erebion/coreboot
Watch
1
0
Fork
You've already forked coreboot
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security/tpm: Fix TCPA log feature

Browse source 
Until now the TCPA log wasn't working correctly.

* Refactor TCPA log code.
* Add TCPA log dump fucntion.
* Make TCPA log available in bootblock.
* Fix TCPA log formatting.
* Add x86 and Cavium memory for early log.

Change-Id: Ic93133531b84318f48940d34bded48cbae739c44
Signed-off-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/29563
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Rudolph <siro@das-labor.org>
This commit is contained in:
Philipp Deppenwiese 2018-11-10 00:35:02 +01:00
commit c9b7d1fb57
20 changed files with 372 additions and 88 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/security/vboot/secdata_tpm.c
View file

@ -80,10 +80,11 @@ uint32_t vboot_extend_pcr(struct vb2_context *ctx, int pcr,
switch (which_digest) {
case BOOT_MODE_PCR:
return tpm_extend_pcr(pcr, buffer, size,
return tpm_extend_pcr(pcr, VB2_HASH_SHA1, buffer, size,
TPM_PCR_GBB_FLAGS_NAME);
case HWID_DIGEST_PCR:
return tpm_extend_pcr(pcr, buffer, size, TPM_PCR_GBB_HWID_NAME);
return tpm_extend_pcr(pcr, VB2_HASH_SHA256, buffer,
size, TPM_PCR_GBB_HWID_NAME);
default:
return VB2_ERROR_UNKNOWN;
}

2
src/security/vboot/symbols.h
View file

@ -20,4 +20,6 @@
DECLARE_REGION(vboot2_work)
DECLARE_REGION(vboot2_tpm_log)
#endif /* __VBOOT_SYMBOLS_H__ */

67
src/security/vboot/vboot_crtm.c
View file

@ -18,6 +18,36 @@
#include <security/vboot/vboot_crtm.h>
#include <security/vboot/misc.h>
/*
* This functions sets the TCPA log namespace
* for the cbfs file (region) lookup.
*/
static int create_tcpa_metadata(const struct region_device *rdev,
const char *cbfs_name, char log_string[TCPA_PCR_HASH_NAME])
{
int i;
struct region_device fmap;
const static char *fmap_cbfs_names[] = {
"COREBOOT",
"FW_MAIN_A",
"FW_MAIN_B",
"RW_LEGACY"};
for (i = 0; i < ARRAY_SIZE(fmap_cbfs_names); i++) {
if (fmap_locate_area_as_rdev(fmap_cbfs_names[i], &fmap) == 0) {
if (region_is_subregion(region_device_region(&fmap),
region_device_region(rdev))) {
snprintf(log_string, TCPA_PCR_HASH_NAME,
"FMAP: %s CBFS: %s",
fmap_cbfs_names[i], cbfs_name);
return 0;
}
}
}
return -1;
}
uint32_t vboot_init_crtm(void)
{
struct prog bootblock = PROG_INIT(PROG_BOOTBLOCK, "bootblock");
@ -25,6 +55,10 @@ uint32_t vboot_init_crtm(void)
PROG_INIT(PROG_VERSTAGE, CONFIG_CBFS_PREFIX "/verstage");
struct prog romstage =
PROG_INIT(PROG_ROMSTAGE, CONFIG_CBFS_PREFIX "/romstage");
char tcpa_metadata[TCPA_PCR_HASH_NAME];
/* Initialize TCPE PRERAM log. */
tcpa_preram_log_clear();
/* measure bootblock from RO */
struct cbfsf bootblock_data;
@ -32,16 +66,20 @@ uint32_t vboot_init_crtm(void)
if (fmap_locate_area_as_rdev("BOOTBLOCK", &bootblock_fmap) == 0) {
if (tpm_measure_region(&bootblock_fmap,
TPM_CRTM_PCR,
prog_name(&bootblock)))
"FMAP: BOOTBLOCK"))
return VB2_ERROR_UNKNOWN;
} else {
if (cbfs_boot_locate(&bootblock_data,
prog_name(&bootblock), NULL) == 0) {
cbfs_file_data(prog_rdev(&bootblock), &bootblock_data);
if (create_tcpa_metadata(prog_rdev(&bootblock),
prog_name(&bootblock), tcpa_metadata) < 0)
return VB2_ERROR_UNKNOWN;
if (tpm_measure_region(prog_rdev(&bootblock),
TPM_CRTM_PCR,
prog_name(&bootblock)))
TPM_CRTM_PCR,
tcpa_metadata))
return VB2_ERROR_UNKNOWN;
} else {
printk(BIOS_INFO,
@ -57,9 +95,13 @@ uint32_t vboot_init_crtm(void)
prog_name(&romstage), NULL) == 0) {
cbfs_file_data(prog_rdev(&romstage), &romstage_data);
if (create_tcpa_metadata(prog_rdev(&romstage),
prog_name(&romstage), tcpa_metadata) < 0)
return VB2_ERROR_UNKNOWN;
if (tpm_measure_region(prog_rdev(&romstage),
TPM_CRTM_PCR,
CONFIG_CBFS_PREFIX "/romstage"))
TPM_CRTM_PCR,
tcpa_metadata))
return VB2_ERROR_UNKNOWN;
} else {
printk(BIOS_INFO,
@ -76,9 +118,13 @@ uint32_t vboot_init_crtm(void)
prog_name(&verstage), NULL) == 0) {
cbfs_file_data(prog_rdev(&verstage), &verstage_data);
if (create_tcpa_metadata(prog_rdev(&verstage),
prog_name(&verstage), tcpa_metadata) < 0)
return VB2_ERROR_UNKNOWN;
if (tpm_measure_region(prog_rdev(&verstage),
TPM_CRTM_PCR,
CONFIG_CBFS_PREFIX "/verstage"))
TPM_CRTM_PCR,
tcpa_metadata))
return VB2_ERROR_UNKNOWN;
} else {
printk(BIOS_INFO,
@ -114,6 +160,7 @@ uint32_t vboot_measure_cbfs_hook(struct cbfsf *fh, const char *name)
uint32_t pcr_index;
uint32_t cbfs_type;
struct region_device rdev;
char tcpa_metadata[TCPA_PCR_HASH_NAME];
if (!vb2_logic_executed())
return 0;
@ -139,6 +186,8 @@ uint32_t vboot_measure_cbfs_hook(struct cbfsf *fh, const char *name)
break;
}
return tpm_measure_region(&rdev, pcr_index,
name);
if (create_tcpa_metadata(&rdev, name, tcpa_metadata) < 0)
return VB2_ERROR_UNKNOWN;
return tpm_measure_region(&rdev, pcr_index, tcpa_metadata);
}