From patchwork Wed Nov 24 07:56:25 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ruchika Gupta X-Patchwork-Id: 519346 Delivered-To: patch@linaro.org Received: by 2002:ac0:c605:0:0:0:0:0 with SMTP id p5csp9968471imj; Tue, 23 Nov 2021 23:57:14 -0800 (PST) X-Google-Smtp-Source: ABdhPJzFrWLNRINZtbnec9TwxXSAj7hR/J6AJMtMpgSu07b14SK9pw9mDd6BHJ27xSGDsLgv9F61 X-Received: by 2002:a05:6402:510e:: with SMTP id m14mr21613161edd.312.1637740633923; Tue, 23 Nov 2021 23:57:13 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1637740633; cv=none; d=google.com; s=arc-20160816; b=ZL0Gt7PjXrPfRUXsl0xck47luI+ZYp/Oqxl8shqevh+35stpQltvZSShL7RtkSIUHD Zqh24YWDq9ZAUvf3N6of5DeCuxZxlYDE/d36T5qALp06b4T8Wkl1Us4pQkSW6w1FzO2H myq/0xSwKYocEhe0SzLokoHT6cc5lxr4PltlKtX4uGRg1T6O1aVh0U1RaA1w61ly5dfn gnUqSqhUDLFh6Yi6i41t35vPlZI3GcJuti6pdI/8lURe2/UvzWlmGlRzyytcCBVb5Wzv cA82VikK8L+zdLM2Oe/hl66BR8oTN0EGdrSgEYlmR4dfnFx9deQ5F+9ZYDcoMXlJ8Pfh bITA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=RJtxl1wfiVTaN2nsueXpnMjbK6zFOJZ8kS7S91H0g4Y=; b=qKSdafUwndUZLcXggKQrUuuO4bR7zvlMsIE9KLNRhhr5U3Ne4egkO/vPfKT2XefQOd xFvoRV9RjFu27IqziU+UT1TSvbjF/4F8tMFvkJam7kH16IgK5o3fR2JGY56cyWcViy05 AUoYrTAHj+fUjURe4cESRhGaJyb1gqx6NH0BU8TQpdjLSi7OXY8J4/GXSqfC0FqEPRZQ 8Ge9YfOwjJuM3NnGNtXimlRPZH9lU0KMY3Y8aryoTsgIRmChE5O9o7YF0Xi1hz2pCCVn qHGyS4daJRKR3cLkqCEUidl/ZF+7ZmHiWjxdUJNSdQb/ogOwfx7w5H5LVctscnzHEc95 7ElA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=EEjh33B8; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id dt3si56004326ejc.300.2021.11.23.23.57.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 23 Nov 2021 23:57:13 -0800 (PST) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=EEjh33B8; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id EAAFA83738; Wed, 24 Nov 2021 08:57:12 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="EEjh33B8"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id F148783735; Wed, 24 Nov 2021 08:57:09 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-pl1-x62a.google.com (mail-pl1-x62a.google.com [IPv6:2607:f8b0:4864:20::62a]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 8307D8373B for ; Wed, 24 Nov 2021 08:57:04 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ruchika.gupta@linaro.org Received: by mail-pl1-x62a.google.com with SMTP id n8so1180001plf.4 for ; Tue, 23 Nov 2021 23:57:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=RJtxl1wfiVTaN2nsueXpnMjbK6zFOJZ8kS7S91H0g4Y=; b=EEjh33B8k4AM8YveJuLIzJZb1XnPYZVLbjCroG5+8+b2r62D5osq34l15OgFqTO+yk m/oiRll5PDbPCdGkifTPd2Usx4SzyvodiskK9todyoidIMuytlSOrasGoiQuYS1fo8xh OkDh8r0G/F5nQ9Yi0Av0XlKbStWk2XTrV3NAURsAVypm1VtTmAlCXRqmNnkBkYk5ry+J SqQxKZKJISynJ9GGbj++90OzSVFcIlk6Wte+uP06MwoVsxMhfxKKt9dLkdoqWo3u7RTd Q3tIiylNaXxw+AJ4Cd4H5Qng4uLh3ZFGvaa/yK6TjWe9RPlrIvL63dGQ6HLn95t+JZLV hWPQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=RJtxl1wfiVTaN2nsueXpnMjbK6zFOJZ8kS7S91H0g4Y=; b=RdXZaIKRS/Cogb14V7HYBBj8Zq3vcPPkbpJTXorsUEyAV2dkXS8rYDCr1WkFiblJsH xXKseD6ucR2k3ORn8a/Pd0DL4gra39fAsIssZGZ5voaviERPaLEh0dQBG0oyvyJ+2GwI QTv3gbQOXMR1Mom7j+Hrq1fh4XXfE3D3MthQUXZBCwOPWulkbgCNLwBkNjOgdZ8ci0vU +CJ2UAhp6uUmufAd1eHBNfKxihlMogsRIjC1vVYAwuXuHYO6LsB5nA3bDjjiqomKTFe9 UCcOU3Zc5Y1kZQTdO6th8I0zpLomh1fvMQY/MXHr/Vi4//akN1hkh8eMBj9q5NofCDRm Svdw== X-Gm-Message-State: AOAM5330bZnIv9Y9Prt/nyRCln1nDJQXavPytA4s5GGl1f2ubyLM0HJN fXnO3vmQAJW/CtpDyoJ+K7TomXTI5Rv/XQ== X-Received: by 2002:a17:90a:c58f:: with SMTP id l15mr6001470pjt.168.1637740622519; Tue, 23 Nov 2021 23:57:02 -0800 (PST) Received: from localhost.localdomain ([106.215.91.18]) by smtp.gmail.com with ESMTPSA id q9sm10775420pfj.114.2021.11.23.23.56.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 23 Nov 2021 23:57:02 -0800 (PST) From: Ruchika Gupta To: u-boot@lists.denx.de, ilias.apalodimas@linaro.org, xypron.glpk@gmx.de, agraf@csgraf.de Cc: Ruchika Gupta Subject: [v3] [PATCH 3/3] efi_loader: Extend PCR's for firmware measurements Date: Wed, 24 Nov 2021 13:26:25 +0530 Message-Id: <20211124075625.197449-3-ruchika.gupta@linaro.