[PATCH v3 2/2] efi/tpcm: Add complete support of TPCM module

[chench246 <chench246@gmail.com>]

TPCM(Trusted Platform Control Module) is a Chinese standard and has similar function
to tpm, but tpcm adds the function of active monitoring and control to the system.
It can realize active startup measurement when the system starts,as well as dynamic
measurement and monitoring when the program is running, further enhance the security
of the system.

Signed-off-by: hao chen <chench246@gmail.com>
---
 grub-core/Makefile.core.def |   7 +++
 grub-core/commands/tpcm.c   | 100 ++++++++++++++++++++++++++++++++++++
 2 files changed, 107 insertions(+)
 create mode 100755 grub-core/commands/tpcm.c

diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
index 24e8c8437..fc31dbca4 100644
--- a/grub-core/Makefile.core.def
+++ b/grub-core/Makefile.core.def
@@ -2600,6 +2600,13 @@ module = {
   cppflags = '-I$(srcdir)/lib/tss2 -I$(srcdir)/lib/libtasn1-grub';
 };
 
+module = {
+  name = tpcm;
+  common = commands/tpcm.c;
+  efi = commands/efi/tpcm.c;
+  enable = x86_64_efi;
+};
+
 module = {
   name = tr;
   common = commands/tr.c;
diff --git a/grub-core/commands/tpcm.c b/grub-core/commands/tpcm.c
new file mode 100755
index 000000000..a5869c98f
--- /dev/null
+++ b/grub-core/commands/tpcm.c
@@ -0,0 +1,100 @@
+/*
+ *  GRUB  --  GRand Unified Bootloader
+ *  Copyright (C) 2025  Free Software Foundation, Inc.
+ *
+ *  GRUB is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  GRUB is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  Core TPCM support code.
+ */
+
+#include <grub/err.h>
+#include <grub/verify.h>
+#include <grub/dl.h>
+#include <grub/efi/tpcm.h>
+
+GRUB_MOD_LICENSE ("GPLv3+");
+
+static char context_buf[TPCM_MAX_BUF_SIZE];
+
+static grub_err_t
+grub_tpcm_verify_init (grub_file_t io, enum grub_file_type type, void **context,
+                       enum grub_verify_flags *flags)
+{
+    grub_memset (context_buf, 0, TPCM_MAX_BUF_SIZE);
+    grub_snprintf (context_buf, TPCM_MAX_BUF_SIZE, "%d|%s", (type & GRUB_FILE_TYPE_MASK), io->name);
+    *context = context_buf;
+    *flags |= GRUB_VERIFY_FLAGS_SINGLE_CHUNK;
+
+    return GRUB_ERR_NONE;
+}
+
+static grub_err_t
+grub_tpcm_verify_write (void *context, void *buf, grub_size_t size)
+{
+    return grub_tpcm_measure_memory (context, (grub_addr_t)buf, size);
+}
+
+static grub_err_t
+grub_tpcm_verify_string (char *str, enum grub_verify_string_type type)
+{
+    const char *prefix = NULL;
+    char *description, *context = NULL;
+    grub_err_t status;
+
+    switch (type)
+    {
+    case GRUB_VERIFY_KERNEL_CMDLINE:
+      prefix = "kernel_cmdline: ";
+      break;
+    case GRUB_VERIFY_MODULE_CMDLINE:
+      prefix = "module_cmdline: ";
+      break;
+    case GRUB_VERIFY_COMMAND:
+      prefix = "grub_cmd: ";
+      break;
+    }
+
+    context = grub_zalloc (grub_strlen (str) + grub_strlen (prefix) + 1 + 4);  /* 4 for type */
+    if (context == NULL)
+        return grub_errno;
+
+    grub_snprintf (context, 4, "%d|", (type & GRUB_FILE_TYPE_MASK));
+    description = context + grub_strlen (context);
+    grub_memcpy (description, prefix, grub_strlen (prefix));
+    grub_memcpy (description + grub_strlen (prefix), str, grub_strlen (str) + 1);
+
+    status = grub_tpcm_measure_memory (context, (grub_addr_t)str, grub_strlen (str));
+
+    grub_free (context);
+
+    return status;
+}
+
+struct grub_file_verifier grub_tpcm_verifier = {
+    .name = "tpcm",
+    .init  = grub_tpcm_verify_init,
+    .write = grub_tpcm_verify_write,
+    .verify_string = grub_tpcm_verify_string,
+};
+
+GRUB_MOD_INIT (tpcm)
+{
+    grub_verifier_register (&grub_tpcm_verifier);
+}
+
+GRUB_MOD_FINI (tpcm)
+{
+    grub_verifier_unregister (&grub_tpcm_verifier);
+}
+
-- 
2.17.1


_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel