brain-hackers_pepepper-mirror/u-boot-brain
1
0
Fork 0
mirror of https://github.com/brain-hackers/u-boot-brain synced 2024-06-09 23:36:03 +09:00
Code Issues Projects Releases Wiki Activity

efi_loader: Add an S-CRTM even for firmware version

Browse Source 
TCG PC Client Platform Firmware Profile Spec mandates that an S-CRTM
event for the version identifier using the event type EV_S_CRTM_VERSION
must be measured.

So since we are trying to add more conformance into U-Boot, let's add
the event using U_BOOT_VERSION_STRING, extend PCR[0] accordingly and log
it in the EventLog

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
This commit is contained in:
Ilias Apalodimas 2021-03-24 16:50:46 +02:00 committed by Heinrich Schuchardt
parent d8cf113fe5
commit f69a2016b6
1 changed files with 35 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
lib/efi_loader/efi_tcg2.c
View File

@ -13,6 +13,7 @@
#include <efi_loader.h>
#include <efi_tcg2.h>
#include <log.h>
#include <version.h>
#include <tpm-v2.h>
#include <u-boot/sha1.h>
#include <u-boot/sha256.h>
@ -1063,6 +1064,36 @@ out:
return ret;
}
/**
* efi_append_scrtm_version - Append an S-CRTM EV_S_CRTM_VERSION event on the
* eventlog and extend the PCRs
*
* @dev: TPM device
*
* @Return: status code
*/
static efi_status_t efi_append_scrtm_version(struct udevice *dev)
{
struct tpml_digest_values digest_list;
u8 ver[] = U_BOOT_VERSION_STRING;
const int pcr_index = 0;
efi_status_t ret;
ret = tcg2_create_digest(ver, sizeof(ver), &digest_list);
if (ret != EFI_SUCCESS)
goto out;
ret = tcg2_pcr_extend(dev, pcr_index, &digest_list);
if (ret != EFI_SUCCESS)
goto out;
ret = tcg2_agile_log_append(pcr_index, EV_S_CRTM_VERSION, &digest_list,
sizeof(ver), ver);
out:
return ret;
}
/**
* efi_tcg2_register() - register EFI_TCG2_PROTOCOL
*
@ -1086,6 +1117,10 @@ efi_status_t efi_tcg2_register(void)
if (ret != EFI_SUCCESS)
goto fail;
ret = efi_append_scrtm_version(dev);
if (ret != EFI_SUCCESS)
goto out;
ret = efi_add_protocol(efi_root, &efi_guid_tcg2_protocol,
(void *)&efi_tcg2_protocol);
if (ret != EFI_SUCCESS) {