From patchwork Sat Jun 22 14:35:37 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 806721 Delivered-To: patch@linaro.org Received: by 2002:a5d:508d:0:b0:362:4979:7f74 with SMTP id a13csp1200934wrt; Sat, 22 Jun 2024 07:36:38 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXDmAylit9pZ3BCylWFethUU3tKYyxnzH+8zASDY71y/TA+ZSS7XJIKNPT1q6ZtKko+dGHoAPH0hOBGDspyT7mb X-Google-Smtp-Source: AGHT+IHKLSXBPMNOrGO0+BNyz8um+aMLwO2Mq84ncZjURM/HXH9J+E+1Y/7Ist/DEPBqQn16oEa8 X-Received: by 2002:a17:907:c20e:b0:a6f:68b6:4e7a with SMTP id a640c23a62f3a-a7242c9beb5mr37412766b.19.1719066998700; Sat, 22 Jun 2024 07:36:38 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1719066998; cv=none; d=google.com; s=arc-20160816; b=gq8CTFXzfO6waVAmlw/TboIk/kgYkQ4qOsI2S8LsTHHRjRHW2UiaFqQlOvhFzNZtIA H290RxWE8SU8DK7RkLfmLNcg6WyjQYXAnnM+tA2ITxEepUiKqdD5fEx4VVs6DHS6nXqT 0mTed+3t0u2S+OnLno/nDrTDxSDNiN71LTUL3fpmhd5Bz9KTs676cb5g/axryCmPRTu5 koPhq4uWFn2CjRRy1UGB/4Tcz566myMxHZRj6RYh5+BlWREBosqw1enyDivipW50tm/a i+8BVrXAjselyG5wqBnQPmsvvNNKwkub/ZNZ9h/bdH15RJzFBhcgqGfUS9afc8yiJyai 9hgQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=2N8RNRcSBLmt0ZSK5CiACSpazEEoUvaXOylAXemtb1s=; fh=PnlrZ+izBUKIkDKFazcblh0ZNg6kR4KN0mBn4E8xSBc=; b=HKN9LQ64XEtLv2w4paxxMVXIiy5gZGX20jmnjE9AeJuwWbNZDB3t2ywZVOX+6R+4lH uG9NY8QIDNWK8WUAA3jawzupiNp3dONg6KA/PbUht/UTHd41Dai9dLjAnUV3JZcveLLb q0MIqR8DAjN+cR5dp0sZxbngdRhMPRoi6/Owh3bidRk6y/ojq8+JbpxsCR45Or1vRFz3 Rozrg0HGOyX0LE6u99+6G6tjph818oR+7EJ67RZjyUto0+OoDsAdS+vR2RcelkwcGIRy hpcgL+p7z76kmhMDL2U6jdz24GiEoRBQEExAIh0Tdo5lmOOB1KscNn9mgHayCWClZAfS vnZA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=R+y8tdiE; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id a640c23a62f3a-a6fcf5ad41bsi187350666b.968.2024.06.22.07.36.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 22 Jun 2024 07:36:38 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=R+y8tdiE; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 623D888001; Sat, 22 Jun 2024 16:36:28 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="R+y8tdiE"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 231ED87FB5; Sat, 22 Jun 2024 16:36:27 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-ej1-x636.google.com (mail-ej1-x636.google.com [IPv6:2a00:1450:4864:20::636]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 3B62F87D8E for ; Sat, 22 Jun 2024 16:36:25 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ej1-x636.google.com with SMTP id a640c23a62f3a-a6265d3ba8fso309797466b.0 for ; Sat, 22 Jun 2024 07:36:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1719066985; x=1719671785; darn=lists.denx.de; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=2N8RNRcSBLmt0ZSK5CiACSpazEEoUvaXOylAXemtb1s=; b=R+y8tdiEptRjeRld33GnAlLW8a2VTVvvQw7iLhvVZStDHUulu36ZmPJ9D5+scty5cS 3aClAF8yitrIM9U84QMzQH6mg0cQ56KI3hUWB0aZONSA46BpcacKk2xhfoWL0y6Oym9o ct62mrogkEad5NbB6VQA+rRjMZW07lccpsn4zUyPRtGTi8ogf5bJcQg/G6s6MhL7gH4R +hsfdAnFGSHBHhvqlcguhdmXUTtBKpyPqFw01cIxay8RKdiL5T5IZJw74/VElMEKbrJe uTUTaRY+9sT/lJzV3wm2xXD33BhOQApu3fDsw1mpugu53NQSllbYJurmzX38+c/xy72f aLKA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1719066985; x=1719671785; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=2N8RNRcSBLmt0ZSK5CiACSpazEEoUvaXOylAXemtb1s=; b=mmbFmnSqHiRXKqRonRFIFbaY9+C0PHzbLazt/wiknYBU7I5SyQX0fvPhzRwu26mnbm M51Ii+6NmRTlBr840WcpYgDTXyAOP5nukyRogBTPadLlfqNhmQKgCcXcxdOb3AdbBPqC IOfvcNKBx0NEKJQG7C+mcf4lxrNQhT+Jm/y9ddQhGrPucqmX1RvkkvbAtJYqczP3loYA AntUXYq/HB6cQX34z60HuPoXCD8uxZpVa+hXekCBw9Id8Z15sAQAwVcQcB71P5VybyqS Vq7AftsO3SaMw8R0MAVvADcDZ5wgOrxKrIZtGE1FSseWkSJrMctwbHixifn71CPFitxj L7iw== X-Forwarded-Encrypted: i=1; AJvYcCW+PR6wdAUYXDwAtztxUNL8DjKm1jptn3xplRgJ8dYoWlJF8gCflASbsixS9Su2av+ELRkYS/y77JNNGM9huSMnhDg5og== X-Gm-Message-State: AOJu0Yz97uXIg58uzh5ESC09Q/w0Uwszrd6L/bKrwQNjBv4aPwxJyXI/ hYh8iGYiWsE7MrcphtnCFv0e59ZbI5WSYleOEsndF6rITKbjxNDcz9UjNSv4IUU= X-Received: by 2002:a17:907:c307:b0:a6f:2981:56c with SMTP id a640c23a62f3a-a7242da6a35mr29659866b.53.1719066984464; Sat, 22 Jun 2024 07:36:24 -0700 (PDT) Received: from localhost.localdomain (ppp046103020130.access.hol.gr. [46.103.20.130]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a6fcf54a534sm204005366b.136.2024.06.22.07.36.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 22 Jun 2024 07:36:23 -0700 (PDT) From: Ilias Apalodimas To: sjg@chromium.org, trini@konsulko.com Cc: Ilias Apalodimas , Heinrich Schuchardt , Eddie James , Mattijs Korpershoek , Tim Harvey , Bin Meng , Sean Anderson , Manorit Chawdhry , Oleksandr Suvorov , Michal Simek , AKASHI Takahiro , Masahisa Kojima , u-boot@lists.denx.de Subject: [PATCH 1/7] tpm: fix the return code, if the eventlog buffer is full Date: Sat, 22 Jun 2024 17:35:37 +0300 Message-ID: <20240622143601.187723-2-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240622143601.187723-1-ilias.apalodimas@linaro.org> References: <20240622143601.187723-1-ilias.apalodimas@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean We currently return 'No space left on device' if the eventlong buffer we allocated is not enough. On a similar check later on that function during the call to tcg2_log_init() we return 'No buffer space available'. So switch both error codes to -ENOBUFS since we are always checking a buffer and not a device. Fixes: commit 97707f12fdab ("tpm: Support boot measurements") Signed-off-by: Ilias Apalodimas Reviewed-by: Heinrich Schuchardt --- lib/tpm-v2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c index a67daed2f3c1..91526af33acb 100644 --- a/lib/tpm-v2.c +++ b/lib/tpm-v2.c @@ -554,7 +554,7 @@ int tcg2_log_prepare_buffer(struct udevice *dev, struct tcg2_event_log *elog, if (elog->log_size) { if (log.found) { if (elog->log_size < log.log_position) - return -ENOSPC; + return -ENOBUFS; /* * Copy the discovered log into the user buffer From patchwork Sat Jun 22 14:35:38 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 806722 Delivered-To: patch@linaro.org Received: by 2002:a5d:508d:0:b0:362:4979:7f74 with SMTP id a13csp1200989wrt; Sat, 22 Jun 2024 07:36:49 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUb9eL2GjEne2b2QibaORe1yiQfBCFacbM99l9QLNRyikkOgqhsS7Z7D49Oo/P3YgMfP3NQNXtUfltHyq3hGJLP X-Google-Smtp-Source: AGHT+IENbtCE6XX45Vrfx0HYOJedKl8WYC4xF8IaY47zyeGLL0I4n0s3F1ti5Je9aIAXSexyqFzA X-Received: by 2002:a2e:95ca:0:b0:2ec:5200:a941 with SMTP id 38308e7fff4ca-2ec5b2dd968mr357831fa.38.1719067008896; Sat, 22 Jun 2024 07:36:48 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1719067008; cv=none; d=google.com; s=arc-20160816; b=slarZPBHZ/3k1IaM/Y7OagjhpzNdGWsNe2Lg9UeblZtCz8lOOvtLsvKAVMkAWQHz3d tzJIhcRihQpSPRQBgw3o2LHKYqBxyj/njIAL6IrJLQcr8bEzXMKKswb5+lDAOtN4580y hue+ZSW6UnY3ozUAkIn5K/LUxhsVSCLAayNFiBDF4gIG66zYVmbaW+/M7nACBa6gae3p UmyEBuZ3ka3GxOjkJdgjaJybDDYs0bmxzVV689wyW5hQ9U6xfTXzb/EnzadkT4stH4dm CU1OrD/0hrVpQ5pC38tmLgvPYDvRP78zzvkT3P/SZo6vREhXthxw4zU3QGgVqXzmTH0y 8tzw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=lnS68u1K++WfbupuReMwuGVKeNklfYWdqEVREH0lccU=; fh=haccVAZgXy42lfWuM6Vkp+ai5jSM0RXp965Z2Bnfq+c=; b=pP+jZwmDaf/qmjE0BO5S1wMM4nHguUX2oyR8kzpkazxLApDvIBHL0idn7J1/db2Y/9 pQMYJtbnxe3IckOGz/zTnwBEyxXcU4rE42ucvh53KtsUk/IJlafXQ2yatJhmbKuCHZCy 77g0ooaKUlt/83MOclzbSb8Htn7IHJQHt+J8DIFxksec1f4HNlcaaGEPECIdVZLxGZYj TKvGkuOEiUIgNOQEXwGcjxvkL0aJ3ru/oe9IgXRpaWjsoUJqK8SNUZqDExfNXpfg60y0 B4Qgow+srzuiUnwFrPOJEOrkbHbGdvrjoxC+IL8eYuyOFPeot7ghSJcQbVA6zcAex9Sq cvuQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=W9ybcjR6; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id 4fb4d7f45d1cf-57d3063353fsi1858658a12.4.2024.06.22.07.36.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 22 Jun 2024 07:36:48 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=W9ybcjR6; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id C034787F9F; Sat, 22 Jun 2024 16:36:33 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="W9ybcjR6"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 27664878E2; Sat, 22 Jun 2024 16:36:32 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-ej1-x62e.google.com (mail-ej1-x62e.google.com [IPv6:2a00:1450:4864:20::62e]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id C09BD880DB for ; Sat, 22 Jun 2024 16:36:29 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ej1-x62e.google.com with SMTP id a640c23a62f3a-a6fd513f18bso144089166b.3 for ; Sat, 22 Jun 2024 07:36:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1719066989; x=1719671789; darn=lists.denx.de; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=lnS68u1K++WfbupuReMwuGVKeNklfYWdqEVREH0lccU=; b=W9ybcjR6F4awZKNUHv+k++/JqXE8zitmEc6/yiYarh+pDvlS4uma48wQeFZ1k3bRHi Hf7C1FtJSVZRGVDAt5eaJSiCYEcOjmJwO6ihK73B5Y3SaU3B+rF5LoLFHRaLJVAVqR7j SwzBsZr23MnNM68HqFVbsXj1cdbwIJhPpI/xCu9urizyM9hTsUOYZK0ONyAumJu16ATc xcYNw88W18hHdr6TYzQSNcDI88Sbu2IMAtMvvQVTcPptDmdkcjAFVIHuofSA1SjnZJLS sX6XqTM42pbUGBhNsMJNwfgNoBitvrQaKTmLkzmI3PMHw0gweAETD8qNSiObB028TxYC U31Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1719066989; x=1719671789; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=lnS68u1K++WfbupuReMwuGVKeNklfYWdqEVREH0lccU=; b=QEHMU4usjwJ5cu8JtcpY1k+gdt6WYlK39W61Phpg6HARlr7drnOtB21C4UNcfwbeca 2SKtRGstm8FXyhJJow5EQol4Jsf7KKILA5up1i/awtV/OGtAln3gqAIhpVLPWHOon4M7 CkKIxZhG47CYJctDCQ8fN1NVET9VmY9/KR1z3rRC9mx1yIzZsvaiL00V1Y1pS2Zvm+FX C1+YG9VYiLXd3gMrdQrmlH0jw5tj/Bp7a0SHwOguB4O8Y9ASC9btdzxSHns0wAptW4+Y Rr+rQUpF3SVOUPkpgoAWFMQPajUfm4xLnTCrKJvVifJT5zRKPOeZF9IHgJyJurhWWZSK 4Jzg== X-Forwarded-Encrypted: i=1; AJvYcCV8lXf2fEdigX8c21UaZz+vmg7bxEavpfXzPoNmsDawHHrJMZgfiKxvFXrIqJ7j/DS1gUmObaZR3skdMUrfmIkfwqyAtg== X-Gm-Message-State: AOJu0YxnV9FxCt+iCaLun0mAXIUWSDK4jW+sJqhmaSsZDWrPyy1UNtKX bFl6ga2p60tjGy3WgBgrt6puAvkJBIbLpmoz5ZF4d1CCpPcP2Y0UfMIJ4ztdLPo= X-Received: by 2002:a17:907:d312:b0:a6f:6b6a:e8d3 with SMTP id a640c23a62f3a-a7245b459fdmr1879066b.13.1719066988554; Sat, 22 Jun 2024 07:36:28 -0700 (PDT) Received: from localhost.localdomain (ppp046103020130.access.hol.gr. [46.103.20.130]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a6fcf54a534sm204005366b.136.2024.06.22.07.36.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 22 Jun 2024 07:36:27 -0700 (PDT) From: Ilias Apalodimas To: sjg@chromium.org, trini@konsulko.com Cc: Ilias Apalodimas , Heinrich Schuchardt , Eddie James , Mattijs Korpershoek , Tim Harvey , Bin Meng , Sean Anderson , AKASHI Takahiro , Oleksandr Suvorov , Michal Simek , Masahisa Kojima , u-boot@lists.denx.de Subject: [PATCH 2/7] efi_loader: fix the return values on efi_tcg Date: Sat, 22 Jun 2024 17:35:38 +0300 Message-ID: <20240622143601.187723-3-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240622143601.187723-1-ilias.apalodimas@linaro.org> References: <20240622143601.187723-1-ilias.apalodimas@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean A while back we moved the core functions of the EFI TCG protocol to the TPM APIs in order for them to be used with bootm, booti etc. Some prototypes changed from returning efi_status_t to int, which is more appropriate for the non-EFI APIs. However, some of the EFI callsites never changed and we ended up assigning the int value to efi_status_t. This is unlikely to cause any problems, apart from returning invalid values on failures and violating the EFI spec. Let's fix them by looking at the new return code and map it to the proper EFI return code on failures. Fixes: commit 97707f12fdab ("tpm: Support boot measurements") Fixes: commit d6b55a420cfc ("efi_loader: startup the tpm device when installing the protocol") Signed-off-by: Ilias Apalodimas Reviewed-by: Heinrich Schuchardt --- lib/efi_loader/efi_tcg2.c | 121 ++++++++++++++++++++------------------ 1 file changed, 64 insertions(+), 57 deletions(-) diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c index d56bd5657c8a..10c09caac35a 100644 --- a/lib/efi_loader/efi_tcg2.c +++ b/lib/efi_loader/efi_tcg2.c @@ -257,8 +257,8 @@ efi_tcg2_get_capability(struct efi_tcg2_protocol *this, capability->protocol_version.major = 1; capability->protocol_version.minor = 1; - efi_ret = tcg2_platform_get_tpm2(&dev); - if (efi_ret != EFI_SUCCESS) { + ret = tcg2_platform_get_tpm2(&dev); + if (ret) { capability->supported_event_logs = 0; capability->hash_algorithm_bitmap = 0; capability->tpm_present_flag = false; @@ -353,8 +353,7 @@ efi_tcg2_get_eventlog(struct efi_tcg2_protocol *this, goto out; } - ret = tcg2_platform_get_tpm2(&dev); - if (ret != EFI_SUCCESS) { + if (tcg2_platform_get_tpm2(&dev)) { event_log_location = NULL; event_log_last_entry = NULL; *event_log_truncated = false; @@ -389,7 +388,7 @@ static efi_status_t tcg2_hash_pe_image(void *efi, u64 efi_size, void *new_efi = NULL; u8 hash[TPM2_SHA512_DIGEST_SIZE]; struct udevice *dev; - efi_status_t ret; + efi_status_t ret = EFI_SUCCESS; u32 active; int i; @@ -404,12 +403,13 @@ static efi_status_t tcg2_hash_pe_image(void *efi, u64 efi_size, goto out; } - ret = tcg2_platform_get_tpm2(&dev); - if (ret != EFI_SUCCESS) + if (tcg2_platform_get_tpm2(&dev)) { + ret = EFI_DEVICE_ERROR; goto out; + } - ret = tcg2_get_active_pcr_banks(dev, &active); - if (ret != EFI_SUCCESS) { + if (tcg2_get_active_pcr_banks(dev, &active)) { + ret = EFI_DEVICE_ERROR; goto out; } @@ -473,12 +473,12 @@ efi_status_t tcg2_measure_pe_image(void *efi, u64 efi_size, IMAGE_DOS_HEADER *dos; IMAGE_NT_HEADERS32 *nt; struct efi_handler *handler; + int rc; if (!is_tcg2_protocol_installed()) return EFI_SUCCESS; - ret = tcg2_platform_get_tpm2(&dev); - if (ret != EFI_SUCCESS) + if (tcg2_platform_get_tpm2(&dev)) return EFI_SECURITY_VIOLATION; switch (handle->image_type) { @@ -502,9 +502,9 @@ efi_status_t tcg2_measure_pe_image(void *efi, u64 efi_size, if (ret != EFI_SUCCESS) return ret; - ret = tcg2_pcr_extend(dev, pcr_index, &digest_list); - if (ret != EFI_SUCCESS) - return ret; + rc = tcg2_pcr_extend(dev, pcr_index, &digest_list); + if (rc) + return EFI_DEVICE_ERROR; ret = efi_search_protocol(&handle->header, &efi_guid_loaded_image_device_path, &handler); @@ -574,9 +574,10 @@ efi_tcg2_hash_log_extend_event(struct efi_tcg2_protocol *this, u64 flags, struct efi_tcg2_event *efi_tcg_event) { struct udevice *dev; - efi_status_t ret; + efi_status_t ret = EFI_SUCCESS; u32 event_type, pcr_index, event_size; struct tpml_digest_values digest_list; + int rc = 0; EFI_ENTRY("%p, %llu, %llu, %llu, %p", this, flags, data_to_hash, data_to_hash_len, efi_tcg_event); @@ -586,9 +587,10 @@ efi_tcg2_hash_log_extend_event(struct efi_tcg2_protocol *this, u64 flags, goto out; } - ret = tcg2_platform_get_tpm2(&dev); - if (ret != EFI_SUCCESS) + if (tcg2_platform_get_tpm2(&dev)) { + ret = EFI_DEVICE_ERROR; goto out; + } if (efi_tcg_event->size < efi_tcg_event->header.header_size + sizeof(u32)) { @@ -621,8 +623,10 @@ efi_tcg2_hash_log_extend_event(struct efi_tcg2_protocol *this, u64 flags, ret = tcg2_hash_pe_image((void *)(uintptr_t)data_to_hash, data_to_hash_len, &digest_list); } else { - ret = tcg2_create_digest(dev, (u8 *)(uintptr_t)data_to_hash, - data_to_hash_len, &digest_list); + rc = tcg2_create_digest(dev, (u8 *)(uintptr_t)data_to_hash, + data_to_hash_len, &digest_list); + if (rc) + ret = EFI_DEVICE_ERROR; } if (ret != EFI_SUCCESS) @@ -631,9 +635,11 @@ efi_tcg2_hash_log_extend_event(struct efi_tcg2_protocol *this, u64 flags, pcr_index = efi_tcg_event->header.pcr_index; event_type = efi_tcg_event->header.event_type; - ret = tcg2_pcr_extend(dev, pcr_index, &digest_list); - if (ret != EFI_SUCCESS) + rc = tcg2_pcr_extend(dev, pcr_index, &digest_list); + if (rc) { + ret = EFI_DEVICE_ERROR; goto out; + } if (flags & EFI_TCG2_EXTEND_ONLY) { if (event_log.truncated) @@ -672,7 +678,7 @@ efi_tcg2_submit_command(struct efi_tcg2_protocol *this, u8 *output_param_block) { struct udevice *dev; - efi_status_t ret; + efi_status_t ret = EFI_SUCCESS; u32 rc; size_t resp_buf_size = output_param_block_size; @@ -684,9 +690,10 @@ efi_tcg2_submit_command(struct efi_tcg2_protocol *this, goto out; } - ret = tcg2_platform_get_tpm2(&dev); - if (ret != EFI_SUCCESS) + if (tcg2_platform_get_tpm2(&dev)) { + ret = EFI_DEVICE_ERROR; goto out; + } rc = tpm2_submit_command(dev, input_param_block, output_param_block, &resp_buf_size); @@ -714,19 +721,20 @@ efi_tcg2_get_active_pcr_banks(struct efi_tcg2_protocol *this, u32 *active_pcr_banks) { struct udevice *dev; - efi_status_t ret; + efi_status_t ret = EFI_INVALID_PARAMETER; EFI_ENTRY("%p, %p", this, active_pcr_banks); - if (!this || !active_pcr_banks) { - ret = EFI_INVALID_PARAMETER; + if (!this || !active_pcr_banks) goto out; - } - ret = tcg2_platform_get_tpm2(&dev); - if (ret != EFI_SUCCESS) + + if (tcg2_platform_get_tpm2(&dev)) + goto out; + + if (tcg2_get_active_pcr_banks(dev, active_pcr_banks)) goto out; - ret = tcg2_get_active_pcr_banks(dev, active_pcr_banks); + ret = EFI_SUCCESS; out: return EFI_EXIT(ret); @@ -852,14 +860,15 @@ static efi_status_t measure_event(struct udevice *dev, u32 pcr_index, u32 event_type, u32 size, u8 event[]) { struct tpml_digest_values digest_list; - efi_status_t ret; + efi_status_t ret = EFI_DEVICE_ERROR; + int rc; - ret = tcg2_create_digest(dev, event, size, &digest_list); - if (ret != EFI_SUCCESS) + rc = tcg2_create_digest(dev, event, size, &digest_list); + if (rc) goto out; - ret = tcg2_pcr_extend(dev, pcr_index, &digest_list); - if (ret != EFI_SUCCESS) + rc = tcg2_pcr_extend(dev, pcr_index, &digest_list); + if (rc) goto out; ret = tcg2_agile_log_append(pcr_index, event_type, &digest_list, @@ -901,10 +910,10 @@ static efi_status_t efi_init_event_log(void) struct tcg2_event_log elog; struct udevice *dev; efi_status_t ret; + int rc; - ret = tcg2_platform_get_tpm2(&dev); - if (ret != EFI_SUCCESS) - return ret; + if (tcg2_platform_get_tpm2(&dev)) + return EFI_DEVICE_ERROR; ret = efi_allocate_pool(EFI_BOOT_SERVICES_DATA, TPM2_EVENT_LOG_SIZE, (void **)&event_log.buffer); @@ -933,9 +942,11 @@ static efi_status_t efi_init_event_log(void) */ elog.log = event_log.buffer; elog.log_size = TPM2_EVENT_LOG_SIZE; - ret = tcg2_log_prepare_buffer(dev, &elog, false); - if (ret != EFI_SUCCESS) + rc = tcg2_log_prepare_buffer(dev, &elog, false); + if (rc) { + ret = (rc == -ENOBUFS) ? EFI_BUFFER_TOO_SMALL : EFI_DEVICE_ERROR; goto free_pool; + } event_log.pos = elog.log_position; @@ -1306,8 +1317,7 @@ efi_status_t efi_tcg2_measure_dtb(void *dtb) if (!is_tcg2_protocol_installed()) return EFI_SUCCESS; - ret = tcg2_platform_get_tpm2(&dev); - if (ret != EFI_SUCCESS) + if (tcg2_platform_get_tpm2(&dev)) return EFI_SECURITY_VIOLATION; rsvmap_size = size_of_rsvmap(dtb); @@ -1356,8 +1366,7 @@ efi_status_t efi_tcg2_measure_efi_app_invocation(struct efi_loaded_image_obj *ha if (tcg2_efi_app_invoked) return EFI_SUCCESS; - ret = tcg2_platform_get_tpm2(&dev); - if (ret != EFI_SUCCESS) + if (tcg2_platform_get_tpm2(&dev)) return EFI_SECURITY_VIOLATION; ret = tcg2_measure_boot_variable(dev); @@ -1406,9 +1415,8 @@ efi_status_t efi_tcg2_measure_efi_app_exit(void) if (!is_tcg2_protocol_installed()) return EFI_SUCCESS; - ret = tcg2_platform_get_tpm2(&dev); - if (ret != EFI_SUCCESS) - return ret; + if (tcg2_platform_get_tpm2(&dev)) + return EFI_SECURITY_VIOLATION; ret = measure_event(dev, 4, EV_EFI_ACTION, strlen(EFI_RETURNING_FROM_EFI_APPLICATION), @@ -1437,9 +1445,10 @@ efi_tcg2_notify_exit_boot_services(struct efi_event *event, void *context) goto out; } - ret = tcg2_platform_get_tpm2(&dev); - if (ret != EFI_SUCCESS) + if (tcg2_platform_get_tpm2(&dev)) { + ret = EFI_SECURITY_VIOLATION; goto out; + } ret = measure_event(dev, 5, EV_EFI_ACTION, strlen(EFI_EXIT_BOOT_SERVICES_INVOCATION), @@ -1469,9 +1478,8 @@ efi_status_t efi_tcg2_notify_exit_boot_services_failed(void) if (!is_tcg2_protocol_installed()) return EFI_SUCCESS; - ret = tcg2_platform_get_tpm2(&dev); - if (ret != EFI_SUCCESS) - goto out; + if (tcg2_platform_get_tpm2(&dev)) + return EFI_SECURITY_VIOLATION; ret = measure_event(dev, 5, EV_EFI_ACTION, strlen(EFI_EXIT_BOOT_SERVICES_INVOCATION), @@ -1551,8 +1559,7 @@ efi_status_t efi_tcg2_do_initial_measurement(void) if (!is_tcg2_protocol_installed()) return EFI_SUCCESS; - ret = tcg2_platform_get_tpm2(&dev); - if (ret != EFI_SUCCESS) + if (tcg2_platform_get_tpm2(&dev)) return EFI_SECURITY_VIOLATION; ret = tcg2_measure_secure_boot_variable(dev); @@ -1577,8 +1584,7 @@ efi_status_t efi_tcg2_register(void) struct efi_event *event; u32 err; - ret = tcg2_platform_get_tpm2(&dev); - if (ret != EFI_SUCCESS) { + if (tcg2_platform_get_tpm2(&dev)) { log_warning("Missing TPMv2 device for EFI_TCG_PROTOCOL\n"); return EFI_SUCCESS; } @@ -1586,6 +1592,7 @@ efi_status_t efi_tcg2_register(void) /* initialize the TPM as early as possible. */ err = tpm_auto_start(dev); if (err) { + ret = EFI_DEVICE_ERROR; log_err("TPM startup failed\n"); goto fail; } From patchwork Sat Jun 22 14:35:39 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 806723 Delivered-To: patch@linaro.org Received: by 2002:a5d:508d:0:b0:362:4979:7f74 with SMTP id a13csp1201033wrt; Sat, 22 Jun 2024 07:36:59 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCVzgIu8byAzWG61+CknZWwCXfqbnmvMtT/WlVieusFM7lmP549UirH3GYTKgRdYCxZ5R3r7uAOVmaQ0YjUo6CwG X-Google-Smtp-Source: AGHT+IFjT1k4Diwm01hSXRDB6j33DVSax9g+wHr4MihKqVaAAik+v6Pu9lgNJ90vTtnbt8x8XkKQ X-Received: by 2002:a17:906:3383:b0:a72:438b:2dfe with SMTP id a640c23a62f3a-a7245cf26e7mr140066b.40.1719067019573; Sat, 22 Jun 2024 07:36:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1719067019; cv=none; d=google.com; s=arc-20160816; b=PJtjymGtRrNt4IZZ3oAvNEkjSMlrgctDhVjXGmQOOBC/EyTHJTbl/W3tJwBaEsQeeR K8S8oc2mQ3GwHUU2JpBVKD1rYNDG06H9tbF4EKRT+OXzMFRuJnbZ/lGKC/KxEKBwYIxk ND+Q+WgimxH0La64vnm5+vU+vtgrPY7pWmw+YQ3AQhMTKZHgTbM3PIYbVOheOLLRh25J hblKNuE6XDa0iSqehtKO74UIaTcSGCs/FuBUtTyDMHIGFLpqyQVIZSxe+VQYYsrscw9E nPM4cCRg2BrIm5nKeXW1BVOECYvm8GlCXCA/unnTkDxg/3MN5sj5vmVQq11ttrDVcC0r c0MQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=nZcGBMtH3K0r02Kucnml6DOJS3j4NbOQoJDdifTThoY=; fh=nzsbZJ0SEn01go518cGBqSgrU7mh3+JGrTG0OD1KtOw=; b=I9VqbykYHZYBoZS1c15GMYqDIFqpd8oRiS0NEHoX4ia5lM2OSI4WpuA+8JfzRI7NyL PrT6a5DeJFk0sO4AdJg9Bzf9lM9MVwdLTEZIqSMLGssM4LgdBgk/7YR93nFDKnO6vBnS B3YwGZ9Cvdkma1bm6eRZfuRV0MdpUasCWvkA9677iQORibOkVv9xMLpKHfV3PIuOmQr6 Bvno1cuOggHwLzpgvmc4xzAOwkzvS2seaFDa1uGTZEiQO0FKhVsVgwErIU8M1XIJFssO 0n1Se4FR24of9wRKqy+/rDtdCXimwSkXJSHHxMfUJ4QrqQxHBYeaHYWGxrJ8dRQ3hRny aKTg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b="bR//7+e8"; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [2a01:238:438b:c500:173d:9f52:ddab:ee01]) by mx.google.com with ESMTPS id a640c23a62f3a-a6fcf57960asi185093766b.781.2024.06.22.07.36.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 22 Jun 2024 07:36:59 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b="bR//7+e8"; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 28B5987D8E; Sat, 22 Jun 2024 16:36:37 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="bR//7+e8"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 9D8F48818B; Sat, 22 Jun 2024 16:36:35 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-ej1-x636.google.com (mail-ej1-x636.google.com [IPv6:2a00:1450:4864:20::636]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id B4B45878E2 for ; Sat, 22 Jun 2024 16:36:33 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ej1-x636.google.com with SMTP id a640c23a62f3a-a689ad8d1f6so364120566b.2 for ; Sat, 22 Jun 2024 07:36:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1719066993; x=1719671793; darn=lists.denx.de; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=nZcGBMtH3K0r02Kucnml6DOJS3j4NbOQoJDdifTThoY=; b=bR//7+e82NY0DtO1R+WE/4c5i4piwo0dPwl5SSXGCZKwWkl0fEq4QkOvfjd8DR/bco /7DaioYkY8ysJLObRKjeho3Os9ViScNfBsfiprvm323UFUqNj52juTLCOIKJT7v4i0EY E2fpkls5pTgoHWV0fUUP8lz3bPG0A/YYcpmoEz8UExW28vUkDgBJUDS+2v8ys1FeAIuj +pdDZOmzYvcrL+6HMwIb3La1I0DkapXUgD3pBKWNspaddqEkoEa0YCp6LtGQh4KDBvkx 2jzdzJim0SOzxmluFU7E1JRzAY6ISjZmN2RJae4p7EawoPMB94vQCIPBFg4vYu7Wecch OShQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1719066993; x=1719671793; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=nZcGBMtH3K0r02Kucnml6DOJS3j4NbOQoJDdifTThoY=; b=fQuD8wzLrMoovjFpmHocu2VkddEP1sBD3c1pELfssuvyUAZ8tVqtk380L11P+aWQAx wg+NKekNl2ATMGv1k/BF4QJyg6GzgSF8+hI6vifFZ6aqid7ZVHRQ6fmqk2hTXqepTzcU MVMMK5ANnEMuiwRuuezF0WfdNUOAiv7P5L3qQcOEqIHIUT/Ke1Xv2rwxWF0hFbZ5fU8A iZ7UlUPlBuidr7dkAi39QZn6k6xW41bDXhnaQ4SMjD2Lzvh7cSqsiMcSq/OAYDkvVUN8 3vP8h5jvReNzqD3NB0AAwRSD8xU2rK9nIRgSkIT8HG12iErfmHVf4B7aUXhXOWQHog2z yr4w== X-Forwarded-Encrypted: i=1; AJvYcCWe8qebXpEDShrx3ECVlbu4CWSeH5n2tQdalZaAMNnUBecf00sPr0gj13y2wafW0Eg4k4TblKJ3141VfZCr49wrPOrJ5A== X-Gm-Message-State: AOJu0YxTm+C1knvpoUs+rH+Eyl6eJEIg3dd1PUT/t2QhOpL0B9rlhQr/ FsMzSgcc0ilGPMhhisl9qW5rmoI39XX1atb6p6WVxYSnH/R2EUJeprNnfyrMvNw= X-Received: by 2002:a17:907:8e93:b0:a6e:f62d:bd02 with SMTP id a640c23a62f3a-a7245c84f2emr590866b.7.1719066992851; Sat, 22 Jun 2024 07:36:32 -0700 (PDT) Received: from localhost.localdomain (ppp046103020130.access.hol.gr. [46.103.20.130]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a6fcf54a534sm204005366b.136.2024.06.22.07.36.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 22 Jun 2024 07:36:32 -0700 (PDT) From: Ilias Apalodimas To: sjg@chromium.org, trini@konsulko.com Cc: Ilias Apalodimas , Heinrich Schuchardt , Eddie James , Mattijs Korpershoek , Tim Harvey , Bin Meng , Sean Anderson , Michal Simek , AKASHI Takahiro , Oleksandr Suvorov , Masahisa Kojima , u-boot@lists.denx.de Subject: [PATCH 3/7] efi_loader: remove duplicate TCG algo definitions Date: Sat, 22 Jun 2024 17:35:39 +0300 Message-ID: <20240622143601.187723-4-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240622143601.187723-1-ilias.apalodimas@linaro.org> References: <20240622143601.187723-1-ilias.apalodimas@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean commit 97707f12fdab ("tpm: Support boot measurements") moved some of the EFI TCG code to the TPM subsystem. Those definitions are now in tpm-v2.h. Let's remove the duplicate entries Signed-off-by: Ilias Apalodimas Reviewed-by: Heinrich Schuchardt --- include/efi_tcg2.h | 8 -------- 1 file changed, 8 deletions(-) diff --git a/include/efi_tcg2.h b/include/efi_tcg2.h index a75b5a35b6e7..54490969b2d1 100644 --- a/include/efi_tcg2.h +++ b/include/efi_tcg2.h @@ -25,14 +25,6 @@ #define PE_COFF_IMAGE 0x0000000000000010 #define EFI_TCG2_MAX_PCR_INDEX 23 - -/* Algorithm Registry */ -#define EFI_TCG2_BOOT_HASH_ALG_SHA1 0x00000001 -#define EFI_TCG2_BOOT_HASH_ALG_SHA256 0x00000002 -#define EFI_TCG2_BOOT_HASH_ALG_SHA384 0x00000004 -#define EFI_TCG2_BOOT_HASH_ALG_SHA512 0x00000008 -#define EFI_TCG2_BOOT_HASH_ALG_SM3_256 0x00000010 - #define EFI_TCG2_FINAL_EVENTS_TABLE_VERSION 1 #define TPM2_EVENT_LOG_SIZE CONFIG_EFI_TCG2_PROTOCOL_EVENTLOG_SIZE From patchwork Sat Jun 22 14:35:40 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 806724 Delivered-To: patch@linaro.org Received: by 2002:a5d:508d:0:b0:362:4979:7f74 with SMTP id a13csp1201080wrt; Sat, 22 Jun 2024 07:37:11 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWc4X5IcNZ61VJdzPQPMcPdA5ErVSj3rLipvqNzcWuZWMDFpt7NhgMAI7YWH6X1kA6F0bfmN7VbUl7pT7rh2D/Z X-Google-Smtp-Source: AGHT+IG4VLbPYQV69jIcgEuy+NQUm94uHVnD1IgpVQdfz+CNebpu0ympe8uT6HQqve/yvvu01blq X-Received: by 2002:a17:906:f1d9:b0:a6f:4e0e:8689 with SMTP id a640c23a62f3a-a7245b4cc8emr1662066b.13.1719067030755; Sat, 22 Jun 2024 07:37:10 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1719067030; cv=none; d=google.com; s=arc-20160816; b=ucbCnIRKItTQd73tK7WxsV8mi8KfepGx7ku+T66hZP1dvFUQGVtJf64pH3fhC4FOh6 eg3ARSFjqEJEotidwsOJ7Rv9hZQMXvYr3CPeeYee8Y9o+W4/SOe4C5c3eA9AxsD0OXZh Kygn8BdcHT6QbO9th4NZlqqTOiJKrrKTlJPEF7oAKpbIlmt4LbuRs95w5d6FFXsuVBcv 9f/F/RTXZ34kyGYvBmTwd0jNKQ9GKZmdZRs2X9CT+uD36OWGH7iyguufakpZzFWlSmv6 3co+Sc4maA7VfjcrfGQ4xqJOnwEHCT1iWyi5VCdQ1/G81fqLZvgX8o5bj+3w4Am51c/Z 757g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=FR3a/NMw1wh1A3Cs8iArBRN/ZHlc+odU4RFLesiHUeE=; fh=BIMieeI+3kdg5kt6uOiueFLYiYFGppzgH+IX3mnGpxw=; b=hDW8sYPT1kUpAlcsWk1Y7j7UUapKM6CLAcF+88AnnKzYXXwaA1v8qz5jdBbiwVHwmI Evm4S8lXCx5H6OZhrXw2nTRClRChCoCg/FXCWDLVxv7Sgfq4CsbuUq/+zOPVoMP36U8s 4tSgmszki+ahdFulHu2nSGR9MaemAJrtKTTygUJf9iktLV4oXgysQCZ+UTMFYjzL/28C KiSM1bQNnWoxx1XMn/l/TwoJa71YDnYZwrvBTF5lhhcQ4+7Qav+tlFBflnd7Am4jZFVJ K1PNnELJ66yvn4FWd3RsedJBWJqLpJ4i2hTCNaFOot/xMj+6rHYkMw9CClSXDvzKekRq bFfw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=ZWqdqoS6; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id a640c23a62f3a-a6fcf4615f3si192499166b.161.2024.06.22.07.37.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 22 Jun 2024 07:37:10 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=ZWqdqoS6; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 8994388224; Sat, 22 Jun 2024 16:36:42 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="ZWqdqoS6"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id D2B24881A9; Sat, 22 Jun 2024 16:36:41 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-ej1-x62b.google.com (mail-ej1-x62b.google.com [IPv6:2a00:1450:4864:20::62b]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 3C2FB8818B for ; Sat, 22 Jun 2024 16:36:38 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ej1-x62b.google.com with SMTP id a640c23a62f3a-a6fd4d1c173so184105966b.2 for ; Sat, 22 Jun 2024 07:36:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1719066998; x=1719671798; darn=lists.denx.de; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=FR3a/NMw1wh1A3Cs8iArBRN/ZHlc+odU4RFLesiHUeE=; b=ZWqdqoS63EytI1xDRiopXR3m+bvgf+m3KHfMzwsFfFlpfZ4Mhfzo0F5bmJGHjgktF9 0/Ay2b6387ri8UleyQvTTVbMZPy1Dm8rC8tckpYLsfZREuos5vEAW3AuU/rdrDnLem7m MHFptDd0oYqxGsPRGtsf3KkvwEhr5grtCk1LJqQwPw17+SlrQ/cvzWnH/qU+9hKp9P00 BBATMFBezuIBX28nm9gEDmBEUGx/JlWnrIUJBK1MBK/qWhpR+5oB00+i6eq1VYrVBQop Kd+Eu485oZvnGTqjLyXbT1JaU4XMDcHYgVPcbXlxDwOxXrUqA7WT2n3CTOoWUwbHWTIC pTiw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1719066998; x=1719671798; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=FR3a/NMw1wh1A3Cs8iArBRN/ZHlc+odU4RFLesiHUeE=; b=imJLPCTD1IVH4rNWUED+pkvsfJAfNVkPZogRzH10l5a9NViuUZ6oUmLySbfno9qBqb h/1LUbhDlBIh7dMEXgXWaO4UUruvAOTIiC1veU7WRKl9mmBvBGsNjElIzxsx+dJNw+Zx jT2gAMXO9AAU9Ssc6gF7YisphVRyZMP2tvID18BHtVDFhMvOrovJFuJBHu9nlSYfci8F 9iwxWW0rRr7H4xvP/SAQiSkQbIScbeF5W4LrxuQp/7CYzDknfsuqr1JFcEQaGuYm3V2f TSWJnWqcobY4XiI8sQaTzSFtLYt4P24lPYpSzSSd/jG2Q5sVL9Fyeo+HZURxXwqepXZE MxYg== X-Forwarded-Encrypted: i=1; AJvYcCWRjx4vstjKbh/XvJwW9ZvMcRZ/tYnIXd6860mb+TMGuiF6YOtn7185YR5TLVVtu42pQ7d3ZnYapGcj6sdSpIshJzDYVg== X-Gm-Message-State: AOJu0YwoytprxY+AJui/hsiFGMujRS4KdLlwRE9hNnpaeP1Q/71WPmj5 4W7o7eLRlsyh2AqSgmDTUOqZWyJIls/SG49Ui939gm1Bekl+v18iR0ENOpfxe/s= X-Received: by 2002:a17:906:e215:b0:a6f:e77d:e273 with SMTP id a640c23a62f3a-a7245c4838amr666566b.51.1719066997314; Sat, 22 Jun 2024 07:36:37 -0700 (PDT) Received: from localhost.localdomain (ppp046103020130.access.hol.gr. [46.103.20.130]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a6fcf54a534sm204005366b.136.2024.06.22.07.36.