From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0E09EC07E95 for ; Tue, 13 Jul 2021 23:54:27 +0000 (UTC) Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 5146A6115A for ; Tue, 13 Jul 2021 23:54:26 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 5146A6115A Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id F027F82E4C; Wed, 14 Jul 2021 01:54:23 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="O0oujH9L"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id CCC4F82E87; Wed, 14 Jul 2021 01:54:21 +0200 (CEST) Received: from mail-pf1-x429.google.com (mail-pf1-x429.google.com [IPv6:2607:f8b0:4864:20::429]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 5D59B82E0B for ; Wed, 14 Jul 2021 01:54:17 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=takahiro.akashi@linaro.org Received: by mail-pf1-x429.google.com with SMTP id y4so244664pfi.9 for ; Tue, 13 Jul 2021 16:54:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=date:from:to:cc:subject:message-id:mail-followup-to:references :mime-version:content-disposition:in-reply-to; bh=k90Q9R0crtb0u63gmQgbyiKVxUf7pLit008j1XZ3tGY=; b=O0oujH9LT9gbFz6M0r4ZhS0BghyoDZbQO2f55GTvtKw+ur36/WCsnwqtRC+3mzeuuo 5VJWnKaph5UWbrBTY3xmxuZoP+xtyMvA7pBT0I9tn0oCJH9GHTWk4+gaflVUJh+vIwww VH2BC+R2PhrhSRY3JQJx/bKGo6xrOvB3SnVKCJTWuyQyS524hzAwxt/KkcD4epjyhXfC INM1QZayjWQrvaUQj8Mn3G9BPv4X0Cb7oCzjBdP2zOybh7tOLnvT1XYeQjlwwV/yXX9x dYXeIzmFRxPeGzcQoyTyAG1mGbce5mdsnZ8c58yiXSolvP94K3L39r2qRMbb9LT/BB3k N/JA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id :mail-followup-to:references:mime-version:content-disposition :in-reply-to; bh=k90Q9R0crtb0u63gmQgbyiKVxUf7pLit008j1XZ3tGY=; b=obpVBR9ox9XTyJ13a2E+8zfqwHybTfSJIk8kYXA1OPq/zOke24MdQy/MBiGpiAEQ6R 58c9VRGCBvhqmx7ZSDli1dcXNf24YHkgFMc5ZRrZYGiczW7Pb3PrPU3dNZvxDYDwK1br z2jXWegb1a096lcrw/4f2LNHIOFZhXDx0kIqEo52Lf98B//Pp1v+ULMc7Jq6gEaxg+49 XuHyE72t7PYCw5+16uZ4V9JhxlbNB8O0H0MlMlBwIQkpigEVlfKOZo9cHHl9Yh6cC5SR GBVkfjiGHaGjp8227b5KdwsWd6jG/n4I/4STgXW+Hx85qg7vPnB3BZcpJNItyUXuSSsF Zdyg== X-Gm-Message-State: AOAM531nFlZTpBsyMww0uHoxiu3gmWl9RBGt8a2v+wNuxK1zt31Tr/ch qkzYrpwZFBzjoM6q8+RRs+EP5Q== X-Google-Smtp-Source: ABdhPJxCfmI5frPSRNsE4M2clOyHlXy6ByMOFxh3lx0ug4P2R8ZrHyCvuntf1otq06r37a3kaRSkzA== X-Received: by 2002:a62:e90b:0:b029:30e:4530:8dca with SMTP id j11-20020a62e90b0000b029030e45308dcamr7161642pfh.17.1626220455274; Tue, 13 Jul 2021 16:54:15 -0700 (PDT) Received: from laputa (p3dd30549.tkyea130.ap.so-net.ne.jp. [61.211.5.73]) by smtp.gmail.com with ESMTPSA id s6sm3897955pjp.45.2021.07.13.16.54.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Jul 2021 16:54:14 -0700 (PDT) Date: Wed, 14 Jul 2021 08:54:10 +0900 From: AKASHI Takahiro To: Heinrich Schuchardt Cc: Masahisa Kojima , Alexander Graf , Ilias Apalodimas , Simon Glass , Dhananjay Phadke , U-Boot Mailing List Subject: Re: [PATCH 3/5] efi_loader: add boot variable measurement Message-ID: <20210713235410.GA41906@laputa> Mail-Followup-To: AKASHI Takahiro , Heinrich Schuchardt , Masahisa Kojima , Alexander Graf , Ilias Apalodimas , Simon Glass , Dhananjay Phadke , U-Boot Mailing List References: <20210707133638.12630-1-masahisa.kojima@linaro.org> <20210707133638.12630-4-masahisa.kojima@linaro.org> <5ec11448-585c-a115-d320-c820c1ad0272@gmx.de> <6b8a8baa-49a1-ca55-6f01-340ee591b79c@gmx.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6b8a8baa-49a1-ca55-6f01-340ee591b79c@gmx.de> X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean On Tue, Jul 13, 2021 at 04:24:52PM +0200, Heinrich Schuchardt wrote: > > > On 13.07.21 10:31, Masahisa Kojima wrote: > > Hi Heinrich, > > > > > > > TCG spec also requires to measure "Calling EFI Application from > > > > > Boot Option" for each boot attempt, and "Returning from EFI > > > > > Application from Boot Option" if a boot device returns control > > > > > back to the Boot Manager. > > > > I would like to hear your opinion regarding > > "Calling EFI Application from Boot Option" measurement. > > > > My current(v1 patch series) implementation considers > > both "bootefi bootmgr" and "bootefi $image_addr" cases, > > so I do this "Calling EFI Application from Boot Option" measurement > > at efi_boottime.c::efi_start_image(). > > Do I need to implement only the case UEFI application boot from bootmgr? > > If yes, I will move the timing of this measurement at > > efi_bootmgr.c::efi_bootmgr_load(). > > > > As a reference, in edk2, this measurement is performed in > > ready_to_boot event handler, ready_to_boot handler is called > > upon the user selects the boot option in boot manager. > > When booting you can call > > bootefi $driver1 > booefii $driver2 > bootefi bootmgr > > in sequence. > > Any of the binaries can call LoadImage(), StartImage() multiple times to > execute further images. E.g. I am loading iPXE. By default it loads GRUB > from an iSCSI drive but I can choose in the menu or the iPXE console to > invoke another UEFI binary. > > I suggest to measure any image no matter how it is invoked. The > measurement must depend on the sequence of invocation. Moreover, booting from the default path, like /EFI/BOOT/BOOTAA64.EFI, is only implemented by using bootefi syntax. -Takahiro Akashi > Best regards > > Heinrich > > > > > What do you think? > > > > Thanks, > > Masahisa Kojima > > > > > > > > > > > > On Fri, 9 Jul 2021 at 11:44, Masahisa Kojima wrote: > > > > > > On Fri, 9 Jul 2021 at 02:46, Heinrich Schuchardt wrote: > > > > > > > > On 7/7/21 3:36 PM, Masahisa Kojima wrote: > > > > > TCG PC Client PFP spec requires to measure "Boot####" > > > > > and "BootOrder" variables, EV_SEPARATOR event prior > > > > > to the Ready to Boot invocation. > > > > > Since u-boot does not implement Ready to Boot event, > > > > > these measurements are performed when efi_start_image() is called. > > > > > > > > > > TCG spec also requires to measure "Calling EFI Application from > > > > > Boot Option" for each boot attempt, and "Returning from EFI > > > > > Application from Boot Option" if a boot device returns control > > > > > back to the Boot Manager. > > > > > > > > > > Signed-off-by: Masahisa Kojima > > > > > --- > > > > > include/efi_loader.h | 4 ++ > > > > > include/tpm-v2.h | 18 ++++- > > > > > lib/efi_loader/efi_boottime.c | 20 ++++++ > > > > > lib/efi_loader/efi_tcg2.c | 123 ++++++++++++++++++++++++++++++++++ > > > > > 4 files changed, 164 insertions(+), 1 deletion(-) > > > > > > > > > > diff --git a/include/efi_loader.h b/include/efi_loader.h > > > > > index 0a9c82a257..281ffff30f 