diff options
Diffstat (limited to 'src/security/vboot')
| -rw-r--r-- | src/security/vboot/Kconfig | 5 | ||||
| -rw-r--r-- | src/security/vboot/antirollback.h | 66 | ||||
| -rw-r--r-- | src/security/vboot/secdata_mock.c | 30 | ||||
| -rw-r--r-- | src/security/vboot/secdata_tpm.c | 179 | ||||
| -rw-r--r-- | src/security/vboot/vboot_logic.c | 17 |
5 files changed, 143 insertions, 154 deletions
diff --git a/src/security/vboot/Kconfig b/src/security/vboot/Kconfig index 0139d25599..e13101b6be 100644 --- a/src/security/vboot/Kconfig +++ b/src/security/vboot/Kconfig @@ -17,10 +17,7 @@ menu "Verified Boot (vboot)" config VBOOT bool "Verify firmware with vboot." default n - select TPM if !MAINBOARD_HAS_TPM2 && !VBOOT_MOCK_SECDATA - select TPM2 if MAINBOARD_HAS_TPM2 && !VBOOT_MOCK_SECDATA - select TPM_INIT_FAILURE_IS_FATAL if PC80_SYSTEM && LPC_TPM - select SKIP_TPM_STARTUP_ON_NORMAL_BOOT if PC80_SYSTEM && LPC_TPM + select VBOOT_MOCK_SECDATA if !TPM1 && !TPM2 depends on HAVE_HARD_RESET help Enabling VBOOT will use vboot to verify the components of the firmware diff --git a/src/security/vboot/antirollback.h b/src/security/vboot/antirollback.h new file mode 100644 index 0000000000..be42f009e7 --- /dev/null +++ b/src/security/vboot/antirollback.h @@ -0,0 +1,66 @@ +/* Copyright (c) 2013 The Chromium OS Authors. All rights reserved. + * Use of this source code is governed by a BSD-style license that can be + * found in the LICENSE file. + * + * Functions for querying, manipulating and locking rollback indices + * stored in the TPM NVRAM. + */ + +#ifndef ANTIROLLBACK_H_ +#define ANTIROLLBACK_H_ + +#include <types.h> +#include <security/tpm/tspi.h> + +struct vb2_context; +enum vb2_pcr_digest; + +/* TPM NVRAM location indices. */ +#define FIRMWARE_NV_INDEX 0x1007 +#define KERNEL_NV_INDEX 0x1008 +/* 0x1009 used to be used as a backup space. Think of conflicts if you + * want to use 0x1009 for something else. */ +#define BACKUP_NV_INDEX 0x1009 +#define FWMP_NV_INDEX 0x100a +#define REC_HASH_NV_INDEX 0x100b +#define REC_HASH_NV_SIZE VB2_SHA256_DIGEST_SIZE + +/* Structure definitions for TPM spaces */ + +/* Flags for firmware space */ + +/* + * Last boot was developer mode. TPM ownership is cleared when transitioning + * to/from developer mode. + */ +#define FLAG_LAST_BOOT_DEVELOPER 0x01 + +/* All functions return TPM_SUCCESS (zero) if successful, non-zero if error */ + +uint32_t antirollback_read_space_firmware(struct vb2_context *ctx); + +/** + * Write may be called if the versions change. + */ +uint32_t antirollback_write_space_firmware(struct vb2_context *ctx); + +/** + * Lock must be called. + */ +uint32_t antirollback_lock_space_firmware(void); + +/* Read recovery hash data from TPM. */ +uint32_t antirollback_read_space_rec_hash(uint8_t *data, uint32_t size); +/* Write new hash data to recovery space in TPM. */ +uint32_t antirollback_write_space_rec_hash(const uint8_t *data, uint32_t size); +/* Lock down recovery hash space in TPM. */ +uint32_t antirollback_lock_space_rec_hash(void); + +/* Start of the root of trust */ +uint32_t