From patchwork Thu Apr 15 13:30:19 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Masahisa Kojima X-Patchwork-Id: 421767 Delivered-To: patch@linaro.org Received: by 2002:a02:6a6f:0:0:0:0:0 with SMTP id m47csp469527jaf; Thu, 15 Apr 2021 06:24:58 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzXXekT3VdLq2HVQ7grXF5hi7Y+KH4Y7nxE/iJrp7vZMA5i6jgvy0iYg/xjW+Wcc6iMwDDX X-Received: by 2002:a50:f19d:: with SMTP id x29mr4375153edl.102.1618493098758; Thu, 15 Apr 2021 06:24:58 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1618493098; cv=none; d=google.com; s=arc-20160816; b=mfxQm2+RtxipQdNN+b6QOUJScOAhrrHRk6KomMsK7hS13FmzeZS1SN9PcfriXjnaJW 5gNeBk5xgzTMeKRkja/TTXkg8EUaHiPTMFg9JLxtIsIAzvstaUdkKDT1YK8nphRV4N9Y ymbd1Ggxanm/eNbv5IwQXkH6nh/hjVLdkZJA+5nk1UoaaFeQPNKaxa0Kw+/YkgbVhjTM PgncL/lMGSkWPW5/Z0XTT4ObNw7JDE4iIrWJTVRzKr9bLyfSyGa0tj/kfA1DJ7NRlbrd JtcFuLe9V2I3kGA/GAPpVf+Zdz4lA6spoy24FcGWRouLop57MH8Ot/UdU8850B9N2WwX KkDQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=Oakivl+hOZER5Ni1FOhqPbb0h3bVcMVthQvx8L/MypQ=; b=W3dYA/hoOfVF9QFFukoa6c11BXzWzXIsTbyRSN/j1zbZgiVbSONc0620ms0GiElrYC mQgrLGc5i+vMVRRk5SD/XzhuIWh7YxqNdIiIaazQZuITFzARXqH1a7La58dJO4oahqcJ FhUrVqg+rqkUZ+M/t3tw5ZbJgBIID7jHDVa4OQIZu8ZDEG9koOMcQhUhGs8IB71ImrDK BQS4+dST82Fk0jyGeLBG1f+iJOzjatBkTaZnvHj4mYGRt86jwMigSKSJJhXlWnExAZlY aCis7r53nAUuxsnvxEpT0Znw4pg5Wnstml5Ml5w9icSGQlmti10zgef8zS6bRaGyLvjr o83Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=DBlzm81+; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [2a01:238:438b:c500:173d:9f52:ddab:ee01]) by mx.google.com with ESMTPS id x8si2220170edd.185.2021.04.15.06.24.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 15 Apr 2021 06:24:58 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=DBlzm81+; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 938D782012; Thu, 15 Apr 2021 15:24:56 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="DBlzm81+"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id AF00281FE8; Thu, 15 Apr 2021 15:24:46 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,SPF_HELO_NONE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-pj1-x1030.google.com (mail-pj1-x1030.google.com [IPv6:2607:f8b0:4864:20::1030]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 9E36B81FE0 for ; Thu, 15 Apr 2021 15:24:41 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=masahisa.kojima@linaro.org Received: by mail-pj1-x1030.google.com with SMTP id x21-20020a17090a5315b029012c4a622e4aso12689299pjh.2 for ; Thu, 15 Apr 2021 06:24:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=Oakivl+hOZER5Ni1FOhqPbb0h3bVcMVthQvx8L/MypQ=; b=DBlzm81+vh7fsc02CKRgbnloWscGDzDWTAoKC9E7y/SovBOsnt/um/8mhY3wLp2TVa 2saWEBzXg9z4bCxAMPt2JycnVmXYHkijkLLmtASyguyekM4mptdM4d0XNuyrmDcfa45L ZfyEvs+jTxCdsSXwx3KX/fSHfMq+K1FksSxHz4Ls5+WCFvtfLCSE9IUWEeR8zRGx3UN8 p0ZiWCxDfBSbFRH6RpLGaMoiKKzps7hVaoc3raCS5i75A4uLdnhLFvp+x1wqUaqJ2FW6 akxhgvge+eXmWo8zhhcEtkaTKWvZX1o+qaklTwcCMFfB2Fyisb0vic2mTPHaPAiRHjin eN8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=Oakivl+hOZER5Ni1FOhqPbb0h3bVcMVthQvx8L/MypQ=; b=Vc5SOjq+JWrP9JDCzrzKi7pK5n43ppcGk1zaConPjIMGpvuLYFZftGRwYZi6BF7Pnf qXEMwZAfsahN6GDboMxf3IEfE526z1LSDdSX9UhgMp015ikttWHFA9rK0pFazIBSQG3s TTECV+71p3s37HoBPu15UtwtklcHKRMpovKEd/pt0rjSdzcRu2YPDhD42RcqCj6g1UGX 