100644 > > > > > --- a/include/efi_loader.h > > > > > +++ b/include/efi_loader.h > > > > > @@ -407,6 +407,10 @@ efi_status_t efi_run_image(void *source_buffer, efi_uintn_t source_size); > > > > > efi_status_t efi_init_variables(void); > > > > > /* Notify ExitBootServices() is called */ > > > > > void efi_variables_boot_exit_notify(void); > > > > > +/* Measure efi application invocation */ > > > > > +efi_status_t EFIAPI efi_tcg2_measure_efi_app_invocation(void); > > > > > +/* Measure efi application exit */ > > > > > +efi_status_t EFIAPI efi_tcg2_measure_efi_app_exit(void); > > > > > /* Called by bootefi to initialize root node */ > > > > > efi_status_t efi_root_node_register(void); > > > > > /* Called by bootefi to initialize runtime */ > > > > > diff --git a/include/tpm-v2.h b/include/tpm-v2.h > > > > > index 3e48e35861..8a7b7f1874 100644 > > > > > --- a/include/tpm-v2.h > > > > > +++ b/include/tpm-v2.h > > > > > @@ -73,7 +73,7 @@ struct udevice; > > > > > /* > > > > > * event types, cf. > > > > > * "TCG PC Client Platform Firmware Profile Specification", Family "2.0" > > > > > - * rev 1.04, June 3, 2019 > > > > > + * Level 00 Version 1.05 Revision 23, May 7, 2021 > > > > > */ > > > > > #define EV_EFI_EVENT_BASE ((u32)0x80000000) > > > > > #define EV_EFI_VARIABLE_DRIVER_CONFIG ((u32)0x80000001) > > > > > @@ -85,8 +85,24 @@ struct udevice; > > > > > #define EV_EFI_ACTION ((u32)0x80000007) > > > > > #define EV_EFI_PLATFORM_FIRMWARE_BLOB ((u32)0x80000008) > > > > > #define EV_EFI_HANDOFF_TABLES ((u32)0x80000009) > > > > > +#define EV_EFI_PLATFORM_FIRMWARE_BLOB2 ((u32)0x8000000A) > > > > > +#define EV_EFI_HANDOFF_TABLES2 ((u32)0x8000000B) > > > > > +#define EV_EFI_VARIABLE_BOOT2 ((u32)0x8000000C) > > > > > #define EV_EFI_HCRTM_EVENT ((u32)0x80000010) > > > > > #define EV_EFI_VARIABLE_AUTHORITY ((u32)0x800000E0) > > > > > +#define EV_EFI_SPDM_FIRMWARE_BLOB ((u32)0x800000E1) > > > > > +#define EV_EFI_SPDM_FIRMWARE_CONFIG ((u32)0x800000E2) > > > > > + > > > > > +#define EFI_CALLING_EFI_APPLICATION \ > > > > > + "Calling EFI Application from Boot Option" > > > > > +#define EFI_RETURNING_FROM_EFI_APPLICATION \ > > > > > + "Returning from EFI Application from Boot Option" > > > > > +#define EFI_EXIT_BOOT_SERVICES_INVOCATION \ > > > > > + "Exit Boot Services Invocation" > > > > > +#define EFI_EXIT_BOOT_SERVICES_FAILED \ > > > > > + "Exit Boot Services Returned with Failure" > > > > > +#define EFI_EXIT_BOOT_SERVICES_SUCCEEDED \ > > > > > + "Exit Boot Services Returned with Success" > > > > > > > > Which spec defines if the string in the event log shall be utf-8 or utf-16? > > > > > > TCG PC Client PFP spec does not clearly define the character encoding. > > > In my understanding, the string derived from UEFI spec such as > > > UEFI variable name uses utf-16(CHAR16). > > > Other strings like "Calling EFI Application from Boot Option" defind in TCG PC > > > Client spec use 1 byte ASCII encoding. > > > > > > EDK2 implementation also uses 1 byte ASCII encoding for these strings, > > > and tpm2-tools::tpm2_eventlog command can handles properly. > > > > > > Thanks, > > > Masahisa Kojima > > > > > > > > > > > Best regards > > > > > > > > Heinrich > > > > > > > > > > > > > > /* TPMS_TAGGED_PROPERTY