sravan/system76-coreboot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

vendorcode/eltan/security: Align mboot with coreboot tpm

Browse Source 
Align the eltan mboot support with coreboot tpm support to limit the amount of custom code.

We now only support SHA256 pcrs, only single a single digest will be handled in a call.
The pcr invalidation has been changed fixed values are now loaded while the correct algortihm is
selected.

BUG=N/A
TEST=tested on fbg1701

Change-Id: Id11389ca90c1e6121293353402a2dd464a2e6727
Signed-off-by: Wim Vervoorn <wvervoorn@eltan.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/36483
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Frans Hendriks <fhendriks@eltan.com>
This commit is contained in:
Wim Vervoorn 2019-10-30 17:06:58 +01:00 committed by Patrick Georgi
parent 8119841ec0
commit 397ce3c45f
4 changed files with 47 additions and 119 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/mainboard/facebook/fbg1701/romstage.c
View File

@ -78,7 +78,7 @@ static const uint8_t crtm_version[] =
CONFIG_VENDORCODE_ELTAN_CRTM_VERSION_STRING COREBOOT_VERSION COREBOOT_EXTRA_VERSION CONFIG_VENDORCODE_ELTAN_CRTM_VERSION_STRING COREBOOT_VERSION COREBOOT_EXTRA_VERSION
" " COREBOOT_BUILD; " " COREBOOT_BUILD;
int mb_crtm(EFI_TCG2_EVENT_ALGORITHM_BITMAP activePcr) int mb_crtm(void)
{ {
int status = TPM_E_IOERROR; int status = TPM_E_IOERROR;
TCG_PCR_EVENT2_HDR tcgEventHdr; TCG_PCR_EVENT2_HDR tcgEventHdr;
@ -91,9 +91,9 @@ int mb_crtm(EFI_TCG2_EVENT_ALGORITHM_BITMAP activePcr)
tcgEventHdr.eventSize = sizeof(crtm_version); tcgEventHdr.eventSize = sizeof(crtm_version);
printk(BIOS_DEBUG, "%s: EventSize - %u\n", __func__, tcgEventHdr.eventSize); printk(BIOS_DEBUG, "%s: EventSize - %u\n", __func__, tcgEventHdr.eventSize);
status = mboot_hash_extend_log(activePcr, 0, (uint8_t *)crtm_version, status = mboot_hash_extend_log(0, (uint8_t *)crtm_version,
tcgEventHdr.eventSize, &tcgEventHdr, tcgEventHdr.eventSize, &tcgEventHdr,
(uint8_t *)crtm_version, 0); (uint8_t *)crtm_version);
if (status) { if (status) {
printk(BIOS_DEBUG, "Measure CRTM Version returned 0x%x\n", status); printk(BIOS_DEBUG, "Measure CRTM Version returned 0x%x\n", status);
} }

