussion.  Let's check what Windows is doing".  I did have a look on
> that Eventlog James included,  but my windows understanding is
> mediocre at best.  OTOH separators are used for PCRs 0-7 and they
> either indicate errors or delimit actions during the boot process.  We
> already have separators before EBS so I skipped it for the initrd.
> Moreover I found nothing relevant to the spec wrt to tagged events and
> separators  (apart from a mention to a Specification for Conventional
> BIOS).
> Delimiting actions during the boot process is useful for example when
> you want a key sealed against specific PCRs extended by the firmware,
> while not allowing later boot stages access it.   I can't think of
> such a usage for the initrd.  Obviously if anyone can and it makes
> sense I'll go add it.
>

Thanks. I've queued these up so they should appear in -next shortly.



> >
> > > I did test this on arm64 and x86_64 (incl mixed mode). Here's a snip of the
> > > EventLog
> > > <snip>
> > >   - EventNum: 23
> > >     PCRIndex: 9
> > >     EventType: EV_EVENT_TAG
> > >     DigestCount: 4
> > >     Digests:
> > >       - AlgorithmId: sha1
> > >         Digest: "53fe403e0d763f6a4e3384e8112d6463e7ddf12b"
> > >       - AlgorithmId: sha256
> > >         Digest: "28f24eab8cb433e4b8cbce0f96b7ad0aa541a4b905f748491139e42f0adc8026"
> > >       - AlgorithmId: sha384
> > >         Digest: "848389ab172267dcf9a0b873c7534b3d969e915b525c9fe2b57db47f4ecd8283b18d6e0cff84099893d589447c2bea55"
> > >       - AlgorithmId: sha512
> > >         Digest: "438b254c92e6716a5a1ba0338f5e751f3dd27782481e5698911b4cd33a98efdd776459d56781c5ae4a8d0b9945246d04ab243d4dbe03f49542e2455ac66db584"
> > >     EventSize: 21
> > >     Event: "ec223b8f0d0000004c696e757820696e6974726400"
> > > <snip>
> > >
> > > [1] https://lore.kernel.org/linux-efi/20201102170634.20575-1-ardb@kernel.org/
> > > [2] https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf
> > > [3] https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf
> > >
> > > Ard Biesheuvel (3):
> > >   efi/libstub: add prototype of
> > >     efi_tcg2_protocol::hash_log_extend_event()
> > >   efi/libstub: x86/mixed: increase supported argument count
> > >   efi/libstub: consolidate initrd handling across architectures
> > >
> > > Ilias Apalodimas (1):
> > >   efi/libstub: measure loaded initrd info into the TPM
> > >
> > >  arch/x86/boot/compressed/efi_thunk_64.S       | 14 +++-
> > >  arch/x86/include/asm/efi.h                    | 14 +++-
> > >  arch/x86/platform/efi/efi_thunk_64.S          | 14 +++-
> > >  .../firmware/efi/libstub/efi-stub-helper.c    | 73 ++++++++++++++++---
> > >  drivers/firmware/efi/libstub/efi-stub.c       | 10 +--
> > >  drivers/firmware/efi/libstub/efistub.h        | 30 +++++++-
> > >  drivers/firmware/efi/libstub/x86-stub.c       | 26 +++----
> > >  7 files changed, 134 insertions(+), 47 deletions(-)
> > >
> > > --
> > > 2.33.1
> > >