Structure */ > > > > > struct tpms_tagged_property { > > > > > diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c > > > > > index f6d5ba05e3..2914800c56 100644 > > > > > --- a/lib/efi_loader/efi_boottime.c > > > > > +++ b/lib/efi_loader/efi_boottime.c > > > > > @@ -2993,6 +2993,16 @@ efi_status_t EFIAPI efi_start_image(efi_handle_t image_handle, > > > > > image_obj->exit_status = &exit_status; > > > > > image_obj->exit_jmp = &exit_jmp; > > > > > > > > > > + if (IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL)) { > > > > > + if (image_obj->image_type == IMAGE_SUBSYSTEM_EFI_APPLICATION) { > > > > > + ret = efi_tcg2_measure_efi_app_invocation(); > > > > > + if (ret != EFI_SUCCESS) { > > > > > + EFI_PRINT("tcg2 measurement fails(0x%lx)\n", > > > > > + ret); > > > > > + } > > > > > + } > > > > > + } > > > > > + > > > > > /* call the image! */ > > > > > if (setjmp(&exit_jmp)) { > > > > > /* > > > > > @@ -3251,6 +3261,16 @@ static efi_status_t EFIAPI efi_exit(efi_handle_t image_handle, > > > > > exit_status != EFI_SUCCESS) > > > > > efi_delete_image(image_obj, loaded_image_protocol); > > > > > > > > > > + if (IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL)) { > > > > > + if (image_obj->image_type == IMAGE_SUBSYSTEM_EFI_APPLICATION) { > > > > > + ret = efi_tcg2_measure_efi_app_exit(); > > > > > + if (ret != EFI_SUCCESS) { > > > > > + EFI_PRINT("tcg2 measurement fails(0x%lx)\n", > > > > > + ret); > > > > > + } > > > > > + } > > > > > + } > > > > > + > > > > > /* Make sure entry/exit counts for EFI world cross-overs match */ > > > > > EFI_EXIT(exit_status); > > > > > > > > > > diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c > > > > > index 2a248bd62a..6e903e3cb3 100644 > > > > > --- a/lib/efi_loader/efi_tcg2.c > > > > > +++ b/lib/efi_loader/efi_tcg2.c > > > > > @@ -35,6 +35,7 @@ struct event_log_buffer { > > > > > }; > > > > > > > > > > static struct event_log_buffer event_log; > > > > > +static bool tcg2_efi_app_invoked; > > > > > /* > > > > > * When requesting TPM2_CAP_TPM_PROPERTIES the value is on a standard offset. > > > > > * Since the current tpm2_get_capability() response buffers starts at > > > > > @@ -1383,6 +1384,128 @@ static efi_status_t tcg2_measure_variable(struct udevice *dev, u32 pcr_index, > > > > > return ret; > > > > > } > > > > > > > > > > +/** > > > > > + * tcg2_measure_boot_variable() - measure boot variables > > > > > + * > > > > > + * @dev: TPM device > > > > > + * > > > > > + * Return: status code > > > > > + */ > > > > > +static efi_status_t tcg2_measure_boot_variable(struct udevice *dev) > > > > > +{ > > > > > + u16 *boot_order; > > > > > + u16 var_name[] = L"BootOrder"; > > > > > + u16 boot_name[] = L"Boot0000"; > > > > > + u16 hexmap[] = L"0123456789ABCDEF"; > > > > > + u8 *bootvar; > > > > > + efi_uintn_t var_data_size; > > > > > + u32 count, i; > > > > > + efi_status_t ret; > > > > > + > > > > > + boot_order = efi_get_var(var_name, &efi_global_variable_guid, > > > > > + &var_data_size); > > > > > + if (!boot_order) { > > > > > + log_info("BootOrder not defined\n"); > > > > > + ret = EFI_NOT_FOUND; > > > > > + goto error; > > > > > + } > > > > > + > > > > > + ret = tcg2_measure_variable(dev, 