6RF/P7+utiUwIAeDl8Jstcx3VJYarj1VQVmiESTXlohU2WkmagalmZ5Jw9l2CXhihDdT 0GCF64eF2fO+9sr4O72rjRMptS33Ola1gGOLf6VFXFE10YMIqroybd0QIXM3ToLZvLXl J1rQ== X-Gm-Message-State: AOAM531ubYKSVAWq11cvIuudz4DyXpnChpB0Sy8oB8zFLw3Mu4et5SGC rnTMiSDlNRueo4Fw21g6D1kneg== X-Received: by 2002:a17:90a:3b4c:: with SMTP id t12mr4147042pjf.142.1618493079977; Thu, 15 Apr 2021 06:24:39 -0700 (PDT) Received: from localhost.localdomain ([2400:2411:502:a100:82fa:5bff:fe4b:26b1]) by smtp.gmail.com with ESMTPSA id m11sm2527461pjs.34.2021.04.15.06.24.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 15 Apr 2021 06:24:39 -0700 (PDT) From: Masahisa Kojima To: Heinrich Schuchardt Cc: Alexander Graf , Simon Glass , Ilias Apalodimas , Masahisa Kojima , Dhananjay Phadke , Takahiro Akashi , u-boot@lists.denx.de Subject: [PATCH 1/2] efi_loader: expose efi_image_parse() even if UEFI Secure Boot is disabled Date: Thu, 15 Apr 2021 22:30:19 +0900 Message-Id: <20210415133020.29175-2-masahisa.kojima@linaro.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210415133020.29175-1-masahisa.kojima@linaro.org> References: <20210415133020.29175-1-masahisa.kojima@linaro.org> X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.4 at phobos.denx.de X-Virus-Status: Clean This is preparation for PE/COFF measurement support. PE/COFF image hash calculation is same in both UEFI Secure Boot image verification and measurement in measured boot. This commit exposes the hash calculation functions even if UEFI Secure Boot is not enabled. Signed-off-by: Masahisa Kojima --- lib/efi_loader/efi_image_loader.c | 2 +- lib/efi_loader/efi_signature.c | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) -- 2.17.1 diff --git a/lib/efi_loader/efi_image_loader.c b/lib/efi_loader/efi_image_loader.c index f53ef367ec..2c35cb5651 100644 --- a/lib/efi_loader/efi_image_loader.c +++ b/lib/efi_loader/efi_image_loader.c @@ -213,7 +213,6 @@ static void efi_set_code_and_data_type( } } -#ifdef CONFIG_EFI_SECURE_BOOT /** * cmp_pe_section() - compare virtual addresses of two PE image sections * @arg1: pointer to pointer to first section header @@ -422,6 +421,7 @@ err: return false; } +#ifdef CONFIG_EFI_SECURE_BOOT /** * efi_image_unsigned_authenticate() - authenticate unsigned image with * SHA256 hash diff --git a/lib/efi_loader/efi_signature.c b/lib/efi_loader/efi_signature.c index c7ec275414..1dd9d0e130 100644 --- a/lib/efi_loader/efi_signature.c +++ b/lib/efi_loader/efi_signature.c @@ -538,6 +538,7 @@ out: EFI_PRINT("%s: Exit, revoked: %d\n", __func__, revoked); return !revoked; } +#endif /** * efi_image_region_add() - add an entry of region @@ -601,6 +602,7 @@ efi_status_t efi_image_region_add(struct efi_image_regions *regs, return EFI_SUCCESS; } +#if defined(CONFIG_EFI_SECURE_BOOT) || defined(CONFIG_EFI_CAPSULE_AUTHENTICATE) /** * efi_sigstore_free - free signature store * @sigstore: Pointer to signature store structure From patchwork Thu Apr 15 13:30:20 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Masahisa Kojima X-Patchwork-Id: 421768 Delivered-To: patch@linaro.org Received: by 2002:a02:6a6f:0:0:0:0:0 with SMTP id m47csp469754jaf; Thu, 15 Apr 2021 06:25:15 