[PATCH v5 1/3] efi_loader: Add check for event log passed from firmware

Ilias Apalodimas ilias.apalodimas at linaro.org
Thu Nov 25 09:10:21 CET 2021


On Wed, 24 Nov 2021 at 17:09, Ruchika Gupta <ruchika.gupta at linaro.org> wrote:
>
> Platforms may have support to measure their initial firmware components
> and pass the event log to u-boot. The event log address can be passed
> in property tpm_event_log_addr and tpm_event_log_size of the tpm node.
> Platforms may choose their own specific mechanism to do so. A weak
> function is added to check if even log has been passed to u-boot
> from earlier firmware components. If available, the eventlog is parsed
> to check for its correctness and further event logs are appended to the
> passed log.
>
> Signed-off-by: Ruchika Gupta <ruchika.gupta at linaro.org>
> ---
> v5:
> Shift the efi_init_event_log() to a different location in the file.
> This help fixes compilation issue introduced by calling efi_append_scrtm_version()
> from it.
>
> v4:
> Add SCRTM version to log only if previous firmware doesn't pass the eventlog
>
> v3:
> Return as soon as you detect error
>
> v2:
> Moved firmware eventlog code parsing to tcg2_get_fw_eventlog()
>
>  lib/efi_loader/efi_tcg2.c | 438 ++++++++++++++++++++++++++++++++------
>  1 file changed, 369 insertions(+), 69 deletions(-)
>
> diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c
> index 8c1f22e337..a789c44660 100644
> --- a/lib/efi_loader/efi_tcg2.c
> +++ b/lib/efi_loader/efi_tcg2.c
> @@ -324,6 +324,45 @@ __weak efi_status_t platform_get_tpm2_device(struct udevice **dev)
>         return EFI_NOT_FOUND;
>  }
>
> +/**
> + * platform_get_eventlog() - retrieve the eventlog address and size
> + *
> + * This function retrieves the eventlog address and size if the underlying
> + * firmware has done some measurements and passed them.
> + *
> + * This function may be overridden based on platform specific method of
> + * passing the eventlog address and size.
> + *
> + * @dev:       udevice
> + * @addr:      eventlog address
> + * @sz:                eventlog size
> + * Return:     status code
> + */
> +__weak efi_status_t platform_get_eventlog(struct udevice *dev, u64 *addr,
> +                                         u32 *sz)
> +{
> +       const u64 *basep;
> +       const u32 *sizep;
> +
> +       basep = dev_read_prop(dev, "tpm_event_log_addr", NULL);
> +       if (!basep)
> +               return EFI_NOT_FOUND;
> +
> +       *addr = be64_to_cpup((__force __be64 *)basep);
> +
> +       sizep = dev_read_prop(dev, "tpm_event_log_size", NULL);
> +       if (!sizep)
> +               return EFI_NOT_FOUND;
> +
> +       *sz = be32_to_cpup((__force __be32 *)sizep);
> +       if (*sz == 0) {
> +               log_debug("event log empty\n");
> +               return EFI_NOT_FOUND;
> +       }
> +
> +       return EFI_SUCCESS;
> +}
> +
>  /**
>   * tpm2_get_max_command_size() - get the supported max command size
>   *
> @@ -1181,6 +1220,250 @@ static const struct efi_tcg2_protocol efi_tcg2_protocol = {
>         .get_result_of_set_active_pcr_banks = efi_tcg2_get_result_of_set_active_pcr_banks,
>  };
>
> +/**
> + * parse_event_log_header() -  Parse and verify the event log header fields
> + *
> + * @buffer:                    Pointer to the event header
> + * @size:                      Size of the eventlog
> + * @pos:                       Position in buffer after event log header
> + *
> + * Return:     status code
> + */
> +efi_status_t parse_event_log_header(void *buffer, u32 size, u32 *pos)
> +{
> +       struct tcg_pcr_event *event_header = (struct tcg_pcr_event *)buffer;
> +       int i = 0;
> +
> +       if (size < sizeof(*event_header))
> +               return EFI_COMPROMISED_DATA;
> +
> +       if (get_unaligned_le32(&event_header->pcr_index) != 0 ||
