Angel Pons | 986d50e | 2020-04-02 23:48:53 +0200 | [diff] [blame] | 1 | /* SPDX-License-Identifier: GPL-2.0-only */ |
Philipp Deppenwiese | 80961af | 2018-02-27 22:14:34 +0100 | [diff] [blame] | 2 | |
| 3 | #include <security/vboot/antirollback.h> |
| 4 | #include <program_loading.h> |
| 5 | #include <security/vboot/vboot_common.h> |
| 6 | #include <vb2_api.h> |
| 7 | #include <security/tpm/tss.h> |
Shelley Chen | d5faa90 | 2020-10-16 10:55:07 -0700 | [diff] [blame] | 8 | #include <security/vboot/mrc_cache_hash_tpm.h> |
Philipp Deppenwiese | 80961af | 2018-02-27 22:14:34 +0100 | [diff] [blame] | 9 | #include <console/console.h> |
| 10 | #include <string.h> |
| 11 | |
Shelley Chen | a79803c | 2020-10-16 13:15:59 -0700 | [diff] [blame] | 12 | void mrc_cache_update_hash(uint32_t index, const uint8_t *data, size_t size) |
Philipp Deppenwiese | 80961af | 2018-02-27 22:14:34 +0100 | [diff] [blame] | 13 | { |
| 14 | uint8_t data_hash[VB2_SHA256_DIGEST_SIZE]; |
| 15 | static const uint8_t dead_hash[VB2_SHA256_DIGEST_SIZE] = { |
| 16 | 0xba, 0xad, 0xda, 0x1a, /* BAADDA1A */ |
| 17 | 0xde, 0xad, 0xde, 0xad, /* DEADDEAD */ |
| 18 | 0xde, 0xad, 0xda, 0x1a, /* DEADDA1A */ |
| 19 | 0xba, 0xad, 0xba, 0xad, /* BAADBAAD */ |
| 20 | 0xba, 0xad, 0xda, 0x1a, /* BAADDA1A */ |
| 21 | 0xde, 0xad, 0xde, 0xad, /* DEADDEAD */ |
| 22 | 0xde, 0xad, 0xda, 0x1a, /* DEADDA1A */ |
| 23 | 0xba, 0xad, 0xba, 0xad, /* BAADBAAD */ |
| 24 | }; |
| 25 | const uint8_t *hash_ptr = data_hash; |
| 26 | |
Philipp Deppenwiese | 80961af | 2018-02-27 22:14:34 +0100 | [diff] [blame] | 27 | /* Initialize TPM driver. */ |
| 28 | if (tlcl_lib_init() != VB2_SUCCESS) { |
| 29 | printk(BIOS_ERR, "MRC: TPM driver initialization failed.\n"); |
| 30 | return; |
| 31 | } |
| 32 | |
| 33 | /* Calculate hash of data generated by MRC. */ |
| 34 | if (vb2_digest_buffer(data, size, VB2_HASH_SHA256, data_hash, |
| 35 | sizeof(data_hash))) { |
| 36 | printk(BIOS_ERR, "MRC: SHA-256 calculation failed for data. " |
| 37 | "Not updating TPM hash space.\n"); |
| 38 | /* |
Shelley Chen | a79803c | 2020-10-16 13:15:59 -0700 | [diff] [blame] | 39 | * Since data is being updated in mrc cache, the hash |
| 40 | * currently stored in TPM hash space is no longer |
| 41 | * valid. If we are not able to calculate hash of the |
| 42 | * data being updated, reset all the bits in TPM hash |
| 43 | * space to pre-defined hash pattern. |
Philipp Deppenwiese | 80961af | 2018-02-27 22:14:34 +0100 | [diff] [blame] | 44 | */ |
| 45 | hash_ptr = dead_hash; |
| 46 | } |
| 47 | |
| 48 | /* Write hash of data to TPM space. */ |
Shelley Chen | a79803c | 2020-10-16 13:15:59 -0700 | [diff] [blame] | 49 | if (antirollback_write_space_mrc_hash(index, hash_ptr, VB2_SHA256_DIGEST_SIZE) |
Philipp Deppenwiese | 80961af | 2018-02-27 22:14:34 +0100 | [diff] [blame] | 50 | != TPM_SUCCESS) { |
| 51 | printk(BIOS_ERR, "MRC: Could not save hash to TPM.\n"); |
| 52 | return; |
| 53 | } |
| 54 | |
Shelley Chen | a79803c | 2020-10-16 13:15:59 -0700 | [diff] [blame] | 55 | printk(BIOS_INFO, "MRC: TPM MRC hash idx 0x%x updated successfully.\n", index); |
Philipp Deppenwiese | 80961af | 2018-02-27 22:14:34 +0100 | [diff] [blame] | 56 | } |
| 57 | |
Shelley Chen | a79803c | 2020-10-16 13:15:59 -0700 | [diff] [blame] | 58 | int mrc_cache_verify_hash(uint32_t index, const uint8_t *data, size_t size) |
Philipp Deppenwiese | 80961af | 2018-02-27 22:14:34 +0100 | [diff] [blame] | 59 | { |
| 60 | uint8_t data_hash[VB2_SHA256_DIGEST_SIZE]; |
| 61 | uint8_t tpm_hash[VB2_SHA256_DIGEST_SIZE]; |
| 62 | |
Shelley Chen | a79803c | 2020-10-16 13:15:59 -0700 | [diff] [blame] | 63 | /* Calculate hash of data read from MRC_CACHE. */ |
Philipp Deppenwiese | 80961af | 2018-02-27 22:14:34 +0100 | [diff] [blame] | 64 | if (vb2_digest_buffer(data, size, VB2_HASH_SHA256, data_hash, |
| 65 | sizeof(data_hash))) { |
| 66 | printk(BIOS_ERR, "MRC: SHA-256 calculation failed for data.\n"); |
| 67 | return 0; |
| 68 | } |
| 69 | |
| 70 | /* Initialize TPM driver. */ |
| 71 | if (tlcl_lib_init() != VB2_SUCCESS) { |
| 72 | printk(BIOS_ERR, "MRC: TPM driver initialization failed.\n"); |
| 73 | return 0; |
| 74 | } |
| 75 | |
| 76 | /* Read hash of MRC data saved in TPM. */ |
Shelley Chen | a79803c | 2020-10-16 13:15:59 -0700 | [diff] [blame] | 77 | if (antirollback_read_space_mrc_hash(index, tpm_hash, sizeof(tpm_hash)) |
Philipp Deppenwiese | 80961af | 2018-02-27 22:14:34 +0100 | [diff] [blame] | 78 | != TPM_SUCCESS) { |
| 79 | printk(BIOS_ERR, "MRC: Could not read hash from TPM.\n"); |
| 80 | return 0; |
| 81 | } |
| 82 | |
| 83 | if (memcmp(tpm_hash, data_hash, sizeof(tpm_hash))) { |
| 84 | printk(BIOS_ERR, "MRC: Hash comparison failed.\n"); |
| 85 | return 0; |
| 86 | } |
| 87 | |
Shelley Chen | a79803c | 2020-10-16 13:15:59 -0700 | [diff] [blame] | 88 | printk(BIOS_INFO, "MRC: Hash idx 0x%x comparison successful.\n", index); |
| 89 | |
Philipp Deppenwiese | 80961af | 2018-02-27 22:14:34 +0100 | [diff] [blame] | 90 | return 1; |
| 91 | } |