[SLOF] [PATCH 11/16] Measure the static core root of trust for measurements

[Stefan Berger]

This patch adds support for measuring the static core root of trust
(S-CRTM) and logging the measurements.

Signed-off-by: Stefan Berger <stefanb at linux.vnet.ibm.com>
---
 board-qemu/slof/vio-vtpm-cdriver.fs |  2 ++
 lib/libtpm/tcgbios.c                | 37 +++++++++++++++++++++++++++++++++++++
 lib/libtpm/tcgbios.h                |  1 +
 lib/libtpm/tcgbios_int.h            |  2 ++
 lib/libtpm/tpm.code                 | 10 ++++++++++
 lib/libtpm/tpm.in                   |  1 +
 slof/fs/tpm/tpm-static.fs           | 11 +++++++++++
 7 files changed, 64 insertions(+)

diff --git a/board-qemu/slof/vio-vtpm-cdriver.fs b/board-qemu/slof/vio-vtpm-cdriver.fs
index 2fc1657..0b4ba41 100644
--- a/board-qemu/slof/vio-vtpm-cdriver.fs
+++ b/board-qemu/slof/vio-vtpm-cdriver.fs
@@ -72,3 +72,5 @@ vtpm-init
 
 \ setup the log
 include vtpm-sml.fs
+
+vtpm-measure-scrtm
diff --git a/lib/libtpm/tcgbios.c b/lib/libtpm/tcgbios.c
index 40557d6..adec313 100644
--- a/lib/libtpm/tcgbios.c
+++ b/lib/libtpm/tcgbios.c
@@ -1383,3 +1383,40 @@ bool tpm_is_working(void)
 {
 	return has_working_tpm();
 }
+
+uint32_t tpm_measure_scrtm(void)
+{
+	uint32_t rc;
+
+	extern long print_version, print_version_end;
+	extern long _slof_data, _slof_data_end;
+
+	char *version_start = (char *)&print_version;
+	uint32_t version_length = (long)&print_version_end - (long)&print_version;
+
+	char *slof_start = (char *)&_slof_data;
+	uint32_t slof_length = (long)&_slof_data_end - (long)&_slof_data;
+
+	const char *scrtm = "S-CRTM Contents";
+
+	dprintf("Measure S-CRTM Version: addr = %p, length = %d\n",
+		version_start, version_length);
+
+	rc = tpm_add_measurement_to_log(
+		0, EV_S_CRTM_VERSION,
+		version_start, version_length,
+		(uint8_t *)version_start, version_length);
+
+	if (rc)
+		return rc;
+
+	dprintf("Measure S-CRTM Content: start = %p, length = %d\n",
+		&slof_start, slof_length);
+
+	rc = tpm_add_measurement_to_log(
+		0, EV_S_CRTM_CONTENTS,
+		scrtm, strlen(scrtm),
+		(uint8_t *)slof_start, slof_length);
+
+	return rc;
+}
diff --git a/lib/libtpm/tcgbios.h b/lib/libtpm/tcgbios.h
index 902ea1f..9f07caf 100644
--- a/lib/libtpm/tcgbios.h
+++ b/lib/libtpm/tcgbios.h
@@ -24,6 +24,7 @@ enum ipltype {
 
 uint32_t tpm_start(void);
 uint32_t tpm_unassert_pp(void);
+uint32_t tpm_measure_scrtm(void);
 void tpm_set_log_parameters(void *address, unsigned int size);
 uint32_t tpm_get_logsize(void);
 uint32_t tpm_ipl(enum ipltype bootcd, const uint8_t *addr, uint32_t length);
diff --git a/lib/libtpm/tcgbios_int.h b/lib/libtpm/tcgbios_int.h
index 420049f..bedc2f1 100644
--- a/lib/libtpm/tcgbios_int.h
+++ b/lib/libtpm/tcgbios_int.h
@@ -57,6 +57,8 @@
 #define EV_SEPARATOR             4
 #define EV_ACTION                5
 #define EV_EVENT_TAG             6
+#define EV_S_CRTM_CONTENTS       7
+#define EV_S_CRTM_VERSION        8
 #define EV_COMPACT_HASH         12
 #define EV_IPL                  13
 #define EV_IPL_PARTITION_DATA   14
diff --git a/lib/libtpm/tpm.code b/lib/libtpm/tpm.code
index 66250d5..34b9cbc 100644
--- a/lib/libtpm/tpm.code
+++ b/lib/libtpm/tpm.code
@@ -122,3 +122,13 @@ PRIM(tpm_X2d_is_X2d_working)
 	PUSH;
 	TOS.n = tpm_is_working();
 MIRP
+
+/************************************************/
+/* Have the S-CRTM measured                     */
+/* SLOF:   tpm-measure-scrtm  ( -- errcode )    */
+/* LIBTPM: errcode = tpm_measure_scrtm          */
+/************************************************/
+PRIM(tpm_X2d_measure_X2d_scrtm)
+	PUSH;
+	TOS.n = tpm_measure_scrtm();
+MIRP
diff --git a/lib/libtpm/tpm.in b/lib/libtpm/tpm.in
index f2cc81e..48c0d75 100644
--- a/lib/libtpm/tpm.in
+++ b/lib/libtpm/tpm.in
@@ -23,3 +23,4 @@ cod(tpm-add-bcv)
 cod(tpm-process-opcode)
 cod(tpm-get-state)
 cod(tpm-is-working)
+cod(tpm-measure-scrtm)
diff --git a/slof/fs/tpm/tpm-static.fs b/slof/fs/tpm/tpm-static.fs
index bc5138a..1bc37c9 100644
--- a/slof/fs/tpm/tpm-static.fs
+++ b/slof/fs/tpm/tpm-static.fs
@@ -33,6 +33,17 @@ false VALUE vtpm-debug?
     THEN
 ;
 
+: vtpm-measure-scrtm
+    vtpm-available? IF
+        tpm-measure-scrtm                                 ( -- errcode )
+        vtpm-debug? IF
+            ." VTPM: Error code from tpm-measure-scrtm: " . cr
+        ELSE
+            drop
+        THEN
+    THEN
+;
+
 : vtpm-unassert-pp
     vtpm-available? IF
         tpm-unassert-pp                                    ( -- errcode )
-- 
1.9.3