efi/libstub/tpm.c

0001 // SPDX-License-Identifier: GPL-2.0
0002 /*
0003  * TPM handling.
0004  *
0005  * Copyright (C) 2016 CoreOS, Inc
0006  * Copyright (C) 2017 Google, Inc.
0007  *     Matthew Garrett <mjg59@google.com>
0008  *     Thiebaud Weksteen <tweek@google.com>
0009  */
0010 #include <linux/efi.h>
0011 #include <linux/tpm_eventlog.h>
0012 #include <asm/efi.h>
0013
0014 #include "efistub.h"
0015
0016 #ifdef CONFIG_RESET_ATTACK_MITIGATION
0017 static const efi_char16_t efi_MemoryOverWriteRequest_name[] =
0018     L"MemoryOverwriteRequestControl";
0019
0020 #define MEMORY_ONLY_RESET_CONTROL_GUID \
0021     EFI_GUID(0xe20939be, 0x32d4, 0x41be, 0xa1, 0x50, 0x89, 0x7f, 0x85, 0xd4, 0x98, 0x29)
0022
0023 /*
0024  * Enable reboot attack mitigation. This requests that the firmware clear the
0025  * RAM on next reboot before proceeding with boot, ensuring that any secrets
0026  * are cleared. If userland has ensured that all secrets have been removed
0027  * from RAM before reboot it can simply reset this variable.
0028  */
0029 void efi_enable_reset_attack_mitigation(void)
0030 {
0031     u8 val = 1;
0032     efi_guid_t var_guid = MEMORY_ONLY_RESET_CONTROL_GUID;
0033     efi_status_t status;
0034     unsigned long datasize = 0;
0035
0036     status = get_efi_var(efi_MemoryOverWriteRequest_name, &var_guid,
0037                  NULL, &datasize, NULL);
0038
0039     if (status == EFI_NOT_FOUND)
0040         return;
0041
0042     set_efi_var(efi_MemoryOverWriteRequest_name, &var_guid,
0043             EFI_VARIABLE_NON_VOLATILE |
0044             EFI_VARIABLE_BOOTSERVICE_ACCESS |
0045             EFI_VARIABLE_RUNTIME_ACCESS, sizeof(val), &val);
0046 }
0047
0048 #endif
0049
0050 void efi_retrieve_tpm2_eventlog(void)
0051 {
0052     efi_guid_t tcg2_guid = EFI_TCG2_PROTOCOL_GUID;
0053     efi_guid_t linux_eventlog_guid = LINUX_EFI_TPM_EVENT_LOG_GUID;
0054     efi_status_t status;
0055     efi_physical_addr_t log_location = 0, log_last_entry = 0;
0056     struct linux_efi_tpm_eventlog *log_tbl = NULL;
0057     struct efi_tcg2_final_events_table *final_events_table = NULL;
0058     unsigned long first_entry_addr, last_entry_addr;
0059     size_t log_size, last_entry_size;
0060     efi_bool_t truncated;
0061     int version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_2;
0062     efi_tcg2_protocol_t *tcg2_protocol = NULL;
0063     int final_events_size = 0;
0064
0065     status = efi_bs_call(locate_protocol, &tcg2_guid, NULL,
0066                  (void **)&tcg2_protocol);
0067     if (status != EFI_SUCCESS)
0068         return;
0069
0070     status = efi_call_proto(tcg2_protocol, get_event_log, version,
0071                 &log_location, &log_last_entry, &truncated);
0072
0073     if (status != EFI_SUCCESS || !log_location) {
0074         version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2;
0075         status = efi_call_proto(tcg2_protocol, get_event_log, version,
0076                     &log_location, &log_last_entry,
0077                     &truncated);
0078         if (status != EFI_SUCCESS || !log_location)
0079             return;
0080
0081     }
0082
0083     first_entry_addr = (unsigned long) log_location;
0084
0085     /*
0086      * We populate the EFI table even if the logs are empty.
0087      */
0088     if (!log_last_entry) {
0089         log_size = 0;
0090     } else {
0091         last_entry_addr = (unsigned long) log_last_entry;
0092         /*
0093          * get_event_log only returns the address of the last entry.
0094          * We need to calculate its size to deduce the full size of
0095          * the logs.
0096          */
0097         if (version == EFI_TCG2_EVENT_LOG_FORMAT_TCG_2) {
0098             /*
0099              * The TCG2 log format has variable length entries,
0100              * and the information to decode the hash algorithms
0101              * back into a size is contained in the first entry -
0102              * pass a pointer to the final entry (to calculate its
0103              * size) and the first entry (so we know how long each
0104              * digest is)
0105              */
0106             last_entry_size =
0107                 __calc_tpm2_event_size((void *)last_entry_addr,
0108                             (void *)(long)log_location,
0109                             false);
0110         } else {
0111             last_entry_size = sizeof(struct tcpa_event) +
0112                ((struct tcpa_event *) last_entry_addr)->event_size;
0113         }
0114         log_size = log_last_entry - log_location + last_entry_size;
0115     }
0116
0117     /* Allocate space for the logs and copy them. */
0118     status = efi_bs_call(allocate_pool, EFI_LOADER_DATA,
0119                  sizeof(*log_tbl) + log_size, (void **)&log_tbl);
0120
0121     if (status != EFI_SUCCESS) {
0122         efi_err("Unable to allocate memory for event log\n");
0123         return;
0124     }
0125
0126     /*
0127      * Figure out whether any events have already been logged to the
0128      * final events structure, and if so how much space they take up
0129      */
0130     if (version == EFI_TCG2_EVENT_LOG_FORMAT_TCG_2)
0131         final_events_table = get_efi_config_table(LINUX_EFI_TPM_FINAL_LOG_GUID);
0132     if (final_events_table && final_events_table->nr_events) {
0133         struct tcg_pcr_event2_head *header;
0134         int offset;
0135         void *data;
0136         int event_size;
0137         int i = final_events_table->nr_events;
0138
0139         data = (void *)final_events_table;
0140         offset = sizeof(final_events_table->version) +
0141             sizeof(final_events_table->nr_events);
0142
0143         while (i > 0) {
0144             header = data + offset + final_events_size;
0145             event_size = __calc_tpm2_event_size(header,
0146                            (void *)(long)log_location,
0147                            false);
0148             final_events_size += event_size;
0149             i--;
0150         }
0151     }
0152
0153     memset(log_tbl, 0, sizeof(*log_tbl) + log_size);
0154     log_tbl->size = log_size;
0155     log_tbl->final_events_preboot_size = final_events_size;
0156     log_tbl->version = version;
0157     memcpy(log_tbl->log, (void *) first_entry_addr, log_size);
0158
0159     status = efi_bs_call(install_configuration_table,
0160                  &linux_eventlog_guid, log_tbl);
0161     if (status != EFI_SUCCESS)
0162         goto err_free;
0163     return;
0164
0165 err_free:
0166     efi_bs_call(free_pool, log_tbl);
0167 }