Pull request for UEFI sub-system for efi-2021-01-rc3
A part of the EFI_TCG2_PROTOCOL is implemented. A unit test is supplied. The following bugs are fixed: * incorrect buffer size in efi_file_setinfo() leading to creash in SCT * a crash in UEFI selftest on the sandbox due to removed drivers * missing newlines in log message for the UEFI RNG driver -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEbcT5xx8ppvoGt20zxIHbvCwFGsQFAl+vWMQACgkQxIHbvCwF GsQoQA//fDPn/qWP3zQw/jWecZLNs3AexDKQIEmn4T/1b179N1v5B8y6axD/Km0Q MNHdYQIy3GEYS1E1fre28tsgqWnY7tlGi5oeYw9v4QT0ahMzuuzIrsq7J7UhNAgo 4nXXQuL9GvQvObO786VFDmekndAaehfgqoZjC1qwn6d8CvQYQex9Wor966Y0OQ4z RsWVirWoIkBlC+02bAtCFWFmyPgHYilNACC2EZlxRGcTmYWObvLQMAko4reRJ08Y IJbR2glqmrgWkkEe7PpU/lz9r1IvWTSDFIlG8HgQ7HqScQXDqmXyDARuj4T/DxuT /VfyNwxD5+aHCyZtxcgQ82RvP+trNkgvz9wuUbmg3IBOQ7wFPtk/g9243ySKalM5 U3PmdaG6K/XaZ5UDnpK08FvGU85/9LQJOnGnHSUTfjaDgYBeV0QUYGzFFeyn2hW9 TFdzBjl2KJv2I19fCmCrGD+jGtuRqUqDeeY3UCBv3T9ioXeV2Jg+eziASAejDEZQ w757nxqI5upSlo/uX8l9yybvlMlEXoyj6w7THxqZKItuiwWcE69aV6HNUHKLMpoD AsFr6/9y4duqaoYWzGIsjcEGjCzGhFAybrlVqN1MrfE77jCk9WEePFw452+Tjhp0 ch4eIUoh0unZZcamcPBo+JLngKgYW0HS6OKXh0PWMucGLn7XW8g= =/DST -----END PGP SIGNATURE----- Merge tag 'efi-2021-01-rc3' of https://gitlab.denx.de/u-boot/custodians/u-boot-efi Pull request for UEFI sub-system for efi-2021-01-rc3 A part of the EFI_TCG2_PROTOCOL is implemented. A unit test is supplied. The following bugs are fixed: * incorrect buffer size in efi_file_setinfo() leading to creash in SCT * a crash in UEFI selftest on the sandbox due to removed drivers * missing newlines in log message for the UEFI RNG driver
This commit is contained in:
Tom Rini
commit
de865f7ee1
13 changed files with 816 additions and 7 deletions
|
|
@ -59,6 +59,9 @@ extern efi_handle_t efi_root;
|
|||
/* Set to EFI_SUCCESS when initialized */
|
||||
extern efi_status_t efi_obj_list_initialized;
|
||||
|
||||
/* Flag used by the selftest to avoid detaching devices in ExitBootServices() */
|
||||
extern bool efi_st_keep_devices;
|
||||
|
||||
/* EFI system partition */
|
||||
extern struct efi_system_partition {
|
||||
enum if_type if_type;
|
||||
|
|
@ -405,6 +408,8 @@ efi_status_t efi_console_register(void);
|
|||
efi_status_t efi_disk_register(void);
|
||||
/* Called by efi_init_obj_list() to install EFI_RNG_PROTOCOL */
|
||||
efi_status_t efi_rng_register(void);
|
||||
/* Called by efi_init_obj_list() to install EFI_TCG2_PROTOCOL */
|
||||
efi_status_t efi_tcg2_register(void);
|
||||
/* Create handles and protocols for the partitions of a block device */
|
||||
int efi_disk_create_partitions(efi_handle_t parent, struct blk_desc *desc,
|
||||
const char *if_typename, int diskid,
|
||||
|
|
|
|||
94
include/efi_tcg2.h
Normal file
94
include/efi_tcg2.h
Normal file
|
|
@ -0,0 +1,94 @@
|
|||
/* SPDX-License-Identifier: GPL-2.0+ */
|
||||
/*
|
||||
* Defines data structures and APIs that allow an OS to interact with UEFI
|
||||
* firmware to query information about the device
|
||||
*
|
||||
* Copyright (c) 2020, Linaro Limited
|
||||
*/
|
||||
|
||||
#if !defined _EFI_TCG2_PROTOCOL_H_
|
||||
#define _EFI_TCG2_PROTOCOL_H_
|
||||
|
||||
#include <tpm-v2.h>
|
||||
|
||||
#define EFI_TCG2_PROTOCOL_GUID \
|
||||
EFI_GUID(0x607f766c, 0x7455, 0x42be, 0x93, \
|
||||
0x0b, 0xe4, 0xd7, 0x6d, 0xb2, 0x72, 0x0f)
|
||||
|
||||
/* TPMV2 only */
|
||||
#define TCG2_EVENT_LOG_FORMAT_TCG_2 0x00000002
|
||||
|
||||
/* SHA1, SHA256, SHA384, SHA512, TPM_ALG_SM3_256 */
|
||||
#define MAX_HASH_COUNT 5
|
||||
/* Algorithm Registry */
|
||||
#define EFI_TCG2_BOOT_HASH_ALG_SHA1 0x00000001
|
||||
#define EFI_TCG2_BOOT_HASH_ALG_SHA256 0x00000002
|
||||
#define EFI_TCG2_BOOT_HASH_ALG_SHA384 0x00000004
|
||||