> +           get_unaligned_le32(&event_header->event_type) != EV_NO_ACTION)
> +               return EFI_COMPROMISED_DATA;
> +
> +       for (i = 0; i < sizeof(event_header->digest); i++) {
> +               if (event_header->digest[i] != 0)
> +                       return EFI_COMPROMISED_DATA;
> +       }
> +
> +       *pos += sizeof(*event_header);
> +
> +       return EFI_SUCCESS;
> +}
> +
> +/**
> + * parse_specid_event() -  Parse and verify the specID Event in the eventlog
> + *
> + * @dev:               udevice
> + * @buffer:            Pointer to the start of the eventlog
> + * @log_size:          Size of the eventlog
> + * @pos:               Offset in the evenlog where specID event starts
> + *
> + * Return:             status code
> + * @pos                        Offset in the eventlog where the specID event ends
> + * @digest_list:       list of digests in the event
> + */
> +efi_status_t parse_specid_event(struct udevice *dev, void *buffer, u32 log_size,
> +                               u32 *pos,
> +                               struct tpml_digest_values *digest_list)
> +{
> +       struct tcg_efi_spec_id_event *spec_event;
> +       struct tcg_pcr_event *event_header = (struct tcg_pcr_event *)buffer;
> +       size_t spec_event_size;
> +       u32 active = 0, supported = 0, pcr_count = 0, alg_count = 0;
> +       u32 spec_active = 0;
> +       u16 hash_alg, hash_sz;
> +       u8 vendor_sz;
> +       int err, i;
> +
> +       /* Check specID event data */
> +       spec_event = (struct tcg_efi_spec_id_event *)((uintptr_t)buffer + *pos);
> +       /* Check for signature */
> +       if (memcmp(spec_event->signature, TCG_EFI_SPEC_ID_EVENT_SIGNATURE_03,
> +                  sizeof(TCG_EFI_SPEC_ID_EVENT_SIGNATURE_03))) {
> +               log_err("specID Event: Signature mismatch\n");
> +               return EFI_COMPROMISED_DATA;
> +       }
> +
> +       if (spec_event->spec_version_minor !=
> +                       TCG_EFI_SPEC_ID_EVENT_SPEC_VERSION_MINOR_TPM2 ||
> +           spec_event->spec_version_major !=
> +                       TCG_EFI_SPEC_ID_EVENT_SPEC_VERSION_MAJOR_TPM2)
> +               return EFI_COMPROMISED_DATA;
> +
> +       if (spec_event->number_of_algorithms > MAX_HASH_COUNT ||
> +           spec_event->number_of_algorithms < 1) {
> +               log_err("specID Event: Number of algorithms incorrect\n");
> +               return EFI_COMPROMISED_DATA;
> +       }
> +
> +       alg_count = spec_event->number_of_algorithms;
> +
> +       err = tpm2_get_pcr_info(dev, &supported, &active, &pcr_count);
> +       if (err)
> +               return EFI_DEVICE_ERROR;
> +
> +       digest_list->count = 0;
> +       /*
> +        * We may need to worry about the order of algs in this structure as
> +        * subsequent entries in event should be in same order
> +        */
> +       for (i = 0; i < alg_count; i++) {
> +               hash_alg =
> +                 get_unaligned_le16(&spec_event->digest_sizes[i].algorithm_id);
> +               hash_sz =
> +                  get_unaligned_le16(&spec_event->digest_sizes[i].digest_size);
> +
> +               if (!(supported & alg_to_mask(hash_alg))) {
> +                       log_err("specID Event: Unsupported algorithm\n");
> +                       return EFI_COMPROMISED_DATA;
> +               }
> +               digest_list->digests[digest_list->count++].hash_alg = hash_alg;
> +
> +               spec_active |= alg_to_mask(hash_alg);
> +       }
> +
> +       /* TCG spec expects the event log to have hashes for all active PCR's */
> +       if (spec_active != active) {
> +               /*
> +                * Previous stage bootloader should know all the active PCR's
> +                * and use them in the Eventlog.
