From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6A171C4338F for ; Mon, 16 Aug 2021 00:33:51 +0000 (UTC) Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 5B21B6137D for ; Mon, 16 Aug 2021 00:33:50 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 5B21B6137D Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=lists.denx.de Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 3D28881FA5; Mon, 16 Aug 2021 02:33:47 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="RTH4+4Rh"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 1CD0282DA7; Mon, 16 Aug 2021 02:33:45 +0200 (CEST) Received: from mail-io1-xd32.google.com (mail-io1-xd32.google.com [IPv6:2607:f8b0:4864:20::d32]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 7FF43817D3 for ; Mon, 16 Aug 2021 02:33:38 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=masahisa.kojima@linaro.org Received: by mail-io1-xd32.google.com with SMTP id q16so18486164ioj.0 for ; Sun, 15 Aug 2021 17:33:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Nf09AOtxTBe6S9IU1GhxgzYuQQHKK3nYDVuTMHkLYPM=; b=RTH4+4RhN0c34I6t9s75ObzNTsti3m7gNo6KzuIFWAFWStTLGjQcOc033KeR2DsXdj 7gHySMwcIs5YDQ7FvOdE7ekyWbWUDyrniz2xwcgtZsySCh03Eko73ESnu7GYNBKyN7Ib fG+nLB+RSxCqOgDMRworXLng8MeMzt2LmTRK9RPCWxXlVa06MBvDSLCnRMAwqDOoOVXJ QZeYwZofMuPaTmMjU5neFGYZej3iit38OWS5CC/LGJAytZ6TtZrbybHpufsYCtWc+PoR zhRHn8vjJv5Wz1vV+oXcxo9nV3kqIQXF+TAR6w1ZrdCGuCAiyCfdqnPC0nIayoaN9l40 NnPg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Nf09AOtxTBe6S9IU1GhxgzYuQQHKK3nYDVuTMHkLYPM=; b=F+oGoP7D2oXoxtOtFy5nBOuCJE1uz21QGTrUnSi1AE1PsTtXEdljk1wR97j9zeRoEh 3fdbFQ/COH4K1WNOAYZQrtnvSH+r85hFLK9YN1T8BYrV1h5Nl0kIEBJ0vaYEVKgHDSVw 423QceYKcKSgIGovIHO424cgJsQ1viurwfinY9bHL5OG/h9tfOwnfhPHvL9hdt+dX5qS 2trQrOqpmgq7QlA6BRwOAbPxt8ZHDDc/PB8NCH4x0Pjuqiu7wI1v6ieNyu4oY/p2qbXV Rayef3WUYrDRXp+SUh3f54wX1VmcT9+6K/TVOBJXorINR9Gp+MYcTUIYpp1z6LtiJQBv nfOA== X-Gm-Message-State: AOAM530dtW5s2o2z/Kr5tc3rXmq4tOHuFzAJNSv1SbvLsvW28e1w+abf szuHb374W3sFwRGzhBsCLy6mVHfcgxE6p/jhWf5cmQ== X-Google-Smtp-Source: ABdhPJyPn6OT2P6pNMgQqCs72s8+ICFyOKIUUdVX38Ia+H+sR2csVMWNkEipavbTmoyAjQG18gS3phFydXkvmGjnJGE= X-Received: by 2002:a5e:9747:: with SMTP id h7mr10562084ioq.92.1629074017010; Sun, 15 Aug 2021 17:33:37 -0700 (PDT) MIME-Version: 1.0 References: <20210813071243.18885-1-masahisa.kojima@linaro.org> <20210813071243.18885-4-masahisa.kojima@linaro.org> In-Reply-To: From: Masahisa Kojima Date: Mon, 16 Aug 2021 09:33:24 +0900 Message-ID: Subject: Re: [PATCH v4 3/5] efi_loader: add ExitBootServices() measurement To: Heinrich Schuchardt Cc: Alexander Graf , Ilias Apalodimas , Simon Glass , Dhananjay Phadke , AKASHI Takahiro , U-Boot Mailing List Content-Type: text/plain; charset="UTF-8" X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean On Sat, 14 Aug 2021 at 18:06, Heinrich Schuchardt wrote: > > On 8/13/21 9:12 AM, Masahisa Kojima wrote: > > TCG PC Client PFP spec requires to measure > > "Exit Boot Services Invocation" if ExitBootServices() is invoked. > > Depending upon the return code from the ExitBootServices() call, > > "Exit Boot Services Returned with Success" or "Exit Boot Services > > Returned with Failure" is also measured. > > > > Signed-off-by: Masahisa Kojima > > --- > > Changes in v4: > > - remove unnecessary EFIAPI specifier > > > > Changes in v2: > > - use strlen instead of sizeof, event log for EV_EFI_ACTION string > > > > shall not include NUL terminator > > include/efi_loader.h | 1 + > > lib/efi_loader/efi_boottime.c | 5 +++ > > lib/efi_loader/efi_tcg2.c | 70 +++++++++++++++++++++++++++++++++++ > > 3 files changed, 76 insertions(+) > > > > diff --git a/include/efi_loader.h b/include/efi_loader.h > > index 6f61e9faac..32cb8d0f1e 100644 > > --- a/include/efi_loader.h > > +++ b/include/efi_loader.h > > @@ -499,6 +499,7 @@ efi_status_t efi_run_image(void *source_buffer, efi_uintn_t