Angel Pons | 3ef916f | 2020-04-02 23:49:13 +0200 | [diff] [blame] | 1 | /* SPDX-License-Identifier: GPL-2.0-only */ |
Wim Vervoorn | 8210047 | 2020-01-27 15:47:44 +0100 | [diff] [blame] | 2 | |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 3 | #include <boot_device.h> |
Wim Vervoorn | 46cc24d | 2019-11-14 11:45:03 +0100 | [diff] [blame] | 4 | #include <bootmem.h> |
Bill XIE | 516c0a5 | 2020-02-24 23:08:35 +0800 | [diff] [blame] | 5 | #include <bootmode.h> |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 6 | #include <cbfs.h> |
Arthur Heymans | ac522f1 | 2021-07-25 10:40:53 +0200 | [diff] [blame] | 7 | #include <fmap_config.h> |
Jon Murphy | d7b8dc9 | 2023-09-05 11:36:43 -0600 | [diff] [blame] | 8 | #include <security/tpm/tss_errors.h> |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 9 | #include <vboot_check.h> |
| 10 | #include <vboot_common.h> |
Joel Kitching | 172ef5f | 2020-02-14 16:08:45 +0800 | [diff] [blame] | 11 | #include <vb2_internals_please_do_not_use.h> |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 12 | |
| 13 | #define RSA_PUBLICKEY_FILE_NAME "vboot_public_key.bin" |
| 14 | |
| 15 | #if CONFIG(VENDORCODE_ELTAN_VBOOT_USE_SHA512) |
| 16 | #define DIGEST_SIZE VB2_SHA512_DIGEST_SIZE |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 17 | #define HASH_ALG VB2_HASH_SHA512 |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 18 | #else |
| 19 | #define DIGEST_SIZE VB2_SHA256_DIGEST_SIZE |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 20 | #define HASH_ALG VB2_HASH_SHA256 |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 21 | #endif |
| 22 | |
| 23 | int verified_boot_check_manifest(void) |
| 24 | { |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 25 | uint8_t *buffer; |
Wim Vervoorn | 8210047 | 2020-01-27 15:47:44 +0100 | [diff] [blame] | 26 | struct vb2_context *ctx; |
| 27 | struct vb2_kernel_preamble *pre; |
| 28 | static struct vb2_shared_data *sd; |
| 29 | size_t size; |
Frans Hendriks | 7023174 | 2020-04-20 13:37:00 +0200 | [diff] [blame] | 30 | uint8_t wb_buffer[3000]; |
Wim Vervoorn | 8210047 | 2020-01-27 15:47:44 +0100 | [diff] [blame] | 31 | |
| 32 | if (vb2api_init(&wb_buffer, sizeof(wb_buffer), &ctx)) { |
| 33 | goto fail; |
| 34 | } |
| 35 | |
| 36 | sd = vb2_get_sd(ctx); |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 37 | |
Julius Werner | 834b3ec | 2020-03-04 16:52:08 -0800 | [diff] [blame] | 38 | buffer = cbfs_map(RSA_PUBLICKEY_FILE_NAME, &size); |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 39 | if (!buffer || !size) { |
Julius Werner | e966595 | 2022-01-21 17:06:20 -0800 | [diff] [blame] | 40 | printk(BIOS_ERR, "Public key not found!\n"); |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 41 | goto fail; |
| 42 | } |
| 43 | |
| 44 | if ((size != CONFIG_VENDORCODE_ELTAN_VBOOT_KEY_SIZE) || |
Wim Vervoorn | 8210047 | 2020-01-27 15:47:44 +0100 | [diff] [blame] | 45 | (buffer != (void *)CONFIG_VENDORCODE_ELTAN_VBOOT_KEY_LOCATION)) { |
Julius Werner | e966595 | 2022-01-21 17:06:20 -0800 | [diff] [blame] | 46 | printk(BIOS_ERR, "Illegal public key!\n"); |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 47 | goto fail; |
| 48 | } |
| 49 | |
Wim Vervoorn | 8210047 | 2020-01-27 15:47:44 +0100 | [diff] [blame] | 50 | /* |