141
src/vendorcode/eltan/security/mboot/mboot.c
View File

@ -120,92 +120,37 @@ int tpm2_get_capability_pcrs(TPML_PCR_SELECTION *Pcrs)
* Calculates the hash over the data and extends it in active PCR banks and * Calculates the hash over the data and extends it in active PCR banks and
* then logs them in the event log. * then logs them in the event log.
* *
* @param[in] activePcr bitmap of active PCR banks in TPM. * @param[in] flags flags associated with hash data. Currently unused.
* @param[in] flags flags associated with hash data. Currently
* unused.
* @param[in] hashData data to be hashed. * @param[in] hashData data to be hashed.
* @param[in] hashDataLen length of the data to be hashed. * @param[in] hashDataLen length of the data to be hashed.
* @param[in] newEventHdr event header in TCG_PCR_EVENT2 format. * @param[in] newEventHdr event header in TCG_PCR_EVENT2 format.
* @param[in] eventLog description of the event. * @param[in] eventLog description of the event.
* @param[in] invalid invalidate the pcr
* *
* @retval TPM_SUCCESS Operation completed successfully. * @retval TPM_SUCCESS Operation completed successfully.
* @retval TPM_E_IOERROR Unexpected device behavior. * @retval TPM_E_IOERROR Unexpected device behavior.
*/ */
int mboot_hash_extend_log(EFI_TCG2_EVENT_ALGORITHM_BITMAP activePcr, int mboot_hash_extend_log(uint64_t flags, uint8_t *hashData, uint32_t hashDataLen,
uint64_t flags, uint8_t *hashData, uint32_t hashDataLen, TCG_PCR_EVENT2_HDR *newEventHdr, uint8_t *eventLog)
TCG_PCR_EVENT2_HDR *newEventHdr, uint8_t *eventLog, uint8_t invalid)
{ {
int status;
TPMT_HA *digest = NULL; TPMT_HA *digest = NULL;
int digest_num = 0;
printk(BIOS_DEBUG, "%s: Hash Data Length: %zu bytes\n", __func__, printk(BIOS_DEBUG, "%s: Hash Data Length: %zu bytes\n", __func__, (size_t)hashDataLen);
(size_t)hashDataLen);
if (invalid) { /* Generate SHA256 */
digest = &(newEventHdr->digest.digests[digest_num]); digest = &(newEventHdr->digest.digests[0]);
digest->hashAlg = TPM_ALG_ERROR; if (flags & MBOOT_HASH_PROVIDED) {
digest_num++; /* The hash is provided as data */
memcpy(digest->digest.sha256, (void *)hashData, hashDataLen);
} else { } else {
/* if (cb_sha_little_endian(VB2_HASH_SHA256, hashData, hashDataLen,
* Generate SHA1 hash if SHA1 PCR bank is active in TPM digest->digest.sha256))
* currently return TPM_E_IOERROR;
*/
if (activePcr & EFI_TCG2_BOOT_HASH_ALG_SHA1) {
digest = &(newEventHdr->digest.digests[digest_num]);
if (flags & MBOOT_HASH_PROVIDED) {
/* The hash is provided as data */
memcpy(digest->digest.sha1, (void *)hashData,
VB2_SHA1_DIGEST_SIZE);
} else {
if (cb_sha_little_endian(VB2_HASH_SHA1, hashData,
hashDataLen, digest->digest.sha1))
return TPM_E_IOERROR;
}
digest->hashAlg = TPM_ALG_SHA1;
digest_num++;
printk(BIOS_DEBUG, "%s: SHA1 Hash Digest:\n", __func__);
mboot_print_buffer(digest->digest.sha1,
VB2_SHA1_DIGEST_SIZE);
}
/*
* Generate SHA256 hash if SHA256 PCR bank is active in TPM
* currently
*/
if (activePcr & EFI_TCG2_BOOT_HASH_ALG_SHA256) {
digest = &(newEventHdr->digest.digests[digest_num]);
if (flags & MBOOT_HASH_PROVIDED) {
/* The hash is provided as data */
memcpy(digest->digest.sha256,
(void *)hashData, hashDataLen);
} else {
if (cb_sha_little_endian(VB2_HASH_SHA256, hashData,
hashDataLen, digest->digest.sha256))
return TPM_E_IOERROR;
}
digest->hashAlg = TPM_ALG_SHA256;
digest_num++;
printk(BIOS_DEBUG, "%s: SHA256 Hash Digest:\n",
__func__);
mboot_print_buffer(digest->digest.sha256,
VB2_SHA256_DIGEST_SIZE);
}
} }
newEventHdr->digest.count = digest_num; printk(BIOS_DEBUG, "%s: SHA256 Hash Digest:\n", __func__);
mboot_print_buffer(digest->digest.sha256, VB2_SHA256_DIGEST_SIZE);