source_size); > > efi_status_t efi_init_variables(void); > > /* Notify ExitBootServices() is called */ > > void efi_variables_boot_exit_notify(void); > > +efi_status_t efi_tcg2_notify_exit_boot_services_failed(void); > > /* Measure efi application invocation */ > > efi_status_t efi_tcg2_measure_efi_app_invocation(void); > > /* Measure efi application exit */ > > diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c > > index 13ab139222..b818cbb540 100644 > > --- a/lib/efi_loader/efi_boottime.c > > +++ b/lib/efi_loader/efi_boottime.c > > @@ -2182,6 +2182,11 @@ static efi_status_t EFIAPI efi_exit_boot_services(efi_handle_t image_handle, > > efi_set_watchdog(0); > > WATCHDOG_RESET(); > > out: > > + if (ret != EFI_SUCCESS) { > > + if (IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL)) > > + efi_tcg2_notify_exit_boot_services_failed(); > > + } > > + > > return EFI_EXIT(ret); > > } > > > > diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c > > index ed71337780..8557fce1da 100644 > > --- a/lib/efi_loader/efi_tcg2.c > > +++ b/lib/efi_loader/efi_tcg2.c > > @@ -1506,6 +1506,67 @@ efi_status_t efi_tcg2_measure_efi_app_exit(void) > > return ret; > > } > > > > +/** > > + * efi_tcg2_notify_exit_boot_services() - ExitBootService callback > > + * > > + * @event: callback event > > + * @context: callback context > > + */ > > +static void > > Event notification functions must be of return type void EFIAPI to match > the ABI used by the x86_64 in the UEFI API. > > I will fix this when merging. Hi Heinrich, Thank you for your fix and merging. Regards, Masahisa Kojima > > Best regards > > Heinrich > > > +efi_tcg2_notify_exit_boot_services(struct efi_event *event, void *context) > > +{ > > + efi_status_t ret; > > + struct udevice *dev; > > + > > + EFI_ENTRY("%p, %p", event, context); > > + > > + ret = platform_get_tpm2_device(&dev); > > + if (ret != EFI_SUCCESS) > > + goto out; > > + > > + ret = tcg2_measure_event(dev, 5, EV_EFI_ACTION, > > + strlen(EFI_EXIT_BOOT_SERVICES_INVOCATION), > > + (u8 *)EFI_EXIT_BOOT_SERVICES_INVOCATION); > > + if (ret != EFI_SUCCESS) > > + goto out; > > + > > + ret = tcg2_measure_event(dev, 5, EV_EFI_ACTION, > > + strlen(EFI_EXIT_BOOT_SERVICES_SUCCEEDED), > > + (u8 *)EFI_EXIT_BOOT_SERVICES_SUCCEEDED); > > + > > +out: > > + EFI_EXIT(ret); > > +} > > + > > +/** > > + * efi_tcg2_notify_exit_boot_services_failed() > > + * - notify ExitBootServices() is failed > > + * > > + * Return: status code > > + */ > > +efi_status_t efi_tcg2_notify_exit_boot_services_failed(void) > > +{ > > + struct udevice *dev; > > + efi_status_t ret; > > + > > + ret = platform_get_tpm2_device(&dev); > > + if (ret != EFI_SUCCESS) > > + goto out; > > + > > + ret = tcg2_measure_event(dev, 5, EV_EFI_ACTION, > > + strlen(EFI_EXIT_BOOT_SERVICES_INVOCATION), > > + (u8 *)EFI_EXIT_BOOT_SERVICES_INVOCATION); > > + if (ret != EFI_SUCCESS) > > + goto out; > > + > > + ret = tcg2_measure_event(dev, 5, EV_EFI_ACTION, > > + strlen(EFI_EXIT_BOOT_SERVICES_FAILED), > > + (u8 *)EFI_EXIT_BOOT_SERVICES_FAILED); > > + > > +out: > > + return ret; > > +} > > + > > /** > > * tcg2_measure_secure_boot_variable() - measure secure boot variables > > * > > @@ -1584,6 +1645,7 @@ efi_status_t efi_tcg2_register(void) > > { > > efi_status_t ret = EFI_SUCCESS; > > struct udevice *dev; > > + struct efi_event *event; > > > > ret = platform_get_tpm2_device(&dev); > > if (ret != EFI_SUCCESS) { > > @@ -1608,6 +1670,14 @@ efi_status_t efi_tcg2_register(void) > > goto fail; > > } > > > > + ret = efi_create_event(EVT_SIGNAL_EXIT_BOOT_SERVICES, TPL_CALLBACK, > > + efi_tcg2_notify_exit_boot_services, NULL, > > + NULL, &event); > > + if (ret != EFI_SUCCESS) { > > + tcg2_uninit(); > > + goto fail; > > + } > > + > > ret = tcg2_measure_secure_boot_variable(dev); > > if (ret != EFI_SUCCESS) { > > tcg2_uninit(); > > >