tss2: Add TPM2 Software Stack (TSS2) support
A Trusted Platform Module (TPM) Software Stack (TSS) provides logic to compose and submit TPM commands and parse responses. A limited number of TPM commands may be accessed via the EFI TCG2 protocol. This protocol exposes functionality that is primarily geared toward TPM usage within the context of Secure Boot. For all other TPM commands, however, such as sealing and unsealing, this protocol does not provide any help, with the exception of passthrough command submission. The SubmitCommand method allows a caller to send raw commands to the system's TPM and to receive the corresponding response. These command/response pairs are formatted using the TPM wire protocol. To construct commands in this way, and to parse the TPM's response, it is necessary to, first, possess knowledge of the various TPM structures, and, second, of the TPM wire protocol itself. As such, this patch includes implementations of various grub_tpm2_* functions (inventoried below), and logic to write and read command and response buffers, respectively, using the TPM wire protocol. Functions: - grub_tpm2_create(), - grub_tpm2_createprimary(), - grub_tpm2_evictcontrol(), - grub_tpm2_flushcontext(), - grub_tpm2_load(), - grub_tpm2_pcr_read(), - grub_tpm2_policygetdigest(), - grub_tpm2_policypcr(), - grub_tpm2_readpublic(), - grub_tpm2_startauthsession(), - grub_tpm2_unseal(), - grub_tpm2_loadexternal(), - grub_tpm2_hash(), - grub_tpm2_verifysignature(), - grub_tpm2_policyauthorize(), - grub_tpm2_testparms(). Signed-off-by: Hernan Gatta <hegatta@linux.microsoft.com> Signed-off-by: Gary Lin <glin@suse.com> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Tested-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Gary Lin
Daniel Kiper
parent
63a78f4b4d
commit
35c9904df4
@ -2567,6 +2567,17 @@ module = {
|
||||
enable = efi;
|
||||
};
|
||||
|
||||
module = {
|
||||
name = tss2;
|
||||
common = lib/tss2/buffer.c;
|
||||
common = lib/tss2/tss2_mu.c;
|
||||
common = lib/tss2/tpm2_cmd.c;
|
||||
common = lib/tss2/tss2.c;
|
||||
efi = lib/efi/tcg2.c;
|
||||
enable = efi;
|
||||
cppflags = '-I$(srcdir)/lib/tss2';
|
||||
};
|
||||
|
||||
module = {
|
||||
name = tr;
|
||||
common = commands/tr.c;
|
||||
|
||||
143
grub-core/lib/efi/tcg2.c
Normal file
143
grub-core/lib/efi/tcg2.c
Normal file
@ -0,0 +1,143 @@
|
||||
/*
|
||||
* GRUB -- GRand Unified Bootloader
|
||||
* Copyright (C) 2022 Microsoft Corporation
|
||||
* Copyright (C) 2024 Free Software Foundation, Inc.
|
||||
*
|
||||
* GRUB is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* GRUB is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with GRUB. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#include <grub/efi/api.h>
|
||||
#include <grub/efi/efi.h>
|
||||
#include <grub/efi/tpm.h>
|
||||
#include <grub/mm.h>
|
||||
|
||||
#include <tcg2.h>
|
||||
|
||||
static grub_err_t
|
||||
tcg2_get_caps (grub_efi_tpm2_protocol_t *protocol, int *tpm2, grub_size_t *max_output_size)
|
||||
{
|
||||
grub_efi_status_t status;
|
||||
static bool has_caps = 0;
|
||||
static EFI_TCG2_BOOT_SERVICE_CAPABILITY caps =
|
||||
{
|
||||
.Size = (grub_uint8_t) sizeof (caps)
|
||||
};
|
||||
|
||||
if (has_caps)
|
||||
goto exit;
|
||||
|
||||
status = protocol->get_capability (protocol, &caps);
|
||||
if (status != GRUB_EFI_SUCCESS || !caps.TPMPresentFlag)
|
||||
return GRUB_ERR_FILE_NOT_FOUND;
|
||||
|
||||
has_caps = 1;
|
||||
|
||||
exit:
|
||||
if (tpm2 != NULL)
|
||||
*tpm2 = caps.TPMPresentFlag;
|
||||
if (max_output_size != NULL)
|
||||
*max_output_size = caps.MaxResponseSize;
|
||||
|
||||
return GRUB_ERR_NONE;
|
||||
}
|
||||
|
||||
static grub_err_t
|
||||
tcg2_get_protocol (grub_efi_tpm2_protocol_t **protocol)
|