| 51 | * Check if all items will fit into workbuffer: |
| 52 | * vb2_shared data, Public Key, Preamble data |
| 53 | */ |
| 54 | if ((sd->workbuf_used + size + sizeof(struct vb2_kernel_preamble) + |
| 55 | ((CONFIG_VENDORCODE_ELTAN_OEM_MANIFEST_ITEMS * DIGEST_SIZE) + (2048/8))) > |
| 56 | sizeof(wb_buffer)) { |
Julius Werner | e966595 | 2022-01-21 17:06:20 -0800 | [diff] [blame] | 57 | printk(BIOS_ERR, "Work buffer too small\n"); |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 58 | goto fail; |
| 59 | } |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 60 | |
Wim Vervoorn | 8210047 | 2020-01-27 15:47:44 +0100 | [diff] [blame] | 61 | /* Add public key */ |
| 62 | sd->data_key_offset = sd->workbuf_used; |
| 63 | sd->data_key_size = size; |
| 64 | sd->workbuf_used += sd->data_key_size; |
| 65 | memcpy((void *)((void *)sd + (long)sd->data_key_offset), (uint8_t *)buffer, size); |
| 66 | |
| 67 | /* Fill preamble area */ |
| 68 | sd->preamble_size = sizeof(struct vb2_kernel_preamble); |
| 69 | sd->preamble_offset = sd->data_key_offset + sd->data_key_size; |
| 70 | sd->workbuf_used += sd->preamble_size; |
| 71 | pre = (struct vb2_kernel_preamble *)((void *)sd + (long)sd->preamble_offset); |
| 72 | |
| 73 | pre->flags = VB2_FIRMWARE_PREAMBLE_DISALLOW_HWCRYPTO; |
| 74 | |
| 75 | /* Fill body_signature (vb2_structure). RSA2048 key is used */ |
Julius Werner | 834b3ec | 2020-03-04 16:52:08 -0800 | [diff] [blame] | 76 | cbfs_map("oemmanifest.bin", &size); |
Wim Vervoorn | 8210047 | 2020-01-27 15:47:44 +0100 | [diff] [blame] | 77 | if (size != ((CONFIG_VENDORCODE_ELTAN_OEM_MANIFEST_ITEMS * DIGEST_SIZE) + (2048/8))) { |
Julius Werner | e966595 | 2022-01-21 17:06:20 -0800 | [diff] [blame] | 78 | printk(BIOS_ERR, "Incorrect manifest size!\n"); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 79 | goto fail; |
| 80 | } |
Wim Vervoorn | 8210047 | 2020-01-27 15:47:44 +0100 | [diff] [blame] | 81 | pre->body_signature.data_size = CONFIG_VENDORCODE_ELTAN_OEM_MANIFEST_ITEMS * |
| 82 | DIGEST_SIZE; |
| 83 | pre->body_signature.sig_offset = sizeof(struct vb2_signature) + |
| 84 | pre->body_signature.data_size; |
Frans Hendriks | 988a273 | 2020-04-20 13:58:07 +0200 | [diff] [blame] | 85 | pre->body_signature.sig_size = size - pre->body_signature.data_size; |
Wim Vervoorn | 8210047 | 2020-01-27 15:47:44 +0100 | [diff] [blame] | 86 | sd->workbuf_used += size; |
| 87 | memcpy((void *)((void *)&pre->body_signature + (long)sizeof(struct vb2_signature)), |
Wim Vervoorn | 944fdc4 | 2019-10-30 16:46:41 +0100 | [diff] [blame] | 88 | (uint8_t *)CONFIG_VENDORCODE_ELTAN_OEM_MANIFEST_LOC, size); |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 89 | |
Wim Vervoorn | 8210047 | 2020-01-27 15:47:44 +0100 | [diff] [blame] | 90 | |
| 91 | if (vb2api_verify_kernel_data(ctx, (void *)CONFIG_VENDORCODE_ELTAN_OEM_MANIFEST_LOC, |
| 92 | pre->body_signature.data_size)) |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 93 | goto fail; |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 94 | |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 95 | printk(BIOS_INFO, "%s: Successfully verified hash_table signature.\n", __func__); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 96 | return 0; |
| 97 | |
| 98 | fail: |
