[PATCH v2] optionrom: disallow int19 redirect for pnp roms.
by Gerd Hoffmann
Check whenever pnp roms attempt to redirect int19, and in case it does
log a message and undo the redirect.
A pnp rom should not need this, we have BEVs and BCVs for that.
Nevertheless there are roms in the wild which are redirecting int19.
At least some BIOS implementations for physical hardware have a config
option in the setup to allow/disallow int19 redirections, so just not
allowing this seems to be the way to deal with this situation.
Buglink: https://bugzilla.redhat.com//show_bug.cgi?id=1642135
Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com>
---
src/optionroms.c | 29 +++++++++++++++++++++++++++++
1 file changed, 29 insertions(+)
diff --git a/src/optionroms.c b/src/optionroms.c
index fc992f649f..e90900b790 100644
--- a/src/optionroms.c
+++ b/src/optionroms.c
@@ -8,6 +8,7 @@
#include "bregs.h" // struct bregs
#include "config.h" // CONFIG_*
#include "farptr.h" // FLATPTR_TO_SEG
+#include "biosvar.h" // GET_IVT
#include "hw/pci.h" // pci_config_readl
#include "hw/pcidevice.h" // foreachpci
#include "hw/pci_ids.h" // PCI_CLASS_DISPLAY_VGA
@@ -308,6 +309,24 @@ fail:
return NULL;
}
+static int boot_irq_captured(void)
+{
+ struct segoff_s current, seabios;
+
+ current = GET_IVT(0x19);
+ seabios = FUNC16(entry_19_official);
+ return ((current.seg != seabios.seg) ||
+ (current.offset != current.offset));
+}
+
+static void boot_irq_restore(void)
+{
+ struct segoff_s seabios;
+
+ seabios = FUNC16(entry_19_official);
+ SET_IVT(0x19, seabios);
+}
+
// Attempt to map and initialize the option rom on a given PCI device.
static void
init_pcirom(struct pci_device *pci, int isvga, u64 *sources)
@@ -327,8 +346,18 @@ init_pcirom(struct pci_device *pci, int isvga, u64 *sources)
if (! rom)
// No ROM present.
return;
+ int irq_was_captured = boot_irq_captured();
+ struct pnp_data *pnp = get_pnp_rom(rom);
setRomSource(sources, rom, RS_PCIROM | (u32)pci);
init_optionrom(rom, pci->bdf, isvga);
+ if (boot_irq_captured() && !irq_was_captured &&
+ !file && !isvga && pnp) {
+ // This PCI rom is misbehaving - recapture the boot irqs
+ char *desc = MAKE_FLATPTR(FLATPTR_TO_SEG(rom), pnp->productname);
+ dprintf(1, "PnP optionrom \"%s\" (bdf %pP) captured int19, restoring\n",
+ desc, pci);
+ boot_irq_restore();
+ }
}
--
2.9.3
1 month, 3 weeks
[PATCH] optionrom: disallow int19 redirect for pnp roms.
by Gerd Hoffmann
Check whenever pnp roms attempt to redirect int19, and in case it does
log a message and undo the redirect.
A pnp rom should not need this, we have BEVs and BCVs for that.
Nevertheless there are roms in the wild which are redirecting int19.
At least some BIOS implementations for physical hardware have a config
option in the setup to allow/disallow int19 redirections, so just not
allowing this seems to be the way to deal with this situation.
Buglink: https://bugzilla.redhat.com//show_bug.cgi?id=1642135
Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com>
---
src/optionroms.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/src/optionroms.c b/src/optionroms.c
index fc992f649f..4ec5504ca9 100644
--- a/src/optionroms.c
+++ b/src/optionroms.c
@@ -8,6 +8,7 @@
#include "bregs.h" // struct bregs
#include "config.h" // CONFIG_*
#include "farptr.h" // FLATPTR_TO_SEG
+#include "biosvar.h" // GET_IVT
#include "hw/pci.h" // pci_config_readl
#include "hw/pcidevice.h" // foreachpci
#include "hw/pci_ids.h" // PCI_CLASS_DISPLAY_VGA
@@ -136,9 +137,24 @@ init_optionrom(struct rom_header *rom, u16 bdf, int isvga)
tpm_option_rom(newrom, rom->size * 512);
- if (isvga || get_pnp_rom(newrom))
+ struct pnp_data *pnp = get_pnp_rom(newrom);
+ if (isvga || pnp) {
+ struct segoff_s old19, new19;
// Only init vga and PnP roms here.