> +                */
> +               log_err("specID Event: All active hash alg not present\n");
> +               return EFI_COMPROMISED_DATA;
> +       }
> +
> +       /*
> +        * the size of the spec event and placement of vendor_info_size
> +        * depends on supported algoriths
> +        */
> +       spec_event_size =
> +               offsetof(struct tcg_efi_spec_id_event, digest_sizes) +
> +               alg_count * sizeof(spec_event->digest_sizes[0]);
> +
> +       vendor_sz = *(uint8_t *)((uintptr_t)buffer + *pos + spec_event_size);
> +
> +       spec_event_size += sizeof(vendor_sz) + vendor_sz;
> +       *pos += spec_event_size;
> +
> +       if (get_unaligned_le32(&event_header->event_size) != spec_event_size) {
> +               log_err("specID event: header event size mismatch\n");
> +               /* Right way to handle this can be to call SetActive PCR's */
> +               return EFI_COMPROMISED_DATA;
> +       }
> +
> +       return EFI_SUCCESS;
> +}
> +
> +efi_status_t tcg2_parse_event(struct udevice *dev, void *buffer, u32 log_size,
> +                             u32 *offset, struct tpml_digest_values *digest_list,
> +                             u32 *pcr)
> +{
> +       struct tcg_pcr_event2 *event = NULL;
> +       u32 event_type, count, size, event_size;
> +       size_t pos;
> +
> +       if (*offset > log_size)
> +               return EFI_COMPROMISED_DATA;
> +
> +       event = (struct tcg_pcr_event2 *)((uintptr_t)buffer + *offset);
> +
> +       *pcr = get_unaligned_le32(&event->pcr_index);
> +
> +       event_size = tcg_event_final_size(digest_list);
> +
> +       if (*offset + event_size > log_size) {
> +               log_err("Event exceeds log size\n");
> +               return EFI_COMPROMISED_DATA;
> +       }
> +
> +       event_type = get_unaligned_le32(&event->event_type);
> +
> +       /* get the count */
> +       count = get_unaligned_le32(&event->digests.count);
> +       if (count != digest_list->count)
> +               return EFI_COMPROMISED_DATA;
> +
> +       pos = offsetof(struct tcg_pcr_event2, digests);
> +       pos += offsetof(struct tpml_digest_values, digests);
> +
> +       for (int i = 0; i < digest_list->count; i++) {
> +               u16 alg;
> +               u16 hash_alg = digest_list->digests[i].hash_alg;
> +               u8 *digest = (u8 *)&digest_list->digests[i].digest;
> +
> +               alg = get_unaligned_le16((void *)((uintptr_t)event + pos));
> +
> +               if (alg != hash_alg)
> +                       return EFI_COMPROMISED_DATA;
> +
> +               pos += offsetof(struct tpmt_ha, digest);
> +               memcpy(digest, (void *)((uintptr_t)event + pos), alg_to_len(hash_alg));
> +               pos += alg_to_len(hash_alg);
> +       }
> +
> +       size = get_unaligned_le32((void *)((uintptr_t)event + pos));
> +       event_size += size;
> +       pos += sizeof(u32); /* tcg_pcr_event2 event_size*/
> +       pos += size;
> +
> +       /* make sure the calculated buffer is what we checked against */
> +       if (pos != event_size)
> +               return EFI_COMPROMISED_DATA;
> +
> +       if (pos > log_size)
> +               return EFI_COMPROMISED_DATA;
> +
> +       *offset += pos;
> +
> +       return EFI_SUCCESS;
> +}
> +
> +efi_status_t tcg2_get_fw_eventlog(struct udevice *dev, void *log_buffer,
> +                                 size_t *log_sz)
> +{
> +       struct tpml_digest_values digest_list;
> +       void *buffer;
> +       efi_status_t ret;
> +       u32 pcr, pos;
> +       u64 base;
> +       u32 sz;
> +
> +       ret = platform_get_eventlog(dev, &base, &sz);
> +       if (ret != EFI_SUCCESS)
> +               return ret;
> +
> +       if (sz > TPM2_EVENT_LOG_SIZE)
> +               return EFI_VOLUME_FULL;
> +
> +       buffer = (void *)base;
> +       pos = 0;
> +       /* Parse the eventlog to check for its validity */
> +       ret = parse_event_log_header(buffer, sz, &pos);
> +       if (ret || pos > sz)
> +               return EFI_COMPROMISED_DATA;
> +
> +       ret = parse_specid_event(dev, buffer, sz, &pos, &digest_list);
> +       if (ret || pos > sz) {
> +               log_err("Error parsing SPEC ID Event\n");
