From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1nH7OG-0000IL-Fc for mharc-grub-devel@gnu.org; Mon, 07 Feb 2022 12:01:25 -0500 Received: from eggs.gnu.org ([209.51.188.92]:59712) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nH7O3-0000FT-0z for grub-devel@gnu.org; Mon, 07 Feb 2022 12:01:14 -0500 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]:37681) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nH7Nv-0001tV-K1 for grub-devel@gnu.org; Mon, 07 Feb 2022 12:01:08 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1644253255; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=1LrMTqDjHRquefRCF2Lc2mXd/aqsY89GDgJSrqBAXrU=; b=F3ce/syTNMbHZ9MfCQVVT4z4XBnjqjwGIVRu1IeuwGMlDOp+Otb1vfjDyPy21aBICvLvCA xuA2J21jxR6USzxCZpuS/aP0RuBbZK4/13KIwuBOGjbaLa5Q+QyMcDGA/ECx6k9ZP3JNJX MhLyMUYJ8VPY3MZikwn1eU6WlkmPpeg= Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-605-N832eLxfMhiAr__jlaTQYA-1; Mon, 07 Feb 2022 12:00:54 -0500 X-MC-Unique: N832eLxfMhiAr__jlaTQYA-1 Received: by mail-wr1-f70.google.com with SMTP id e11-20020adf9bcb000000b001e316b01456so1053244wrc.21 for ; Mon, 07 Feb 2022 09:00:53 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=1LrMTqDjHRquefRCF2Lc2mXd/aqsY89GDgJSrqBAXrU=; b=xBk54xCS43ajkPJnyTp6jKcZqje005yJsEhiH6A8iqjdKblng7bK7x60k7JrAXnnfo WpNX733Xd6myWNmlDQNjBaszkjm+2VVcUdq5qIIBHa0lpH97Ga3A+GEB1OpFaO6lHUum e3u+4twuwZE8vPUnxHmrFOVdnMS1X1keJGRksxmvZq/dqqSkPmKiZHI8GKGw91lFcDic i5hADSSkRjSEAeZY9cOlsTsWy4TIOvmk707MO4C1NRX7Nr2GjDGWyWmHUjEBs3I8YQXO l3hM47ZYG8Jys2+xMSEO309kSR7kvW5+TgOKifmYbBmsscBECq14M661Fir+/1deZliN LPMw== X-Gm-Message-State: AOAM532geF3WKnkrGMlgzQfiXWcYYiVRM4tyMRN8HFYqVRvf903X3b9e PpusAxqUO9J283BlinGgsr3ACp1OiQ70F9Muk75HY8l53Jj3yGVWyjKp22A4Dsvyti1yRE9NUQi msdAhpr009wk= X-Received: by 2002:a05:600c:364f:: with SMTP id y15mr283835wmq.125.1644253252700; Mon, 07 Feb 2022 09:00:52 -0800 (PST) X-Google-Smtp-Source: ABdhPJyy8Hn+u7h29cb4af/zoqWO0sWSDrFACg8FOkjURSKBkgMHYH8VDlxPI3805vhRKK6xWUwm4A== X-Received: by 2002:a05:600c:364f:: with SMTP id y15mr283809wmq.125.1644253252445; Mon, 07 Feb 2022 09:00:52 -0800 (PST) Received: from work-vm (cpc109025-salf6-2-0-cust480.10-2.cable.virginm.net. [82.30.61.225]) by smtp.gmail.com with ESMTPSA id m25sm17123562wml.47.2022.02.07.09.00.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 07 Feb 2022 09:00:52 -0800 (PST) Date: Mon, 7 Feb 2022 17:00:50 +0000 From: "Dr. David Alan Gilbert" To: James Bottomley Cc: grub-devel@gnu.org, thomas.lendacky@amd.com, ashish.kalra@amd.com, brijesh.singh@amd.com, david.kaplan@amd.com, jon.grimm@amd.com, tobin@ibm.com, frankeh@us.ibm.com, dovmurik@linux.vnet.ibm.com, Dov.Murik1@il.ibm.com, Javier Martinez Canillas , GNUtoo@cyberdimension.org, ps@pks.im, development@efficientek.com, Daniel Kiper Subject: Re: [PATCH v4 2/2] efi: Add API for retrieving the EFI secret for cryptodisk Message-ID: References: <20220207152944.27183-1-jejb@linux.ibm.com> <20220207152944.27183-3-jejb@linux.ibm.com> MIME-Version: 1.0 In-Reply-To: <20220207152944.27183-3-jejb@linux.ibm.com> User-Agent: Mutt/2.1.5 (2021-12-30) Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=dgilbert@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Received-SPF: pass client-ip=170.10.129.124; envelope-from=dgilbert@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Feb 2022 