+ old19 = GET_IVT(0x19);
callrom(newrom, bdf);
+ new19 = GET_IVT(0x19);
+ if (old19.seg != new19.seg ||
+ old19.offset != new19.offset) {
+ dprintf(1, "WARNING! rom tried to hijack int19 "
+ "(vec %04x:%04x, pnp %s, bev %s, bvc %s)\n",
+ new19.seg, new19.offset,
+ pnp ? "yes" : "no",
+ pnp && pnp->bev ? "yes" : "no",
+ pnp && pnp->bcv ? "yes" : "no");
+ SET_IVT(0x19, old19);
+ }
+ }
return rom_confirm(newrom->size * 512);
}
--
2.9.3
2 months
[PATCH v3 0/2] Add menu item for activating TPM 2.0 PCR banks
by Stefan Berger
The following two patches add a menu item to the TPM 2.0 menu that allows
a user to activate and deactivate the PCR banks the attached TPM 2.0
supports.
This operation has to be done while in the firmware.
Stefan
v2->v3:
- Activate the selection of activate PCR banks right from the menu
- Undo some other changes, such as #define in src/utils.h
v1->v2:
- Refactor existing function for looking up the buffer size a hash needs
to use a table instead; we extend the table then in patch 2
Stefan Berger (2):
tcgbios: Use table to convert hash to buffer size
tcgbios: Implement TPM 2.0 menu item to activate and deactivate PCR
banks
src/std/tcg.h | 17 ++++
src/tcgbios.c | 264 +++++++++++++++++++++++++++++++++++++++++++++++---
2 files changed, 268 insertions(+), 13 deletions(-)
--
2.17.2
4 months, 3 weeks
bmp/bootsplash: Added support for 16/24/32bpp in one function
by Joseph Pacheco-Corwin
Specifically added support for 16 and 32bpp files, in addition to 24bpp.
The function bmp_show() in bmp.c has had the hardcoded check for 24bpp replaced with a general
bpp check that uses a % to check for remainder, and returns 1 if the remainder is >0.
The previous method for adjusting the BMP data (raw_data_format_adjust_24bpp) relied
on a preset 3*bytes_per_line_src, this has been changed and the multiplication is now performed
in the function's arguments. This change still allows someone else to reuse the same function for
1/2/4bpp support if necessary. The file util.h has been modified to reflect this decision.
The changes to raw_data_format_adjust() is based on an
abandoned patch by Gert Menke (submitted March 14, 2017),
credit to them for that change and the addition of *bpp to bmp_get_info().
Any feedback? I would appreciate it.
Signed-off-by: Joseph S. Pacheco-Corwin <hammersamatom(a)gmail.com>
---
src/bmp.c | 19 +++++++++----------
src/bootsplash.c | 17 +++++++++++++----
src/util.h | 2 +-
3 files changed, 23 insertions(+), 15 deletions(-)
diff --git a/src/bmp.c b/src/bmp.c
index 96a2b3f..fecc295 100644
--- a/src/bmp.c
+++ b/src/bmp.c
@@ -56,10 +56,9 @@ typedef struct tagRGBQUAD {
* arrange horizontal pixel data, add extra space in the dest buffer
* for every line
*/
-static void raw_data_format_adjust_24bpp(u8 *src, u8 *dest, int width,
- int height, int bytes_per_line_dest)
+static void raw_data_format_adjust(u8 *src, u8 *dest, int width,
+ int height, int bytes_per_line_src, int bytes_per_line_dest)
{
- int bytes_per_line_src = 3 * width;
int i;
for (i = 0 ; i < height ; i++) {
memcpy(dest + i * bytes_per_line_dest,
@@ -95,22 +94,22 @@ int bmp_decode(struct bmp_decdata *bmp, unsigned char *data, int data_size)