> +               return EFI_COMPROMISED_DATA;
> +       }
> +
> +       while (pos < sz) {
> +               ret = tcg2_parse_event(dev, buffer, sz, &pos, &digest_list,
> +                                      &pcr);
> +               if (ret) {
> +                       log_err("Error parsing event\n");
> +                       return ret;
> +               }
> +       }
> +
> +       memcpy(log_buffer, buffer, sz);
> +       *log_sz = sz;
> +
> +       return ret;
> +}
> +
>  /**
>   * create_specid_event() - Create the first event in the eventlog
>   *
> @@ -1312,69 +1595,6 @@ out:
>         return ret;
>  }
>
> -/**
> - * efi_init_event_log() - initialize an eventlog
> - */
> -static efi_status_t efi_init_event_log(void)
> -{
> -       /*
> -        * vendor_info_size is currently set to 0, we need to change the length
> -        * and allocate the flexible array member if this changes
> -        */
> -       struct tcg_pcr_event *event_header = NULL;
> -       struct udevice *dev;
> -       size_t spec_event_size;
> -       efi_status_t ret;
> -
> -       ret = platform_get_tpm2_device(&dev);
> -       if (ret != EFI_SUCCESS)
> -               goto out;
> -
> -       ret = efi_allocate_pool(EFI_BOOT_SERVICES_DATA, TPM2_EVENT_LOG_SIZE,
> -                               (void **)&event_log.buffer);
> -       if (ret != EFI_SUCCESS)
> -               goto out;
> -
> -       /*
> -        * initialize log area as 0xff so the OS can easily figure out the
> -        * last log entry
> -        */
> -       memset(event_log.buffer, 0xff, TPM2_EVENT_LOG_SIZE);
> -       event_log.pos = 0;
> -       event_log.last_event_size = 0;
> -       event_log.get_event_called = false;
> -       event_log.ebs_called = false;
> -       event_log.truncated = false;
> -
> -       /*
> -        * The log header is defined to be in SHA1 event log entry format.
> -        * Setup event header
> -        */
> -       event_header =  (struct tcg_pcr_event *)event_log.buffer;
> -       put_unaligned_le32(0, &event_header->pcr_index);
> -       put_unaligned_le32(EV_NO_ACTION, &event_header->event_type);
> -       memset(&event_header->digest, 0, sizeof(event_header->digest));
> -       ret = create_specid_event(dev, (void *)((uintptr_t)event_log.buffer + sizeof(*event_header)),
> -                                 &spec_event_size);
> -       if (ret != EFI_SUCCESS)
> -               goto free_pool;
> -       put_unaligned_le32(spec_event_size, &event_header->event_size);
> -       event_log.pos = spec_event_size + sizeof(*event_header);
> -       event_log.last_event_size = event_log.pos;
> -
> -       ret = create_final_event();
> -       if (ret != EFI_SUCCESS)
> -               goto free_pool;
> -
> -out:
> -       return ret;
> -
> -free_pool:
> -       efi_free_pool(event_log.buffer);
> -       event_log.buffer = NULL;
> -       return ret;
> -}
> -
>  /**
>   * tcg2_measure_event() - common function to add event log and extend PCR
>   *
> @@ -1427,6 +1647,92 @@ static efi_status_t efi_append_scrtm_version(struct udevice *dev)
>         return ret;
>  }
>
> +/**
> + * efi_init_event_log() - initialize an eventlog
> + */
> +static efi_status_t efi_init_event_log(void)
> +{
> +       /*
> +        * vendor_info_size is currently set to 0, we need to change the length
> +        * and allocate the flexible array member if this changes
> +        */
> +       struct tcg_pcr_event *event_header = NULL;
> +       struct udevice *dev;
> +       size_t spec_event_size;
> +       efi_status_t ret;
> +
> +       ret = platform_get_tpm2_device(&dev);
> +       if (ret != EFI_SUCCESS)
> +               goto out;
> +
> +       ret = efi_allocate_pool(EFI_BOOT_SERVICES_DATA, TPM2_EVENT_LOG_SIZE,
> +                               (void **)&event_log.buffer);
> +       if (ret != EFI_SUCCESS)
> +               goto out;
> +
> +       /*
> +        * initialize log area as 0xff so the OS can easily figure out the
> +        * last log entry
> +        */
> +       memset(event_log.buffer, 0xff, TPM2_EVENT_LOG_SIZE);
> +
> +       /*
> +        * The log header is defined to be in SHA1 event log entry format.
