[SeaBIOS] [PATCH v2 1/3] Add 'measurement' code to the BIOS
Stefan Berger
stefanb at linux.vnet.ibm.com
Tue May 26 21:48:33 CEST 2015
This patch adds invocations of functions that measure various parts of the
code and data through various parts of the BIOS code. It follows TCG
specifications on what needs to be measured. It also adds the implementation
of the called functions.
Reference for what needs to be measured can be found in specs found here:
http://www.trustedcomputinggroup.org/resources/pc_client_work_group_specific_implementation_specification_for_conventional_bios
The first measurements are done once the ACPI tables have been initialized.
Once booted into Linux, the current measurements produce the following logs
which can be found in /sys/kernel/security/tpm0/ascii_bios_measurements.
The below log also shows measurements from trusted grub.
1 3fb240d2a04085a4e84f81e4398e070ed5a18163 06 [SMBIOS]
2 cc812353fc277c1fab99e0b721752a1392984566 06 [Option ROM]
2 9dbd87163112e5670378abe4510491259a61f411 05 [Start Option ROM Scan]
2 6f74e357331b8dee11bbad85f27bc66cb873106c 06 [Option ROM]
2 5626eb7ac05c7231e46d7461e7d3839b03ae9fad 06 [Option ROM]
4 c1e25c3f6b0dc78d57296aa2870ca6f782ccf80f 05 [Calling INT 19h]
0 d9be6524a5f5047db5866813acf3277892a7a30a 04 []
1 d9be6524a5f5047db5866813acf3277892a7a30a 04 []
2 d9be6524a5f5047db5866813acf3277892a7a30a 04 []
3 d9be6524a5f5047db5866813acf3277892a7a30a 04 []
4 d9be6524a5f5047db5866813acf3277892a7a30a 04 []
5 d9be6524a5f5047db5866813acf3277892a7a30a 04 []
6 d9be6524a5f5047db5866813acf3277892a7a30a 04 []
7 d9be6524a5f5047db5866813acf3277892a7a30a 04 []
4 8cf2fe6c87d4d0b2998a43da630292e6d85ee8b6 05 [Booting BCV device 80h (HDD)]
4 5dff94459a3e2d13a433ef94afdc306144565bf7 0d [IPL]
5 d1b33afde65ad47502332af957c60f20c84c1edc 0e [IPL Partition Data]
4 487ce764b527ccad17f1d04243d0136fa981e6c4 0d [IPL]
4 91d285e4dead566324c8938a3cc75803f462d9a1 0d [IPL]
4 8ba79ac98bb491524fef29defc724daaf6263d35 0d [IPL]
4 c591c15b82e4ff30e7383a4ff1ef3b41b38521ac 06 []
4 8cdc27ec545eda33fbba1e8b8dae4da5c7206972 04 [Grub Event Separator]
5 8cdc27ec545eda33fbba1e8b8dae4da5c7206972 04 [Grub Event Separator]
5 e8673b9e14b02dc12d8ccfd0176bca7a3de7fc3c 0e [IPL Partition Data]
5 0163e375a0af7525c5dac1a8e74b277359e40d1d 1105 []
8 4be30f67c3d48ab7f04d9c0fd07f06d4c68379be 1205 []
8 54c83965978de9708d026016ecb0e70660e04388 1305 []
5 2431ed60130faeaf3a045f21963f71cacd46a029 04 [OS Event Separator]
8 2431ed60130faeaf3a045f21963f71cacd46a029 04 [OS Event Separator]
8 f3973cae05d6e2055062119d6e6e1e077b7df876 1005 []
Signed-off-by: Stefan Berger <stefanb at linux.vnet.ibm.com>
---
src/boot.c | 6 +
src/cdrom.c | 4 +
src/optionroms.c | 2 +
src/tcgbios.c | 377 ++++++++++++++++++++++++++++++++++++++++++++++++++++++-
src/tcgbios.h | 4 +
5 files changed, 390 insertions(+), 3 deletions(-)
diff --git a/src/boot.c b/src/boot.c
index d6b1fb7..ec59c37 100644
--- a/src/boot.c
+++ b/src/boot.c
@@ -19,6 +19,7 @@
#include "std/disk.h" // struct mbr_s
#include "string.h" // memset
#include "util.h" // irqtimer_calc
+#include "tcgbios.h" // tpm_*
/****************************************************************