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 22 Jun 2024 07:36:36 -0700 (PDT) From: Ilias Apalodimas To: sjg@chromium.org, trini@konsulko.com Cc: Ilias Apalodimas , Heinrich Schuchardt , Eddie James , Mattijs Korpershoek , Tim Harvey , Bin Meng , Sean Anderson , Manorit Chawdhry , =?utf-8?q?Vincent_Stehl=C3=A9?= , Oleksandr Suvorov , Michal Simek , AKASHI Takahiro , Masahisa Kojima , u-boot@lists.denx.de Subject: [PATCH 4/7] tpm: Move TCG into a separate library Date: Sat, 22 Jun 2024 17:35:40 +0300 Message-ID: <20240622143601.187723-5-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240622143601.187723-1-ilias.apalodimas@linaro.org> References: <20240622143601.187723-1-ilias.apalodimas@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean commit 97707f12fdab ("tpm: Support boot measurements") moved out code from the EFI subsystem into the TPM one to support measurements when booting with !EFI. Those were moved directly into the TPM subsystem and in the tpm-v2.c library. In hindsight, it would have been better to move it in new files since the TCG2 is governed by its own spec and it's cleaner when we want to enable certian parts of the TPM functionality. So let's create a header file and another library and move the TCG specific bits there. Signed-off-by: Ilias Apalodimas --- boot/bootm.c | 1 + include/efi_tcg2.h | 1 + include/tpm-v2.h | 474 +++++------------------------- include/tpm_tcg2.h | 336 ++++++++++++++++++++++ lib/Makefile | 2 + lib/tpm-v2.c | 676 +------------------------------------------ lib/tpm_tcg2.c | 696 +++++++++++++++++++++++++++++++++++++++++++++ 7 files changed, 1114 insertions(+), 1072 deletions(-) create mode 100644 include/tpm_tcg2.h create mode 100644 lib/tpm_tcg2.c diff --git a/boot/bootm.c b/boot/bootm.c index 9879e1bba4eb..395b42cccd88 100644 --- a/boot/bootm.c +++ b/boot/bootm.c @@ -25,6 +25,7 @@ #include #include #include +#include #if defined(CONFIG_CMD_USB) #include #endif diff --git a/include/efi_tcg2.h b/include/efi_tcg2.h index 54490969b2d1..8dfb1bc9527b 100644 --- a/include/efi_tcg2.h +++ b/include/efi_tcg2.h @@ -18,6 +18,7 @@ #include #include +#include /* TPMV2 only */ #define TCG2_EVENT_LOG_FORMAT_TCG_2 0x00000002 diff --git a/include/tpm-v2.h b/include/tpm-v2.h index c9d5cb6d3e5a..c176e04c9952 100644 --- a/include/tpm-v2.h +++ b/include/tpm-v2.h @@ -26,14 +26,13 @@ struct udevice; #define TPM2_SHA512_DIGEST_SIZE 64 #define TPM2_SM3_256_DIGEST_SIZE 32 +#define TPM2_HDR_LEN 10 + #define TPM2_MAX_PCRS 32 #define TPM2_PCR_SELECT_MAX ((TPM2_MAX_PCRS + 7) / 8) #define TPM2_MAX_CAP_BUFFER 1024 #define TPM2_MAX_TPM_PROPERTIES ((TPM2_MAX_CAP_BUFFER - sizeof(u32) /* TPM2_CAP */ - \ sizeof(u32)) / sizeof(struct tpms_tagged_property)) - -#define TPM2_HDR_LEN 10 - /* * We deviate from this draft of the specification by increasing the value of * TPM2_NUM_PCR_BANKS from 3 to 16 to ensure compatibility with TPM2 @@ -55,211 +54,6 @@ struct udevice; #define TPM2_PT_MAX_COMMAND_SIZE (u32)(TPM2_PT_FIXED + 30) #define TPM2_PT_MAX_RESPONSE_SIZE (u32)(TPM2_PT_FIXED + 31) -/* - * event types, cf. - * "TCG Server Management Domain Firmware Profile Specification", - * rev 1.00, 2020-05-01 - */ -#define EV_POST_CODE ((u32)0x00000001) -#define EV_NO_ACTION ((u32)0x00000003) -#define EV_SEPARATOR ((u32)0x00000004) -#define EV_ACTION ((u32)0x00000005) -#define EV_TAG ((u32)0x00000006) -#define EV_S_CRTM_CONTENTS ((u32)0x00000007) -#define EV_S_CRTM_VERSION ((u32)0x00000008) -#define EV_CPU_MICROCODE ((u32)0x00000009) -#define EV_PLATFORM_CONFIG_FLAGS ((u32)0x0000000A) -#define EV_TABLE_OF_DEVICES ((u32)0x0000000B) -#define EV_COMPACT_HASH ((u32)0x0000000C) - -/* - * event types, cf. - * "TCG PC Client Platform Firmware Profile Specification", Family "2.0" - * Level 00 Version 1.05 Revision 23, May 7, 2021 - */ -#define EV_EFI_EVENT_BASE ((u32)0x80000000) -#define EV_EFI_VARIABLE_DRIVER_CONFIG ((u32)0x80000001) -#define EV_EFI_VARIABLE_BOOT ((u32)0x80000002) -#define EV_EFI_BOOT_SERVICES_APPLICATION ((u32)0x80000003) -#define EV_EFI_BOOT_SERVICES_DRIVER ((u32)0x80000004) -#define EV_EFI_RUNTIME_SERVICES_DRIVER ((u32)0x80000005) -#define EV_EFI_GPT_EVENT ((u32)0x80000006) -#define EV_EFI_ACTION ((u32)0x80000007) -#define EV_EFI_PLATFORM_FIRMWARE_BLOB ((u32)0x80000008) -#define EV_EFI_HANDOFF_TABLES ((u32)0x80000009) -#define EV_EFI_PLATFORM_FIRMWARE_BLOB2 ((u32)0x8000000A) -#define EV_EFI_HANDOFF_TABLES2 ((u32)0x8000000B) -#define EV_EFI_VARIABLE_BOOT2 ((u32)0x8000000C) -#define EV_EFI_HCRTM_EVENT ((u32)0x80000010) -#define EV_EFI_VARIABLE_AUTHORITY ((u32)0x800000E0) -#define EV_EFI_SPDM_FIRMWARE_BLOB ((u32)0x800000E1) -#define EV_EFI_SPDM_FIRMWARE_CONFIG ((u32)0x800000E2) - -#define EFI_CALLING_EFI_APPLICATION \ - "Calling EFI Application from Boot Option" -#define EFI_RETURNING_FROM_EFI_APPLICATION \ - "Returning from EFI Application from Boot Option" -#define EFI_EXIT_BOOT_SERVICES_INVOCATION \ - "Exit Boot Services Invocation" -#define EFI_EXIT_BOOT_SERVICES_FAILED \ - "Exit Boot Services Returned with Failure" -#define EFI_EXIT_BOOT_SERVICES_SUCCEEDED \ - "Exit Boot Services Returned with Success" -#define EFI_DTB_EVENT_STRING \ - "DTB DATA" - -/* TPMS_TAGGED_PROPERTY Structure */ -struct tpms_tagged_property { - u32 property; - u32 value; -} __packed; - -/* TPMS_PCR_SELECTION Structure */ -struct tpms_pcr_selection { - u16 hash; - u8 size_of_select; - u8 pcr_select[TPM2_PCR_SELECT_MAX]; -} __packed; - -/* TPML_PCR_SELECTION Structure */ -struct tpml_pcr_selection { - u32 count; - struct tpms_pcr_selection selection[TPM2_NUM_PCR_BANKS]; -} __packed; - -/* TPML_TAGGED_TPM_PROPERTY Structure */ -struct tpml_tagged_tpm_property { - u32 count; - struct tpms_tagged_property tpm_property[TPM2_MAX_TPM_PROPERTIES]; -} __packed; - -/* TPMU_CAPABILITIES Union */ -union tpmu_capabilities { - /* - * Non exhaustive. Only added the structs needed for our - * current code - */ - struct tpml_pcr_selection assigned_pcr; - struct tpml_tagged_tpm_property tpm_properties; -} __packed; - -/* TPMS_CAPABILITY_DATA Structure */ -struct tpms_capability_data { - u32 capability; - union tpmu_capabilities data; -} __packed; - -/** - * SHA1 Event Log Entry Format - * - * @pcr_index: PCRIndex event extended to - * @event_type: Type of event (see EFI specs) - * @digest: Value extended into PCR index - * @event_size: Size of event - * @event: Event data - */ -struct tcg_pcr_event { - u32 pcr_index; - u32 event_type; - u8 digest[TPM2_SHA1_DIGEST_SIZE]; - u32 event_size; - u8 event[]; -} __packed; - -/** - * Definition of TPMU_HA Union - */ -union tpmu_ha { - u8 sha1[TPM2_SHA1_DIGEST_SIZE]; - u8 sha256[TPM2_SHA256_DIGEST_SIZE]; - u8 sm3_256[TPM2_SM3_256_DIGEST_SIZE]; - u8 sha384[TPM2_SHA384_DIGEST_SIZE]; - u8 sha512[TPM2_SHA512_DIGEST_SIZE]; -} __packed; - -/** - * Definition of TPMT_HA Structure - * - * @hash_alg: Hash algorithm defined in enum tpm2_algorithms - * @digest: Digest value for a given algorithm - */ -struct tpmt_ha { - u16 hash_alg; - union tpmu_ha digest; -} __packed; - -/** - * Definition of TPML_DIGEST_VALUES Structure - * - * @count: Number of algorithms supported by hardware - * @digests: struct for algorithm id and hash value - */ -struct tpml_digest_values { - u32 count; - struct tpmt_ha digests[TPM2_NUM_PCR_BANKS]; -} __packed; - -/** - * Crypto Agile Log Entry Format - * - * @pcr_index: PCRIndex event extended to - * @event_type: Type of event - * @digests: List of digestsextended to PCR index - * @event_size: Size of the event data - * @event: Event data - */ -struct tcg_pcr_event2 { - u32 pcr_index; - u32 event_type; - struct tpml_digest_values digests; - u32 event_size; - u8 event[]; -} __packed; - -/** - * struct TCG_EfiSpecIdEventAlgorithmSize - hashing algorithm information - * - * @algorithm_id: algorithm defined in enum tpm2_algorithms - * @digest_size: size of the algorithm - */ -struct tcg_efi_spec_id_event_algorithm_size { - u16 algorithm_id; - u16 digest_size; -} __packed; - -#define TCG_EFI_SPEC_ID_EVENT_SIGNATURE_03 "Spec ID Event03" -#define TCG_EFI_SPEC_ID_EVENT_SPEC_VERSION_MAJOR_TPM2 2 -#define TCG_EFI_SPEC_ID_EVENT_SPEC_VERSION_MINOR_TPM2 0 -#define TCG_EFI_SPEC_ID_EVENT_SPEC_VERSION_ERRATA_TPM2 2 - -/** - * struct TCG_EfiSpecIDEventStruct - content of the event log header - * - * @signature: signature, set to Spec ID Event03 - * @platform_class: class defined in TCG ACPI Specification - * Client Common Header. - * @spec_version_minor: minor version - * @spec_version_major: major version - * @spec_version_errata: major version - * @uintn_size: size of the efi_uintn_t fields used in various - * data structures used in this specification. - * 0x01 indicates u32 and 0x02 indicates u64 - * @number_of_algorithms: hashing algorithms used in this event log - * @digest_sizes: array of number_of_algorithms pairs - * 1st member defines the algorithm id - * 2nd member defines the algorithm size - */ -struct tcg_efi_spec_id_event { - u8 signature[16]; - u32 platform_class; - u8 spec_version_minor; - u8 spec_version_major; - u8 spec_errata; - u8 uintn_size; - u32 number_of_algorithms; - struct tcg_efi_spec_id_event_algorithm_size digest_sizes[]; -} __packed; - /** * TPM2 Structure Tags for command/response buffers. * @@ -386,6 +180,80 @@ enum tpm2_algorithms { TPM2_ALG_SM3_256 = 0x12, }; +/* TPMS_TAGGED_PROPERTY Structure */ +struct tpms_tagged_property { + u32 property; + u32 value; +} __packed; + +/* TPMS_PCR_SELECTION Structure */ +struct tpms_pcr_selection { + u16 hash; + u8 size_of_select; + u8 pcr_select[TPM2_PCR_SELECT_MAX]; +} __packed; + +/* TPML_PCR_SELECTION Structure */ +struct tpml_pcr_selection { + u32 count; + struct tpms_pcr_selection selection[TPM2_NUM_PCR_BANKS]; +} __packed; + +/* TPML_TAGGED_TPM_PROPERTY Structure */ +struct tpml_tagged_tpm_property { + u32 count; + struct tpms_tagged_property tpm_property[TPM2_MAX_TPM_PROPERTIES]; +} __packed; + +/* TPMU_CAPABILITIES Union */ +union tpmu_capabilities { + /* + * Non exhaustive. Only added the structs needed for our + * current code + */ + struct tpml_pcr_selection assigned_pcr; + struct tpml_tagged_tpm_property tpm_properties; +} __packed; + +/* TPMS_CAPABILITY_DATA Structure */ +struct tpms_capability_data { + u32 capability; + union tpmu_capabilities data; +} __packed; + +/** + * Definition of TPMU_HA Union + */ +union tpmu_ha { + u8 sha1[TPM2_SHA1_DIGEST_SIZE]; + u8 sha256[TPM2_SHA256_DIGEST_SIZE]; + u8 sm3_256[TPM2_SM3_256_DIGEST_SIZE]; + u8 sha384[TPM2_SHA384_DIGEST_SIZE]; + u8 sha512[TPM2_SHA512_DIGEST_SIZE]; +} __packed; + +/** + * Definition of TPMT_HA Structure + * + * @hash_alg: Hash algorithm defined in enum tpm2_algorithms + * @digest: Digest value for a given algorithm + */ +struct tpmt_ha { + u16 hash_alg; + union tpmu_ha digest; +} __packed; + +/** + * Definition of TPML_DIGEST_VALUES Structure + * + * @count: Number of algorithms supported by hardware + * @digests: struct for algorithm id and hash value + */ +struct tpml_digest_values { + u32 count; + struct tpmt_ha digests[TPM2_NUM_PCR_BANKS]; +} __packed; + /** * struct digest_info - details of supported digests * @@ -530,188 +398,6 @@ enum { HR_NV_INDEX = TPM_HT_NV_INDEX << HR_SHIFT, }; -/** - * struct tcg2_event_log - Container for managing the platform event log - * - * @log: Address of the log - * @log_position: Current entry position - * @log_size: Log space available - * @found: Boolean indicating if an existing log was discovered - */ -struct tcg2_event_log { - u8 *log; - u32 log_position; - u32 log_size; - bool found; -}; - -/** - * Create a list of digests of the supported PCR banks for a given input data - * - * @dev TPM device - * @input Data - * @length Length of the data to calculate the digest - * @digest_list List of digests to fill in - * - * Return: zero on success, negative errno otherwise - */ -int tcg2_create_digest(struct udevice *dev, const u8 *input, u32 length, - struct tpml_digest_values *digest_list); - -/** - * Get the event size of the specified digests - * - * @digest_list List of digests for the event - * - * Return: Size in bytes of the event - */ -u32 tcg2_event_get_size(struct tpml_digest_values *digest_list); - -/** - * tcg2_get_active_pcr_banks - * - * @dev TPM device - * @active_pcr_banks Bitmask of PCR algorithms supported - * - * Return: zero on success, negative errno otherwise - */ -int tcg2_get_active_pcr_banks(struct udevice *dev, u32 *active_pcr_banks); - -/** - * tcg2_log_append - Append an event to an event log - * - * @pcr_index Index of the PCR - * @event_type Type of event - * @digest_list List of digests to add - * @size Size of event - * @event Event data - * @log Log buffer to append the event to - */ -void tcg2_log_append(u32 pcr_index, u32 event_type, - struct tpml_digest_values *digest_list, u32 size, - const u8 *event, u8 *log); - -/** - * Extend the PCR with specified digests - * - * @dev TPM device - * @pcr_index Index of the PCR - * @digest_list List of digests to extend - * - * Return: zero on success, negative errno otherwise - */ -int tcg2_pcr_extend(struct udevice *dev, u32 pcr_index, - struct tpml_digest_values *digest_list); - -/** - * Read the PCR into a list of digests - * - * @dev TPM device - * @pcr_index Index of the PCR - * @digest_list List of digests to extend - * - * Return: zero on success, negative errno otherwise - */ -int tcg2_pcr_read(struct udevice *dev, u32 pcr_index, - struct tpml_digest_values *digest_list); - -/** - * Measure data into the TPM PCRs and the platform event log. - * - * @dev TPM device - * @log Platform event log - * @pcr_index Index of the PCR - * @size Size of the data or 0 for event only - * @data Pointer to the data or NULL for event only - * @event_type Event log type - * @event_size Size of the event - * @event Pointer to the event - * - * Return: zero on success, negative errno otherwise - */ -int tcg2_measure_data(struct udevice *dev, struct tcg2_event_log *elog, - u32 pcr_index, u32 size, const u8 *data, u32 event_type, - u32 event_size, const u8 *event); - -#define tcg2_measure_event(dev, elog, pcr_index, event_type, size, event) \ - tcg2_measure_data(dev, elog, pcr_index, 0, NULL, event_type, size, \ - event) - -/** - * Prepare the event log buffer. This function tries to discover an existing - * event log in memory from a previous bootloader stage. If such a log exists - * and the PCRs are not extended, the log is "replayed" to extend the PCRs. - * If no log is discovered, create the log header. - * - * @dev TPM device - * @elog Platform event log. The log pointer and log_size - * members must be initialized to either 0 or to a valid - * memory region, in which case any existing log - * discovered will be copied to the specified memory - * region. - * @ignore_existing_log Boolean to indicate whether or not to ignore an - * existing platform log in memory - * - * Return: zero on success, negative errno otherwise - */ -int tcg2_log_prepare_buffer(struct udevice *dev, struct tcg2_event_log *elog, - bool ignore_existing_log); - -/** - * Begin measurements. - * - * @dev TPM device - * @elog Platform event log. The log pointer and log_size - * members must be initialized to either 0 or to a valid - * memory region, in which case any existing log - * discovered will be copied to the specified memory - * region. - * @ignore_existing_log Boolean to indicate whether or not to