verifiers: Core TPM support
Add support for performing basic TPM measurements. Right now this only supports extending PCRs statically and only on UEFI. In future we might want to have some sort of mechanism for choosing which events get logged to which PCRs, but this seems like a good default policy and we can wait to see whether anyone has a use case before adding more complexity. Signed-off-by: Matthew Garrett <mjg59@google.com> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Matthew Garrett
Daniel Kiper
parent
d3a5e812c5
commit
d6ca0a90ca
6 changed files with 723 additions and 0 deletions
198
include/grub/efi/tpm.h
Normal file
198
include/grub/efi/tpm.h
Normal file
|
|
@ -0,0 +1,198 @@
|
|||
/*
|
||||
* GRUB -- GRand Unified Bootloader
|
||||
* Copyright (C) 2018 Free Software Foundation, Inc.
|
||||
*
|
||||
* GRUB is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* GRUB is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with GRUB. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#ifndef GRUB_EFI_TPM_HEADER
|
||||
#define GRUB_EFI_TPM_HEADER 1
|
||||
|
||||
#define EFI_TPM_GUID {0xf541796d, 0xa62e, 0x4954, {0xa7, 0x75, 0x95, 0x84, 0xf6, 0x1b, 0x9c, 0xdd }};
|
||||
#define EFI_TPM2_GUID {0x607f766c, 0x7455, 0x42be, {0x93, 0x0b, 0xe4, 0xd7, 0x6d, 0xb2, 0x72, 0x0f }};
|
||||
|
||||
#define TCG_ALG_SHA 0x00000004
|
||||
|
||||
/* These structs are as defined in the TCG EFI Protocol Specification, family 2.0. */
|
||||
|
||||
struct __TCG_VERSION
|
||||
{
|
||||
grub_efi_uint8_t Major;
|
||||
grub_efi_uint8_t Minor;
|
||||
grub_efi_uint8_t RevMajor;
|
||||
grub_efi_uint8_t RevMinor;
|
||||
};
|
||||
typedef struct __TCG_VERSION TCG_VERSION;
|
||||
|
||||
struct __TCG_EFI_BOOT_SERVICE_CAPABILITY
|
||||
{
|
||||
/* Size of this structure. */
|
||||
grub_efi_uint8_t Size;
|
||||
TCG_VERSION StructureVersion;
|
||||
TCG_VERSION ProtocolSpecVersion;
|
||||
/* Hash algorithms supported by this TPM. */
|
||||
grub_efi_uint8_t HashAlgorithmBitmap;
|
||||
/* 1 if TPM present. */
|
||||
char TPMPresentFlag;
|
||||
/* 1 if TPM deactivated. */
|
||||
char TPMDeactivatedFlag;
|
||||
};
|
||||
typedef struct __TCG_EFI_BOOT_SERVICE_CAPABILITY TCG_EFI_BOOT_SERVICE_CAPABILITY;
|
||||
|
||||
struct tdTCG_PCR_EVENT
|
||||
{
|
||||
grub_efi_uint32_t PCRIndex;
|
||||
grub_efi_uint32_t EventType;
|
||||
grub_efi_uint8_t digest[20];
|
||||
grub_efi_uint32_t EventSize;
|
||||
grub_efi_uint8_t Event[1];
|
||||
};
|
||||
typedef struct tdTCG_PCR_EVENT TCG_PCR_EVENT;
|
||||
|
||||
struct grub_efi_tpm_protocol
|
||||
{
|
||||
grub_efi_status_t (*status_check) (struct grub_efi_tpm_protocol *this,
|
||||
TCG_EFI_BOOT_SERVICE_CAPABILITY *
|
||||
ProtocolCapability,
|
||||
grub_efi_uint32_t *TCGFeatureFlags,
|
||||
grub_efi_physical_address_t *
|
||||
EventLogLocation,
|
||||
grub_efi_physical_address_t *
|
||||
EventLogLastEntry);
|
||||
grub_efi_status_t (*hash_all) (struct grub_efi_tpm_protocol *this,
|
||||
grub_efi_uint8_t *HashData,
|
||||
grub_efi_uint64_t HashLen,
|
||||
grub_efi_uint32_t AlgorithmId,
|
||||
grub_efi_uint64_t *HashedDataLen,
|
||||
grub_efi_uint8_t **HashedDataResult);
|
||||
grub_efi_status_t (*log_event) (struct grub_efi_tpm_protocol *this,
|
||||
TCG_PCR_EVENT *TCGLogData,
|
||||
grub_efi_uint32_t *EventNumber,
|
||||
grub_efi_uint32_t Flags);
|
||||
