tablet/grub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tss2: Implement grub_tcg2_cap_pcr() for EFI

Browse Source 
This commit implements grub_tcg2_cap_pcr() for EFI by using the UEFI
TCG2 protocol, HashLogExtendEvent, to extend the specified PCR with an
EV_SEPARATOR event and ensure the event will be recorded properly in the
TPM event log.

Signed-off-by: Gary Lin <glin@suse.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Gary Lin 2025-10-03 11:22:04 +08:00 committed by Daniel Kiper
parent d47d261ecd
commit 39f98e4719
1 changed files with 40 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
grub-core/lib/efi/tcg2.c
View File

@ -22,6 +22,7 @@
#include <grub/efi/tpm.h>
#include <grub/mm.h>
#include <tss2_types.h>
#include <tcg2.h>
static grub_err_t
@ -141,3 +142,42 @@ grub_tcg2_submit_command (grub_size_t input_size,
return GRUB_ERR_NONE;
}
grub_err_t
grub_tcg2_cap_pcr (grub_uint8_t pcr)
{
grub_err_t err;
grub_efi_status_t status;
grub_efi_tpm2_protocol_t *protocol;
EFI_TCG2_EVENT *event;
grub_uint8_t separator[4] = {0};
if (pcr >= TPM_MAX_PCRS)
return GRUB_ERR_BAD_ARGUMENT;
err = tcg2_get_protocol (&protocol);
if (err != GRUB_ERR_NONE)
return err;
event = grub_zalloc (sizeof (EFI_TCG2_EVENT) + sizeof (separator));
if (event == NULL)
return grub_error (GRUB_ERR_OUT_OF_MEMORY,
N_("cannot allocate TPM event buffer"));
event->Header.HeaderSize = sizeof (EFI_TCG2_EVENT_HEADER);
event->Header.HeaderVersion = 1;
event->Header.PCRIndex = pcr;
event->Header.EventType = GRUB_EV_SEPARATOR;
event->Size = sizeof (*event) - sizeof (event->Event) + sizeof (separator);
grub_memcpy (event->Event, separator, sizeof (separator));
status = protocol->hash_log_extend_event (protocol, 0,
(grub_addr_t) separator,
sizeof (separator), event);
grub_free (event);
if (status != GRUB_EFI_SUCCESS)
return grub_error (GRUB_ERR_BAD_DEVICE, N_("cannot cap PCR %u"), pcr);
return GRUB_ERR_NONE;
}