||||
{
|
||||
static grub_guid_t tpm2_guid = EFI_TPM2_GUID;
|
||||
static grub_efi_tpm2_protocol_t *tpm2_protocol = NULL;
|
||||
int tpm2;
|
||||
grub_efi_handle_t *handles;
|
||||
grub_efi_uintn_t num_handles;
|
||||
grub_efi_handle_t tpm2_handle;
|
||||
grub_err_t err = GRUB_ERR_FILE_NOT_FOUND;
|
||||
|
||||
if (tpm2_protocol != NULL)
|
||||
{
|
||||
*protocol = tpm2_protocol;
|
||||
return GRUB_ERR_NONE;
|
||||
}
|
||||
|
||||
handles = grub_efi_locate_handle (GRUB_EFI_BY_PROTOCOL, &tpm2_guid, NULL,
|
||||
&num_handles);
|
||||
if (handles == NULL || num_handles == 0)
|
||||
return err;
|
||||
|
||||
tpm2_handle = handles[0];
|
||||
|
||||
tpm2_protocol = grub_efi_open_protocol (tpm2_handle, &tpm2_guid,
|
||||
GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL);
|
||||
if (tpm2_protocol == NULL)
|
||||
goto exit;
|
||||
|
||||
err = tcg2_get_caps (tpm2_protocol, &tpm2, NULL);
|
||||
if (err != GRUB_ERR_NONE || tpm2 == 0)
|
||||
goto exit;
|
||||
|
||||
*protocol = tpm2_protocol;
|
||||
err = GRUB_ERR_NONE;
|
||||
|
||||
exit:
|
||||
grub_free (handles);
|
||||
return err;
|
||||
}
|
||||
|
||||
grub_err_t
|
||||
grub_tcg2_get_max_output_size (grub_size_t *size)
|
||||
{
|
||||
grub_err_t err;
|
||||
grub_size_t max;
|
||||
grub_efi_tpm2_protocol_t *protocol;
|
||||
|
||||
if (size == NULL)
|
||||
return GRUB_ERR_BAD_ARGUMENT;
|
||||
|
||||
err = tcg2_get_protocol (&protocol);
|
||||
if (err != GRUB_ERR_NONE)
|
||||
return err;
|
||||
|
||||
err = tcg2_get_caps (protocol, NULL, &max);
|
||||
if (err != GRUB_ERR_NONE)
|
||||
return err;
|
||||
|
||||
*size = max;
|
||||
|
||||
return GRUB_ERR_NONE;
|
||||
}
|
||||
|
||||
grub_err_t
|
||||
grub_tcg2_submit_command (grub_size_t input_size,
|
||||
grub_uint8_t *input,
|
||||
grub_size_t output_size,
|
||||
grub_uint8_t *output)
|
||||
{
|
||||
grub_err_t err;
|
||||
grub_efi_status_t status;
|
||||
grub_efi_tpm2_protocol_t *protocol;
|
||||
|
||||
if (input_size == 0 || input == NULL ||
|
||||
output_size == 0 || output == NULL)
|
||||
return GRUB_ERR_BAD_ARGUMENT;
|
||||
|
||||
err = tcg2_get_protocol (&protocol);
|
||||
if (err != GRUB_ERR_NONE)
|
||||
return err;
|
||||
|
||||
status = protocol->submit_command (protocol, input_size, input,
|
||||
output_size, output);
|
||||
if (status != GRUB_EFI_SUCCESS)
|
||||
return GRUB_ERR_INVALID_COMMAND;
|
||||
|
||||
return GRUB_ERR_NONE;
|
||||
}
|
||||
35
grub-core/lib/tss2/tcg2.h
Normal file
35
grub-core/lib/tss2/tcg2.h
Normal file
@ -0,0 +1,35 @@
|
||||
/*
|
||||
* GRUB -- GRand Unified Bootloader
|
||||
* Copyright (C) 2022 Microsoft Corporation
|
||||
* Copyright (C) 2024 Free Software Foundation, Inc.
|
||||
*
|
||||
* GRUB is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* GRUB is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with GRUB. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#ifndef GRUB_TPM2_TCG2_HEADER
|
||||
#define GRUB_TPM2_TCG2_HEADER 1
|
||||
|
||||
#include <grub/err.h>
|
||||
#include <grub/types.h>
|
||||
|
||||
extern grub_err_t
|
||||
grub_tcg2_get_max_output_size (grub_size_t *size);
|
||||
|
||||
extern grub_err_t
|
||||
grub_tcg2_submit_command (grub_size_t input_size,
|
||||
grub_uint8_t *input,
|
||||
grub_size_t output_size,
|
||||
grub_uint8_t *output);
|
||||
|
||||
#endif /* ! GRUB_TPM2_TCG2_HEADER */
|
||||
1043
grub-core/lib/tss2/tpm2_cmd.c
Normal file
1043
grub-core/lib/tss2/tpm2_cmd.c
Normal file
File diff suppressed because it is too large
Load Diff
157
grub-core/lib/tss2/tpm2_cmd.h
Normal file
157
grub-core/lib/tss2/tpm2_cmd.h
Normal file
@ -0,0 +1,157 @@
|
||||
/*
|
||||
* GRUB -- GRand Unified Bootloader
|
||||
* Copyright (C) 2022 Microsoft Corporation
|
||||
* Copyright (C) 2024 Free Software Foundation, Inc.