ignore an - * existing platform log in memory - * - * Return: zero on success, negative errno otherwise - */ -int tcg2_measurement_init(struct udevice **dev, struct tcg2_event_log *elog, - bool ignore_existing_log); - -/** - * Stop measurements and record separator events. - * - * @dev TPM device - * @elog Platform event log - * @error Boolean to indicate whether an error ocurred or not - */ -void tcg2_measurement_term(struct udevice *dev, struct tcg2_event_log *elog, - bool error); - -/** - * Get the platform event log address and size. - * - * @dev TPM device - * @addr Address of the log - * @size Size of the log - * - * Return: zero on success, negative errno otherwise - */ -int tcg2_platform_get_log(struct udevice *dev, void **addr, u32 *size); - -/** - * Get the first TPM2 device found. - * - * @dev TPM device - * - * Return: zero on success, negative errno otherwise - */ -int tcg2_platform_get_tpm2(struct udevice **dev); - -/** - * Platform-specific function for handling TPM startup errors - * - * @dev TPM device - * @rc The TPM response code - */ -void tcg2_platform_startup_error(struct udevice *dev, int rc); - /** * Issue a TPM2_Startup command. * @@ -1028,12 +714,4 @@ enum tpm2_algorithms tpm2_name_to_algorithm(const char *name); */ const char *tpm2_algorithm_name(enum tpm2_algorithms); -/** - * tpm2_algorithm_to_mask() - Get a TCG hash mask for algorithm - * - * @hash_alg: TCG defined algorithm - * Return: TCG hashing algorithm bitmaps (or 0 if algo not supported) - */ -u32 tpm2_algorithm_to_mask(enum tpm2_algorithms); - #endif /* __TPM_V2_H */ diff --git a/include/tpm_tcg2.h b/include/tpm_tcg2.h new file mode 100644 index 000000000000..77afdbb03e77 --- /dev/null +++ b/include/tpm_tcg2.h @@ -0,0 +1,336 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * Defines APIs and structures that adhere to + * https://trustedcomputinggroup.org/resource/pc-client-specific-platform-firmware-profile-specification/ + * https://trustedcomputinggroup.org/resource/tcg-efi-protocol-specification/ + * + * Copyright (c) 2020 Linaro + */ + +#ifndef __TPM_TCG_V2_H +#define __TPM_TCG_V2_H + +#include + +/* + * event types, cf. + * "TCG Server Management Domain Firmware Profile Specification", + * rev 1.00, 2020-05-01 + */ +#define EV_POST_CODE ((u32)0x00000001) +#define EV_NO_ACTION ((u32)0x00000003) +#define EV_SEPARATOR ((u32)0x00000004) +#define EV_ACTION ((u32)0x00000005) +#define EV_TAG ((u32)0x00000006) +#define EV_S_CRTM_CONTENTS ((u32)0x00000007) +#define EV_S_CRTM_VERSION ((u32)0x00000008) +#define EV_CPU_MICROCODE ((u32)0x00000009) +#define EV_PLATFORM_CONFIG_FLAGS ((u32)0x0000000A) +#define EV_TABLE_OF_DEVICES ((u32)0x0000000B) +#define EV_COMPACT_HASH ((u32)0x0000000C) + +/* + * event types, cf. + * "TCG PC Client Platform Firmware Profile Specification", Family "2.0" + * Level 00 Version 1.05 Revision 23, May 7, 2021 + */ +#define EV_EFI_EVENT_BASE ((u32)0x80000000) +#define EV_EFI_VARIABLE_DRIVER_CONFIG ((u32)0x80000001) +#define EV_EFI_VARIABLE_BOOT ((u32)0x80000002) +#define EV_EFI_BOOT_SERVICES_APPLICATION ((u32)0x80000003) +#define EV_EFI_BOOT_SERVICES_DRIVER ((u32)0x80000004) +#define EV_EFI_RUNTIME_SERVICES_DRIVER ((u32)0x80000005) +#define EV_EFI_GPT_EVENT ((u32)0x80000006) +#define EV_EFI_ACTION ((u32)0x80000007) +#define EV_EFI_PLATFORM_FIRMWARE_BLOB ((u32)0x80000008) +#define EV_EFI_HANDOFF_TABLES ((u32)0x80000009) +#define EV_EFI_PLATFORM_FIRMWARE_BLOB2 ((u32)0x8000000A) +#define EV_EFI_HANDOFF_TABLES2 ((u32)0x8000000B) +#define EV_EFI_VARIABLE_BOOT2 ((u32)0x8000000C) +#define EV_EFI_HCRTM_EVENT ((u32)0x80000010) +#define EV_EFI_VARIABLE_AUTHORITY ((u32)0x800000E0) +#define EV_EFI_SPDM_FIRMWARE_BLOB ((u32)0x800000E1) +#define EV_EFI_SPDM_FIRMWARE_CONFIG ((u32)0x800000E2) + +#define EFI_CALLING_EFI_APPLICATION \ + "Calling EFI Application from Boot Option" +#define EFI_RETURNING_FROM_EFI_APPLICATION \ + "Returning from EFI Application from Boot Option" +#define EFI_EXIT_BOOT_SERVICES_INVOCATION \ + "Exit Boot Services Invocation" +#define EFI_EXIT_BOOT_SERVICES_FAILED \ + "Exit Boot Services Returned with Failure" +#define EFI_EXIT_BOOT_SERVICES_SUCCEEDED \ + "Exit Boot Services Returned with Success" +#define EFI_DTB_EVENT_STRING \ + "DTB DATA" + +/** + * SHA1 Event Log Entry Format + * + * @pcr_index: PCRIndex event extended to + * @event_type: Type of event (see EFI specs) + * @digest: Value extended into PCR index + * @event_size: Size of event + * @event: Event data + */ +struct tcg_pcr_event { + u32 pcr_index; + u32 event_type; + u8 digest[TPM2_SHA1_DIGEST_SIZE]; + u32 event_size; + u8 event[]; +} __packed; + +/** + * Crypto Agile Log Entry Format + * + * @pcr_index: PCRIndex event extended to + * @event_type: Type of event + * @digests: List of digestsextended to PCR index + * @event_size: Size of the event data + * @event: Event data + */ +struct tcg_pcr_event2 { + u32 pcr_index; + u32 event_type; + struct tpml_digest_values digests; + u32 event_size; + u8 event[]; +} __packed; + +/** + * struct TCG_EfiSpecIdEventAlgorithmSize - hashing algorithm information + * + * @algorithm_id: algorithm defined in enum tpm2_algorithms + * @digest_size: size of the algorithm + */ +struct tcg_efi_spec_id_event_algorithm_size { + u16 algorithm_id; + u16 digest_size; +} __packed; + +#define TCG_EFI_SPEC_ID_EVENT_SIGNATURE_03 "Spec ID Event03" +#define TCG_EFI_SPEC_ID_EVENT_SPEC_VERSION_MAJOR_TPM2 2 +#define TCG_EFI_SPEC_ID_EVENT_SPEC_VERSION_MINOR_TPM2 0 +#define TCG_EFI_SPEC_ID_EVENT_SPEC_VERSION_ERRATA_TPM2 2 + +/** + * struct TCG_EfiSpecIDEventStruct - content of the event log header + * + * @signature: signature, set to Spec ID Event03 + * @platform_class: class defined in TCG ACPI Specification + * Client Common Header. + * @spec_version_minor: minor version + * @spec_version_major: major version + * @spec_version_errata: major version + * @uintn_size: size of the efi_uintn_t fields used in various + * data structures used in this specification. + * 0x01 indicates u32 and 0x02 indicates u64 + * @number_of_algorithms: hashing algorithms used in this event log + * @digest_sizes: array of number_of_algorithms pairs + * 1st member defines the algorithm id + * 2nd member defines the algorithm size + */ +struct tcg_efi_spec_id_event { + u8 signature[16]; + u32 platform_class; + u8 spec_version_minor; + u8 spec_version_major; + u8 spec_errata; + u8 uintn_size; + u32 number_of_algorithms; + struct tcg_efi_spec_id_event_algorithm_size digest_sizes[]; +} __packed; + +/** + * struct tcg2_event_log - Container for managing the platform event log + * + * @log: Address of the log + * @log_position: Current entry position + * @log_size: Log space available + * @found: Boolean indicating if an existing log was discovered + */ +struct tcg2_event_log { + u8 *log; + u32 log_position; + u32 log_size; + bool found; +}; + +/** + * Create a list of digests of the supported PCR banks for a given input data + * + * @dev TPM device + * @input Data + * @length Length of the data to calculate the digest + * @digest_list List of digests to fill in + * + * Return: zero on success, negative errno otherwise + */ +int tcg2_create_digest(struct udevice *dev, const u8 *input, u32 length, + struct tpml_digest_values *digest_list); + +/** + * Get the event size of the specified digests + * + * @digest_list List of digests for the event + * + * Return: Size in bytes of the event + */ +u32 tcg2_event_get_size(struct tpml_digest_values *digest_list); + +/** + * tcg2_get_active_pcr_banks + * + * @dev TPM device + * @active_pcr_banks Bitmask of PCR algorithms supported + * + * Return: zero on success, negative errno otherwise + */ +int tcg2_get_active_pcr_banks(struct udevice *dev, u32 *active_pcr_banks); + +/** + * tcg2_log_append - Append an event to an event log + * + * @pcr_index Index of the PCR + * @event_type Type of event + * @digest_list List of digests to add + * @size Size of event + * @event Event data + * @log Log buffer to append the event to + */ +void tcg2_log_append(u32 pcr_index, u32 event_type, + struct tpml_digest_values *digest_list, u32 size, + const u8 *event, u8 *log); + +/** + * Extend the PCR with specified digests + * + * @dev TPM device + * @pcr_index Index of the PCR + * @digest_list List of digests to extend + * + * Return: zero on success, negative errno otherwise + */ +int tcg2_pcr_extend(struct udevice *dev, u32 pcr_index, + struct tpml_digest_values *digest_list); + +/** + * Read the PCR into a list of digests + * + * @dev TPM device + * @pcr_index Index of the PCR + * @digest_list List of digests to extend + * + * Return: zero on success, negative errno otherwise + */ +int tcg2_pcr_read(struct udevice *dev, u32 pcr_index, + struct tpml_digest_values *digest_list); + +/** + * Measure data into the TPM PCRs and the platform event log. + * + * @dev TPM device + * @log Platform event log + * @pcr_index Index of the PCR + * @size Size of the data or 0 for event only + * @data Pointer to the data or NULL for event only + * @event_type Event log type + * @event_size Size of the event + * @event Pointer to the event + * + * Return: zero on success, negative errno otherwise + */ +int tcg2_measure_data(struct udevice *dev, struct tcg2_event_log *elog, + u32 pcr_index, u32 size, const u8 *data, u32 event_type, + u32 event_size, const u8 *event); + +#define tcg2_measure_event(dev, elog, pcr_index, event_type, size, event) \ + tcg2_measure_data(dev, elog, pcr_index, 0, NULL, event_type, size, \ + event) + +/** + * Prepare the event log buffer. This function tries to discover an existing + * event log in memory from a previous bootloader stage. If such a log exists + * and the PCRs are not extended, the log is "replayed" to extend the PCRs. + * If no log is discovered, create the log header. + * + * @dev TPM device + * @elog Platform event log. The log pointer and log_size + * members must be initialized to either 0 or to a valid + * memory region, in which case any existing log + * discovered will be copied to the specified memory + * region. + * @ignore_existing_log Boolean to indicate whether or not to ignore an + * existing platform log in memory + * + * Return: zero on success, negative errno otherwise + */ +int tcg2_log_prepare_buffer(struct udevice *dev, struct tcg2_event_log *elog, + bool ignore_existing_log); + +/** + * Begin measurements. + * + * @dev TPM device + * @elog Platform event log. The log pointer and log_size + * members must be initialized to either 0 or to a valid + * memory region, in which case any existing log + * discovered will be copied to the specified memory + * region. + * @ignore_existing_log Boolean to indicate whether or not to ignore an + * existing platform log in memory + * + * Return: zero on success, negative errno otherwise + */ +int tcg2_measurement_init(struct udevice **dev, struct tcg2_event_log *elog, + bool ignore_existing_log); + +/** + * Stop measurements and record separator events. + * + * @dev TPM device + * @elog Platform event log + * @error Boolean to indicate whether an error ocurred or not + */ +void tcg2_measurement_term(struct udevice *dev, struct tcg2_event_log *elog, + bool error); + +/** + * Get the platform event log address and size. + * + * @dev TPM device + * @addr Address of the log + * @size Size of the log + * + * Return: zero on success, negative errno otherwise + */ +int tcg2_platform_get_log(struct udevice *dev, void **addr, u32 *size); + +/** + * Get the first TPM2 device found. + * + * @dev TPM device + * + * Return: zero on success, negative errno otherwise + */ +int tcg2_platform_get_tpm2(struct udevice **dev); + +/** + * Platform-specific function for handling TPM startup errors + * + * @dev TPM device + * @rc The TPM response code + */ +void tcg2_platform_startup_error(struct udevice *dev, int rc); + +/** + * tcg2_algorithm_to_mask() - Get a TCG hash mask for algorithm + * + * @hash_alg: TCG defined algorithm + * Return: TCG hashing algorithm bitmaps (or 0 if algo not supported) + */ +u32 tcg2_algorithm_to_mask(enum tpm2_algorithms); + +#endif /* __TPM_TCG_V2_H */ diff --git a/lib/Makefile b/lib/Makefile index 2a76acf100d0..e389ad014f89 100644 --- a/lib/Makefile +++ b/lib/Makefile @@ -61,6 +61,8 @@ ifeq ($(CONFIG_$(SPL_TPL_)TPM),y) obj-$(CONFIG_TPM) += tpm_api.o obj-$(CONFIG_TPM_V1) += tpm-v1.o obj-$(CONFIG_TPM_V2) += tpm-v2.o +obj-$(CONFIG_EFI_TCG2_PROTOCOL) += tpm_tcg2.o +obj-$(CONFIG_MEASURED_BOOT) += tpm_tcg2.o endif obj-$(CONFIG_$(SPL_TPL_)CRC8) += crc8.o diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c index 91526af33acb..62ab804b4b38 100644 --- a/lib/tpm-v2.c +++ b/lib/tpm-v2.c @@ -10,6 +10,7 @@ #include #include #include +#include #include #include #include @@ -22,668 +23,6 @@ #include "tpm-utils.h" -int tcg2_get_active_pcr_banks(struct udevice *dev, u32 *active_pcr_banks) -{ - u32 supported = 0; - u32 pcr_banks = 0; - u32 active = 0; - int rc; - - rc = tpm2_get_pcr_info(dev, &supported, &active, &pcr_banks); - if (rc) - return rc; - - *active_pcr_banks = active; - - return 0; -} - -u32 tcg2_event_get_size(struct tpml_digest_values *digest_list) -{ - u32 len; - size_t i; - - len = offsetof(struct tcg_pcr_event2, digests); - len += offsetof(struct tpml_digest_values, digests); - for (i = 0; i < digest_list->count; ++i) { - u16 l = tpm2_algorithm_to_len(digest_list->digests[i].hash_alg); - - if (!l) - continue; - - len += l + offsetof(struct tpmt_ha, digest); - } - len += sizeof(u32); - - return len; -} - -int tcg2_create_digest(struct udevice *dev, const u8 *input, u32 length, - struct tpml_digest_values *digest_list) -{ - u8 final[sizeof(union tpmu_ha)]; - sha256_context ctx_256; - sha512_context ctx_512; - sha1_context ctx; - u32 active; - size_t i; - u32 len; - int rc; - - rc = tcg2_get_active_pcr_banks(dev, &active); - if (rc) - return rc; - - digest_list->count = 0; - for (i = 0; i < ARRAY_SIZE(hash_algo_list); ++i) { - if (!