}
/* get bmp properties */
-void bmp_get_size(struct bmp_decdata *bmp, int *width, int *height)
+void bmp_get_info(struct bmp_decdata *bmp, int *width, int *height, int *bpp)
{
*width = bmp->width;
*height = bmp->height;
+ *bpp = bmp->bpp;
}
/* flush flat picture data to *pc */
-int bmp_show(struct bmp_decdata *bmp, unsigned char *pic, int width
- , int height, int depth, int bytes_per_line_dest)
+int bmp_show(struct bmp_decdata *bmp, unsigned char *pic, int width,
+ int height, int depth, int bytes_per_line_dest)
{
if (bmp->datap == pic)
return 0;
- /* now only support 24bpp bmp file */
- if ((depth == 24) && (bmp->bpp == 24)) {
- raw_data_format_adjust_24bpp(bmp->datap, pic, width, height,
- bytes_per_line_dest);
+ if ((depth == bmp->bpp) && (bmp->bpp%8 == 0)) {
+ raw_data_format_adjust(bmp->datap, pic, width, height,
+ (bmp->bpp/8)*width, bytes_per_line_dest);
return 0;
}
return 1;
diff --git a/src/bootsplash.c b/src/bootsplash.c
index 165c98d..401c348 100644
--- a/src/bootsplash.c
+++ b/src/bootsplash.c
@@ -172,10 +172,13 @@ enable_bootsplash(void)
dprintf(1, "bmp_decode failed with return code %d...\n", ret);
goto done;
}
- bmp_get_size(bmp, &width, &height);
- bpp_require = 24;
+ bmp_get_info(bmp, &width, &height, &bpp_require);
}
- /* jpeg would use 16 or 24 bpp video mode, BMP use 24bpp mode only */
+
+ /* jpeg would use 16 or 24 bpp video mode, BMP uses 8/16/24/32 bpp mode.
+ * 8bpp for BMP has corrupted colors, and lower than 8bpp fails to display
+ * or results in a loop.
+ */
// Try to find a graphics mode with the corresponding dimensions.
int videomode = find_videomode(vesa_info, mode_info, width, height,
@@ -192,7 +195,13 @@ enable_bootsplash(void)
dprintf(3, "bytes per scanline: %d\n", mode_info->bytes_per_scanline);
dprintf(3, "bits per pixel: %d\n", depth);
- // Allocate space for image and decompress it.
+ // Allocate space for image and decompress it.
+ /*
+ * Has a weird issue with low bpp image files, imagesize is not
+ * consistent. Example: 8bpp images are correct, being essentially
+ * multiplied/divided by 1, but if you use 4bpp images, width is divided by
+ * 8, when it should be divided by 2.
+ */
int imagesize = height * mode_info->bytes_per_scanline;
picture = malloc_tmphigh(imagesize);
if (!picture) {
diff --git a/src/util.h b/src/util.h
index 6dd080f..9c06850 100644
--- a/src/util.h
+++ b/src/util.h
@@ -12,7 +12,7 @@ void handle_1553(struct bregs *regs);
// bmp.c
struct bmp_decdata *bmp_alloc(void);
int bmp_decode(struct bmp_decdata *bmp, unsigned char *data, int data_size);
-void bmp_get_size(struct bmp_decdata *bmp, int *width, int *height);
+void bmp_get_info(struct bmp_decdata *bmp, int *width, int *height, int *bpp);
int bmp_show(struct bmp_decdata *bmp, unsigned char *pic, int width
, int height, int depth, int bytes_per_line_dest);
--
2.20.1
5 months, 1 week
[PATCH 0/2] Add menu item for activating TPM 2.0 PCR banks
by Stefan Berger
The following two patches add a menu item to the TPM 2.0 menu that allows
a user to activate and deactivate the PCR banks the attached TPM 2.0
supports.
This operation has to be done while in the firmware.
