Mirrors/u-boot
1
0
Fork 0
mirror of https://source.denx.de/u-boot/u-boot.git synced 2026-06-13 15:03:58 +03:00
Code Issues Packages Projects Releases Wiki Activity

efi_loader: add boot variable measurement

Browse Source 
TCG PC Client PFP spec requires to measure "Boot####"
and "BootOrder" variables, EV_SEPARATOR event prior
to the Ready to Boot invocation.
Since u-boot does not implement Ready to Boot event,
these measurements are performed when efi_start_image() is called.

TCG spec also requires to measure "Calling EFI Application from
Boot Option" for each boot attempt, and "Returning from EFI
Application from Boot Option" if a boot device returns control
back to the Boot Manager.

Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
This commit is contained in:
Masahisa Kojima
2021-08-13 16:12:40 +09:00
committed by Heinrich Schuchardt
parent cfbcf054a3
commit 8fc4e0b427
4 changed files with 162 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
lib/efi_loader/efi_boottime.c
View File

@@ -2994,6 +2994,16 @@ efi_status_t EFIAPI efi_start_image(efi_handle_t image_handle,
image_obj->exit_status = &exit_status;
image_obj->exit_jmp = &exit_jmp;
if (IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL)) {
if (image_obj->image_type == IMAGE_SUBSYSTEM_EFI_APPLICATION) {
ret = efi_tcg2_measure_efi_app_invocation();
if (ret != EFI_SUCCESS) {
log_warning("tcg2 measurement fails(0x%lx)\n",
ret);
}
}
}
/* call the image! */
if (setjmp(&exit_jmp)) {
/*
@@ -3252,6 +3262,16 @@ static efi_status_t EFIAPI efi_exit(efi_handle_t image_handle,
exit_status != EFI_SUCCESS)
efi_delete_image(image_obj, loaded_image_protocol);
if (IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL)) {
if (image_obj->image_type == IMAGE_SUBSYSTEM_EFI_APPLICATION) {
ret = efi_tcg2_measure_efi_app_exit();
if (ret != EFI_SUCCESS) {
log_warning("tcg2 measurement fails(0x%lx)\n",
ret);
}
}
}
/* Make sure entry/exit counts for EFI world cross-overs match */
EFI_EXIT(exit_status);

121
lib/efi_loader/efi_tcg2.c
View File

@@ -35,6 +35,7 @@ struct event_log_buffer {
};
static struct event_log_buffer event_log;
static bool tcg2_efi_app_invoked;
/*
* When requesting TPM2_CAP_TPM_PROPERTIES the value is on a standard offset.
* Since the current tpm2_get_capability() response buffers starts at
@@ -1385,6 +1386,126 @@ static efi_status_t tcg2_measure_variable(struct udevice *dev, u32 pcr_index,
return ret;
}
/**
* tcg2_measure_boot_variable() - measure boot variables
*
* @dev: TPM device
*
* Return: status code
*/
static efi_status_t tcg2_measure_boot_variable(struct udevice *dev)
{
u16 *boot_order;
u16 *boot_index;
u16 var_name[] = L"BootOrder";
u16 boot_name[] = L"Boot####";
u8 *bootvar;
efi_uintn_t var_data_size;
u32 count, i;
efi_status_t ret;
boot_order = efi_get_var(var_name, &efi_global_variable_guid,
&var_data_size);
if (!boot_order) {
ret = EFI_NOT_FOUND;
goto error;
}
ret = tcg2_measure_variable(dev, 1, EV_EFI_VARIABLE_BOOT2, var_name,
&efi_global_variable_guid, var_data_size,
(u8 *)boot_order);
if (ret != EFI_SUCCESS)
goto error;
count = var_data_size / sizeof(*boot_order);
boot_index = boot_order;
for (i = 0; i < count; i++) {
efi_create_indexed_name(boot_name, sizeof(boot_name),
"Boot", *boot_index++);
bootvar = efi_get_var(boot_name, &efi_global_variable_guid,
&var_data_size);
if (!bootvar) {
log_info("%ls not found\n", boot_name);
continue;
}
ret = tcg2_measure_variable(dev, 1, EV_EFI_VARIABLE_BOOT2,
boot_name,
&efi_global_variable_guid,
var_data_size, bootvar);
free(bootvar);
if (ret != EFI_SUCCESS)
goto error;
}
error:
free(boot_order);
return ret;
}
/**
* efi_tcg2_measure_efi_app_invocation() - measure efi app invocation
*
* Return: status code
*/
efi_status_t efi_tcg2_measure_efi_app_invocation(void)
{
efi_status_t ret;
u32 pcr_index;
struct udevice *dev;
u32 event = 0;
if (tcg2_efi_app_invoked)
return EFI_SUCCESS;
ret = platform_get_tpm2_device(&dev);
if (ret != EFI_SUCCESS)
return ret;
ret = tcg2_measure_boot_variable(dev);
if (ret != EFI_SUCCESS)
goto out;
ret = tcg2_measure_event(dev, 4, EV_EFI_ACTION,
strlen(EFI_CALLING_EFI_APPLICATION),
(u8 *)EFI_CALLING_EFI_APPLICATION);
if (ret != EFI_SUCCESS)
goto out;
for (pcr_index = 0; pcr_index <= 7; pcr_index++) {
ret = tcg2_measure_event(dev, pcr_index, EV_SEPARATOR,
sizeof(event), (u8 *)&event);
if (ret != EFI_SUCCESS)
goto out;
}
tcg2_efi_app_invoked = true;
out:
return ret;
}
/**
* efi_tcg2_measure_efi_app_exit() - measure efi app exit
*
* Return: status code
*/
efi_status_t efi_tcg2_measure_efi_app_exit(void)
{
efi_status_t ret;
struct udevice *dev;
ret = platform_get_tpm2_device(&dev);
if (ret != EFI_SUCCESS)
return ret;
ret = tcg2_measure_event(dev, 4, EV_EFI_ACTION,
strlen(EFI_RETURNING_FROM_EFI_APPLICATION),
(u8 *)EFI_RETURNING_FROM_EFI_APPLICATION);
return ret;
}
/**
* tcg2_measure_secure_boot_variable() - measure secure boot variables
*