Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 1 | // SPDX-License-Identifier: GPL-2.0+ |
| 2 | /* |
| 3 | * Defines APIs that allow an OS to interact with UEFI firmware to query |
| 4 | * information about the device. |
| 5 | * https://trustedcomputinggroup.org/resource/tcg-efi-protocol-specification/ |
| 6 | * |
| 7 | * Copyright (c) 2020, Linaro Limited |
| 8 | */ |
| 9 | |
| 10 | #define LOG_CATEGORY LOGC_EFI |
| 11 | #include <common.h> |
| 12 | #include <dm.h> |
| 13 | #include <efi_loader.h> |
Heinrich Schuchardt | 6f26e7c | 2021-09-09 08:50:01 +0200 | [diff] [blame] | 14 | #include <efi_variable.h> |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 15 | #include <efi_tcg2.h> |
| 16 | #include <log.h> |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 17 | #include <malloc.h> |
Masahisa Kojima | cd1fe7d | 2021-10-26 17:27:24 +0900 | [diff] [blame] | 18 | #include <smbios.h> |
Pali Rohár | ba87ddf | 2021-08-02 15:18:31 +0200 | [diff] [blame] | 19 | #include <version_string.h> |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 20 | #include <tpm-v2.h> |
Ilias Apalodimas | 1d16f1e | 2021-11-18 10:13:42 +0200 | [diff] [blame] | 21 | #include <tpm_api.h> |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 22 | #include <u-boot/hash-checksum.h> |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 23 | #include <u-boot/sha1.h> |
| 24 | #include <u-boot/sha256.h> |
| 25 | #include <u-boot/sha512.h> |
Masahisa Kojima | d420d8d | 2021-11-03 11:04:09 +0900 | [diff] [blame] | 26 | #include <linux/unaligned/be_byteshift.h> |
| 27 | #include <linux/unaligned/le_byteshift.h> |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 28 | #include <linux/unaligned/generic.h> |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 29 | #include <hexdump.h> |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 30 | |
Ilias Apalodimas | 24e841a | 2021-11-18 09:03:39 +0200 | [diff] [blame] | 31 | /** |
| 32 | * struct event_log_buffer - internal eventlog management structure |
| 33 | * |
| 34 | * @buffer: eventlog buffer |
| 35 | * @final_buffer: finalevent config table buffer |
| 36 | * @pos: current position of 'buffer' |
| 37 | * @final_pos: current position of 'final_buffer' |
| 38 | * @get_event_called: true if GetEventLog has been invoked at least once |
| 39 | * @ebs_called: true if ExitBootServices has been invoked |
| 40 | * @truncated: true if the 'buffer' is truncated |
| 41 | */ |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 42 | struct event_log_buffer { |
| 43 | void *buffer; |
| 44 | void *final_buffer; |
| 45 | size_t pos; /* eventlog position */ |
| 46 | size_t final_pos; /* final events config table position */ |
| 47 | size_t last_event_size; |
| 48 | bool get_event_called; |
Ilias Apalodimas | 24e841a | 2021-11-18 09:03:39 +0200 | [diff] [blame] | 49 | bool ebs_called; |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 50 | bool truncated; |
| 51 | }; |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 52 | |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 53 | static struct event_log_buffer event_log; |
Masahisa Kojima | 8173cd4 | 2021-08-13 16:12:40 +0900 | [diff] [blame] | 54 | static bool tcg2_efi_app_invoked; |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 55 | /* |
| 56 | * When requesting TPM2_CAP_TPM_PROPERTIES the value is on a standard offset. |
| 57 | * Since the current tpm2_get_capability() response buffers starts at |
| 58 | * 'union tpmu_capabilities data' of 'struct tpms_capability_data', calculate |
| 59 | * the response size and offset once for all consumers |
| 60 | */ |
| 61 | #define TPM2_RESPONSE_BUFFER_SIZE (sizeof(struct tpms_capability_data) - \ |
| 62 | offsetof(struct tpms_capability_data, data)) |
| 63 | #define properties_offset (offsetof(struct tpml_tagged_tpm_property, tpm_property) + \ |
| 64 | offsetof(struct tpms_tagged_property, value)) |
| 65 | |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 66 | static const efi_guid_t efi_guid_tcg2_protocol = EFI_TCG2_PROTOCOL_GUID; |
| 67 | static const efi_guid_t efi_guid_final_events = EFI_TCG2_FINAL_EVENTS_TABLE_GUID; |
| 68 | |
Masahisa Kojima | 2168452 | 2021-10-26 17:27:26 +0900 | [diff] [blame] | 69 | struct variable_info { |
| 70 | const u16 *name; |
| 71 | bool accept_empty; |
Masahisa Kojima | f3e0c55 | 2021-10-26 17:27:27 +0900 | [diff] [blame] | 72 | u32 pcr_index; |
Masahisa Kojima | 1d2a656 | 2021-08-13 16:12:39 +0900 | [diff] [blame] | 73 | }; |
| 74 | |
Masahisa Kojima | 2168452 | 2021-10-26 17:27:26 +0900 | [diff] [blame] | 75 | static struct variable_info secure_variables[] = { |
Masahisa Kojima | f3e0c55 | 2021-10-26 17:27:27 +0900 | [diff] [blame] | 76 | {u"SecureBoot", true, 7}, |
| 77 | {u"PK", true, 7}, |
| 78 | {u"KEK", true, 7}, |
| 79 | {u"db", true, 7}, |
| 80 | {u"dbx", true, 7}, |
| 81 | {u"dbt", false, 7}, |
| 82 | {u"dbr", false, 7}, |
| 83 | {u"DeployedMode", false, 1}, |
| 84 | {u"AuditMode", false, 1}, |
Masahisa Kojima | 2168452 | 2021-10-26 17:27:26 +0900 | [diff] [blame] | 85 | }; |
| 86 | |
Masahisa Kojima | 0fd4379 | 2021-12-07 14:15:31 +0900 | [diff] [blame] | 87 | static bool is_tcg2_protocol_installed(void) |
| 88 | { |
| 89 | struct efi_handler *handler; |
| 90 | efi_status_t ret; |
| 91 | |
| 92 | ret = efi_search_protocol(efi_root, &efi_guid_tcg2_protocol, &handler); |
| 93 | return ret == EFI_SUCCESS; |
| 94 | } |
| 95 | |
Ilias Apalodimas | 24e841a | 2021-11-18 09:03:39 +0200 | [diff] [blame] | 96 | /* tcg2_agile_log_append - Append an agile event to an eventlog |
| 97 | * |
| 98 | * @pcr_index: PCR index |
| 99 | * @event_type: type of event added |
| 100 | * @digest_list: list of digest algorithms to add |
| 101 | * @size: size of event |
| 102 | * @event: event to add |
| 103 | * @log: log buffer to append the event |
| 104 | * |
| 105 | * @Return: status code |
| 106 | */ |
| 107 | static efi_status_t tcg2_agile_log_append(u32 pcr_index, u32 event_type, |
| 108 | struct tpml_digest_values *digest_list, |
| 109 | u32 size, u8 event[]) |
| 110 | { |
| 111 | void *log = (void *)((uintptr_t)event_log.buffer + event_log.pos); |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 112 | u32 event_size = size + tcg2_event_get_size(digest_list); |
Ilias Apalodimas | 24e841a | 2021-11-18 09:03:39 +0200 | [diff] [blame] | 113 | struct efi_tcg2_final_events_table *final_event; |
| 114 | efi_status_t ret = EFI_SUCCESS; |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 115 | |
Ilias Apalodimas | 24e841a | 2021-11-18 09:03:39 +0200 | [diff] [blame] | 116 | /* if ExitBootServices hasn't been called update the normal log */ |
| 117 | if (!event_log.ebs_called) { |
| 118 | if (event_log.truncated || |
| 119 | event_log.pos + event_size > TPM2_EVENT_LOG_SIZE) { |
| 120 | event_log.truncated = true; |
| 121 | return EFI_VOLUME_FULL; |
| 122 | } |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 123 | tcg2_log_append(pcr_index, event_type, digest_list, size, event, log); |
Ilias Apalodimas | 24e841a | 2021-11-18 09:03:39 +0200 | [diff] [blame] | 124 | event_log.pos += event_size; |
| 125 | event_log.last_event_size = event_size; |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 126 | } |
| 127 | |
Ilias Apalodimas | 24e841a | 2021-11-18 09:03:39 +0200 | [diff] [blame] | 128 | if (!event_log.get_event_called) |
| 129 | return ret; |
| 130 | |
| 131 | /* if GetEventLog has been called update FinalEventLog as well */ |
| 132 | if (event_log.final_pos + event_size > TPM2_EVENT_LOG_SIZE) |
| 133 | return EFI_VOLUME_FULL; |
| 134 | |
| 135 | log = (void *)((uintptr_t)event_log.final_buffer + event_log.final_pos); |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 136 | tcg2_log_append(pcr_index, event_type, digest_list, size, event, log); |
Ilias Apalodimas | 24e841a | 2021-11-18 09:03:39 +0200 | [diff] [blame] | 137 | |
| 138 | final_event = event_log.final_buffer; |
| 139 | final_event->number_of_events++; |
| 140 | event_log.final_pos += event_size; |
| 141 | |
| 142 | return ret; |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 143 | } |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 144 | |
| 145 | /** |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 146 | * tpm2_get_max_command_size() - get the supported max command size |
| 147 | * |
| 148 | * @dev: TPM device |
| 149 | * @max_command_size: output buffer for the size |
| 150 | * |
| 151 | * Return: 0 on success, -1 on error |
| 152 | */ |
| 153 | static int tpm2_get_max_command_size(struct udevice *dev, u16 *max_command_size) |
| 154 | { |
| 155 | u8 response[TPM2_RESPONSE_BUFFER_SIZE]; |
| 156 | u32 ret; |
| 157 | |
| 158 | memset(response, 0, sizeof(response)); |
| 159 | ret = tpm2_get_capability(dev, TPM2_CAP_TPM_PROPERTIES, |
| 160 | TPM2_PT_MAX_COMMAND_SIZE, response, 1); |
| 161 | if (ret) |
| 162 | return -1; |
| 163 | |
| 164 | *max_command_size = (uint16_t)get_unaligned_be32(response + |
| 165 | properties_offset); |
| 166 | |
| 167 | return 0; |
| 168 | } |
| 169 | |
| 170 | /** |
| 171 | * tpm2_get_max_response_size() - get the supported max response size |
| 172 | * |
| 173 | * @dev: TPM device |
| 174 | * @max_response_size: output buffer for the size |
| 175 | * |
| 176 | * Return: 0 on success, -1 on error |
| 177 | */ |
| 178 | static int tpm2_get_max_response_size(struct udevice *dev, |
| 179 | u16 *max_response_size) |
| 180 | { |
