1*5fff9558SSimon J. Gerraty /*- 2*5fff9558SSimon J. Gerraty * Copyright (c) 2018, Juniper Networks, Inc. 3*5fff9558SSimon J. Gerraty * 4*5fff9558SSimon J. Gerraty * Redistribution and use in source and binary forms, with or without 5*5fff9558SSimon J. Gerraty * modification, are permitted provided that the following conditions 6*5fff9558SSimon J. Gerraty * are met: 7*5fff9558SSimon J. Gerraty * 1. Redistributions of source code must retain the above copyright 8*5fff9558SSimon J. Gerraty * notice, this list of conditions and the following disclaimer. 9*5fff9558SSimon J. Gerraty * 2. Redistributions in binary form must reproduce the above copyright 10*5fff9558SSimon J. Gerraty * notice, this list of conditions and the following disclaimer in the 11*5fff9558SSimon J. Gerraty * documentation and/or other materials provided with the distribution. 12*5fff9558SSimon J. Gerraty * 13*5fff9558SSimon J. Gerraty * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 14*5fff9558SSimon J. Gerraty * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 15*5fff9558SSimon J. Gerraty * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 16*5fff9558SSimon J. Gerraty * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 17*5fff9558SSimon J. Gerraty * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 18*5fff9558SSimon J. Gerraty * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 19*5fff9558SSimon J. Gerraty * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 20*5fff9558SSimon J. Gerraty * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 21*5fff9558SSimon J. Gerraty * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 22*5fff9558SSimon J. Gerraty * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 23*5fff9558SSimon J. Gerraty * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 24*5fff9558SSimon J. Gerraty */ 25*5fff9558SSimon J. Gerraty #include <sys/cdefs.h> 26*5fff9558SSimon J. Gerraty __FBSDID("$FreeBSD$"); 27*5fff9558SSimon J. Gerraty 28*5fff9558SSimon J. Gerraty #include "libsecureboot-priv.h" 29*5fff9558SSimon J. Gerraty 30*5fff9558SSimon J. Gerraty /* 31*5fff9558SSimon J. Gerraty * To support measured boot without putting a ton 32*5fff9558SSimon J. Gerraty * of extra code in the loader, we just maintain 33*5fff9558SSimon J. Gerraty * a hash of all the hashes we (attempt to) verify. 34*5fff9558SSimon J. Gerraty * The loader can export this for kernel or rc script 35*5fff9558SSimon J. Gerraty * to feed to a TPM pcr register - hence the name ve_pcr. 36*5fff9558SSimon J. Gerraty * 37*5fff9558SSimon J. Gerraty * NOTE: in the current standard the TPM pcr register size is for SHA1, 38*5fff9558SSimon J. Gerraty * the fact that we provide a SHA256 hash should not matter 39*5fff9558SSimon J. Gerraty * as long as we are consistent - it can be truncated or hashed 40*5fff9558SSimon J. Gerraty * before feeding to TPM. 41*5fff9558SSimon J. Gerraty */ 42*5fff9558SSimon J. Gerraty 43*5fff9558SSimon J. Gerraty static const br_hash_class *pcr_md = NULL; 44*5fff9558SSimon J. Gerraty static br_hash_compat_context pcr_ctx; 45*5fff9558SSimon J. Gerraty static size_t pcr_hlen = 0; 46*5fff9558SSimon J. Gerraty 47*5fff9558SSimon J. Gerraty /** 48*5fff9558SSimon J. Gerraty * @brief initialize pcr context 49*5fff9558SSimon J. Gerraty * 50*5fff9558SSimon J. Gerraty * Real TPM registers only hold a SHA1 hash 51*5fff9558SSimon J. Gerraty * but we use SHA256 52*5fff9558SSimon J. Gerraty */ 53*5fff9558SSimon J. Gerraty void 54*5fff9558SSimon J. Gerraty ve_pcr_init(void) 55*5fff9558SSimon J. Gerraty { 56*5fff9558SSimon J. Gerraty pcr_hlen = br_sha256_SIZE; 57*5fff9558SSimon J. Gerraty pcr_md = &br_sha256_vtable; 58*5fff9558SSimon J. Gerraty pcr_md->init(&pcr_ctx.vtable); 59*5fff9558SSimon J. Gerraty } 60*5fff9558SSimon J. Gerraty 61*5fff9558SSimon J. Gerraty /** 62*5fff9558SSimon J. Gerraty * @brief update pcr context 63*5fff9558SSimon J. Gerraty */ 64*5fff9558SSimon J. Gerraty void 65*5fff9558SSimon J. Gerraty ve_pcr_update(unsigned char *data, size_t dlen) 66*5fff9558SSimon J. Gerraty { 67*5fff9558SSimon J. Gerraty if (pcr_md) 68*5fff9558SSimon J. Gerraty pcr_md->update(&pcr_ctx.vtable, data, dlen); 69*5fff9558SSimon J. Gerraty } 70*5fff9558SSimon J. Gerraty 71*5fff9558SSimon J. Gerraty /** 72*5fff9558SSimon J. Gerraty * @brief get pcr result 73*5fff9558SSimon J. Gerraty */ 74*5fff9558SSimon J. Gerraty ssize_t 75*5fff9558SSimon J. Gerraty ve_pcr_get(unsigned char *buf, size_t sz) 76*5fff9558SSimon J. Gerraty { 77*5fff9558SSimon J. Gerraty if (!pcr_md) 78*5fff9558SSimon J. Gerraty return (-1); 79*5fff9558SSimon J. Gerraty if (sz < pcr_hlen) 80*5fff9558SSimon J. Gerraty return (-1); 81*5fff9558SSimon J. Gerraty pcr_md->out(&pcr_ctx.vtable, buf); 82*5fff9558SSimon J. Gerraty return (pcr_hlen); 83*5fff9558SSimon J. Gerraty } 84*5fff9558SSimon J. Gerraty 85