Stefan
v1->v2:
- Refactor existing function for looking up the buffer size a hash needs
to use a table instead; we extend the table then in patch 2
Stefan Berger (2):
tcgbios: Use table to convert hash to buffer size
tcgbios: Implement TPM 2.0 menu item to activate and deactivate PCR
banks
src/std/tcg.h | 18 ++++
src/tcgbios.c | 270 +++++++++++++++++++++++++++++++++++++++++++++++---
src/util.h | 2 +
3 files changed, 275 insertions(+), 15 deletions(-)
--
2.17.2
5 months, 2 weeks
[PATCH] build: Allow to use cross C preprocessor
by Roman Bolshakov
An attempt to cross-compile SeaBIOS on macOS can fail because host C
preprocessor doesn't comprehend the command line options:
Compiling IASL src/fw/acpi-dsdt.hex
cpp -P -MD -MT src/fw/acpi-dsdt.hex src/fw/acpi-dsdt.dsl -o out/src/fw/acpi-dsdt.dsl.i.orig
clang: error: no input files
make: *** [src/fw/acpi-dsdt.hex] Error 1
Signed-off-by: Roman Bolshakov <r.bolshakov(a)yadro.com>
---
Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Makefile b/Makefile
index d2d11db..909c0a1 100644
--- a/Makefile
+++ b/Makefile
@@ -23,7 +23,7 @@ OBJCOPY=$(CROSS_PREFIX)objcopy
OBJDUMP=$(CROSS_PREFIX)objdump
STRIP=$(CROSS_PREFIX)strip
PYTHON=python
-CPP=cpp
+CPP=$(CROSS_PREFIX)cpp
IASL:=iasl
LD32BIT_FLAG:=-melf_i386
--
2.20.1
5 months, 2 weeks
Re: [SeaBIOS] [coreboot] Upgrade the 12 years old LZMA libraries - should we do it?
by Carl-Daniel Hailfinger
Hi Ivan,
On 03.04.2018 20:03, Ivan Ivanov wrote:
> I have noticed that both coreboot and seabios are using the very old
> versions of LZMA SDK.
True. I introduced the lzma code in coreboot (back when it was called
LinuxBIOS) when we were working on OLPC XO-1 support.
> If we will upgrade our LZMA libraries from the
> outdated-by-12-years 4.42 to the current version 18.04 , speed and
> compression ratio should improve and maybe a few bugs will be fixed.
Do you have any numbers for this? An improved compression ratio and
improved speed would be nice indeed, but how does the size of the
decompression code change? If the decompression code grows more than the
size reduction from better compression, it would be a net loss. A
significantly reduced decompression speed would also be a problem.
Decompression speed would have to be measured both for stream
decompression (i.e. the decompressor gets the compressed data in
single-byte or multibyte chunks) as well as full-size decompression
(i.e. the decompressor can access all compressed data at once). We also
have to make sure that stream decompression still works after the change.
> Do you think it should be done, or you are OK with using such an
> outdated version?
A size benefit for the resulting image is a good reason to switch.
Regards,
Carl-Daniel
5 months, 2 weeks
Mailing list update
by Kevin O'Connor
FYI, the SeaBIOS mailing list backend was recently updated (upgrade to
Mailman3). Service should not be impacted, but if anyone does
experience an issue then please let me know.
Cheers,
-Kevin
5 months, 3 weeks
[PATCH] tcgbios: Implement TPM 2.0 menu item to activate and deactivate PCR banks
by Stefan Berger
Implement a TPM 2.0 menu item that allows a user to toggle the activation
of PCR banks of the TPM 2.0. After successful activation we shut down the
TPM 2.0 and reset the machine.