Wim Vervoorn | 8210047 | 2020-01-27 15:47:44 +0100 | [diff] [blame] | 99 | die("ERROR: HASH table verification failed!\n"); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 100 | return -1; |
| 101 | } |
| 102 | |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 103 | /* |
| 104 | * |
| 105 | * measure_item |
| 106 | * |
| 107 | * extends the defined pcr using the hash calculated by the verified boot |
| 108 | * routines. |
| 109 | * |
| 110 | * @param[in] pcr PCR to extend |
| 111 | * @param[in] *hashData Pointer to the hash data |
| 112 | * @param[in] hashDataLen Length of the hash data |
| 113 | * @param[in] *event_msg Message to log or display |
| 114 | * @param[in] eventType Event type to use when logging |
| 115 | |
| 116 | * @retval TPM_SUCCESS Operation completed successfully. |
Jon Murphy | 056952e | 2023-09-05 10:44:09 -0600 | [diff] [blame] | 117 | * @retval TPM_IOERROR Unexpected device behavior. |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 118 | */ |
Jon Murphy | d7b8dc9 | 2023-09-05 11:36:43 -0600 | [diff] [blame] | 119 | static tpm_result_t measure_item(uint32_t pcr, uint8_t *hashData, uint32_t hashDataLen, |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 120 | int8_t *event_msg, TCG_EVENTTYPE eventType) |
| 121 | { |
Jon Murphy | d7b8dc9 | 2023-09-05 11:36:43 -0600 | [diff] [blame] | 122 | tpm_result_t rc = TPM_SUCCESS; |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 123 | TCG_PCR_EVENT2_HDR tcgEventHdr; |
| 124 | |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 125 | memset(&tcgEventHdr, 0, sizeof(tcgEventHdr)); |
| 126 | tcgEventHdr.pcrIndex = pcr; |
| 127 | tcgEventHdr.eventType = eventType; |
| 128 | if (event_msg) { |
Jon Murphy | d7b8dc9 | 2023-09-05 11:36:43 -0600 | [diff] [blame] | 129 | rc = mboot_hash_extend_log(MBOOT_HASH_PROVIDED, hashData, |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 130 | hashDataLen, &tcgEventHdr, |
| 131 | (uint8_t *)event_msg); |
Jon Murphy | d7b8dc9 | 2023-09-05 11:36:43 -0600 | [diff] [blame] | 132 | if (rc == TPM_SUCCESS) |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 133 | printk(BIOS_INFO, "%s: Success! %s measured to pcr %d.\n", __func__, |
| 134 | event_msg, pcr); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 135 | } |
Jon Murphy | d7b8dc9 | 2023-09-05 11:36:43 -0600 | [diff] [blame] | 136 | return rc; |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 137 | } |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 138 | |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 139 | static void verified_boot_check_buffer(const char *name, void *start, size_t size, |
| 140 | uint32_t hash_index, int32_t pcr) |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 141 | { |
| 142 | uint8_t digest[DIGEST_SIZE]; |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 143 | vb2_error_t status; |
Jon Murphy | d7b8dc9 | 2023-09-05 11:36:43 -0600 | [diff] [blame] | 144 | tpm_result_t rc = TPM_SUCCESS; |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 145 | |
| 146 | printk(BIOS_DEBUG, "%s: %s HASH verification buffer %p size %d\n", __func__, name, |
| 147 | start, (int)size); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 148 | |
| 149 | if (start && size) { |
Julius Werner | d96ca24 | 2022-08-08 18:08:35 -0700 | [diff] [blame] | 150 | struct vb2_hash tmp_hash; |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 151 | |