#define EFI_TCG2_BOOT_HASH_ALG_SHA512 0x00000008
|
||||
#define EFI_TCG2_BOOT_HASH_ALG_SM3_256 0x00000010
|
||||
|
||||
typedef u32 efi_tcg_event_log_bitmap;
|
||||
typedef u32 efi_tcg_event_log_format;
|
||||
typedef u32 efi_tcg_event_algorithm_bitmap;
|
||||
|
||||
struct efi_tcg2_version {
|
||||
u8 major;
|
||||
u8 minor;
|
||||
};
|
||||
|
||||
struct efi_tcg2_event_header {
|
||||
u32 header_size;
|
||||
u16 header_version;
|
||||
u32 pcr_index;
|
||||
u32 event_type;
|
||||
} __packed;
|
||||
|
||||
struct efi_tcg2_event {
|
||||
u32 size;
|
||||
struct efi_tcg2_event_header header;
|
||||
u8 event[];
|
||||
} __packed;
|
||||
|
||||
struct efi_tcg2_boot_service_capability {
|
||||
u8 size;
|
||||
struct efi_tcg2_version structure_version;
|
||||
struct efi_tcg2_version protocol_version;
|
||||
efi_tcg_event_algorithm_bitmap hash_algorithm_bitmap;
|
||||
efi_tcg_event_log_bitmap supported_event_logs;
|
||||
u8 tpm_present_flag;
|
||||
u16 max_command_size;
|
||||
u16 max_response_size;
|
||||
u32 manufacturer_id;
|
||||
u32 number_of_pcr_banks;
|
||||
efi_tcg_event_algorithm_bitmap active_pcr_banks;
|
||||
};
|
||||
|
||||
#define boot_service_capability_min \
|
||||
sizeof(struct efi_tcg2_boot_service_capability) - \
|
||||
offsetof(struct efi_tcg2_boot_service_capability, number_of_pcr_banks)
|
||||
|
||||
struct efi_tcg2_protocol {
|
||||
efi_status_t (EFIAPI * get_capability)(struct efi_tcg2_protocol *this,
|
||||
struct efi_tcg2_boot_service_capability *capability);
|
||||
efi_status_t (EFIAPI * get_eventlog)(struct efi_tcg2_protocol *this,
|
||||
efi_tcg_event_log_format log_format,
|
||||
u64 *event_log_location, u64 *event_log_last_entry,
|
||||
bool *event_log_truncated);
|
||||
efi_status_t (EFIAPI * hash_log_extend_event)(struct efi_tcg2_protocol *this,
|
||||
u64 flags, u64 data_to_hash,
|
||||
u64 data_to_hash_len,
|
||||
struct efi_tcg2_event *efi_tcg_event);
|
||||
efi_status_t (EFIAPI * submit_command)(struct efi_tcg2_protocol *this,
|
||||
u32 input_parameter_block_size,
|
||||
u8 *input_parameter_block,
|
||||
u32 output_parameter_block_size,
|
||||
u8 *output_parameter_block);
|
||||
efi_status_t (EFIAPI * get_active_pcr_banks)(struct efi_tcg2_protocol *this,
|
||||
u32 *active_pcr_banks);
|
||||
efi_status_t (EFIAPI * set_active_pcr_banks)(struct efi_tcg2_protocol *this,
|
||||
u32 active_pcr_banks);
|
||||
efi_status_t (EFIAPI * get_result_of_set_active_pcr_banks)(struct efi_tcg2_protocol *this,
|
||||
u32 *operation_present,
|
||||
u32 *response);
|
||||
};
|
||||
#endif
|
||||
|
|
@ -1,6 +1,13 @@
|
|||
/* SPDX-License-Identifier: GPL-2.0+ */
|
||||
/*
|
||||
* Defines APIs and structures that allow software to interact with a
|
||||
* TPM2 device
|
||||
*
|
||||
* Copyright (c) 2020 Linaro
|
||||
* Copyright (c) 2018 Bootlin
|
||||
*
|
||||
* https://trustedcomputinggroup.org/resource/tss-overview-common-structures-specification/
|
||||
*
|
||||
* Author: Miquel Raynal <miquel.raynal@bootlin.com>
|
||||
*/
|
||||
|
||||
|
|
@ -11,6 +18,74 @@
|
|||
|
||||
#define TPM2_DIGEST_LEN 32
|
||||
|
||||
#define TPM2_MAX_PCRS 32
|
||||
#define TPM2_PCR_SELECT_MAX ((TPM2_MAX_PCRS + 7) / 8)
|
||||
#define TPM2_MAX_CAP_BUFFER 1024
|
||||
#define TPM2_MAX_TPM_PROPERTIES ((TPM2_MAX_CAP_BUFFER - sizeof(u32) /* TPM2_CAP */ - \
|
||||
sizeof(u32)) / sizeof(struct tpms_tagged_property))
|
||||
|
||||
/*
|
||||
* We deviate from this draft of the specification by increasing the value of
|
||||
* TPM2_NUM_PCR_BANKS from 3 to 16 to ensure compatibility with TPM2
|
||||
* implementations that have enabled a larger than typical number of PCR
|
||||
* banks. This larger value for TPM2_NUM_PCR_BANKS is expected to be included
|
||||
* in a future revision of the specification.