17:01:18 -0000 * James Bottomley (jejb@linux.ibm.com) wrote: > This module is designed to provide an efisecret provider which > interrogates the EFI configuration table to find the location of the > confidential computing secret and tries to register the secret with > the cryptodisk. > > The secret is stored in a boot allocated area, usually a page in size. > The layout of the secret injection area is a header > > |GRUB_EFI_SECRET_TABLE_HEADER_GUID|len| > > with entries of the form > > |guid|len|data| > > the guid corresponding to the disk encryption passphrase is > GRUB_EFI_DISKPASSWD_GUID and data must be a zero terminated string. > To get a high entropy string that doesn't need large numbers of > iterations, use a base64 encoding of 33 bytes of random data. > > Signed-off-by: James Bottomley > > --- > > v2: use callback to print failure message and destroy secret > v3: change to generic naming to use for TDX and SEV and use new mechanism > v4: review fixes > --- > grub-core/Makefile.core.def | 8 ++ > grub-core/disk/efi/efisecret.c | 129 +++++++++++++++++++++++++++++++++ > include/grub/efi/api.h | 15 ++++ > 3 files changed, 152 insertions(+) > create mode 100644 grub-core/disk/efi/efisecret.c > > diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def > index 8022e1c0a..6293ddaa5 100644 > --- a/grub-core/Makefile.core.def > +++ b/grub-core/Makefile.core.def > @@ -788,6 +788,14 @@ module = { > enable = efi; > }; > > +module = { > + name = efisecret; > + > + common = disk/efi/efisecret.c; > + > + enable = efi; > +}; > + > module = { > name = lsefimmap; > > diff --git a/grub-core/disk/efi/efisecret.c b/grub-core/disk/efi/efisecret.c > new file mode 100644 > index 000000000..4cecebbdc > --- /dev/null > +++ b/grub-core/disk/efi/efisecret.c > @@ -0,0 +1,129 @@ > +#include > +#include > +#include > +#include > +#include > +#include > + > +GRUB_MOD_LICENSE ("GPLv3+"); > + > +static grub_efi_packed_guid_t secret_guid = GRUB_EFI_SECRET_TABLE_GUID; > +static grub_efi_packed_guid_t tableheader_guid = GRUB_EFI_SECRET_TABLE_HEADER_GUID; > +static grub_efi_packed_guid_t diskpasswd_guid = GRUB_EFI_DISKPASSWD_GUID; > + > +struct efi_secret { > + grub_uint64_t base; > + grub_uint64_t size; > +}; > + > +struct secret_header { > + grub_efi_packed_guid_t guid; > + grub_uint32_t len; > +}; > + > +struct secret_entry { > + grub_efi_packed_guid_t guid; > + grub_uint32_t len; > + grub_uint8_t data[0]; > +}; > + > +static grub_err_t > +grub_efi_secret_put (const char *arg __attribute__((unused)), int have_it, > + grub_uint8_t **ptr) > +{ > + struct secret_entry *e = (struct secret_entry *)(*ptr - (long)&((struct secret_entry *)0)->data); use offsetof ? > + int len = e->len; > + > + /* destroy the secret */ > + grub_memset (e, 0, len); > + /* put back the length to make sure the table is still traversable */ > + e->len = len; > + > + *ptr = NULL; > + > + if (have_it) > + return GRUB_ERR_NONE; > + > + return grub_error (GRUB_ERR_ACCESS_DENIED, "EFI secret failed to unlock any volumes"); > +} > + > +static grub_err_t > +grub_efi_secret_find (struct efi_secret *s, grub_uint8_t **secret_ptr) > +{ > + int len; > + struct secret_header *h; > + struct secret_entry *e; > + unsigned char *ptr = (unsigned char *)(unsigned long)s->base; > + > + /* the area must be big enough for a guid