@@ -628,6 +629,8 @@ boot_disk(u8 bootdrv, int checksig)
}
}
+ tpm_add_bcv(bootdrv, MAKE_FLATPTR(bootseg, 0), 512);
+
/* Canonicalize bootseg:bootip */
u16 bootip = (bootseg & 0x0fff) << 4;
bootseg &= 0xf000;
@@ -651,6 +654,9 @@ boot_cdrom(struct drive_s *drive_g)
u8 bootdrv = CDEmu.emulated_drive;
u16 bootseg = CDEmu.load_segment;
+
+ tpm_add_cdrom(bootdrv, MAKE_FLATPTR(bootseg, 0), 512);
+
/* Canonicalize bootseg:bootip */
u16 bootip = (bootseg & 0x0fff) << 4;
bootseg &= 0xf000;
diff --git a/src/cdrom.c b/src/cdrom.c
index 92f34f4..7ee36d9 100644
--- a/src/cdrom.c
+++ b/src/cdrom.c
@@ -15,6 +15,7 @@
#include "std/disk.h" // DISK_RET_SUCCESS
#include "string.h" // memset
#include "util.h" // cdrom_prepboot
+#include "tcgbios.h" // tpm_*
// Locks for removable devices
u8 CDRom_locks[BUILD_MAX_EXTDRIVE] VARLOW;
@@ -192,6 +193,9 @@ cdrom_boot(struct drive_s *drive)
if (buffer[0x20] != 0x88)
return 11; // Bootable
+ /* measure 2048 bytes (one sector) */
+ tpm_add_cdrom_catalog(MAKE_FLATPTR(GET_SEG(SS), buffer), sizeof(buffer));
+
// Fill in el-torito cdrom emulation fields.
emulated_drive_gf = drive;
u8 media = buffer[0x21];
diff --git a/src/optionroms.c b/src/optionroms.c
index f6047e6..7906908 100644
--- a/src/optionroms.c
+++ b/src/optionroms.c
@@ -19,6 +19,7 @@
#include "std/pnpbios.h" // PNP_SIGNATURE
#include "string.h" // memset
#include "util.h" // get_pnp_offset
+#include "tcgbios.h" // tpm_*
static int EnforceChecksum, S3ResumeVga, RunPCIroms;
@@ -80,6 +81,7 @@ is_valid_rom(struct rom_header *rom)
if (EnforceChecksum)
return 0;
}
+ tpm_option_rom(rom, len);
return 1;
}
diff --git a/src/tcgbios.c b/src/tcgbios.c
index 04904e3..dc133c5 100644
--- a/src/tcgbios.c
+++ b/src/tcgbios.c
@@ -1,8 +1,8 @@
// Implementation of the TCG BIOS extension according to the specification
-// described in
-// https://www.trustedcomputinggroup.org/specs/PCClient/TCG_PCClientImplementationforBIOS_1-20_1-00.pdf
+// described in specs found at
+// http://www.trustedcomputinggroup.org/resources/pc_client_work_group_specific_implementation_specification_for_conventional_bios
//
-// Copyright (C) 2006-2011, 2014 IBM Corporation
+// Copyright (C) 2006-2011, 2014, 2015 IBM Corporation
//
// Authors:
// Stefan Berger <stefanb at linux.vnet.ibm.com>
@@ -24,6 +24,7 @@
#include "bregs.h" // struct bregs
#include "sha1.h" // sha1
#include "fw/paravirt.h" // runningOnXen
+#include "std/smbios.h"
static const u8 Startup_ST_CLEAR[2] = { 0x00, TPM_ST_CLEAR };
static const u8 Startup_ST_STATE[2] = { 0x00, TPM_ST_STATE };
@@ -56,9 +57,17 @@ static const u8 GetCapability_Durations[] = {
0x00, 0x00, 0x01, 0x20
};
+static u8 evt_separator[] = {0xff,0xff,0xff,0xff};
+
#define RSDP_CAST(ptr) ((struct rsdp_descriptor *)ptr)
+/* local function prototypes */
+
+static u32 tpm_calling_int19h(void);
+static u32 tpm_add_event_separators(void);
+static u32 tpm_start_option_rom_scan(void);
+static u32 tpm_smbios_measure(void);
/* helper functions */
@@ -475,6 +484,14 @@ tpm_startup(void)
if (rc)
goto err_exit;
+ rc = tpm_smbios_measure();
+ if (rc)
+ goto err_exit;
+
+ rc = tpm_start_option_rom_scan();
+ if (rc)