|
||||
*
|
||||
* GRUB is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* GRUB is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with GRUB. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#ifndef GRUB_TPM2_COMMANDS_HEADER
|
||||
#define GRUB_TPM2_COMMANDS_HEADER 1
|
||||
|
||||
#include <tss2_structs.h>
|
||||
|
||||
extern TPM_RC_t
|
||||
grub_tpm2_createprimary (const TPMI_RH_HIERARCHY_t primaryHandle,
|
||||
const TPMS_AUTH_COMMAND_t *authCommand,
|
||||
const TPM2B_SENSITIVE_CREATE_t *inSensitive,
|
||||
const TPM2B_PUBLIC_t *inPublic,
|
||||
const TPM2B_DATA_t *outsideInfo,
|
||||
const TPML_PCR_SELECTION_t *creationPCR,
|
||||
TPM_HANDLE_t *objectHandle,
|
||||
TPM2B_PUBLIC_t *outPublic,
|
||||
TPM2B_CREATION_DATA_t *creationData,
|
||||
TPM2B_DIGEST_t *creationHash,
|
||||
TPMT_TK_CREATION_t *creationTicket,
|
||||
TPM2B_NAME_t *name,
|
||||
TPMS_AUTH_RESPONSE_t *authResponse);
|
||||
|
||||
extern TPM_RC_t
|
||||
grub_tpm2_startauthsession (const TPMI_DH_OBJECT_t tpmKey,
|
||||
const TPMI_DH_ENTITY_t bind,
|
||||
const TPMS_AUTH_COMMAND_t *authCommand,
|
||||
const TPM2B_NONCE_t *nonceCaller,
|
||||
const TPM2B_ENCRYPTED_SECRET_t *encryptedSalt,
|
||||
const TPM_SE_t sessionType,
|
||||
const TPMT_SYM_DEF_t *symmetric,
|
||||
const TPMI_ALG_HASH_t authHash,
|
||||
TPMI_SH_AUTH_SESSION_t *sessionHandle,
|
||||
TPM2B_NONCE_t *nonceTpm,
|
||||
TPMS_AUTH_RESPONSE_t *authResponse);
|
||||
|
||||
extern TPM_RC_t
|
||||
grub_tpm2_policypcr (const TPMI_SH_POLICY_t policySession,
|
||||
const TPMS_AUTH_COMMAND_t *authCommand,
|
||||
const TPM2B_DIGEST_t *pcrDigest,
|
||||
const TPML_PCR_SELECTION_t *pcrs,
|
||||
TPMS_AUTH_RESPONSE_t *authResponse);
|
||||
|
||||
extern TPM_RC_t
|
||||
grub_tpm2_readpublic (const TPMI_DH_OBJECT_t objectHandle,
|
||||
const TPMS_AUTH_COMMAND_t *authCommand,
|
||||
TPM2B_PUBLIC_t *outPublic);
|
||||
|
||||
extern TPM_RC_t
|
||||
grub_tpm2_load (const TPMI_DH_OBJECT_t parent_handle,
|
||||
const TPMS_AUTH_COMMAND_t *authCommand,
|
||||
const TPM2B_PRIVATE_t *inPrivate,
|
||||
const TPM2B_PUBLIC_t *inPublic,
|
||||
TPM_HANDLE_t *objectHandle,
|
||||
TPM2B_NAME_t *name,
|
||||
TPMS_AUTH_RESPONSE_t *authResponse);
|
||||
|
||||
extern TPM_RC_t
|
||||
grub_tpm2_loadexternal (const TPMS_AUTH_COMMAND_t *authCommand,
|
||||
const TPM2B_SENSITIVE_t *inPrivate,
|
||||
const TPM2B_PUBLIC_t *inPublic,
|
||||
const TPMI_RH_HIERARCHY_t hierarchy,
|
||||
TPM_HANDLE_t *objectHandle,
|
||||
TPM2B_NAME_t *name,
|
||||
TPMS_AUTH_RESPONSE_t *authResponse);
|
||||
|
||||
extern TPM_RC_t
|
||||
grub_tpm2_unseal (const TPMI_DH_OBJECT_t item_handle,
|
||||
const TPMS_AUTH_COMMAND_t *authCommand,
|
||||
TPM2B_SENSITIVE_DATA_t *outData,
|
||||
TPMS_AUTH_RESPONSE_t *authResponse);
|
||||
|
||||
extern TPM_RC_t
|
||||
grub_tpm2_flushcontext (const TPMI_DH_CONTEXT_t handle);
|
||||
|
||||
extern TPM_RC_t
|
||||
grub_tpm2_pcr_read (const TPMS_AUTH_COMMAND_t *authCommand,
|
||||
const TPML_PCR_SELECTION_t *pcrSelectionIn,