Julius Werner | d96ca24 | 2022-08-08 18:08:35 -0700 | [diff] [blame] | 152 | status = vb2_hash_calculate(false, start, size, HASH_ALG, &tmp_hash); |
| 153 | if (!status) |
| 154 | memcpy(digest, tmp_hash.raw, DIGEST_SIZE); |
| 155 | |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 156 | if ((CONFIG(VENDORCODE_ELTAN_VBOOT) && memcmp((void *)( |
| 157 | (uint8_t *)CONFIG_VENDORCODE_ELTAN_OEM_MANIFEST_LOC + |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 158 | sizeof(digest) * hash_index), digest, sizeof(digest))) || status) { |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 159 | printk(BIOS_DEBUG, "%s: buffer hash\n", __func__); |
| 160 | hexdump(digest, sizeof(digest)); |
| 161 | printk(BIOS_DEBUG, "%s: manifest hash\n", __func__); |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 162 | hexdump((void *)( (uint8_t *)CONFIG_VENDORCODE_ELTAN_OEM_MANIFEST_LOC + |
| 163 | sizeof(digest) * hash_index), sizeof(digest)); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 164 | printk(BIOS_EMERG, "%s ", name); |
| 165 | die("HASH verification failed!\n"); |
| 166 | } else { |
Kyösti Mälkki | bf43f9e | 2019-11-05 17:55:15 +0200 | [diff] [blame] | 167 | if (!ENV_BOOTBLOCK && CONFIG(VENDORCODE_ELTAN_MBOOT)) { |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 168 | if (pcr != -1) { |
Wim Vervoorn | ffe4eba | 2019-11-14 11:06:35 +0100 | [diff] [blame] | 169 | printk(BIOS_DEBUG, "%s: measuring %s\n", __func__, |
| 170 | name); |
Jon Murphy | d7b8dc9 | 2023-09-05 11:36:43 -0600 | [diff] [blame] | 171 | rc = measure_item(pcr, digest, sizeof(digest), |
| 172 | (int8_t *)name, 0); |
| 173 | if (rc) |
| 174 | printk(BIOS_DEBUG, "%s: measuring failed with error %#x!\n", |
| 175 | __func__, rc); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 176 | } |
| 177 | } |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 178 | if (CONFIG(VENDORCODE_ELTAN_VBOOT)) |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 179 | printk(BIOS_DEBUG, "%s HASH verification success\n", name); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 180 | } |
| 181 | } else { |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 182 | printk(BIOS_EMERG, "Invalid buffer\n"); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 183 | die("HASH verification failed!\n"); |
| 184 | } |
| 185 | } |
| 186 | |
Arthur Heymans | ac522f1 | 2021-07-25 10:40:53 +0200 | [diff] [blame] | 187 | #if FMAP_SECTION_COREBOOT_START < (0xffffffff - CONFIG_ROM_SIZE + 1) |
| 188 | #define COREBOOT_CBFS_START (0xffffffff - CONFIG_ROM_SIZE + 1 + FMAP_SECTION_COREBOOT_START) |
| 189 | #else |
| 190 | #define COREBOOT_CBFS_START FMAP_SECTION_COREBOOT_START |
| 191 | #endif |
| 192 | |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 193 | void verified_boot_check_cbfsfile(const char *name, uint32_t type, uint32_t hash_index, |
| 194 | void **buffer, uint32_t *filesize, int32_t pcr) |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 195 | { |
| 196 | void *start; |
| 197 | size_t size; |
| 198 | |
Julius Werner | 834b3ec | 2020-03-04 16:52:08 -0800 | [diff] [blame] | 199 | start = cbfs_map(name, &size); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 200 | if (start && size) { |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 201 | /* Speed up processing by copying the file content to memory first */ |