|
||||
*/
|
||||
#define TPM2_NUM_PCR_BANKS 16
|
||||
|
||||
/* Definition of (UINT32) TPM2_CAP Constants */
|
||||
#define TPM2_CAP_PCRS 0x00000005U
|
||||
#define TPM2_CAP_TPM_PROPERTIES 0x00000006U
|
||||
|
||||
/* Definition of (UINT32) TPM2_PT Constants */
|
||||
#define TPM2_PT_GROUP (u32)(0x00000100)
|
||||
#define TPM2_PT_FIXED (u32)(TPM2_PT_GROUP * 1)
|
||||
#define TPM2_PT_MANUFACTURER (u32)(TPM2_PT_FIXED + 5)
|
||||
#define TPM2_PT_PCR_COUNT (u32)(TPM2_PT_FIXED + 18)
|
||||
#define TPM2_PT_MAX_COMMAND_SIZE (u32)(TPM2_PT_FIXED + 30)
|
||||
#define TPM2_PT_MAX_RESPONSE_SIZE (u32)(TPM2_PT_FIXED + 31)
|
||||
|
||||
/* TPMS_TAGGED_PROPERTY Structure */
|
||||
struct tpms_tagged_property {
|
||||
u32 property;
|
||||
u32 value;
|
||||
} __packed;
|
||||
|
||||
/* TPMS_PCR_SELECTION Structure */
|
||||
struct tpms_pcr_selection {
|
||||
u16 hash;
|
||||
u8 size_of_select;
|
||||
u8 pcr_select[TPM2_PCR_SELECT_MAX];
|
||||
} __packed;
|
||||
|
||||
/* TPML_PCR_SELECTION Structure */
|
||||
struct tpml_pcr_selection {
|
||||
u32 count;
|
||||
struct tpms_pcr_selection selection[TPM2_NUM_PCR_BANKS];
|
||||
} __packed;
|
||||
|
||||
/* TPML_TAGGED_TPM_PROPERTY Structure */
|
||||
struct tpml_tagged_tpm_property {
|
||||
u32 count;
|
||||
struct tpms_tagged_property tpm_property[TPM2_MAX_TPM_PROPERTIES];
|
||||
} __packed;
|
||||
|
||||
/* TPMU_CAPABILITIES Union */
|
||||
union tpmu_capabilities {
|
||||
/*
|
||||
* Non exhaustive. Only added the structs needed for our
|
||||
* current code
|
||||
*/
|
||||
struct tpml_pcr_selection assigned_pcr;
|
||||
struct tpml_tagged_tpm_property tpm_properties;
|
||||
} __packed;
|
||||
|
||||
/* TPMS_CAPABILITY_DATA Structure */
|
||||
struct tpms_capability_data {
|
||||
u32 capability;
|
||||
union tpmu_capabilities data;
|
||||
} __packed;
|
||||
|
||||
/**
|
||||
* TPM2 Structure Tags for command/response buffers.
|
||||
*
|
||||
|
|
@ -123,11 +198,13 @@ enum tpm2_return_codes {
|
|||
* TPM2 algorithms.
|
||||
*/
|
||||
enum tpm2_algorithms {
|
||||
TPM2_ALG_SHA1 = 0x04,
|
||||
TPM2_ALG_XOR = 0x0A,
|
||||
TPM2_ALG_SHA256 = 0x0B,
|
||||
TPM2_ALG_SHA384 = 0x0C,
|
||||
TPM2_ALG_SHA512 = 0x0D,
|
||||
TPM2_ALG_NULL = 0x10,
|
||||
TPM2_ALG_SM3_256 = 0x12,
|
||||
};
|
||||
|
||||
/* NV index attributes */
|
||||
|
|
|
|||
|
|
@ -184,6 +184,13 @@ config EFI_RNG_PROTOCOL
|
|||
Provide a EFI_RNG_PROTOCOL implementation using the hardware random
|
||||
number generator of the platform.
|
||||
|
||||
config EFI_TCG2_PROTOCOL
|
||||
bool "EFI_TCG2_PROTOCOL support"
|
||||
depends on TPM_V2
|
||||
help
|
||||
Provide a EFI_TCG2_PROTOCOL implementation using the TPM hardware
|
||||
of the platform.
|
||||
|
||||
config EFI_LOAD_FILE2_INITRD
|
||||
bool "EFI_FILE_LOAD2_PROTOCOL for Linux initial ramdisk"
|
||||
default n
|
||||
|
|
|
|||
|
|
@ -53,6 +53,7 @@ obj-$(CONFIG_NET) += efi_net.o
|
|||
obj-$(CONFIG_GENERATE_ACPI_TABLE) += efi_acpi.o
|
||||
obj-$(CONFIG_GENERATE_SMBIOS_TABLE) += efi_smbios.o
|
||||
obj-$(CONFIG_EFI_RNG_PROTOCOL) += efi_rng.o
|
||||
obj-$(CONFIG_EFI_TCG2_PROTOCOL) += efi_tcg2.o
|
||||
obj-$(CONFIG_EFI_LOAD_FILE2_INITRD) += efi_load_initrd.o
|
||||
obj-y += efi_signature.o
|
||||
|
||||
|
|
|
|||
|
|
@ -38,6 +38,9 @@ LIST_HEAD(efi_event_queue);
|
|||
/* Flag to disable timer activity in ExitBootServices() */
|
||||
static bool timers_enabled = true;
|
||||
|
||||
/* Flag used by the selftest to avoid detaching devices in ExitBootServices() */
|
||||
bool efi_st_keep_devices;
|
||||
|
||||
/* List of all events registered by RegisterProtocolNotify() */
|
||||
LIST_HEAD(efi_register_notify_events);
|
||||
|
||||
|
|
@ -1996,10 +1999,12 @@ static efi_status_t EFIAPI efi_exit_boot_services(efi_handle_t image_handle,
|
|||
list_del(&evt->link);
|
||||
}
|
||||
|
||||
if IS_ENABLED(CONFIG_USB_DEVICE)
|
||||
udc_disconnect();
|
||||
board_quiesce_devices();
|
||||
dm_remove_devices_flags(DM_REMOVE_ACTIVE_ALL);
|
||||
if (!efi_st_keep_devices) {
|
||||
if IS_ENABLED(CONFIG_USB_DEVICE)
|
||||
udc_disconnect();
|
||||
board_quiesce_devices();
|
||||
dm_remove_devices_flags(DM_REMOVE_ACTIVE_ALL);
|
||||
}
|
||||
|
||||
/* Patch out unsupported runtime function */
|
||||
efi_runtime_detach();
|
||||
|
|
|
|||
|
|
@ -723,7 +723,7 @@ static efi_status_t EFIAPI efi_file_setinfo(struct efi_file_handle *file,
|
|||
goto out;
|
||||
}
|
||||
/* Check for renaming */
|
||||
new_file_name = malloc(utf16_utf8_strlen(info->file_name));