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwVmBIEXtAjqvdGweQucFpaOkME7QlqZSvgxp/kDf0XREg7zGFVBSJUJ36tJY+nABHb9icu X-Received: by 2002:a17:906:1284:: with SMTP id k4mr3267531ejb.409.1618493114865; Thu, 15 Apr 2021 06:25:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1618493114; cv=none; d=google.com; s=arc-20160816; b=BkGRUeEX3W9GqQ9HuKUzCetLDQVWiDHLPv91dLDnzaO3w66ibAOwWyR++iwDLanvtB RMP4/nMu9BQ2eqcAeUOkNgVjkeKhBd++gQAlJdIZA/KsZ8emIItVEZ713khYg0fgfoUV FLiuT5sqNJIXmMEUCIl3piCbSFURteRf33XiIRJXmsJEaPuwoetbqM5o4FO3bC+G1Oqd aH40H236gcVGddYCsC/bTsKrILdmyVnlKQf8jIsCiaAdVTvRrcQyUKUN4/KIVik3yuVs miTuTD46A4vyFZSV//zyo4mPQwkwn4h5ahv+69vEC2s4iY0pDKv3fnvB4pn2F7zeVmKQ 6Zwg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=cJTu377ZJyUJxXo/14mi5cTFo9klwXerYDFRYqpg41g=; b=i3dyjkhD9NdRLDPVTKfW/eQrG07xrjhIBicnjNrOsFNrO44M7NyjnswW+QVX9CsbB8 Erm6Sw+cKnkhFvmqKNUiZhFHFgahtyxngZl0/80Aa8jZatofn3uONkVU+Z2i0dBZFbqD g39mg+mPLFNOJO4WdZ8/HQH6RCRH1UwekHAMXL71YfvZvOiaFzCRYeJfe/DTUPXLGI24 0K3tP9ac+IodBOZR4BQJMxmC+jR0QRak5jw9sCMljQ3WVZjfrUykH0OKUvDkdyVJRZwK RjDewCWYYZGMZxhaaTSxEM/Pg7Mjhytr14dNQXjvaAmkz1xEmfJueP2wHjJYV6DNQdHN Y3gg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=BpheLZ7z; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id k7si2104347eds.512.2021.04.15.06.25.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 15 Apr 2021 06:25:14 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=BpheLZ7z; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id B360182030; Thu, 15 Apr 2021 15:25:06 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="BpheLZ7z"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 45EA281FFC; Thu, 15 Apr 2021 15:24:53 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,SPF_HELO_NONE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-pf1-x434.google.com (mail-pf1-x434.google.com [IPv6:2607:f8b0:4864:20::434]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 5208E81E89 for ; Thu, 15 Apr 2021 15:24:44 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=masahisa.kojima@linaro.org Received: by mail-pf1-x434.google.com with SMTP id w6so1522868pfc.8 for ; Thu, 15 Apr 2021 06:24:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=cJTu377ZJyUJxXo/14mi5cTFo9klwXerYDFRYqpg41g=; b=BpheLZ7zhhjITRfZhXQw+fUJSx34e52laNAetuGCojKuDqxpwO6Wa4aTlkeE8UxOBf mLhM3uPKbODpRvGESpT27pR4eNcWnYLBiCNGQvNWbhx1Wca64c9o81PeMVG6vOiBMtcm nSUCgxUFJO08LDn5fYNIwZToDaZzHSd0aOPv+K7b8OahWD2MQgKIkof6XStYDZZ+6JqU wPEQQq8X+Ld/nzAkGSUxMZ9kopZm2zaC5zAT26elC8K0CN8J0ZnIL0xz963f9Lew4zf8 9gvgEhivvUi++PoxBgFF9gWcpP62av98FZM6ITS18Z5DhIAtI22g4hHfFFm5QpkEmYNe mAHg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=cJTu377ZJyUJxXo/14mi5cTFo9klwXerYDFRYqpg41g=; b=i2xaBRx2UbGRgO+h6J7GYfx+0Qoo84maopDTY7pf3brvILuDj2MkPUiVtPo1taMBZQ urP3rFJyQArvq7hkozZWzsv4AtHGZjiMyI99S1dlKlxIpfnm9vD2rffTx/5l5OBTM7AO r5mlJbvABChDoQKltn9hW+MJd8jIA4ZjM6UD1cD+BY0wA8OWR4iw5HN6V8zhiSl+40mi CBKtVZK5u/ngEHXNZzg+cZAI3PwXGKuy3Xy+l0MYmmEigDL8nFGkQhx8JDDJoBtT/ixI 3u30T3fpqzMbJlcfwydWirU1gjDnxhJr/d95JTm7e2rh/0kp2dwTd/RDg5tCbH3QSdYD aq8Q== X-Gm-Message-State: AOAM530xNgKFiCZ5bwlZ33lCm2GxOnuA00JiK1dKMQo0105NCnNwE1nU 0qGyrSNjq+fZ8FLbzr3F7GmCvQ== X-Received: by 2002:a63:b52:: with SMTP id a18mr3494128pgl.276.1618493082870; Thu, 15 Apr 2021 06:24:42 -0700 (PDT) Received: from localhost.localdomain ([2400:2411:502:a100:82fa:5bff:fe4b:26b1]) by smtp.gmail.com with ESMTPSA id m11sm2527461pjs.34.2021.04.15.06.24.