|
 |
00e791 |
From cf3f99c3b1e11c8c83938784975331db5efb410f Mon Sep 17 00:00:00 2001
|
|
|
00e791 |
From: Matthew Garrett <mjg59@google.com>
|
|
|
00e791 |
Date: Tue, 11 Dec 2018 15:25:44 -0800
|
|
|
00e791 |
Subject: [PATCH 26/62] Remove call to TPM2 get_event_log()
|
|
|
00e791 |
|
|
|
00e791 |
Calling the TPM2 get_event_log causes the firmware to start logging
|
|
|
00e791 |
events to the final events table, but implementations may also continue
|
|
|
00e791 |
logging to the boot services event log. Any OS that wishes to
|
|
|
00e791 |
reconstruct the full PCR state must already look at both the final
|
|
|
00e791 |
events log and the boot services event log, so if this call is made
|
|
|
00e791 |
anywhere other than immediately before ExitBootServices() then the OS
|
|
|
00e791 |
must deduplicate events that occur in both, complicating things
|
|
|
00e791 |
immensely.
|
|
|
00e791 |
|
|
|
00e791 |
Linux already has support for copying up the boot services event log
|
|
|
00e791 |
across the ExitBootServices() boundary, so there's no reason to make
|
|
|
00e791 |
this call. Remove it.
|
|
|
00e791 |
|
|
|
00e791 |
Signed-off-by: Matthew Garrett <mjg59@google.com>
|
|
|
00e791 |
Upstream-commit-id: fd7c3bd920b
|
|
|
00e791 |
---
|
|
|
00e791 |
tpm.c | 46 ----------------------------------------------
|
|
|
00e791 |
1 file changed, 46 deletions(-)
|
|
|
00e791 |
|
|
|
00e791 |
diff --git a/tpm.c b/tpm.c
|
|
|
00e791 |
index 674e69b715f..f07362c70bb 100644
|
|
|
00e791 |
--- a/tpm.c
|
|
|
00e791 |
+++ b/tpm.c
|
|
|
00e791 |
@@ -70,41 +70,6 @@ static BOOLEAN tpm2_present(EFI_TCG2_BOOT_SERVICE_CAPABILITY *caps,
|
|
|
00e791 |
return FALSE;
|
|
|
00e791 |
}
|
|
|
00e791 |
|
|
|
00e791 |
-static inline EFI_TCG2_EVENT_LOG_BITMAP
|
|
|
00e791 |
-tpm2_get_supported_logs(efi_tpm2_protocol_t *tpm,
|
|
|
00e791 |
- EFI_TCG2_BOOT_SERVICE_CAPABILITY *caps,
|
|
|
00e791 |
- BOOLEAN old_caps)
|
|
|
00e791 |
-{
|
|
|
00e791 |
- if (old_caps)
|
|
|
00e791 |
- return ((TREE_BOOT_SERVICE_CAPABILITY *)caps)->SupportedEventLogs;
|
|
|
00e791 |
-
|
|
|
00e791 |
- return caps->SupportedEventLogs;
|
|
|
00e791 |
-}
|
|
|
00e791 |
-
|
|
|
00e791 |
-/*
|
|
|
00e791 |
- * According to TCG EFI Protocol Specification for TPM 2.0 family,
|
|
|
00e791 |
- * all events generated after the invocation of EFI_TCG2_GET_EVENT_LOG
|
|
|
00e791 |
- * shall be stored in an instance of an EFI_CONFIGURATION_TABLE aka
|
|
|
00e791 |
- * EFI TCG 2.0 final events table. Hence, it is necessary to trigger the
|
|
|
00e791 |
- * internal switch through calling get_event_log() in order to allow
|
|
|
00e791 |
- * to retrieve the logs from OS runtime.
|
|
|
00e791 |
- */
|
|
|
00e791 |
-static EFI_STATUS trigger_tcg2_final_events_table(efi_tpm2_protocol_t *tpm2,
|
|
|
00e791 |
- EFI_TCG2_EVENT_LOG_BITMAP supported_logs)
|
|
|
00e791 |
-{
|
|
|
00e791 |
- EFI_TCG2_EVENT_LOG_FORMAT log_fmt;
|
|
|
00e791 |
- EFI_PHYSICAL_ADDRESS start;
|
|
|
00e791 |
- EFI_PHYSICAL_ADDRESS end;
|
|
|
00e791 |
- BOOLEAN truncated;
|
|
|
00e791 |
-
|
|
|
00e791 |
- if (supported_logs & EFI_TCG2_EVENT_LOG_FORMAT_TCG_2)
|
|
|
00e791 |
- log_fmt = EFI_TCG2_EVENT_LOG_FORMAT_TCG_2;
|
|
|
00e791 |
- else
|
|
|
00e791 |
- log_fmt = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2;
|
|
|
00e791 |
-
|
|
|
00e791 |
- return tpm2->get_event_log(tpm2, log_fmt, &start, &end, &truncated);
|
|
|
00e791 |
-}
|
|
|
00e791 |
-
|
|
|
00e791 |
static EFI_STATUS tpm_locate_protocol(efi_tpm_protocol_t **tpm,
|
|
|
00e791 |
efi_tpm2_protocol_t **tpm2,
|
|
|
00e791 |
BOOLEAN *old_caps_p,
|
|
|
00e791 |
@@ -166,17 +131,6 @@ static EFI_STATUS tpm_log_event_raw(EFI_PHYSICAL_ADDRESS buf, UINTN size,
|
|
|
00e791 |
#endif
|
|
|
00e791 |
} else if (tpm2) {
|
|
|
00e791 |
EFI_TCG2_EVENT *event;
|
|
|
00e791 |
- EFI_TCG2_EVENT_LOG_BITMAP supported_logs;
|
|
|
00e791 |
-
|
|
|
00e791 |
- supported_logs = tpm2_get_supported_logs(tpm2, &caps, old_caps);
|
|
|
00e791 |
-
|
|
|
00e791 |
- efi_status = trigger_tcg2_final_events_table(tpm2,
|
|
|
00e791 |
- supported_logs);
|
|
|
00e791 |
- if (EFI_ERROR(efi_status)) {
|
|
|
00e791 |
- perror(L"Unable to trigger tcg2 final events table: %r\n",
|
|
|
00e791 |
- efi_status);
|
|
|
00e791 |
- return efi_status;
|
|
|
00e791 |
- }
|
|
|
00e791 |
|
|
|
00e791 |
event = AllocatePool(sizeof(*event) + logsize);
|
|
|
00e791 |
if (!event) {
|
|
|
00e791 |
--
|
|
|
00e791 |
2.26.2
|
|
|
00e791 |
|