| 181 | u8 response[TPM2_RESPONSE_BUFFER_SIZE]; |
| 182 | u32 ret; |
| 183 | |
| 184 | memset(response, 0, sizeof(response)); |
| 185 | ret = tpm2_get_capability(dev, TPM2_CAP_TPM_PROPERTIES, |
| 186 | TPM2_PT_MAX_RESPONSE_SIZE, response, 1); |
| 187 | if (ret) |
| 188 | return -1; |
| 189 | |
| 190 | *max_response_size = (uint16_t)get_unaligned_be32(response + |
| 191 | properties_offset); |
| 192 | |
| 193 | return 0; |
| 194 | } |
| 195 | |
| 196 | /** |
| 197 | * tpm2_get_manufacturer_id() - get the manufacturer ID |
| 198 | * |
| 199 | * @dev: TPM device |
| 200 | * @manufacturer_id: output buffer for the id |
| 201 | * |
| 202 | * Return: 0 on success, -1 on error |
| 203 | */ |
| 204 | static int tpm2_get_manufacturer_id(struct udevice *dev, u32 *manufacturer_id) |
| 205 | { |
| 206 | u8 response[TPM2_RESPONSE_BUFFER_SIZE]; |
| 207 | u32 ret; |
| 208 | |
| 209 | memset(response, 0, sizeof(response)); |
| 210 | ret = tpm2_get_capability(dev, TPM2_CAP_TPM_PROPERTIES, |
| 211 | TPM2_PT_MANUFACTURER, response, 1); |
| 212 | if (ret) |
| 213 | return -1; |
| 214 | |
| 215 | *manufacturer_id = get_unaligned_be32(response + properties_offset); |
| 216 | |
| 217 | return 0; |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 218 | } |
| 219 | |
| 220 | /** |
Ilias Apalodimas | c67fef6 | 2020-11-16 08:52:41 +0200 | [diff] [blame] | 221 | * efi_tcg2_get_capability() - protocol capability information and state information |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 222 | * |
| 223 | * @this: TCG2 protocol instance |
| 224 | * @capability: caller allocated memory with size field to the size of |
| 225 | * the structure allocated |
| 226 | |
| 227 | * Return: status code |
| 228 | */ |
| 229 | static efi_status_t EFIAPI |
Ilias Apalodimas | c67fef6 | 2020-11-16 08:52:41 +0200 | [diff] [blame] | 230 | efi_tcg2_get_capability(struct efi_tcg2_protocol *this, |
| 231 | struct efi_tcg2_boot_service_capability *capability) |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 232 | { |
| 233 | struct udevice *dev; |
| 234 | efi_status_t efi_ret; |
| 235 | int ret; |
| 236 | |
| 237 | EFI_ENTRY("%p, %p", this, capability); |
| 238 | |
| 239 | if (!this || !capability) { |
| 240 | efi_ret = EFI_INVALID_PARAMETER; |
| 241 | goto out; |
| 242 | } |
| 243 | |
Masahisa Kojima | 9cc8293 | 2021-09-06 12:04:12 +0900 | [diff] [blame] | 244 | if (capability->size < BOOT_SERVICE_CAPABILITY_MIN) { |
| 245 | capability->size = BOOT_SERVICE_CAPABILITY_MIN; |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 246 | efi_ret = EFI_BUFFER_TOO_SMALL; |
| 247 | goto out; |
| 248 | } |
| 249 | |
| 250 | if (capability->size < sizeof(*capability)) { |
| 251 | capability->size = sizeof(*capability); |
| 252 | efi_ret = EFI_BUFFER_TOO_SMALL; |
| 253 | goto out; |
| 254 | } |
| 255 | |
| 256 | capability->structure_version.major = 1; |
| 257 | capability->structure_version.minor = 1; |
| 258 | capability->protocol_version.major = 1; |
| 259 | capability->protocol_version.minor = 1; |
| 260 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 261 | efi_ret = tcg2_platform_get_tpm2(&dev); |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 262 | if (efi_ret != EFI_SUCCESS) { |
| 263 | capability->supported_event_logs = 0; |
| 264 | capability->hash_algorithm_bitmap = 0; |
| 265 | capability->tpm_present_flag = false; |
| 266 | capability->max_command_size = 0; |
| 267 | capability->max_response_size = 0; |
| 268 | capability->manufacturer_id = 0; |
| 269 | capability->number_of_pcr_banks = 0; |
| 270 | capability->active_pcr_banks = 0; |
| 271 | |
| 272 | efi_ret = EFI_SUCCESS; |
| 273 | goto out; |
| 274 | } |
| 275 | |
| 276 | /* We only allow a TPMv2 device to register the EFI protocol */ |
| 277 | capability->supported_event_logs = TCG2_EVENT_LOG_FORMAT_TCG_2; |
| 278 | |
| 279 | capability->tpm_present_flag = true; |
| 280 | |
| 281 | /* Supported and active PCRs */ |
| 282 | capability->hash_algorithm_bitmap = 0; |
| 283 | capability->active_pcr_banks = 0; |
| 284 | ret = tpm2_get_pcr_info(dev, &capability->hash_algorithm_bitmap, |
| 285 | &capability->active_pcr_banks, |
| 286 | &capability->number_of_pcr_banks); |
| 287 | if (ret) { |
| 288 | efi_ret = EFI_DEVICE_ERROR; |
| 289 | goto out; |
| 290 | } |
| 291 | |
| 292 | /* Max command size */ |
| 293 | ret = tpm2_get_max_command_size(dev, &capability->max_command_size); |
| 294 | if (ret) { |
| 295 | efi_ret = EFI_DEVICE_ERROR; |
| 296 | goto out; |
| 297 | } |
| 298 | |
| 299 | /* Max response size */ |
| 300 | ret = tpm2_get_max_response_size(dev, &capability->max_response_size); |
| 301 | if (ret) { |
| 302 | efi_ret = EFI_DEVICE_ERROR; |
| 303 | goto out; |
| 304 | } |
| 305 | |
| 306 | /* Manufacturer ID */ |
| 307 | ret = tpm2_get_manufacturer_id(dev, &capability->manufacturer_id); |
| 308 | if (ret) { |
| 309 | efi_ret = EFI_DEVICE_ERROR; |
| 310 | goto out; |
| 311 | } |
| 312 | |
| 313 | return EFI_EXIT(EFI_SUCCESS); |
| 314 | out: |
| 315 | return EFI_EXIT(efi_ret); |
| 316 | } |
| 317 | |
| 318 | /** |
Ilias Apalodimas | c67fef6 | 2020-11-16 08:52:41 +0200 | [diff] [blame] | 319 | * efi_tcg2_get_eventlog() - retrieve the the address of an event log and its |
| 320 | * last entry |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 321 | * |
| 322 | * @this: TCG2 protocol instance |
| 323 | * @log_format: type of event log format |
| 324 | * @event_log_location: pointer to the memory address of the event log |
| 325 | * @event_log_last_entry: pointer to the address of the start of the last |
| 326 | * entry in the event log in memory, if log contains |
| 327 | * more than 1 entry |
| 328 | * @event_log_truncated: set to true, if the Event Log is missing at i |
| 329 | * least one entry |
| 330 | * |
| 331 | * Return: status code |
| 332 | */ |
| 333 | static efi_status_t EFIAPI |
Ilias Apalodimas | c67fef6 | 2020-11-16 08:52:41 +0200 | [diff] [blame] | 334 | efi_tcg2_get_eventlog(struct efi_tcg2_protocol *this, |
| 335 | efi_tcg_event_log_format log_format, |
| 336 | u64 *event_log_location, u64 *event_log_last_entry, |
| 337 | bool *event_log_truncated) |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 338 | { |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 339 | efi_status_t ret = EFI_SUCCESS; |
| 340 | struct udevice *dev; |
| 341 | |
| 342 | EFI_ENTRY("%p, %u, %p, %p, %p", this, log_format, event_log_location, |
| 343 | event_log_last_entry, event_log_truncated); |
| 344 | |
Masahisa Kojima | 7c5fccd | 2021-09-03 10:55:50 +0900 | [diff] [blame] | 345 | if (!this || !event_log_location || !event_log_last_entry || |
| 346 | !event_log_truncated) { |
| 347 | ret = EFI_INVALID_PARAMETER; |
| 348 | goto out; |
| 349 | } |
| 350 | |
| 351 | /* Only support TPMV2 */ |
| 352 | if (log_format != TCG2_EVENT_LOG_FORMAT_TCG_2) { |
| 353 | ret = EFI_INVALID_PARAMETER; |
| 354 | goto out; |
| 355 | } |
| 356 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 357 | ret = tcg2_platform_get_tpm2(&dev); |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 358 | if (ret != EFI_SUCCESS) { |
| 359 | event_log_location = NULL; |
| 360 | event_log_last_entry = NULL; |
| 361 | *event_log_truncated = false; |
| 362 | ret = EFI_SUCCESS; |
| 363 | goto out; |
| 364 | } |
| 365 | *event_log_location = (uintptr_t)event_log.buffer; |
| 366 | *event_log_last_entry = (uintptr_t)(event_log.buffer + event_log.pos - |
| 367 | event_log.last_event_size); |
| 368 | *event_log_truncated = event_log.truncated; |
| 369 | event_log.get_event_called = true; |
| 370 | |
| 371 | out: |
| 372 | return EFI_EXIT(ret); |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 373 | } |
| 374 | |
| 375 | /** |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 376 | * tcg2_hash_pe_image() - calculate PE/COFF image hash |
| 377 | * |
| 378 | * @efi: pointer to the EFI binary |
| 379 | * @efi_size: size of @efi binary |
| 380 | * @digest_list: list of digest algorithms to extend |
| 381 | * |
| 382 | * Return: status code |
| 383 | */ |
| 384 | static efi_status_t tcg2_hash_pe_image(void *efi, u64 efi_size, |
| 385 | struct tpml_digest_values *digest_list) |
| 386 | { |
| 387 | WIN_CERTIFICATE *wincerts = NULL; |
| 388 | size_t wincerts_len; |
| 389 | struct efi_image_regions *regs = NULL; |
| 390 | void *new_efi = NULL; |
| 391 | u8 hash[TPM2_SHA512_DIGEST_SIZE]; |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 392 | struct udevice *dev; |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 393 | efi_status_t ret; |
| 394 | u32 active; |
| 395 | int i; |
| 396 | |
| 397 | new_efi = efi_prepare_aligned_image(efi, &efi_size); |
| 398 | if (!new_efi) |
| 399 | return EFI_OUT_OF_RESOURCES; |
| 400 | |
| 401 | if (!efi_image_parse(new_efi, efi_size, ®s, &wincerts, |
| 402 | &wincerts_len)) { |
| 403 | log_err("Parsing PE executable image failed\n"); |
| 404 | ret = EFI_UNSUPPORTED; |
| 405 | goto out; |
| 406 | } |
| 407 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 408 | ret = tcg2_platform_get_tpm2(&dev); |
| 409 | if (ret != EFI_SUCCESS) |
| 410 | goto out; |
| 411 | |
| 412 | ret = tcg2_get_active_pcr_banks(dev, &active); |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 413 | if (ret != EFI_SUCCESS) { |
| 414 | goto out; |
| 415 | } |
| 416 | |
| 417 | digest_list->count = 0; |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 418 | for (i = 0; i < ARRAY_SIZE(tpm2_supported_algorithms); i++) { |
