Linux-Integrity Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH v4] tpm: Document UEFI event log quirks
@ 2019-07-12 15:44 Jarkko Sakkinen
  2019-07-31 19:39 ` Jonathan Corbet
  0 siblings, 1 reply; 3+ messages in thread
From: Jarkko Sakkinen @ 2019-07-12 15:44 UTC (permalink / raw)
  To: linux-kernel, linux-integrity, linux-doc
  Cc: tweek, matthewgarrett, jorhand, rdunlap, Jarkko Sakkinen,
	Jonathan Corbet, Sasha Levin

[-- Warning: decoded text below may be mangled --]
[-- Attachment #0: Type: text/plain; charset=y, Size: 3652 bytes --]

There are some weird quirks when it comes to UEFI event log. Provide a
brief introduction to TPM event log mechanism and describe the quirks
and how they can be sorted out.

Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
---
v4: - Unfortanely -> Unfortunately
v3: - Add a section for refs and use a bullet list to enumerate them.
    - Remove an invalid author info.
v2: - Fix one typo.
    - Refine the last paragraph to better explain how the two halves
      of the event log are concatenated.
 Documentation/security/tpm/index.rst         |  1 +
 Documentation/security/tpm/tpm_event_log.rst | 55 ++++++++++++++++++++
 2 files changed, 56 insertions(+)
 create mode 100644 Documentation/security/tpm/tpm_event_log.rst

diff --git a/Documentation/security/tpm/index.rst b/Documentation/security/tpm/index.rst
index af77a7bbb070..db566350bcd5 100644
--- a/Documentation/security/tpm/index.rst
+++ b/Documentation/security/tpm/index.rst
@@ -4,4 +4,5 @@ Trusted Platform Module documentation
 
 .. toctree::
 
+   tpm_event_log
    tpm_vtpm_proxy
diff --git a/Documentation/security/tpm/tpm_event_log.rst b/Documentation/security/tpm/tpm_event_log.rst
new file mode 100644
index 000000000000..f00f7a1d5e92
--- /dev/null
+++ b/Documentation/security/tpm/tpm_event_log.rst
@@ -0,0 +1,55 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+=============
+TPM Event Log
+=============
+
+This document briefly describes what TPM log is and how it is handed
+over from the preboot firmware to the operating system.
+
+Introduction
+============
+
+The preboot firmware maintains an event log that gets new entries every
+time something gets hashed by it to any of the PCR registers. The events
+are segregated by their type and contain the value of the hashed PCR
+register. Typically, the preboot firmware will hash the components to
+who execution is to be handed over or actions relevant to the boot
+process.
+
+The main application for this is remote attestation and the reason why
+it is useful is nicely put in the very first section of [1]:
+
+"Attestation is used to provide information about the platform’s state
+to a challenger. However, PCR contents are difficult to interpret;
+therefore, attestation is typically more useful when the PCR contents
+are accompanied by a measurement log. While not trusted on their own,
+the measurement log contains a richer set of information than do the PCR
+contents. The PCR contents are used to provide the validation of the
+measurement log."
+
+UEFI event log
+==============
+
+UEFI provided event log has a few somewhat weird quirks.
+
+Before calling ExitBootServices() Linux EFI stub copies the event log to
+a custom configuration table defined by the stub itself. Unfortunately,
+the events generated by ExitBootServices() don't end up in the table.
+
+The firmware provides so called final events configuration table to sort
+out this issue. Events gets mirrored to this table after the first time
+EFI_TCG2_PROTOCOL.GetEventLog() gets called.
+
+This introduces another problem: nothing guarantees that it is not called
+before the Linux EFI stub gets to run. Thus, it needs to calculate and save the
+final events table size while the stub is still running to the custom
+configuration table so that the TPM driver can later on skip these events when
+concatenating two halves of the event log from the custom configuration table
+and the final events table.
+
+References
+==========
+
+- [1] https://trustedcomputinggroup.org/resource/pc-client-specific-platform-firmware-profile-specification/
+- [2] The final concatenation is done in drivers/char/tpm/eventlog/efi.c
-- 
2.20.1