1, EV_EFI_VARIABLE_BOOT2, var_name, > > > > > + &efi_global_variable_guid, var_data_size, > > > > > + (u8 *)boot_order); > > > > > + if (ret != EFI_SUCCESS) > > > > > + goto error; > > > > > + > > > > > + count = var_data_size / sizeof(*boot_order); > > > > > + for (i = 0; i < count; i++) { > > > > > + boot_name[4] = hexmap[(boot_order[i] & 0xf000) >> 12]; > > > > > + boot_name[5] = hexmap[(boot_order[i] & 0x0f00) >> 8]; > > > > > + boot_name[6] = hexmap[(boot_order[i] & 0x00f0) >> 4]; > > > > > + boot_name[7] = hexmap[(boot_order[i] & 0x000f)]; > > > > > + > > > > > + bootvar = efi_get_var(boot_name, &efi_global_variable_guid, > > > > > + &var_data_size); > > > > > + > > > > > + if (!bootvar) { > > > > > + log_info("%ls not found\n", boot_name); > > > > > + continue; > > > > > + } > > > > > + > > > > > + ret = tcg2_measure_variable(dev, 1, EV_EFI_VARIABLE_BOOT2, > > > > > + boot_name, > > > > > + &efi_global_variable_guid, > > > > > + var_data_size, bootvar); > > > > > + free(bootvar); > > > > > + if (ret != EFI_SUCCESS) > > > > > + goto error; > > > > > + } > > > > > + > > > > > +error: > > > > > + free(boot_order); > > > > > + return ret; > > > > > +} > > > > > + > > > > > +/** > > > > > + * efi_tcg2_measure_efi_app_invocation() - measure efi app invocation > > > > > + * > > > > > + * Return: status code > > > > > + */ > > > > > +efi_status_t EFIAPI efi_tcg2_measure_efi_app_invocation(void) > > > > > +{ > > > > > + efi_status_t ret; > > > > > + u32 pcr_index; > > > > > + struct udevice *dev; > > > > > + u32 event = 0; > > > > > + > > > > > + if (tcg2_efi_app_invoked) > > > > > + return EFI_SUCCESS; > > > > > + > > > > > + ret = platform_get_tpm2_device(&dev); > > > > > + if (ret != EFI_SUCCESS) > > > > > + return ret; > > > > > + > > > > > + ret = tcg2_measure_boot_variable(dev); > > > > > + if (ret != EFI_SUCCESS) > > > > > + goto out; > > > > > + > > > > > + ret = tcg2_measure_event(dev, 4, EV_EFI_ACTION, > > > > > + strlen(EFI_CALLING_EFI_APPLICATION), > > > > > + (u8 *)EFI_CALLING_EFI_APPLICATION); > > > > > + if (ret != EFI_SUCCESS) > > > > > + goto out; > > > > > + > > > > > + for (pcr_index = 0; pcr_index <= 7; pcr_index++) { > > > > > + ret = tcg2_measure_event(dev, pcr_index, EV_SEPARATOR, > > > > > + sizeof(event), (u8 *)&event); > > > > > + if (ret != EFI_SUCCESS) > > > > > + goto out; > > > > > + } > > > > > + > > > > > + tcg2_efi_app_invoked = true; > > > > > +out: > > > > > + return ret; > > > > > +} > > > > > + > > > > > +/** > > > > > + * efi_tcg2_measure_efi_app_exit() - measure efi app exit > > > > > + * > > > > > + * Return: status code > > > > > + */ > > > > > +efi_status_t EFIAPI efi_tcg2_measure_efi_app_exit(void) > > > > > +{ > > > > > + efi_status_t ret; > > > > > + struct udevice *dev; > > > > > + > > > > > + ret = platform_get_tpm2_device(&dev); > > > > > + if (ret != EFI_SUCCESS) > > > > > + return ret; > > > > > + > > > > > + ret = tcg2_measure_event(dev, 4, EV_EFI_ACTION, > > > > > + strlen(EFI_RETURNING_FROM_EFI_APPLICATION), > > > > > + (u8 *)EFI_RETURNING_FROM_EFI_APPLICATION); > > > > > + return ret; > > > > > +} > > > > > + > > > > > /** > > > > > * tcg2_measure_secure_boot_variable() - measure secure boot variables > > > > > * > > > > > > > > >