vboot_setup_tpm(struct vb2_context *ctx); + +/* vboot_extend_pcr function for vb2 context */ +uint32_t vboot_extend_pcr(struct vb2_context *ctx, int pcr, + enum vb2_pcr_digest which_digest); + +#endif /* ANTIROLLBACK_H_ */ diff --git a/src/security/vboot/secdata_mock.c b/src/security/vboot/secdata_mock.c index 4ea53558f9..3075d335f6 100644 --- a/src/security/vboot/secdata_mock.c +++ b/src/security/vboot/secdata_mock.c @@ -32,54 +32,50 @@ * stored in the TPM NVRAM. */ -#include <security/tpm/antirollback.h> #include <stdlib.h> -#include <security/tpm/tss.h> +#include <security/tpm/tspi.h> #include <vb2_api.h> -uint32_t tpm_extend_pcr(struct vb2_context *ctx, int pcr, - enum vb2_pcr_digest which_digest) +#include "antirollback.h" + +int vb2ex_tpm_clear_owner(struct vb2_context *ctx) { - return TPM_SUCCESS; + return VB2_SUCCESS; } -uint32_t tpm_clear_and_reenable(void) +uint32_t vboot_extend_pcr(struct vb2_context *ctx, int pcr, + enum vb2_pcr_digest which_digest) { - return TPM_SUCCESS; + return VB2_SUCCESS; } uint32_t antirollback_read_space_firmware(struct vb2_context *ctx) { vb2api_secdata_create(ctx); - return TPM_SUCCESS; + return VB2_SUCCESS; } uint32_t antirollback_write_space_firmware(struct vb2_context *ctx) { - return TPM_SUCCESS; + return VB2_SUCCESS; } uint32_t antirollback_lock_space_firmware() { - return TPM_SUCCESS; + return VB2_SUCCESS; } uint32_t antirollback_lock_space_rec_hash(void) { - return TPM_SUCCESS; + return VB2_SUCCESS; } uint32_t antirollback_read_space_rec_hash(uint8_t *data, uint32_t size) { - return TPM_SUCCESS; + return VB2_SUCCESS; } uint32_t antirollback_write_space_rec_hash(const uint8_t *data, uint32_t size) { - return TPM_SUCCESS; -} - -uint32_t tlcl_lib_init(void) -{ return VB2_SUCCESS; } diff --git a/src/security/vboot/secdata_tpm.c b/src/security/vboot/secdata_tpm.c index a757f02f98..57c107bc3a 100644 --- a/src/security/vboot/secdata_tpm.c +++ b/src/security/vboot/secdata_tpm.c @@ -32,10 +32,10 @@ * stored in the TPM NVRAM. */ -#include <security/tpm/antirollback.h> +#include <security/vboot/antirollback.h> #include <stdlib.h> #include <string.h> -#include <security/tpm/tss.h> +#include <security/tpm/tspi.h> #include <vb2_api.h> #include <console/console.h> @@ -64,7 +64,7 @@ static uint32_t safe_write(uint32_t index, const void *data, uint32_t length); -uint32_t tpm_extend_pcr(struct vb2_context *ctx, int pcr, +uint32_t vboot_extend_pcr(struct vb2_context *ctx, int pcr, enum vb2_pcr_digest which_digest) { uint8_t buffer[VB2_PCR_DIGEST_RECOMMENDED_SIZE]; @@ -74,10 +74,10 @@ uint32_t tpm_extend_pcr(struct vb2_context *ctx, int pcr, rv = vb2api_get_pcr_digest(ctx, which_digest, buffer, &size); if (rv != VB2_SUCCESS) return rv; - if (size < TPM_PCR_DIGEST) + if (size < TPM_PCR_MINIMUM_DIGEST_SIZE) return VB2_ERROR_UNKNOWN; - return tlcl_extend(pcr, buffer, NULL); + return tpm_extend_pcr(pcr, buffer, NULL); } static uint32_t read_space_firmware(struct vb2_context *ctx) @@ -158,6 +158,35 @@ static const uint8_t secdata_kernel[] = { static const uint8_t rec_hash_data[REC_HASH_NV_SIZE] = { }; #if