(active & hash_algo_list[i].hash_mask)) - continue; - - switch (hash_algo_list[i].hash_alg) { - case TPM2_ALG_SHA1: - sha1_starts(&ctx); - sha1_update(&ctx, input, length); - sha1_finish(&ctx, final); - len = TPM2_SHA1_DIGEST_SIZE; - break; - case TPM2_ALG_SHA256: - sha256_starts(&ctx_256); - sha256_update(&ctx_256, input, length); - sha256_finish(&ctx_256, final); - len = TPM2_SHA256_DIGEST_SIZE; - break; - case TPM2_ALG_SHA384: - sha384_starts(&ctx_512); - sha384_update(&ctx_512, input, length); - sha384_finish(&ctx_512, final); - len = TPM2_SHA384_DIGEST_SIZE; - break; - case TPM2_ALG_SHA512: - sha512_starts(&ctx_512); - sha512_update(&ctx_512, input, length); - sha512_finish(&ctx_512, final); - len = TPM2_SHA512_DIGEST_SIZE; - break; - default: - printf("%s: unsupported algorithm %x\n", __func__, - hash_algo_list[i].hash_alg); - continue; - } - - digest_list->digests[digest_list->count].hash_alg = - hash_algo_list[i].hash_alg; - memcpy(&digest_list->digests[digest_list->count].digest, final, - len); - digest_list->count++; - } - - return 0; -} - -void tcg2_log_append(u32 pcr_index, u32 event_type, - struct tpml_digest_values *digest_list, u32 size, - const u8 *event, u8 *log) -{ - size_t len; - size_t pos; - u32 i; - - pos = offsetof(struct tcg_pcr_event2, pcr_index); - put_unaligned_le32(pcr_index, log); - pos = offsetof(struct tcg_pcr_event2, event_type); - put_unaligned_le32(event_type, log + pos); - pos = offsetof(struct tcg_pcr_event2, digests) + - offsetof(struct tpml_digest_values, count); - put_unaligned_le32(digest_list->count, log + pos); - - pos = offsetof(struct tcg_pcr_event2, digests) + - offsetof(struct tpml_digest_values, digests); - for (i = 0; i < digest_list->count; ++i) { - u16 hash_alg = digest_list->digests[i].hash_alg; - - len = tpm2_algorithm_to_len(hash_alg); - if (!len) - continue; - - pos += offsetof(struct tpmt_ha, hash_alg); - put_unaligned_le16(hash_alg, log + pos); - pos += offsetof(struct tpmt_ha, digest); - memcpy(log + pos, (u8 *)&digest_list->digests[i].digest, len); - pos += len; - } - - put_unaligned_le32(size, log + pos); - pos += sizeof(u32); - memcpy(log + pos, event, size); -} - -static int tcg2_log_append_check(struct tcg2_event_log *elog, u32 pcr_index, - u32 event_type, - struct tpml_digest_values *digest_list, - u32 size, const u8 *event) -{ - u32 event_size; - u8 *log; - - event_size = size + tcg2_event_get_size(digest_list); - if (elog->log_position + event_size > elog->log_size) { - printf("%s: log too large: %u + %u > %u\n", __func__, - elog->log_position, event_size, elog->log_size); - return -ENOBUFS; - } - - log = elog->log + elog->log_position; - elog->log_position += event_size; - - tcg2_log_append(pcr_index, event_type, digest_list, size, event, log); - - return 0; -} - -static int tcg2_log_init(struct udevice *dev, struct tcg2_event_log *elog) -{ - struct tcg_efi_spec_id_event *ev; - struct tcg_pcr_event *log; - u32 event_size; - u32 count = 0; - u32 log_size; - u32 active; - size_t i; - u16 len; - int rc; - - rc = tcg2_get_active_pcr_banks(dev, &active); - if (rc) - return rc; - - event_size = offsetof(struct tcg_efi_spec_id_event, digest_sizes); - for (i = 0; i < ARRAY_SIZE(hash_algo_list); ++i) { - if (!(active & hash_algo_list[i].hash_mask)) - continue; - - switch (hash_algo_list[i].hash_alg) { - case TPM2_ALG_SHA1: - case TPM2_ALG_SHA256: - case TPM2_ALG_SHA384: - case TPM2_ALG_SHA512: - count++; - break; - default: - continue; - } - } - - event_size += 1 + - (sizeof(struct tcg_efi_spec_id_event_algorithm_size) * count); - log_size = offsetof(struct tcg_pcr_event, event) + event_size; - - if (log_size > elog->log_size) { - printf("%s: log too large: %u > %u\n", __func__, log_size, - elog->log_size); - return -ENOBUFS; - } - - log = (struct tcg_pcr_event *)elog->log; - put_unaligned_le32(0, &log->pcr_index); - put_unaligned_le32(EV_NO_ACTION, &log->event_type); - memset(&log->digest, 0, sizeof(log->digest)); - put_unaligned_le32(event_size, &log->event_size); - - ev = (struct tcg_efi_spec_id_event *)log->event; - strlcpy((char *)ev->signature, TCG_EFI_SPEC_ID_EVENT_SIGNATURE_03, - sizeof(ev->signature)); - put_unaligned_le32(0, &ev->platform_class); - ev->spec_version_minor = TCG_EFI_SPEC_ID_EVENT_SPEC_VERSION_MINOR_TPM2; - ev->spec_version_major = TCG_EFI_SPEC_ID_EVENT_SPEC_VERSION_MAJOR_TPM2; - ev->spec_errata = TCG_EFI_SPEC_ID_EVENT_SPEC_VERSION_ERRATA_TPM2; - ev->uintn_size = sizeof(size_t) / sizeof(u32); - put_unaligned_le32(count, &ev->number_of_algorithms); - - count = 0; - for (i = 0; i < ARRAY_SIZE(hash_algo_list); ++i) { - if (!(active & hash_algo_list[i].hash_mask)) - continue; - - len = hash_algo_list[i].hash_len; - if (!len) - continue; - - put_unaligned_le16(hash_algo_list[i].hash_alg, - &ev->digest_sizes[count].algorithm_id); - put_unaligned_le16(len, &ev->digest_sizes[count].digest_size); - count++; - } - - *((u8 *)ev + (event_size - 1)) = 0; - elog->log_position = log_size; - - return 0; -} - -static int tcg2_replay_eventlog(struct tcg2_event_log *elog, - struct udevice *dev, - struct tpml_digest_values *digest_list, - u32 log_position) -{ - const u32 offset = offsetof(struct tcg_pcr_event2, digests) + - offsetof(struct tpml_digest_values, digests); - u32 event_size; - u32 count; - u16 algo; - u32 pcr; - u32 pos; - u16 len; - u8 *log; - int rc; - u32 i; - - while (log_position + offset < elog->log_size) { - log = elog->log + log_position; - - pos = offsetof(struct tcg_pcr_event2, pcr_index); - pcr = get_unaligned_le32(log + pos); - pos = offsetof(struct tcg_pcr_event2, event_type); - if (!get_unaligned_le32(log + pos)) - return 0; - - pos = offsetof(struct tcg_pcr_event2, digests) + - offsetof(struct tpml_digest_values, count); - count = get_unaligned_le32(log + pos); - if (count > ARRAY_SIZE(hash_algo_list) || - (digest_list->count && digest_list->count != count)) - return 0; - - pos = offsetof(struct tcg_pcr_event2, digests) + - offsetof(struct tpml_digest_values, digests); - for (i = 0; i < count; ++i) { - pos += offsetof(struct tpmt_ha, hash_alg); - if (log_position + pos + sizeof(u16) >= elog->log_size) - return 0; - - algo = get_unaligned_le16(log + pos); - pos += offsetof(struct tpmt_ha, digest); - switch (algo) { - case TPM2_ALG_SHA1: - case TPM2_ALG_SHA256: - case TPM2_ALG_SHA384: - case TPM2_ALG_SHA512: - len = tpm2_algorithm_to_len(algo); - break; - default: - return 0; - } - - if (digest_list->count) { - if (algo != digest_list->digests[i].hash_alg || - log_position + pos + len >= elog->log_size) - return 0; - - memcpy(digest_list->digests[i].digest.sha512, - log + pos, len); - } - - pos += len; - } - - if (log_position + pos + sizeof(u32) >= elog->log_size) - return 0; - - event_size = get_unaligned_le32(log + pos); - pos += event_size + sizeof(u32); - if (log_position + pos > elog->log_size) - return 0; - - if (digest_list->count) { - rc = tcg2_pcr_extend(dev, pcr, digest_list); - if (rc) - return rc; - } - - log_position += pos; - } - - elog->log_position = log_position; - elog->found = true; - return 0; -} - -static int tcg2_log_parse(struct udevice *dev, struct tcg2_event_log *elog) -{ - struct tpml_digest_values digest_list; - struct tcg_efi_spec_id_event *event; - struct tcg_pcr_event *log; - u32 log_active; - u32 calc_size; - u32 active; - u32 count; - u32 evsz; - u32 mask; - u16 algo; - u16 len; - int rc; - u32 i; - u16 j; - - if (elog->log_size <= offsetof(struct tcg_pcr_event, event)) - return 0; - - log = (struct tcg_pcr_event *)elog->log; - if (get_unaligned_le32(&log->pcr_index) != 0 || - get_unaligned_le32(&log->event_type) != EV_NO_ACTION) - return 0; - - for (i = 0; i < sizeof(log->digest); i++) { - if (log->digest[i]) - return 0; - } - - evsz = get_unaligned_le32(&log->event_size); - if (evsz < offsetof(struct tcg_efi_spec_id_event, digest_sizes) || - evsz + offsetof(struct tcg_pcr_event, event) > elog->log_size) - return 0; - - event = (struct tcg_efi_spec_id_event *)log->event; - if (memcmp(event->signature, TCG_EFI_SPEC_ID_EVENT_SIGNATURE_03, - sizeof(TCG_EFI_SPEC_ID_EVENT_SIGNATURE_03))) - return 0; - - if (event->spec_version_minor != TCG_EFI_SPEC_ID_EVENT_SPEC_VERSION_MINOR_TPM2 || - event->spec_version_major != TCG_EFI_SPEC_ID_EVENT_SPEC_VERSION_MAJOR_TPM2) - return 0; - - count = get_unaligned_le32(&event->number_of_algorithms); - if (count > ARRAY_SIZE(hash_algo_list)) - return 0; - - calc_size = offsetof(struct tcg_efi_spec_id_event, digest_sizes) + - (sizeof(struct tcg_efi_spec_id_event_algorithm_size) * count) + - 1; - if (evsz != calc_size) - return 0; - - rc = tcg2_get_active_pcr_banks(dev, &active); - if (rc) - return rc; - - digest_list.count = 0; - log_active = 0; - - for (i = 0; i < count; ++i) { - algo = get_unaligned_le16(&event->digest_sizes[i].algorithm_id); - mask = tpm2_algorithm_to_mask(algo); - - if (!(active & mask)) - return 0; - - switch (algo) { - case TPM2_ALG_SHA1: - case TPM2_ALG_SHA256: - case TPM2_ALG_SHA384: - case TPM2_ALG_SHA512: - len = get_unaligned_le16(&event->digest_sizes[i].digest_size); - if (tpm2_algorithm_to_len(algo) != len) - return 0; - digest_list.digests[digest_list.count++].hash_alg = algo; - break; - default: - return 0; - } - - log_active |= mask; - } - - /* Ensure the previous firmware extended all the PCRs. */ - if (log_active != active) - return 0; - - /* Read PCR0 to check if previous firmware extended the PCRs or not. */ - rc = tcg2_pcr_read(dev, 0, &digest_list); - if (rc) - return rc; - - for (i = 0; i < digest_list.count; ++i) { - len = tpm2_algorithm_to_len(digest_list.digests[i].hash_alg); - for (j = 0; j < len; ++j) { - if (digest_list.digests[i].digest.sha512[j]) - break; - } - - /* PCR is non-zero; it has been extended, so skip extending. */ - if (j != len) { - digest_list.count = 0; - break; - } - } - - return tcg2_replay_eventlog(elog, dev, &digest_list, - offsetof(struct tcg_pcr_event, event) + - evsz); -} - -int tcg2_pcr_extend(struct udevice *dev, u32 pcr_index, - struct tpml_digest_values *digest_list) -{ - u32 rc; - u32 i; - - for (i = 0; i < digest_list->count; i++) { - u32 alg = digest_list->digests[i].hash_alg; - - rc = tpm2_pcr_extend(dev, pcr_index, alg, - (u8 *)&digest_list->digests[i].digest, - tpm2_algorithm_to_len(alg)); - if (rc) { - printf("%s: error pcr:%u alg:%08x\n", __func__, - pcr_index, alg); - return rc; - } - } - - return 0; -} - -int tcg2_pcr_read(struct udevice *dev, u32 pcr_index, - struct tpml_digest_values *digest_list) -{ - struct tpm_chip_priv *priv; - u32 rc; - u32 i; - - priv = dev_get_uclass_priv(dev); - if (!priv) - return -ENODEV; - - for (i = 0; i < digest_list->count; i++) { - u32 alg = digest_list->digests[i].hash_alg; - u8 *digest = (u8 *)&digest_list->digests[i].digest; - - rc = tpm2_pcr_read(dev, pcr_index, priv->pcr_select_min, alg, - digest, tpm2_algorithm_to_len(alg), NULL); - if (rc) { - printf("%s: error pcr:%u alg:%08x\n", __func__, - pcr_index, alg); - return rc; - } - } - - return 0; -} - -int tcg2_measure_data(struct udevice *dev, struct tcg2_event_log *elog, - u32 pcr_index, u32 size, const u8 *data, u32 event_type, - u32 event_size, const u8 *event) -{ - struct tpml_digest_values digest_list; - int rc; - - if (data) - rc = tcg2_create_digest(dev, data, size, &digest_list); - else - rc = tcg2_create_digest(dev, event, event_size, &digest_list); - if (rc) - return rc; - - rc = tcg2_pcr_extend(dev, pcr_index, &digest_list); - if (rc) - return rc; - - return tcg2_log_append_check(elog, pcr_index, event_type, &digest_list, - event_size, event); -} - -int tcg2_log_prepare_buffer(struct udevice *dev, struct tcg2_event_log *elog, - bool ignore_existing_log) -{ - struct tcg2_event_log log; - int rc; - - elog->log_position = 0; - elog->found = false; - - rc = tcg2_platform_get_log(dev, (void **)&log.log, &log.log_size); - if (!rc) { - log.log_position = 0; - log.found = false; - - if (!ignore_existing_log) { - rc = tcg2_log_parse(dev, &log); - if (rc) - return rc; - } - - if (elog->log_size) { - if (log.found) { - if (elog->log_size < log.log_position) - return -ENOBUFS; - - /* - * Copy the discovered log into the user buffer - * if there's enough space. - */ - memcpy(elog->log, log.log, log.log_position); - } - - unmap_physmem(log.log, MAP_NOCACHE); - } else { - elog->log = log.log; - elog->log_size = log.log_size; - } - - elog->log_position = log.log_position; - elog->found = log.found; - } - - /* - * Initialize the log buffer if no log was discovered and the buffer is - * valid. User's can pass in their own buffer as a fallback if no - * memory region is found. - */ - if (!elog->found && elog->log_size) - rc = tcg2_log_init(dev, elog); - - return rc; -} - -int tcg2_measurement_init(struct udevice **dev, struct tcg2_event_log *elog, - bool ignore_existing_log) -{ - int rc; - - rc = tcg2_platform_get_tpm2(dev); - if (rc) - return rc; - - rc = tpm_auto_start(*dev); - if (rc) - return rc; - - rc = tcg2_log_prepare_buffer(*dev, elog, ignore_existing_log); - if (rc) { - tcg2_measurement_term(*dev, elog, true); - return rc; - } - - rc = tcg2_measure_event(*dev, elog, 0, EV_S_CRTM_VERSION, - strlen(version_string) + 1, - (u8 *)version_string); - if (rc) { - tcg2_measurement_term(*dev, elog, true); - return rc; - } - - return 0; -} - -void tcg2_measurement_term(struct udevice *dev, struct tcg2_event_log *elog, - bool error) -{ - u32 event = error ? 0x1 : 0xffffffff; - int i; - - for (i = 0; i < 8; ++i) - tcg2_measure_event(dev, elog, i, EV_SEPARATOR, sizeof(event), - (const u8 *)&event); - - if (elog->log) - unmap_physmem(elog->log, MAP_NOCACHE); -} - -__weak int tcg2_platform_get_log(struct udevice *dev, void **addr, u32 *size) -{ - const __be32 *addr_prop; - const __be32 *size_prop; - int asize; - int ssize; - - *addr = NULL; - *size = 0; - - addr_prop = dev_read_prop(dev, "tpm_event_log_addr", &asize); - if (!addr_prop) - addr_prop = dev_read_prop(dev, "linux,sml-base", &asize); - - size_prop = dev_read_prop(dev, "tpm_event_log_size", &ssize); - if (!size_prop) - size_prop = dev_read_prop(dev, "linux,sml-size", &ssize); - - if (addr_prop && size_prop) { - u64 a = of_read_number(addr_prop, asize / sizeof(__be32)); - u64 s = of_read_number(size_prop, ssize / sizeof(__be32)); - - *addr = map_physmem(a, s, MAP_NOCACHE); - *size = (u32)s; - } else { - struct ofnode_phandle_args args; - phys_addr_t a; - fdt_size_t s; - - if (dev_read_phandle_with_args(dev, "memory-region", NULL, 0, - 0, &args)) - return -ENODEV; - - a = ofnode_get_addr_size(args.node, "reg", &s); - if (a == FDT_ADDR_T_NONE) - return -ENOMEM; - - *addr = map_physmem(a, s, MAP_NOCACHE); - *size = (u32)s; - } - - return 0; -} - -__weak int tcg2_platform_get_tpm2(struct udevice **dev) -{ - for_each_tpm_device(*dev) { - if (tpm_get_version(*dev) == TPM_V2) - return 0; - } - - return -ENODEV; -} - -__weak void tcg2_platform_startup_error(struct udevice *dev, int rc) {} - u32 tpm2_startup(struct udevice *dev, enum tpm2_startup_types mode) { const u8 command_v2[12] = { @@ -1140,7 +479,7 @@ int tpm2_get_pcr_info(struct udevice *dev, u32 *supported_pcr, u32 *active_pcr, } for (i = 0; i < pcrs.count; i++) { - u32 hash_mask = tpm2_algorithm_to_mask(pcrs.selection[i].hash); + u32 hash_mask = tcg2_algorithm_to_mask(pcrs.selection[i].hash); if (hash_mask) { *supported_pcr |= hash_mask; @@ -1566,14 +905,3 @@ const char *tpm2_algorithm_name(enum tpm2_algorithms algo) return ""; } -u32 tpm2_algorithm_to_mask(enum tpm2_algorithms algo) -{ - size_t i; - - for (i = 0; i < ARRAY_SIZE(hash_algo_list); i++) { - if (hash_algo_list[i].hash_alg == algo) - return hash_algo_list[i].hash_mask; - } - - return 0; -} diff --git a/lib/tpm_tcg2.c b/lib/tpm_tcg2.c new file mode 100644 index 000000000000..865ef6e01ca9 --- /dev/null +++ b/lib/tpm_tcg2.c @@ -0,0 +1,696 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright (c) 2023 Linaro Limited + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include "tpm-utils.h" + +int tcg2_get_active_pcr_banks(struct udevice *dev, u32 *active_pcr_banks) +{ + u32 supported = 0; + u32 pcr_banks = 0; + u32 active = 0; + int rc; + + rc = tpm2_get_pcr_info(dev, &supported, &active, &pcr_banks); + if (rc) + return rc; + + *active_pcr_banks = active; + + return 0; +} + +u32 tcg2_event_get_size(struct tpml_digest_values *digest_list) +{ + u32 len; + size_t i; + + len = offsetof(struct tcg_pcr_event2, digests); + len += offsetof(struct tpml_digest_values, digests); + for (i = 0; i < digest_list->count; ++i) { + u16 l = tpm2_algorithm_to_len(digest_list->digests[i].hash_alg); + + if (!l) + continue; + + len += l + offsetof(struct tpmt_ha, digest); + } + len += sizeof(u32); + + return len; +} + +int tcg2_create_digest(struct udevice *dev, const u8 *input, u32 length, + struct tpml_digest_values *digest_list) +{ + u8 final[sizeof(union tpmu_ha)]; + sha256_context ctx_256; + sha512_context ctx_512; + sha1_context ctx; + u32 active; + size_t i; + u32 len; + int rc; + + rc = tcg2_get_active_pcr_banks(dev, &active); + if (rc) + return rc; + + digest_list->count = 0; + for (i = 0; i < ARRAY_SIZE(hash_algo_list); ++i) { + if (!