|
||||
grub_uint32_t *pcrUpdateCounter,
|
||||
TPML_PCR_SELECTION_t *pcrSelectionOut,
|
||||
TPML_DIGEST_t *pcrValues,
|
||||
TPMS_AUTH_RESPONSE_t *authResponse);
|
||||
|
||||
extern TPM_RC_t
|
||||
grub_tpm2_policygetdigest (const TPMI_SH_POLICY_t policySession,
|
||||
const TPMS_AUTH_COMMAND_t *authCommand,
|
||||
TPM2B_DIGEST_t *policyDigest,
|
||||
TPMS_AUTH_RESPONSE_t *authResponse);
|
||||
|
||||
extern TPM_RC_t
|
||||
grub_tpm2_create (const TPMI_DH_OBJECT_t parentHandle,
|
||||
const TPMS_AUTH_COMMAND_t *authCommand,
|
||||
const TPM2B_SENSITIVE_CREATE_t *inSensitive,
|
||||
const TPM2B_PUBLIC_t *inPublic,
|
||||
const TPM2B_DATA_t *outsideInfo,
|
||||
const TPML_PCR_SELECTION_t *creationPCR,
|
||||
TPM2B_PRIVATE_t *outPrivate,
|
||||
TPM2B_PUBLIC_t *outPublic,
|
||||
TPM2B_CREATION_DATA_t *creationData,
|
||||
TPM2B_DIGEST_t *creationHash,
|
||||
TPMT_TK_CREATION_t *creationTicket,
|
||||
TPMS_AUTH_RESPONSE_t *authResponse);
|
||||
|
||||
extern TPM_RC_t
|
||||
grub_tpm2_evictcontrol (const TPMI_RH_PROVISION_t auth,
|
||||
const TPMI_DH_OBJECT_t objectHandle,
|
||||
const TPMS_AUTH_COMMAND_t *authCommand,
|
||||
const TPMI_DH_PERSISTENT_t persistentHandle,
|
||||
TPMS_AUTH_RESPONSE_t *authResponse);
|
||||
|
||||
extern TPM_RC_t
|
||||
grub_tpm2_hash (const TPMS_AUTH_COMMAND_t *authCommand,
|
||||
const TPM2B_MAX_BUFFER_t *data,
|
||||
const TPMI_ALG_HASH_t hashAlg,
|
||||
const TPMI_RH_HIERARCHY_t hierarchy,
|
||||
TPM2B_DIGEST_t *outHash,
|
||||
TPMT_TK_HASHCHECK_t *validation,
|
||||
TPMS_AUTH_RESPONSE_t *authResponse);
|
||||
|
||||
extern TPM_RC_t
|
||||
grub_tpm2_verifysignature (const TPMI_DH_OBJECT_t keyHandle,
|
||||
const TPMS_AUTH_COMMAND_t *authCommand,
|
||||
const TPM2B_DIGEST_t *digest,
|
||||
const TPMT_SIGNATURE_t *signature,
|
||||
TPMT_TK_VERIFIED_t *validation,
|
||||
TPMS_AUTH_RESPONSE_t *authResponse);
|
||||
|
||||
extern TPM_RC_t
|
||||
grub_tpm2_policyauthorize (const TPMI_SH_POLICY_t policySession,
|
||||
const TPMS_AUTH_COMMAND_t *authCommand,
|
||||
const TPM2B_DIGEST_t *approvedPolicy,
|
||||
const TPM2B_NONCE_t *policyRef,
|
||||
const TPM2B_NAME_t *keySign,
|
||||
const TPMT_TK_VERIFIED_t *checkTicket,
|
||||
TPMS_AUTH_RESPONSE_t *authResponse);
|
||||
|
||||
extern TPM_RC_t
|
||||
grub_tpm2_testparms (const TPMT_PUBLIC_PARMS_t *parms,
|
||||
const TPMS_AUTH_COMMAND_t *authCommand);
|
||||
|
||||
#endif /* ! GRUB_TPM2_COMMANDS_HEADER */
|
||||
21
grub-core/lib/tss2/tss2.c
Normal file
21
grub-core/lib/tss2/tss2.c
Normal file
@ -0,0 +1,21 @@
|
||||
/*
|
||||
* GRUB -- GRand Unified Bootloader
|
||||
* Copyright (C) 2024 Free Software Foundation, Inc.
|
||||
*
|
||||
* GRUB is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* GRUB is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with GRUB. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#include <grub/dl.h>
|
||||
|
||||
GRUB_MOD_LICENSE ("GPLv3+");
|
||||
Loading…
x
Reference in New Issue
Block a user