From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id CD949C433EF for ; Wed, 24 Nov 2021 10:44:40 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id B728282F83; Wed, 24 Nov 2021 11:44:35 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="Q9T+ittR"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 4813582F91; Wed, 24 Nov 2021 11:44:33 +0100 (CET) Received: from mail-wm1-x335.google.com (mail-wm1-x335.google.com [IPv6:2a00:1450:4864:20::335]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id F120982F7D for ; Wed, 24 Nov 2021 11:44:29 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-wm1-x335.google.com with SMTP id j140-20020a1c2392000000b003399ae48f58so4957032wmj.5 for ; Wed, 24 Nov 2021 02:44:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=jwdGl7REXJ8WHnhufM4LYfDPduvejFa8DtkSfn/3TFM=; b=Q9T+ittRhiJAQ5Rw5uVC3T8dmrTj0pp3anr5UEcohN0Uq3R2aLw/7UWor4wi1cKd9N Dut73f+BdIwOKTH7/q0/vBlkhfGeYoZ7BfwSZNmKPuLB00nJ8LcMjnASMDpVZKuvvLzG uZoaXMCjkTrMSJ86D88M12tUMQWHc3qfAXxuPvYKxI1b2GGjuchqxiOYYV2Df8iAUkpY uzQ5s+X+zoQr2tOgTEb+/SCLwuIdfo3CzbtK0VMMUa2iZNR+hdCSS22PP32DvmQxqxBN I6CCd1EZFhFDc/w1jlAPuF+1fn7vhq5RAKo1F0ns+tqIdXY6UNhVrvZ0JVvt0qDWeTOo vmCQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=jwdGl7REXJ8WHnhufM4LYfDPduvejFa8DtkSfn/3TFM=; b=iENv74F0SF2j1ix9wb9TUU4NiW7POLKE1mecgkXEooskhkXtUp1UPz3/dLNa+9b6V7 f8Kt3E5+oJrG6Rhg+8hTU2JV275zpP5phnz4SA2ArdcMfQFtlyTCg0IeKLeMPDkMzIYi liQusb/SCRCSxlwDpw4+I5qYO+S7xF8wZ4i6UtYwgXVxhiAT7moGlFz7EpCkkUtJaqXx yO76KcnrYChNwRhOTdBtYAGIOKiVJBPQkkkAkhQSCphMwla48Y8WofrYXvgbcjzYL48r Q29vKhie7YTjxXinfxkBXULAIXuMh/Q/tuF+15SQtHCvxboZWF0eDN+6zE0HgwAN/jFa djtw== X-Gm-Message-State: AOAM530/0MKshxFn+X/7mZp/4vr3MASHMF/BtVwru709yfB/oAbQhObY tnaU0dVER6Ar1KCQ6DxEPbC0KQ== X-Google-Smtp-Source: ABdhPJwyXjgeLzyZTeHK7JMwdM5mA1YsXttu8bd0qqv0Vc0ZgztavwF2VCiv3J/4pU7tbyxFq4K3zQ== X-Received: by 2002:a05:600c:1d9b:: with SMTP id p27mr13793260wms.123.1637750669447; Wed, 24 Nov 2021 02:44:29 -0800 (PST) Received: from apalos.home (ppp-94-66-220-227.home.otenet.gr. [94.66.220.227]) by smtp.gmail.com with ESMTPSA id o10sm18571799wri.15.2021.11.24.02.44.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 24 Nov 2021 02:44:29 -0800 (PST) Date: Wed, 24 Nov 2021 12:44:26 +0200 From: Ilias Apalodimas To: Ruchika Gupta Cc: u-boot@lists.denx.de, xypron.glpk@gmx.de, agraf@csgraf.de Subject: Re: [v2] [PATCH 3/3] efi_loader: Extend PCR's for firmware measurements Message-ID: References: <20211123115335.125252-1-ruchika.gupta@linaro.org> <20211123115335.125252-3-ruchika.gupta@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20211123115335.125252-3-ruchika.gupta@linaro.org> X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.37 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean On Tue, Nov 23, 2021 at 05:23:35PM +0530, Ruchika Gupta wrote: > Firmwares before U-Boot may be capable of doing tpm measurements > and passing them to U-Boot in the form of eventlog. However there > may be scenarios where the firmwares don't have TPM driver and > are not capable of extending the measurements in the PCRs. > Based on TCG spec, if previous firnware has extended PCR's, PCR0 > would not be 0. So, read the PCR0 to determine if the PCR's need > to be extended as eventlog is parsed or