IS_ENABLED(CONFIG_TPM2) +/* + * Different sets of NVRAM space attributes apply to the "ro" spaces, + * i.e. those which should not be possible to delete or modify once + * the RO exits, and the rest of the NVRAM spaces. + */ +const static TPMA_NV ro_space_attributes = { + .TPMA_NV_PPWRITE = 1, + .TPMA_NV_AUTHREAD = 1, + .TPMA_NV_PPREAD = 1, + .TPMA_NV_PLATFORMCREATE = 1, + .TPMA_NV_WRITE_STCLEAR = 1, + .TPMA_NV_POLICY_DELETE = 1, +}; + +const static TPMA_NV rw_space_attributes = { + .TPMA_NV_PPWRITE = 1, + .TPMA_NV_AUTHREAD = 1, + .TPMA_NV_PPREAD = 1, + .TPMA_NV_PLATFORMCREATE = 1, +}; + +/* + * This policy digest was obtained using TPM2_PolicyPCR + * selecting only PCR_0 with a value of all zeros. + */ +const static uint8_t pcr0_unchanged_policy[] = { + 0x09, 0x93, 0x3C, 0xCE, 0xEB, 0xB4, 0x41, 0x11, 0x18, 0x81, 0x1D, + 0xD4, 0x47, 0x78, 0x80, 0x08, 0x88, 0x86, 0x62, 0x2D, 0xD7, 0x79, + 0x94, 0x46, 0x62, 0x26, 0x68, 0x8E, 0xEE, 0xE6, 0x6A, 0xA1}; /* Nothing special in the TPM2 path yet. */ static uint32_t safe_write(uint32_t index, const void *data, uint32_t length) @@ -166,11 +195,13 @@ static uint32_t safe_write(uint32_t index, const void *data, uint32_t length) } static uint32_t set_space(const char *name, uint32_t index, const void *data, - uint32_t length) + uint32_t length, const TPMA_NV nv_attributes, + const uint8_t *nv_policy, size_t nv_policy_size) { uint32_t rv; - rv = tlcl_define_space(index, length); + rv = tlcl_define_space(index, length, nv_attributes, nv_policy, + nv_policy_size); if (rv == TPM_E_NV_DEFINED) { /* * Continue with writing: it may be defined, but not written @@ -193,19 +224,22 @@ static uint32_t set_space(const char *name, uint32_t index, const void *data, static uint32_t set_firmware_space(const void *firmware_blob) { return set_space("firmware", FIRMWARE_NV_INDEX, firmware_blob, - VB2_SECDATA_SIZE); + VB2_SECDATA_SIZE, ro_space_attributes, + pcr0_unchanged_policy, sizeof(pcr0_unchanged_policy)); } static uint32_t set_kernel_space(const void *kernel_blob) { return set_space("kernel", KERNEL_NV_INDEX, kernel_blob, - sizeof(secdata_kernel)); + sizeof(secdata_kernel), rw_space_attributes, NULL, 0); } static uint32_t set_rec_hash_space(const uint8_t *data) { return set_space("MRC Hash", REC_HASH_NV_INDEX, data, - REC_HASH_NV_SIZE); + REC_HASH_NV_SIZE, + ro_space_attributes, pcr0_unchanged_policy, + sizeof(pcr0_unchanged_policy)); } static uint32_t _factory_initialize_tpm(struct vb2_context *ctx) @@ -228,13 +262,6 @@ static uint32_t _factory_initialize_tpm(struct vb2_context *ctx) return TPM_SUCCESS; } -uint32_t tpm_clear_and_reenable(void) -{ - VBDEBUG("TPM: Clear and re-enable\n"); - RETURN_ON_FAILURE(tlcl_force_clear()); - return TPM_SUCCESS; -} - uint32_t antirollback_lock_space_firmware(void) { return tlcl_lock_nv_write(FIRMWARE_NV_INDEX); @@ -247,16 +274,6 @@ uint32_t antirollback_lock_space_rec_hash(void) #else -uint32_t tpm_clear_and_reenable(void) -{ - VBDEBUG("TPM: Clear and re-enable\n"); - RETURN_ON_FAILURE(tlcl_force_clear()); - RETURN_ON_FAILURE(tlcl_set_enable()); - RETURN_ON_FAILURE(tlcl_set_deactivated(0)); - - return TPM_SUCCESS; -} - /** * Like tlcl_write(), but checks for write errors due to hitting the 64-write * limit and clears the TPM when that happens. This can only happen when the @@ -416,110 +433,22 @@ static uint32_t factory_initialize_tpm(struct vb2_context *ctx) return TPM_SUCCESS; } -/* - * SetupTPM starts the TPM and establishes the root of trust for the - * anti-rollback mechanism. SetupTPM can fail for three reasons. 