Wim Vervoorn | 46cc24d | 2019-11-14 11:45:03 +0100 | [diff] [blame] | 202 | if (!ENV_ROMSTAGE_OR_BEFORE && (type & VERIFIED_BOOT_COPY_BLOCK)) { |
| 203 | |
| 204 | if ((buffer) && (*buffer) && (*filesize >= size) && |
Arthur Heymans | ac522f1 | 2021-07-25 10:40:53 +0200 | [diff] [blame] | 205 | ((uint32_t) start > COREBOOT_CBFS_START)) { |
Wim Vervoorn | 46cc24d | 2019-11-14 11:45:03 +0100 | [diff] [blame] | 206 | |
| 207 | /* Use the buffer passed in if possible */ |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 208 | printk(BIOS_DEBUG, "%s: move buffer to memory\n", __func__); |
Wim Vervoorn | 46cc24d | 2019-11-14 11:45:03 +0100 | [diff] [blame] | 209 | /* Move the file to memory buffer passed in */ |
| 210 | memcpy(*buffer, start, size); |
| 211 | start = *buffer; |
| 212 | printk(BIOS_DEBUG, "%s: done\n", __func__); |
| 213 | |
| 214 | } else if (ENV_RAMSTAGE) { |
| 215 | /* Try to allocate a buffer from boot_mem */ |
| 216 | void *local_buffer = bootmem_allocate_buffer(size); |
| 217 | |
| 218 | if (local_buffer) { |
| 219 | |
| 220 | /* Use the allocated buffer */ |
| 221 | printk(BIOS_DEBUG, "%s: move file to memory\n", |
| 222 | __func__); |
| 223 | memcpy(local_buffer, start, size); |
| 224 | start = local_buffer; |
| 225 | printk(BIOS_DEBUG, "%s: done\n", __func__); |
| 226 | } |
| 227 | } |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 228 | } |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 229 | verified_boot_check_buffer(name, start, size, hash_index, pcr); |
| 230 | } else { |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 231 | printk(BIOS_EMERG, "CBFS Failed to get file content for %s\n", name); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 232 | die("HASH verification failed!\n"); |
| 233 | } |
| 234 | if (buffer) |
| 235 | *buffer = start; |
| 236 | if (filesize) |
| 237 | *filesize = size; |
| 238 | } |
| 239 | |
| 240 | void process_verify_list(const verify_item_t list[]) |
| 241 | { |
| 242 | int i = 0; |
| 243 | |
| 244 | while (list[i].type != VERIFY_TERMINATOR) { |
| 245 | switch (list[i].type) { |
| 246 | case VERIFY_FILE: |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 247 | verified_boot_check_cbfsfile(list[i].name, list[i].data.file.cbfs_type, |
| 248 | list[i].hash_index, NULL, NULL, list[i].pcr); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 249 | if (list[i].data.file.related_items) { |
| 250 | printk(BIOS_SPEW, "process related items\n"); |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 251 | process_verify_list( |
| 252 | (verify_item_t *)list[i].data.file.related_items); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 253 | } |
| 254 | break; |
| 255 | case VERIFY_BLOCK: |
| 256 | verified_boot_check_buffer(list[i].name, |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 257 | (void *)list[i].data.block.start, |
| 258 | list[i].data.block.size, |
| 259 | list[i].hash_index, list[i].pcr); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 260 | break; |
| 261 | default: |
Jon Murphy | 53fc667 | 2023-09-26 21:05:37 -0600 | [diff] [blame] | 262 | printk(BIOS_EMERG, "INVALID TYPE IN VERIFY LIST %#x\n", list[i].type); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 263 | die("HASH verification failed!\n"); |