not. > > Signed-off-by: Ruchika Gupta > --- > v2 : Removed check for PCR0 in eventlog > > lib/efi_loader/efi_tcg2.c | 77 +++++++++++++++++++++++++++++++++++++++ > 1 file changed, 77 insertions(+) > > diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c > index c3ebdf92f5..133fe8291a 100644 > --- a/lib/efi_loader/efi_tcg2.c > +++ b/lib/efi_loader/efi_tcg2.c > @@ -199,6 +199,43 @@ static efi_status_t tcg2_pcr_extend(struct udevice *dev, u32 pcr_index, > return EFI_SUCCESS; > } > > +/* tcg2_pcr_read - Read PCRs for a TPM2 device for a given tpml_digest_values > + * > + * @dev: device > + * @digest_list: list of digest algorithms to extend > + * > + * @Return: status code > + */ > +static efi_status_t tcg2_pcr_read(struct udevice *dev, u32 pcr_index, > + struct tpml_digest_values *digest_list) > +{ > + struct tpm_chip_priv *priv; > + unsigned int updates, pcr_select_min; > + u32 rc; > + size_t i; > + > + priv = dev_get_uclass_priv(dev); > + if (!priv) > + return EFI_DEVICE_ERROR; > + > + pcr_select_min = priv->pcr_select_min; > + > + for (i = 0; i < digest_list->count; i++) { > + u16 hash_alg = digest_list->digests[i].hash_alg; > + u8 *digest = (u8 *)&digest_list->digests[i].digest; > + > + rc = tpm2_pcr_read(dev, pcr_index, pcr_select_min, > + hash_alg, digest, alg_to_len(hash_alg), > + &updates); > + if (rc) { > + EFI_PRINT("Failed to read PCR\n"); > + return EFI_DEVICE_ERROR; > + } > + } > + > + return EFI_SUCCESS; > +} > + > /* put_event - Append an agile event to an eventlog > * > * @pcr_index: PCR index > @@ -1427,6 +1464,8 @@ efi_status_t tcg2_get_fw_eventlog(struct udevice *dev, void *log_buffer, > u32 pcr, pos; > u64 base; > u32 sz; > + bool extend_pcr = false; > + int i; > > ret = platform_get_eventlog(dev, &base, &sz); > if (ret == EFI_SUCCESS) { > @@ -1447,6 +1486,26 @@ efi_status_t tcg2_get_fw_eventlog(struct udevice *dev, void *log_buffer, > return EFI_COMPROMISED_DATA; > } > > + ret = tcg2_pcr_read(dev, 0, &digest_list); > + if (ret) { > + log_err("Error reading PCR 0\n"); > + return ret; > + } > + > + /* > + * If PCR0 is 0, previous firmware didn't have the capability > + * to extend the PCR. In this scenario, extend the PCR as > + * the eventlog is parsed. > + */ > + for (i = 0; i < digest_list.count; i++) { > + u8 buffer[TPM2_DIGEST_LEN] = { 0 }; > + u16 hash_alg = digest_list.digests[i].hash_alg; > + > + if (!memcmp((u8 *)&digest_list.digests[i].digest, > + buffer, alg_to_len(hash_alg))) > + extend_pcr = true; > + } > + > while (pos < sz) { > ret = tcg2_parse_event(dev, buffer, sz, &pos, > &digest_list, &pcr); > @@ -1454,6 +1513,24 @@ efi_status_t tcg2_get_fw_eventlog(struct udevice *dev, void *log_buffer, > log_err("Error parsing event\n"); > return ret; > } > + > + if (extend_pcr) { > + ret = tcg2_pcr_extend(dev, pcr, &digest_list); > + if (ret != EFI_SUCCESS) { > + log_err("Error in extending PCR\n"); > + return ret; > + } > + > + /* Clear the digest for next event */ > + for (i = 0; i < digest_list.count; i++) { > + u16 hash_alg = > + digest_list.digests[i].hash_alg; > + u8 *digest = > + (u8 *)&digest_list.digests[i].digest; > + > + memset(digest, 0, alg_to_len(hash_alg)); > + } > + } > } > > memcpy(log_buffer, buffer, sz); > -- > 2.25.1 > Reviewed-by: Ilias Apalodimas