2ae5c1e
From 59e54f473afa4e4f67dde8f11a33cb8490496086 Mon Sep 17 00:00:00 2001
b9efc54
From: Matthew Garrett <mjg59@coreos.com>
b9efc54
Date: Tue, 14 Jul 2015 17:06:35 -0700
2ae5c1e
Subject: [PATCH 77/85] Core TPM support
b9efc54
b9efc54
Add support for performing basic TPM measurements. Right now this only
b9efc54
supports extending PCRs statically and only on UEFI and BIOS systems, but
b9efc54
will measure all modules as they're loaded.
b9efc54
---
b9efc54
 grub-core/Makefile.am        |   1 +
b9efc54
 grub-core/Makefile.core.def  |   3 +
b9efc54
 grub-core/kern/dl.c          |   3 +
b9efc54
 grub-core/kern/efi/tpm.c     | 282 +++++++++++++++++++++++++++++++++++++++++++
b9efc54
 grub-core/kern/i386/pc/tpm.c | 132 ++++++++++++++++++++
b9efc54
 grub-core/kern/tpm.c         |  13 ++
b9efc54
 include/grub/efi/tpm.h       | 153 +++++++++++++++++++++++
b9efc54
 include/grub/tpm.h           |  91 ++++++++++++++
b9efc54
 8 files changed, 678 insertions(+)
b9efc54
 create mode 100644 grub-core/kern/efi/tpm.c
b9efc54
 create mode 100644 grub-core/kern/i386/pc/tpm.c
b9efc54
 create mode 100644 grub-core/kern/tpm.c
b9efc54
 create mode 100644 include/grub/efi/tpm.h
b9efc54
 create mode 100644 include/grub/tpm.h
b9efc54
b9efc54
diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am
b9efc54
index fd715a8..d082933 100644
b9efc54
--- a/grub-core/Makefile.am
b9efc54
+++ b/grub-core/Makefile.am
b9efc54
@@ -93,6 +93,7 @@ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/term.h
b9efc54
 KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/time.h
b9efc54
 KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/mm_private.h
b9efc54
 KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/net.h
b9efc54
+KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/tpm.h
b9efc54
 KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/memory.h
b9efc54
 
b9efc54
 if COND_i386_pc
b9efc54
diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
b9efc54
index 990e41b..9fa9790 100644
b9efc54
--- a/grub-core/Makefile.core.def
b9efc54
+++ b/grub-core/Makefile.core.def
b9efc54
@@ -126,6 +126,7 @@ kernel = {
b9efc54
   common = kern/rescue_parser.c;
b9efc54
   common = kern/rescue_reader.c;
b9efc54
   common = kern/term.c;
b9efc54
+  common = kern/tpm.c;
b9efc54
 
b9efc54
   noemu = kern/compiler-rt.c;
b9efc54
   noemu = kern/mm.c;
b9efc54
@@ -177,6 +178,7 @@ kernel = {
b9efc54
   efi = kern/acpi.c;
b9efc54
   efi = kern/efi/acpi.c;
b9efc54
   efi = lib/envblk.c;
b9efc54
+  efi = kern/efi/tpm.c;
b9efc54
   i386_coreboot = kern/i386/pc/acpi.c;
b9efc54
   i386_multiboot = kern/i386/pc/acpi.c;
b9efc54
   i386_coreboot = kern/acpi.c;
b9efc54
@@ -222,6 +224,7 @@ kernel = {
b9efc54
 
b9efc54
   i386_pc = kern/i386/pc/init.c;
b9efc54
   i386_pc = kern/i386/pc/mmap.c;
b9efc54
+  i386_pc = kern/i386/pc/tpm.c;
b9efc54
   i386_pc = term/i386/pc/console.c;
b9efc54
 
b9efc54
   i386_qemu = bus/pci.c;
b9efc54
diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
b9efc54
index 04e804d..247cd0a 100644
b9efc54
--- a/grub-core/kern/dl.c
b9efc54
+++ b/grub-core/kern/dl.c
b9efc54
@@ -32,6 +32,7 @@
b9efc54
 #include <grub/env.h>
b9efc54
 #include <grub/cache.h>
b9efc54
 #include <grub/i18n.h>
b9efc54
+#include <grub/tpm.h>
b9efc54
 
b9efc54
 /* Platforms where modules are in a readonly area of memory.  */
b9efc54
 #if defined(GRUB_MACHINE_QEMU)
b9efc54
@@ -733,6 +734,8 @@ grub_dl_load_file (const char *filename)
b9efc54
      opens of the same device.  */
b9efc54
   grub_file_close (file);
b9efc54
 
b9efc54
+  grub_tpm_measure(core, size, GRUB_TPM_PCR, filename);
b9efc54
+
b9efc54
   mod = grub_dl_load_core (core, size);
b9efc54
   grub_free (core);
b9efc54
   if (! mod)
b9efc54
diff --git a/grub-core/kern/efi/tpm.c b/grub-core/kern/efi/tpm.c
b9efc54
new file mode 100644
b9efc54
index 0000000..c9fb3c1
b9efc54
--- /dev/null
b9efc54
+++ b/grub-core/kern/efi/tpm.c
b9efc54
@@ -0,0 +1,282 @@
b9efc54
+#include <grub/err.h>
b9efc54
+#include <grub/i18n.h>
b9efc54
+#include <grub/efi/api.h>
b9efc54
+#include <grub/efi/efi.h>
b9efc54
+#include <grub/efi/tpm.h>
b9efc54
+#include <grub/mm.h>
b9efc54
+#include <grub/tpm.h>
