Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-15-SP1:Update
grub2.9568
0012-tpm-Build-tpm-as-module.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 0012-tpm-Build-tpm-as-module.patch of Package grub2.9568
From 54b6ba5f27dd9eb9ec2f1a41e7160964ab94451c Mon Sep 17 00:00:00 2001 From: Michael Chang <mchang@suse.com> Date: Wed, 23 Nov 2016 16:52:16 +0800 Subject: [PATCH 11/11] Build tpm as module Rather than having tpm as permanent kernel feature that gets enabled and active unconditionally, it's more applicable to have it as external module that can be installed with --suse-enable-tpm option to grub2-install. This can provide some enhancement. First the core image size can be nearly the same when you don't need TPM, as it's controllable option now. Second the TPM device can be tested upon loading the module instead of on every measurement. Third is not to potentially break running system by forcing into the TPM after update, as it's still bleeding edge feature that could have side effect. --- grub-core/Makefile.core.def | 24 +++- grub-core/boot/i386/pc/boot.S | 1 - grub-core/kern/efi/tpm.c | 282 ----------------------------------------- grub-core/kern/i386/pc/tpm.c | 132 -------------------- grub-core/kern/tpm.c | 11 +- grub-core/tpm/efi/tpm.c | 283 ++++++++++++++++++++++++++++++++++++++++++ grub-core/tpm/i386/pc/tpm.c | 144 +++++++++++++++++++++ include/grub/tpm.h | 23 ++-- util/grub-install.c | 16 ++- 9 files changed, 479 insertions(+), 437 deletions(-) delete mode 100644 grub-core/kern/efi/tpm.c delete mode 100644 grub-core/kern/i386/pc/tpm.c create mode 100644 grub-core/tpm/efi/tpm.c create mode 100644 grub-core/tpm/i386/pc/tpm.c Index: grub-2.02~rc1/grub-core/Makefile.core.def =================================================================== --- grub-2.02~rc1.orig/grub-core/Makefile.core.def +++ grub-2.02~rc1/grub-core/Makefile.core.def @@ -174,7 +174,6 @@ kernel = { efi = term/efi/console.c; efi = kern/acpi.c; efi = kern/efi/acpi.c; - efi = kern/efi/tpm.c; i386_coreboot = kern/i386/pc/acpi.c; i386_multiboot = kern/i386/pc/acpi.c; i386_coreboot = kern/acpi.c; @@ -221,7 +220,6 @@ kernel = { i386_pc = kern/i386/pc/init.c; i386_pc = kern/i386/pc/mmap.c; - i386_pc = kern/i386/pc/tpm.c; i386_pc = term/i386/pc/console.c; i386_qemu = bus/pci.c; @@ -395,6 +393,19 @@ image = { }; image = { + name = boot_tpm; + i386_pc = boot/i386/pc/boot.S; + + cppflags = '-DTPM=1'; + + i386_pc_ldflags = '$(TARGET_IMG_LDFLAGS)'; + i386_pc_ldflags = '$(TARGET_IMG_BASE_LDOPT),0x7C00'; + + objcopyflags = '-O binary'; + enable = i386_pc; +}; + +image = { name = cdboot; i386_pc = boot/i386/pc/cdboot.S; @@ -2369,3 +2380,12 @@ module = { common = loader/i386/xen_file64.c; extra_dist = loader/i386/xen_fileXX.c; }; + +module = { + name = tpm; + i386_pc = kern/i386/pc/tpm.c; + efi = kern/efi/tpm.c; + + enable = i386_pc; + enable = efi; +}; Index: grub-2.02~rc1/grub-core/boot/i386/pc/boot.S =================================================================== --- grub-2.02~rc1.orig/grub-core/boot/i386/pc/boot.S +++ grub-2.02~rc1/grub-core/boot/i386/pc/boot.S @@ -24,7 +24,6 @@ * defines for the code go here */ -#define TPM 1 /* Print message string */ #define MSG(x) movw $x, %si; call LOCAL(message) Index: grub-2.02~rc1/grub-core/kern/efi/tpm.c =================================================================== --- grub-2.02~rc1.orig/grub-core/kern/efi/tpm.c +++ grub-2.02~rc1/grub-core/kern/efi/tpm.c @@ -7,6 +7,8 @@ #include <grub/tpm.h> #include <grub/term.h> +GRUB_MOD_LICENSE ("GPLv3+"); + static grub_efi_guid_t tpm_guid = EFI_TPM_GUID; static grub_efi_guid_t tpm2_guid = EFI_TPM2_GUID; @@ -70,21 +72,14 @@ static grub_efi_boolean_t grub_tpm_handl } static grub_err_t -grub_tpm1_execute(grub_efi_handle_t tpm_handle, +grub_tpm1_execute(grub_efi_tpm_protocol_t *tpm, PassThroughToTPM_InputParamBlock *inbuf, PassThroughToTPM_OutputParamBlock *outbuf) { grub_efi_status_t status; - grub_efi_tpm_protocol_t *tpm; grub_uint32_t inhdrsize = sizeof(*inbuf) - sizeof(inbuf->TPMOperandIn); grub_uint32_t outhdrsize = sizeof(*outbuf) - sizeof(outbuf->TPMOperandOut); - tpm = grub_efi_open_protocol (tpm_handle, &tpm_guid, - GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL); - - if (!grub_tpm_present(tpm)) - return 0; - /* UEFI TPM protocol takes the raw operand block, no param block header */ status = efi_call_5 (tpm->pass_through_to_tpm, tpm, inbuf->IPBLength - inhdrsize, inbuf->TPMOperandIn, @@ -107,21 +102,14 @@ grub_tpm1_execute(grub_efi_handle_t tpm_ } static grub_err_t -grub_tpm2_execute(grub_efi_handle_t tpm_handle, +grub_tpm2_execute(grub_efi_tpm2_protocol_t *tpm, PassThroughToTPM_InputParamBlock *inbuf, PassThroughToTPM_OutputParamBlock *outbuf) { grub_efi_status_t status; - grub_efi_tpm2_protocol_t *tpm; grub_uint32_t inhdrsize = sizeof(*inbuf) - sizeof(inbuf->TPMOperandIn); grub_uint32_t outhdrsize = sizeof(*outbuf) - sizeof(outbuf->TPMOperandOut); - tpm = grub_efi_open_protocol (tpm_handle, &tpm2_guid, - GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL); - - if (!grub_tpm2_present(tpm)) - return 0; - /* UEFI TPM protocol takes the raw operand block, no param block header */ status = efi_call_5 (tpm->submit_command, tpm, inbuf->IPBLength - inhdrsize, inbuf->TPMOperandIn, @@ -143,42 +131,17 @@ grub_tpm2_execute(grub_efi_handle_t tpm_ } } -grub_err_t -grub_tpm_execute(PassThroughToTPM_InputParamBlock *inbuf, - PassThroughToTPM_OutputParamBlock *outbuf) -{ - grub_efi_handle_t tpm_handle; - grub_uint8_t protocol_version; - - /* It's not a hard failure for there to be no TPM */ - if (!grub_tpm_handle_find(&tpm_handle, &protocol_version)) - return 0; - - if (protocol_version == 1) { - return grub_tpm1_execute(tpm_handle, inbuf, outbuf); - } else { - return grub_tpm2_execute(tpm_handle, inbuf, outbuf); - } -} - static grub_err_t -grub_tpm1_log_event(grub_efi_handle_t tpm_handle, unsigned char *buf, +grub_tpm1_log_event(grub_efi_tpm_protocol_t *tpm, unsigned char *buf, grub_size_t size, grub_uint8_t pcr, const char *description) { TCG_PCR_EVENT *event; grub_efi_status_t status; - grub_efi_tpm_protocol_t *tpm; grub_efi_physical_address_t lastevent; grub_uint32_t algorithm; grub_uint32_t eventnum = 0; - tpm = grub_efi_open_protocol (tpm_handle, &tpm_guid, - GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL); - - if (!grub_tpm_present(tpm)) - return 0; - event = grub_zalloc(sizeof (TCG_PCR_EVENT) + grub_strlen(description) + 1); if (!event) return grub_error (GRUB_ERR_OUT_OF_MEMORY, @@ -210,19 +173,12 @@ grub_tpm1_log_event(grub_efi_handle_t tp } static grub_err_t -grub_tpm2_log_event(grub_efi_handle_t tpm_handle, unsigned char *buf, +grub_tpm2_log_event(grub_efi_tpm2_protocol_t *tpm, unsigned char *buf, grub_size_t size, grub_uint8_t pcr, const char *description) { EFI_TCG2_EVENT *event; grub_efi_status_t status; - grub_efi_tpm2_protocol_t *tpm; - - tpm = grub_efi_open_protocol (tpm_handle, &tpm2_guid, - GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL); - - if (!grub_tpm2_present(tpm)) - return 0; event = grub_zalloc(sizeof (EFI_TCG2_EVENT) + grub_strlen(description) + 1); if (!event) @@ -255,19 +211,64 @@ grub_tpm2_log_event(grub_efi_handle_t tp } } -grub_err_t +static grub_efi_tpm_protocol_t *tpm; +static grub_efi_tpm2_protocol_t *tpm2; + +static grub_err_t +grub_tpm_execute(PassThroughToTPM_InputParamBlock *inbuf, + PassThroughToTPM_OutputParamBlock *outbuf) +{ + if (tpm) + return grub_tpm1_execute(tpm, inbuf, outbuf); + else if (tpm2) + return grub_tpm2_execute(tpm2, inbuf, outbuf); + return GRUB_ERR_NONE; +} + +static grub_err_t grub_tpm_log_event(unsigned char *buf, grub_size_t size, grub_uint8_t pcr, const char *description) { + if (tpm) + return grub_tpm1_log_event(tpm, buf, size, pcr, description); + else if (tpm2) + return grub_tpm2_log_event(tpm2, buf, size, pcr, description); + return GRUB_ERR_NONE; +} + +static struct grub_tpm grub_efi_tpm = +{ + .log_event = grub_tpm_log_event, + .execute = grub_tpm_execute +}; + +GRUB_MOD_INIT (tpm) +{ grub_efi_handle_t tpm_handle; grub_efi_uint8_t protocol_version; - if (!grub_tpm_handle_find(&tpm_handle, &protocol_version)) - return 0; + if (!grub_tpm_handle_find (&tpm_handle, &protocol_version)) + return ; - if (protocol_version == 1) { - return grub_tpm1_log_event(tpm_handle, buf, size, pcr, description); - } else { - return grub_tpm2_log_event(tpm_handle, buf, size, pcr, description); - } + if (protocol_version == 1) + { + tpm = grub_efi_open_protocol (tpm_handle, &tpm_guid, + GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL); + if (tpm && grub_tpm_present(tpm)) + grub_tpm = &grub_efi_tpm; + } + else + { + tpm2 = grub_efi_open_protocol (tpm_handle, &tpm2_guid, + GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL); + if (tpm2 && grub_tpm2_present(tpm2)) + grub_tpm = &grub_efi_tpm; + } +} + +GRUB_MOD_FINI (tpm) +{ + grub_tpm = NULL; + tpm = NULL; + tpm2 = NULL; } Index: grub-2.02~rc1/grub-core/kern/i386/pc/tpm.c =================================================================== --- grub-2.02~rc1.orig/grub-core/kern/i386/pc/tpm.c +++ grub-2.02~rc1/grub-core/kern/i386/pc/tpm.c @@ -4,12 +4,14 @@ #include <grub/tpm.h> #include <grub/misc.h> #include <grub/i386/pc/int.h> +#include <grub/dl.h> -#define TCPA_MAGIC 0x41504354 +GRUB_MOD_LICENSE ("GPLv3+"); -int tpm_present(void); +#define TCPA_MAGIC 0x41504354 -int tpm_present(void) +static int +tpm_present(void) { struct grub_bios_int_registers regs; @@ -24,16 +26,13 @@ int tpm_present(void) return 0; } -grub_err_t +static grub_err_t grub_tpm_execute(PassThroughToTPM_InputParamBlock *inbuf, PassThroughToTPM_OutputParamBlock *outbuf) { struct grub_bios_int_registers regs; grub_addr_t inaddr, outaddr; - if (!tpm_present()) - return 0; - inaddr = (grub_addr_t) inbuf; outaddr = (grub_addr_t) outbuf; regs.flags = GRUB_CPU_INT_FLAGS_DEFAULT; @@ -80,7 +79,7 @@ typedef struct { grub_uint8_t hashvalue[20]; } GRUB_PACKED EventOutgoing; -grub_err_t +static grub_err_t grub_tpm_log_event(unsigned char *buf, grub_size_t size, grub_uint8_t pcr, const char *description) { @@ -90,9 +89,6 @@ grub_tpm_log_event(unsigned char *buf, g Event *event; grub_uint32_t datalength; - if (!tpm_present()) - return 0; - datalength = grub_strlen(description); event = grub_zalloc(datalength + sizeof(Event)); if (!event) @@ -130,3 +126,19 @@ grub_tpm_log_event(unsigned char *buf, g return 0; } +static struct grub_tpm grub_pc_tpm = +{ + .log_event = grub_tpm_log_event, + .execute = grub_tpm_execute +}; + +GRUB_MOD_INIT (tpm) +{ + if (tpm_present()) + grub_tpm = &grub_pc_tpm; +} + +GRUB_MOD_FINI (tpm) +{ + grub_tpm = NULL; +} Index: grub-2.02~rc1/grub-core/kern/tpm.c =================================================================== --- grub-2.02~rc1.orig/grub-core/kern/tpm.c +++ grub-2.02~rc1/grub-core/kern/tpm.c @@ -5,15 +5,22 @@ #include <grub/tpm.h> #include <grub/term.h> +grub_tpm_t grub_tpm = NULL; + grub_err_t grub_tpm_measure (unsigned char *buf, grub_size_t size, grub_uint8_t pcr, const char *kind, const char *description) { grub_err_t ret; - char *desc = grub_xasprintf("%s %s", kind, description); + char *desc; + + if (!grub_tpm) + return GRUB_ERR_NONE; + + desc = grub_xasprintf("%s %s", kind, description); if (!desc) return GRUB_ERR_OUT_OF_MEMORY; - ret = grub_tpm_log_event(buf, size, pcr, description); + ret = grub_tpm->log_event(buf, size, pcr, desc); grub_free(desc); return ret; } Index: grub-2.02~rc1/include/grub/tpm.h =================================================================== --- grub-2.02~rc1.orig/include/grub/tpm.h +++ grub-2.02~rc1/include/grub/tpm.h @@ -69,21 +69,14 @@ typedef struct { grub_err_t EXPORT_FUNC(grub_tpm_measure) (unsigned char *buf, grub_size_t size, grub_uint8_t pcr, const char *kind, const char *description); -#if defined (GRUB_MACHINE_EFI) || defined (GRUB_MACHINE_PCBIOS) -grub_err_t grub_tpm_execute(PassThroughToTPM_InputParamBlock *inbuf, - PassThroughToTPM_OutputParamBlock *outbuf); -grub_err_t grub_tpm_log_event(unsigned char *buf, grub_size_t size, - grub_uint8_t pcr, const