| 419 | u16 hash_alg = tpm2_supported_algorithms[i]; |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 420 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 421 | if (!(active & tpm2_algorithm_to_mask(hash_alg))) |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 422 | continue; |
| 423 | switch (hash_alg) { |
| 424 | case TPM2_ALG_SHA1: |
| 425 | hash_calculate("sha1", regs->reg, regs->num, hash); |
| 426 | break; |
| 427 | case TPM2_ALG_SHA256: |
| 428 | hash_calculate("sha256", regs->reg, regs->num, hash); |
| 429 | break; |
| 430 | case TPM2_ALG_SHA384: |
| 431 | hash_calculate("sha384", regs->reg, regs->num, hash); |
| 432 | break; |
| 433 | case TPM2_ALG_SHA512: |
| 434 | hash_calculate("sha512", regs->reg, regs->num, hash); |
| 435 | break; |
| 436 | default: |
Heinrich Schuchardt | 09ec9f7 | 2023-07-31 14:11:34 +0200 | [diff] [blame] | 437 | continue; |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 438 | } |
Ruchika Gupta | e53007b | 2021-09-14 12:14:31 +0530 | [diff] [blame] | 439 | digest_list->digests[digest_list->count].hash_alg = hash_alg; |
| 440 | memcpy(&digest_list->digests[digest_list->count].digest, hash, |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 441 | (u32)tpm2_algorithm_to_len(hash_alg)); |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 442 | digest_list->count++; |
| 443 | } |
| 444 | |
| 445 | out: |
| 446 | if (new_efi != efi) |
| 447 | free(new_efi); |
| 448 | free(regs); |
| 449 | |
| 450 | return ret; |
| 451 | } |
| 452 | |
| 453 | /** |
| 454 | * tcg2_measure_pe_image() - measure PE/COFF image |
| 455 | * |
| 456 | * @efi: pointer to the EFI binary |
| 457 | * @efi_size: size of @efi binary |
| 458 | * @handle: loaded image handle |
| 459 | * @loaded_image: loaded image protocol |
| 460 | * |
| 461 | * Return: status code |
| 462 | */ |
| 463 | efi_status_t tcg2_measure_pe_image(void *efi, u64 efi_size, |
| 464 | struct efi_loaded_image_obj *handle, |
| 465 | struct efi_loaded_image *loaded_image) |
| 466 | { |
| 467 | struct tpml_digest_values digest_list; |
| 468 | efi_status_t ret; |
| 469 | struct udevice *dev; |
| 470 | u32 pcr_index, event_type, event_size; |
| 471 | struct uefi_image_load_event *image_load_event; |
| 472 | struct efi_device_path *device_path; |
| 473 | u32 device_path_length; |
| 474 | IMAGE_DOS_HEADER *dos; |
| 475 | IMAGE_NT_HEADERS32 *nt; |
| 476 | struct efi_handler *handler; |
| 477 | |
Masahisa Kojima | fd19a7e | 2021-12-07 14:15:32 +0900 | [diff] [blame] | 478 | if (!is_tcg2_protocol_installed()) |
| 479 | return EFI_SUCCESS; |
| 480 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 481 | ret = tcg2_platform_get_tpm2(&dev); |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 482 | if (ret != EFI_SUCCESS) |
Masahisa Kojima | 38155ea | 2021-12-07 14:15:33 +0900 | [diff] [blame] | 483 | return EFI_SECURITY_VIOLATION; |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 484 | |
| 485 | switch (handle->image_type) { |
| 486 | case IMAGE_SUBSYSTEM_EFI_APPLICATION: |
| 487 | pcr_index = 4; |
| 488 | event_type = EV_EFI_BOOT_SERVICES_APPLICATION; |
| 489 | break; |
| 490 | case IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER: |
| 491 | pcr_index = 2; |
| 492 | event_type = EV_EFI_BOOT_SERVICES_DRIVER; |
| 493 | break; |
| 494 | case IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER: |
| 495 | pcr_index = 2; |
| 496 | event_type = EV_EFI_RUNTIME_SERVICES_DRIVER; |
| 497 | break; |
| 498 | default: |
| 499 | return EFI_UNSUPPORTED; |
| 500 | } |
| 501 | |
| 502 | ret = tcg2_hash_pe_image(efi, efi_size, &digest_list); |
| 503 | if (ret != EFI_SUCCESS) |
| 504 | return ret; |
| 505 | |
| 506 | ret = tcg2_pcr_extend(dev, pcr_index, &digest_list); |
| 507 | if (ret != EFI_SUCCESS) |
| 508 | return ret; |
| 509 | |
Ilias Apalodimas | 26753c0 | 2021-09-09 00:30:49 +0300 | [diff] [blame] | 510 | ret = efi_search_protocol(&handle->header, |
| 511 | &efi_guid_loaded_image_device_path, &handler); |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 512 | if (ret != EFI_SUCCESS) |
| 513 | return ret; |
| 514 | |
Ilias Apalodimas | 26753c0 | 2021-09-09 00:30:49 +0300 | [diff] [blame] | 515 | device_path = handler->protocol_interface; |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 516 | device_path_length = efi_dp_size(device_path); |
| 517 | if (device_path_length > 0) { |
| 518 | /* add end node size */ |
| 519 | device_path_length += sizeof(struct efi_device_path); |
| 520 | } |
| 521 | event_size = sizeof(struct uefi_image_load_event) + device_path_length; |
Ilias Apalodimas | 26753c0 | 2021-09-09 00:30:49 +0300 | [diff] [blame] | 522 | image_load_event = calloc(1, event_size); |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 523 | if (!image_load_event) |
| 524 | return EFI_OUT_OF_RESOURCES; |
| 525 | |
| 526 | image_load_event->image_location_in_memory = (uintptr_t)efi; |
| 527 | image_load_event->image_length_in_memory = efi_size; |
| 528 | image_load_event->length_of_device_path = device_path_length; |
| 529 | |
| 530 | dos = (IMAGE_DOS_HEADER *)efi; |
| 531 | nt = (IMAGE_NT_HEADERS32 *)(efi + dos->e_lfanew); |
| 532 | if (nt->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) { |
| 533 | IMAGE_NT_HEADERS64 *nt64 = (IMAGE_NT_HEADERS64 *)nt; |
| 534 | |
| 535 | image_load_event->image_link_time_address = |
| 536 | nt64->OptionalHeader.ImageBase; |
| 537 | } else if (nt->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC) { |
| 538 | image_load_event->image_link_time_address = |
| 539 | nt->OptionalHeader.ImageBase; |
| 540 | } else { |
| 541 | ret = EFI_INVALID_PARAMETER; |
| 542 | goto out; |
| 543 | } |
| 544 | |
Ilias Apalodimas | 26753c0 | 2021-09-09 00:30:49 +0300 | [diff] [blame] | 545 | /* device_path_length might be zero */ |
| 546 | memcpy(image_load_event->device_path, device_path, device_path_length); |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 547 | |
| 548 | ret = tcg2_agile_log_append(pcr_index, event_type, &digest_list, |
| 549 | event_size, (u8 *)image_load_event); |
| 550 | |
| 551 | out: |
| 552 | free(image_load_event); |
| 553 | |
| 554 | return ret; |
| 555 | } |
| 556 | |
| 557 | /** |
Ilias Apalodimas | c67fef6 | 2020-11-16 08:52:41 +0200 | [diff] [blame] | 558 | * efi_tcg2_hash_log_extend_event() - extend and optionally log events |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 559 | * |
| 560 | * @this: TCG2 protocol instance |
| 561 | * @flags: bitmap providing additional information on the |
| 562 | * operation |
| 563 | * @data_to_hash: physical address of the start of the data buffer |
| 564 | * to be hashed |
| 565 | * @data_to_hash_len: the length in bytes of the buffer referenced by |
| 566 | * data_to_hash |
| 567 | * @efi_tcg_event: pointer to data buffer containing information |
| 568 | * about the event |
| 569 | * |
| 570 | * Return: status code |
| 571 | */ |
| 572 | static efi_status_t EFIAPI |
Ilias Apalodimas | c67fef6 | 2020-11-16 08:52:41 +0200 | [diff] [blame] | 573 | efi_tcg2_hash_log_extend_event(struct efi_tcg2_protocol *this, u64 flags, |
| 574 | u64 data_to_hash, u64 data_to_hash_len, |
| 575 | struct efi_tcg2_event *efi_tcg_event) |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 576 | { |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 577 | struct udevice *dev; |
| 578 | efi_status_t ret; |
| 579 | u32 event_type, pcr_index, event_size; |
| 580 | struct tpml_digest_values digest_list; |
| 581 | |
| 582 | EFI_ENTRY("%p, %llu, %llu, %llu, %p", this, flags, data_to_hash, |
| 583 | data_to_hash_len, efi_tcg_event); |
| 584 | |
| 585 | if (!this || !data_to_hash || !efi_tcg_event) { |
| 586 | ret = EFI_INVALID_PARAMETER; |
| 587 | goto out; |
| 588 | } |
| 589 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 590 | ret = tcg2_platform_get_tpm2(&dev); |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 591 | if (ret != EFI_SUCCESS) |
| 592 | goto out; |
| 593 | |
| 594 | if (efi_tcg_event->size < efi_tcg_event->header.header_size + |
| 595 | sizeof(u32)) { |
| 596 | ret = EFI_INVALID_PARAMETER; |
| 597 | goto out; |
| 598 | } |
| 599 | |
Masahisa Kojima | b807491 | 2021-09-03 10:55:52 +0900 | [diff] [blame] | 600 | if (efi_tcg_event->header.pcr_index > EFI_TCG2_MAX_PCR_INDEX) { |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 601 | ret = EFI_INVALID_PARAMETER; |
| 602 | goto out; |
| 603 | } |
| 604 | |
| 605 | /* |
| 606 | * if PE_COFF_IMAGE is set we need to make sure the image is not |
| 607 | * corrupted, verify it and hash the PE/COFF image in accordance with |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 608 | * the procedure specified in "Calculating the PE Image Hash" |
| 609 | * section of the "Windows Authenticode Portable Executable Signature |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 610 | * Format" |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 611 | */ |
| 612 | if (flags & PE_COFF_IMAGE) { |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 613 | IMAGE_NT_HEADERS32 *nt; |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 614 | |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 615 | ret = efi_check_pe((void *)(uintptr_t)data_to_hash, |
| 616 | data_to_hash_len, (void **)&nt); |
| 617 | if (ret != EFI_SUCCESS) { |
| 618 | log_err("Not a valid PE-COFF file\n"); |
Masahisa Kojima | 7c5fccd | 2021-09-03 10:55:50 +0900 | [diff] [blame] | 619 | ret = EFI_UNSUPPORTED; |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 620 | goto out; |