(active & hash_algo_list[i].hash_mask)) + continue; + + switch (hash_algo_list[i].hash_alg) { + case TPM2_ALG_SHA1: + sha1_starts(&ctx); + sha1_update(&ctx, input, length); + sha1_finish(&ctx, final); + len = TPM2_SHA1_DIGEST_SIZE; + break; + case TPM2_ALG_SHA256: + sha256_starts(&ctx_256); + sha256_update(&ctx_256, input, length); + sha256_finish(&ctx_256, final); + len = TPM2_SHA256_DIGEST_SIZE; + break; + case TPM2_ALG_SHA384: + sha384_starts(&ctx_512); + sha384_update(&ctx_512, input, length); + sha384_finish(&ctx_512, final); + len = TPM2_SHA384_DIGEST_SIZE; + break; + case TPM2_ALG_SHA512: + sha512_starts(&ctx_512); + sha512_update(&ctx_512, input, length); + sha512_finish(&ctx_512, final); + len = TPM2_SHA512_DIGEST_SIZE; + break; + default: + printf("%s: unsupported algorithm %x\n", __func__, + hash_algo_list[i].hash_alg); + continue; + } + + digest_list->digests[digest_list->count].hash_alg = + hash_algo_list[i].hash_alg; + memcpy(&digest_list->digests[digest_list->count].digest, final, + len); + digest_list->count++; + } + + return 0; +} + +void tcg2_log_append(u32 pcr_index, u32 event_type, + struct tpml_digest_values *digest_list, u32 size, + const u8 *event, u8 *log) +{ + size_t len; + size_t pos; + u32 i; + + pos = offsetof(struct tcg_pcr_event2, pcr_index); + put_unaligned_le32(pcr_index, log); + pos = offsetof(struct tcg_pcr_event2, event_type); + put_unaligned_le32(event_type, log + pos); + pos = offsetof(struct tcg_pcr_event2, digests) + + offsetof(struct tpml_digest_values, count); + put_unaligned_le32(digest_list->count, log + pos); + + pos = offsetof(struct tcg_pcr_event2, digests) + + offsetof(struct tpml_digest_values, digests); + for (i = 0; i < digest_list->count; ++i) { + u16 hash_alg = digest_list->digests[i].hash_alg; + + len = tpm2_algorithm_to_len(hash_alg); + if (!len) + continue; + + pos += offsetof(struct tpmt_ha, hash_alg); + put_unaligned_le16(hash_alg, log + pos); + pos += offsetof(struct tpmt_ha, digest); + memcpy(log + pos, (u8 *)&digest_list->digests[i].digest, len); + pos += len; + } + + put_unaligned_le32(size, log + pos); + pos += sizeof(u32); + memcpy(log + pos, event, size); +} + +static int tcg2_log_append_check(struct tcg2_event_log *elog, u32 pcr_index, + u32 event_type, + struct tpml_digest_values *digest_list, + u32 size, const u8 *event) +{ + u32 event_size; + u8 *log; + + event_size = size + tcg2_event_get_size(digest_list); + if (elog->log_position + event_size > elog->log_size) { + printf("%s: log too large: %u + %u > %u\n", __func__, + elog->log_position, event_size, elog->log_size); + return -ENOBUFS; + } + + log = elog->log + elog->log_position; + elog->log_position += event_size; + + tcg2_log_append(pcr_index, event_type, digest_list, size, event, log); + + return 0; +} + +static int tcg2_log_init(struct udevice *dev, struct tcg2_event_log *elog) +{ + struct tcg_efi_spec_id_event *ev; + struct tcg_pcr_event *log; + u32 event_size; + u32 count = 0; + u32 log_size; + u32 active; + size_t i; + u16 len; + int rc; + + rc = tcg2_get_active_pcr_banks(dev, &active); + if (rc) + return rc; + + event_size = offsetof(struct tcg_efi_spec_id_event, digest_sizes); + for (i = 0; i < ARRAY_SIZE(hash_algo_list); ++i) { + if (!(active & hash_algo_list[i].hash_mask)) + continue; + + switch (hash_algo_list[i].hash_alg) { + case TPM2_ALG_SHA1: + case TPM2_ALG_SHA256: + case TPM2_ALG_SHA384: + case TPM2_ALG_SHA512: + count++; + break; + default: + continue; + } + } + + event_size += 1 + + (sizeof(struct tcg_efi_spec_id_event_algorithm_size) * count); + log_size = offsetof(struct tcg_pcr_event, event) + event_size; + + if (log_size > elog->log_size) { + printf("%s: log too large: %u > %u\n", __func__, log_size, + elog->log_size); + return -ENOBUFS; + } + + log = (struct tcg_pcr_event *)elog->log; + put_unaligned_le32(0, &log->pcr_index); + put_unaligned_le32(EV_NO_ACTION, &log->event_type); + memset(&log->digest, 0, sizeof(log->digest)); + put_unaligned_le32(event_size, &log->event_size); + + ev = (struct tcg_efi_spec_id_event *)log->event; + strlcpy((char *)ev->signature, TCG_EFI_SPEC_ID_EVENT_SIGNATURE_03, + sizeof(ev->signature)); + put_unaligned_le32(0, &ev->platform_class); + ev->spec_version_minor = TCG_EFI_SPEC_ID_EVENT_SPEC_VERSION_MINOR_TPM2; + ev->spec_version_major = TCG_EFI_SPEC_ID_EVENT_SPEC_VERSION_MAJOR_TPM2; + ev->spec_errata = TCG_EFI_SPEC_ID_EVENT_SPEC_VERSION_ERRATA_TPM2; + ev->uintn_size = sizeof(size_t) / sizeof(u32); + put_unaligned_le32(count, &ev->number_of_algorithms); + + count = 0; + for (i = 0; i < ARRAY_SIZE(hash_algo_list); ++i) { + if (!(active & hash_algo_list[i].hash_mask)) + continue; + + len = hash_algo_list[i].hash_len; + if (!len) + continue; + + put_unaligned_le16(hash_algo_list[i].hash_alg, + &ev->digest_sizes[count].algorithm_id); + put_unaligned_le16(len, &ev->digest_sizes[count].digest_size); + count++; + } + + *((u8 *)ev + (event_size - 1)) = 0; + elog->log_position = log_size; + + return 0; +} + +static int tcg2_replay_eventlog(struct tcg2_event_log *elog, + struct udevice *dev, + struct tpml_digest_values *digest_list, + u32 log_position) +{ + const u32 offset = offsetof(struct tcg_pcr_event2, digests) + + offsetof(struct tpml_digest_values, digests); + u32 event_size; + u32 count; + u16 algo; + u32 pcr; + u32 pos; + u16 len; + u8 *log; + int rc; + u32 i; + + while (log_position + offset < elog->log_size) { + log = elog->log + log_position; + + pos = offsetof(struct tcg_pcr_event2, pcr_index); + pcr = get_unaligned_le32(log + pos); + pos = offsetof(struct tcg_pcr_event2, event_type); + if (!get_unaligned_le32(log + pos)) + return 0; + + pos = offsetof(struct tcg_pcr_event2, digests) + + offsetof(struct tpml_digest_values, count); + count = get_unaligned_le32(log + pos); + if (count > ARRAY_SIZE(hash_algo_list) || + (digest_list->count && digest_list->count != count)) + return 0; + + pos = offsetof(struct tcg_pcr_event2, digests) + + offsetof(struct tpml_digest_values, digests); + for (i = 0; i < count; ++i) { + pos += offsetof(struct tpmt_ha, hash_alg); + if (log_position + pos + sizeof(u16) >= elog->log_size) + return 0; + + algo = get_unaligned_le16(log + pos); + pos += offsetof(struct tpmt_ha, digest); + switch (algo) { + case TPM2_ALG_SHA1: + case TPM2_ALG_SHA256: + case TPM2_ALG_SHA384: + case TPM2_ALG_SHA512: + len = tpm2_algorithm_to_len(algo); + break; + default: + return 0; + } + + if (digest_list->count) { + if (algo != digest_list->digests[i].hash_alg || + log_position + pos + len >= elog->log_size) + return 0; + + memcpy(digest_list->digests[i].digest.sha512, + log + pos, len); + } + + pos += len; + } + + if (log_position + pos + sizeof(u32) >= elog->log_size) + return 0; + + event_size = get_unaligned_le32(log + pos); + pos += event_size + sizeof(u32); + if (log_position + pos > elog->log_size) + return 0; + + if (digest_list->count) { + rc = tcg2_pcr_extend(dev, pcr, digest_list); + if (rc) + return rc; + } + + log_position += pos; + } + + elog->log_position = log_position; + elog->found = true; + return 0; +} + +static int tcg2_log_parse(struct udevice *dev, struct tcg2_event_log *elog) +{ + struct tpml_digest_values digest_list; + struct tcg_efi_spec_id_event *event; + struct tcg_pcr_event *log; + u32 log_active; + u32 calc_size; + u32 active; + u32 count; + u32 evsz; + u32 mask; + u16 algo; + u16 len; + int rc; + u32 i; + u16 j; + + if (elog->log_size <= offsetof(struct tcg_pcr_event, event)) + return 0; + + log = (struct tcg_pcr_event *)elog->log; + if (get_unaligned_le32(&log->pcr_index) != 0 || + get_unaligned_le32(&log->event_type) != EV_NO_ACTION) + return 0; + + for (i = 0; i < sizeof(log->digest); i++) { + if (log->digest[i]) + return 0; + } + + evsz = get_unaligned_le32(&log->event_size); + if (evsz < offsetof(struct tcg_efi_spec_id_event, digest_sizes) || + evsz + offsetof(struct tcg_pcr_event, event) > elog->log_size) + return 0; + + event = (struct tcg_efi_spec_id_event *)log->event; + if (memcmp(event->signature, TCG_EFI_SPEC_ID_EVENT_SIGNATURE_03, + sizeof(TCG_EFI_SPEC_ID_EVENT_SIGNATURE_03))) + return 0; + + if (event->spec_version_minor != TCG_EFI_SPEC_ID_EVENT_SPEC_VERSION_MINOR_TPM2 || + event->spec_version_major != TCG_EFI_SPEC_ID_EVENT_SPEC_VERSION_MAJOR_TPM2) + return 0; + + count = get_unaligned_le32(&event->number_of_algorithms); + if (count > ARRAY_SIZE(hash_algo_list)) + return 0; + + calc_size = offsetof(struct tcg_efi_spec_id_event, digest_sizes) + + (sizeof(struct tcg_efi_spec_id_event_algorithm_size) * count) + + 1; + if (evsz != calc_size) + return 0; + + rc = tcg2_get_active_pcr_banks(dev, &active); + if (rc) + return rc; + + digest_list.count = 0; + log_active = 0; + + for (i = 0; i < count; ++i) { + algo = get_unaligned_le16(&event->digest_sizes[i].algorithm_id); + mask = tcg2_algorithm_to_mask(algo); + + if (!(active & mask)) + return 0; + + switch (algo) { + case TPM2_ALG_SHA1: + case TPM2_ALG_SHA256: + case TPM2_ALG_SHA384: + case TPM2_ALG_SHA512: + len = get_unaligned_le16(&event->digest_sizes[i].digest_size); + if (tpm2_algorithm_to_len(algo) != len) + return 0; + digest_list.digests[digest_list.count++].hash_alg = algo; + break; + default: + return 0; + } + + log_active |= mask; + } + + /* Ensure the previous firmware extended all the PCRs. */ + if (log_active != active) + return 0; + + /* Read PCR0 to check if previous firmware extended the PCRs or not. */ + rc = tcg2_pcr_read(dev, 0, &digest_list); + if (rc) + return rc; + + for (i = 0; i < digest_list.count; ++i) { + len = tpm2_algorithm_to_len(digest_list.digests[i].hash_alg); + for (j = 0; j < len; ++j) { + if (digest_list.digests[i].digest.sha512[j]) + break; + } + + /* PCR is non-zero; it has been extended, so skip extending. */ + if (j != len) { + digest_list.count = 0; + break; + } + } + + return tcg2_replay_eventlog(elog, dev, &digest_list, + offsetof(struct tcg_pcr_event, event) + + evsz); +} + +int tcg2_pcr_extend(struct udevice *dev, u32 pcr_index, + struct tpml_digest_values *digest_list) +{ + u32 rc; + u32 i; + + for (i = 0; i < digest_list->count; i++) { + u32 alg = digest_list->digests[i].hash_alg; + + rc = tpm2_pcr_extend(dev, pcr_index, alg, + (u8 *)&digest_list->digests[i].digest, + tpm2_algorithm_to_len(alg)); + if (rc) { + printf("%s: error pcr:%u alg:%08x\n", __func__, + pcr_index, alg); + return rc; + } + } + + return 0; +} + +int tcg2_pcr_read(struct udevice *dev, u32 pcr_index, + struct tpml_digest_values *digest_list) +{ + struct tpm_chip_priv *priv; + u32 rc; + u32 i; + + priv = dev_get_uclass_priv(dev); + if (!priv) + return -ENODEV; + + for (i = 0; i < digest_list->count; i++) { + u32 alg = digest_list->digests[i].hash_alg; + u8 *digest = (u8 *)&digest_list->digests[i].digest; + + rc = tpm2_pcr_read(dev, pcr_index, priv->pcr_select_min, alg, + digest, tpm2_algorithm_to_len(alg), NULL); + if (rc) { + printf("%s: error pcr:%u alg:%08x\n", __func__, + pcr_index, alg); + return rc; + } + } + + return 0; +} + +int tcg2_measure_data(struct udevice *dev, struct tcg2_event_log *elog, + u32 pcr_index, u32 size, const u8 *data, u32 event_type, + u32 event_size, const u8 *event) +{ + struct tpml_digest_values digest_list; + int rc; + + if (data) + rc = tcg2_create_digest(dev, data, size, &digest_list); + else + rc = tcg2_create_digest(dev, event, event_size, &digest_list); + if (rc) + return rc; + + rc = tcg2_pcr_extend(dev, pcr_index, &digest_list); + if (rc) + return rc; + + return tcg2_log_append_check(elog, pcr_index, event_type, &digest_list, + event_size, event); +} + +int tcg2_log_prepare_buffer(struct udevice *dev, struct tcg2_event_log *elog, + bool ignore_existing_log) +{ + struct tcg2_event_log log; + int rc; + + elog->log_position = 0; + elog->found = false; + + rc = tcg2_platform_get_log(dev, (void **)&log.log, &log.log_size); + if (!rc) { + log.log_position = 0; + log.found = false; + + if (!ignore_existing_log) { + rc = tcg2_log_parse(dev, &log); + if (rc) + return rc; + } + + if (elog->log_size) { + if (log.found) { + if (elog->log_size < log.log_position) + return -ENOSPC; + + /* + * Copy the discovered log into the user buffer + * if there's enough space. + */ + memcpy(elog->log, log.log, log.log_position); + } + + unmap_physmem(log.log, MAP_NOCACHE); + } else { + elog->log = log.log; + elog->log_size = log.log_size; + } + + elog->log_position = log.log_position; + elog->found = log.found; + } + + /* + * Initialize the log buffer if no log was discovered and the buffer is + * valid. User's can pass in their own buffer as a fallback if no + * memory region is found. + */ + if (!elog->found && elog->log_size) + rc = tcg2_log_init(dev, elog); + + return rc; +} + +int tcg2_measurement_init(struct udevice **dev, struct tcg2_event_log *elog, + bool ignore_existing_log) +{ + int rc; + + rc = tcg2_platform_get_tpm2(dev); + if (rc) + return rc; + + rc = tpm_auto_start(*dev); + if (rc) + return rc; + + rc = tcg2_log_prepare_buffer(*dev, elog, ignore_existing_log); + if (rc) { + tcg2_measurement_term(*dev, elog, true); + return rc; + } + + rc = tcg2_measure_event(*dev, elog, 0, EV_S_CRTM_VERSION, + strlen(version_string) + 1, + (u8 *)version_string); + if (rc) { + tcg2_measurement_term(*dev, elog, true); + return rc; + } + + return 0; +} + +void tcg2_measurement_term(struct udevice *dev, struct tcg2_event_log *elog, + bool error) +{ + u32 event = error ? 0x1 : 0xffffffff; + int i; + + for (i = 0; i < 8; ++i) + tcg2_measure_event(dev, elog, i, EV_SEPARATOR, sizeof(event), + (const u8 *)&event); + + if (elog->log) + unmap_physmem(elog->log, MAP_NOCACHE); +} + +__weak int tcg2_platform_get_log(struct udevice *dev, void **addr, u32 *size) +{ + const __be32 *addr_prop; + const __be32 *size_prop; + int asize; + int ssize; + + *addr = NULL; + *size = 0; + + addr_prop = dev_read_prop(dev, "tpm_event_log_addr", &asize); + if (!addr_prop) + addr_prop = dev_read_prop(dev, "linux,sml-base", &asize); + + size_prop = dev_read_prop(dev, "tpm_event_log_size", &ssize); + if (!size_prop) + size_prop = dev_read_prop(dev, "linux,sml-size", &ssize); + + if (addr_prop && size_prop) { + u64 a = of_read_number(addr_prop, asize / sizeof(__be32)); + u64 s = of_read_number(size_prop, ssize / sizeof(__be32)); + + *addr = map_physmem(a, s, MAP_NOCACHE); + *size = (u32)s; + } else { + struct ofnode_phandle_args args; + phys_addr_t a; + fdt_size_t s; + + if (dev_read_phandle_with_args(dev, "memory-region", NULL, 0, + 0, &args)) + return -ENODEV; + + a = ofnode_get_addr_size(args.node, "reg", &s); + if (a == FDT_ADDR_T_NONE) + return -ENOMEM; + + *addr = map_physmem(a, s, MAP_NOCACHE); + *size = (u32)s; + } + + return 0; +} + +__weak int tcg2_platform_get_tpm2(struct udevice **dev) +{ + for_each_tpm_device(*dev) { + if (tpm_get_version(*dev) == TPM_V2) + return 0; + } + + return -ENODEV; +} + +u32 tcg2_algorithm_to_mask(enum tpm2_algorithms algo) +{ + size_t i; + + for (i = 0; i < ARRAY_SIZE(hash_algo_list); i++) { + if (hash_algo_list[i].hash_alg == algo) + return hash_algo_list[i].hash_mask; + } + + return 0; +} + +__weak void tcg2_platform_startup_error(struct udevice *dev, int rc) {} + From patchwork Sat Jun 22 14:35:41 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 806725 Delivered-To: patch@linaro.org Received: by 2002:a5d:508d:0:b0:362:4979:7f74 with SMTP id a13csp1201141wrt; Sat, 22 Jun 2024 07:37:22 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCW5hBe8TKb6FaU4cs1XQBVFzXI+GgOitEUxDhwTtnG4S0cENP1PbSGVEm/GTijJ9+VZAQldSdH/h6AzOQkiOSzQ X-Google-Smtp-Source: AGHT+IF1/K5L85vZRHqXyQt2BSvk6XEXifjDgXwsr9vTOmJAlTRdUc5eLXwnyla01Zc9S5JL03mZ X-Received: by 2002:a50:d5cf:0:b0:57c:5f8a:26f8 with SMTP id 4fb4d7f45d1cf-57d4bdbfaf2mr137245a12.27.1719067042440; Sat, 22 Jun 2024 07:37:22 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1719067042; cv=none; d=google.com; s=arc-20160816; b=tURwWr/xZq+cmc1cClmPk/tEA8MlYxdwfNpiLYYa/8h12OZIth4APlbfVeauLAK3vd 4lL6GbIBdDeWanIgJm9EvmON5j9ElzWVGz62WxlkYysh8WNALdd3U4ruiS67BGWcon9x O1+guThnF0aAgsMmA/dRrO9QZxza3kmD4jLgZjeBSdOiEYPRTGjpyJCIm1VmLMs9X1fC YYG7+VeJ6pMhY76XM7K7Pndfm0/f+au4aSfupbB0uD8cNjpGekvFQP1V5VcDvIWoaHkl gAA2bSnhrxlX3uVBUF5aK9iIFJ5wyaeiZk17tQTCJLOICgc3NC6nmIZt7zK8aLFhWGba JBnQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=tpPJN/CRk5cREWKnqLbDTJX3oPpy42QB8VF7teH+aQU=; fh=oVVP6GVzFv+KTth/8Fo3aZQNRn8mjc6kc0hPLeo9TNo=; b=KIRZJLUZPxgXqApVthBHg8IhWUeYxMPYRiHO1xoIgQOYz9Z0tlBPwi1bIgcfK+cjdR uTmUQg+54HG2Ak0+Mmjl8BsKe6U+Zg7IztsaHkfzxH66SUs9JUylw/LK4thNWSGcTlK0 bJL8J8JRY4sq4z1muYyoEzmMeM9eH1KBuf8bj+5l/WZe/xQAHBhZPuiLfiItg979sGJ8 XYUI5t9MuajxMm23BBTEP7xtMVG+2fQHKcIA5YNMmE6h+vtcSMU9KJ9H8OiJEUVP5mWo 8fg0ILQ/iq/0gV2hRQyR9jwobPdrnRG8B9VaxNF1CTIuUoA5eBa8xZf6iGTvacx34GMM zw2A==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=g7BDbyKh; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id 4fb4d7f45d1cf-57d30633674si1808837a12.86.2024.06.22.07.37.