Userspace needs to know if TPM kernel drivers need to be loaded and related services started early in the boot if TPM device is used and available. If EFI firmware has used TPM device to e.g. measure binaries, then many of them also provide the TPM log to kernel in addition to the actual TPM device side measurements. Expose availability of TPM event log to userspace via /sys/firmware/efi/tpm_log. If the file exists, then firmware provided a TPM event log to kernel, and userspace init should also queue TPM module loading and other early boot services for TPM support. Enables systemd to support TPM drivers as modules when rootfs is encrypted with the TPM device. Sample output from a arm64 qemu machine with u-boot based EFI firmware and swtpm: root@trs-qemuarm64:~# dmesg|grep TPMEvent [ 0.000000] efi: TPMFinalLog=0xbd648040 RTPROP=0xbd646040 SMBIOS3.0=0xbe6ad000 TPMEventLog=0xbd5f9040 INITRD=0xbd5f7040 RNG=0xbd5f6040 MEMRESERVE=0xbd5f5040 root@trs-qemuarm64:~# ls -l /sys/firmware/efi/tpm_log -r-------- 1 root root 4096 Apr 22 10:31 /sys/firmware/efi/tpm_log root@trs-qemuarm64:~# cat /sys/firmware/efi/tpm_log TPMEventLog=0xbd5f9040 root@trs-qemuarm64:~# cat /sys/firmware/efi/systab SMBIOS3=0xbe6ad000 Other similar information is currently in /sys/firmware/efi/systab but for new exported variables a one-variable-per-file sysfs interface is preferred according to comments in systab_show() drivers/firmware/efi/efi.c See also: https://github.com/systemd/systemd/pull/32314 https://lists.freedesktop.org/archives/systemd-devel/2024-April/050206.html Cc: Ilias Apalodimas <ilias.apalodimas@xxxxxxxxxx> Cc: Lennart Poettering <lennart@xxxxxxxxxxxxxx> Signed-off-by: Mikko Rapeli <mikko.rapeli@xxxxxxxxxx> --- Documentation/ABI/testing/sysfs-firmware-efi | 12 ++++++++++++ drivers/firmware/efi/efi.c | 13 +++++++++++++ 2 files changed, 25 insertions(+) diff --git a/Documentation/ABI/testing/sysfs-firmware-efi b/Documentation/ABI/testing/sysfs-firmware-efi index 5e4d0b27cdfe..caaff27cc73e 100644 --- a/Documentation/ABI/testing/sysfs-firmware-efi +++ b/Documentation/ABI/testing/sysfs-firmware-efi @@ -36,3 +36,15 @@ Description: Displays the content of the Runtime Configuration Interface Table version 2 on Dell EMC PowerEdge systems in binary format Users: It is used by Dell EMC OpenManage Server Administrator tool to populate BIOS setup page. + +What: /sys/firmware/efi/tpm_log +Date: April 2024 +Contact: Mikko Rapeli <mikko.rapeli@xxxxxxxxxx> +Description: If EFI firmware supports TPM device and measurements were done + then a TPM event log has very likely been generated and provided + to the kernel. This serves as indicator for userspace to load + TPM drivers and to start related service early in the boot sequence, + e.g. initramfs, where full bus probes and device scans are not yet + done. +Users: systemd will use this interface to support TPM drivers as modules also + for early initramfs diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c index 4fcda50acfa4..94773e8b8806 100644 --- a/drivers/firmware/efi/efi.c +++ b/drivers/firmware/efi/efi.c @@ -162,6 +162,13 @@ static ssize_t fw_platform_size_show(struct kobject *kobj, return sprintf(buf, "%d\n", efi_enabled(EFI_64BIT) ? 64 : 32); } +static ssize_t tpm_log_show(struct kobject *kobj, + struct kobj_attribute *attr, char *buf) +{ + return sprintf(buf, "TPMEventLog=0x%lx", efi.tpm_log); +} +static struct kobj_attribute efi_attr_tpm_log = __ATTR_RO_MODE(tpm_log, 0400); + extern __weak struct kobj_attribute efi_attr_fw_vendor; extern __weak struct kobj_attribute efi_attr_runtime; extern __weak struct kobj_attribute efi_attr_config_table; @@ -459,6 +466,12 @@ static int __init efisubsys_init(void) platform_device_register_simple("efi_secret", 0, NULL, 0); #endif + if (efi.tpm_log != EFI_INVALID_TABLE_ADDR) { + error = sysfs_create_file(efi_kobj, &efi_attr_tpm_log.attr); + if (error) + pr_err("sysfs create file failed with error %d.\n", error); + } + return 0; err_remove_group: -- 2.34.1