status = tlcl_extend(newEventHdr->pcrIndex, (uint8_t *)&(newEventHdr->digest), return (tlcl_extend(newEventHdr->pcrIndex, (uint8_t *)&(newEventHdr->digest), NULL));
NULL);
if (status != TPM_SUCCESS)
printk(BIOS_DEBUG, "%s: returned 0x%x\n", __func__, status);
return status;
} }
/* /*
@ -215,13 +160,11 @@ int mboot_hash_extend_log(EFI_TCG2_EVENT_ALGORITHM_BITMAP activePcr,
*/ */
void invalidate_pcrs(void) void invalidate_pcrs(void)
{ {
int status, pcr; int pcr;
TCG_PCR_EVENT2_HDR tcgEventHdr; int status;
EFI_TCG2_EVENT_ALGORITHM_BITMAP ActivePcrs;
uint8_t invalidate;
ActivePcrs = tpm2_get_active_pcrs(); TCG_PCR_EVENT2_HDR tcgEventHdr;
invalidate = 1; uint8_t invalidate = 1;
for (pcr = 0; pcr < 8; pcr++) { for (pcr = 0; pcr < 8; pcr++) {
printk(BIOS_DEBUG, "%s: Invalidating PCR %d\n", __func__, pcr); printk(BIOS_DEBUG, "%s: Invalidating PCR %d\n", __func__, pcr);
@ -230,10 +173,9 @@ void invalidate_pcrs(void)
tcgEventHdr.eventType = EV_NO_ACTION; tcgEventHdr.eventType = EV_NO_ACTION;
tcgEventHdr.eventSize = (uint32_t) sizeof(invalidate); tcgEventHdr.eventSize = (uint32_t) sizeof(invalidate);
status = mboot_hash_extend_log(ActivePcrs, 0, status = mboot_hash_extend_log(0, (uint8_t *)&invalidate,
(uint8_t *)&invalidate, tcgEventHdr.eventSize, tcgEventHdr.eventSize, &tcgEventHdr,
&tcgEventHdr, (uint8_t *)"Invalidate PCR", invalidate); (uint8_t *)"Invalidate PCR");
if (status != TPM_SUCCESS) if (status != TPM_SUCCESS)
printk(BIOS_DEBUG, "%s: invalidating pcr %d returned" printk(BIOS_DEBUG, "%s: invalidating pcr %d returned"
" 0x%x\n", __func__, pcr, status); " 0x%x\n", __func__, pcr, status);
@ -288,7 +230,6 @@ void mboot_print_buffer(uint8_t *buffer, uint32_t bufferSize)
/* /*
* measures and logs the specified cbfs file. * measures and logs the specified cbfs file.
* *
* @param[in] activePcr bitmap of active PCR banks in TPM.
* @param[in] name name of the cbfs file to measure * @param[in] name name of the cbfs file to measure
* @param[in] type data type of the cbfs file. * @param[in] type data type of the cbfs file.
* @param[in] pcr pcr to extend. * @param[in] pcr pcr to extend.
@ -298,9 +239,8 @@ void mboot_print_buffer(uint8_t *buffer, uint32_t bufferSize)
* @retval TPM_SUCCESS Operation completed successfully. * @retval TPM_SUCCESS Operation completed successfully.
* @retval TPM_E_IOERROR Unexpected device behavior. * @retval TPM_E_IOERROR Unexpected device behavior.
*/ */
int mb_measure_log_worker(EFI_TCG2_EVENT_ALGORITHM_BITMAP activePcr, int mb_measure_log_worker(const char *name, uint32_t type, uint32_t pcr,
const char *name, uint32_t type, uint32_t pcr, TCG_EVENTTYPE eventType, const char *event_msg)
TCG_EVENTTYPE eventType, const char *event_msg)
{ {
int status; int status;
TCG_PCR_EVENT2_HDR tcgEventHdr; TCG_PCR_EVENT2_HDR tcgEventHdr;
@ -311,21 +251,18 @@ int mb_measure_log_worker(EFI_TCG2_EVENT_ALGORITHM_BITMAP activePcr,
base = cbfs_boot_map_with_leak(name, type, &size); base = cbfs_boot_map_with_leak(name, type, &size);
if (base == NULL) { if (base == NULL) {
printk(BIOS_DEBUG, "%s: CBFS locate fail: %s\n", __func__, printk(BIOS_DEBUG, "%s: CBFS locate fail: %s\n", __func__, name);
name);
return VB2_ERROR_READ_FILE_OPEN; return VB2_ERROR_READ_FILE_OPEN;
} }
printk(BIOS_DEBUG, "%s: CBFS locate success: %s\n", printk(BIOS_DEBUG, "%s: CBFS locate success: %s\n", __func__, name);
__func__, name);
memset(&tcgEventHdr, 0, sizeof(tcgEventHdr)); memset(&tcgEventHdr, 0, sizeof(tcgEventHdr));
tcgEventHdr.pcrIndex = pcr; tcgEventHdr.pcrIndex = pcr;
tcgEventHdr.eventType = eventType; tcgEventHdr.eventType = eventType;
if (event_msg) if (event_msg)
tcgEventHdr.eventSize = (uint32_t) strlen(event_msg); tcgEventHdr.eventSize = (uint32_t) strlen(event_msg);