+ goto err_exit;
+
return 0;
err_exit:
@@ -528,6 +545,14 @@ tpm_leave_bios(void)
if (rc || returnCode)
goto err_exit;
+ rc = tpm_calling_int19h();
+ if (rc)
+ goto err_exit;
+
+ rc = tpm_add_event_separators();
+ if (rc)
+ goto err_exit;
+
return 0;
err_exit:
@@ -1083,6 +1108,352 @@ tpm_interrupt_handler32(struct bregs *regs)
return;
}
+/*
+ * Add a measurement to the log; the data at data_seg:data/length are
+ * appended to the TCG_PCClientPCREventStruct
+ *
+ * Input parameters:
+ * pcrIndex : which PCR to extend
+ * event_type : type of event; specs section on 'Event Types'
+ * info : pointer to info (e.g., string) to be added to log as-is
+ * info_length: length of the info
+ * data : pointer to the data (i.e., string) to be added to the log
+ * data_length: length of the data
+ */
+static u32
+tpm_add_measurement_to_log(u32 pcrIndex, u32 event_type,
+ const char *info, u32 info_length,
+ const u8 *data, u32 data_length)
+{
+ u32 rc = 0;
+ struct hleeo hleeo;
+ u8 _pcpes[offsetof(struct pcpes, event) + 400];
+ struct pcpes *pcpes = (struct pcpes *)_pcpes;
+
+ if (info_length < sizeof(_pcpes) - offsetof(struct pcpes, event)) {
+
+ pcpes->pcrindex = pcrIndex;
+ pcpes->eventtype = event_type;
+ memset(&pcpes->digest, 0x0, sizeof(pcpes->digest));
+ pcpes->eventdatasize = info_length;
+ memcpy(&pcpes->event, info, info_length);
+
+ struct hleei_short hleei = {
+ .ipblength = sizeof(hleei),
+ .hashdataptr = data,
+ .hashdatalen = data_length,
+ .pcrindex = pcrIndex,
+ .logdataptr = _pcpes,
+ .logdatalen = info_length + offsetof(struct pcpes, event),
+ };
+
+ rc = hash_log_extend_event(&hleei, &hleeo);
+ } else {
+ rc = TCG_GENERAL_ERROR;
+ }
+
+ return rc;
+}
+
+
+/*
+ * Add a measurement to the list of measurements
+ * pcrIndex : PCR to be extended
+ * event_type : type of event; specs section on 'Event Types'
+ * data : additional parameter; used as parameter for
+ * 'action index'
+ */
+static u32
+tpm_add_measurement(u32 pcrIndex,
+ u16 event_type,
+ const char *string)
+{
+ u32 rc;
+ u32 len;
+
+ switch (event_type) {
+ case EV_SEPARATOR:
+ len = sizeof(evt_separator);
+ rc = tpm_add_measurement_to_log(pcrIndex, event_type,
+ (char *)NULL, 0,
+ (u8 *)evt_separator, len);
+ break;
+
+ case EV_ACTION:
+ rc = tpm_add_measurement_to_log(pcrIndex, event_type,
+ string, strlen(string),
+ (u8 *)string, strlen(string));
+ break;
+
+ default:
+ rc = TCG_INVALID_INPUT_PARA;
+ }
+
+ return rc;
+}
+
+
+static u32
+tpm_calling_int19h(void)
+{
+ if (!CONFIG_TCGBIOS)
+ return 0;
+
+ if (!has_working_tpm())
+ return TCG_GENERAL_ERROR;
+
+ return tpm_add_measurement(4, EV_ACTION,
+ "Calling INT 19h");
+}
+
+/*
+ * Add event separators for PCRs 0 to 7; specs on 'Measuring Boot Events'
+ */
+u32
+tpm_add_event_separators(void)
+{
+ u32 rc;
+ u32 pcrIndex = 0;
+
+ if (!CONFIG_TCGBIOS)
+ return 0;
+
+ if (!has_working_tpm())
+ return TCG_GENERAL_ERROR;
+
+ while (pcrIndex <= 7) {
+ rc = tpm_add_measurement(pcrIndex, EV_SEPARATOR, NULL);
+ if (rc)
+ break;
+ pcrIndex ++;
+ }
+
+ return rc;
+}
+
+
+/*
+ * Add a measurement regarding the boot device (CDRom, Floppy, HDD) to
+ * the list of measurements.