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH v4] tpm: Document UEFI event log quirks
  2019-07-12 15:44 [PATCH v4] tpm: Document UEFI event log quirks Jarkko Sakkinen
@ 2019-07-31 19:39 ` Jonathan Corbet
  2019-08-01 17:43   ` Jarkko Sakkinen
  0 siblings, 1 reply; 3+ messages in thread
From: Jonathan Corbet @ 2019-07-31 19:39 UTC (permalink / raw)
  To: Jarkko Sakkinen
  Cc: linux-kernel, linux-integrity, linux-doc, tweek, matthewgarrett,
	jorhand, rdunlap, Sasha Levin

On Fri, 12 Jul 2019 18:44:32 +0300
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> wrote:

> There are some weird quirks when it comes to UEFI event log. Provide a
> brief introduction to TPM event log mechanism and describe the quirks
> and how they can be sorted out.
> 
> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
> ---
> v4: - Unfortanely -> Unfortunately
> v3: - Add a section for refs and use a bullet list to enumerate them.
>     - Remove an invalid author info.
> v2: - Fix one typo.
>     - Refine the last paragraph to better explain how the two halves
>       of the event log are concatenated.
>  Documentation/security/tpm/index.rst         |  1 +
>  Documentation/security/tpm/tpm_event_log.rst | 55 ++++++++++++++++++++
>  2 files changed, 56 insertions(+)
>  create mode 100644 Documentation/security/tpm/tpm_event_log.rst

I've applied this, thanks.  Before I could do so, though, I had to edit
the headers, which read:

> Content-Type: text/plain; charset=y

"git am" *really* doesn't like "charset=y".  I think this is something
that git send-email likes to do occasionally, don't know why...

Thanks,

jon

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH v4] tpm: Document UEFI event log quirks
  2019-07-31 19:39 ` Jonathan Corbet
@ 2019-08-01 17:43   ` Jarkko Sakkinen
  0 siblings, 0 replies; 3+ messages in thread
From: Jarkko Sakkinen @ 2019-08-01 17:43 UTC (permalink / raw)
  To: Jonathan Corbet
  Cc: linux-kernel, linux-integrity, linux-doc, tweek, matthewgarrett,
	jorhand, rdunlap, Sasha Levin

On Wed, Jul 31, 2019 at 01:39:48PM -0600, Jonathan Corbet wrote:
> On Fri, 12 Jul 2019 18:44:32 +0300
> Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> wrote:
> 
> > There are some weird quirks when it comes to UEFI event log. Provide a
> > brief introduction to TPM event log mechanism and describe the quirks
> > and how they can be sorted out.
> > 
> > Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
> > ---
> > v4: - Unfortanely -> Unfortunately
> > v3: - Add a section for refs and use a bullet list to enumerate them.
> >     - Remove an invalid author info.
> > v2: - Fix one typo.
> >     - Refine the last paragraph to better explain how the two halves
> >       of the event log are concatenated.
> >  Documentation/security/tpm/index.rst         |  1 +
> >  Documentation/security/tpm/tpm_event_log.rst | 55 ++++++++++++++++++++
> >  2 files changed, 56 insertions(+)
> >  create mode 100644 Documentation/security/tpm/tpm_event_log.rst
> 
> I've applied this, thanks.  Before I could do so, though, I had to edit
> the headers, which read:
> 
> > Content-Type: text/plain; charset=y
> 
> "git am" *really* doesn't like "charset=y".  I think this is something
> that git send-email likes to do occasionally, don't know why...

Thank you!

/Jarkko

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-07-12 15:44 [PATCH v4] tpm: Document UEFI event log quirks Jarkko Sakkinen
2019-07-31 19:39 ` Jonathan Corbet
2019-08-01 17:43   ` Jarkko Sakkinen

Linux-Integrity Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-integrity/0 linux-integrity/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-integrity linux-integrity/ https://lore.kernel.org/linux-integrity \
		linux-integrity@vger.kernel.org linux-integrity@archiver.kernel.org
	public-inbox-index linux-integrity


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-integrity


AGPL code for this site: git clone https://public-inbox.org/ public-inbox