|
||||
new_file_name = malloc(utf16_utf8_strlen(info->file_name) + 1);
|
||||
if (!new_file_name) {
|
||||
ret = EFI_OUT_OF_RESOURCES;
|
||||
goto out;
|
||||
|
|
|
|||
|
|
@ -166,13 +166,13 @@ efi_status_t efi_rng_register(void)
|
|||
|
||||
ret = platform_get_rng_device(&dev);
|
||||
if (ret != EFI_SUCCESS) {
|
||||
log_warning("Missing RNG device for EFI_RNG_PROTOCOL");
|
||||
log_warning("Missing RNG device for EFI_RNG_PROTOCOL\n");
|
||||
return EFI_SUCCESS;
|
||||
}
|
||||
ret = efi_add_protocol(efi_root, &efi_guid_rng_protocol,
|
||||
(void *)&efi_rng_protocol);
|
||||
if (ret != EFI_SUCCESS)
|
||||
log_err("Cannot install EFI_RNG_PROTOCOL");
|
||||
log_err("Cannot install EFI_RNG_PROTOCOL\n");
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -156,6 +156,13 @@ efi_status_t efi_init_obj_list(void)
|
|||
if (ret != EFI_SUCCESS)
|
||||
goto out;
|
||||
}
|
||||
|
||||
if (IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL)) {
|
||||
ret = efi_tcg2_register();
|
||||
if (ret != EFI_SUCCESS)
|
||||
goto out;
|
||||
}
|
||||
|
||||
/* Initialize variable services */
|
||||
ret = efi_init_variables();
|
||||
if (ret != EFI_SUCCESS)
|
||||
|
|
|
|||
534
lib/efi_loader/efi_tcg2.c
Normal file
534
lib/efi_loader/efi_tcg2.c
Normal file
|
|
@ -0,0 +1,534 @@
|
|||
// SPDX-License-Identifier: GPL-2.0+
|
||||
/*
|
||||
* Defines APIs that allow an OS to interact with UEFI firmware to query
|
||||
* information about the device.
|
||||
* https://trustedcomputinggroup.org/resource/tcg-efi-protocol-specification/
|
||||
*
|
||||
* Copyright (c) 2020, Linaro Limited
|
||||
*/
|
||||
|
||||
#define LOG_CATEGORY LOGC_EFI
|
||||
#include <common.h>
|
||||
#include <dm.h>
|
||||
#include <efi_loader.h>
|
||||
#include <efi_tcg2.h>
|
||||
#include <log.h>
|
||||
#include <tpm-v2.h>
|
||||
#include <linux/unaligned/access_ok.h>
|
||||
#include <linux/unaligned/generic.h>
|
||||
|
||||
DECLARE_GLOBAL_DATA_PTR;
|
||||
|
||||
/*
|
||||
* When requesting TPM2_CAP_TPM_PROPERTIES the value is on a standard offset.
|
||||
* Since the current tpm2_get_capability() response buffers starts at
|
||||
* 'union tpmu_capabilities data' of 'struct tpms_capability_data', calculate
|
||||
* the response size and offset once for all consumers
|
||||
*/
|
||||
#define TPM2_RESPONSE_BUFFER_SIZE (sizeof(struct tpms_capability_data) - \
|
||||
offsetof(struct tpms_capability_data, data))
|
||||
#define properties_offset (offsetof(struct tpml_tagged_tpm_property, tpm_property) + \
|
||||
offsetof(struct tpms_tagged_property, value))
|
||||
|
||||
const efi_guid_t efi_guid_tcg2_protocol = EFI_TCG2_PROTOCOL_GUID;
|
||||
|
||||
/**
|
||||
* platform_get_tpm_device() - retrieve TPM device
|
||||
*
|
||||
* This function retrieves the udevice implementing a TPM
|
||||
*
|
||||
* This function may be overridden if special initialization is needed.
|
||||
*
|
||||
* @dev: udevice
|
||||
* Return: status code
|
||||
*/
|
||||
__weak efi_status_t platform_get_tpm2_device(struct udevice **dev)
|
||||
{
|
||||
for_each_tpm_device((*dev)) {
|
||||
if (tpm_get_version(*dev) == TPM_V2)
|
||||
return EFI_SUCCESS;
|
||||
}
|
||||
return EFI_NOT_FOUND;
|
||||
}
|
||||
|
||||
/**
|
||||
* tpm2_get_max_command_size() - get the supported max command size
|
||||
*
|
||||
* @dev: TPM device
|
||||
* @max_command_size: output buffer for the size
|
||||
*
|
||||
* Return: 0 on success, -1 on error
|
||||
*/
|
||||
static int tpm2_get_max_command_size(struct udevice *dev, u16 *max_command_size)
|
||||
{
|
||||
u8 response[TPM2_RESPONSE_BUFFER_SIZE];
|
||||
u32 ret;
|
||||
|
||||
memset(response, 0, sizeof(response));
|
||||
ret = tpm2_get_capability(dev, TPM2_CAP_TPM_PROPERTIES,
|
||||
TPM2_PT_MAX_COMMAND_SIZE, response, 1);
|
||||
if (ret)
|
||||
return -1;
|
||||
|
||||
*max_command_size = (uint16_t)get_unaligned_be32(response +
|
||||
properties_offset);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* tpm2_get_max_response_size() - get the supported max response size
|
||||
*
|
||||
* @dev: TPM device
|
||||
* @max_response_size: output buffer for the size
|
||||
*
|
||||
* Return: 0 on success, -1 on error
|
||||
*/
|
||||
static int tpm2_get_max_response_size(struct udevice *dev,
|
||||
u16 *max_response_size)
|
||||
{
|
||||
u8 response[TPM2_RESPONSE_BUFFER_SIZE];
|
||||
u32 ret;
|
||||
|
||||
memset(response, 0, sizeof(response));
|
||||
ret = tpm2_get_capability(dev, TPM2_CAP_TPM_PROPERTIES,