b9efc54
+#include <grub/term.h>
b9efc54
+
b9efc54
+static grub_efi_guid_t tpm_guid = EFI_TPM_GUID;
b9efc54
+static grub_efi_guid_t tpm2_guid = EFI_TPM2_GUID;
b9efc54
+
b9efc54
+static grub_efi_boolean_t grub_tpm_present(grub_efi_tpm_protocol_t *tpm)
b9efc54
+{
b9efc54
+  grub_efi_status_t status;
b9efc54
+  TCG_EFI_BOOT_SERVICE_CAPABILITY caps;
b9efc54
+  grub_uint32_t flags;
b9efc54
+  grub_efi_physical_address_t eventlog, lastevent;
b9efc54
+
b9efc54
+  caps.Size = (grub_uint8_t)sizeof(caps);
b9efc54
+
b9efc54
+  status = efi_call_5(tpm->status_check, tpm, &caps, &flags, &eventlog,
b9efc54
+		      &lastevent);
b9efc54
+
b9efc54
+  if (status != GRUB_EFI_SUCCESS || caps.TPMDeactivatedFlag
b9efc54
+      || !caps.TPMPresentFlag)
b9efc54
+    return 0;
b9efc54
+
b9efc54
+  return 1;
b9efc54
+}
b9efc54
+
b9efc54
+static grub_efi_boolean_t grub_tpm2_present(grub_efi_tpm2_protocol_t *tpm)
b9efc54
+{
b9efc54
+  grub_efi_status_t status;
b9efc54
+  EFI_TCG2_BOOT_SERVICE_CAPABILITY caps;
b9efc54
+
b9efc54
+  caps.Size = (grub_uint8_t)sizeof(caps);
b9efc54
+
b9efc54
+  status = efi_call_2(tpm->get_capability, tpm, &caps);
b9efc54
+
b9efc54
+  if (status != GRUB_EFI_SUCCESS || !caps.TPMPresentFlag)
b9efc54
+    return 0;
b9efc54
+
b9efc54
+  return 1;
b9efc54
+}
b9efc54
+
b9efc54
+static grub_efi_boolean_t grub_tpm_handle_find(grub_efi_handle_t *tpm_handle,
b9efc54
+					       grub_efi_uint8_t *protocol_version)
b9efc54
+{
b9efc54
+  grub_efi_handle_t *handles;
b9efc54
+  grub_efi_uintn_t num_handles;
b9efc54
+
b9efc54
+  handles = grub_efi_locate_handle (GRUB_EFI_BY_PROTOCOL, &tpm_guid, NULL,
b9efc54
+				    &num_handles);
b9efc54
+  if (handles && num_handles > 0) {
b9efc54
+    *tpm_handle = handles[0];
b9efc54
+    *protocol_version = 1;
b9efc54
+    return 1;
b9efc54
+  }
b9efc54
+
b9efc54
+  handles = grub_efi_locate_handle (GRUB_EFI_BY_PROTOCOL, &tpm2_guid, NULL,
b9efc54
+				    &num_handles);
b9efc54
+  if (handles && num_handles > 0) {
b9efc54
+    *tpm_handle = handles[0];
b9efc54
+    *protocol_version = 2;
b9efc54
+    return 1;
b9efc54
+  }
b9efc54
+
b9efc54
+  return 0;
b9efc54
+}
b9efc54
+
b9efc54
+static grub_err_t
b9efc54
+grub_tpm1_execute(grub_efi_handle_t tpm_handle,
b9efc54
+		  PassThroughToTPM_InputParamBlock *inbuf,
b9efc54
+		  PassThroughToTPM_OutputParamBlock *outbuf)
b9efc54
+{
b9efc54
+  grub_efi_status_t status;
b9efc54
+  grub_efi_tpm_protocol_t *tpm;
b9efc54
+  grub_uint32_t inhdrsize = sizeof(*inbuf) - sizeof(inbuf->TPMOperandIn);
b9efc54
+  grub_uint32_t outhdrsize = sizeof(*outbuf) - sizeof(outbuf->TPMOperandOut);
b9efc54
+
b9efc54
+  tpm = grub_efi_open_protocol (tpm_handle, &tpm_guid,
b9efc54
+				GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL);
b9efc54
+
b9efc54
+  if (!grub_tpm_present(tpm))
b9efc54
+    return 0;
b9efc54
+
b9efc54
+  /* UEFI TPM protocol takes the raw operand block, no param block header */
b9efc54
+  status = efi_call_5 (tpm->pass_through_to_tpm, tpm,
b9efc54
+		       inbuf->IPBLength - inhdrsize, inbuf->TPMOperandIn,
b9efc54
+		       outbuf->OPBLength - outhdrsize, outbuf->TPMOperandOut);
b9efc54
+
b9efc54
+  switch (status) {
b9efc54
+  case GRUB_EFI_SUCCESS:
b9efc54
+    return 0;
b9efc54
+  case GRUB_EFI_DEVICE_ERROR:
b9efc54
+    return grub_error (GRUB_ERR_IO, N_("Command failed"));
b9efc54
+  case GRUB_EFI_INVALID_PARAMETER:
b9efc54
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("Invalid parameter"));
b9efc54
+  case GRUB_EFI_BUFFER_TOO_SMALL:
b9efc54
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("Output buffer too small"));
b9efc54
+  case GRUB_EFI_NOT_FOUND:
b9efc54
+    return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("TPM unavailable"));
b9efc54
+  default:
b9efc54
+    return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("Unknown TPM error"));
b9efc54
+  }
b9efc54
+}
b9efc54
+
b9efc54
+static grub_err_t
b9efc54
+grub_tpm2_execute(grub_efi_handle_t tpm_handle,
b9efc54
+		  PassThroughToTPM_InputParamBlock *inbuf,
b9efc54
+		  PassThroughToTPM_OutputParamBlock *outbuf)
b9efc54
+{
b9efc54
+  grub_efi_status_t status;
b9efc54
+  grub_efi_tpm2_protocol_t *tpm;
