summaryrefslogtreecommitdiff
path: root/tpm.c
AgeCommit message (Collapse)Author
2018-04-04tpm_log_event_raw(): be more careful about EFI_NOT_FOUNDPeter Jones
Don't return EFI_NOT_FOUND from tpm_log_event*() unless we're in REQUIRE_TPM mode. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12shim: make everything use a common perror() call.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12shim: tpm.c: Make sure old_caps is initialized in tpm2 code.Peter Jones
clang-analyzer caught this. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Don't use uefi_call_wrapper(), ever.Peter Jones
I'm pretty done with typing uefi_call_wrapper() and counting arguments every time. Instead, just make the compiler error if we don't have ms_abi. Also, make it so nothing can use uefi_call_wrapper() directly. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12shim: Use EFI_ERROR() instead of comparing to EFI_SUCCESS everywhere.Peter Jones
Also consistently name our status variable "efi_status" unless there's a good reason not to, such as already having another one of those. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Don't have tons of local guid definitions for no reason at all.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Move includes around to clean the source tree up a bit.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-06Fall-back TPM2 measurement if it fails with PE_COFF_IMAGE flagTamas K Lengyel
Signed-off-by: Tamas K Lengyel <lengyelt@ainfosec.com>
2017-12-19"in_protocol" is used in more than shim.o; make it not static.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-03Make fallback aware of tpm measurements, and reboot if tpm is used.Peter Jones
Since booting the entry with fallback in the stack of things that got measured will result in all the wrong PCR values, in the cases where TPM is present and enabled, use ->Reset() instead of loading the Boot#### variable and executing its target. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-03Make tpm.c build right on 32-bit platforms.Peter Jones
EFI_PHYSICAL_ADDRESS is UINT64 everywhere, so you can't just copy a 32-bit pointer to it. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-03Measure stage 2 according to specMatthew Garrett
We're currently measuring the raw second stage loader into PCR 9, but we're closer to spec if we measure the semi-parsed PE into PCR 4. The hash that's logged is the same as the hash used for the Authenticode validation, so refactor shim.c a little to separate out the hash generation.
2017-08-01Extend PCR 7Matthew Garrett
It's desirable to be able to use PCR 7 for all TPM policy on Secure Boot systems, but right now Shim doesn't record any information about its configuration or the signature used to launch the second stage loader. Add support for that.
2017-06-20tpm2_present(): remove unused tpm2 protocol argument.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-06-15shim/tpm: Avoid passing an usupported event log format to GetEventLogs()Javier Martinez Canillas
The TCG EFI Protocol Specification for family "2.0" mentions that not all TPM2 chips may support the EFI_TCG2_EVENT_LOG_FORMAT_TCG_2 (crypto agile) log format. So instead of always use this log format, the GetCapability() function should be used to determine which format is supported by the TPM. For example, the Intel PTT firmware based TPM found in Lenovo Thinkapd X1 Carbon (4th gen), only supports SHA-1 (EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2) log format. So a call to GetEventLog() using the crypto agile format was returning EFI_INVALID_PARAMETER, making tpm_log_event() function to fail. This was preventing shim to correctly measure the second stage bootloader: $ tpm2_listpcrs -L 0x04:9 Bank/Algorithm: TPM_ALG_SHA1(0x0004) PCR_09: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 After passing a supported log format to GetEventLog(), it succeeds and so shim is able to call the HashLogExtendEvent() EFI function correctly: $ tpm2_listpcrs -L 0x04:9 Bank/Algorithm: TPM_ALG_SHA1(0x0004) PCR_09: 07 5a 7e d3 75 64 ad 91 1a 34 17 17 c2 34 10 2b 58 5b de b7 Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2017-06-15shim/tpm: Take out GetCapability() call from tpm2_present() logicJavier Martinez Canillas
The EFI_TCG2_PROTOCOL.GetCapability() function is used to learn if a TPM2 chip is present. But the protocol capability information is also needed for other reasons, for example to determine what event log formats are supported by the firmware. Take out the GetCapability() call from the tpm2_present() logic and reduce that function to just checking if a TPM2 chip is available or not, so the capabilities can later be used to determine the supported TPM log formats. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2017-06-15shim/tpm: Remove magic numbersJavier Martinez Canillas
When measuring data into the TPM and generating events logs, the event type is set to EV_IPL (0xd), and for TPM1.2 the algorithm will always be set to SHA-1 (0x4). So, add some macro-defined constants for these instead of having them as magic numbers to make the code more readable. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2017-02-06shim/tpm: correct the definition of the capability structure version 1.0Lans Zhang
EFI TrEE Protocol uses the same protocol GUID as EFI TCG2 protocol, and defines the capability structure version 1.0. Hence, the structure and name are all align the EFI TrEE Protocol. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2016-11-30shim/tpm: fix trigger failure caused by NULL argumentsLans Zhang
Certain AMI BIOS (Intel NUC5i3MYBE BIOS version 0037) may make the strict check on the last 3 arguments passed to get_event_log() and don't expect NULL pointers are passed. In order to work around this failure (EFI_INVALID_PARAMETER), pass them even though we really don't use it. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2016-11-30shim/tpm: print the error status if trigger failsLans Zhang
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2016-09-30shim: trigger to record further logs to tcg 2.0 final event log areaLans Zhang
According to TCG EFI Protocol Specification for TPM 2.0 family, all events generated after the invocation of EFI_TCG2_GET_EVENT_LOG shall be stored in an instance of an EFI_CONFIGURATION_TABLE aka EFI TCG 2.0 final events table. Hence, it is necessary to trigger the internal switch through calling get_event_log() in order to allow to retrieve the logs from OS runtime. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2016-05-11Measure state and second stage into TPMMatthew Garrett
Add support for measuring the MOK database and secure boot state into a TPM, and do the same for the second stage loader. This avoids a hole in TPM measurement between the firmware and the second stage loader.
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-24 07:22:58 +0000