|
||||
TPM2_PT_MAX_RESPONSE_SIZE, response, 1);
|
||||
if (ret)
|
||||
return -1;
|
||||
|
||||
*max_response_size = (uint16_t)get_unaligned_be32(response +
|
||||
properties_offset);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* tpm2_get_manufacturer_id() - get the manufacturer ID
|
||||
*
|
||||
* @dev: TPM device
|
||||
* @manufacturer_id: output buffer for the id
|
||||
*
|
||||
* Return: 0 on success, -1 on error
|
||||
*/
|
||||
static int tpm2_get_manufacturer_id(struct udevice *dev, u32 *manufacturer_id)
|
||||
{
|
||||
u8 response[TPM2_RESPONSE_BUFFER_SIZE];
|
||||
u32 ret;
|
||||
|
||||
memset(response, 0, sizeof(response));
|
||||
ret = tpm2_get_capability(dev, TPM2_CAP_TPM_PROPERTIES,
|
||||
TPM2_PT_MANUFACTURER, response, 1);
|
||||
if (ret)
|
||||
return -1;
|
||||
|
||||
*manufacturer_id = get_unaligned_be32(response + properties_offset);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* tpm2_get_num_pcr() - get the number of PCRs
|
||||
*
|
||||
* @dev: TPM device
|
||||
* @manufacturer_id: output buffer for the number
|
||||
*
|
||||
* Return: 0 on success, -1 on error
|
||||
*/
|
||||
static int tpm2_get_num_pcr(struct udevice *dev, u32 *num_pcr)
|
||||
{
|
||||
u8 response[TPM2_RESPONSE_BUFFER_SIZE];
|
||||
u32 ret;
|
||||
|
||||
memset(response, 0, sizeof(response));
|
||||
ret = tpm2_get_capability(dev, TPM2_CAP_TPM_PROPERTIES,
|
||||
TPM2_PT_PCR_COUNT, response, 1);
|
||||
if (ret)
|
||||
return -1;
|
||||
|
||||
*num_pcr = get_unaligned_be32(response + properties_offset);
|
||||
if (*num_pcr > TPM2_MAX_PCRS)
|
||||
return -1;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* is_active_pcr() - Check if a supported algorithm is active
|
||||
*
|
||||
* @dev: TPM device
|
||||
* @selection: struct of PCR information
|
||||
*
|
||||
* Return: true if PCR is active
|
||||
*/
|
||||
bool is_active_pcr(struct tpms_pcr_selection *selection)
|
||||
{
|
||||
int i;
|
||||
/*
|
||||
* check the pcr_select. If at least one of the PCRs supports the
|
||||
* algorithm add it on the active ones
|
||||
*/
|
||||
for (i = 0; i < selection->size_of_select; i++) {
|
||||
if (selection->pcr_select[i])
|
||||
return true;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* tpm2_get_pcr_info() - get the supported, active PCRs and number of banks
|
||||
*
|
||||
* @dev: TPM device
|
||||
* @supported_pcr: bitmask with the algorithms supported
|
||||
* @active_pcr: bitmask with the active algorithms
|
||||
* @pcr_banks: number of PCR banks
|
||||
*
|
||||
* Return: 0 on success, -1 on error
|
||||
*/
|
||||
static int tpm2_get_pcr_info(struct udevice *dev, u32 *supported_pcr,
|
||||
u32 *active_pcr, u32 *pcr_banks)
|
||||
{
|
||||
u8 response[TPM2_RESPONSE_BUFFER_SIZE];
|
||||
struct tpml_pcr_selection pcrs;
|
||||
u32 ret, num_pcr;
|
||||
int i, tpm_ret;
|
||||
|
||||
memset(response, 0, sizeof(response));
|
||||
ret = tpm2_get_capability(dev, TPM2_CAP_PCRS, 0, response, 1);
|
||||
if (ret)
|
||||
goto out;
|
||||
|
||||
pcrs.count = get_unaligned_be32(response);
|
||||
/*
|
||||
* We only support 5 algorithms for now so check against that
|
||||
* instead of TPM2_NUM_PCR_BANKS
|
||||
*/
|
||||
if (pcrs.count > MAX_HASH_COUNT || pcrs.count < 1)
|
||||
goto out;
|
||||
|
||||
tpm_ret = tpm2_get_num_pcr(dev, &num_pcr);
|
||||
if (tpm_ret)
|
||||
goto out;
|
||||
|
||||
for (i = 0; i < pcrs.count; i++) {
|
||||
/*
|
||||
* Definition of TPMS_PCR_SELECTION Structure
|
||||
* hash: u16
|
||||
* size_of_select: u8
|
||||
* pcr_select: u8 array
|
||||
*
|
||||
* The offsets depend on the number of the device PCRs
|
||||
* so we have to calculate them based on that
|
||||
*/
|
||||
u32 hash_offset = offsetof(struct tpml_pcr_selection, selection) +
|
||||
i * offsetof(struct tpms_pcr_selection, pcr_select) +
|
||||
i * ((num_pcr + 7) / 8);
|
||||
u32 size_select_offset =
|
||||
hash_offset + offsetof(struct tpms_pcr_selection,
|
||||
size_of_select);
|
||||
u32 pcr_select_offset =
|
||||
hash_offset + offsetof(struct tpms_pcr_selection,
|
||||
pcr_select);
|
||||
|
||||
pcrs.selection[i].hash =
|
||||
get_unaligned_be16(response + hash_offset);
|
||||
pcrs.selection[i].size_of_select =
|
||||
__get_unaligned_be(response + size_select_offset);
|
||||
if (pcrs.selection[i].size_of_select > TPM2_PCR_SELECT_MAX)
|
||||
goto out;
|
||||
/* copy the array of pcr_select */
|
||||
memcpy(pcrs.selection[i].pcr_select, response + pcr_select_offset,