b9efc54
+  grub_uint32_t inhdrsize = sizeof(*inbuf) - sizeof(inbuf->TPMOperandIn);
b9efc54
+  grub_uint32_t outhdrsize = sizeof(*outbuf) - sizeof(outbuf->TPMOperandOut);
b9efc54
+
b9efc54
+  tpm = grub_efi_open_protocol (tpm_handle, &tpm2_guid,
b9efc54
+				GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL);
b9efc54
+
b9efc54
+  if (!grub_tpm2_present(tpm))
b9efc54
+    return 0;
b9efc54
+
b9efc54
+  /* UEFI TPM protocol takes the raw operand block, no param block header */
b9efc54
+  status = efi_call_5 (tpm->submit_command, tpm,
b9efc54
+		       inbuf->IPBLength - inhdrsize, inbuf->TPMOperandIn,
b9efc54
+		       outbuf->OPBLength - outhdrsize, outbuf->TPMOperandOut);
b9efc54
+
b9efc54
+  switch (status) {
b9efc54
+  case GRUB_EFI_SUCCESS:
b9efc54
+    return 0;
b9efc54
+  case GRUB_EFI_DEVICE_ERROR:
b9efc54
+    return grub_error (GRUB_ERR_IO, N_("Command failed"));
b9efc54
+  case GRUB_EFI_INVALID_PARAMETER:
b9efc54
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("Invalid parameter"));
b9efc54
+  case GRUB_EFI_BUFFER_TOO_SMALL:
b9efc54
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("Output buffer too small"));
b9efc54
+  case GRUB_EFI_NOT_FOUND:
b9efc54
+    return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("TPM unavailable"));
b9efc54
+  default:
b9efc54
+    return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("Unknown TPM error"));
b9efc54
+  }
b9efc54
+}
b9efc54
+
b9efc54
+grub_err_t
b9efc54
+grub_tpm_execute(PassThroughToTPM_InputParamBlock *inbuf,
b9efc54
+		 PassThroughToTPM_OutputParamBlock *outbuf)
b9efc54
+{
b9efc54
+  grub_efi_handle_t tpm_handle;
b9efc54
+   grub_uint8_t protocol_version;
b9efc54
+
b9efc54
+  /* It's not a hard failure for there to be no TPM */
b9efc54
+  if (!grub_tpm_handle_find(&tpm_handle, &protocol_version))
b9efc54
+    return 0;
b9efc54
+
b9efc54
+  if (protocol_version == 1) {
b9efc54
+    return grub_tpm1_execute(tpm_handle, inbuf, outbuf);
b9efc54
+  } else {
b9efc54
+    return grub_tpm2_execute(tpm_handle, inbuf, outbuf);
b9efc54
+  }
b9efc54
+}
b9efc54
+
b9efc54
+typedef struct {
b9efc54
+	grub_uint32_t pcrindex;
b9efc54
+	grub_uint32_t eventtype;
b9efc54
+	grub_uint8_t digest[20];
b9efc54
+	grub_uint32_t eventsize;
b9efc54
+	grub_uint8_t event[1];
b9efc54
+} Event;
b9efc54
+
b9efc54
+
b9efc54
+static grub_err_t
b9efc54
+grub_tpm1_log_event(grub_efi_handle_t tpm_handle, unsigned char *buf,
b9efc54
+		    grub_size_t size, grub_uint8_t pcr,
b9efc54
+		    const char *description)
b9efc54
+{
b9efc54
+  Event *event;
b9efc54
+  grub_efi_status_t status;
b9efc54
+  grub_efi_tpm_protocol_t *tpm;
b9efc54
+  grub_efi_physical_address_t lastevent;
b9efc54
+  grub_uint32_t algorithm;
b9efc54
+  grub_uint32_t eventnum = 0;
b9efc54
+
b9efc54
+  tpm = grub_efi_open_protocol (tpm_handle, &tpm_guid,
b9efc54
+				GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL);
b9efc54
+
b9efc54
+  if (!grub_tpm_present(tpm))
b9efc54
+    return 0;
b9efc54
+
b9efc54
+  event = grub_zalloc(sizeof (Event) + grub_strlen(description) + 1);
b9efc54
+  if (!event)
b9efc54
+    return grub_error (GRUB_ERR_OUT_OF_MEMORY,
b9efc54
+		       N_("cannot allocate TPM event buffer"));
b9efc54
+
b9efc54
+  event->pcrindex = pcr;
b9efc54
+  event->eventtype = EV_IPL;
b9efc54
+  event->eventsize = grub_strlen(description) + 1;
b9efc54
+  grub_memcpy(event->event, description, event->eventsize);
b9efc54
+
b9efc54
+  algorithm = TCG_ALG_SHA;
b9efc54
+  status = efi_call_7 (tpm->log_extend_event, tpm, buf, (grub_uint64_t) size,
b9efc54
+		       algorithm, event, &eventnum, &lastevent);
b9efc54
+
b9efc54
+  switch (status) {
b9efc54
+  case GRUB_EFI_SUCCESS:
b9efc54
+    return 0;
b9efc54
+  case GRUB_EFI_DEVICE_ERROR:
b9efc54
+    return grub_error (GRUB_ERR_IO, N_("Command failed"));
b9efc54
+  case GRUB_EFI_INVALID_PARAMETER:
b9efc54
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("Invalid parameter"));
b9efc54
+  case GRUB_EFI_BUFFER_TOO_SMALL:
b9efc54
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("Output buffer too small"));
b9efc54
+  case GRUB_EFI_NOT_FOUND:
b9efc54