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 22 Jun 2024 07:37:22 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=g7BDbyKh; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id EDE2C87A09; Sat, 22 Jun 2024 16:36:44 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="g7BDbyKh"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 11F378818B; Sat, 22 Jun 2024 16:36:44 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-ej1-x62b.google.com (mail-ej1-x62b.google.com [IPv6:2a00:1450:4864:20::62b]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 1582A881BC for ; Sat, 22 Jun 2024 16:36:42 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ej1-x62b.google.com with SMTP id a640c23a62f3a-a63359aaacaso435829766b.1 for ; Sat, 22 Jun 2024 07:36:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1719067001; x=1719671801; darn=lists.denx.de; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=tpPJN/CRk5cREWKnqLbDTJX3oPpy42QB8VF7teH+aQU=; b=g7BDbyKh4rg63NeRWmzoXR/zoRxbUxW33H8V7vW8S9Yg32umywQAPSBryOCWJFmcQR yyT2X9aImvN0KtBa1rkOPquSi586vdW0ShNyI+zG7I+A3senkBLIjhfiJhkwciUNzkqE rIa2sEVf71rHK3ZQ0kATpP0ROeg8Gpb8qwIxyMMnRYUlA3M4LuQjh9WdSmiowWpaflaa /AtWzTCNbRaMSPY30qTFESBR9jxWuDzESXk3eOm+JPA9JHaGhTylDlvBOafgo+z5LNFQ onh5evyOD7gtHX8dxNnpM2Y4kRA5/t9HENkVbk0DTxpHgEZke1maU/TeOQnE5JE10Srj LHwQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1719067001; x=1719671801; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=tpPJN/CRk5cREWKnqLbDTJX3oPpy42QB8VF7teH+aQU=; b=mT/2z3eYIvmUCeimXmXpHxeFQPQq+GfkiBC2AArdb1I2NhhYPL9wDSGKYeBje+5mAD i/CNsuMutOoQQodSDSwBp8saRMBvq4GfPPEQvxD60v08Zu1PwnD8weVuanz1xVUzQYU6 KegujngNJc4mZylrxAB9uzRNx9YOW4mTDH1GDSBEPkstvSRYN5VIfxcOI04TcFmvWNjn tEOaSHAKEsYkiAl7Anyi5RPSFKdqmJKafgKmtKZgjtlw692m6DyzHq9ZgdGwEJb6HquG OFPI64A3g8edCSz3HJVMGUmmlMlpVS6Ketj14tETvZeYJWrJFOQjSput0P1qW7TQ7hcK vrdA== X-Forwarded-Encrypted: i=1; AJvYcCXav7mgtNCzuGDT0XrSIIdALegiZGWWS+lT0wNcnKyf0S/3Q9otHoH+l4YRHphi30eSR3nzSLQmYrEiSKIRvOzS/qVXPQ== X-Gm-Message-State: AOJu0Yx2O7momSu+H/KYxXGlv8PS1zl+hZaykSF1kiqV9KHoaFMamRj/ kBhrMjPm3BgTwwb9XtGH28nKoj68nqKu1Mmgdq0Z1Wz/UzdUIsr7r+oizDq8E9E= X-Received: by 2002:a17:907:a785:b0:a6f:6ed6:1961 with SMTP id a640c23a62f3a-a7245b45a4emr1914066b.8.1719067001400; Sat, 22 Jun 2024 07:36:41 -0700 (PDT) Received: from localhost.localdomain (ppp046103020130.access.hol.gr. [46.103.20.130]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a6fcf54a534sm204005366b.136.2024.06.22.07.36.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 22 Jun 2024 07:36:40 -0700 (PDT) From: Ilias Apalodimas To: sjg@chromium.org, trini@konsulko.com Cc: Ilias Apalodimas , Heinrich Schuchardt , Eddie James , Mattijs Korpershoek , Tim Harvey , Bin Meng , Sean Anderson , Michal Simek , Oleksandr Suvorov , AKASHI Takahiro , Masahisa Kojima , u-boot@lists.denx.de Subject: [PATCH 5/7] efi_loader: remove unneeded header files Date: Sat, 22 Jun 2024 17:35:41 +0300 Message-ID: <20240622143601.187723-6-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240622143601.187723-1-ilias.apalodimas@linaro.org> References: <20240622143601.187723-1-ilias.apalodimas@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean efi_tcg2.h already includes tpm-v2.h. Remove it Signed-off-by: Ilias Apalodimas --- lib/efi_loader/efi_tcg2.c | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c index 10c09caac35a..c654d2cbd704 100644 --- a/lib/efi_loader/efi_tcg2.c +++ b/lib/efi_loader/efi_tcg2.c @@ -16,7 +16,6 @@ #include #include #include -#include #include #include #include From patchwork Sat Jun 22 14:35:42 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 806726 Delivered-To: patch@linaro.org Received: by 2002:a5d:508d:0:b0:362:4979:7f74 with SMTP id a13csp1201180wrt; Sat, 22 Jun 2024 07:37:33 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUrL9TbxAvp7jXvcK80HPLHcqyJqosqMy65EuNVDzho7zn/fwTLhqAgqhqFWtnYors6ZYdsL95XAbPRx4pR7uqh X-Google-Smtp-Source: AGHT+IHhzdQHFxJXSeGMzBoUsUDBnnXS02ojgmRQEDZx6AuruOa0M7JnjDE+NCF03v80zLVb7iFs X-Received: by 2002:a17:906:a8d:b0:a6f:4c10:8da6 with SMTP id a640c23a62f3a-a7245b45a69mr2064866b.2.1719067053408; Sat, 22 Jun 2024 07:37:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1719067053; cv=none; d=google.com; s=arc-20160816; b=iPjdh+DK2PTP8Y09Mg9mBL4+/ppY+wVBQI0+M51dRXu6XdRvdNNTT2sIAO31OuDw4h ieH7fqiAL93RYbiD5nfuGHi34RpR8Qm/30MBQL4nxkFxAAo/iANwERX8F1MI8duijVG1 bH+XMawAZjHXjHYdW4kdLf4+y+UNX9ajuVdsObu62LiJKD5sM9U9l/L+flaRhoY3hf9G GIXwrbK4qXywqkDbs79spri9JHLU1gaIdv2q/oExMl2krO7tCI6rL9g/sBFKwkb/ZDuJ qdpMS3MShnVv6giyBxadMgm/NE32ILIRJ2d/V7KJCNwSw9yyW1eHGybwyNQ6tpHpDlGj GYcQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=IDtKkPsBCvsb9Fmpquo7/Ie0w6uQLXkc7J6e8RCnTlU=; fh=Hx8vv8uzybUDbPJW6zMv+f7IwmhBrikZN0akiE3gbCY=; b=XI0PGAqvWhhlJpS3ftZ+8JtfvA1tNs7NwY8AHexdIETgRtGSZ9PSgUBviMJo8ad0gU lUbcic3IZ/JyAna1+Emzdm8c260XpK5spe26F8ATPSInAh8yhY+fcWuDPG5A5Apc5MIf RmNnbqm1TTlABAtreZY9pLFzqH0z/Ablzb6OZ2mmVTY6YOTGgiZzNWVllzzVthLVIMoO FPkA0THU4Nbo31ShUE4TsGp2QGdePWVggL1/X3l6a/Zt+xKhkcRMZmoRvlU+nP1/SDbP nQdix5HSBAX6dTZ5/Pa8NYieaQibXDpDmQPTMKyRTKcYFcU+aQqwa1+3f44jO7o7/FgD XI3w==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=QbAlDbXK; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id a640c23a62f3a-a6fcf5ad989si183999066b.979.2024.06.22.07.37.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 22 Jun 2024 07:37:33 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=QbAlDbXK; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 67D32881A9; Sat, 22 Jun 2024 16:36:49 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="QbAlDbXK"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 821E5878E2; Sat, 22 Jun 2024 16:36:48 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-ej1-x630.google.com (mail-ej1-x630.google.com [IPv6:2a00:1450:4864:20::630]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 26D80881A9 for ; Sat, 22 Jun 2024 16:36:46 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ej1-x630.google.com with SMTP id a640c23a62f3a-a6fd513f18bso144111166b.3 for ; Sat, 22 Jun 2024 07:36:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1719067005; x=1719671805; darn=lists.denx.de; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=IDtKkPsBCvsb9Fmpquo7/Ie0w6uQLXkc7J6e8RCnTlU=; b=QbAlDbXKnGa5G0d8VO7PQdPmT2LE0vsjp21E+6VCz4OgF6XRxbJWlBo9ZoThxl+WLn N7qRaME85yj/MyU2+X7sOiQHSYlCBk+cGVlAZJU+qeU+8hXBx2XJexea/prKcN3k+oye 0kBVlQcjfnt0giQdr2LG0jnkuwUk+17ZVayS0JROu5ij3e9jGwvy7cR4K/0cZtLPvXtQ wXizH9clQKQw/PwVuQqnvnn2uI0i/GVvqrk9FZYBThPTc+bz8ukovhHIM2A138XOa+Q1 Fd7TWtPEmVvpoO1BUCMODl3qOdWajrn8FtyzLSOkyo0y2fYBTp0FLOt+x5GL0S1OP4dI nonQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1719067005; x=1719671805; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=IDtKkPsBCvsb9Fmpquo7/Ie0w6uQLXkc7J6e8RCnTlU=; b=OSJkIsF2IpXNHALsewjDaAnebSBueJwf+/B9UzPtP7RdrIIn7dY6zH1gqwRId8QTcA WcvQDmyxUJRYHvcyNT8b6fj7dUW00p/Qx27QzqbOBHQpTt1k2+CMPy41wqUXAcxnNodR EiJzSgVlqd58IwuvjUlvpYv4Q6OYuwPduUwJjHefLFxFVIk9V1wEkB4zXMEhT7MoKKDX zHtw83W/Nw2gY8OmmzorP83tct6ImbZbUWQo8trlgmcrUfVjoKpqr1d4ttERu7bgRlZP bWujo51izAcRdLsf+zpq2ltAuUfevUNDeV8orDKvLMUbBrEvwVmH5N0jUa8JNqQM5cp9 gtow== X-Forwarded-Encrypted: i=1; AJvYcCXUhuTr0lyzYKWdR546eM1iuyYEm7mgMoUbH9f4o8KKhjAOhyQFuHftEPrsVgwKJ2mu6E7BejtS+4lb29Phnag7IHJRLg== X-Gm-Message-State: AOJu0YyfwWUW+1b1Vh/KrXo0YH5YOwRSgkoIs5dqHOT7X4VUT6uhkRHw SZh6/UuKEh+raZcgASP91VtS6A64Nk602eLq43gvL5F9wwPlIupYRif0hdF8ytA= X-Received: by 2002:a17:907:a809:b0:a70:7a10:de0b with SMTP id a640c23a62f3a-a7245b565b2mr1717566b.21.1719067005438; Sat, 22 Jun 2024 07:36:45 -0700 (PDT) Received: from localhost.localdomain (ppp046103020130.access.hol.gr. [46.103.20.130]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a6fcf54a534sm204005366b.136.2024.06.22.07.36.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 22 Jun 2024 07:36:44 -0700 (PDT) From: Ilias Apalodimas To: sjg@chromium.org, trini@konsulko.com Cc: Ilias Apalodimas , Heinrich Schuchardt , Eddie James , Mattijs Korpershoek , Tim Harvey , Bin Meng , Sean Anderson , Manorit Chawdhry , Oleksandr Suvorov , Michal Simek , AKASHI Takahiro , Masahisa Kojima , u-boot@lists.denx.de Subject: [PATCH 6/7] tpm: Untangle tpm2_get_pcr_info() Date: Sat, 22 Jun 2024 17:35:42 +0300 Message-ID: <20240622143601.187723-7-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240622143601.187723-1-ilias.apalodimas@linaro.org> References: <20240622143601.187723-1-ilias.apalodimas@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean This function was used on measured boot to retrieve the number of active PCR banks and was designed to work with the TCG protocols. Since we now have the need to retrieve the active PCRs outside the measured boot context -- e.g use the in the command line, decouple the function. Create one that will only adheres to TCG TSS2.0 [0] specification called tpm2_get_pcr_info() which can be used by the TPM2.0 APIs and a new one that is called from the measured boot context called tcg2_get_pcr_info() [0] https://trustedcomputinggroup.org/wp-content/uploads/TSS_Overview_Common_Structures_Version-0.9_Revision-03_Review_030918.pdf Signed-off-by: Ilias Apalodimas --- include/tpm-v2.h | 16 ++++++--- include/tpm_tcg2.h | 13 +++++++ lib/efi_loader/efi_tcg2.c | 2 +- lib/tpm-v2.c | 73 +++++++++++++-------------------------- lib/tpm_tcg2.c | 38 +++++++++++++++++++- 5 files changed, 86 insertions(+), 56 deletions(-) diff --git a/include/tpm-v2.h b/include/tpm-v2.h index c176e04c9952..eac04d1c6831 100644 --- a/include/tpm-v2.h +++ b/include/tpm-v2.h @@ -521,14 +521,11 @@ u32 tpm2_get_capability(struct udevice *dev, u32 capability, u32 property, * tpm2_get_pcr_info() - get the supported, active PCRs and number of banks * * @dev: TPM device - * @supported_pcr: bitmask with the algorithms supported - * @active_pcr: bitmask with the active algorithms - * @pcr_banks: number of PCR banks + * @pcrs: struct tpml_pcr_selection of available PCRs * * @return 0 on success, code of operation or negative errno on failure */ -int tpm2_get_pcr_info(struct udevice *dev, u32 *supported_pcr, u32 *active_pcr, - u32 *pcr_banks); +int tpm2_get_pcr_info(struct udevice *dev, struct tpml_pcr_selection *pcrs); /** * Issue a TPM2_DictionaryAttackLockReset command. @@ -714,4 +711,13 @@ enum tpm2_algorithms tpm2_name_to_algorithm(const char *name); */ const char *tpm2_algorithm_name(enum tpm2_algorithms); +/** + * tpm2_is_active_pcr() - check the pcr_select. If at least one of the PCRs + * supports the algorithm add it on the active ones + * + * @selection: PCR selection structure + * Return: True if the algorithm is active + */ +bool tpm2_is_active_pcr(struct tpms_pcr_selection *selection); + #endif /* __TPM_V2_H */ diff --git a/include/tpm_tcg2.h b/include/tpm_tcg2.h index 77afdbb03e77..a0557898865e 100644 --- a/include/tpm_tcg2.h +++ b/include/tpm_tcg2.h @@ -82,6 +82,19 @@ struct tcg_pcr_event { u8 event[]; } __packed; +/** + * tcg2_get_pcr_info() - get the supported, active PCRs and number of banks + * + * @dev: TPM device + * @supported_pcr: bitmask with the algorithms supported + * @active_pcr: bitmask with the active algorithms + * @pcr_banks: number of PCR banks + * + * @return 0 on success, code of operation or negative errno on failure + */ +int tcg2_get_pcr_info(struct udevice *dev, u32 *supported_pcr, u32 *active_pcr, + u32 *pcr_banks); + /** * Crypto Agile Log Entry Format * diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c index c654d2cbd704..2d2c015db053 100644 --- a/lib/efi_loader/efi_tcg2.c +++ b/lib/efi_loader/efi_tcg2.c @@ -279,7 +279,7 @@ efi_tcg2_get_capability(struct efi_tcg2_protocol *this, /* Supported and active PCRs */ capability->hash_algorithm_bitmap = 0; capability->active_pcr_banks = 0; - ret = tpm2_get_pcr_info(dev, &capability->hash_algorithm_bitmap, + ret = tcg2_get_pcr_info(dev, &capability->hash_algorithm_bitmap, &capability->active_pcr_banks, &capability->number_of_pcr_banks); if (ret) { diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c index 62ab804b4b38..36aace03cf4e 100644 --- a/lib/tpm-v2.c +++ b/lib/tpm-v2.c @@ -395,48 +395,26 @@ static int tpm2_get_num_pcr(struct udevice *dev, u32 *num_pcr) return 0; } -static bool tpm2_is_active_pcr(struct tpms_pcr_selection *selection) -{ - int i; - - /* - * check the pcr_select. If at least one of the PCRs supports the - * algorithm add it on the active ones - */ - for (i = 0; i < selection->size_of_select; i++) { - if (selection->pcr_select[i]) - return true; - } - - return false; -} - -int tpm2_get_pcr_info(struct udevice *dev, u32 *supported_pcr, u32 *active_pcr, - u32 *pcr_banks) +int tpm2_get_pcr_info(struct udevice *dev, struct tpml_pcr_selection *pcrs) { u8 response[(sizeof(struct tpms_capability_data) - offsetof(struct tpms_capability_data, data))]; - struct tpml_pcr_selection pcrs; u32 num_pcr; size_t i; u32 ret; - *supported_pcr = 0; - *active_pcr = 0; - *pcr_banks = 0; - memset(response, 0, sizeof(response)); ret = tpm2_get_capability(dev, TPM2_CAP_PCRS, 0, response, 1); if (ret) return ret; - pcrs.count = get_unaligned_be32(response); + pcrs->count = get_unaligned_be32(response); /* * We only support 5 algorithms for now so check against that * instead of TPM2_NUM_PCR_BANKS */ - if (pcrs.count > ARRAY_SIZE(hash_algo_list) || - pcrs.count < 1) { - printf("%s: too many pcrs: %u\n", __func__, pcrs.count); + if (pcrs->count > ARRAY_SIZE(hash_algo_list) || + pcrs->count < 1) { + printf("%s: too many pcrs: %u\n", __func__, pcrs->count); return -EMSGSIZE; } @@ -444,7 +422,7 @@ int tpm2_get_pcr_info(struct udevice *dev, u32 *supported_pcr, u32 *active_pcr, if (ret) return ret; - for (i = 0; i < pcrs.count; i++) { + for (i = 0; i < pcrs->count; i++) { /* * Definition of