|
||||
pcrs.selection[i].size_of_select);
|
||||
}
|
||||
|
||||
for (i = 0; i < pcrs.count; i++) {
|
||||
switch (pcrs.selection[i].hash) {
|
||||
case TPM2_ALG_SHA1:
|
||||
*supported_pcr |= EFI_TCG2_BOOT_HASH_ALG_SHA1;
|
||||
if (is_active_pcr(&pcrs.selection[i]))
|
||||
*active_pcr |= EFI_TCG2_BOOT_HASH_ALG_SHA1;
|
||||
break;
|
||||
case TPM2_ALG_SHA256:
|
||||
*supported_pcr |= EFI_TCG2_BOOT_HASH_ALG_SHA256;
|
||||
if (is_active_pcr(&pcrs.selection[i]))
|
||||
*active_pcr |= EFI_TCG2_BOOT_HASH_ALG_SHA256;
|
||||
break;
|
||||
case TPM2_ALG_SHA384:
|
||||
*supported_pcr |= EFI_TCG2_BOOT_HASH_ALG_SHA384;
|
||||
if (is_active_pcr(&pcrs.selection[i]))
|
||||
*active_pcr |= EFI_TCG2_BOOT_HASH_ALG_SHA384;
|
||||
break;
|
||||
case TPM2_ALG_SHA512:
|
||||
*supported_pcr |= EFI_TCG2_BOOT_HASH_ALG_SHA512;
|
||||
if (is_active_pcr(&pcrs.selection[i]))
|
||||
*active_pcr |= EFI_TCG2_BOOT_HASH_ALG_SHA512;
|
||||
break;
|
||||
case TPM2_ALG_SM3_256:
|
||||
*supported_pcr |= EFI_TCG2_BOOT_HASH_ALG_SM3_256;
|
||||
if (is_active_pcr(&pcrs.selection[i]))
|
||||
*active_pcr |= EFI_TCG2_BOOT_HASH_ALG_SM3_256;
|
||||
break;
|
||||
default:
|
||||
EFI_PRINT("Unknown algorithm %x\n",
|
||||
pcrs.selection[i].hash);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
*pcr_banks = pcrs.count;
|
||||
|
||||
return 0;
|
||||
out:
|
||||
return -1;
|
||||
}
|
||||
|
||||
/**
|
||||
* get_capability() - protocol capability information and state information
|
||||
*
|
||||
* @this: TCG2 protocol instance
|
||||
* @capability: caller allocated memory with size field to the size of
|
||||
* the structure allocated
|
||||
|
||||
* Return: status code
|
||||
*/
|
||||
static efi_status_t EFIAPI
|
||||
get_capability(struct efi_tcg2_protocol *this,
|
||||
struct efi_tcg2_boot_service_capability *capability)
|
||||
{
|
||||
struct udevice *dev;
|
||||
efi_status_t efi_ret;
|
||||
int ret;
|
||||
|
||||
EFI_ENTRY("%p, %p", this, capability);
|
||||
|
||||
if (!this || !capability) {
|
||||
efi_ret = EFI_INVALID_PARAMETER;
|
||||
goto out;
|
||||
}
|
||||
|
||||
if (capability->size < boot_service_capability_min) {
|
||||
capability->size = boot_service_capability_min;
|
||||
efi_ret = EFI_BUFFER_TOO_SMALL;
|
||||
goto out;
|
||||
}
|
||||
|
||||
if (capability->size < sizeof(*capability)) {
|
||||
capability->size = sizeof(*capability);
|
||||
efi_ret = EFI_BUFFER_TOO_SMALL;
|
||||
goto out;
|
||||
}
|
||||
|
||||
capability->structure_version.major = 1;
|
||||
capability->structure_version.minor = 1;
|
||||
capability->protocol_version.major = 1;
|
||||
capability->protocol_version.minor = 1;
|
||||
|
||||
efi_ret = platform_get_tpm2_device(&dev);
|
||||
if (efi_ret != EFI_SUCCESS) {
|
||||
capability->supported_event_logs = 0;
|
||||
capability->hash_algorithm_bitmap = 0;
|
||||
capability->tpm_present_flag = false;
|
||||
capability->max_command_size = 0;
|
||||
capability->max_response_size = 0;
|
||||
capability->manufacturer_id = 0;
|
||||
capability->number_of_pcr_banks = 0;
|
||||
capability->active_pcr_banks = 0;
|
||||
|
||||
efi_ret = EFI_SUCCESS;
|
||||
goto out;
|
||||
}
|
||||
|
||||
/* We only allow a TPMv2 device to register the EFI protocol */
|
||||
capability->supported_event_logs = TCG2_EVENT_LOG_FORMAT_TCG_2;
|
||||
|
||||
capability->tpm_present_flag = true;
|
||||
|
||||
/* Supported and active PCRs */
|
||||
capability->hash_algorithm_bitmap = 0;
|
||||
capability->active_pcr_banks = 0;
|
||||
ret = tpm2_get_pcr_info(dev, &capability->hash_algorithm_bitmap,
|
||||
&capability->active_pcr_banks,
|
||||
&capability->number_of_pcr_banks);
|
||||
if (ret) {
|
||||
efi_ret = EFI_DEVICE_ERROR;
|
||||
goto out;
|
||||
}
|
||||
|
||||
/* Max command size */
|
||||
ret = tpm2_get_max_command_size(dev, &capability->max_command_size);
|
||||
if (ret) {
|
||||
efi_ret = EFI_DEVICE_ERROR;
|
||||
goto out;
|
||||
}
|
||||
|
||||
/* Max response size */
|
||||
ret = tpm2_get_max_response_size(dev, &capability->max_response_size);
|
||||
if (ret) {
|
||||
efi_ret = EFI_DEVICE_ERROR;
|
||||
goto out;
|
||||
}
|
||||
|
||||
/* Manufacturer ID */
|
||||
ret = tpm2_get_manufacturer_id(dev, &capability->manufacturer_id);
|
||||
if (ret) {
|
||||
efi_ret = EFI_DEVICE_ERROR;
|
||||
goto out;
|
||||
}
|
||||
|
||||
return EFI_EXIT(EFI_SUCCESS);
|
||||
out:
|
||||
return EFI_EXIT(efi_ret);
|
||||
}
|
||||
|
||||
/**
|
||||
* get_eventlog() - retrieve the the address of an event log and its last entry