and a u32 length */ > + if (s->size < sizeof (*h)) > + return grub_error (GRUB_ERR_BAD_ARGUMENT, "EFI secret area is too small"); > + > + h = (struct secret_header *)ptr; > + if (grub_memcmp(&h->guid, &tableheader_guid, sizeof (h->guid))) > + return grub_error (GRUB_ERR_BAD_ARGUMENT, "EFI secret area does not start with correct guid\n"); > + if (h->len < sizeof (*h)) > + return grub_error (GRUB_ERR_BAD_ARGUMENT, "EFI secret area is too small\n"); These grub_error calls (and a couple later) are terminated using a \n which I don't think you want. > + > + len = h->len - sizeof (*h); > + ptr += sizeof (*h); > + > + while (len >= (int)sizeof (*e)) { > + e = (struct secret_entry *)ptr; > + if (e->len < sizeof(*e) || e->len > (unsigned int)len) > + return grub_error (GRUB_ERR_BAD_ARGUMENT, "EFI secret area is corrupt\n"); > + > + if (! grub_memcmp (&e->guid, &diskpasswd_guid, sizeof (e->guid))) { > + int end = e->len - sizeof(*e); > + > + /* > + * the passphrase must be a zero terminated string because the > + * password routines call grub_strlen () to find its size > + */ > + if (end < 2 || e->data[end - 1] != '\0') > + return grub_error (GRUB_ERR_BAD_ARGUMENT, "EFI secret area disk encryption password is corrupt\n"); > + > + *secret_ptr = e->data; > + return GRUB_ERR_NONE; > + } > + ptr += e->len; > + len -= e->len; > + } > + return grub_error (GRUB_ERR_BAD_ARGUMENT, "EFI secret area does not contain disk decryption password\n"); > +} > + > +static grub_err_t > +grub_efi_secret_get (const char *arg __attribute__((unused)), grub_uint8_t **ptr) > +{ > + unsigned int i; > + > + for (i = 0; i < grub_efi_system_table->num_table_entries; i++) > + { > + grub_efi_packed_guid_t *guid = > + &grub_efi_system_table->configuration_table[i].vendor_guid; > + > + if (! grub_memcmp (guid, &secret_guid, sizeof (grub_efi_packed_guid_t))) { > + struct efi_secret *s = > + grub_efi_system_table->configuration_table[i].vendor_table; > + > + return grub_efi_secret_find(s, ptr); > + } > + } > + return grub_error (GRUB_ERR_BAD_ARGUMENT, "No secret found in the EFI configuration table"); > +} > + > +static struct grub_secret_entry secret = { > + .name = "efisecret", > + .get = grub_efi_secret_get, > + .put = grub_efi_secret_put, > +}; > + > +GRUB_MOD_INIT(efisecret) > +{ > + grub_cryptodisk_add_secret_provider (&secret); > +} > + > +GRUB_MOD_FINI(efisecret) > +{ > + grub_cryptodisk_remove_secret_provider (&secret); > +} > diff --git a/include/grub/efi/api.h b/include/grub/efi/api.h > index f1a52210c..f33a8f2ab 100644 > --- a/include/grub/efi/api.h > +++ b/include/grub/efi/api.h > @@ -299,6 +299,21 @@ > { 0x9a, 0x16, 0x00, 0x90, 0x27, 0x3f, 0xc1, 0x4d } \ > } > > +#define GRUB_EFI_SECRET_TABLE_GUID \ > + { 0xadf956ad, 0xe98c, 0x484c, \ > + { 0xae, 0x11, 0xb5, 0x1c, 0x7d, 0x33, 0x64, 0x47} \ > + } > + > +#define GRUB_EFI_SECRET_TABLE_HEADER_GUID \ > + { 0x1e74f542, 0x71dd, 0x4d66, \ > + { 0x96, 0x3e, 0xef, 0x42, 0x87, 0xff, 0x17, 0x3b } \ > + } > + > +#define GRUB_EFI_DISKPASSWD_GUID \ > + { 0x736869e5, 0x84f0, 0x4973, \ > + { 0x92, 0xec, 0x06, 0x87, 0x9c, 0xe3, 0xda, 0x0b } \ > + } > + > #define GRUB_EFI_ACPI_TABLE_GUID \ > { 0xeb9d2d30, 0x2d88, 0x11d3, \ > { 0x9a, 0x16, 0x0, 0x90, 0x27, 0x3f, 0xc1, 0x4d } \ > -- > 2.34.1 > -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK