diff options
| -rw-r--r-- | src/include/antirollback.h | 7 | ||||
| -rw-r--r-- | src/lib/tlcl.c | 5 | ||||
| -rw-r--r-- | src/vendorcode/google/chromeos/vboot2/antirollback.c | 17 | ||||
| -rw-r--r-- | src/vendorcode/google/chromeos/vboot2/verstage.c | 15 |
4 files changed, 42 insertions, 2 deletions
diff --git a/src/include/antirollback.h b/src/include/antirollback.h index 942793a62b..5ba36f7e65 100644 --- a/src/include/antirollback.h +++ b/src/include/antirollback.h @@ -12,6 +12,7 @@ #include "tpm_lite/tss_constants.h" struct vb2_context; +enum vb2_pcr_digest; /* TPM NVRAM location indices. */ #define FIRMWARE_NV_INDEX 0x1007 @@ -51,6 +52,12 @@ uint32_t antirollback_lock_space_firmware(void); */ /** + * Ask vboot for a digest and extend a TPM PCR with it. + */ +uint32_t tpm_extend_pcr(struct vb2_context *ctx, int pcr, + enum vb2_pcr_digest which_digest); + +/** * Issue a TPM_Clear and reenable/reactivate the TPM. */ uint32_t tpm_clear_and_reenable(void); diff --git a/src/lib/tlcl.c b/src/lib/tlcl.c index c37b51a532..ccf4e8004b 100644 --- a/src/lib/tlcl.c +++ b/src/lib/tlcl.c @@ -320,7 +320,8 @@ uint32_t tlcl_extend(int pcr_num, const uint8_t* in_digest, if (result != TPM_SUCCESS) return result; - memcpy(out_digest, response + kTpmResponseHeaderLength, - kPcrDigestLength); + if (out_digest) + memcpy(out_digest, response + kTpmResponseHeaderLength, + kPcrDigestLength); return result; } diff --git a/src/vendorcode/google/chromeos/vboot2/antirollback.c b/src/vendorcode/google/chromeos/vboot2/antirollback.c index f420d16114..407b19cecd 100644 --- a/src/vendorcode/google/chromeos/vboot2/antirollback.c +++ b/src/vendorcode/google/chromeos/vboot2/antirollback.c @@ -35,6 +35,23 @@ } \ } while (0) + +uint32_t tpm_extend_pcr(struct vb2_context *ctx, int pcr, + enum vb2_pcr_digest which_digest) +{ + uint8_t buffer[VB2_PCR_DIGEST_RECOMMENDED_SIZE]; + uint32_t size = sizeof(buffer); + int rv; + + rv = vb2api_get_pcr_digest(ctx, which_digest, buffer, &size); + if (rv != VB2_SUCCESS) + return rv; + if (size < TPM_PCR_DIGEST) + return VB2_ERROR_UNKNOWN; + + return tlcl_extend(pcr, buffer, NULL); +} + uint32_t tpm_clear_and_reenable(void) { VBDEBUG("TPM: Clear and re-enable\n"); diff --git a/src/vendorcode/google/chromeos/vboot2/verstage.c b/src/vendorcode/google/chromeos/vboot2/verstage.c index 06d76fe24a..0ce4e89246 100644 --- a/src/vendorcode/google/chromeos/vboot2/verstage.c +++ b/src/vendorcode/google/chromeos/vboot2/verstage.c @@ -205,6 +205,12 @@ static void save_if_needed(struct vb2_context *ctx) } } +static uint32_t extend_pcrs(struct vb2_context *ctx) +{ + return tpm_extend_pcr(ctx, 0, BOOT_MODE_PCR) || + tpm_extend_pcr(ctx, 1, HWID_DIGEST_PCR); +} + /** * Verify and select the firmware in the RW image * @@ -248,6 +254,7 @@ void verstage_main(void) printk(BIOS_INFO, "Recovery requested (%x)\n", rv); /* If we need recovery mode, leave firmware selection now */ save_if_needed(&ctx); + extend_pcrs(&ctx); /* ignore failures */ timestamp_add_now(TS_END_VBOOT); return; } @@ -284,6 +291,14 @@ void verstage_main(void) vboot_reboot(); } + rv = extend_pcrs(&ctx); + if (rv) { + printk(BIOS_WARNING, "Failed to extend TPM PCRs (%#x)\n", rv); + vb2api_fail(&ctx, VB2_RECOVERY_RO_TPM_U_ERROR, rv); + save_if_needed(&ctx); + vboot_reboot(); + } + /* Lock TPM */ rv = antirollback_lock_space_firmware(); if (rv) { |