| 621 | } |
| 622 | ret = tcg2_hash_pe_image((void *)(uintptr_t)data_to_hash, |
| 623 | data_to_hash_len, &digest_list); |
| 624 | } else { |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 625 | ret = tcg2_create_digest(dev, (u8 *)(uintptr_t)data_to_hash, |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 626 | data_to_hash_len, &digest_list); |
| 627 | } |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 628 | |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 629 | if (ret != EFI_SUCCESS) |
| 630 | goto out; |
| 631 | |
Masahisa Kojima | 70be5a6 | 2021-05-26 12:09:58 +0900 | [diff] [blame] | 632 | pcr_index = efi_tcg_event->header.pcr_index; |
| 633 | event_type = efi_tcg_event->header.event_type; |
| 634 | |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 635 | ret = tcg2_pcr_extend(dev, pcr_index, &digest_list); |
| 636 | if (ret != EFI_SUCCESS) |
| 637 | goto out; |
| 638 | |
| 639 | if (flags & EFI_TCG2_EXTEND_ONLY) { |
| 640 | if (event_log.truncated) |
| 641 | ret = EFI_VOLUME_FULL; |
| 642 | goto out; |
| 643 | } |
| 644 | |
| 645 | /* |
| 646 | * The efi_tcg_event size includes the size component and the |
| 647 | * headersize |
| 648 | */ |
| 649 | event_size = efi_tcg_event->size - sizeof(efi_tcg_event->size) - |
| 650 | efi_tcg_event->header.header_size; |
| 651 | ret = tcg2_agile_log_append(pcr_index, event_type, &digest_list, |
| 652 | event_size, efi_tcg_event->event); |
| 653 | out: |
| 654 | return EFI_EXIT(ret); |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 655 | } |
| 656 | |
| 657 | /** |
Ilias Apalodimas | c67fef6 | 2020-11-16 08:52:41 +0200 | [diff] [blame] | 658 | * efi_tcg2_submit_command() - Send command to the TPM |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 659 | * |
| 660 | * @this: TCG2 protocol instance |
| 661 | * @input_param_block_size: size of the TPM input parameter block |
| 662 | * @input_param_block: pointer to the TPM input parameter block |
| 663 | * @output_param_block_size: size of the TPM output parameter block |
| 664 | * @output_param_block: pointer to the TPM output parameter block |
| 665 | * |
| 666 | * Return: status code |
| 667 | */ |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 668 | static efi_status_t EFIAPI |
Masahisa Kojima | 06ef6b6 | 2021-11-04 22:59:16 +0900 | [diff] [blame] | 669 | efi_tcg2_submit_command(struct efi_tcg2_protocol *this, |
| 670 | u32 input_param_block_size, |
| 671 | u8 *input_param_block, |
| 672 | u32 output_param_block_size, |
| 673 | u8 *output_param_block) |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 674 | { |
Masahisa Kojima | 06ef6b6 | 2021-11-04 22:59:16 +0900 | [diff] [blame] | 675 | struct udevice *dev; |
| 676 | efi_status_t ret; |
| 677 | u32 rc; |
| 678 | size_t resp_buf_size = output_param_block_size; |
| 679 | |
| 680 | EFI_ENTRY("%p, %u, %p, %u, %p", this, input_param_block_size, |
| 681 | input_param_block, output_param_block_size, output_param_block); |
| 682 | |
| 683 | if (!this || !input_param_block || !input_param_block_size) { |
| 684 | ret = EFI_INVALID_PARAMETER; |
| 685 | goto out; |
| 686 | } |
| 687 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 688 | ret = tcg2_platform_get_tpm2(&dev); |
Masahisa Kojima | 06ef6b6 | 2021-11-04 22:59:16 +0900 | [diff] [blame] | 689 | if (ret != EFI_SUCCESS) |
| 690 | goto out; |
| 691 | |
| 692 | rc = tpm2_submit_command(dev, input_param_block, |
| 693 | output_param_block, &resp_buf_size); |
| 694 | if (rc) { |
| 695 | ret = (rc == -ENOSPC) ? EFI_OUT_OF_RESOURCES : EFI_DEVICE_ERROR; |
| 696 | |
| 697 | goto out; |
| 698 | } |
| 699 | |
| 700 | out: |
| 701 | return EFI_EXIT(ret); |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 702 | } |
| 703 | |
| 704 | /** |
Ilias Apalodimas | c67fef6 | 2020-11-16 08:52:41 +0200 | [diff] [blame] | 705 | * efi_tcg2_get_active_pcr_banks() - returns the currently active PCR banks |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 706 | * |
| 707 | * @this: TCG2 protocol instance |
| 708 | * @active_pcr_banks: pointer for receiving the bitmap of currently |
| 709 | * active PCR banks |
| 710 | * |
| 711 | * Return: status code |
| 712 | */ |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 713 | static efi_status_t EFIAPI |
Ilias Apalodimas | c67fef6 | 2020-11-16 08:52:41 +0200 | [diff] [blame] | 714 | efi_tcg2_get_active_pcr_banks(struct efi_tcg2_protocol *this, |
| 715 | u32 *active_pcr_banks) |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 716 | { |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 717 | struct udevice *dev; |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 718 | efi_status_t ret; |
| 719 | |
Ilias Apalodimas | 918a6ea | 2023-10-24 10:43:53 -0500 | [diff] [blame] | 720 | EFI_ENTRY("%p, %p", this, active_pcr_banks); |
| 721 | |
Masahisa Kojima | 7c5fccd | 2021-09-03 10:55:50 +0900 | [diff] [blame] | 722 | if (!this || !active_pcr_banks) { |
| 723 | ret = EFI_INVALID_PARAMETER; |
| 724 | goto out; |
| 725 | } |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 726 | ret = tcg2_platform_get_tpm2(&dev); |
| 727 | if (ret != EFI_SUCCESS) |
| 728 | goto out; |
| 729 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 730 | ret = tcg2_get_active_pcr_banks(dev, active_pcr_banks); |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 731 | |
Masahisa Kojima | 7c5fccd | 2021-09-03 10:55:50 +0900 | [diff] [blame] | 732 | out: |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 733 | return EFI_EXIT(ret); |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 734 | } |
| 735 | |
| 736 | /** |
Ilias Apalodimas | c67fef6 | 2020-11-16 08:52:41 +0200 | [diff] [blame] | 737 | * efi_tcg2_set_active_pcr_banks() - sets the currently active PCR banks |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 738 | * |
| 739 | * @this: TCG2 protocol instance |
| 740 | * @active_pcr_banks: bitmap of the requested active PCR banks |
| 741 | * |
| 742 | * Return: status code |
| 743 | */ |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 744 | static efi_status_t EFIAPI |
Ilias Apalodimas | 190b0a2 | 2021-05-25 14:35:31 +0300 | [diff] [blame] | 745 | efi_tcg2_set_active_pcr_banks(__maybe_unused struct efi_tcg2_protocol *this, |
| 746 | u32 __maybe_unused active_pcr_banks) |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 747 | { |
| 748 | return EFI_UNSUPPORTED; |
| 749 | } |
| 750 | |
| 751 | /** |
Ilias Apalodimas | c67fef6 | 2020-11-16 08:52:41 +0200 | [diff] [blame] | 752 | * efi_tcg2_get_result_of_set_active_pcr_banks() - retrieve result for previous |
| 753 | * set_active_pcr_banks() |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 754 | * |
| 755 | * @this: TCG2 protocol instance |
| 756 | * @operation_present: non-zero value to indicate a |
| 757 | * set_active_pcr_banks operation was |
| 758 | * invoked during last boot |
| 759 | * @response: result value could be returned |
| 760 | * |
| 761 | * Return: status code |
| 762 | */ |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 763 | static efi_status_t EFIAPI |
Ilias Apalodimas | 190b0a2 | 2021-05-25 14:35:31 +0300 | [diff] [blame] | 764 | efi_tcg2_get_result_of_set_active_pcr_banks(__maybe_unused struct efi_tcg2_protocol *this, |
| 765 | u32 __maybe_unused *operation_present, |
| 766 | u32 __maybe_unused *response) |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 767 | { |
| 768 | return EFI_UNSUPPORTED; |
| 769 | } |
| 770 | |
| 771 | static const struct efi_tcg2_protocol efi_tcg2_protocol = { |
Ilias Apalodimas | c67fef6 | 2020-11-16 08:52:41 +0200 | [diff] [blame] | 772 | .get_capability = efi_tcg2_get_capability, |
| 773 | .get_eventlog = efi_tcg2_get_eventlog, |
| 774 | .hash_log_extend_event = efi_tcg2_hash_log_extend_event, |
| 775 | .submit_command = efi_tcg2_submit_command, |
| 776 | .get_active_pcr_banks = efi_tcg2_get_active_pcr_banks, |
| 777 | .set_active_pcr_banks = efi_tcg2_set_active_pcr_banks, |
| 778 | .get_result_of_set_active_pcr_banks = efi_tcg2_get_result_of_set_active_pcr_banks, |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 779 | }; |
| 780 | |
| 781 | /** |
Ilias Apalodimas | 1b278e6 | 2021-03-25 13:31:45 +0200 | [diff] [blame] | 782 | * tcg2_uninit - remove the final event table and free efi memory on failures |
| 783 | */ |
| 784 | void tcg2_uninit(void) |
| 785 | { |
| 786 | efi_status_t ret; |
| 787 | |
| 788 | ret = efi_install_configuration_table(&efi_guid_final_events, NULL); |
| 789 | if (ret != EFI_SUCCESS) |
| 790 | log_err("Failed to delete final events config table\n"); |
| 791 | |
| 792 | efi_free_pool(event_log.buffer); |
| 793 | event_log.buffer = NULL; |
| 794 | efi_free_pool(event_log.final_buffer); |
| 795 | event_log.final_buffer = NULL; |
Masahisa Kojima | 0fd4379 | 2021-12-07 14:15:31 +0900 | [diff] [blame] | 796 | |
| 797 | if (!is_tcg2_protocol_installed()) |
| 798 | return; |
| 799 | |
Ilias Apalodimas | 4953c99 | 2023-06-19 14:14:02 +0300 | [diff] [blame] | 800 | ret = efi_uninstall_multiple_protocol_interfaces(efi_root, &efi_guid_tcg2_protocol, |
| 801 | &efi_tcg2_protocol, NULL); |
Masahisa Kojima | 0fd4379 | 2021-12-07 14:15:31 +0900 | [diff] [blame] | 802 | if (ret != EFI_SUCCESS) |
| 803 | log_err("Failed to remove EFI TCG2 protocol\n"); |
Ilias Apalodimas | 1b278e6 | 2021-03-25 13:31:45 +0200 | [diff] [blame] | 804 | } |
| 805 | |