+    return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("TPM unavailable"));
b9efc54
+  default:
b9efc54
+    return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("Unknown TPM error"));
b9efc54
+  }
b9efc54
+}
b9efc54
+
b9efc54
+static grub_err_t
b9efc54
+grub_tpm2_log_event(grub_efi_handle_t tpm_handle, unsigned char *buf,
b9efc54
+		   grub_size_t size, grub_uint8_t pcr,
b9efc54
+		   const char *description)
b9efc54
+{
b9efc54
+  EFI_TCG2_EVENT *event;
b9efc54
+  grub_efi_status_t status;
b9efc54
+  grub_efi_tpm2_protocol_t *tpm;
b9efc54
+
b9efc54
+  tpm = grub_efi_open_protocol (tpm_handle, &tpm2_guid,
b9efc54
+				GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL);
b9efc54
+
b9efc54
+  if (!grub_tpm2_present(tpm))
b9efc54
+    return 0;
b9efc54
+
b9efc54
+  event = grub_zalloc(sizeof (EFI_TCG2_EVENT) + grub_strlen(description) + 1);
b9efc54
+  if (!event)
b9efc54
+    return grub_error (GRUB_ERR_OUT_OF_MEMORY,
b9efc54
+		       N_("cannot allocate TPM event buffer"));
b9efc54
+
b9efc54
+  event->Header.HeaderSize = sizeof(EFI_TCG2_EVENT_HEADER);
b9efc54
+  event->Header.HeaderVersion = 1;
b9efc54
+  event->Header.PCRIndex = pcr;
b9efc54
+  event->Header.EventType = EV_IPL;
b9efc54
+  event->Size = sizeof(*event) - sizeof(event->Event) + grub_strlen(description) + 1;
b9efc54
+  grub_memcpy(event->Event, description, grub_strlen(description) + 1);
b9efc54
+
b9efc54
+  status = efi_call_5 (tpm->hash_log_extend_event, tpm, 0, buf,
b9efc54
+		       (grub_uint64_t) size, event);
b9efc54
+
b9efc54
+  switch (status) {
b9efc54
+  case GRUB_EFI_SUCCESS:
b9efc54
+    return 0;
b9efc54
+  case GRUB_EFI_DEVICE_ERROR:
b9efc54
+    return grub_error (GRUB_ERR_IO, N_("Command failed"));
b9efc54
+  case GRUB_EFI_INVALID_PARAMETER:
b9efc54
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("Invalid parameter"));
b9efc54
+  case GRUB_EFI_BUFFER_TOO_SMALL:
b9efc54
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("Output buffer too small"));
b9efc54
+  case GRUB_EFI_NOT_FOUND:
b9efc54
+    return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("TPM unavailable"));
b9efc54
+  default:
b9efc54
+    return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("Unknown TPM error"));
b9efc54
+  }
b9efc54
+}
b9efc54
+
b9efc54
+grub_err_t
b9efc54
+grub_tpm_log_event(unsigned char *buf, grub_size_t size, grub_uint8_t pcr,
b9efc54
+		   const char *description)
b9efc54
+{
b9efc54
+  grub_efi_handle_t tpm_handle;
b9efc54
+  grub_efi_uint8_t protocol_version;
b9efc54
+
b9efc54
+  if (!grub_tpm_handle_find(&tpm_handle, &protocol_version))
b9efc54
+    return 0;
b9efc54
+
b9efc54
+  if (protocol_version == 1) {
b9efc54
+    return grub_tpm1_log_event(tpm_handle, buf, size, pcr, description);
b9efc54
+  } else {
b9efc54
+    return grub_tpm2_log_event(tpm_handle, buf, size, pcr, description);
b9efc54
+  }
b9efc54
+}
b9efc54
diff --git a/grub-core/kern/i386/pc/tpm.c b/grub-core/kern/i386/pc/tpm.c
b9efc54
new file mode 100644
b9efc54
index 0000000..8c6c1e6
b9efc54
--- /dev/null
b9efc54
+++ b/grub-core/kern/i386/pc/tpm.c
b9efc54
@@ -0,0 +1,132 @@
b9efc54
+#include <grub/err.h>
b9efc54
+#include <grub/i18n.h>
b9efc54
+#include <grub/mm.h>
b9efc54
+#include <grub/tpm.h>
b9efc54
+#include <grub/misc.h>
b9efc54
+#include <grub/i386/pc/int.h>
b9efc54
+
b9efc54
+#define TCPA_MAGIC 0x41504354
b9efc54
+
b9efc54
+int tpm_present(void);
b9efc54
+
b9efc54
+int tpm_present(void)
b9efc54
+{
b9efc54
+  struct grub_bios_int_registers regs;
b9efc54
+
b9efc54
+  regs.flags = GRUB_CPU_INT_FLAGS_DEFAULT;
b9efc54
+  regs.eax = 0xbb00;
b9efc54
+  regs.ebx = TCPA_MAGIC;
b9efc54
+  grub_bios_interrupt (0x1a, ®s;;
b9efc54
+
b9efc54
+  if (regs.eax == 0)
b9efc54
+    return 1;
b9efc54
+
b9efc54
+  return 0;
b9efc54
+}
b9efc54
+
b9efc54
+grub_err_t
b9efc54
+grub_tpm_execute(PassThroughToTPM_InputParamBlock *inbuf,
b9efc54
+		 PassThroughToTPM_OutputParamBlock *outbuf)
b9efc54
+{
b9efc54
+  struct grub_bios_int_registers regs;
b9efc54
+  grub_addr_t inaddr, outaddr;
b9efc54
+
b9efc54
+  if (!tpm_present())
b9efc54
+    return 0;
b9efc54
+
b9efc54
+  inaddr = (grub_addr_t) inbuf;
b9efc54
+  outaddr = (grub_addr_t) outbuf;
