1 /* 2 * TPM handling. 3 * 4 * Copyright (C) 2016 CoreOS, Inc 5 * Copyright (C) 2017 Google, Inc. 6 * Matthew Garrett <mjg59@google.com> 7 * Thiebaud Weksteen <tweek@google.com> 8 * 9 * This file is part of the Linux kernel, and is made available under the 10 * terms of the GNU General Public License version 2. 11 */ 12 #include <linux/efi.h> 13 #include <linux/tpm_eventlog.h> 14 #include <asm/efi.h> 15 16 #include "efistub.h" 17 18 #ifdef CONFIG_RESET_ATTACK_MITIGATION 19 static const efi_char16_t efi_MemoryOverWriteRequest_name[] = 20 L"MemoryOverwriteRequestControl"; 21 22 #define MEMORY_ONLY_RESET_CONTROL_GUID \ 23 EFI_GUID(0xe20939be, 0x32d4, 0x41be, 0xa1, 0x50, 0x89, 0x7f, 0x85, 0xd4, 0x98, 0x29) 24 25 #define get_efi_var(name, vendor, ...) \ 26 efi_call_runtime(get_variable, \ 27 (efi_char16_t *)(name), (efi_guid_t *)(vendor), \ 28 __VA_ARGS__) 29 30 #define set_efi_var(name, vendor, ...) \ 31 efi_call_runtime(set_variable, \ 32 (efi_char16_t *)(name), (efi_guid_t *)(vendor), \ 33 __VA_ARGS__) 34 35 /* 36 * Enable reboot attack mitigation. This requests that the firmware clear the 37 * RAM on next reboot before proceeding with boot, ensuring that any secrets 38 * are cleared. If userland has ensured that all secrets have been removed 39 * from RAM before reboot it can simply reset this variable. 40 */ 41 void efi_enable_reset_attack_mitigation(efi_system_table_t *sys_table_arg) 42 { 43 u8 val = 1; 44 efi_guid_t var_guid = MEMORY_ONLY_RESET_CONTROL_GUID; 45 efi_status_t status; 46 unsigned long datasize = 0; 47 48 status = get_efi_var(efi_MemoryOverWriteRequest_name, &var_guid, 49 NULL, &datasize, NULL); 50 51 if (status == EFI_NOT_FOUND) 52 return; 53 54 set_efi_var(efi_MemoryOverWriteRequest_name, &var_guid, 55 EFI_VARIABLE_NON_VOLATILE | 56 EFI_VARIABLE_BOOTSERVICE_ACCESS | 57 EFI_VARIABLE_RUNTIME_ACCESS, sizeof(val), &val); 58 } 59 60 #endif 61 62 static void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg) 63 { 64 efi_guid_t tcg2_guid = EFI_TCG2_PROTOCOL_GUID; 65 efi_guid_t linux_eventlog_guid = LINUX_EFI_TPM_EVENT_LOG_GUID; 66 efi_status_t status; 67 efi_physical_addr_t log_location = 0, log_last_entry = 0; 68 struct linux_efi_tpm_eventlog *log_tbl = NULL; 69 unsigned long first_entry_addr, last_entry_addr; 70 size_t log_size, last_entry_size; 71 efi_bool_t truncated; 72 void *tcg2_protocol = NULL; 73 74 status = efi_call_early(locate_protocol, &tcg2_guid, NULL, 75 &tcg2_protocol); 76 if (status != EFI_SUCCESS) 77 return; 78 79 status = efi_call_proto(efi_tcg2_protocol, get_event_log, tcg2_protocol, 80 EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2, 81 &log_location, &log_last_entry, &truncated); 82 if (status != EFI_SUCCESS) 83 return; 84 85 if (!log_location) 86 return; 87 first_entry_addr = (unsigned long) log_location; 88 89 /* 90 * We populate the EFI table even if the logs are empty. 91 */ 92 if (!log_last_entry) { 93 log_size = 0; 94 } else { 95 last_entry_addr = (unsigned long) log_last_entry; 96 /* 97 * get_event_log only returns the address of the last entry. 98 * We need to calculate its size to deduce the full size of 99 * the logs. 100 */ 101 last_entry_size = sizeof(struct tcpa_event) + 102 ((struct tcpa_event *) last_entry_addr)->event_size; 103 log_size = log_last_entry - log_location + last_entry_size; 104 } 105 106 /* Allocate space for the logs and copy them. */ 107 status = efi_call_early(allocate_pool, EFI_LOADER_DATA, 108 sizeof(*log_tbl) + log_size, 109 (void **) &log_tbl); 110 111 if (status != EFI_SUCCESS) { 112 efi_printk(sys_table_arg, 113 "Unable to allocate memory for event log\n"); 114 return; 115 } 116 117 memset(log_tbl, 0, sizeof(*log_tbl) + log_size); 118 log_tbl->size = log_size; 119 log_tbl->version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2; 120 memcpy(log_tbl->log, (void *) first_entry_addr, log_size); 121 122 status = efi_call_early(install_configuration_table, 123 &linux_eventlog_guid, log_tbl); 124 if (status != EFI_SUCCESS) 125 goto err_free; 126 return; 127 128 err_free: 129 efi_call_early(free_pool, log_tbl); 130 } 131 132 void efi_retrieve_tpm2_eventlog(efi_system_table_t *sys_table_arg) 133 { 134 /* Only try to retrieve the logs in 1.2 format. */ 135 efi_retrieve_tpm2_eventlog_1_2(sys_table_arg); 136 } 137