| 806 | /** |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 807 | * create_final_event() - Create the final event and install the config |
| 808 | * defined by the TCG EFI spec |
| 809 | */ |
| 810 | static efi_status_t create_final_event(void) |
| 811 | { |
| 812 | struct efi_tcg2_final_events_table *final_event; |
| 813 | efi_status_t ret; |
| 814 | |
| 815 | /* |
| 816 | * All events generated after the invocation of |
| 817 | * EFI_TCG2_GET_EVENT_LOGS need to be stored in an instance of an |
| 818 | * EFI_CONFIGURATION_TABLE |
| 819 | */ |
| 820 | ret = efi_allocate_pool(EFI_ACPI_MEMORY_NVS, TPM2_EVENT_LOG_SIZE, |
| 821 | &event_log.final_buffer); |
| 822 | if (ret != EFI_SUCCESS) |
| 823 | goto out; |
| 824 | |
| 825 | memset(event_log.final_buffer, 0xff, TPM2_EVENT_LOG_SIZE); |
| 826 | final_event = event_log.final_buffer; |
| 827 | final_event->number_of_events = 0; |
| 828 | final_event->version = EFI_TCG2_FINAL_EVENTS_TABLE_VERSION; |
| 829 | event_log.final_pos = sizeof(*final_event); |
| 830 | ret = efi_install_configuration_table(&efi_guid_final_events, |
| 831 | final_event); |
Ilias Apalodimas | 5a2baf9 | 2021-05-12 00:03:41 +0300 | [diff] [blame] | 832 | if (ret != EFI_SUCCESS) { |
| 833 | efi_free_pool(event_log.final_buffer); |
| 834 | event_log.final_buffer = NULL; |
| 835 | } |
| 836 | |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 837 | out: |
| 838 | return ret; |
| 839 | } |
| 840 | |
| 841 | /** |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 842 | * measure_event() - common function to add event log and extend PCR |
Masahisa Kojima | 1d2a656 | 2021-08-13 16:12:39 +0900 | [diff] [blame] | 843 | * |
| 844 | * @dev: TPM device |
| 845 | * @pcr_index: PCR index |
| 846 | * @event_type: type of event added |
| 847 | * @size: event size |
| 848 | * @event: event data |
| 849 | * |
| 850 | * Return: status code |
| 851 | */ |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 852 | static efi_status_t measure_event(struct udevice *dev, u32 pcr_index, |
| 853 | u32 event_type, u32 size, u8 event[]) |
Masahisa Kojima | 1d2a656 | 2021-08-13 16:12:39 +0900 | [diff] [blame] | 854 | { |
| 855 | struct tpml_digest_values digest_list; |
| 856 | efi_status_t ret; |
| 857 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 858 | ret = tcg2_create_digest(dev, event, size, &digest_list); |
Masahisa Kojima | 1d2a656 | 2021-08-13 16:12:39 +0900 | [diff] [blame] | 859 | if (ret != EFI_SUCCESS) |
| 860 | goto out; |
| 861 | |
| 862 | ret = tcg2_pcr_extend(dev, pcr_index, &digest_list); |
| 863 | if (ret != EFI_SUCCESS) |
| 864 | goto out; |
| 865 | |
| 866 | ret = tcg2_agile_log_append(pcr_index, event_type, &digest_list, |
| 867 | size, event); |
| 868 | |
| 869 | out: |
| 870 | return ret; |
| 871 | } |
| 872 | |
| 873 | /** |
Ilias Apalodimas | f576f7d | 2021-03-24 16:50:46 +0200 | [diff] [blame] | 874 | * efi_append_scrtm_version - Append an S-CRTM EV_S_CRTM_VERSION event on the |
| 875 | * eventlog and extend the PCRs |
| 876 | * |
| 877 | * @dev: TPM device |
| 878 | * |
| 879 | * @Return: status code |
| 880 | */ |
| 881 | static efi_status_t efi_append_scrtm_version(struct udevice *dev) |
| 882 | { |
Ilias Apalodimas | f576f7d | 2021-03-24 16:50:46 +0200 | [diff] [blame] | 883 | efi_status_t ret; |
| 884 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 885 | ret = measure_event(dev, 0, EV_S_CRTM_VERSION, |
| 886 | strlen(version_string) + 1, (u8 *)version_string); |
Ilias Apalodimas | f576f7d | 2021-03-24 16:50:46 +0200 | [diff] [blame] | 887 | |
Ruchika Gupta | bc9495c | 2021-11-29 13:09:44 +0530 | [diff] [blame] | 888 | return ret; |
| 889 | } |
| 890 | |
| 891 | /** |
| 892 | * efi_init_event_log() - initialize an eventlog |
| 893 | * |
| 894 | * Return: status code |
| 895 | */ |
| 896 | static efi_status_t efi_init_event_log(void) |
| 897 | { |
| 898 | /* |
| 899 | * vendor_info_size is currently set to 0, we need to change the length |
| 900 | * and allocate the flexible array member if this changes |
| 901 | */ |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 902 | struct tcg2_event_log elog; |
Ruchika Gupta | bc9495c | 2021-11-29 13:09:44 +0530 | [diff] [blame] | 903 | struct udevice *dev; |
Ruchika Gupta | bc9495c | 2021-11-29 13:09:44 +0530 | [diff] [blame] | 904 | efi_status_t ret; |
| 905 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 906 | ret = tcg2_platform_get_tpm2(&dev); |
Ruchika Gupta | bc9495c | 2021-11-29 13:09:44 +0530 | [diff] [blame] | 907 | if (ret != EFI_SUCCESS) |
| 908 | return ret; |
| 909 | |
| 910 | ret = efi_allocate_pool(EFI_BOOT_SERVICES_DATA, TPM2_EVENT_LOG_SIZE, |
| 911 | (void **)&event_log.buffer); |
| 912 | if (ret != EFI_SUCCESS) |
| 913 | return ret; |
| 914 | |
| 915 | /* |
| 916 | * initialize log area as 0xff so the OS can easily figure out the |
| 917 | * last log entry |
| 918 | */ |
| 919 | memset(event_log.buffer, 0xff, TPM2_EVENT_LOG_SIZE); |
| 920 | |
| 921 | /* |
| 922 | * The log header is defined to be in SHA1 event log entry format. |
| 923 | * Setup event header |
| 924 | */ |
Ruchika Gupta | bc9495c | 2021-11-29 13:09:44 +0530 | [diff] [blame] | 925 | event_log.pos = 0; |
| 926 | event_log.last_event_size = 0; |
| 927 | event_log.get_event_called = false; |
| 928 | event_log.ebs_called = false; |
| 929 | event_log.truncated = false; |
| 930 | |
| 931 | /* |
| 932 | * Check if earlier firmware have passed any eventlog. Different |
| 933 | * platforms can use different ways to do so. |
| 934 | */ |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 935 | elog.log = event_log.buffer; |
| 936 | elog.log_size = TPM2_EVENT_LOG_SIZE; |
| 937 | ret = tcg2_log_prepare_buffer(dev, &elog, false); |
| 938 | if (ret != EFI_SUCCESS) |
| 939 | goto free_pool; |
| 940 | |
| 941 | event_log.pos = elog.log_position; |
| 942 | |
Ruchika Gupta | bc9495c | 2021-11-29 13:09:44 +0530 | [diff] [blame] | 943 | /* |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 944 | * Add SCRTM version to the log if previous firmmware |
| 945 | * doesn't pass an eventlog. |
Ruchika Gupta | bc9495c | 2021-11-29 13:09:44 +0530 | [diff] [blame] | 946 | */ |
Ilias Apalodimas | 12c15f5 | 2023-11-07 13:31:34 +0200 | [diff] [blame] | 947 | if (!elog.found) { |
Ruchika Gupta | bc9495c | 2021-11-29 13:09:44 +0530 | [diff] [blame] | 948 | ret = efi_append_scrtm_version(dev); |
Ilias Apalodimas | 12c15f5 | 2023-11-07 13:31:34 +0200 | [diff] [blame] | 949 | if (ret != EFI_SUCCESS) |
| 950 | goto free_pool; |
| 951 | } |
Ruchika Gupta | bc9495c | 2021-11-29 13:09:44 +0530 | [diff] [blame] | 952 | |
| 953 | ret = create_final_event(); |
| 954 | if (ret != EFI_SUCCESS) |
| 955 | goto free_pool; |
| 956 | |
| 957 | return ret; |
| 958 | |
| 959 | free_pool: |
| 960 | efi_free_pool(event_log.buffer); |
| 961 | event_log.buffer = NULL; |
Ilias Apalodimas | f576f7d | 2021-03-24 16:50:46 +0200 | [diff] [blame] | 962 | return ret; |
| 963 | } |
| 964 | |
| 965 | /** |
Masahisa Kojima | 1d2a656 | 2021-08-13 16:12:39 +0900 | [diff] [blame] | 966 | * tcg2_measure_variable() - add variable event log and extend PCR |
| 967 | * |
| 968 | * @dev: TPM device |
| 969 | * @pcr_index: PCR index |
| 970 | * @event_type: type of event added |
| 971 | * @var_name: variable name |
| 972 | * @guid: guid |
| 973 | * @data_size: variable data size |
| 974 | * @data: variable data |
| 975 | * |
| 976 | * Return: status code |
| 977 | */ |
| 978 | static efi_status_t tcg2_measure_variable(struct udevice *dev, u32 pcr_index, |
Heinrich Schuchardt | 1ad2f0d | 2021-09-09 07:12:14 +0200 | [diff] [blame] | 979 | u32 event_type, const u16 *var_name, |
Masahisa Kojima | 1d2a656 | 2021-08-13 16:12:39 +0900 | [diff] [blame] | 980 | const efi_guid_t *guid, |
| 981 | efi_uintn_t data_size, u8 *data) |
| 982 | { |
| 983 | u32 event_size; |
| 984 | efi_status_t ret; |
| 985 | struct efi_tcg2_uefi_variable_data *event; |
| 986 | |
| 987 | event_size = sizeof(event->variable_name) + |
| 988 | sizeof(event->unicode_name_length) + |
| 989 | sizeof(event->variable_data_length) + |
| 990 | (u16_strlen(var_name) * sizeof(u16)) + data_size; |
| 991 | event = malloc(event_size); |
| 992 | if (!event) |
| 993 | return EFI_OUT_OF_RESOURCES; |
| 994 | |
| 995 | guidcpy(&event->variable_name, guid); |
| 996 | event->unicode_name_length = u16_strlen(var_name); |
| 997 | event->variable_data_length = data_size; |
| 998 | memcpy(event->unicode_name, var_name, |
| 999 | (event->unicode_name_length * sizeof(u16))); |
| 1000 | if (data) { |
| 1001 | memcpy((u16 *)event->unicode_name + event->unicode_name_length, |
| 1002 | data, data_size); |
| 1003 | } |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 1004 | ret = measure_event(dev, pcr_index, event_type, event_size, |
| 1005 | (u8 *)event); |
Masahisa Kojima | 1d2a656 | 2021-08-13 16:12:39 +0900 | [diff] [blame] | 1006 | free(event); |
| 1007 | return ret; |
| 1008 | } |
| 1009 | |
| 1010 | /** |
Masahisa Kojima | 8173cd4 | 2021-08-13 16:12:40 +0900 | [diff] [blame] | 1011 | * tcg2_measure_boot_variable() - measure boot variables |
| 1012 | * |
| 1013 | * @dev: TPM device |
| 1014 | * |
| 1015 | * Return: status code |
| 1016 | */ |
| 1017 | static efi_status_t tcg2_measure_boot_variable(struct udevice *dev) |
| 1018 | { |
| 1019 | u16 *boot_order; |
| 1020 | u16 *boot_index; |
Simon Glass | 9097537 | 2022-01-23 12:55:12 -0700 | [diff] [blame] | 1021 | u16 var_name[] = u"BootOrder"; |