char *description); -#else -static inline grub_err_t grub_tpm_execute(PassThroughToTPM_InputParamBlock *inbuf, - PassThroughToTPM_OutputParamBlock *outbuf) { return 0; }; -static inline grub_err_t grub_tpm_log_event(unsigned char *buf, - grub_size_t size, - grub_uint8_t pcr, - const char *description) +typedef struct grub_tpm { - return 0; -}; -#endif + grub_err_t (*log_event)(unsigned char *buf, grub_size_t size, + grub_uint8_t pcr, const char *description); + grub_err_t (*execute)(PassThroughToTPM_InputParamBlock *inbuf, + PassThroughToTPM_OutputParamBlock *outbuf); +} *grub_tpm_t; + +extern grub_tpm_t EXPORT_VAR(grub_tpm); #endif Index: grub-2.02~rc1/util/grub-install.c =================================================================== --- grub-2.02~rc1.orig/util/grub-install.c +++ grub-2.02~rc1/util/grub-install.c @@ -80,6 +80,7 @@ static char *label_color; static char *label_bgcolor; static char *product_version; static int add_rs_codes = 1; +static int suse_enable_tpm = 0; enum { @@ -106,6 +107,7 @@ enum OPTION_DISK_MODULE, OPTION_NO_BOOTSECTOR, OPTION_NO_RS_CODES, + OPTION_SUSE_ENABLE_TPM, OPTION_MACPPC_DIRECTORY, OPTION_ZIPL_DIRECTORY, OPTION_LABEL_FONT, @@ -231,6 +233,10 @@ argp_parser (int key, char *arg, struct add_rs_codes = 0; return 0; + case OPTION_SUSE_ENABLE_TPM: + suse_enable_tpm = 1; + return 0; + case OPTION_DEBUG: verbosity++; return 0; @@ -292,6 +298,7 @@ static struct argp_option options[] = { {"no-rs-codes", OPTION_NO_RS_CODES, 0, 0, N_("Do not apply any reed-solomon codes when embedding core.img. " "This option is only available on x86 BIOS targets."), 0}, + {"suse-enable-tpm", OPTION_SUSE_ENABLE_TPM, 0, 0, N_("install TPM modules"), 0}, {"debug", OPTION_DEBUG, 0, OPTION_HIDDEN, 0, 2}, {"no-floppy", OPTION_NO_FLOPPY, 0, OPTION_HIDDEN, 0, 2}, @@ -1322,6 +1329,9 @@ main (int argc, char *argv[]) else if (disk_module && disk_module[0]) grub_install_push_module (disk_module); + if (suse_enable_tpm && (is_efi || platform == GRUB_INSTALL_PLATFORM_I386_PC)) + grub_install_push_module ("tpm"); + relative_grubdir = grub_make_system_path_relative_to_its_root (grubdir); if (relative_grubdir[0] == '\0') { @@ -1742,9 +1752,9 @@ main (int argc, char *argv[]) { char *boot_img_src = grub_util_path_concat (2, grub_install_source_directory, - "boot.img"); + suse_enable_tpm ? "boot_tpm.img" : "boot.img"); char *boot_img = grub_util_path_concat (2, platdir, - "boot.img"); + suse_enable_tpm ? "boot_tpm.img" : "boot.img"); grub_install_copy_file (boot_img_src, boot_img, 1); grub_util_info ("%sgrub-bios-setup %s %s %s %s %s --directory='%s' --device-map='%s' '%s'", @@ -1762,7 +1772,7 @@ main (int argc, char *argv[]) /* Now perform the installation. */ if (install_bootsector) - grub_util_bios_setup (platdir, "boot.img", "core.img", + grub_util_bios_setup (platdir, suse_enable_tpm ? "boot_tpm.img" : "boot.img", "core.img", install_drive, force, fs_probe, allow_floppy, add_rs_codes); break;
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