b9efc54
+  regs.flags = GRUB_CPU_INT_FLAGS_DEFAULT;
b9efc54
+  regs.eax = 0xbb02;
b9efc54
+  regs.ebx = TCPA_MAGIC;
b9efc54
+  regs.ecx = 0;
b9efc54
+  regs.edx = 0;
b9efc54
+  regs.es = (inaddr & 0xffff0000) >> 4;
b9efc54
+  regs.edi = inaddr & 0xffff;
b9efc54
+  regs.ds = outaddr >> 4;
b9efc54
+  regs.esi = outaddr & 0xf;
b9efc54
+
b9efc54
+  grub_bios_interrupt (0x1a, ®s;;
b9efc54
+
b9efc54
+  if (regs.eax)
b9efc54
+    return grub_error (GRUB_ERR_IO, N_("TPM error %x\n"), regs.eax);
b9efc54
+
b9efc54
+  return 0;
b9efc54
+}
b9efc54
+
b9efc54
+typedef struct {
b9efc54
+	grub_uint32_t pcrindex;
b9efc54
+	grub_uint32_t eventtype;
b9efc54
+	grub_uint8_t digest[20];
b9efc54
+	grub_uint32_t eventdatasize;
b9efc54
+	grub_uint8_t event[0];
b9efc54
+} GRUB_PACKED Event;
b9efc54
+
b9efc54
+typedef struct {
b9efc54
+	grub_uint16_t ipblength;
b9efc54
+	grub_uint16_t reserved;
b9efc54
+	grub_uint32_t hashdataptr;
b9efc54
+	grub_uint32_t hashdatalen;
b9efc54
+	grub_uint32_t pcr;
b9efc54
+	grub_uint32_t reserved2;
b9efc54
+	grub_uint32_t logdataptr;
b9efc54
+	grub_uint32_t logdatalen;
b9efc54
+} GRUB_PACKED EventIncoming;
b9efc54
+
b9efc54
+typedef struct {
b9efc54
+	grub_uint16_t opblength;
b9efc54
+	grub_uint16_t reserved;
b9efc54
+	grub_uint32_t eventnum;
b9efc54
+	grub_uint8_t  hashvalue[20];
b9efc54
+} GRUB_PACKED EventOutgoing;
b9efc54
+
b9efc54
+grub_err_t
b9efc54
+grub_tpm_log_event(unsigned char *buf, grub_size_t size, grub_uint8_t pcr,
b9efc54
+		   const char *description)
b9efc54
+{
b9efc54
+	struct grub_bios_int_registers regs;
b9efc54
+	EventIncoming incoming;
b9efc54
+	EventOutgoing outgoing;
b9efc54
+	Event *event;
b9efc54
+	grub_uint32_t datalength;
b9efc54
+
b9efc54
+	if (!tpm_present())
b9efc54
+		return 0;
b9efc54
+
b9efc54
+	datalength = grub_strlen(description);
b9efc54
+	event = grub_zalloc(datalength + sizeof(Event));
b9efc54
+	if (!event)
b9efc54
+		return grub_error (GRUB_ERR_OUT_OF_MEMORY,
b9efc54
+				   N_("cannot allocate TPM event buffer"));
b9efc54
+
b9efc54
+	event->pcrindex = pcr;
b9efc54
+	event->eventtype = 0x0d;
b9efc54
+	event->eventdatasize = grub_strlen(description);
b9efc54
+	grub_memcpy(event->event, description, datalength);
b9efc54
+
b9efc54
+	incoming.ipblength = sizeof(incoming);
b9efc54
+	incoming.hashdataptr = (grub_uint32_t)buf;
b9efc54
+	incoming.hashdatalen = size;
b9efc54
+	incoming.pcr = pcr;
b9efc54
+	incoming.logdataptr = (grub_uint32_t)event;
b9efc54
+	incoming.logdatalen = datalength + sizeof(Event);
b9efc54
+
b9efc54
+	regs.flags = GRUB_CPU_INT_FLAGS_DEFAULT;
b9efc54
+	regs.eax = 0xbb01;
b9efc54
+	regs.ebx = TCPA_MAGIC;
b9efc54
+	regs.ecx = 0;
b9efc54
+	regs.edx = 0;
b9efc54
+	regs.es = (((grub_addr_t) &incoming) & 0xffff0000) >> 4;
b9efc54
+	regs.edi = ((grub_addr_t) &incoming) & 0xffff;
b9efc54
+	regs.ds = (((grub_addr_t) &outgoing) & 0xffff0000) >> 4;
b9efc54
+	regs.esi = ((grub_addr_t) &outgoing) & 0xffff;
b9efc54
+
b9efc54
+	grub_bios_interrupt (0x1a, ®s;;
b9efc54
+
b9efc54
+	grub_free(event);
b9efc54
+
b9efc54
+	if (regs.eax)
b9efc54
+		return grub_error (GRUB_ERR_IO, N_("TPM error %x\n"), regs.eax);
b9efc54
+
b9efc54
+	return 0;
b9efc54
+}
b9efc54
diff --git a/grub-core/kern/tpm.c b/grub-core/kern/tpm.c
b9efc54
new file mode 100644
b9efc54
index 0000000..1a99187
b9efc54
--- /dev/null
b9efc54
+++ b/grub-core/kern/tpm.c
b9efc54
@@ -0,0 +1,13 @@
b9efc54
+#include <grub/err.h>
b9efc54
+#include <grub/i18n.h>
b9efc54
+#include <grub/misc.h>
b9efc54
+#include <grub/mm.h>
b9efc54
+#include <grub/tpm.h>
b9efc54
+#include <grub/term.h>
b9efc54
+
b9efc54
+grub_err_t
b9efc54
+grub_tpm_measure (unsigned char *buf, grub_size_t size, grub_uint8_t pcr,
b9efc54
+		  const char *description)
b9efc54
+{
b9efc54
+  return grub_tpm_log_event(buf, size, pcr, description);
b9efc54
+}
b9efc54
diff --git a/include/grub/efi/tpm.h b/include/grub/efi/tpm.h
b9efc54
new file mode 100644
b9efc54
index 0000000..e2aff4a
b9efc54
--- /dev/null
b9efc54
+++ b/include/grub/efi/tpm.h
b9efc54
@@ -0,0 +1,153 @@
b9efc54
+/*
b9efc54
+ *  GRUB  --  GRand Unified Bootloader
b9efc54
+ *  Copyright (C) 2015  Free Software Foundation, Inc.