| 1022 | u16 boot_name[] = u"Boot####"; |
Masahisa Kojima | 8173cd4 | 2021-08-13 16:12:40 +0900 | [diff] [blame] | 1023 | u8 *bootvar; |
| 1024 | efi_uintn_t var_data_size; |
| 1025 | u32 count, i; |
| 1026 | efi_status_t ret; |
| 1027 | |
| 1028 | boot_order = efi_get_var(var_name, &efi_global_variable_guid, |
| 1029 | &var_data_size); |
| 1030 | if (!boot_order) { |
Masahisa Kojima | d132593 | 2021-11-09 18:44:54 +0900 | [diff] [blame] | 1031 | /* If "BootOrder" is not defined, skip the boot variable measurement */ |
| 1032 | return EFI_SUCCESS; |
Masahisa Kojima | 8173cd4 | 2021-08-13 16:12:40 +0900 | [diff] [blame] | 1033 | } |
| 1034 | |
| 1035 | ret = tcg2_measure_variable(dev, 1, EV_EFI_VARIABLE_BOOT2, var_name, |
| 1036 | &efi_global_variable_guid, var_data_size, |
| 1037 | (u8 *)boot_order); |
| 1038 | if (ret != EFI_SUCCESS) |
| 1039 | goto error; |
| 1040 | |
| 1041 | count = var_data_size / sizeof(*boot_order); |
| 1042 | boot_index = boot_order; |
| 1043 | for (i = 0; i < count; i++) { |
| 1044 | efi_create_indexed_name(boot_name, sizeof(boot_name), |
| 1045 | "Boot", *boot_index++); |
| 1046 | |
| 1047 | bootvar = efi_get_var(boot_name, &efi_global_variable_guid, |
| 1048 | &var_data_size); |
| 1049 | |
| 1050 | if (!bootvar) { |
Masahisa Kojima | aca20c8 | 2021-11-09 20:35:53 +0900 | [diff] [blame] | 1051 | log_debug("%ls not found\n", boot_name); |
Masahisa Kojima | 8173cd4 | 2021-08-13 16:12:40 +0900 | [diff] [blame] | 1052 | continue; |
| 1053 | } |
| 1054 | |
| 1055 | ret = tcg2_measure_variable(dev, 1, EV_EFI_VARIABLE_BOOT2, |
| 1056 | boot_name, |
| 1057 | &efi_global_variable_guid, |
| 1058 | var_data_size, bootvar); |
| 1059 | free(bootvar); |
| 1060 | if (ret != EFI_SUCCESS) |
| 1061 | goto error; |
| 1062 | } |
| 1063 | |
| 1064 | error: |
| 1065 | free(boot_order); |
| 1066 | return ret; |
| 1067 | } |
| 1068 | |
| 1069 | /** |
Masahisa Kojima | cd1fe7d | 2021-10-26 17:27:24 +0900 | [diff] [blame] | 1070 | * tcg2_measure_smbios() - measure smbios table |
| 1071 | * |
| 1072 | * @dev: TPM device |
| 1073 | * @entry: pointer to the smbios_entry structure |
| 1074 | * |
| 1075 | * Return: status code |
| 1076 | */ |
| 1077 | static efi_status_t |
| 1078 | tcg2_measure_smbios(struct udevice *dev, |
| 1079 | const struct smbios_entry *entry) |
| 1080 | { |
| 1081 | efi_status_t ret; |
| 1082 | struct smbios_header *smbios_copy; |
| 1083 | struct smbios_handoff_table_pointers2 *event = NULL; |
| 1084 | u32 event_size; |
| 1085 | |
| 1086 | /* |
| 1087 | * TCG PC Client PFP Spec says |
| 1088 | * "SMBIOS structures that contain static configuration information |
| 1089 | * (e.g. Platform Manufacturer Enterprise Number assigned by IANA, |
| 1090 | * platform model number, Vendor and Device IDs for each SMBIOS table) |
| 1091 | * that is relevant to the security of the platform MUST be measured". |
| 1092 | * Device dependent parameters such as serial number are cleared to |
| 1093 | * zero or spaces for the measurement. |
| 1094 | */ |
| 1095 | event_size = sizeof(struct smbios_handoff_table_pointers2) + |
| 1096 | FIELD_SIZEOF(struct efi_configuration_table, guid) + |
| 1097 | entry->struct_table_length; |
| 1098 | event = calloc(1, event_size); |
| 1099 | if (!event) { |
| 1100 | ret = EFI_OUT_OF_RESOURCES; |
| 1101 | goto out; |
| 1102 | } |
| 1103 | |
| 1104 | event->table_description_size = sizeof(SMBIOS_HANDOFF_TABLE_DESC); |
| 1105 | memcpy(event->table_description, SMBIOS_HANDOFF_TABLE_DESC, |
| 1106 | sizeof(SMBIOS_HANDOFF_TABLE_DESC)); |
| 1107 | put_unaligned_le64(1, &event->number_of_tables); |
| 1108 | guidcpy(&event->table_entry[0].guid, &smbios_guid); |
| 1109 | smbios_copy = (struct smbios_header *)((uintptr_t)&event->table_entry[0].table); |
| 1110 | memcpy(&event->table_entry[0].table, |
| 1111 | (void *)((uintptr_t)entry->struct_table_address), |
| 1112 | entry->struct_table_length); |
| 1113 | |
| 1114 | smbios_prepare_measurement(entry, smbios_copy); |
| 1115 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 1116 | ret = measure_event(dev, 1, EV_EFI_HANDOFF_TABLES2, event_size, |
| 1117 | (u8 *)event); |
Masahisa Kojima | cd1fe7d | 2021-10-26 17:27:24 +0900 | [diff] [blame] | 1118 | if (ret != EFI_SUCCESS) |
| 1119 | goto out; |
| 1120 | |
| 1121 | out: |
| 1122 | free(event); |
| 1123 | |
| 1124 | return ret; |
| 1125 | } |
| 1126 | |
| 1127 | /** |
| 1128 | * find_smbios_table() - find smbios table |
| 1129 | * |
| 1130 | * Return: pointer to the smbios table |
| 1131 | */ |
| 1132 | static void *find_smbios_table(void) |
| 1133 | { |
| 1134 | u32 i; |
| 1135 | |
| 1136 | for (i = 0; i < systab.nr_tables; i++) { |
| 1137 | if (!guidcmp(&smbios_guid, &systab.tables[i].guid)) |
| 1138 | return systab.tables[i].table; |
| 1139 | } |
| 1140 | |
| 1141 | return NULL; |
| 1142 | } |
| 1143 | |
| 1144 | /** |
Masahisa Kojima | 6460c3e | 2021-10-26 17:27:25 +0900 | [diff] [blame] | 1145 | * tcg2_measure_gpt_table() - measure gpt table |
| 1146 | * |
| 1147 | * @dev: TPM device |
| 1148 | * @loaded_image: handle to the loaded image |
| 1149 | * |
| 1150 | * Return: status code |
| 1151 | */ |
| 1152 | static efi_status_t |
| 1153 | tcg2_measure_gpt_data(struct udevice *dev, |
| 1154 | struct efi_loaded_image_obj *loaded_image) |
| 1155 | { |
| 1156 | efi_status_t ret; |
| 1157 | efi_handle_t handle; |
Heinrich Schuchardt | 1100d15 | 2022-10-07 14:28:18 +0200 | [diff] [blame] | 1158 | struct efi_handler *dp_handler, *io_handler; |
Masahisa Kojima | 6460c3e | 2021-10-26 17:27:25 +0900 | [diff] [blame] | 1159 | struct efi_device_path *orig_device_path; |
| 1160 | struct efi_device_path *device_path; |
| 1161 | struct efi_device_path *dp; |
| 1162 | struct efi_block_io *block_io; |
| 1163 | struct efi_gpt_data *event = NULL; |
| 1164 | efi_guid_t null_guid = NULL_GUID; |
| 1165 | gpt_header *gpt_h; |
| 1166 | gpt_entry *entry = NULL; |
| 1167 | gpt_entry *gpt_e; |
| 1168 | u32 num_of_valid_entry = 0; |
| 1169 | u32 event_size; |
| 1170 | u32 i; |
| 1171 | u32 total_gpt_entry_size; |
| 1172 | |
| 1173 | ret = efi_search_protocol(&loaded_image->header, |
| 1174 | &efi_guid_loaded_image_device_path, |
| 1175 | &dp_handler); |
| 1176 | if (ret != EFI_SUCCESS) |
| 1177 | return ret; |
| 1178 | |
| 1179 | orig_device_path = dp_handler->protocol_interface; |
| 1180 | if (!orig_device_path) /* no device path, skip GPT measurement */ |
| 1181 | return EFI_SUCCESS; |
| 1182 | |
| 1183 | device_path = efi_dp_dup(orig_device_path); |
| 1184 | if (!device_path) |
| 1185 | return EFI_OUT_OF_RESOURCES; |
| 1186 | |
| 1187 | dp = search_gpt_dp_node(device_path); |
| 1188 | if (!dp) { |
| 1189 | /* no GPT device path node found, skip GPT measurement */ |
| 1190 | ret = EFI_SUCCESS; |
| 1191 | goto out1; |
| 1192 | } |
| 1193 | |
| 1194 | /* read GPT header */ |
| 1195 | dp->type = DEVICE_PATH_TYPE_END; |
| 1196 | dp->sub_type = DEVICE_PATH_SUB_TYPE_END; |
| 1197 | dp = device_path; |
| 1198 | ret = EFI_CALL(systab.boottime->locate_device_path(&efi_block_io_guid, |
| 1199 | &dp, &handle)); |
| 1200 | if (ret != EFI_SUCCESS) |
| 1201 | goto out1; |
| 1202 | |
Heinrich Schuchardt | 1100d15 | 2022-10-07 14:28:18 +0200 | [diff] [blame] | 1203 | ret = efi_search_protocol(handle, &efi_block_io_guid, &io_handler); |
Masahisa Kojima | 6460c3e | 2021-10-26 17:27:25 +0900 | [diff] [blame] | 1204 | if (ret != EFI_SUCCESS) |
| 1205 | goto out1; |
Heinrich Schuchardt | 1100d15 | 2022-10-07 14:28:18 +0200 | [diff] [blame] | 1206 | block_io = io_handler->protocol_interface; |
Masahisa Kojima | 6460c3e | 2021-10-26 17:27:25 +0900 | [diff] [blame] | 1207 | |
| 1208 | gpt_h = memalign(block_io->media->io_align, block_io->media->block_size); |
| 1209 | if (!gpt_h) { |
| 1210 | ret = EFI_OUT_OF_RESOURCES; |
| 1211 | goto out2; |
| 1212 | } |
| 1213 | |
| 1214 | ret = block_io->read_blocks(block_io, block_io->media->media_id, 1, |
| 1215 | block_io->media->block_size, gpt_h); |
| 1216 | if (ret != EFI_SUCCESS) |
| 1217 | goto out2; |
| 1218 | |
| 1219 | /* read GPT entry */ |
| 1220 | total_gpt_entry_size = gpt_h->num_partition_entries * |
| 1221 | gpt_h->sizeof_partition_entry; |
| 1222 | entry = memalign(block_io->media->io_align, total_gpt_entry_size); |
| 1223 | if (!entry) { |
| 1224 | ret = EFI_OUT_OF_RESOURCES; |
| 1225 | goto out2; |
| 1226 | } |
| 1227 | |
| 1228 | ret = block_io->read_blocks(block_io, block_io->media->media_id, |
| 1229 | gpt_h->partition_entry_lba, |
| 1230 | total_gpt_entry_size, entry); |
| 1231 | if (ret != EFI_SUCCESS) |
| 1232 | goto out2; |
| 1233 | |
| 1234 | /* count valid GPT entry */ |
| 1235 | gpt_e = entry; |
| 1236 | for (i = 0; i < gpt_h->num_partition_entries; i++) { |
| 1237 | if (guidcmp(&null_guid, &gpt_e->partition_type_guid)) |
| 1238 | num_of_valid_entry++; |
| 1239 | |
| 1240 | gpt_e = (gpt_entry *)((u8 *)gpt_e + gpt_h->sizeof_partition_entry); |
| 1241 | } |
| 1242 | |
| 1243 | /* prepare event data for measurement */ |
| 1244 | event_size = sizeof(struct efi_gpt_data) + |
| 1245 | (num_of_valid_entry * gpt_h->sizeof_partition_entry); |
| 1246 | event = calloc(1, event_size); |
| 1247 | if (!event) { |
| 1248 | ret = EFI_OUT_OF_RESOURCES; |
| 1249 | goto out2; |
| 1250 | } |
| 1251 | memcpy(event, gpt_h, sizeof(gpt_header)); |
| 1252 | put_unaligned_le64(num_of_valid_entry, &event->number_of_partitions); |
| 1253 | |
| 1254 | /* copy valid GPT entry */ |