Signed-off-by: Stefan Berger <stefanb(a)linux.ibm.com>
---
src/std/tcg.h | 18 ++++
src/tcgbios.c | 235 +++++++++++++++++++++++++++++++++++++++++++++++++-
src/util.h | 2 +
3 files changed, 253 insertions(+), 2 deletions(-)
diff --git a/src/std/tcg.h b/src/std/tcg.h
index 09a92d8..eb9e67d 100644
--- a/src/std/tcg.h
+++ b/src/std/tcg.h
@@ -336,6 +336,12 @@ struct tpm_res_sha1complete {
#define TPM2_ALG_SHA512 0x000d
#define TPM2_ALG_SM3_256 0x0012
+#define TPM2_ALG_SHA1_FLAG (1 << 0)
+#define TPM2_ALG_SHA256_FLAG (1 << 1)
+#define TPM2_ALG_SHA384_FLAG (1 << 2)
+#define TPM2_ALG_SHA512_FLAG (1 << 3)
+#define TPM2_ALG_SM3_256_FLAG (1 << 4)
+
/* TPM 2 command tags */
#define TPM2_ST_NO_SESSIONS 0x8001
#define TPM2_ST_SESSIONS 0x8002
@@ -345,8 +351,10 @@ struct tpm_res_sha1complete {
#define TPM2_CC_Clear 0x126
#define TPM2_CC_ClearControl 0x127
#define TPM2_CC_HierarchyChangeAuth 0x129
+#define TPM2_CC_PCR_Allocate 0x12b
#define TPM2_CC_SelfTest 0x143
#define TPM2_CC_Startup 0x144
+#define TPM2_CC_Shutdown 0x145
#define TPM2_CC_StirRandom 0x146
#define TPM2_CC_GetCapability 0x17a
#define TPM2_CC_GetRandom 0x17b
@@ -442,6 +450,15 @@ struct tpm2_res_getcapability {
u8 data[0]; /* capability dependent data */
} PACKED;
+struct tpm2_req_pcr_allocate {
+ struct tpm_req_header hdr;
+ u32 authhandle;
+ u32 authblocksize;
+ struct tpm2_authblock authblock;
+ u32 count;
+ u8 tpms_pcr_selections[4];
+} PACKED;
+
struct tpms_pcr_selection {
u16 hashAlg;
u8 sizeOfSelect;
@@ -550,5 +567,6 @@ struct pcctes_romex
#define TPM_PPI_OP_CLEAR 5
#define TPM_PPI_OP_SET_OWNERINSTALL_TRUE 8
#define TPM_PPI_OP_SET_OWNERINSTALL_FALSE 9
+#define TPM_PPI_OP_SET_PCR_BANKS 23
#endif // tcg.h
diff --git a/src/tcgbios.c b/src/tcgbios.c
index 24846d3..ae0020e 100644
--- a/src/tcgbios.c
+++ b/src/tcgbios.c
@@ -180,6 +180,60 @@ tpm20_get_hash_buffersize(u16 hashAlg)
}
}
+static u8
+tpm20_hashalg_to_flag(u16 hashAlg)
+{
+ switch (hashAlg) {
+ case TPM2_ALG_SHA1:
+ return TPM2_ALG_SHA1_FLAG;
+ case TPM2_ALG_SHA256:
+ return TPM2_ALG_SHA256_FLAG;
+ case TPM2_ALG_SHA384:
+ return TPM2_ALG_SHA384_FLAG;
+ case TPM2_ALG_SHA512:
+ return TPM2_ALG_SHA512_FLAG;
+ case TPM2_ALG_SM3_256:
+ return TPM2_ALG_SM3_256_FLAG;
+ default:
+ return 0;
+ }
+}
+
+static u16
+tpm20_hashalg_flag_to_hashalg(u8 hashalg_flag)
+{
+ switch (hashalg_flag) {
+ case TPM2_ALG_SHA1_FLAG:
+ return TPM2_ALG_SHA1;
+ case TPM2_ALG_SHA256_FLAG:
+ return TPM2_ALG_SHA256;
+ case TPM2_ALG_SHA384_FLAG:
+ return TPM2_ALG_SHA384;
+ case TPM2_ALG_SHA512_FLAG:
+ return TPM2_ALG_SHA512;
+ case TPM2_ALG_SM3_256_FLAG:
+ return TPM2_ALG_SM3_256;
+ default:
+ return 0;
+ }
+}
+
+static const char *
+tpm20_hashalg_flag_to_name(u8 hashalg_flag)
+{
+ switch (hashalg_flag) {
+ case TPM2_ALG_SHA1_FLAG:
