From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2359EC04FF3 for ; Mon, 24 May 2021 12:54:12 +0000 (UTC) Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 69637613AD for ; Mon, 24 May 2021 12:54:11 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 69637613AD Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 0659C82EAC; Mon, 24 May 2021 14:54:06 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="C4XCUILQ"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 4583782EA6; Mon, 24 May 2021 14:54:02 +0200 (CEST) Received: from mail-ej1-x62a.google.com (mail-ej1-x62a.google.com [IPv6:2a00:1450:4864:20::62a]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 7416782E95 for ; Mon, 24 May 2021 14:53:57 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ej1-x62a.google.com with SMTP id s22so41419717ejv.12 for ; Mon, 24 May 2021 05:53:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=UE/liRY3VFaCo4BsA53Qa44ueC6XipPS4KK2zbgbjLQ=; b=C4XCUILQmvvCPf69149lFgDsD0Y9CXIKK4RjPJNrAa+gBxFKD3u09qo/RpSFfpoxJi IYg3Cm5eL4tbZVsckeHhMUqxbiDFHBWv6gY/nQKZopLYcFqluVSe+qtho1NtDUyaXHyT 2R5dqouhhTk1dzPs4IBjh9X39bu9NY8ylKRqu3x6SIOOU2GRFCtFOYZ2aC1MfVMBmJNQ pQhGAX+P3D8c1PBJsC9YPj8Kv2PgavolKEbLnOnPd8o96qYk2KhtzCuyqSp6VCm8RLBk 3gFS0QsXJq8TLg9aID6Sl3jSEMNcYd8JrF4XeEHp13r+sDAepwT1OVTs8Eeb6p4+K+Fr 94NQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=UE/liRY3VFaCo4BsA53Qa44ueC6XipPS4KK2zbgbjLQ=; b=pYZ/RYoGY+wLlfHosRtw5ZXsGrOAJRHqOFF428b+DJ4qEzyd9bRK1foTZMdd1LClAF LROZsK6W6OEVSahcK1RYNeg0dFaDDHR9SACE+q5o5/XpR22epAeBParzorLAq3anNZos +bWnzaPZIOgq5JLpdF8K7ByH+gKNNGNbIMB/3MPvAB4HLWng7Fow/UYVY3y9QDZpngj9 Z8RIZuxHryrLa2XwcROcSCVrk8F4emIy4YSQ4h8lgrsEQXwRYsR03PN55KWXhwiBMRg7 /ZZu7pS3tCFNa9jipOoo3eRNRx56oIdDlFuXiYVOTJvvDdjvJSiZoiPtEZt+HYeJZ9GN 5aag== X-Gm-Message-State: AOAM530P4Suz+Z94kVbqpsbjYS9zVqpuoH1ke4feHG6Sphd88ooALzcl Bx9VK402vl1PY0zdv9uIGfD9gA== X-Google-Smtp-Source: ABdhPJxdCfp/m0qUMWzj9gYyrC+OWMwn5FLJaV8O6KYy0/KgCmt3OSfh/Hwpo2y4fPCEB/Ar0KowAQ== X-Received: by 2002:a17:907:2dab:: with SMTP id gt43mr23682270ejc.369.1621860837105; Mon, 24 May 2021 05:53:57 -0700 (PDT) Received: from apalos.home ([94.69.77.156]) by smtp.gmail.com with ESMTPSA id n4sm901285eja.121.2021.05.24.05.53.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 24 May 2021 05:53:56 -0700 (PDT) Date: Mon, 24 May 2021 15:53:54 +0300 From: Ilias Apalodimas To: Masahisa Kojima Cc: Heinrich Schuchardt , Alexander Graf , Simon Glass , Dhananjay Phadke , Takahiro Akashi , Alexandru Gagniuc , u-boot@lists.denx.de Subject: Re: [PATCH v8 3/3] efi_loader: add PE/COFF image measurement Message-ID: References: <20210514005337.5243-1-masahisa.kojima@linaro.org> <20210514005337.5243-4-masahisa.kojima@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20210514005337.5243-4-masahisa.kojima@linaro.org> X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.4 at phobos.denx.de X-Virus-Status: Clean new_efi); > + > bool efi_image_parse(void *efi, size_t len, struct efi_image_regions **regp, > WIN_CERTIFICATE **auth, size_t *auth_len); > > diff --git a/include/efi_tcg2.h b/include/efi_tcg2.h > index 40e241ce31..bcfb98168a 100644 > --- a/include/efi_tcg2.h > +++ b/include/efi_tcg2.h > @@ -9,6 +9,7 @@ > #if !defined _EFI_TCG2_PROTOCOL_H_ > #define _EFI_TCG2_PROTOCOL_H_ > > +#include > #include > > #define EFI_TCG2_PROTOCOL_GUID \ > @@ -53,6 +54,14 @@ struct efi_tcg2_event { > u8 event[]; > } __packed; > > +struct uefi_image_load_event { > + efi_physical_addr_t image_location_in_memory; > + u64 image_length_in_memory; > + u64 image_link_time_address; > + u64 length_of_device_path; > + struct efi_device_path device_path[]; > +}; > + > struct efi_tcg2_boot_service_capability { > u8 size; > struct efi_tcg2_version structure_version; > diff --git a/include/tpm-v2.h b/include/tpm-v2.h > index 7de7d6a57d..247b386967 100644 > --- a/include/tpm-v2.h > +++ b/include/tpm-v2.h > @@ -70,6 +70,24 @@ struct udevice; > #define EV_TABLE_OF_DEVICES ((u32)0x0000000B) > #define EV_COMPACT_HASH ((u32)0x0000000C) > > +/* > + * event types, cf. > + * "TCG PC Client Platform Firmware Profile Specification", Family "2.0" > + * rev 1.04, June 3, 2019 > + */ > +#define EV_EFI_EVENT_BASE ((u32)0x80000000) > +#define EV_EFI_VARIABLE_DRIVER_CONFIG ((u32)0x80000001) > +#define EV_EFI_VARIABLE_BOOT ((u32)0x80000002) > +#define EV_EFI_BOOT_SERVICES_APPLICATION ((u32)0x80000003) > +#define EV_EFI_BOOT_SERVICES_DRIVER ((u32)0x80000004) > +#define EV_EFI_RUNTIME_SERVICES_DRIVER ((u32)0x80000005) > +#define EV_EFI_GPT_EVENT ((u32)0x80000006) > +#define EV_EFI_ACTION ((u32)0x80000007) > +#define EV_EFI_PLATFORM_FIRMWARE_BLOB ((u32)0x80000008) > +#define EV_EFI_HANDOFF_TABLES ((u32)0x80000009) > +#define EV_EFI_HCRTM_EVENT ((u32)0x80000010) > +#define EV_EFI_VARIABLE_AUTHORITY ((u32)0x800000E0) > + > /* TPMS_TAGGED_PROPERTY Structure */ > struct tpms_tagged_property { > u32 property; > diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig > index 98845b8ba3..0e6200fa25 100644 > --- a/lib/efi_loader/Kconfig > +++ b/lib/efi_loader/Kconfig > @@ -309,6 +309,7 @@ config EFI_TCG2_PROTOCOL > select SHA512_ALGO > select SHA384 > select SHA512 > + select HASH_CALCULATE > help > Provide a EFI_TCG2_PROTOCOL implementation using the TPM hardware > of the platform. > diff --git a/lib/efi_loader/efi_image_loader.c b/lib/efi_loader/efi_image_loader.c > index fe1ee198e2..f37a85e56e 100644 > --- a/lib/efi_loader/efi_image_loader.c > +++ b/lib/efi_loader/efi_image_loader.c > @@ -302,6 +302,40 @@ static int cmp_pe_section(const void *arg1, const void *arg2) > return 1; > } > > +/** > + * efi_prepare_aligned_image() - prepare 8-byte aligned image > + * @efi: pointer to the EFI binary > + * @efi_size: size of @efi binary > + * @new_efi: pointer to the newly allocated image > + * > + * If @efi is not 8-byte aligned, this function newly allocates > + * the image buffer and updates @efi_size. > + * > + * Return: valid pointer to a image, return NULL if allocation fails. > + */ > +void *efi_prepare_aligned_image(void *efi, u64 *efi_size, void **new_efi) > +{ > + size_t new_efi_size; > + void *p; > + > + /* > + * Size must be 8-byte aligned and the trailing bytes must be > + * zero'ed. Otherwise hash value may be incorrect. > + */ > + if (!IS_ALIGNED(*efi_size, 8)) { > + new_efi_size = ALIGN(*efi_size, 8); > + p = calloc(new_efi_size, 1); > + if (!p) > + return NULL; > + memcpy(p, efi, *efi_size); > + *efi_size = new_efi_size; Do we really need new_efi here? I might be missing some context for the original code, but since we return the new pointer, can't we just use that in the caller? If so the whole void **new_efi is not needed? > + [...] > + ret = __get_active_pcr_banks(&active); > + if (ret != EFI_SUCCESS) { > + ret = EFI_DEVICE_ERROR; __get_active_pcr_banks is supposed to return the correct efi_status_t code. I don't think we need EFI_DEVICE_ERROR here. Thanks! /Ilias