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 15 Apr 2021 06:24:42 -0700 (PDT) From: Masahisa Kojima To: Heinrich Schuchardt Cc: Alexander Graf , Simon Glass , Ilias Apalodimas , Masahisa Kojima , Dhananjay Phadke , Takahiro Akashi , u-boot@lists.denx.de Subject: [PATCH 2/2] efi_loader: add PE/COFF image measurement Date: Thu, 15 Apr 2021 22:30:20 +0900 Message-Id: <20210415133020.29175-3-masahisa.kojima@linaro.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210415133020.29175-1-masahisa.kojima@linaro.org> References: <20210415133020.29175-1-masahisa.kojima@linaro.org> X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.4 at phobos.denx.de X-Virus-Status: Clean "TCG PC Client Platform Firmware Profile Specification" requires to measure every attempt to load and execute a OS Loader(a UEFI application) into PCR[4]. This commit adds the PE/COFF image measurement, extends PCR, and appends measurement into Event Log. Signed-off-by: Masahisa Kojima --- include/efi_loader.h | 4 + include/efi_tcg2.h | 10 ++ include/tpm-v2.h | 1 + lib/efi_loader/efi_image_loader.c | 7 ++ lib/efi_loader/efi_tcg2.c | 187 ++++++++++++++++++++++++++++-- 5 files changed, 199 insertions(+), 10 deletions(-) -- 2.17.1 diff --git a/include/efi_loader.h b/include/efi_loader.h index de1a496a97..b02bc93c8e 100644 --- a/include/efi_loader.h +++ b/include/efi_loader.h @@ -426,6 +426,10 @@ efi_status_t efi_disk_register(void); efi_status_t efi_rng_register(void); /* Called by efi_init_obj_list() to install EFI_TCG2_PROTOCOL */ efi_status_t efi_tcg2_register(void); +/* measure the pe-coff image, extend PCR and add Event Log */ +efi_status_t tcg2_measure_pe_image(void *efi, u64 efi_size, + struct efi_loaded_image_obj *handle, + struct efi_loaded_image *loaded_image_info); /* Create handles and protocols for the partitions of a block device */ int efi_disk_create_partitions(efi_handle_t parent, struct blk_desc *desc, const char *if_typename, int diskid, diff --git a/include/efi_tcg2.h b/include/efi_tcg2.h index 40e241ce31..f8d46c5fd2 100644 --- a/include/efi_tcg2.h +++ b/include/efi_tcg2.h @@ -9,6 +9,8 @@ #if !defined _EFI_TCG2_PROTOCOL_H_ #define _EFI_TCG2_PROTOCOL_H_ +#include +#include #include #define EFI_TCG2_PROTOCOL_GUID \ @@ -53,6 +55,14 @@ struct efi_tcg2_event { u8 event[]; } __packed; +struct uefi_image_load_event { + efi_physical_addr_t image_location_in_memory; + u64 image_length_in_memory; + u64 image_link_time_address; + u64 length_of_device_path; + struct efi_device_path device_path[]; +} __packed; + struct efi_tcg2_boot_service_capability { u8 size; struct efi_tcg2_version structure_version; diff --git a/include/tpm-v2.h b/include/tpm-v2.h index df67a196cf..ab9c04dc0a 100644 --- a/include/tpm-v2.h +++ b/include/tpm-v2.h @@ -61,6 +61,7 @@ struct udevice; #define EV_S_CRTM_VERSION ((u32)0x00000008) #define EV_CPU_MICROCODE ((u32)0x00000009) #define EV_TABLE_OF_DEVICES ((u32)0x0000000B) +#define EV_EFI_BOOT_SERVICES_APPLICATION ((u32)0x80000003) /* TPMS_TAGGED_PROPERTY Structure */ struct tpms_tagged_property { diff --git a/lib/efi_loader/efi_image_loader.c