| 1255 | gpt_e = entry; |
| 1256 | num_of_valid_entry = 0; |
| 1257 | for (i = 0; i < gpt_h->num_partition_entries; i++) { |
| 1258 | if (guidcmp(&null_guid, &gpt_e->partition_type_guid)) { |
| 1259 | memcpy((u8 *)event->partitions + |
| 1260 | (num_of_valid_entry * gpt_h->sizeof_partition_entry), |
| 1261 | gpt_e, gpt_h->sizeof_partition_entry); |
| 1262 | num_of_valid_entry++; |
| 1263 | } |
| 1264 | |
| 1265 | gpt_e = (gpt_entry *)((u8 *)gpt_e + gpt_h->sizeof_partition_entry); |
| 1266 | } |
| 1267 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 1268 | ret = measure_event(dev, 5, EV_EFI_GPT_EVENT, event_size, (u8 *)event); |
Masahisa Kojima | 6460c3e | 2021-10-26 17:27:25 +0900 | [diff] [blame] | 1269 | |
| 1270 | out2: |
Masahisa Kojima | 6460c3e | 2021-10-26 17:27:25 +0900 | [diff] [blame] | 1271 | free(gpt_h); |
| 1272 | free(entry); |
| 1273 | free(event); |
| 1274 | out1: |
| 1275 | efi_free_pool(device_path); |
| 1276 | |
| 1277 | return ret; |
| 1278 | } |
| 1279 | |
Etienne Carriere | b906435 | 2023-02-16 17:29:48 +0100 | [diff] [blame] | 1280 | /* Return the byte size of reserved map area in DTB or -1 upon error */ |
| 1281 | static ssize_t size_of_rsvmap(void *dtb) |
| 1282 | { |
| 1283 | struct fdt_reserve_entry e; |
| 1284 | ssize_t size_max; |
| 1285 | ssize_t size; |
| 1286 | u8 *rsvmap_base; |
| 1287 | |
| 1288 | rsvmap_base = (u8 *)dtb + fdt_off_mem_rsvmap(dtb); |
| 1289 | size_max = fdt_totalsize(dtb) - fdt_off_mem_rsvmap(dtb); |
| 1290 | size = 0; |
| 1291 | |
| 1292 | do { |
| 1293 | memcpy(&e, rsvmap_base + size, sizeof(e)); |
| 1294 | size += sizeof(e); |
| 1295 | if (size > size_max) |
| 1296 | return -1; |
| 1297 | } while (e.size); |
| 1298 | |
| 1299 | return size; |
| 1300 | } |
| 1301 | |
| 1302 | /** |
| 1303 | * efi_tcg2_measure_dtb() - measure DTB passed to the OS |
| 1304 | * |
| 1305 | * @dtb: pointer to the device tree blob |
| 1306 | * |
| 1307 | * Return: status code |
| 1308 | */ |
| 1309 | efi_status_t efi_tcg2_measure_dtb(void *dtb) |
| 1310 | { |
| 1311 | struct uefi_platform_firmware_blob2 *blob; |
| 1312 | struct fdt_header *header; |
| 1313 | sha256_context hash_ctx; |
| 1314 | struct udevice *dev; |
| 1315 | ssize_t rsvmap_size; |
| 1316 | efi_status_t ret; |
| 1317 | u32 event_size; |
| 1318 | |
| 1319 | if (!is_tcg2_protocol_installed()) |
| 1320 | return EFI_SUCCESS; |
| 1321 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 1322 | ret = tcg2_platform_get_tpm2(&dev); |
Etienne Carriere | b906435 | 2023-02-16 17:29:48 +0100 | [diff] [blame] | 1323 | if (ret != EFI_SUCCESS) |
| 1324 | return EFI_SECURITY_VIOLATION; |
| 1325 | |
| 1326 | rsvmap_size = size_of_rsvmap(dtb); |
| 1327 | if (rsvmap_size < 0) |
| 1328 | return EFI_SECURITY_VIOLATION; |
| 1329 | |
| 1330 | event_size = sizeof(*blob) + sizeof(EFI_DTB_EVENT_STRING) + SHA256_SUM_LEN; |
| 1331 | blob = calloc(1, event_size); |
| 1332 | if (!blob) |
| 1333 | return EFI_OUT_OF_RESOURCES; |
| 1334 | |
| 1335 | blob->blob_description_size = sizeof(EFI_DTB_EVENT_STRING); |
| 1336 | memcpy(blob->data, EFI_DTB_EVENT_STRING, blob->blob_description_size); |
| 1337 | |
| 1338 | /* Measure populated areas of the DTB */ |
| 1339 | header = dtb; |
| 1340 | sha256_starts(&hash_ctx); |
| 1341 | sha256_update(&hash_ctx, (u8 *)header, sizeof(struct fdt_header)); |
| 1342 | sha256_update(&hash_ctx, (u8 *)dtb + fdt_off_dt_struct(dtb), fdt_size_dt_strings(dtb)); |
| 1343 | sha256_update(&hash_ctx, (u8 *)dtb + fdt_off_dt_strings(dtb), fdt_size_dt_struct(dtb)); |
| 1344 | sha256_update(&hash_ctx, (u8 *)dtb + fdt_off_mem_rsvmap(dtb), rsvmap_size); |
| 1345 | sha256_finish(&hash_ctx, blob->data + blob->blob_description_size); |
| 1346 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 1347 | ret = measure_event(dev, 0, EV_POST_CODE, event_size, (u8 *)blob); |
Etienne Carriere | b906435 | 2023-02-16 17:29:48 +0100 | [diff] [blame] | 1348 | |
| 1349 | free(blob); |
| 1350 | return ret; |
| 1351 | } |
| 1352 | |
Masahisa Kojima | 6460c3e | 2021-10-26 17:27:25 +0900 | [diff] [blame] | 1353 | /** |
Masahisa Kojima | 8173cd4 | 2021-08-13 16:12:40 +0900 | [diff] [blame] | 1354 | * efi_tcg2_measure_efi_app_invocation() - measure efi app invocation |
| 1355 | * |
| 1356 | * Return: status code |
| 1357 | */ |
Masahisa Kojima | 6460c3e | 2021-10-26 17:27:25 +0900 | [diff] [blame] | 1358 | efi_status_t efi_tcg2_measure_efi_app_invocation(struct efi_loaded_image_obj *handle) |
Masahisa Kojima | 8173cd4 | 2021-08-13 16:12:40 +0900 | [diff] [blame] | 1359 | { |
| 1360 | efi_status_t ret; |
| 1361 | u32 pcr_index; |
| 1362 | struct udevice *dev; |
| 1363 | u32 event = 0; |
Masahisa Kojima | cd1fe7d | 2021-10-26 17:27:24 +0900 | [diff] [blame] | 1364 | struct smbios_entry *entry; |
Masahisa Kojima | 8173cd4 | 2021-08-13 16:12:40 +0900 | [diff] [blame] | 1365 | |
Masahisa Kojima | fd19a7e | 2021-12-07 14:15:32 +0900 | [diff] [blame] | 1366 | if (!is_tcg2_protocol_installed()) |
| 1367 | return EFI_SUCCESS; |
| 1368 | |
Masahisa Kojima | 8173cd4 | 2021-08-13 16:12:40 +0900 | [diff] [blame] | 1369 | if (tcg2_efi_app_invoked) |
| 1370 | return EFI_SUCCESS; |
| 1371 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 1372 | ret = tcg2_platform_get_tpm2(&dev); |
Masahisa Kojima | 8173cd4 | 2021-08-13 16:12:40 +0900 | [diff] [blame] | 1373 | if (ret != EFI_SUCCESS) |
Masahisa Kojima | 38155ea | 2021-12-07 14:15:33 +0900 | [diff] [blame] | 1374 | return EFI_SECURITY_VIOLATION; |
Masahisa Kojima | 8173cd4 | 2021-08-13 16:12:40 +0900 | [diff] [blame] | 1375 | |
| 1376 | ret = tcg2_measure_boot_variable(dev); |
| 1377 | if (ret != EFI_SUCCESS) |
| 1378 | goto out; |
| 1379 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 1380 | ret = measure_event(dev, 4, EV_EFI_ACTION, |
| 1381 | strlen(EFI_CALLING_EFI_APPLICATION), |
| 1382 | (u8 *)EFI_CALLING_EFI_APPLICATION); |
Masahisa Kojima | 8173cd4 | 2021-08-13 16:12:40 +0900 | [diff] [blame] | 1383 | if (ret != EFI_SUCCESS) |
| 1384 | goto out; |
| 1385 | |
Masahisa Kojima | cd1fe7d | 2021-10-26 17:27:24 +0900 | [diff] [blame] | 1386 | entry = (struct smbios_entry *)find_smbios_table(); |
| 1387 | if (entry) { |
| 1388 | ret = tcg2_measure_smbios(dev, entry); |
| 1389 | if (ret != EFI_SUCCESS) |
| 1390 | goto out; |
| 1391 | } |
| 1392 | |
Masahisa Kojima | 6460c3e | 2021-10-26 17:27:25 +0900 | [diff] [blame] | 1393 | ret = tcg2_measure_gpt_data(dev, handle); |
| 1394 | if (ret != EFI_SUCCESS) |
| 1395 | goto out; |
| 1396 | |
Masahisa Kojima | 8173cd4 | 2021-08-13 16:12:40 +0900 | [diff] [blame] | 1397 | for (pcr_index = 0; pcr_index <= 7; pcr_index++) { |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 1398 | ret = measure_event(dev, pcr_index, EV_SEPARATOR, |
| 1399 | sizeof(event), (u8 *)&event); |
Masahisa Kojima | 8173cd4 | 2021-08-13 16:12:40 +0900 | [diff] [blame] | 1400 | if (ret != EFI_SUCCESS) |
| 1401 | goto out; |
| 1402 | } |
| 1403 | |
| 1404 | tcg2_efi_app_invoked = true; |
| 1405 | out: |
| 1406 | return ret; |
| 1407 | } |
| 1408 | |
| 1409 | /** |
| 1410 | * efi_tcg2_measure_efi_app_exit() - measure efi app exit |
| 1411 | * |
| 1412 | * Return: status code |
| 1413 | */ |
| 1414 | efi_status_t efi_tcg2_measure_efi_app_exit(void) |
| 1415 | { |
| 1416 | efi_status_t ret; |
| 1417 | struct udevice *dev; |
| 1418 | |
Masahisa Kojima | fd19a7e | 2021-12-07 14:15:32 +0900 | [diff] [blame] | 1419 | if (!is_tcg2_protocol_installed()) |
| 1420 | return EFI_SUCCESS; |
| 1421 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 1422 | ret = tcg2_platform_get_tpm2(&dev); |
Masahisa Kojima | 8173cd4 | 2021-08-13 16:12:40 +0900 | [diff] [blame] | 1423 | if (ret != EFI_SUCCESS) |
| 1424 | return ret; |
| 1425 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 1426 | ret = measure_event(dev, 4, EV_EFI_ACTION, |
| 1427 | strlen(EFI_RETURNING_FROM_EFI_APPLICATION), |
| 1428 | (u8 *)EFI_RETURNING_FROM_EFI_APPLICATION); |
Masahisa Kojima | 8173cd4 | 2021-08-13 16:12:40 +0900 | [diff] [blame] | 1429 | return ret; |
| 1430 | } |
| 1431 | |
| 1432 | /** |
Masahisa Kojima | 1ac19bb | 2021-08-13 16:12:41 +0900 | [diff] [blame] | 1433 | * efi_tcg2_notify_exit_boot_services() - ExitBootService callback |
| 1434 | * |
| 1435 | * @event: callback event |
| 1436 | * @context: callback context |
| 1437 | */ |
| 1438 | static void EFIAPI |
| 1439 | efi_tcg2_notify_exit_boot_services(struct efi_event *event, void *context) |
| 1440 | { |
| 1441 | efi_status_t ret; |
| 1442 | struct udevice *dev; |
| 1443 | |
| 1444 | EFI_ENTRY("%p, %p", event, context); |
| 1445 | |
Ilias Apalodimas | 24e841a | 2021-11-18 09:03:39 +0200 | [diff] [blame] | 1446 | event_log.ebs_called = true; |
Masahisa Kojima | fd19a7e | 2021-12-07 14:15:32 +0900 | [diff] [blame] | 1447 | |
| 1448 | if (!is_tcg2_protocol_installed()) { |
| 1449 | ret = EFI_SUCCESS; |
| 1450 | goto out; |
| 1451 | } |
| 1452 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 1453 | ret = tcg2_platform_get_tpm2(&dev); |
Masahisa Kojima | 1ac19bb | 2021-08-13 16:12:41 +0900 | [diff] [blame] | 1454 | if (ret != EFI_SUCCESS) |
| 1455 | goto out; |
| 1456 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 1457 | ret = measure_event(dev, 5, EV_EFI_ACTION, |
| 1458 | strlen(EFI_EXIT_BOOT_SERVICES_INVOCATION), |
| 1459 | (u8 *)EFI_EXIT_BOOT_SERVICES_INVOCATION); |
Masahisa Kojima | 1ac19bb | 2021-08-13 16:12:41 +0900 | [diff] [blame] | 1460 | if (ret != EFI_SUCCESS) |