status = mboot_hash_extend_log(activePcr, 0, base, size, &tcgEventHdr, status = mboot_hash_extend_log(0, base, size, &tcgEventHdr, (uint8_t *)event_msg);
(uint8_t *)event_msg, 0);
return status; return status;
} }
@ -436,18 +373,15 @@ int __attribute__((weak))mb_measure(int wake_from_s3)
int __attribute__((weak))mb_measure_log_start(void) int __attribute__((weak))mb_measure_log_start(void)
{ {
int status; int status;
EFI_TCG2_EVENT_ALGORITHM_BITMAP ActivePcrs;
uint32_t i; uint32_t i;
ActivePcrs = tpm2_get_active_pcrs(); if ((tpm2_get_active_pcrs() & EFI_TCG2_BOOT_HASH_ALG_SHA256) == 0x0) {
printk(BIOS_DEBUG, "%s: SHA256 PCR Bank not active in TPM.\n",
if (ActivePcrs == 0x0) {
printk(BIOS_DEBUG, "%s: No Active PCR Bank in TPM.\n",
__func__); __func__);
return TPM_E_IOERROR; return TPM_E_IOERROR;
} }
status = mb_crtm(ActivePcrs); status = mb_crtm();
if (status != TPM_SUCCESS) { if (status != TPM_SUCCESS) {
printk(BIOS_DEBUG, "%s: Fail! CRTM Version can't be measured." printk(BIOS_DEBUG, "%s: Fail! CRTM Version can't be measured."
" ABORTING!!!\n", __func__); " ABORTING!!!\n", __func__);
@ -458,7 +392,7 @@ int __attribute__((weak))mb_measure_log_start(void)
/* Log the items defined by the mainboard */ /* Log the items defined by the mainboard */
for (i = 0; i < ARRAY_SIZE(mb_log_list); i++) { for (i = 0; i < ARRAY_SIZE(mb_log_list); i++) {
status = mb_measure_log_worker( status = mb_measure_log_worker(
ActivePcrs, mb_log_list[i].cbfs_name, mb_log_list[i].cbfs_name,
mb_log_list[i].cbfs_type, mb_log_list[i].pcr, mb_log_list[i].cbfs_type, mb_log_list[i].pcr,
mb_log_list[i].eventType, mb_log_list[i].eventType,
mb_log_list[i].event_msg); mb_log_list[i].event_msg);
@ -490,12 +424,10 @@ static const uint8_t crtm_version[] =
* The function can be overridden at the mainboard level my simply creating a * The function can be overridden at the mainboard level my simply creating a
* function with the same name there. * function with the same name there.
* *
* @param[in] activePcr bitmap of the support
*
* @retval TPM_SUCCESS Operation completed successfully. * @retval TPM_SUCCESS Operation completed successfully.
* @retval TPM_E_IOERROR Unexpected device behavior. * @retval TPM_E_IOERROR Unexpected device behavior.
**/ **/
int __attribute__((weak))mb_crtm(EFI_TCG2_EVENT_ALGORITHM_BITMAP activePcr) int __attribute__((weak))mb_crtm(void)
{ {
int status; int status;
TCG_PCR_EVENT2_HDR tcgEventHdr; TCG_PCR_EVENT2_HDR tcgEventHdr;
@ -511,9 +443,8 @@ int __attribute__((weak))mb_crtm(EFI_TCG2_EVENT_ALGORITHM_BITMAP activePcr)
printk(BIOS_DEBUG, "%s: EventSize - %u\n", __func__, printk(BIOS_DEBUG, "%s: EventSize - %u\n", __func__,
tcgEventHdr.eventSize); tcgEventHdr.eventSize);
status = mboot_hash_extend_log(activePcr, 0, (uint8_t *)crtm_version, status = mboot_hash_extend_log(0, (uint8_t *)crtm_version, tcgEventHdr.eventSize,
tcgEventHdr.eventSize, &tcgEventHdr, (uint8_t *)crtm_version, &tcgEventHdr, (uint8_t *)crtm_version);
0);
if (status) { if (status) {
printk(BIOS_DEBUG, "Measure CRTM Version returned 0x%x\n", status); printk(BIOS_DEBUG, "Measure CRTM Version returned 0x%x\n", status);
return status; return status;
@ -535,8 +466,8 @@ int __attribute__((weak))mb_crtm(EFI_TCG2_EVENT_ALGORITHM_BITMAP activePcr)
msgPtr = NULL; msgPtr = NULL;
tcgEventHdr.eventSize = 0; tcgEventHdr.eventSize = 0;
status = mboot_hash_extend_log(activePcr, MBOOT_HASH_PROVIDED, hash, status = mboot_hash_extend_log(MBOOT_HASH_PROVIDED, hash, sizeof(hash), &tcgEventHdr,
sizeof(hash), &tcgEventHdr, msgPtr, 0); msgPtr);
if (status) if (status)
printk(BIOS_DEBUG, "Add ME hash returned 0x%x\n", status); printk(BIOS_DEBUG, "Add ME hash returned 0x%x\n", status);