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211124075625.197449-1-ruchika.gupta@linaro.org> References: <20211124075625.197449-1-ruchika.gupta@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.37 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean Firmwares before U-Boot may be capable of doing tpm measurements and passing them to U-Boot in the form of eventlog. However there may be scenarios where the firmwares don't have TPM driver and are not capable of extending the measurements in the PCRs. Based on TCG spec, if previous firnware has extended PCR's, PCR0 would not be 0. So, read the PCR0 to determine if the PCR's need to be extended as eventlog is parsed or not. Signed-off-by: Ruchika Gupta Reviewed-by: Ilias Apalodimas --- v3 : Rebase changes on top of changes made in first patch of series v2 : Removed check for PCR0 in eventlog lib/efi_loader/efi_tcg2.c | 75 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 75 insertions(+) diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c index ebd7847957..b5343bf039 100644 --- a/lib/efi_loader/efi_tcg2.c +++ b/lib/efi_loader/efi_tcg2.c @@ -199,6 +199,43 @@ static efi_status_t tcg2_pcr_extend(struct udevice *dev, u32 pcr_index, return EFI_SUCCESS; } +/* tcg2_pcr_read - Read PCRs for a TPM2 device for a given tpml_digest_values + * + * @dev: device + * @digest_list: list of digest algorithms to extend + * + * @Return: status code + */ +static efi_status_t tcg2_pcr_read(struct udevice *dev, u32 pcr_index, + struct tpml_digest_values *digest_list) +{ + struct tpm_chip_priv *priv; + unsigned int updates, pcr_select_min; + u32 rc; + size_t i; + + priv = dev_get_uclass_priv(dev); + if (!priv) + return EFI_DEVICE_ERROR; + + pcr_select_min = priv->pcr_select_min; + + for (i = 0; i < digest_list->count; i++) { + u16 hash_alg = digest_list->digests[i].hash_alg; + u8 *digest = (u8 *)&digest_list->digests[i].digest; + + rc = tpm2_pcr_read(dev, pcr_index, pcr_select_min, + hash_alg, digest, alg_to_len(hash_alg), + &updates); + if (rc) { + EFI_PRINT("Failed to read PCR\n"); + return EFI_DEVICE_ERROR; + } + } + + return EFI_SUCCESS; +} + /* put_event - Append an agile event to an eventlog * * @pcr_index: PCR index @@ -1428,6 +1465,8 @@ efi_status_t tcg2_get_fw_eventlog(struct udevice *dev, void *log_buffer, u32 pcr, pos; u64 base; u32 sz; + bool extend_pcr = false; + int i; ret = platform_get_eventlog(dev, &base, &sz); if (ret != EFI_SUCCESS) @@ -1449,6 +1488,26 @@ efi_status_t tcg2_get_fw_eventlog(struct udevice *dev, void *log_buffer, return EFI_COMPROMISED_DATA; } + ret = tcg2_pcr_read(dev, 0, &digest_list); + if (ret) { + log_err("Error reading PCR 0\n"); + return ret; + } + + /* + * If PCR0 is 0, previous firmware didn't have the capability + * to extend the PCR. In this scenario, extend the PCR as + * the eventlog is parsed. + */ + for (i = 0; i < digest_list.count; i++) { + u8 buffer[TPM2_DIGEST_LEN] = { 0 }; + u16 hash_alg = digest_list.digests[i].hash_alg; + + if (!memcmp((u8 *)&digest_list.digests[i].digest, buffer, + alg_to_len(hash_alg))) + extend_pcr = true; + } + while (pos < sz) { ret = tcg2_parse_event(dev, buffer, sz, &pos, &digest_list, &pcr); @@ -1456,6 +1515,22 @@ efi_status_t tcg2_get_fw_eventlog(struct udevice *dev, void *log_buffer, log_err("Error parsing event\n"); return ret; } + if (extend_pcr) { + ret = tcg2_pcr_extend(dev, pcr, &digest_list); + if (ret != EFI_SUCCESS) { + log_err("Error in extending PCR\n"); + return ret; + } + + /* Clear the digest for next event */ + for (i = 0; i < digest_list.count; i++) { + u16 hash_alg = digest_list.digests[i].hash_alg; + u8 *digest = + (u8 *)&digest_list.digests[i].digest; + + memset(digest, 0, alg_to_len(hash_alg)); + } + } } memcpy(log_buffer, buffer, sz);