| 1461 | goto out; |
| 1462 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 1463 | ret = measure_event(dev, 5, EV_EFI_ACTION, |
| 1464 | strlen(EFI_EXIT_BOOT_SERVICES_SUCCEEDED), |
| 1465 | (u8 *)EFI_EXIT_BOOT_SERVICES_SUCCEEDED); |
Masahisa Kojima | 1ac19bb | 2021-08-13 16:12:41 +0900 | [diff] [blame] | 1466 | |
| 1467 | out: |
| 1468 | EFI_EXIT(ret); |
| 1469 | } |
| 1470 | |
| 1471 | /** |
| 1472 | * efi_tcg2_notify_exit_boot_services_failed() |
| 1473 | * - notify ExitBootServices() is failed |
| 1474 | * |
| 1475 | * Return: status code |
| 1476 | */ |
| 1477 | efi_status_t efi_tcg2_notify_exit_boot_services_failed(void) |
| 1478 | { |
| 1479 | struct udevice *dev; |
| 1480 | efi_status_t ret; |
| 1481 | |
Masahisa Kojima | fd19a7e | 2021-12-07 14:15:32 +0900 | [diff] [blame] | 1482 | if (!is_tcg2_protocol_installed()) |
| 1483 | return EFI_SUCCESS; |
| 1484 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 1485 | ret = tcg2_platform_get_tpm2(&dev); |
Masahisa Kojima | 1ac19bb | 2021-08-13 16:12:41 +0900 | [diff] [blame] | 1486 | if (ret != EFI_SUCCESS) |
| 1487 | goto out; |
| 1488 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 1489 | ret = measure_event(dev, 5, EV_EFI_ACTION, |
| 1490 | strlen(EFI_EXIT_BOOT_SERVICES_INVOCATION), |
| 1491 | (u8 *)EFI_EXIT_BOOT_SERVICES_INVOCATION); |
Masahisa Kojima | 1ac19bb | 2021-08-13 16:12:41 +0900 | [diff] [blame] | 1492 | if (ret != EFI_SUCCESS) |
| 1493 | goto out; |
| 1494 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 1495 | ret = measure_event(dev, 5, EV_EFI_ACTION, |
| 1496 | strlen(EFI_EXIT_BOOT_SERVICES_FAILED), |
| 1497 | (u8 *)EFI_EXIT_BOOT_SERVICES_FAILED); |
Masahisa Kojima | 1ac19bb | 2021-08-13 16:12:41 +0900 | [diff] [blame] | 1498 | |
| 1499 | out: |
| 1500 | return ret; |
| 1501 | } |
| 1502 | |
| 1503 | /** |
Masahisa Kojima | 1d2a656 | 2021-08-13 16:12:39 +0900 | [diff] [blame] | 1504 | * tcg2_measure_secure_boot_variable() - measure secure boot variables |
| 1505 | * |
| 1506 | * @dev: TPM device |
| 1507 | * |
| 1508 | * Return: status code |
| 1509 | */ |
| 1510 | static efi_status_t tcg2_measure_secure_boot_variable(struct udevice *dev) |
| 1511 | { |
| 1512 | u8 *data; |
| 1513 | efi_uintn_t data_size; |
| 1514 | u32 count, i; |
| 1515 | efi_status_t ret; |
Masahisa Kojima | f3e0c55 | 2021-10-26 17:27:27 +0900 | [diff] [blame] | 1516 | u8 deployed_mode; |
| 1517 | efi_uintn_t size; |
| 1518 | u32 deployed_audit_pcr_index = 1; |
| 1519 | |
| 1520 | size = sizeof(deployed_mode); |
| 1521 | ret = efi_get_variable_int(u"DeployedMode", &efi_global_variable_guid, |
| 1522 | NULL, &size, &deployed_mode, NULL); |
| 1523 | if (ret != EFI_SUCCESS || !deployed_mode) |
| 1524 | deployed_audit_pcr_index = 7; |
Masahisa Kojima | 1d2a656 | 2021-08-13 16:12:39 +0900 | [diff] [blame] | 1525 | |
| 1526 | count = ARRAY_SIZE(secure_variables); |
| 1527 | for (i = 0; i < count; i++) { |
Heinrich Schuchardt | 6f26e7c | 2021-09-09 08:50:01 +0200 | [diff] [blame] | 1528 | const efi_guid_t *guid; |
| 1529 | |
Masahisa Kojima | 2168452 | 2021-10-26 17:27:26 +0900 | [diff] [blame] | 1530 | guid = efi_auth_var_get_guid(secure_variables[i].name); |
Heinrich Schuchardt | 6f26e7c | 2021-09-09 08:50:01 +0200 | [diff] [blame] | 1531 | |
Masahisa Kojima | 2168452 | 2021-10-26 17:27:26 +0900 | [diff] [blame] | 1532 | data = efi_get_var(secure_variables[i].name, guid, &data_size); |
| 1533 | if (!data && !secure_variables[i].accept_empty) |
| 1534 | continue; |
Masahisa Kojima | 1d2a656 | 2021-08-13 16:12:39 +0900 | [diff] [blame] | 1535 | |
Masahisa Kojima | f3e0c55 | 2021-10-26 17:27:27 +0900 | [diff] [blame] | 1536 | if (u16_strcmp(u"DeployedMode", secure_variables[i].name)) |
| 1537 | secure_variables[i].pcr_index = deployed_audit_pcr_index; |
| 1538 | if (u16_strcmp(u"AuditMode", secure_variables[i].name)) |
| 1539 | secure_variables[i].pcr_index = deployed_audit_pcr_index; |
| 1540 | |
| 1541 | ret = tcg2_measure_variable(dev, secure_variables[i].pcr_index, |
Masahisa Kojima | 1d2a656 | 2021-08-13 16:12:39 +0900 | [diff] [blame] | 1542 | EV_EFI_VARIABLE_DRIVER_CONFIG, |
Masahisa Kojima | 2168452 | 2021-10-26 17:27:26 +0900 | [diff] [blame] | 1543 | secure_variables[i].name, guid, |
Masahisa Kojima | 1d2a656 | 2021-08-13 16:12:39 +0900 | [diff] [blame] | 1544 | data_size, data); |
| 1545 | free(data); |
| 1546 | if (ret != EFI_SUCCESS) |
| 1547 | goto error; |
| 1548 | } |
| 1549 | |
Masahisa Kojima | 1d2a656 | 2021-08-13 16:12:39 +0900 | [diff] [blame] | 1550 | error: |
| 1551 | return ret; |
| 1552 | } |
| 1553 | |
| 1554 | /** |
Masahisa Kojima | 0fd4379 | 2021-12-07 14:15:31 +0900 | [diff] [blame] | 1555 | * efi_tcg2_do_initial_measurement() - do initial measurement |
| 1556 | * |
| 1557 | * Return: status code |
| 1558 | */ |
| 1559 | efi_status_t efi_tcg2_do_initial_measurement(void) |
| 1560 | { |
| 1561 | efi_status_t ret; |
| 1562 | struct udevice *dev; |
| 1563 | |
| 1564 | if (!is_tcg2_protocol_installed()) |
| 1565 | return EFI_SUCCESS; |
| 1566 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 1567 | ret = tcg2_platform_get_tpm2(&dev); |
Masahisa Kojima | 0fd4379 | 2021-12-07 14:15:31 +0900 | [diff] [blame] | 1568 | if (ret != EFI_SUCCESS) |
| 1569 | return EFI_SECURITY_VIOLATION; |
| 1570 | |
| 1571 | ret = tcg2_measure_secure_boot_variable(dev); |
| 1572 | if (ret != EFI_SUCCESS) |
| 1573 | goto out; |
| 1574 | |
| 1575 | out: |
| 1576 | return ret; |
| 1577 | } |
| 1578 | |
| 1579 | /** |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 1580 | * efi_tcg2_register() - register EFI_TCG2_PROTOCOL |
| 1581 | * |
| 1582 | * If a TPM2 device is available, the TPM TCG2 Protocol is registered |
| 1583 | * |
Masahisa Kojima | 0fd4379 | 2021-12-07 14:15:31 +0900 | [diff] [blame] | 1584 | * Return: status code |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 1585 | */ |
| 1586 | efi_status_t efi_tcg2_register(void) |
| 1587 | { |
Ilias Apalodimas | 1b278e6 | 2021-03-25 13:31:45 +0200 | [diff] [blame] | 1588 | efi_status_t ret = EFI_SUCCESS; |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 1589 | struct udevice *dev; |
Masahisa Kojima | 1ac19bb | 2021-08-13 16:12:41 +0900 | [diff] [blame] | 1590 | struct efi_event *event; |
Ilias Apalodimas | 1d16f1e | 2021-11-18 10:13:42 +0200 | [diff] [blame] | 1591 | u32 err; |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 1592 | |
Eddie James | 8ed7bb3 | 2023-10-24 10:43:49 -0500 | [diff] [blame] | 1593 | ret = tcg2_platform_get_tpm2(&dev); |
Ilias Apalodimas | c67fef6 | 2020-11-16 08:52:41 +0200 | [diff] [blame] | 1594 | if (ret != EFI_SUCCESS) { |
Ilias Apalodimas | eb1b6b4 | 2023-01-19 16:29:15 +0200 | [diff] [blame] | 1595 | log_warning("Missing TPMv2 device for EFI_TCG_PROTOCOL\n"); |
Ilias Apalodimas | fa5217d | 2021-05-10 21:19:14 +0300 | [diff] [blame] | 1596 | return EFI_SUCCESS; |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 1597 | } |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 1598 | |
Ilias Apalodimas | 1d16f1e | 2021-11-18 10:13:42 +0200 | [diff] [blame] | 1599 | /* initialize the TPM as early as possible. */ |
Ilias Apalodimas | 0c95d22 | 2023-01-25 13:06:03 +0200 | [diff] [blame] | 1600 | err = tpm_auto_start(dev); |
Ilias Apalodimas | 1d16f1e | 2021-11-18 10:13:42 +0200 | [diff] [blame] | 1601 | if (err) { |
| 1602 | log_err("TPM startup failed\n"); |
| 1603 | goto fail; |
| 1604 | } |
| 1605 | |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 1606 | ret = efi_init_event_log(); |
Masahisa Kojima | 0fd4379 | 2021-12-07 14:15:31 +0900 | [diff] [blame] | 1607 | if (ret != EFI_SUCCESS) { |
| 1608 | tcg2_uninit(); |
Ilias Apalodimas | 1b278e6 | 2021-03-25 13:31:45 +0200 | [diff] [blame] | 1609 | goto fail; |
Masahisa Kojima | 0fd4379 | 2021-12-07 14:15:31 +0900 | [diff] [blame] | 1610 | } |
Ilias Apalodimas | 967650d | 2020-11-30 11:47:40 +0200 | [diff] [blame] | 1611 | |
Ilias Apalodimas | 4953c99 | 2023-06-19 14:14:02 +0300 | [diff] [blame] | 1612 | ret = efi_install_multiple_protocol_interfaces(&efi_root, &efi_guid_tcg2_protocol, |
| 1613 | &efi_tcg2_protocol, NULL); |
Ilias Apalodimas | 1b278e6 | 2021-03-25 13:31:45 +0200 | [diff] [blame] | 1614 | if (ret != EFI_SUCCESS) { |
Ilias Apalodimas | 5a2baf9 | 2021-05-12 00:03:41 +0300 | [diff] [blame] | 1615 | tcg2_uninit(); |
Ilias Apalodimas | 1b278e6 | 2021-03-25 13:31:45 +0200 | [diff] [blame] | 1616 | goto fail; |
| 1617 | } |
Masahisa Kojima | 1d2a656 | 2021-08-13 16:12:39 +0900 | [diff] [blame] | 1618 | |
Masahisa Kojima | 1ac19bb | 2021-08-13 16:12:41 +0900 | [diff] [blame] | 1619 | ret = efi_create_event(EVT_SIGNAL_EXIT_BOOT_SERVICES, TPL_CALLBACK, |
| 1620 | efi_tcg2_notify_exit_boot_services, NULL, |
| 1621 | NULL, &event); |
| 1622 | if (ret != EFI_SUCCESS) { |
| 1623 | tcg2_uninit(); |
| 1624 | goto fail; |
| 1625 | } |
| 1626 | |
Ilias Apalodimas | 1b278e6 | 2021-03-25 13:31:45 +0200 | [diff] [blame] | 1627 | return ret; |
Ilias Apalodimas | fa5217d | 2021-05-10 21:19:14 +0300 | [diff] [blame] | 1628 | |
Ilias Apalodimas | 1b278e6 | 2021-03-25 13:31:45 +0200 | [diff] [blame] | 1629 | fail: |
Ilias Apalodimas | 5a2baf9 | 2021-05-12 00:03:41 +0300 | [diff] [blame] | 1630 | log_err("Cannot install EFI_TCG2_PROTOCOL\n"); |
Masahisa Kojima | 0fd4379 | 2021-12-07 14:15:31 +0900 | [diff] [blame] | 1631 | return ret; |
Ilias Apalodimas | 590fef6 | 2020-11-11 11:18:11 +0200 | [diff] [blame] | 1632 | } |