tpmdd-devel Archive on lore.kernel.org
 help / color / Atom feed
From: Thiebaud Weksteen <tweek-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>
To: linux-efi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	linux-integrity-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	tpmdd-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
Cc: ard.biesheuvel-QSEj5FYQhm4dnm+yROfE0A@public.gmane.org,
	matt-mF/unelCI9GS6iBeEJttW/XRex20P6io@public.gmane.org,
	linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	mjg59-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org,
	peterhuewe-Mmb7MZpHnFY@public.gmane.org,
	jarkko.sakkinen-VuQAYsv1563Yd54FQh9/CA@public.gmane.org,
	jgunthorpe-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org,
	tpmdd-yWjUBOtONefk1uMJSBkQmQ@public.gmane.org,
	Thiebaud Weksteen <tweek-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>
Subject: [PATCH v3 0/5] Call GetEventLog before ExitBootServices
Date: Wed, 20 Sep 2017 10:13:35 +0200
Message-ID: <20170920081340.7413-1-tweek@google.com> (raw)

With TPM 1.2, the ACPI table ("TCPA") has two fields to recover the Event
Log Area (LAML and LASA). These logs are useful to understand and rebuild
the final values of PCRs.

With TPM 2.0, the ACPI table ("TPM2") does not contain these fields
anymore. The recommended method is now to call the GetEventLog EFI
protocol before ExitBootServices.

Implement this method within the EFI stub and create a copy of the logs
for the TPM device using a Linux-specific EFI configuration table
(LINUX_EFI_TPM_EVENT_LOG). This will create
/sys/kernel/security/tpm0/binary_bios_measurements for TPM 2.0 devices
(similarly to the current behaviour for TPM 1.2 devices).

Two formats for the log entries exist: TPM 1.2 (SHA1) and TPM 2.0 (Crypto
Agile). This patch set only retrieves the first type of logs. The second
type will be implemented in a subsequent patch set.

According to the specifications[1], once GetEventLog has been called,
future events shall be stored in a separate EFI configuration table
(EFI_TCG2_FINAL_EVENTS_TABLE). Events stored in this table are not
processed in this patch set as they are stored in the Crypto Agile format.
These could eventually be merged with the new table for a unified view
of the logs from userspace.

[1] TCG EFI Protocol Specification, Revision 00.13, March 30, 2016
    https://trustedcomputinggroup.org/wp-content/uploads/EFI-Protocol-Specification-rev13-160330final.pdf

-------------------------------------------------------------------------------

Patchset Changelog:

Version 3:
- Move event log providers (acpi and of) to tpm_eventlog_*.c
- Move efi changes from PATCH 3 to PATCH 2
- Change return value of tpm_read_log_acpi and tpm_read_log_of
- Change iounmap to memunmap calls
- Use log_tbl as variable name for consistency
- Fix kbuild failures

Version 2:
- Move tpm_eventlog.h to top include directory, add commit for this.
- Use EFI_LOADER_DATA to store the configuration table
- Whitespace and new lines fixes

Thiebaud Weksteen (5):
  tpm: move tpm_eventlog.h outside of drivers folder
  tpm: rename event log provider files
  tpm: add event log format version
  efi: call get_event_log before ExitBootServices
  tpm: parse TPM event logs based on EFI table

 arch/x86/boot/compressed/eboot.c                   |  1 +
 drivers/char/tpm/Makefile                          |  5 +-
 drivers/char/tpm/tpm-chip.c                        |  3 +-
 drivers/char/tpm/tpm-interface.c                   |  2 +-
 drivers/char/tpm/tpm.h                             | 35 ++++++++--
 drivers/char/tpm/tpm1_eventlog.c                   | 13 +++-
 drivers/char/tpm/tpm2_eventlog.c                   |  2 +-
 .../char/tpm/{tpm_acpi.c => tpm_eventlog_acpi.c}   |  4 +-
 drivers/char/tpm/tpm_eventlog_efi.c                | 66 ++++++++++++++++++
 drivers/char/tpm/{tpm_of.c => tpm_eventlog_of.c}   |  6 +-
 drivers/firmware/efi/Makefile                      |  2 +-
 drivers/firmware/efi/efi.c                         |  4 ++
 drivers/firmware/efi/libstub/Makefile              |  3 +-
 drivers/firmware/efi/libstub/tpm.c                 | 81 ++++++++++++++++++++++
 drivers/firmware/efi/tpm.c                         | 40 +++++++++++
 include/linux/efi.h                                | 46 ++++++++++++
 {drivers/char/tpm => include/linux}/tpm_eventlog.h | 35 +++-------
 17 files changed, 304 insertions(+), 44 deletions(-)
 rename drivers/char/tpm/{tpm_acpi.c => tpm_eventlog_acpi.c} (97%)
 create mode 100644 drivers/char/tpm/tpm_eventlog_efi.c
 rename drivers/char/tpm/{tpm_of.c => tpm_eventlog_of.c} (93%)
 create mode 100644 drivers/firmware/efi/tpm.c
 rename {drivers/char/tpm => include/linux}/tpm_eventlog.h (77%)