|
||||
*
|
||||
* @this: TCG2 protocol instance
|
||||
* @log_format: type of event log format
|
||||
* @event_log_location: pointer to the memory address of the event log
|
||||
* @event_log_last_entry: pointer to the address of the start of the last
|
||||
* entry in the event log in memory, if log contains
|
||||
* more than 1 entry
|
||||
* @event_log_truncated: set to true, if the Event Log is missing at i
|
||||
* least one entry
|
||||
*
|
||||
* Return: status code
|
||||
*/
|
||||
static efi_status_t EFIAPI
|
||||
get_eventlog(struct efi_tcg2_protocol *this,
|
||||
efi_tcg_event_log_format log_format, u64 *event_log_location,
|
||||
u64 *event_log_last_entry, bool *event_log_truncated)
|
||||
{
|
||||
return EFI_UNSUPPORTED;
|
||||
}
|
||||
|
||||
/**
|
||||
* hash_log_extend_event()- extend and optionally log events
|
||||
*
|
||||
* @this: TCG2 protocol instance
|
||||
* @flags: bitmap providing additional information on the
|
||||
* operation
|
||||
* @data_to_hash: physical address of the start of the data buffer
|
||||
* to be hashed
|
||||
* @data_to_hash_len: the length in bytes of the buffer referenced by
|
||||
* data_to_hash
|
||||
* @efi_tcg_event: pointer to data buffer containing information
|
||||
* about the event
|
||||
*
|
||||
* Return: status code
|
||||
*/
|
||||
static efi_status_t EFIAPI
|
||||
hash_log_extend_event(struct efi_tcg2_protocol *this, u64 flags,
|
||||
u64 data_to_hash, u64 data_to_hash_len,
|
||||
struct efi_tcg2_event *efi_tcg_event)
|
||||
{
|
||||
return EFI_UNSUPPORTED;
|
||||
}
|
||||
|
||||
/**
|
||||
* submit_command() - Send command to the TPM
|
||||
*
|
||||
* @this: TCG2 protocol instance
|
||||
* @input_param_block_size: size of the TPM input parameter block
|
||||
* @input_param_block: pointer to the TPM input parameter block
|
||||
* @output_param_block_size: size of the TPM output parameter block
|
||||
* @output_param_block: pointer to the TPM output parameter block
|
||||
*
|
||||
* Return: status code
|
||||
*/
|
||||
efi_status_t EFIAPI
|
||||
submit_command(struct efi_tcg2_protocol *this, u32 input_param_block_size,
|
||||
u8 *input_param_block, u32 output_param_block_size,
|
||||
u8 *output_param_block)
|
||||
{
|
||||
return EFI_UNSUPPORTED;
|
||||
}
|
||||
|
||||
/**
|
||||
* get_active_pcr_banks() - returns the currently active PCR banks
|
||||
*
|
||||
* @this: TCG2 protocol instance
|
||||
* @active_pcr_banks: pointer for receiving the bitmap of currently
|
||||
* active PCR banks
|
||||
*
|
||||
* Return: status code
|
||||
*/
|
||||
efi_status_t EFIAPI
|
||||
get_active_pcr_banks(struct efi_tcg2_protocol *this, u32 *active_pcr_banks)
|
||||
{
|
||||
return EFI_UNSUPPORTED;
|
||||
}
|
||||
|
||||
/**
|
||||
* set_active_pcr_banks() - sets the currently active PCR banks
|
||||
*
|
||||
* @this: TCG2 protocol instance
|
||||
* @active_pcr_banks: bitmap of the requested active PCR banks
|
||||
*
|
||||
* Return: status code
|
||||
*/
|
||||
efi_status_t EFIAPI
|
||||
set_active_pcr_banks(struct efi_tcg2_protocol *this, u32 active_pcr_banks)
|
||||
{
|
||||
return EFI_UNSUPPORTED;
|
||||
}
|
||||
|
||||
/**
|
||||
* get_result_of_set_active_pcr_banks() - retrieves the result of a previous
|
||||
* set_active_pcr_banks()
|
||||
*
|
||||
* @this: TCG2 protocol instance
|
||||
* @operation_present: non-zero value to indicate a
|
||||
* set_active_pcr_banks operation was
|
||||
* invoked during last boot
|
||||
* @response: result value could be returned
|
||||
*
|
||||
* Return: status code
|
||||
*/
|
||||
efi_status_t EFIAPI
|
||||
get_result_of_set_active_pcr_banks(struct efi_tcg2_protocol *this,
|
||||
u32 *operation_present, u32 *response)
|
||||
{
|
||||
return EFI_UNSUPPORTED;
|
||||
}
|
||||
|
||||
static const struct efi_tcg2_protocol efi_tcg2_protocol = {
|
||||
.get_capability = get_capability,
|
||||
.get_eventlog = get_eventlog,
|
||||
.hash_log_extend_event = hash_log_extend_event,
|
||||
.submit_command = submit_command,
|
||||
.get_active_pcr_banks = get_active_pcr_banks,
|
||||
.set_active_pcr_banks = set_active_pcr_banks,
|
||||
.get_result_of_set_active_pcr_banks = get_result_of_set_active_pcr_banks,
|
||||
};
|
||||
|
||||
/**
|
||||
* efi_tcg2_register() - register EFI_TCG2_PROTOCOL
|
||||
*
|
||||
* If a TPM2 device is available, the TPM TCG2 Protocol is registered
|
||||
*
|
||||
* Return: An error status is only returned if adding the protocol fails.