+ return "SHA1";
+ case TPM2_ALG_SHA256_FLAG:
+ return "SHA256";
+ case TPM2_ALG_SHA384_FLAG:
+ return "SHA384";
+ case TPM2_ALG_SHA512_FLAG:
+ return "SHA512";
+ }
+ return NULL;
+}
+
// Add an entry at the start of the log describing digest formats
static int
tpm20_write_EfiSpecIdEventStruct(void)
@@ -432,6 +486,104 @@ tpm20_get_pcrbanks(void)
return ret;
}
+static int
+tpm20_get_suppt_pcrbanks(u8 *suppt_pcrbanks, u8 *active_pcrbanks)
+{
+ *suppt_pcrbanks = 0;
+ *active_pcrbanks = 0;
+
+ if (!tpm20_pcr_selection)
+ return -1;
+
+ struct tpms_pcr_selection *sel = tpm20_pcr_selection->selections;
+ void *end = (void*)tpm20_pcr_selection + tpm20_pcr_selection_size;
+
+ while (1) {
+ u8 sizeOfSelect = sel->sizeOfSelect;
+ void *nsel = (void*)sel + sizeof(*sel) + sizeOfSelect;
+ if (nsel > end)
+ return 0;
+
+ u16 hashalg = be16_to_cpu(sel->hashAlg);
+ u8 hashalg_flag = tpm20_hashalg_to_flag(hashalg);
+
+ *suppt_pcrbanks |= hashalg_flag;
+
+ unsigned i;
+ for (i = 0; i < sizeOfSelect; i++) {
+ if (sel->pcrSelect[i]) {
+ *active_pcrbanks |= hashalg_flag;
+ break;
+ }
+ }
+
+ sel = nsel;
+ }
+}
+
+static int
+tpm20_set_pcrbanks(u32 active_banks)
+{
+ struct tpm2_req_pcr_allocate trpa = {
+ .hdr.tag = cpu_to_be16(TPM2_ST_SESSIONS),
+ .hdr.ordinal = cpu_to_be32(TPM2_CC_PCR_Allocate),
+ .authhandle = cpu_to_be32(TPM2_RH_PLATFORM),
+ .authblocksize = cpu_to_be32(sizeof(trpa.authblock)),
+ .authblock = {
+ .handle = cpu_to_be32(TPM2_RS_PW),
+ .noncesize = cpu_to_be16(0),
+ .contsession = TPM2_YES,
+ .pwdsize = cpu_to_be16(0),
+ },
+ };
+ struct tpms_pcr_selection3 {
+ u16 hashAlg;
+ u8 sizeOfSelect;
+ u8 pcrSelect[3];
+ } tps[ARRAY_SIZE(trpa.tpms_pcr_selections)];
+ int i = 0;
+ u8 hashalg_flag = TPM2_ALG_SHA1_FLAG;
+ u8 dontcare, suppt_banks;
+
+ tpm20_get_suppt_pcrbanks(&suppt_banks, &dontcare);
+
+ while (hashalg_flag) {
+ if ((hashalg_flag & suppt_banks)) {
+ u16 hashalg = tpm20_hashalg_flag_to_hashalg(hashalg_flag);
+
+ if (hashalg) {
+ u8 mask = 0;
+ tps[i].hashAlg = cpu_to_be16(hashalg);
+ tps[i].sizeOfSelect = 3;
+
+ if (active_banks & hashalg_flag)
+ mask = 0xff;
+
+ tps[i].pcrSelect[0] = mask;
+ tps[i].pcrSelect[1] = mask;
+ tps[i].pcrSelect[2] = mask;
+ i++;
+ }
+ }
+ hashalg_flag <<= 1;
+ }
+
+ trpa.count = cpu_to_be32(i);
+ memcpy(trpa.tpms_pcr_selections, tps, i * sizeof(tps[0]));
+ trpa.hdr.totlen = cpu_to_be32(offsetof(struct tpm2_req_pcr_allocate,
+ tpms_pcr_selections) +
+ i * sizeof(tps[0]));
+
+ struct tpm_rsp_header rsp;
+ u32 resp_length = sizeof(rsp);
+
+ int ret = tpmhw_transmit(0, &trpa.hdr, &rsp, &resp_length,
+ TPM_DURATION_TYPE_SHORT);
+ ret = ret ? -1 : be32_to_cpu(rsp.errcode);
+
+ return ret;
+}
+
static int
tpm12_get_capability(u32 cap, u32 subcap, struct tpm_rsp_header *rsp, u32 rsize)
