1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * TPM handling. 4 * 5 * Copyright (C) 2016 CoreOS, Inc 6 * Copyright (C) 2017 Google, Inc. 7 * Matthew Garrett <mjg59@google.com> 8 * Thiebaud Weksteen <tweek@google.com> 9 */ 10 #include <linux/efi.h> 11 #include <linux/tpm_eventlog.h> 12 #include <asm/efi.h> 13 14 #include "efistub.h" 15 16 #ifdef CONFIG_RESET_ATTACK_MITIGATION 17 static const efi_char16_t efi_MemoryOverWriteRequest_name[] = 18 L"MemoryOverwriteRequestControl"; 19 20 #define MEMORY_ONLY_RESET_CONTROL_GUID \ 21 EFI_GUID(0xe20939be, 0x32d4, 0x41be, 0xa1, 0x50, 0x89, 0x7f, 0x85, 0xd4, 0x98, 0x29) 22 23 #define get_efi_var(name, vendor, ...) \ 24 efi_call_runtime(get_variable, \ 25 (efi_char16_t *)(name), (efi_guid_t *)(vendor), \ 26 __VA_ARGS__) 27 28 #define set_efi_var(name, vendor, ...) \ 29 efi_call_runtime(set_variable, \ 30 (efi_char16_t *)(name), (efi_guid_t *)(vendor), \ 31 __VA_ARGS__) 32 33 /* 34 * Enable reboot attack mitigation. This requests that the firmware clear the 35 * RAM on next reboot before proceeding with boot, ensuring that any secrets 36 * are cleared. If userland has ensured that all secrets have been removed 37 * from RAM before reboot it can simply reset this variable. 38 */ 39 void efi_enable_reset_attack_mitigation(efi_system_table_t *sys_table_arg) 40 { 41 u8 val = 1; 42 efi_guid_t var_guid = MEMORY_ONLY_RESET_CONTROL_GUID; 43 efi_status_t status; 44 unsigned long datasize = 0; 45 46 status = get_efi_var(efi_MemoryOverWriteRequest_name, &var_guid, 47 NULL, &datasize, NULL); 48 49 if (status == EFI_NOT_FOUND) 50 return; 51 52 set_efi_var(efi_MemoryOverWriteRequest_name, &var_guid, 53 EFI_VARIABLE_NON_VOLATILE | 54 EFI_VARIABLE_BOOTSERVICE_ACCESS | 55 EFI_VARIABLE_RUNTIME_ACCESS, sizeof(val), &val); 56 } 57 58 #endif 59 60 static void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg) 61 { 62 efi_guid_t tcg2_guid = EFI_TCG2_PROTOCOL_GUID; 63 efi_guid_t linux_eventlog_guid = LINUX_EFI_TPM_EVENT_LOG_GUID; 64 efi_status_t status; 65 efi_physical_addr_t log_location = 0, log_last_entry = 0; 66 struct linux_efi_tpm_eventlog *log_tbl = NULL; 67 unsigned long first_entry_addr, last_entry_addr; 68 size_t log_size, last_entry_size; 69 efi_bool_t truncated; 70 void *tcg2_protocol = NULL; 71 72 status = efi_call_early(locate_protocol, &tcg2_guid, NULL, 73 &tcg2_protocol); 74 if (status != EFI_SUCCESS) 75 return; 76 77 status = efi_call_proto(efi_tcg2_protocol, get_event_log, tcg2_protocol, 78 EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2, 79 &log_location, &log_last_entry, &truncated); 80 if (status != EFI_SUCCESS) 81 return; 82 83 if (!log_location) 84 return; 85 first_entry_addr = (unsigned long) log_location; 86 87 /* 88 * We populate the EFI table even if the logs are empty. 89 */ 90 if (!log_last_entry) { 91 log_size = 0; 92 } else { 93 last_entry_addr = (unsigned long) log_last_entry; 94 /* 95 * get_event_log only returns the address of the last entry. 96 * We need to calculate its size to deduce the full size of 97 * the logs. 98 */ 99 last_entry_size = sizeof(struct tcpa_event) + 100 ((struct tcpa_event *) last_entry_addr)->event_size; 101 log_size = log_last_entry - log_location + last_entry_size; 102 } 103 104 /* Allocate space for the logs and copy them. */ 105 status = efi_call_early(allocate_pool, EFI_LOADER_DATA, 106 sizeof(*log_tbl) + log_size, 107 (void **) &log_tbl); 108 109 if (status != EFI_SUCCESS) { 110 efi_printk(sys_table_arg, 111 "Unable to allocate memory for event log\n"); 112 return; 113 } 114 115 memset(log_tbl, 0, sizeof(*log_tbl) + log_size); 116 log_tbl->size = log_size; 117 log_tbl->version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2; 118 memcpy(log_tbl->log, (void *) first_entry_addr, log_size); 119 120 status = efi_call_early(install_configuration_table, 121 &linux_eventlog_guid, log_tbl); 122 if (status != EFI_SUCCESS) 123 goto err_free; 124 return; 125 126 err_free: 127 efi_call_early(free_pool, log_tbl); 128 } 129 130 void efi_retrieve_tpm2_eventlog(efi_system_table_t *sys_table_arg) 131 { 132 /* Only try to retrieve the logs in 1.2 format. */ 133 efi_retrieve_tpm2_eventlog_1_2(sys_table_arg); 134 } 135