b9efc54
+ *
b9efc54
+ *  GRUB is free software: you can redistribute it and/or modify
b9efc54
+ *  it under the terms of the GNU General Public License as published by
b9efc54
+ *  the Free Software Foundation, either version 3 of the License, or
b9efc54
+ *  (at your option) any later version.
b9efc54
+ *
b9efc54
+ *  GRUB is distributed in the hope that it will be useful,
b9efc54
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
b9efc54
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
b9efc54
+ *  GNU General Public License for more details.
b9efc54
+ *
b9efc54
+ *  You should have received a copy of the GNU General Public License
b9efc54
+ *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
b9efc54
+ */
b9efc54
+
b9efc54
+#ifndef GRUB_EFI_TPM_HEADER
b9efc54
+#define GRUB_EFI_TPM_HEADER 1
b9efc54
+
b9efc54
+#define EFI_TPM_GUID {0xf541796d, 0xa62e, 0x4954, {0xa7, 0x75, 0x95, 0x84, 0xf6, 0x1b, 0x9c, 0xdd }};
b9efc54
+#define EFI_TPM2_GUID {0x607f766c, 0x7455, 0x42be, {0x93, 0x0b, 0xe4, 0xd7, 0x6d, 0xb2, 0x72, 0x0f }};
b9efc54
+
b9efc54
+typedef struct {
b9efc54
+  grub_efi_uint8_t Major;
b9efc54
+  grub_efi_uint8_t Minor;
b9efc54
+  grub_efi_uint8_t RevMajor;
b9efc54
+  grub_efi_uint8_t RevMinor;
b9efc54
+} TCG_VERSION;
b9efc54
+
b9efc54
+typedef struct _TCG_EFI_BOOT_SERVICE_CAPABILITY {
b9efc54
+  grub_efi_uint8_t          Size;                /// Size of this structure.
b9efc54
+  TCG_VERSION    StructureVersion;
b9efc54
+  TCG_VERSION    ProtocolSpecVersion;
b9efc54
+  grub_efi_uint8_t          HashAlgorithmBitmap; /// Hash algorithms .
b9efc54
+  char        TPMPresentFlag;      /// 00h = TPM not present.
b9efc54
+  char        TPMDeactivatedFlag;  /// 01h = TPM currently deactivated.
b9efc54
+} TCG_EFI_BOOT_SERVICE_CAPABILITY;
b9efc54
+
b9efc54
+typedef struct {
b9efc54
+  grub_efi_uint32_t PCRIndex;
b9efc54
+  grub_efi_uint32_t EventType;
b9efc54
+  grub_efi_uint8_t digest[20];
b9efc54
+  grub_efi_uint32_t EventSize;
b9efc54
+  grub_efi_uint8_t  Event[1];
b9efc54
+} TCG_PCR_EVENT;
b9efc54
+
b9efc54
+struct grub_efi_tpm_protocol
b9efc54
+{
b9efc54
+  grub_efi_status_t (*status_check) (struct grub_efi_tpm_protocol *this,
b9efc54
+				     TCG_EFI_BOOT_SERVICE_CAPABILITY *ProtocolCapability,
b9efc54
+				     grub_efi_uint32_t *TCGFeatureFlags,
b9efc54
+				     grub_efi_physical_address_t *EventLogLocation,
b9efc54
+				     grub_efi_physical_address_t *EventLogLastEntry);
b9efc54
+  grub_efi_status_t (*hash_all) (struct grub_efi_tpm_protocol *this,
b9efc54
+				 grub_efi_uint8_t *HashData,
b9efc54
+				 grub_efi_uint64_t HashLen,
b9efc54
+				 grub_efi_uint32_t AlgorithmId,
b9efc54
+				 grub_efi_uint64_t *HashedDataLen,
b9efc54
+				 grub_efi_uint8_t **HashedDataResult);
b9efc54
+  grub_efi_status_t (*log_event) (struct grub_efi_tpm_protocol *this,
b9efc54
+				  TCG_PCR_EVENT *TCGLogData,
b9efc54
+				  grub_efi_uint32_t *EventNumber,
b9efc54
+				  grub_efi_uint32_t Flags);
b9efc54
+  grub_efi_status_t (*pass_through_to_tpm) (struct grub_efi_tpm_protocol *this,
b9efc54
+					    grub_efi_uint32_t TpmInputParameterBlockSize,
b9efc54
+					    grub_efi_uint8_t *TpmInputParameterBlock,
b9efc54
+					    grub_efi_uint32_t TpmOutputParameterBlockSize,
b9efc54
+					    grub_efi_uint8_t *TpmOutputParameterBlock);
b9efc54
+  grub_efi_status_t (*log_extend_event) (struct grub_efi_tpm_protocol *this,
b9efc54
+					 grub_efi_physical_address_t HashData,
b9efc54
+					 grub_efi_uint64_t HashDataLen,
b9efc54
+					 grub_efi_uint32_t AlgorithmId,
b9efc54
+					 TCG_PCR_EVENT *TCGLogData,
b9efc54
+					 grub_efi_uint32_t *EventNumber,
b9efc54
+					 grub_efi_physical_address_t *EventLogLastEntry);
b9efc54
+};
b9efc54
+
b9efc54
+typedef struct grub_efi_tpm_protocol grub_efi_tpm_protocol_t;
b9efc54