> +        * Setup event header
> +        */
> +       event_header =  (struct tcg_pcr_event *)event_log.buffer;
> +       event_log.pos = 0;
> +       event_log.last_event_size = 0;
> +       event_log.get_event_called = false;
> +       event_log.ebs_called = false;
> +       event_log.truncated = false;
> +
> +       /*
> +        * Check if earlier firmware have passed any eventlog. Different
> +        * platforms can use different ways to do so
> +        */
> +       ret = tcg2_get_fw_eventlog(dev, event_log.buffer, &event_log.pos);
> +       /*
> +        * If earlier firmware hasn't passed any eventlog, go ahead and
> +        * create the eventlog header
> +        */
> +       if (ret == EFI_NOT_FOUND) {
> +               put_unaligned_le32(0, &event_header->pcr_index);
> +               put_unaligned_le32(EV_NO_ACTION, &event_header->event_type);
> +               memset(&event_header->digest, 0, sizeof(event_header->digest));
> +               ret = create_specid_event(dev,
> +                                         (void *)((uintptr_t)event_log.buffer +
> +                                                  sizeof(*event_header)),
> +                                         &spec_event_size);
> +               if (ret != EFI_SUCCESS)
> +                       goto free_pool;
> +               put_unaligned_le32(spec_event_size, &event_header->event_size);
> +               event_log.pos = spec_event_size + sizeof(*event_header);
> +               event_log.last_event_size = event_log.pos;
> +
> +               /*
> +                * Add SCRTM version to the log if previous firmmware
> +                * doesn't pass an eventlog
> +                */
> +               ret = efi_append_scrtm_version(dev);
> +       }
> +
> +       if (ret != EFI_SUCCESS)
> +               goto free_pool;
> +
> +       ret = create_final_event();
> +       if (ret != EFI_SUCCESS)
> +               goto free_pool;
> +
> +out:
> +       return ret;
> +
> +free_pool:
> +       efi_free_pool(event_log.buffer);
> +       event_log.buffer = NULL;
> +       return ret;
> +}
> +
>  /**
>   * tcg2_measure_variable() - add variable event log and extend PCR
>   *
> @@ -1963,12 +2269,6 @@ efi_status_t efi_tcg2_register(void)
>         if (ret != EFI_SUCCESS)
>                 goto fail;
>
> -       ret = efi_append_scrtm_version(dev);
> -       if (ret != EFI_SUCCESS) {
> -               tcg2_uninit();
> -               goto fail;
> -       }
> -
>         ret = efi_add_protocol(efi_root, &efi_guid_tcg2_protocol,
>                                (void *)&efi_tcg2_protocol);
>         if (ret != EFI_SUCCESS) {
> --
> 2.25.1
>

Tested-by: Ilias Apalodimas <ilias.apalodimas at linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas at linaro.org>


More information about the U-Boot mailing list