{
@@ -1752,7 +1904,7 @@ tpm20_clear(void)
}
static int
-tpm20_process_cfg(tpm_ppi_code msgCode, int verbose)
+tpm20_process_cfg(tpm_ppi_code msgCode, u32 pprm, int verbose)
{
int ret = 0;
@@ -1765,6 +1917,13 @@ tpm20_process_cfg(tpm_ppi_code msgCode, int verbose)
if (!ret)
ret = tpm20_clear();
break;
+
+ case TPM_PPI_OP_SET_PCR_BANKS:
+ ret = tpm20_set_pcrbanks(pprm);
+ if (!ret)
+ ret = tpm_simple_cmd(0, TPM2_CC_Shutdown,
+ 2, TPM2_SU_CLEAR, TPM_DURATION_TYPE_SHORT);
+ break;
}
if (ret)
@@ -1947,14 +2106,77 @@ tpm12_menu(void)
}
}
+static int
+tpm20_menu_change_active_pcrbanks(u8 *activate_banks)
+{
+ u8 active_banks, suppt_banks;
+
+ tpm20_get_suppt_pcrbanks(&suppt_banks, &active_banks);
+
+ *activate_banks = active_banks;
+
+ while (1) {
+ u8 hashalg_flag = TPM2_ALG_SHA1_FLAG;
+ u8 i = 0;
+
+ printf("\nToggle active PCR banks by pressing number key\n\n");
+
+ while (hashalg_flag) {
+ u8 flag = hashalg_flag & suppt_banks;
+ const char *hashname = tpm20_hashalg_flag_to_name(flag);
+
+ i++;
+ if (hashname) {
+ printf(" %d: %s", i, hashname);
+ if (*activate_banks & hashalg_flag)
+ printf(" (enabled)");
+ printf("\n");
+ }
+
+ hashalg_flag <<= 1;
+ }
+ printf("\n"
+ "ESC: return to previous menu without changing active PCR banks\n"
+ "A : activate selection\n");
+ u8 flagnum;
+ int show = 0;
+ while (!show) {
+ int scancode = get_keystroke(1000);
+
+ switch (scancode) {
+ case ~0:
+ continue;
+ case 1: /* ESC */
+ printf("\n");
+ return -1;
+ case 2 ... 6: /* keys 1 .. 5 */
+ flagnum = scancode - 1;
+ if (flagnum > i)
+ continue;
+ if (suppt_banks & (1 << (flagnum - 1))) {
+ *activate_banks ^= 1 << (flagnum - 1);
+ show = 1;
+ }
+ break;
+ case SCANCODE_A:
+ return 0;
+ }
+ }
+ }
+}
+
static void
tpm20_menu(void)
{
int scan_code;
tpm_ppi_code msgCode;
+ u32 pprm;
+ u8 active_banks;
+ int do_reset = 0;
for (;;) {
printf("1. Clear TPM\n");
+ printf("2. Change active PCR banks\n");
printf("\nIf no change is desired or if this menu was reached by "
"mistake, press ESC to\n"
@@ -1973,11 +2195,20 @@ tpm20_menu(void)
case 2:
msgCode = TPM_PPI_OP_CLEAR;
break;
+ case 3:
+ if (tpm20_menu_change_active_pcrbanks(&active_banks) < 0)
+ continue;
+ msgCode = TPM_PPI_OP_SET_PCR_BANKS;
+ pprm = active_banks;
+ do_reset = 1;
+ break;
default:
continue;
}
- tpm20_process_cfg(msgCode, 0);
+ tpm20_process_cfg(msgCode, pprm, 0);
+ if (do_reset)
+ reset();
}
}
diff --git a/src/util.h b/src/util.h
index 6dd080f..b7169dd 100644
--- a/src/util.h
+++ b/src/util.h
@@ -38,6 +38,8 @@ struct usbdevice_s;
int bootprio_find_usb(struct usbdevice_s *usbdev, int lun);
int get_keystroke(int msec);
+#define SCANCODE_A 0x1e
+
// bootsplash.c
void enable_vga_console(void);
void enable_bootsplash(void);
--
2.17.2
6 months