+
b9efc54
+typedef grub_efi_uint32_t EFI_TCG2_EVENT_LOG_BITMAP;
b9efc54
+typedef grub_efi_uint32_t EFI_TCG2_EVENT_LOG_FORMAT;
b9efc54
+typedef grub_efi_uint32_t EFI_TCG2_EVENT_ALGORITHM_BITMAP;
b9efc54
+
b9efc54
+typedef struct tdEFI_TCG2_VERSION {
b9efc54
+  grub_efi_uint8_t Major;
b9efc54
+  grub_efi_uint8_t Minor;
b9efc54
+} GRUB_PACKED EFI_TCG2_VERSION;
b9efc54
+
b9efc54
+typedef struct tdEFI_TCG2_BOOT_SERVICE_CAPABILITY {
b9efc54
+  grub_efi_uint8_t Size;
b9efc54
+  EFI_TCG2_VERSION StructureVersion;
b9efc54
+  EFI_TCG2_VERSION ProtocolVersion;
b9efc54
+  EFI_TCG2_EVENT_ALGORITHM_BITMAP HashAlgorithmBitmap;
b9efc54
+  EFI_TCG2_EVENT_LOG_BITMAP SupportedEventLogs;
b9efc54
+  grub_efi_boolean_t TPMPresentFlag;
b9efc54
+  grub_efi_uint16_t MaxCommandSize;
b9efc54
+  grub_efi_uint16_t MaxResponseSize;
b9efc54
+  grub_efi_uint32_t ManufacturerID;
b9efc54
+  grub_efi_uint32_t NumberOfPcrBanks;
b9efc54
+  EFI_TCG2_EVENT_ALGORITHM_BITMAP ActivePcrBanks;
b9efc54
+} EFI_TCG2_BOOT_SERVICE_CAPABILITY;
b9efc54
+
b9efc54
+typedef grub_efi_uint32_t TCG_PCRINDEX;
b9efc54
+typedef grub_efi_uint32_t TCG_EVENTTYPE;
b9efc54
+
b9efc54
+typedef struct tdEFI_TCG2_EVENT_HEADER {
b9efc54
+  grub_efi_uint32_t HeaderSize;
b9efc54
+  grub_efi_uint16_t HeaderVersion;
b9efc54
+  TCG_PCRINDEX PCRIndex;
b9efc54
+  TCG_EVENTTYPE EventType;
b9efc54
+} GRUB_PACKED EFI_TCG2_EVENT_HEADER;
b9efc54
+
b9efc54
+typedef struct tdEFI_TCG2_EVENT {
b9efc54
+  grub_efi_uint32_t Size;
b9efc54
+  EFI_TCG2_EVENT_HEADER Header;
b9efc54
+  grub_efi_uint8_t Event[1];
b9efc54
+} GRUB_PACKED EFI_TCG2_EVENT;
b9efc54
+
b9efc54
+struct grub_efi_tpm2_protocol
b9efc54
+{
b9efc54
+  grub_efi_status_t (*get_capability) (struct grub_efi_tpm2_protocol *this,
b9efc54
+				       EFI_TCG2_BOOT_SERVICE_CAPABILITY *ProtocolCapability);
b9efc54
+  grub_efi_status_t (*get_event_log) (struct grub_efi_tpm2_protocol *this,
b9efc54
+				      EFI_TCG2_EVENT_LOG_FORMAT EventLogFormat,
b9efc54
+				      grub_efi_physical_address_t *EventLogLocation,
b9efc54
+				      grub_efi_physical_address_t *EventLogLastEntry,
b9efc54
+				      grub_efi_boolean_t *EventLogTruncated);
b9efc54
+  grub_efi_status_t (*hash_log_extend_event) (struct grub_efi_tpm2_protocol *this,
b9efc54
+					      grub_efi_uint64_t Flags,
b9efc54
+					      grub_efi_physical_address_t *DataToHash,
b9efc54
+					      grub_efi_uint64_t DataToHashLen,
b9efc54
+					      EFI_TCG2_EVENT *EfiTcgEvent);
b9efc54
+  grub_efi_status_t (*submit_command) (struct grub_efi_tpm2_protocol *this,
b9efc54
+				       grub_efi_uint32_t InputParameterBlockSize,
b9efc54
+				       grub_efi_uint8_t *InputParameterBlock,
b9efc54
+				       grub_efi_uint32_t OutputParameterBlockSize,
b9efc54
+				       grub_efi_uint8_t *OutputParameterBlock);
b9efc54
+  grub_efi_status_t (*get_active_pcr_blanks) (struct grub_efi_tpm2_protocol *this,
b9efc54
+					      grub_efi_uint32_t *ActivePcrBanks);
b9efc54
+  grub_efi_status_t (*set_active_pcr_banks) (struct grub_efi_tpm2_protocol *this,
b9efc54
+					     grub_efi_uint32_t ActivePcrBanks);
b9efc54
+  grub_efi_status_t (*get_result_of_set_active_pcr_banks) (struct grub_efi_tpm2_protocol *this,
b9efc54
+							   grub_efi_uint32_t *OperationPresent,
b9efc54
+							   grub_efi_uint32_t *Response);
b9efc54
+};
b9efc54
+
b9efc54
+typedef struct grub_efi_tpm2_protocol grub_efi_tpm2_protocol_t;
b9efc54
+
b9efc54
+#define TCG_ALG_SHA 0x00000004
b9efc54
+
b9efc54
+#endif
b9efc54
diff --git a/include/grub/tpm.h b/include/grub/tpm.h
b9efc54
new file mode 100644
b9efc54
index 0000000..40d3cf6
b9efc54
--- /dev/null
b9efc54
+++ b/include/grub/tpm.h
b9efc54
@@ -0,0 +1,91 @@
b9efc54
+/*
b9efc54
+ *  GRUB  --  GRand Unified Bootloader
b9efc54
+ *  Copyright (C) 2015  Free Software Foundation, Inc.