TPMS_PCR_SELECTION Structure * hash: u16 @@ -464,35 +442,20 @@ int tpm2_get_pcr_info(struct udevice *dev, u32 *supported_pcr, u32 *active_pcr, hash_offset + offsetof(struct tpms_pcr_selection, pcr_select); - pcrs.selection[i].hash = + pcrs->selection[i].hash = get_unaligned_be16(response + hash_offset); - pcrs.selection[i].size_of_select = + pcrs->selection[i].size_of_select = __get_unaligned_be(response + size_select_offset); - if (pcrs.selection[i].size_of_select > TPM2_PCR_SELECT_MAX) { + if (pcrs->selection[i].size_of_select > TPM2_PCR_SELECT_MAX) { printf("%s: pcrs selection too large: %u\n", __func__, - pcrs.selection[i].size_of_select); + pcrs->selection[i].size_of_select); return -ENOBUFS; } /* copy the array of pcr_select */ - memcpy(pcrs.selection[i].pcr_select, response + pcr_select_offset, - pcrs.selection[i].size_of_select); - } - - for (i = 0; i < pcrs.count; i++) { - u32 hash_mask = tcg2_algorithm_to_mask(pcrs.selection[i].hash); - - if (hash_mask) { - *supported_pcr |= hash_mask; - if (tpm2_is_active_pcr(&pcrs.selection[i])) - *active_pcr |= hash_mask; - } else { - printf("%s: unknown algorithm %x\n", __func__, - pcrs.selection[i].hash); - } + memcpy(pcrs->selection[i].pcr_select, response + pcr_select_offset, + pcrs->selection[i].size_of_select); } - *pcr_banks = pcrs.count; - return 0; } @@ -880,6 +843,18 @@ u32 tpm2_enable_nvcommits(struct udevice *dev, uint vendor_cmd, return 0; } +bool tpm2_is_active_pcr(struct tpms_pcr_selection *selection) +{ + int i; + + for (i = 0; i < selection->size_of_select; i++) { + if (selection->pcr_select[i]) + return true; + } + + return false; +} + enum tpm2_algorithms tpm2_name_to_algorithm(const char *name) { size_t i; diff --git a/lib/tpm_tcg2.c b/lib/tpm_tcg2.c index 865ef6e01ca9..55b7145a9677 100644 --- a/lib/tpm_tcg2.c +++ b/lib/tpm_tcg2.c @@ -20,6 +20,42 @@ #include #include "tpm-utils.h" +int tcg2_get_pcr_info(struct udevice *dev, u32 *supported_pcr, u32 *active_pcr, + u32 *pcr_banks) +{ + u8 response[(sizeof(struct tpms_capability_data) - + offsetof(struct tpms_capability_data, data))]; + struct tpml_pcr_selection pcrs; + size_t i; + u32 ret; + + *supported_pcr = 0; + *active_pcr = 0; + *pcr_banks = 0; + memset(response, 0, sizeof(response)); + + ret = tpm2_get_pcr_info(dev, &pcrs); + if (ret) + return ret; + + for (i = 0; i < pcrs.count; i++) { + u32 hash_mask = tcg2_algorithm_to_mask(pcrs.selection[i].hash); + + if (hash_mask) { + *supported_pcr |= hash_mask; + if (tpm2_is_active_pcr(&pcrs.selection[i])) + *active_pcr |= hash_mask; + } else { + printf("%s: unknown algorithm %x\n", __func__, + pcrs.selection[i].hash); + } + } + + *pcr_banks = pcrs.count; + + return 0; +} + int tcg2_get_active_pcr_banks(struct udevice *dev, u32 *active_pcr_banks) { u32 supported = 0; @@ -27,7 +63,7 @@ int tcg2_get_active_pcr_banks(struct udevice *dev, u32 *active_pcr_banks) u32 active = 0; int rc; - rc = tpm2_get_pcr_info(dev, &supported, &active, &pcr_banks); + rc = tcg2_get_pcr_info(dev, &supported, &active, &pcr_banks); if (rc) return rc; From patchwork Sat Jun 22 14:35:43 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 806727 Delivered-To: patch@linaro.org Received: by 2002:a5d:508d:0:b0:362:4979:7f74 with SMTP id a13csp1201244wrt; Sat, 22 Jun 2024 07:37:45 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXMU3aKHgSP9CeMTHtrl45hSg5cPgulH1us3hbdx0EB7e778lvldFLq9VURFKumkFuMeskPBlakk6rmTL8ch0Ep X-Google-Smtp-Source: AGHT+IEgtH0u6ddCg1WeSFpcbFS+kAKk72Tt3TlTlVgwDffC/DwlauZ1iT/KQ4+vnppArex6O471 X-Received: by 2002:a17:906:7250:b0:a6f:935b:8777 with SMTP id a640c23a62f3a-a700e707009mr108882866b.25.1719067065698; Sat, 22 Jun 2024 07:37:45 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1719067065; cv=none; d=google.com; s=arc-20160816; b=a5zqAZjFqgoo5u7hG3dh4V226gN+8iqaY0mKJZsXumlsmHyHfmzKGsoeBFiwukfVER c6gH3fDQ/Qql2Wc3ZLS56GEFObvx8+AOk/BEFN9WWKHG576IKGtN0wdTzi6MfSGxUcS+ cHt1Wg9obQm28Id1opzkPr2PGnFyM7FRzPplO2Y6QbQefIwT5g0uVcBkv8b8LIZqFGXh d6n8jOQEwBaLD2Zh5S/HcvdKLKDDi/6v/dgyVpHi7SXYamyz8wcJX/9ohtMTiAnbpWlb MXhaKkgM52nxI//Hqpyq7nQYqpNDVQgzlE/N5PuKXMIgT6KoLa3Fk9VbldFJI9YAW/X0 rSAA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=RHixSKTgHr1vQBMgBi4j0zUifCR88z9fhOUh+rxTU5o=; fh=5YzqzEncof6y49phYH1dxstSGt7j69rJJEQfUHMEOlY=; b=r1LRyUPmv5S5U76046Mh0UyzrMZqPKsMYNYqtA4dtfxCJ5e4zgDLgzPB/wo34RYL1g L7r67Efa9VykVgMqBfBhDGbHSX6enVn85MBzlcgi2EUEO68TIMJls6Z1VZd1Pif6kGiN Db8vj8qF30XlHW7x3Ujr2FUUWqusUHFT/fD8MxOLLG1p80FNopcPYenuh+k83Y8Dtvwg UpqVusXt0cvH+W9J7NWiQYs1v48ZBjCRnoITqeNGScfoLj5AcliVQxHrhpjCjXWhcDU6 oIHOlBu0pbbtClqsz+UD4skpWh0GSR2f9OQoxEvkVOG+EC/J0MaENndTNntmjx+3lrQR sVVw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=h7jvv0LT; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [2a01:238:438b:c500:173d:9f52:ddab:ee01]) by mx.google.com with ESMTPS id a640c23a62f3a-a6fcf4615f3si192535366b.161.2024.06.22.07.37.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 22 Jun 2024 07:37:45 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=h7jvv0LT; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id C84D388261; Sat, 22 Jun 2024 16:36:53 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="h7jvv0LT"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 2EE1C878E2; Sat, 22 Jun 2024 16:36:52 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-ej1-x630.google.com (mail-ej1-x630.google.com [IPv6:2a00:1450:4864:20::630]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 1F54D881C1 for ; Sat, 22 Jun 2024 16:36:50 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ej1-x630.google.com with SMTP id a640c23a62f3a-a7245453319so5514966b.1 for ; Sat, 22 Jun 2024 07:36:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1719067009; x=1719671809; darn=lists.denx.de; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=RHixSKTgHr1vQBMgBi4j0zUifCR88z9fhOUh+rxTU5o=; b=h7jvv0LT2aZBqjfjZDxt472EyfhR/i+aD17tTmYSRXXU10m8AT1ZwFxleq+oukcaTe oboHOnV/tE50zNk9PPSSNUU9shUtlC4/PF5er/9WV4AcCjM8vsQWxGLuz54cIXV+tbh9 li/REQ6SQ3EvqHfZkq12fx1mV77e25PCaO7IFXy2fs/UBnFP5zu380vMWlfWq+3CRpfv ZCE4RVb/QQsEP+AK/KSqxBszXNXzNn9ECidueI7q9Lh2m/OC5BvY1EQ90pwwS/9ePtUH h2HE+L6i7YrZytvQ4kxq0WOTI070yU+j8bD+hJGDoAuYXCWEM9KzO7HChR/8QedV2OVG 81pw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1719067009; x=1719671809; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=RHixSKTgHr1vQBMgBi4j0zUifCR88z9fhOUh+rxTU5o=; b=a1k2lRnKQ9c+LSm9xMBrRQKzHuPghjSrMHdTZFMsbdIbOqJZzDMcpzx36i+3ltRw/D gQ2UC6bk1gAb/6+koK6wNv3BvQ+TmJxdQT8GI8cevDcYYqn9X2KRmaR+lCNC75RAHoXy KLQiZM1C7sZte158vhezOobfJByFB4o4q0my1NaK8oIhmUMIjswIdfPXg+2q3Ag16ZcA wX4aYYC9Q/N5ggDDGMEVCDkihFRWDZMBonM+3GZ71u3dkQkIuEz6Q2dI9UyHnWTtlAoS rbGZtQ8lx9Dod6udmvXvCMNDMAEbwD3fQjOF3zEV2ccHAoV0ylUEBOEOSrm9AtTPIzjH w07g== X-Forwarded-Encrypted: i=1; AJvYcCXQgNnNxxiTZOHUiJDTKQUI/JPYD5iI9WusOwi0ki/WoOgNsWe1frVc9vSCONhLSyeKk3x4OYr18aTJT59OtuMOaJal9w== X-Gm-Message-State: AOJu0Yz+jkTOtBZPYhivFa4IJzBrrLYJHdn2HC/R2laFP9SxrM7GhqT1 g3tDt0REscNvX/kJByMVQkEo+uB61AtTXiU4hZ+354fXqxD9DtJKN/hHzeduQSU= X-Received: by 2002:a17:906:34c7:b0:a6f:e151:75ca with SMTP id a640c23a62f3a-a700e707029mr99623966b.30.1719067009487; Sat, 22 Jun 2024 07:36:49 -0700 (PDT) Received: from localhost.localdomain (ppp046103020130.access.hol.gr. [46.103.20.130]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a6fcf54a534sm204005366b.136.2024.06.22.07.36.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 22 Jun 2024 07:36:48 -0700 (PDT) From: Ilias Apalodimas To: sjg@chromium.org, trini@konsulko.com Cc: Ilias Apalodimas , Heinrich Schuchardt , Eddie James , Mattijs Korpershoek , Tim Harvey , Bin Meng , Sean Anderson , Michal Simek , Oleksandr Suvorov , AKASHI Takahiro , Masahisa Kojima , u-boot@lists.denx.de Subject: [PATCH 7/7] tpm: allow the user to select the compiled algorithms Date: Sat, 22 Jun 2024 17:35:43 +0300 Message-ID: <20240622143601.187723-8-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240622143601.187723-1-ilias.apalodimas@linaro.org> References: <20240622143601.187723-1-ilias.apalodimas@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean Simon reports that after enabling all algorithms on the TPM some boards fail since they don't have enough storage to accommodate the ~5KB growth. The choice of hash algorithms are determined by the platform and the TPM configuration. Failing to cap a PCR in a bank which the platform left active is a security vulnerability. It might allow unsealing of secrets if an attacker can replay a good set of measurements into an unused bank. If MEASURED_BOOT or EFI_TCG2_PROTOCOL is enabled our Kconfig will enable all supported hashing algorithms. We still want to allow users to add a TPM and not enable measured boot via EFI or bootm though and at the same time, control the compiled algorithms for size reasons. So let's add a function tpm2_allow_extend() which checks the TPM active PCRs banks against the one U-Boot was compiled with. If all the active PCRs banks are not enabled refuse to extend a PCR but otherwise leave the TPM functional. It's worth noting that this is only added on TPM2.0, since TPM1.2 is lacking a lot of code at the moment to read the available PCRs. We unconditionally enable SHA1 when a TPM is selected, which is the only hashing algorithm v1.2 supports. Signed-off-by: Ilias Apalodimas --- boot/Kconfig | 4 ++++ include/tpm-v2.h | 59 +++++++++++++++++++++++++++++++++++------------- lib/Kconfig | 6 ++--- lib/tpm-v2.c | 40 +++++++++++++++++++++++++++++--- 4 files changed, 87 insertions(+), 22 deletions(-) diff --git a/boot/Kconfig b/boot/Kconfig index 6f3096c15a6f..b061891e109c 100644 --- a/boot/Kconfig +++ b/boot/Kconfig @@ -734,6 +734,10 @@ config LEGACY_IMAGE_FORMAT config MEASURED_BOOT bool "Measure boot images and configuration when booting without EFI" depends on HASH && TPM_V2 + select SHA1 + select SHA256 + select SHA384 + select SHA512 help This option enables measurement of the boot process when booting without UEFI . Measurement involves creating cryptographic hashes diff --git a/include/tpm-v2.h b/include/tpm-v2.h index eac04d1c6831..fccb07fa4695 100644 --- a/include/tpm-v2.h +++ b/include/tpm-v2.h @@ -277,48 +277,40 @@ struct digest_info { #define TCG2_BOOT_HASH_ALG_SM3_256 0x00000010 static const struct digest_info hash_algo_list[] = { +#if IS_ENABLED(CONFIG_SHA1) { "sha1", TPM2_ALG_SHA1, TCG2_BOOT_HASH_ALG_SHA1, TPM2_SHA1_DIGEST_SIZE, }, +#endif +#if IS_ENABLED(CONFIG_SHA256) { "sha256", TPM2_ALG_SHA256, TCG2_BOOT_HASH_ALG_SHA256, TPM2_SHA256_DIGEST_SIZE, }, +#endif +#if IS_ENABLED(CONFIG_SHA384) { "sha384", TPM2_ALG_SHA384, TCG2_BOOT_HASH_ALG_SHA384, TPM2_SHA384_DIGEST_SIZE, }, +#endif +#if IS_ENABLED(CONFIG_SHA512) { "sha512", TPM2_ALG_SHA512, TCG2_BOOT_HASH_ALG_SHA512, TPM2_SHA512_DIGEST_SIZE, }, +#endif }; -static inline u16 tpm2_algorithm_to_len(enum tpm2_algorithms a) -{ - switch (a) { - case TPM2_ALG_SHA1: - return TPM2_SHA1_DIGEST_SIZE; - case TPM2_ALG_SHA256: - return TPM2_SHA256_DIGEST_SIZE; - case TPM2_ALG_SHA384: - return TPM2_SHA384_DIGEST_SIZE; - case TPM2_ALG_SHA512: - return TPM2_SHA512_DIGEST_SIZE; - default: - return 0; - } -} - /* NV index attributes */ enum tpm_index_attrs { TPMA_NV_PPWRITE = 1UL << 0, @@ -711,6 +703,41 @@ enum tpm2_algorithms tpm2_name_to_algorithm(const char *name); */ const char *tpm2_algorithm_name(enum tpm2_algorithms); +/** + * tpm2_algorithm_to_len() - Return an algorithm length for supported algorithm id + * + * @algorithm_id: algorithm defined in enum tpm2_algorithms + * Return: len or 0 if not supported + */ +u16 tpm2_algorithm_to_len(enum tpm2_algorithms algo); + +/* + * When measured boot is enabled via EFI or bootX commands all the algorithms + * above are selected by our Kconfigs. Due to U-Boots nature of being small there + * are cases where we need some functionality from the TPM -- e.g storage or RNG + * but we don't want to support measurements. + * + * The choice of hash algorithms are determined by the platform and the TPM + * configuration. Failing to cap a PCR in a bank which the platform left + * active is a security vulnerability. It permits the unsealing of secrets + * if an attacker can replay a good set of measurements into an unused bank. + * + * On top of that a previous stage bootloader (e.g TF-A), migh pass an eventlog + * since it doesn't have a TPM driver, which U-Boot needs to replace. The algorit h + * choice is a compile time option in that case and we need to make sure we conform. + * + * Add a variable here that sums the supported algorithms U-Boot was compiled + * with so we can refuse to do measurements if we don't support all of them + */ + +/** + * tpm2_allow_extend() - Check if extending PCRs is allowed and safe + * + * @dev: TPM device + * Return: true if allowed + */ +bool tpm2_allow_extend(struct udevice *dev); + /** * tpm2_is_active_pcr() - check the pcr_select. If at least one of the PCRs * supports the algorithm add it on the active ones diff --git a/lib/Kconfig b/lib/Kconfig index 189e6eb31aa1..b3baa4b85b07 100644 --- a/lib/Kconfig +++ b/lib/Kconfig @@ -439,9 +439,6 @@ config TPM depends on DM imply DM_RNG select SHA1 - select SHA256 - select SHA384 - select SHA512 help This enables support for TPMs which can be used to provide security features for your board. The TPM can be connected via LPC or I2C @@ -449,6 +446,9 @@ config TPM command to interactive the TPM. Driver model support is provided for the low-level TPM interface, but only one TPM is supported at a time by the TPM library. + For size reasons only SHA1 is selected which is supported on TPM1.2. + If you want a fully functional TPM enable all hashing algorithms. + If you enabled measured boot all hashing algorithms are selected. config SPL_TPM bool "Trusted Platform Module (TPM) Support in SPL" diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c index 36aace03cf4e..59e6cbafafaa 100644 --- a/lib/tpm-v2.c +++ b/lib/tpm-v2.c @@ -196,6 +196,11 @@ u32 tpm2_pcr_extend(struct udevice *dev, u32 index, u32 algorithm, if (!digest) return -EINVAL; + + if (!tpm2_allow_extend(dev)) { + log_err("Cannot extend PCRs if all the TPM enabled algorithms are not supported\n"); + return -EINVAL; + } /* * Fill the command structure starting from the first buffer: * - the digest @@ -409,11 +414,10 @@ int tpm2_get_pcr_info(struct udevice *dev, struct tpml_pcr_selection *pcrs) pcrs->count = get_unaligned_be32(response); /* - * We only support 5 algorithms for now so check against that + * We only support 4 algorithms for now so check against that * instead of TPM2_NUM_PCR_BANKS */ - if (pcrs->count > ARRAY_SIZE(hash_algo_list) || - pcrs->count < 1) { + if (pcrs->count > 4 || pcrs->count < 1) { printf("%s: too many pcrs: %u\n", __func__, pcrs->count); return -EMSGSIZE; } @@ -880,3 +884,33 @@ const char *tpm2_algorithm_name(enum tpm2_algorithms algo) return ""; } +u16 tpm2_algorithm_to_len(enum tpm2_algorithms algo) +{ + size_t i; + + for (i = 0; i < ARRAY_SIZE(hash_algo_list); ++i) { + if (hash_algo_list[i].hash_alg == algo) + return hash_algo_list[i].hash_len; + } + + return 0; +} + +bool tpm2_allow_extend(struct udevice *dev) +{ + struct tpml_pcr_selection pcrs; + size_t i; + int rc; + + rc = tpm2_get_pcr_info(dev, &pcrs); + if (rc) + return false; + + for (i = 0; i < pcrs.count; i++) { + if (tpm2_is_active_pcr(&pcrs.selection[i]) && + !tpm2_algorithm_to_len(pcrs.selection[i].hash)) + return false; + } + + return true; +}