| 264 | } |
| 265 | i++; |
| 266 | } |
| 267 | } |
Kyösti Mälkki | ed8eaab | 2019-11-05 17:12:42 +0200 | [diff] [blame] | 268 | |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 269 | /* |
| 270 | * BOOTBLOCK |
| 271 | */ |
| 272 | |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 273 | void verified_boot_bootblock_check(void) |
| 274 | { |
| 275 | printk(BIOS_SPEW, "%s: processing bootblock items\n", __func__); |
| 276 | |
| 277 | if (CONFIG(VENDORCODE_ELTAN_VBOOT_SIGNED_MANIFEST)) { |
| 278 | printk(BIOS_SPEW, "%s: check the manifest\n", __func__); |
| 279 | if (verified_boot_check_manifest() != 0) |
| 280 | die("invalid manifest"); |
| 281 | } |
| 282 | printk(BIOS_SPEW, "%s: process bootblock verify list\n", __func__); |
| 283 | process_verify_list(bootblock_verify_list); |
| 284 | } |
| 285 | |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 286 | /* |
| 287 | * ROMSTAGE |
| 288 | */ |
| 289 | |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 290 | void verified_boot_early_check(void) |
| 291 | { |
| 292 | printk(BIOS_SPEW, "%s: processing early items\n", __func__); |
| 293 | |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 294 | if (CONFIG(VENDORCODE_ELTAN_MBOOT)) { |
Jon Murphy | 53fc667 | 2023-09-26 21:05:37 -0600 | [diff] [blame] | 295 | printk(BIOS_DEBUG, "mb_measure returned %#x\n", |
Bill XIE | 516c0a5 | 2020-02-24 23:08:35 +0800 | [diff] [blame] | 296 | mb_measure(platform_is_resuming())); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 297 | } |
| 298 | |
| 299 | printk(BIOS_SPEW, "%s: process early verify list\n", __func__); |
| 300 | process_verify_list(romstage_verify_list); |
| 301 | } |
| 302 | |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 303 | /* |
| 304 | * RAM STAGE |
| 305 | */ |
| 306 | |
| 307 | static int process_oprom_list(const verify_item_t list[], |
| 308 | struct rom_header *rom_header) |
| 309 | { |
| 310 | int i = 0; |
| 311 | struct pci_data *rom_data; |
| 312 | uint32_t viddevid = 0; |
| 313 | |
| 314 | if (le32_to_cpu(rom_header->signature) != PCI_ROM_HDR) { |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 315 | printk(BIOS_ERR, "Incorrect expansion ROM header signature %04x DONT START\n", |
| 316 | le32_to_cpu(rom_header->signature)); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 317 | return 0; |
| 318 | } |
| 319 | |
| 320 | rom_data = (((void *)rom_header) + le32_to_cpu(rom_header->data)); |
| 321 | |
| 322 | viddevid |= (rom_data->vendor << 16); |
| 323 | viddevid |= rom_data->device; |
| 324 | |
| 325 | while (list[i].type != VERIFY_TERMINATOR) { |
| 326 | switch (list[i].type) { |
| 327 | case VERIFY_OPROM: |
| 328 | if (viddevid == list[i].data.oprom.viddev) { |
| 329 | verified_boot_check_buffer(list[i].name, |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 330 | (void *)rom_header, |
| 331 | rom_header->size * 512, |
| 332 | list[i].hash_index, list[i].pcr); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 333 | if (list[i].data.oprom.related_items) { |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 334 | printk(BIOS_SPEW, "%s: process related items\n", |
| 335 | __func__); |
| 336 | process_verify_list( |