b9efc54
+ *
b9efc54
+ *  GRUB is free software: you can redistribute it and/or modify
b9efc54
+ *  it under the terms of the GNU General Public License as published by
b9efc54
+ *  the Free Software Foundation, either version 3 of the License, or
b9efc54
+ *  (at your option) any later version.
b9efc54
+ *
b9efc54
+ *  GRUB is distributed in the hope that it will be useful,
b9efc54
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
b9efc54
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
b9efc54
+ *  GNU General Public License for more details.
b9efc54
+ *
b9efc54
+ *  You should have received a copy of the GNU General Public License
b9efc54
+ *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
b9efc54
+ */
b9efc54
+
b9efc54
+#ifndef GRUB_TPM_HEADER
b9efc54
+#define GRUB_TPM_HEADER 1
b9efc54
+
b9efc54
+#define SHA1_DIGEST_SIZE 20
b9efc54
+
b9efc54
+#define TPM_BASE 0x0
b9efc54
+#define TPM_SUCCESS TPM_BASE
b9efc54
+#define TPM_AUTHFAIL (TPM_BASE + 0x1)
b9efc54
+#define TPM_BADINDEX (TPM_BASE + 0x2)
b9efc54
+
b9efc54
+#define GRUB_TPM_PCR 9
b9efc54
+#define GRUB_KERNEL_PCR 10
b9efc54
+#define GRUB_INITRD_PCR 11
b9efc54
+#define GRUB_CMDLINE_PCR 12
b9efc54
+
b9efc54
+#define TPM_TAG_RQU_COMMAND 0x00C1
b9efc54
+#define TPM_ORD_Extend 0x14
b9efc54
+
b9efc54
+#define EV_IPL 0x0d
b9efc54
+
b9efc54
+/* TCG_PassThroughToTPM Input Parameter Block */
b9efc54
+typedef struct {
b9efc54
+        grub_uint16_t IPBLength;
b9efc54
+        grub_uint16_t Reserved1;
b9efc54
+        grub_uint16_t OPBLength;
b9efc54
+        grub_uint16_t Reserved2;
b9efc54
+        grub_uint8_t TPMOperandIn[1];
b9efc54
+} GRUB_PACKED PassThroughToTPM_InputParamBlock;
b9efc54
+
b9efc54
+/* TCG_PassThroughToTPM Output Parameter Block */
b9efc54
+typedef struct {
b9efc54
+        grub_uint16_t OPBLength;
b9efc54
+        grub_uint16_t Reserved;
b9efc54
+        grub_uint8_t TPMOperandOut[1];
b9efc54
+} GRUB_PACKED PassThroughToTPM_OutputParamBlock;
b9efc54
+
b9efc54
+typedef struct {
b9efc54
+        grub_uint16_t tag;
b9efc54
+        grub_uint32_t paramSize;
b9efc54
+        grub_uint32_t ordinal;
b9efc54
+        grub_uint32_t pcrNum;
b9efc54
+        grub_uint8_t inDigest[SHA1_DIGEST_SIZE];                /* The 160 bit value representing the event to be recorded. */
b9efc54
+} GRUB_PACKED ExtendIncoming;
b9efc54
+
b9efc54
+/* TPM_Extend Outgoing Operand */
b9efc54
+typedef struct {
b9efc54
+        grub_uint16_t tag;
b9efc54
+        grub_uint32_t paramSize;
b9efc54
+        grub_uint32_t returnCode;
b9efc54
+        grub_uint8_t outDigest[SHA1_DIGEST_SIZE];               /* The PCR value after execution of the command. */
b9efc54
+} GRUB_PACKED ExtendOutgoing;
b9efc54
+
b9efc54
+grub_err_t EXPORT_FUNC(grub_tpm_measure) (unsigned char *buf, grub_size_t size,
b9efc54
+					  grub_uint8_t pcr,
b9efc54
+					  const char *description);
b9efc54
+#if defined (GRUB_MACHINE_EFI) || defined (GRUB_MACHINE_PCBIOS)
b9efc54
+grub_err_t grub_tpm_execute(PassThroughToTPM_InputParamBlock *inbuf,
b9efc54
+			    PassThroughToTPM_OutputParamBlock *outbuf);
b9efc54
+grub_err_t grub_tpm_log_event(unsigned char *buf, grub_size_t size,
b9efc54
+			      grub_uint8_t pcr, const char *description);
b9efc54
+#else
b9efc54
+static inline grub_err_t grub_tpm_execute(PassThroughToTPM_InputParamBlock *inbuf,
b9efc54
+					  PassThroughToTPM_OutputParamBlock *outbuf) { return 0; };
b9efc54
+static inline grub_err_t grub_tpm_log_event(unsigned char *buf,
b9efc54
+					    grub_size_t size,
b9efc54
+					    grub_uint8_t pcr,
b9efc54
+					    const char *description)
b9efc54
+{
b9efc54
+	return 0;
b9efc54
+};
b9efc54
+#endif
b9efc54
+
b9efc54
+#endif
b9efc54
-- 
b9efc54
2.5.0
b9efc54