15
src/vendorcode/eltan/security/mboot/mboot.h
View File

@ -89,16 +89,14 @@ typedef uint32_t EFI_TCG2_EVENT_ALGORITHM_BITMAP;
*/ */
#define MBOOT_HASH_PROVIDED (0x00000001) #define MBOOT_HASH_PROVIDED (0x00000001)
int is_zero_buffer(void *buffer, unsigned int size); int is_zero_buffer(void *buffer, unsigned int size);
int mboot_hash_extend_log(EFI_TCG2_EVENT_ALGORITHM_BITMAP activePcr, int mboot_hash_extend_log(uint64_t flags, uint8_t *hashData, uint32_t hashDataLen,
uint64_t flags, uint8_t *hashData, uint32_t hashDataLen, TCG_PCR_EVENT2_HDR *newEventHdr, uint8_t *eventLog);
TCG_PCR_EVENT2_HDR *newEventHdr, uint8_t *eventLog, uint8_t invalid);
void mboot_print_buffer(uint8_t *buffer, uint32_t bufferSize); void mboot_print_buffer(uint8_t *buffer, uint32_t bufferSize);
int mb_crtm(EFI_TCG2_EVENT_ALGORITHM_BITMAP activePcr); int mb_crtm(void);
typedef struct { typedef struct {
const char *cbfs_name; const char *cbfs_name;
@ -108,9 +106,8 @@ typedef struct {
const char *event_msg; const char *event_msg;
} mboot_measure_item_t; } mboot_measure_item_t;
int mb_measure_log_worker(EFI_TCG2_EVENT_ALGORITHM_BITMAP activePcr, int mb_measure_log_worker(const char *name, uint32_t type, uint32_t pcr,
const char *name, uint32_t type, uint32_t pcr, TCG_EVENTTYPE eventType, const char *event_msg);
TCG_EVENTTYPE eventType, const char *event_msg);
int mb_measure_log_start(void); int mb_measure_log_start(void);
void invalidate_pcrs(void); void invalidate_pcrs(void);
@ -122,7 +119,7 @@ int tpm2_get_capability_pcrs(TPML_PCR_SELECTION *Pcrs);
int mb_measure(int wake_from_s3); int mb_measure(int wake_from_s3);
int mb_entry(int wake_from_s3); int mb_entry(int wake_from_s3);
int log_efi_specid_event(EFI_TCG2_EVENT_ALGORITHM_BITMAP ActivePcrs); int log_efi_specid_event(void);
int log_event_tcg_20_format(TCG_PCR_EVENT2_HDR *EventHdr, uint8_t *EventLog); int log_event_tcg_20_format(TCG_PCR_EVENT2_HDR *EventHdr, uint8_t *EventLog);
int log_event_tcg_12_format(TCG_PCR_EVENT2_HDR *EventHdr, uint8_t *EventLog); int log_event_tcg_12_format(TCG_PCR_EVENT2_HDR *EventHdr, uint8_t *EventLog);

4
src/vendorcode/eltan/security/mboot/mboot_func.c
View File

@ -1,7 +1,7 @@
/* /*
* This file is part of the coreboot project. * This file is part of the coreboot project.
* *
* Copyright (C) 2018 Eltan B.V. * Copyright (C) 2018-2019 Eltan B.V.
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by * it under the terms of the GNU General Public License as published by
@ -15,7 +15,7 @@
#include <mboot.h> #include <mboot.h>
int log_efi_specid_event(EFI_TCG2_EVENT_ALGORITHM_BITMAP ActivePcrs) { int log_efi_specid_event(void) {
return TPM_SUCCESS; return TPM_SUCCESS;
} }