-- 
2.14.1.821.g8fa685d3b7-goog

             reply index

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-09-20  8:13 Thiebaud Weksteen [this message]
     [not found] ` <20170920081340.7413-1-tweek-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>
2017-09-20  8:13   ` [PATCH v3 1/5] tpm: move tpm_eventlog.h outside of drivers folder Thiebaud Weksteen
2017-09-20  8:13   ` [PATCH v3 2/5] tpm: rename event log provider files Thiebaud Weksteen via tpmdd-devel
2017-09-26 11:10     ` Jarkko Sakkinen
2017-09-20  8:13   ` [PATCH v3 3/5] tpm: add event log format version Thiebaud Weksteen via tpmdd-devel
2017-09-20  8:13   ` [PATCH v3 4/5] efi: call get_event_log before ExitBootServices Thiebaud Weksteen via tpmdd-devel
     [not found]     ` <20170920081340.7413-5-tweek-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>
2017-09-26 11:45       ` Jarkko Sakkinen
2017-09-26 12:49         ` Thiebaud Weksteen
2017-09-29 17:16           ` Jarkko Sakkinen
     [not found]             ` <20170929171617.yq4dvn66czvnebns-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>
2017-10-04 10:51               ` Jarkko Sakkinen
2017-10-04 11:12                 ` Thiebaud Weksteen
2017-10-10 14:14                   ` Jarkko Sakkinen
     [not found]                     ` <20171010141419.e4uv4fkmcmpc7sdc-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>
2017-10-11  1:54                       ` James Morris
2017-10-11 11:52                         ` Jarkko Sakkinen
     [not found]                           ` <20171011115254.2n4zs77ixyl2mdgm-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>
2017-10-11 11:53                             ` Jarkko Sakkinen
2017-10-12 11:38                               ` Jarkko Sakkinen
     [not found]                                 ` <20171012113844.ptfynppgx3tkwe7g-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>
2017-10-12 15:03                                   ` Javier Martinez Canillas
     [not found]                                     ` <CABxcv=neJZjA407pbmNesNbGY9k3VRbhawut6ewofw_UB5U1_w-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2017-10-13 19:47                                       ` Jarkko Sakkinen
2017-10-16 11:34                                         ` Jarkko Sakkinen
2017-10-16 11:28                             ` Jarkko Sakkinen
2017-10-16 11:49                               ` Jarkko Sakkinen
     [not found]                                 ` <20171016114946.phj3n6vyjdbpj2sj-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>
2017-10-17  8:00                                   ` Thiebaud Weksteen
     [not found]                                     ` <CA+zpnLc038dv-WAE7fdD8i6DpGV3zCLEieg-KPTAvaW7yt-tLA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2017-10-18 15:11                                       ` Jarkko Sakkinen
2017-10-26 18:58                                       ` Jarkko Sakkinen
     [not found]                 ` <20171004105113.mcho3rlytaxfruyf-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>
2017-10-04 11:20                   ` Jarkko Sakkinen
2018-03-05 15:40     ` Marc-André Lureau
2018-03-06 10:15       ` Thiebaud Weksteen
2017-09-21 15:13   ` [PATCH v3 0/5] Call GetEventLog " Jarkko Sakkinen
2017-09-26 11:17   ` [tpmdd-devel] " Javier Martinez Canillas
2017-09-20  8:13 ` [PATCH v3 5/5] tpm: parse TPM event logs based on EFI table Thiebaud Weksteen
     [not found]   ` <20170920081340.7413-6-tweek-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>
2017-09-20 16:40     ` Jason Gunthorpe

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170920081340.7413-1-tweek@google.com \
    --to=tweek-hpiqsd4aklfqt0dzr+alfa@public.gmane.org \
    --cc=ard.biesheuvel-QSEj5FYQhm4dnm+yROfE0A@public.gmane.org \
    --cc=jarkko.sakkinen-VuQAYsv1563Yd54FQh9/CA@public.gmane.org \
    --cc=jgunthorpe-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org \
    --cc=linux-efi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=linux-integrity-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=matt-mF/unelCI9GS6iBeEJttW/XRex20P6io@public.gmane.org \
    --cc=mjg59-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org \
    --cc=peterhuewe-Mmb7MZpHnFY@public.gmane.org \
    --cc=tpmdd-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org \
    --cc=tpmdd-yWjUBOtONefk1uMJSBkQmQ@public.gmane.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

tpmdd-devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/tpmdd-devel/0 tpmdd-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 tpmdd-devel tpmdd-devel/ https://lore.kernel.org/tpmdd-devel \
		tpmdd-devel@lists.sourceforge.net
	public-inbox-index tpmdd-devel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/net.sourceforge.lists.tpmdd-devel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git