grub_efi_status_t (*pass_through_to_tpm) (struct grub_efi_tpm_protocol *
|
||||
this,
|
||||
grub_efi_uint32_t
|
||||
TpmInputParameterBlockSize,
|
||||
grub_efi_uint8_t *
|
||||
TpmInputParameterBlock,
|
||||
grub_efi_uint32_t
|
||||
TpmOutputParameterBlockSize,
|
||||
grub_efi_uint8_t *
|
||||
TpmOutputParameterBlock);
|
||||
grub_efi_status_t (*log_extend_event) (struct grub_efi_tpm_protocol *this,
|
||||
grub_efi_physical_address_t HashData,
|
||||
grub_efi_uint64_t HashDataLen,
|
||||
grub_efi_uint32_t AlgorithmId,
|
||||
TCG_PCR_EVENT *TCGLogData,
|
||||
grub_efi_uint32_t *EventNumber,
|
||||
grub_efi_physical_address_t *
|
||||
EventLogLastEntry);
|
||||
};
|
||||
|
||||
typedef struct grub_efi_tpm_protocol grub_efi_tpm_protocol_t;
|
||||
|
||||
typedef grub_efi_uint32_t EFI_TCG2_EVENT_LOG_BITMAP;
|
||||
typedef grub_efi_uint32_t EFI_TCG2_EVENT_LOG_FORMAT;
|
||||
typedef grub_efi_uint32_t EFI_TCG2_EVENT_ALGORITHM_BITMAP;
|
||||
|
||||
struct tdEFI_TCG2_VERSION
|
||||
{
|
||||
grub_efi_uint8_t Major;
|
||||
grub_efi_uint8_t Minor;
|
||||
} GRUB_PACKED;
|
||||
typedef struct tdEFI_TCG2_VERSION EFI_TCG2_VERSION;
|
||||
|
||||
struct tdEFI_TCG2_BOOT_SERVICE_CAPABILITY
|
||||
{
|
||||
grub_efi_uint8_t Size;
|
||||
EFI_TCG2_VERSION StructureVersion;
|
||||
EFI_TCG2_VERSION ProtocolVersion;
|
||||
EFI_TCG2_EVENT_ALGORITHM_BITMAP HashAlgorithmBitmap;
|
||||
EFI_TCG2_EVENT_LOG_BITMAP SupportedEventLogs;
|
||||
grub_efi_boolean_t TPMPresentFlag;
|
||||
grub_efi_uint16_t MaxCommandSize;
|
||||
grub_efi_uint16_t MaxResponseSize;
|
||||
grub_efi_uint32_t ManufacturerID;
|
||||
grub_efi_uint32_t NumberOfPcrBanks;
|
||||
EFI_TCG2_EVENT_ALGORITHM_BITMAP ActivePcrBanks;
|
||||
};
|
||||
typedef struct tdEFI_TCG2_BOOT_SERVICE_CAPABILITY EFI_TCG2_BOOT_SERVICE_CAPABILITY;
|
||||
|
||||
typedef grub_efi_uint32_t TCG_PCRINDEX;
|
||||
typedef grub_efi_uint32_t TCG_EVENTTYPE;
|
||||
|
||||
struct tdEFI_TCG2_EVENT_HEADER
|
||||
{
|
||||
grub_efi_uint32_t HeaderSize;
|
||||
grub_efi_uint16_t HeaderVersion;
|
||||
TCG_PCRINDEX PCRIndex;
|
||||
TCG_EVENTTYPE EventType;
|
||||
} GRUB_PACKED;
|
||||
typedef struct tdEFI_TCG2_EVENT_HEADER EFI_TCG2_EVENT_HEADER;
|
||||
|
||||
struct tdEFI_TCG2_EVENT
|
||||
{
|
||||
grub_efi_uint32_t Size;
|
||||
EFI_TCG2_EVENT_HEADER Header;
|
||||
grub_efi_uint8_t Event[1];
|
||||
} GRUB_PACKED;
|
||||
typedef struct tdEFI_TCG2_EVENT EFI_TCG2_EVENT;
|
||||
|
||||
struct grub_efi_tpm2_protocol
|
||||
{
|
||||
grub_efi_status_t (*get_capability) (struct grub_efi_tpm2_protocol *this,
|
||||
EFI_TCG2_BOOT_SERVICE_CAPABILITY *
|
||||
ProtocolCapability);
|
||||
grub_efi_status_t (*get_event_log) (struct grub_efi_tpm2_protocol *this,
|
||||
EFI_TCG2_EVENT_LOG_FORMAT
|
||||
EventLogFormat,
|
||||
grub_efi_physical_address_t *
|
||||
EventLogLocation,
|
||||
grub_efi_physical_address_t *
|
||||
EventLogLastEntry,
|
||||
grub_efi_boolean_t * EventLogTruncated);
|
||||
grub_efi_status_t (*hash_log_extend_event) (struct grub_efi_tpm2_protocol *
|
||||
this, grub_efi_uint64_t Flags,
|
||||
grub_efi_physical_address_t *
|
||||
DataToHash,
|
||||
grub_efi_uint64_t DataToHashLen,
|
||||
EFI_TCG2_EVENT *EfiTcgEvent);
|
||||
grub_efi_status_t (*submit_command) (struct grub_efi_tpm2_protocol *this,
|
||||
grub_efi_uint32_t
|
||||
InputParameterBlockSize,
|
||||