1 A bug. 2 a - * TPM hardware failure. 3 An unexpected TPM state due to some attack. In - * general we cannot easily distinguish the kind of failure, so our strategy is - * to reboot in recovery mode in all cases. The recovery mode calls SetupTPM - * again, which executes (almost) the same sequence of operations. There is a - * good chance that, if recovery mode was entered because of a TPM failure, the - * failure will repeat itself. (In general this is impossible to guarantee - * because we have no way of creating the exact TPM initial state at the - * previous boot.) In recovery mode, we ignore the failure and continue, thus - * giving the recovery kernel a chance to fix things (that's why we don't set - * bGlobalLock). The choice is between a knowingly insecure device and a - * bricked device. - * - * As a side note, observe that we go through considerable hoops to avoid using - * the STCLEAR permissions for the index spaces. We do this to avoid writing - * to the TPM flashram at every reboot or wake-up, because of concerns about - * the durability of the NVRAM. - */ -uint32_t setup_tpm(struct vb2_context *ctx) +uint32_t vboot_setup_tpm(struct vb2_context *ctx) { - uint8_t disable; - uint8_t deactivated; uint32_t result; - RETURN_ON_FAILURE(tlcl_lib_init()); - - /* Handle special init for S3 resume path */ - if (ctx->flags & VB2_CONTEXT_S3_RESUME) { - result = tlcl_resume(); - if (result == TPM_E_INVALID_POSTINIT) - printk(BIOS_DEBUG, "TPM: Already initialized.\n"); - return TPM_SUCCESS; - } - - if (IS_ENABLED(CONFIG_VBOOT_SOFT_REBOOT_WORKAROUND)) { - result = tlcl_startup(); - if (result == TPM_E_INVALID_POSTINIT) { - /* - * Some prototype hardware doesn't reset the TPM on a CPU - * reset. We do a hard reset to get around this. - */ - VBDEBUG("TPM: soft reset detected\n"); - ctx->flags |= VB2_CONTEXT_SECDATA_WANTS_REBOOT; - return TPM_E_MUST_REBOOT; - } else if (result != TPM_SUCCESS) { - VBDEBUG("TPM: tlcl_startup returned %08x\n", result); - return result; - } - } else - RETURN_ON_FAILURE(tlcl_startup()); - - /* - * Some TPMs start the self test automatically at power on. In that case - * we don't need to call ContinueSelfTest. On some (other) TPMs, - * continue_self_test may block. In that case, we definitely don't want - * to call it here. For TPMs in the intersection of these two sets, we - * are screwed. (In other words: TPMs that require manually starting the - * self-test AND block will have poor performance until we split - * tlcl_send_receive() into send() and receive(), and have a state - * machine to control setup.) - * - * This comment is likely to become