+ */
+static u32
+tpm_add_bootdevice(u32 bootcd, u32 bootdrv)
+{
+ const char *string;
+
+ if (!CONFIG_TCGBIOS)
+ return 0;
+
+ if (!has_working_tpm())
+ return TCG_GENERAL_ERROR;
+
+ switch (bootcd) {
+ case 0:
+ switch (bootdrv) {
+ case 0:
+ string = "Booting BCV device 00h (Floppy)";
+ break;
+
+ case 0x80:
+ string = "Booting BCV device 80h (HDD)";
+ break;
+
+ default:
+ string = "Booting unknown device";
+ break;
+ }
+
+ break;
+
+ default:
+ string = "Booting from CD ROM device";
+ }
+
+ return tpm_add_measurement_to_log(4, EV_ACTION,
+ string, strlen(string),
+ (u8 *)string, strlen(string));
+}
+
+
+/*
+ * Add measurement to the log about option rom scan
+ */
+u32
+tpm_start_option_rom_scan(void)
+{
+ if (!CONFIG_TCGBIOS)
+ return 0;
+
+ if (!has_working_tpm())
+ return TCG_GENERAL_ERROR;
+
+ return tpm_add_measurement(2, EV_ACTION,
+ "Start Option ROM Scan");
+}
+
+
+/*
+ * Add measurement to the log about an option rom
+ */
+u32
+tpm_option_rom(const void *addr, u32 len)
+{
+ if (!CONFIG_TCGBIOS)
+ return 0;
+
+ if (!has_working_tpm())
+ return TCG_GENERAL_ERROR;
+
+ u32 rc;
+ struct pcctes_romex pcctes = {
+ .eventid = 7,
+ .eventdatasize = sizeof(u16) + sizeof(u16) + SHA1_BUFSIZE,
+ };
+
+ rc = sha1((const u8 *)addr, len, pcctes.digest);
+ if (rc)
+ return rc;
+
+ return tpm_add_measurement_to_log(2,
+ EV_EVENT_TAG,
+ (const char *)&pcctes, sizeof(pcctes),
+ (u8 *)&pcctes, sizeof(pcctes));
+}
+
+
+u32
+tpm_smbios_measure(void)
+{
+ if (!CONFIG_TCGBIOS)
+ return 0;
+
+ if (!has_working_tpm())
+ return TCG_GENERAL_ERROR;
+
+ u32 rc;
+ struct pcctes pcctes = {
+ .eventid = 1,
+ .eventdatasize = SHA1_BUFSIZE,
+ };
+ struct smbios_entry_point *sep = SMBiosAddr;
+
+ dprintf(DEBUG_tcg, "TCGBIOS: SMBIOS at %p\n", sep);
+
+ if (!sep)
+ return 0;
+
+ rc = sha1((const u8 *)sep->structure_table_address,
+ sep->structure_table_length, pcctes.digest);
+ if (rc)
+ return rc;
+
+ return tpm_add_measurement_to_log(1,
+ EV_EVENT_TAG,
+ (const char *)&pcctes, sizeof(pcctes),
+ (u8 *)&pcctes, sizeof(pcctes));
+}
+
+
+/*
+ * Add a measurement related to Initial Program Loader to the log.