b/lib/efi_loader/efi_image_loader.c index 2c35cb5651..b032ec5dd8 100644 --- a/lib/efi_loader/efi_image_loader.c +++ b/lib/efi_loader/efi_image_loader.c @@ -829,6 +829,13 @@ efi_status_t efi_load_pe(struct efi_loaded_image_obj *handle, goto err; } +#if CONFIG_IS_ENABLED(EFI_TCG2_PROTOCOL) + /* Measure an PE/COFF image */ + if (tcg2_measure_pe_image(efi, efi_size, handle, + loaded_image_info)) + log_err("PE image measurement failed\n"); +#endif + /* Copy PE headers */ memcpy(efi_reloc, efi, sizeof(*dos) diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c index ed86a220fb..9fab07605f 100644 --- a/lib/efi_loader/efi_tcg2.c +++ b/lib/efi_loader/efi_tcg2.c @@ -13,8 +13,10 @@ #include #include #include +#include #include #include +#include #include #include #include @@ -709,6 +711,172 @@ out: return EFI_EXIT(ret); } +static efi_status_t tcg2_hash_pe_image(void *efi, u64 efi_size, + struct tpml_digest_values *digest_list) +{ + IMAGE_NT_HEADERS32 *nt; + WIN_CERTIFICATE *wincerts = NULL; + size_t wincerts_len; + struct efi_image_regions *regs = NULL; + void *new_efi = NULL; + size_t new_efi_size; + u8 hash[TPM2_SHA512_DIGEST_SIZE]; + efi_status_t ret; + u32 active; + int i; + + ret = efi_check_pe(efi, efi_size, (void **)&nt); + if (ret != EFI_SUCCESS) { + log_err("Not a valid PE-COFF file\n"); + return EFI_INVALID_PARAMETER; + } + + /* + * Size must be 8-byte aligned and the trailing bytes must be + * zero'ed. Otherwise hash value may be incorrect. + */ + if (!IS_ALIGNED(efi_size, 8)) { + new_efi_size = ALIGN(efi_size, 8); + new_efi = calloc(new_efi_size, 1); + if (!new_efi) + return EFI_OUT_OF_RESOURCES; + memcpy(new_efi, efi, efi_size); + efi = new_efi; + efi_size = new_efi_size; + } + + if (!efi_image_parse(efi, efi_size, ®s, &wincerts, + &wincerts_len)) { + log_err("Parsing PE executable image failed\n"); + ret = EFI_INVALID_PARAMETER; + goto out; + } + + ret = __get_active_pcr_banks(&active); + if (ret != EFI_SUCCESS) { + ret = EFI_DEVICE_ERROR; + goto out; + } + + digest_list->count = 0; + for (i = 0; i < MAX_HASH_COUNT; i++) { + u16 hash_alg = hash_algo_list[i].hash_alg; + + if (!(active & alg_to_mask(hash_alg))) + continue; + switch (hash_alg) { + case TPM2_ALG_SHA1: + hash_calculate("sha1", regs->reg, regs->num, hash); + digest_list->count++; + break; + case TPM2_ALG_SHA256: + hash_calculate("sha256", regs->reg, regs->num, hash); + digest_list->count++; + break; + case TPM2_ALG_SHA384: + hash_calculate("sha384", regs->reg, regs->num, hash); + digest_list->count++; + break; + case TPM2_ALG_SHA512: + hash_calculate("sha512", regs->reg, regs->num, hash); + digest_list->count++; + break; + default: + EFI_PRINT("Unsupported algorithm %x\n", hash_alg); + return EFI_INVALID_PARAMETER; + } + digest_list->digests[i].hash_alg = hash_alg; + memcpy(&digest_list->digests[i].digest, hash, (u32)alg_to_len(hash_alg)); + } + +out: + free(new_efi); + free(regs); + + return ret; +} + +efi_status_t tcg2_measure_pe_image(void *efi, u64 efi_size, + struct efi_loaded_image_obj *handle, + struct efi_loaded_image *loaded_image) +{ + struct tpml_digest_values digest_list; + efi_status_t ret; + struct udevice *dev; + u32 pcr_index, event_type, event_size; + struct uefi_image_load_event *image_load_event; + u8 *event; + struct efi_device_path *device_path; + u32 device_path_length; + IMAGE_DOS_HEADER *dos; + IMAGE_NT_HEADERS32 *nt; + + ret = platform_get_tpm2_device(&dev); + if (ret != EFI_SUCCESS) + return ret; + + if (handle->image_type == IMAGE_SUBSYSTEM_EFI_APPLICATION) { + pcr_index = 4; + event_type = EV_EFI_BOOT_SERVICES_APPLICATION; + } else { + return EFI_UNSUPPORTED; + } + + ret = tcg2_hash_pe_image(efi, efi_size, &digest_list); + if (ret != EFI_SUCCESS) + return ret; + + ret = tcg2_pcr_extend(dev, pcr_index, &digest_list); + if (ret != EFI_SUCCESS) + return ret; + + loaded_image->system_table->boottime->handle_protocol(&handle->header, + &efi_guid_loaded_image_device_path, + (void **)&device_path); + device_path_length = efi_dp_size(device_path); + if (device_path_length > 0) { + /* add end node size */ + device_path_length += sizeof(struct efi_device_path); + } + event_size = sizeof(struct uefi_image_load_event) + device_path_length; + event = malloc(event_size); + if (!event) + return EFI_OUT_OF_RESOURCES; + + image_load_event = (struct uefi_image_load_event *)event; + image_load_event->image_location_in_memory = (efi_physical_addr_t)efi; + image_load_event->image_length_in_memory = efi_size; + image_load_event->length_of_device_path = device_path_length; + + dos = (IMAGE_DOS_HEADER *)efi; + nt = (IMAGE_NT_HEADERS32 *)(efi + dos->e_lfanew); + if (nt->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) { + IMAGE_NT_HEADERS64 *nt64 = (IMAGE_NT_HEADERS64 *)nt; + + image_load_event->image_link_time_address = + nt64->OptionalHeader.ImageBase; + } else if (nt->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC) { + image_load_event->image_link_time_address = + nt->OptionalHeader.ImageBase; + } else { + ret = EFI_INVALID_PARAMETER; + goto out; + } + + if (device_path_length > 0) { + memcpy(image_load_event->device_path, device_path, + device_path_length); + } + + ret = tcg2_agile_log_append(pcr_index, event_type, &digest_list, + event_size, event); + +out: + free(event); + + return ret; +} + /** * efi_tcg2_hash_log_extend_event() - extend and optionally log events * @@ -761,24 +929,23 @@ efi_tcg2_hash_log_extend_event(struct efi_tcg2_protocol *this, u64 flags, /* * if PE_COFF_IMAGE is set we need to make sure the image is not * corrupted, verify it and hash the PE/COFF image in accordance with - * the procedure specified in "Calculating the PE Image Hash" - * section of the "Windows Authenticode Portable Executable Signature + * the procedure specified in "Calculating the PE Image Hash" + * section of the "Windows Authenticode Portable Executable Signature * Format" - * Not supported for now */ if (flags & PE_COFF_IMAGE) { - ret = EFI_UNSUPPORTED; - goto out; + ret = tcg2_hash_pe_image((void *)data_to_hash, data_to_hash_len, + &digest_list); + } else { + ret = tcg2_create_digest((u8 *)data_to_hash, data_to_hash_len, + &digest_list); } + if (ret != EFI_SUCCESS) + goto out; pcr_index = efi_tcg_event->header.pcr_index; event_type = efi_tcg_event->header.event_type; - ret = tcg2_create_digest((u8 *)data_to_hash, data_to_hash_len, - &digest_list); - if (ret != EFI_SUCCESS) - goto out; - ret = tcg2_pcr_extend(dev, pcr_index, &digest_list); if (ret != EFI_SUCCESS) goto out;