|
||||
*/
|
||||
efi_status_t efi_tcg2_register(void)
|
||||
{
|
||||
efi_status_t ret;
|
||||
struct udevice *dev;
|
||||
enum tpm_version tpm_ver;
|
||||
|
||||
ret = platform_get_tpm2_device(&dev);
|
||||
if (ret != EFI_SUCCESS)
|
||||
return EFI_SUCCESS;
|
||||
|
||||
tpm_ver = tpm_get_version(dev);
|
||||
if (tpm_ver != TPM_V2) {
|
||||
log_warning("Only TPMv2 supported for EFI_TCG2_PROTOCOL\n");
|
||||
return EFI_SUCCESS;
|
||||
}
|
||||
|
||||
ret = efi_add_protocol(efi_root, &efi_guid_tcg2_protocol,
|
||||
(void *)&efi_tcg2_protocol);
|
||||
if (ret != EFI_SUCCESS)
|
||||
log_err("Cannot install EFI_TCG2_PROTOCOL\n");
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
|
@ -55,6 +55,7 @@ obj-$(CONFIG_EFI_LOADER_HII) += efi_selftest_hii.o
|
|||
obj-$(CONFIG_EFI_RNG_PROTOCOL) += efi_selftest_rng.o
|
||||
obj-$(CONFIG_EFI_GET_TIME) += efi_selftest_rtc.o
|
||||
obj-$(CONFIG_EFI_LOAD_FILE2_INITRD) += efi_selftest_load_initrd.o
|
||||
obj-$(CONFIG_EFI_TCG2_PROTOCOL) += efi_selftest_tcg2.o
|
||||
|
||||
ifeq ($(CONFIG_GENERATE_ACPI_TABLE),)
|
||||
obj-y += efi_selftest_fdt.o
|
||||
|
|
|
|||
|
|
@ -38,6 +38,9 @@ void efi_st_exit_boot_services(void)
|
|||
efi_status_t ret;
|
||||
struct efi_mem_desc *memory_map;
|
||||
|
||||
/* Do not detach devices in ExitBootServices. We need the console. */
|
||||
efi_st_keep_devices = true;
|
||||
|
||||
ret = boottime->get_memory_map(&map_size, NULL, &map_key, &desc_size,
|
||||
&desc_version);
|
||||
if (ret != EFI_BUFFER_TOO_SMALL) {
|
||||
|
|
|
|||
75
lib/efi_selftest/efi_selftest_tcg2.c
Normal file
75
lib/efi_selftest/efi_selftest_tcg2.c
Normal file
|
|
@ -0,0 +1,75 @@
|
|||
// SPDX-License-Identifier: GPL-2.0+
|
||||
/*
|
||||
* efi_selftest_devicepath
|
||||
*
|
||||
* Copyright (c) 2020 Heinrich Schuchardt <xypron.glpk@gmx.de>
|
||||
*
|
||||
* Test the EFI_TCG2_PROTOCOL
|
||||
*/
|
||||
|
||||
#include <efi_selftest.h>
|
||||
#include <efi_tcg2.h>
|
||||
|
||||
static struct efi_boot_services *boottime;
|
||||
static const efi_guid_t guid_tcg2 = EFI_TCG2_PROTOCOL_GUID;
|
||||
|
||||
/**
|
||||
* efi_st_tcg2_setup() - setup test
|
||||
*
|
||||
* @handle: handle of the loaded image
|
||||
* @systable: system table
|
||||
* @return: status code
|
||||
*/
|
||||
static int efi_st_tcg2_setup(const efi_handle_t img_handle,
|
||||
const struct efi_system_table *systable)
|
||||
{
|
||||
boottime = systable->boottime;
|
||||
|
||||
return EFI_ST_SUCCESS;
|
||||
}
|
||||
|
||||
/**
|
||||
* efi_st_tcg2_execute() - execute test
|
||||
*
|
||||
* Call the GetCapability service of the EFI_TCG2_PROTOCOL.
|
||||
*
|
||||
* Return: status code
|
||||
*/
|
||||
static int efi_st_tcg2_execute(void)
|
||||
{
|
||||
struct efi_tcg2_protocol *tcg2;
|
||||
struct efi_tcg2_boot_service_capability capability;
|
||||
efi_status_t ret;
|
||||
|
||||
ret = boottime->locate_protocol(&guid_tcg2, NULL, (void **)&tcg2);
|
||||
if (ret != EFI_SUCCESS) {
|
||||
efi_st_error("TCG2 protocol is not available.\n");
|
||||
return EFI_ST_FAILURE;
|
||||
}
|
||||
capability.size = sizeof(struct efi_tcg2_boot_service_capability) - 1;
|
||||
ret = tcg2->get_capability(tcg2, &capability);
|
||||
if (ret != EFI_BUFFER_TOO_SMALL) {
|
||||
efi_st_error("tcg2->get_capability on small buffer failed\n");
|
||||
return EFI_ST_FAILURE;
|
||||
}
|
||||
capability.size = sizeof(struct efi_tcg2_boot_service_capability);
|
||||
ret = tcg2->get_capability(tcg2, &capability);
|
||||
if (ret != EFI_SUCCESS) {
|
||||
efi_st_error("tcg2->get_capability failed\n");
|
||||
return EFI_ST_FAILURE;
|
||||
}
|
||||
if (!capability.tpm_present_flag) {
|
||||
efi_st_error("TPM not present\n");
|
||||
return EFI_ST_FAILURE;
|
||||
}
|
||||
efi_st_printf("TPM supports 0x%.8x event logs\n",
|
||||
capability.supported_event_logs);
|
||||
return EFI_ST_SUCCESS;
|
||||
}
|
||||
|
||||
EFI_UNIT_TEST(tcg2) = {
|
||||
.name = "tcg2",
|
||||
.phase = EFI_EXECUTE_BEFORE_BOOTTIME_EXIT,
|
||||
.execute = efi_st_tcg2_execute,
|
||||
.setup = efi_st_tcg2_setup,
|
||||
};
|
||||
Loading…
Reference in a new issue