[PATCH] EFI/stub: tpm: enable tpm eventlog function for ARM64 platform

[PATCH] EFI/stub: tpm: enable tpm eventlog function for ARM64 platform

[Xinwei Kong]

this patch gets tpm eventlog information such as device boot status,event guid
and so on, which will be from bios stage. it use "efi_retrieve_tpm2_eventlog"
functions to get it for ARM64 platorm.

Signed-off-by: Xinwei Kong <kong.kongxinwei@hisilicon.com>
Signed-off-by: Zou Cao <zoucao@linux.alibaba.com>
---
 drivers/firmware/efi/libstub/arm-stub.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c
index c382a48..37c8f81 100644
--- a/drivers/firmware/efi/libstub/arm-stub.c
+++ b/drivers/firmware/efi/libstub/arm-stub.c
@@ -139,6 +139,8 @@ unsigned long efi_entry(void *handle, efi_system_table_t *sys_table,
 	if (status != EFI_SUCCESS)
 		goto fail;
 
+	efi_retrieve_tpm2_eventlog(sys_table);
+
 	/*
 	 * Get a handle to the loaded image protocol.  This is used to get
 	 * information about the running image, such as size and the command
-- 
2.7.4

Re: [PATCH] EFI/stub: tpm: enable tpm eventlog function for ARM64 platform

[Ard Biesheuvel]

On Tue, 5 Nov 2019 at 09:29, Xinwei Kong <kong.kongxinwei@hisilicon.com> wrote:
>
> this patch gets tpm eventlog information such as device boot status,event guid
> and so on, which will be from bios stage. it use "efi_retrieve_tpm2_eventlog"
> functions to get it for ARM64 platorm.
>
> Signed-off-by: Xinwei Kong <kong.kongxinwei@hisilicon.com>
> Signed-off-by: Zou Cao <zoucao@linux.alibaba.com>
> ---
>  drivers/firmware/efi/libstub/arm-stub.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c
> index c382a48..37c8f81 100644
> --- a/drivers/firmware/efi/libstub/arm-stub.c
> +++ b/drivers/firmware/efi/libstub/arm-stub.c
> @@ -139,6 +139,8 @@ unsigned long efi_entry(void *handle, efi_system_table_t *sys_table,
>         if (status != EFI_SUCCESS)
>                 goto fail;
>
> +       efi_retrieve_tpm2_eventlog(sys_table);
> +

This function allocates memory, so calling it should be deferred until
after we relocate the kernel, to prevent these allocations from using
up space that we'd rather use for the kernel.

Does it work for you if we move this call further down, right before
the call to efi_enable_reset_attack_mitigation()? Please confirm.


>         /*
>          * Get a handle to the loaded image protocol.  This is used to get
>          * information about the running image, such as size and the command
> --
> 2.7.4
>
>

Re: [PATCH] EFI/stub: tpm: enable tpm eventlog function for ARM64 platform

[Ard Biesheuvel]

On Wed, 6 Nov 2019 at 15:56, Ard Biesheuvel <ard.biesheuvel@linaro.org> wrote:
>
> On Tue, 5 Nov 2019 at 09:29, Xinwei Kong <kong.kongxinwei@hisilicon.com> wrote:
> >
> > this patch gets tpm eventlog information such as device boot status,event guid
> > and so on, which will be from bios stage. it use "efi_retrieve_tpm2_eventlog"
> > functions to get it for ARM64 platorm.
> >
> > Signed-off-by: Xinwei Kong <kong.kongxinwei@hisilicon.com>
> > Signed-off-by: Zou Cao <zoucao@linux.alibaba.com>
> > ---
> >  drivers/firmware/efi/libstub/arm-stub.c | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c
> > index c382a48..37c8f81 100644
> > --- a/drivers/firmware/efi/libstub/arm-stub.c
> > +++ b/drivers/firmware/efi/libstub/arm-stub.c
> > @@ -139,6 +139,8 @@ unsigned long efi_entry(void *handle, efi_system_table_t *sys_table,
> >         if (status != EFI_SUCCESS)
> >                 goto fail;
> >
> > +       efi_retrieve_tpm2_eventlog(sys_table);
> > +
>
> This function allocates memory, so calling it should be deferred until
> after we relocate the kernel, to prevent these allocations from using
> up space that we'd rather use for the kernel.
>
> Does it work for you if we move this call further down, right before
> the call to efi_enable_reset_attack_mitigation()? Please confirm.
>

Also, your S-o-b chain is incorrect. If Zou Cao provided you with the
patch, please credit her/him as the author (using git --reset-author)
and move your S-o-b last. If Zou Cao was a co-author [which seems
unlikely for a single line patch], use Co-developed-by+Signed-off-by.
In any case, the S-o-b of the person sending out the patch via email
should come last.

Re: [PATCH] EFI/stub: tpm: enable tpm eventlog function for ARM64 platform

[kongxinwei]

On 2019/11/6 22:59, Ard Biesheuvel wrote:
> On Wed, 6 Nov 2019 at 15:56, Ard Biesheuvel <ard.biesheuvel@linaro.org> wrote:
>>
>> On Tue, 5 Nov 2019 at 09:29, Xinwei Kong <kong.kongxinwei@hisilicon.com> wrote:
>>>
>>> this patch gets tpm eventlog information such as device boot status,event guid
>>> and so on, which will be from bios stage. it use "efi_retrieve_tpm2_eventlog"
>>> functions to get it for ARM64 platorm.
>>>
>>> Signed-off-by: Xinwei Kong <kong.kongxinwei@hisilicon.com>
>>> Signed-off-by: Zou Cao <zoucao@linux.alibaba.com>
>>> ---
>>>  drivers/firmware/efi/libstub/arm-stub.c | 2 ++
>>>  1 file changed, 2 insertions(+)
>>>
>>> diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c
>>> index c382a48..37c8f81 100644
>>> --- a/drivers/firmware/efi/libstub/arm-stub.c
>>> +++ b/drivers/firmware/efi/libstub/arm-stub.c
>>> @@ -139,6 +139,8 @@ unsigned long efi_entry(void *handle, efi_system_table_t *sys_table,
>>>         if (status != EFI_SUCCESS)
>>>                 goto fail;
>>>
>>> +       efi_retrieve_tpm2_eventlog(sys_table);
>>> +
>>
>> This function allocates memory, so calling it should be deferred until
>> after we relocate the kernel, to prevent these allocations from using
>> up space that we'd rather use for the kernel.
>>
>> Does it work for you if we move this call further down, right before
>> the call to efi_enable_reset_attack_mitigation()? Please confirm.
>>

ok，I will confirm it and send V2 version patch :

> 
> Also, your S-o-b chain is incorrect. If Zou Cao provided you with the
> patch, please credit her/him as the author (using git --reset-author)
> and move your S-o-b last. If Zou Cao was a co-author [which seems
> unlikely for a single line patch], use Co-developed-by+Signed-off-by.
> In any case, the S-o-b of the person sending out the patch via email
> should come last.
> 
I will deal it.
> .
>