| 337 | (verify_item_t *)list[i].data.oprom.related_items); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 338 | } |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 339 | printk(BIOS_SPEW, "%s: option rom can be started\n", __func__); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 340 | return 1; |
| 341 | } |
| 342 | break; |
| 343 | default: |
Jon Murphy | 53fc667 | 2023-09-26 21:05:37 -0600 | [diff] [blame] | 344 | printk(BIOS_EMERG, "%s: INVALID TYPE IN OPTION ROM LIST %#x\n", |
Wim Vervoorn | ac4896f | 2019-10-30 15:55:21 +0100 | [diff] [blame] | 345 | __func__, list[i].type); |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 346 | die("HASH verification failed!\n"); |
| 347 | } |
| 348 | i++; |
| 349 | } |
| 350 | printk(BIOS_ERR, "%s: option rom not in list DONT START\n", __func__); |
| 351 | return 0; |
| 352 | } |
| 353 | |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 354 | int verified_boot_should_run_oprom(struct rom_header *rom_header) |
| 355 | { |
| 356 | return process_oprom_list(oprom_verify_list, rom_header); |
| 357 | } |
| 358 | |
Wim Vervoorn | e05dc17 | 2019-11-14 09:50:59 +0100 | [diff] [blame] | 359 | int prog_locate_hook(struct prog *prog) |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 360 | { |
Frans Hendriks | 70dca08 | 2020-12-22 14:34:23 +0100 | [diff] [blame] | 361 | static int initialized; |
| 362 | |
Wim Vervoorn | f4a3047 | 2019-11-14 10:03:25 +0100 | [diff] [blame] | 363 | if (ENV_BOOTBLOCK) |
Kyösti Mälkki | ed8eaab | 2019-11-05 17:12:42 +0200 | [diff] [blame] | 364 | verified_boot_bootblock_check(); |
Kyösti Mälkki | ed8eaab | 2019-11-05 17:12:42 +0200 | [diff] [blame] | 365 | |
Arthur Heymans | a2bc254 | 2021-05-29 08:10:49 +0200 | [diff] [blame^] | 366 | if (ENV_RAMINIT) { |
Frans Hendriks | 70dca08 | 2020-12-22 14:34:23 +0100 | [diff] [blame] | 367 | if (!initialized && ((prog->type == PROG_REFCODE) || |
| 368 | (prog->type == PROG_POSTCAR))) { |
Kyösti Mälkki | ed8eaab | 2019-11-05 17:12:42 +0200 | [diff] [blame] | 369 | verified_boot_early_check(); |
Frans Hendriks | 70dca08 | 2020-12-22 14:34:23 +0100 | [diff] [blame] | 370 | initialized = 1; |
| 371 | } |
Wim Vervoorn | f4a3047 | 2019-11-14 10:03:25 +0100 | [diff] [blame] | 372 | |
| 373 | if (CONFIG(POSTCAR_STAGE) && prog->type == PROG_POSTCAR) |
| 374 | process_verify_list(postcar_verify_list); |
| 375 | |
| 376 | if (!CONFIG(POSTCAR_STAGE) && prog->type == PROG_RAMSTAGE) |
| 377 | process_verify_list(ramstage_verify_list); |
Kyösti Mälkki | ed8eaab | 2019-11-05 17:12:42 +0200 | [diff] [blame] | 378 | } |
| 379 | |
Wim Vervoorn | f4a3047 | 2019-11-14 10:03:25 +0100 | [diff] [blame] | 380 | if (ENV_POSTCAR && prog->type == PROG_RAMSTAGE) |
| 381 | process_verify_list(ramstage_verify_list); |
Kyösti Mälkki | ed8eaab | 2019-11-05 17:12:42 +0200 | [diff] [blame] | 382 | |
Wim Vervoorn | f4a3047 | 2019-11-14 10:03:25 +0100 | [diff] [blame] | 383 | if (ENV_RAMSTAGE && prog->type == PROG_PAYLOAD) |
Kyösti Mälkki | ed8eaab | 2019-11-05 17:12:42 +0200 | [diff] [blame] | 384 | process_verify_list(payload_verify_list); |
Wim Vervoorn | f4a3047 | 2019-11-14 10:03:25 +0100 | [diff] [blame] | 385 | |
Wim Vervoorn | e05dc17 | 2019-11-14 09:50:59 +0100 | [diff] [blame] | 386 | return 0; |
Frans Hendriks | 72b3c3c | 2019-07-26 07:59:05 +0200 | [diff] [blame] | 387 | } |