1 /* 2 * TPM handling. 3 * 4 * Copyright (C) 2016 CoreOS, Inc 5 * Copyright (C) 2017 Google, Inc. 6 * Matthew Garrett <mjg59@google.com> 7 * Thiebaud Weksteen <tweek@google.com> 8 * 9 * This file is part of the Linux kernel, and is made available under the 10 * terms of the GNU General Public License version 2. 11 */ 12 #include <linux/efi.h> 13 #include <linux/tpm_eventlog.h> 14 #include <asm/efi.h> 15 16 #include "efistub.h" 17 18 #ifdef CONFIG_RESET_ATTACK_MITIGATION 19 static const efi_char16_t efi_MemoryOverWriteRequest_name[] = { 20 'M', 'e', 'm', 'o', 'r', 'y', 'O', 'v', 'e', 'r', 'w', 'r', 'i', 't', 21 'e', 'R', 'e', 'q', 'u', 'e', 's', 't', 'C', 'o', 'n', 't', 'r', 'o', 22 'l', 0 23 }; 24 25 #define MEMORY_ONLY_RESET_CONTROL_GUID \ 26 EFI_GUID(0xe20939be, 0x32d4, 0x41be, 0xa1, 0x50, 0x89, 0x7f, 0x85, 0xd4, 0x98, 0x29) 27 28 #define get_efi_var(name, vendor, ...) \ 29 efi_call_runtime(get_variable, \ 30 (efi_char16_t *)(name), (efi_guid_t *)(vendor), \ 31 __VA_ARGS__) 32 33 #define set_efi_var(name, vendor, ...) \ 34 efi_call_runtime(set_variable, \ 35 (efi_char16_t *)(name), (efi_guid_t *)(vendor), \ 36 __VA_ARGS__) 37 38 /* 39 * Enable reboot attack mitigation. This requests that the firmware clear the 40 * RAM on next reboot before proceeding with boot, ensuring that any secrets 41 * are cleared. If userland has ensured that all secrets have been removed 42 * from RAM before reboot it can simply reset this variable. 43 */ 44 void efi_enable_reset_attack_mitigation(efi_system_table_t *sys_table_arg) 45 { 46 u8 val = 1; 47 efi_guid_t var_guid = MEMORY_ONLY_RESET_CONTROL_GUID; 48 efi_status_t status; 49 unsigned long datasize = 0; 50 51 status = get_efi_var(efi_MemoryOverWriteRequest_name, &var_guid, 52 NULL, &datasize, NULL); 53 54 if (status == EFI_NOT_FOUND) 55 return; 56 57 set_efi_var(efi_MemoryOverWriteRequest_name, &var_guid, 58 EFI_VARIABLE_NON_VOLATILE | 59 EFI_VARIABLE_BOOTSERVICE_ACCESS | 60 EFI_VARIABLE_RUNTIME_ACCESS, sizeof(val), &val); 61 } 62 63 #endif 64 65 void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg) 66 { 67 efi_guid_t tcg2_guid = EFI_TCG2_PROTOCOL_GUID; 68 efi_guid_t linux_eventlog_guid = LINUX_EFI_TPM_EVENT_LOG_GUID; 69 efi_status_t status; 70 efi_physical_addr_t log_location, log_last_entry; 71 struct linux_efi_tpm_eventlog *log_tbl = NULL; 72 unsigned long first_entry_addr, last_entry_addr; 73 size_t log_size, last_entry_size; 74 efi_bool_t truncated; 75 void *tcg2_protocol = NULL; 76 77 status = efi_call_early(locate_protocol, &tcg2_guid, NULL, 78 &tcg2_protocol); 79 if (status != EFI_SUCCESS) 80 return; 81 82 status = efi_call_proto(efi_tcg2_protocol, get_event_log, tcg2_protocol, 83 EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2, 84 &log_location, &log_last_entry, &truncated); 85 if (status != EFI_SUCCESS) 86 return; 87 88 if (!log_location) 89 return; 90 first_entry_addr = (unsigned long) log_location; 91 92 /* 93 * We populate the EFI table even if the logs are empty. 94 */ 95 if (!log_last_entry) { 96 log_size = 0; 97 } else { 98 last_entry_addr = (unsigned long) log_last_entry; 99 /* 100 * get_event_log only returns the address of the last entry. 101 * We need to calculate its size to deduce the full size of 102 * the logs. 103 */ 104 last_entry_size = sizeof(struct tcpa_event) + 105 ((struct tcpa_event *) last_entry_addr)->event_size; 106 log_size = log_last_entry - log_location + last_entry_size; 107 } 108 109 /* Allocate space for the logs and copy them. */ 110 status = efi_call_early(allocate_pool, EFI_LOADER_DATA, 111 sizeof(*log_tbl) + log_size, 112 (void **) &log_tbl); 113 114 if (status != EFI_SUCCESS) { 115 efi_printk(sys_table_arg, 116 "Unable to allocate memory for event log\n"); 117 return; 118 } 119 120 memset(log_tbl, 0, sizeof(*log_tbl) + log_size); 121 log_tbl->size = log_size; 122 log_tbl->version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2; 123 memcpy(log_tbl->log, (void *) first_entry_addr, log_size); 124 125 status = efi_call_early(install_configuration_table, 126 &linux_eventlog_guid, log_tbl); 127 if (status != EFI_SUCCESS) 128 goto err_free; 129 return; 130 131 err_free: 132 efi_call_early(free_pool, log_tbl); 133 } 134 135 void efi_retrieve_tpm2_eventlog(efi_system_table_t *sys_table_arg) 136 { 137 /* Only try to retrieve the logs in 1.2 format. */ 138 efi_retrieve_tpm2_eventlog_1_2(sys_table_arg); 139 } 140