+ * Creates two log entries.
+ *
+ * Input parameter:
+ * bootcd : 0: MBR of hdd, 1: boot image, 2: boot catalog of El Torito
+ * addr : address where the IP data are located
+ * length : IP data length in bytes
+ */
+static u32
+tpm_ipl(enum ipltype bootcd, const u8 *addr, u32 length)
+{
+ u32 rc;
+ const char *string;
+
+ switch (bootcd) {
+ case IPL_EL_TORITO_1:
+ /* specs: see section 'El Torito' */
+ string = "EL TORITO IPL";
+ rc = tpm_add_measurement_to_log(4, EV_IPL,
+ string, strlen(string),
+ addr, length);
+ break;
+
+ case IPL_EL_TORITO_2:
+ /* specs: see section 'El Torito' */
+ string = "BOOT CATALOG";
+ rc = tpm_add_measurement_to_log(5, EV_IPL_PARTITION_DATA,
+ string, strlen(string),
+ addr, length);
+ break;
+
+ default:
+ /* specs: see section 'Hard Disk Device or Hard Disk-Like Devices' */
+ /* equivalent to: dd if=/dev/hda ibs=1 count=440 | sha1sum */
+ string = "MBR";
+ rc = tpm_add_measurement_to_log(4, EV_IPL,
+ string, strlen(string),
+ addr, 0x1b8);
+
+ if (rc)
+ break;
+
+ /* equivalent to: dd if=/dev/hda ibs=1 count=72 skip=440 | sha1sum */
+ string = "MBR PARTITION_TABLE";
+ rc = tpm_add_measurement_to_log(5, EV_IPL_PARTITION_DATA,
+ string, strlen(string),
+ addr + 0x1b8, 0x48);
+ }
+
+ return rc;
+}
+
+u32
+tpm_add_bcv(u32 bootdrv, const u8 *addr, u32 length)
+{
+ if (!CONFIG_TCGBIOS)
+ return 0;
+
+ if (!has_working_tpm())
+ return TCG_GENERAL_ERROR;
+
+ u32 rc = tpm_add_bootdevice(0, bootdrv);
+ if (rc)
+ return rc;
+
+ return tpm_ipl(IPL_BCV, addr, length);
+}
+
+u32
+tpm_add_cdrom(u32 bootdrv, const u8 *addr, u32 length)
+{
+ if (!CONFIG_TCGBIOS)
+ return 0;
+
+ if (!has_working_tpm())
+ return TCG_GENERAL_ERROR;
+
+ u32 rc = tpm_add_bootdevice(1, bootdrv);
+ if (rc)
+ return rc;
+
+ return tpm_ipl(IPL_EL_TORITO_1, addr, length);
+}
+
+u32
+tpm_add_cdrom_catalog(const u8 *addr, u32 length)
+{
+ if (!CONFIG_TCGBIOS)
+ return 0;
+
+ if (!has_working_tpm())
+ return TCG_GENERAL_ERROR;
+
+ u32 rc = tpm_add_bootdevice(1, 0);
+ if (rc)
+ return rc;
+
+ return tpm_ipl(IPL_EL_TORITO_2, addr, length);
+}
u32
tpm_s3_resume(void)
diff --git a/src/tcgbios.h b/src/tcgbios.h
index 72fd771..a1d0b0f 100644
--- a/src/tcgbios.h
+++ b/src/tcgbios.h
@@ -386,5 +386,9 @@ void tpm_interrupt_handler32(struct bregs *regs);
u32 tpm_start(void);
u32 tpm_leave_bios(void);
u32 tpm_s3_resume(void);
+u32 tpm_add_bcv(u32 bootdrv, const u8 *addr, u32 length);
+u32 tpm_add_cdrom(u32 bootdrv, const u8 *addr, u32 length);
+u32 tpm_add_cdrom_catalog(const u8 *addr, u32 length);
+u32 tpm_option_rom(const void *addr, u32 len);
#endif /* TCGBIOS_H */
--
1.9.3
More information about the SeaBIOS
mailing list