/* SPDX-License-Identifier: GPL-2.0-only */ #include <security/vboot/antirollback.h> #include <program_loading.h> #include <vb2_api.h> #include <security/tpm/tss.h> #include <security/vboot/misc.h> #include <security/vboot/mrc_cache_hash_tpm.h> #include <console/console.h> #include <string.h> void mrc_cache_update_hash(uint32_t index, const uint8_t *data, size_t size) { struct vb2_hash hash; tpm_result_t rc = TPM_SUCCESS; /* Initialize TPM driver. */ rc = tlcl_lib_init(); if (rc != TPM_SUCCESS) { printk(BIOS_ERR, "MRC: TPM driver initialization failed with error %#x.\n", rc); return; } /* Calculate hash of data generated by MRC. */ if (vb2_hash_calculate(vboot_hwcrypto_allowed(), data, size, VB2_HASH_SHA256, &hash)) { printk(BIOS_ERR, "MRC: SHA-256 calculation failed for data. " "Not updating TPM hash space.\n"); /* * Since data is being updated in mrc cache, the hash * currently stored in TPM hash space is no longer * valid. If we are not able to calculate hash of the * data being updated, reset all the bits in TPM hash * space to zero to invalidate it. */ memset(hash.raw, 0, VB2_SHA256_DIGEST_SIZE); } /* Write hash of data to TPM space. */ rc = antirollback_write_space_mrc_hash(index, hash.sha256, sizeof(hash.sha256)); if (rc != TPM_SUCCESS) { printk(BIOS_ERR, "MRC: Could not save hash to TPM with error %#x.\n", rc); return; } printk(BIOS_INFO, "MRC: TPM MRC hash idx %#x updated successfully.\n", index); } int mrc_cache_verify_hash(uint32_t index, const uint8_t *data, size_t size) { struct vb2_hash tpm_hash = { .algo = VB2_HASH_SHA256 }; tpm_result_t rc = TPM_SUCCESS; /* Initialize TPM driver. */ rc = tlcl_lib_init(); if (rc != TPM_SUCCESS) { printk(BIOS_ERR, "MRC: TPM driver initialization failed with error %#x.\n", rc); return 0; } /* Read hash of MRC data saved in TPM. */ rc = antirollback_read_space_mrc_hash(index, tpm_hash.sha256, sizeof(tpm_hash.sha256)); if (rc != TPM_SUCCESS) { printk(BIOS_ERR, "MRC: Could not read hash from TPM with error %#x.\n", rc); return 0; } /* Calculate hash of data read from MRC_CACHE and compare. */ if (vb2_hash_verify(vboot_hwcrypto_allowed(), data, size, &tpm_hash)) { printk(BIOS_ERR, "MRC: Hash comparison failed.\n"); return 0; } printk(BIOS_INFO, "MRC: Hash idx %#x comparison successful.\n", index); return 1; }