From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3DF5EC433FE for ; Wed, 24 Nov 2021 07:04:52 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 75CC682FAD; Wed, 24 Nov 2021 08:04:50 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="JRDO5/Le"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id A6D2782FA8; Wed, 24 Nov 2021 08:04:48 +0100 (CET) Received: from mail-ed1-x529.google.com (mail-ed1-x529.google.com [IPv6:2a00:1450:4864:20::529]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 4AD7A82FA8 for ; Wed, 24 Nov 2021 08:04:45 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ed1-x529.google.com with SMTP id v1so5933233edx.2 for ; Tue, 23 Nov 2021 23:04:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=bC6fb5LXfTF+UgteiT1RIF0ldKyrAZ1bQlNTxQIHAx4=; b=JRDO5/LeQGhS2Y0ZIj78DjOg9HCRh9xrQl988bmXfsnljgT05irbKdkN12nHucYPBz DbmP2iO2EWlrarkehc/kvu7MVkS82J6UfeHYQS9A0kVogmmmr/rxj5h8DvFfpt2VJF2n CBdg6NLByEtYlPin/60UZ5d3hWIKg0t5Sdt8MleyovTWucEUbD37QH4RvMlXI7fOqbWl EJeEOa9QpJEtUpEruYqFnx/XZDStiSfnXNC1J1kKSXV8tcHlckYUzu4epvMobcuNMFYU aM+R4JW0Ms5A0sudeK10wHWHAkXzVMfs8RC4roozjKh2qRB7LQ9GniRvdEPlX6QTOsOR A8eg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=bC6fb5LXfTF+UgteiT1RIF0ldKyrAZ1bQlNTxQIHAx4=; b=6+K20tA8n9/8jqgapMsocYY8iHq3YWKUEFOMV+NkhdwXctDmKtyn6Gg24R16/7OkCT HXvV1JbmcvbilIBtYQc1pfj6lFdyNsCMmdBx36CncMbYtI0AHp+67EcYlAFPv6pYRKKN 6vVTVAezPqJvTgWBAc5wk6ZkkrQl6B5IVa+oKOk7iMGvIcbPz/k2dPfqJt2BYtz7BjG/ czOLqOEmKqT+De53u76wHubzVCY2LjmYwGY0rYTK9mNPey/8+u+8d4IhxTvrNlB+AAZd dj1w3b0ZsFE+pBBg8ZXCePs13p4Pc6FTYrq5tk6j9qtdYgYVxF461CP2Vqbzl0DBaLps Wwsw== X-Gm-Message-State: AOAM530GNkqRtacVHUuKGPOTaOfut2uToL1jpB15l4w5dTm2IZ2DR+qs I73Apz+t75EhgQt+mUr0CY8wnA== X-Google-Smtp-Source: ABdhPJxgC7oUPYP4BYPJNdyfP3GmIz+RLTZZaANWsCfNfqFLE1jCzHtuuf40eoKCxXoPlGI8gWTH/w== X-Received: by 2002:a05:6402:4404:: with SMTP id y4mr20889262eda.321.1637737484823; Tue, 23 Nov 2021 23:04:44 -0800 (PST) Received: from apalos.home (ppp-94-66-220-227.home.otenet.gr. [94.66.220.227]) by smtp.gmail.com with ESMTPSA id og38sm6178619ejc.5.2021.11.23.23.04.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 23 Nov 2021 23:04:44 -0800 (PST) Date: Wed, 24 Nov 2021 09:04:42 +0200 From: Ilias Apalodimas To: Ruchika Gupta Cc: u-boot@lists.denx.de, xypron.glpk@gmx.de, agraf@csgraf.de Subject: Re: [v2][PATCH 1/3] efi_loader: Add check for event log passed from firmware Message-ID: References: <20211123115335.125252-1-ruchika.gupta@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20211123115335.125252-1-ruchika.gupta@linaro.org> X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.37 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean Hi Ruchika, > + [...] > + ret = platform_get_eventlog(dev, &base, &sz); > + if (ret == EFI_SUCCESS) { Can we invert the logic here? if (ret != EFI_SUCCESS) return ret; etc... > + void *buffer = (void *)base; > + > + if (sz > TPM2_EVENT_LOG_SIZE) > + return EFI_VOLUME_FULL; > + > + pos = 0; > + /* Parse the eventlog to check for its validity */ > + ret = parse_event_log_header(buffer, sz, &pos); > + if (ret || pos > sz) > + return EFI_COMPROMISED_DATA; > + > + ret = parse_specid_event(dev, buffer, sz, &pos, &digest_list); > + if (ret || pos > sz) { > + log_err("Error parsing SPEC ID Event\n"); > + return EFI_COMPROMISED_DATA; > + } > + > + while (pos < sz) { > + ret = tcg2_parse_event(dev, buffer, sz, &pos, > + &digest_list, &pcr); > + if (ret) { > + log_err("Error parsing event\n"); > + return ret; > + } > + } > + > + memcpy(log_buffer, buffer, sz); > + *log_sz = sz; > + } > + > + return ret; > +} > + > /** > * create_specid_event() - Create the first event in the eventlog > * > @@ -1340,6 +1622,12 @@ static efi_status_t efi_init_event_log(void) > * last log entry > */ > memset(event_log.buffer, 0xff, TPM2_EVENT_LOG_SIZE); > + > + /* > + * The log header is defined to be in SHA1 event log entry format. > + * Setup event header > + */ > + event_header = (struct tcg_pcr_event *)event_log.buffer; > event_log.pos = 0; > event_log.last_event_size = 0; > event_log.get_event_called = false; > @@ -1347,22 +1635,28 @@ static efi_status_t efi_init_event_log(void) > event_log.truncated = false; > > /* > - * The log header is defined to be in SHA1 event log entry format. > - * Setup event header > + * Check if earlier firmware have passed any eventlog. Different > + * platforms can use different ways to do so > */ > - event_header = (struct tcg_pcr_event *)event_log.buffer; > - put_unaligned_le32(0, &event_header->pcr_index); > - put_unaligned_le32(EV_NO_ACTION, &event_header->event_type); > - memset(&event_header->digest, 0, sizeof(event_header->digest)); > - ret = create_specid_event(dev, (void *)((uintptr_t)event_log.buffer + sizeof(*event_header)), > - &spec_event_size); > - if (ret != EFI_SUCCESS) > - goto free_pool; > - put_unaligned_le32(spec_event_size, &event_header->event_size); > - event_log.pos = spec_event_size + sizeof(*event_header); > - event_log.last_event_size = event_log.pos; > + ret = tcg2_get_fw_eventlog(dev, event_log.buffer, &event_log.pos); > + if (ret == EFI_NOT_FOUND) { > + put_unaligned_le32(0, &event_header->pcr_index); > + put_unaligned_le32(EV_NO_ACTION, &event_header->event_type); > + memset(&event_header->digest, 0, sizeof(event_header->digest)); > + ret = create_specid_event(dev, > + (void *)((uintptr_t)event_log.buffer + > + sizeof(*event_header)), > + &spec_event_size); > + if (ret != EFI_SUCCESS) > + goto free_pool; > + put_unaligned_le32(spec_event_size, &event_header->event_size); > + event_log.pos = spec_event_size + sizeof(*event_header); > + event_log.last_event_size = event_log.pos; > + } > + > + if (ret == EFI_SUCCESS) > + ret = create_final_event(); Same here please. Check for != EFI_SUCCESS and exit before creating the final eventlog config table. > > - ret = create_final_event(); > if (ret != EFI_SUCCESS) > goto free_pool; > > -- > 2.25.1 > Thanks /lias