From d9f26edfec760ff81f88f164fc0e601fe8e20e3e Mon Sep 17 00:00:00 2001 From: Daisuke Nojiri Date: Tue, 21 Apr 2020 15:13:07 -0700 Subject: vboot: Add permission check for kernel space This patch restores the permission check for the kernel space which was dropped when read_space_kernel was moved from Depthcharge by CL:2155429. BUG=chromium:1045217, chromium:1020578 BRANCH=none TEST=none Signed-off-by: dnojiri Change-Id: If6d487940f39865cadc0ca9d5de6e055ad3e017d Reviewed-on: https://review.coreboot.org/c/coreboot/+/40579 Reviewed-by: Julius Werner Tested-by: build bot (Jenkins) --- src/security/tpm/tss.h | 5 +++++ src/security/tpm/tss/tcg-1.2/tss.c | 19 +++++++++++++++++++ 2 files changed, 24 insertions(+) (limited to 'src/security/tpm') diff --git a/src/security/tpm/tss.h b/src/security/tpm/tss.h index 5237387a74..57f3b24847 100644 --- a/src/security/tpm/tss.h +++ b/src/security/tpm/tss.h @@ -197,4 +197,9 @@ uint32_t tlcl_extend(int pcr_num, const uint8_t *in_digest, */ uint32_t tlcl_disable_platform_hierarchy(void); +/** + * Get the permission bits for the NVRAM space with |index|. + */ +uint32_t tlcl_get_permissions(uint32_t index, uint32_t *permissions); + #endif /* TSS_H_ */ diff --git a/src/security/tpm/tss/tcg-1.2/tss.c b/src/security/tpm/tss/tcg-1.2/tss.c index 9bc72d2733..ea3f94d5f8 100644 --- a/src/security/tpm/tss/tcg-1.2/tss.c +++ b/src/security/tpm/tss/tcg-1.2/tss.c @@ -359,3 +359,22 @@ uint32_t tlcl_extend(int pcr_num, const uint8_t *in_digest, kPcrDigestLength); return result; } + +uint32_t tlcl_get_permissions(uint32_t index, uint32_t *permissions) +{ + struct s_tpm_getpermissions_cmd cmd; + uint8_t response[TPM_LARGE_ENOUGH_COMMAND_SIZE]; + uint8_t *nvdata; + uint32_t result; + uint32_t size; + + memcpy(&cmd, &tpm_getpermissions_cmd, sizeof(cmd)); + to_tpm_uint32(cmd.buffer + tpm_getpermissions_cmd.index, index); + result = tlcl_send_receive(cmd.buffer, response, sizeof(response)); + if (result != TPM_SUCCESS) + return result; + + nvdata = response + kTpmResponseHeaderLength + sizeof(size); + from_tpm_uint32(nvdata + kNvDataPublicPermissionsOffset, permissions); + return result; +} -- cgit v1.2.3