grub_efi_uint8_t *InputParameterBlock,
|
||||
grub_efi_uint32_t
|
||||
OutputParameterBlockSize,
|
||||
grub_efi_uint8_t *
|
||||
OutputParameterBlock);
|
||||
grub_efi_status_t (*get_active_pcr_blanks) (struct grub_efi_tpm2_protocol *
|
||||
this,
|
||||
grub_efi_uint32_t *
|
||||
ActivePcrBanks);
|
||||
grub_efi_status_t (*set_active_pcr_banks) (struct grub_efi_tpm2_protocol *
|
||||
this,
|
||||
grub_efi_uint32_t
|
||||
ActivePcrBanks);
|
||||
grub_efi_status_t (*get_result_of_set_active_pcr_banks) (struct
|
||||
grub_efi_tpm2_protocol
|
||||
*this,
|
||||
grub_efi_uint32_t *
|
||||
OperationPresent,
|
||||
grub_efi_uint32_t *
|
||||
Response);
|
||||
};
|
||||
|
||||
typedef struct grub_efi_tpm2_protocol grub_efi_tpm2_protocol_t;
|
||||
|
||||
#endif
|
||||
82
include/grub/tpm.h
Normal file
82
include/grub/tpm.h
Normal file
|
|
@ -0,0 +1,82 @@
|
|||
/*
|
||||
* GRUB -- GRand Unified Bootloader
|
||||
* Copyright (C) 2018 Free Software Foundation, Inc.
|
||||
*
|
||||
* GRUB is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* GRUB is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with GRUB. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#ifndef GRUB_TPM_HEADER
|
||||
#define GRUB_TPM_HEADER 1
|
||||
|
||||
#define GRUB_STRING_PCR 8
|
||||
#define GRUB_BINARY_PCR 9
|
||||
|
||||
#define SHA1_DIGEST_SIZE 20
|
||||
|
||||
#define TPM_BASE 0x0
|
||||
#define TPM_SUCCESS TPM_BASE
|
||||
#define TPM_AUTHFAIL (TPM_BASE + 0x1)
|
||||
#define TPM_BADINDEX (TPM_BASE + 0x2)
|
||||
|
||||
#define TPM_TAG_RQU_COMMAND 0x00C1
|
||||
#define TPM_ORD_Extend 0x14
|
||||
|
||||
#define EV_IPL 0x0d
|
||||
|
||||
/* TCG_PassThroughToTPM Input Parameter Block. */
|
||||
typedef struct
|
||||
{
|
||||
grub_uint16_t IPBLength;
|
||||
grub_uint16_t Reserved1;
|
||||
grub_uint16_t OPBLength;
|
||||
grub_uint16_t Reserved2;
|
||||
grub_uint8_t TPMOperandIn[1];
|
||||
} GRUB_PACKED PassThroughToTPM_InputParamBlock;
|
||||
|
||||
/* TCG_PassThroughToTPM Output Parameter Block. */
|
||||
typedef struct
|
||||
{
|
||||
grub_uint16_t OPBLength;
|
||||
grub_uint16_t Reserved;
|
||||
grub_uint8_t TPMOperandOut[1];
|
||||
} GRUB_PACKED PassThroughToTPM_OutputParamBlock;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
grub_uint16_t tag;
|
||||
grub_uint32_t paramSize;
|
||||
grub_uint32_t ordinal;
|
||||
grub_uint32_t pcrNum;
|
||||
/* The 160 bit value representing the event to be recorded. */
|
||||
grub_uint8_t inDigest[SHA1_DIGEST_SIZE];
|
||||
} GRUB_PACKED ExtendIncoming;
|
||||
|
||||
/* TPM_Extend Outgoing Operand. */
|
||||
typedef struct
|
||||
{
|
||||
grub_uint16_t tag;
|
||||
grub_uint32_t paramSize;
|
||||
grub_uint32_t returnCode;
|
||||
/* The PCR value after execution of the command. */
|
||||
grub_uint8_t outDigest[SHA1_DIGEST_SIZE];
|
||||
} GRUB_PACKED ExtendOutgoing;
|
||||
|
||||
grub_err_t grub_tpm_measure (unsigned char *buf, grub_size_t size,
|
||||
grub_uint8_t pcr, const char *description);
|
||||
grub_err_t grub_tpm_init (void);
|
||||
grub_err_t grub_tpm_execute (PassThroughToTPM_InputParamBlock *inbuf,
|
||||
PassThroughToTPM_OutputParamBlock *outbuf);
|
||||
grub_err_t grub_tpm_log_event (unsigned char *buf, grub_size_t size,
|
||||
grub_uint8_t pcr, const char *description);
|
||||
#endif
|
||||
Loading…
Add table
Add a link
Reference in a new issue