obsolete in the near future, so - * don't trust it. It may have not been updated. - */ -#ifdef TPM_MANUAL_SELFTEST -#ifdef TPM_BLOCKING_CONTINUESELFTEST -#warning "lousy TPM!" -#endif - RETURN_ON_FAILURE(tlcl_continue_self_test()); -#endif - result = tlcl_assert_physical_presence(); - if (result != TPM_SUCCESS) { - /* - * It is possible that the TPM was delivered with the physical - * presence command disabled. This tries enabling it, then - * tries asserting PP again. - */ - RETURN_ON_FAILURE(tlcl_physical_presence_cmd_enable()); - RETURN_ON_FAILURE(tlcl_assert_physical_presence()); - } - - /* Check that the TPM is enabled and activated. */ - RETURN_ON_FAILURE(tlcl_get_flags(&disable, &deactivated, NULL)); - if (disable || deactivated) { - VBDEBUG("TPM: disabled (%d) or deactivated (%d). Fixing...\n", - disable, deactivated); - RETURN_ON_FAILURE(tlcl_set_enable()); - RETURN_ON_FAILURE(tlcl_set_deactivated(0)); - VBDEBUG("TPM: Must reboot to re-enable\n"); + result = tpm_setup(ctx->flags & VB2_CONTEXT_S3_RESUME); + if (result == TPM_E_MUST_REBOOT) ctx->flags |= VB2_CONTEXT_SECDATA_WANTS_REBOOT; - return TPM_E_MUST_REBOOT; - } - VBDEBUG("TPM: SetupTPM() succeeded\n"); - return TPM_SUCCESS; + return result; } uint32_t antirollback_read_space_firmware(struct vb2_context *ctx) { uint32_t rv; - rv = setup_tpm(ctx); + rv = vboot_setup_tpm(ctx); if (rv) return rv; @@ -585,3 +514,13 @@ uint32_t antirollback_write_space_rec_hash(const uint8_t *data, uint32_t size) return write_secdata(REC_HASH_NV_INDEX, data, size); } + +int vb2ex_tpm_clear_owner(struct vb2_context *ctx) +{ + uint32_t rv; + printk(BIOS_INFO, "Clearing TPM owner\n"); + rv = tpm_clear_and_reenable(); + if (rv) + return VB2_ERROR_EX_TPM_CLEAR_OWNER; + return VB2_SUCCESS; +} diff --git a/src/security/vboot/vboot_logic.c b/src/security/vboot/vboot_logic.c index 2600f84945..9710ae2e7c 100644 --- a/src/security/vboot/vboot_logic.c +++ b/src/security/vboot/vboot_logic.c @@ -13,7 +13,6 @@ * GNU General Public License for more details. */ -#include <security/tpm/antirollback.h> #include <arch/exception.h> #include <assert.h> #include <bootmode.h> @@ -27,6 +26,8 @@ #include <security/vboot/misc.h> #include <security/vboot/vbnv.h> +#include "antirollback.h" + /* The max hash size to expect is for SHA512. */ #define VBOOT_MAX_HASH_SIZE VB2_SHA512_DIGEST_SIZE @@ -53,16 +54,6 @@ void vb2ex_printf(const char *func, const char *fmt, ...) return; } -int vb2ex_tpm_clear_owner(struct vb2_context *ctx) -{ - uint32_t rv; - printk(BIOS_INFO, "Clearing TPM owner\n"); - rv = tpm_clear_and_reenable(); - if (rv) - return VB2_ERROR_EX_TPM_CLEAR_OWNER; - return VB2_SUCCESS; -} - int vb2ex_read_resource(struct vb2_context *ctx, enum vb2_resource_index index, uint32_t offset, @@ -290,8 +281,8 @@ static void save_if_needed(struct vb2_context *ctx) static uint32_t extend_pcrs(struct vb2_context *ctx) { - return tpm_extend_pcr(ctx, 0, BOOT_MODE_PCR) || - tpm_extend_pcr(ctx, 1, HWID_DIGEST_PCR); + return vboot_extend_pcr(ctx, 0, BOOT_MODE_PCR) || + vboot_extend_pcr(ctx, 1, HWID_DIGEST_PCR); } /** |