summaryrefslogtreecommitdiff
path: root/src/security/vboot
diff options
context:
space:
mode:
authorPhilipp Deppenwiese <zaolin@das-labor.org>2018-02-27 19:40:52 +0100
committerMartin Roth <martinroth@google.com>2018-06-04 20:33:07 +0000
commitc07f8fbe6fd13e4245da71574b52b47e9733db84 (patch)
tree12db8b3c40552eab81045c6165538e2d3ba36ce8 /src/security/vboot
parent961d31bdb3c97e177156ed335d6f2c726d08ab51 (diff)
downloadcoreboot-c07f8fbe6fd13e4245da71574b52b47e9733db84.tar.xz
security/tpm: Unify the coreboot TPM software stack
* Remove 2nd software stack in pc80 drivers directory. * Create TSPI interface for common usage. * Refactor TSS / TIS code base. * Add vendor tss (Cr50) directory. * Change kconfig options for TPM to TPM1. * Add user / board configuration with: * MAINBOARD_HAS_*_TPM # * BUS driver * MAINBOARD_HAS_TPM1 or MAINBOARD_HAS_TPM2 * Add kconfig TPM user selection (e.g. pluggable TPMs) * Fix existing headers and function calls. * Fix vboot for interface usage and antirollback mode. Change-Id: I7ec277e82a3c20c62a0548a1a2b013e6ce8f5b3f Signed-off-by: Philipp Deppenwiese <zaolin@das-labor.org> Reviewed-on: https://review.coreboot.org/24903 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Diffstat (limited to 'src/security/vboot')
-rw-r--r--src/security/vboot/Kconfig5
-rw-r--r--src/security/vboot/antirollback.h66
-rw-r--r--src/security/vboot/secdata_mock.c30
-rw-r--r--src/security/vboot/secdata_tpm.c179
-rw-r--r--src/security/vboot/vboot_logic.c17
5 files changed, 143 insertions, 154 deletions
diff --git a/src/security/vboot/Kconfig b/src/security/vboot/Kconfig
index 0139d25599..e13101b6be 100644
--- a/src/security/vboot/Kconfig
+++ b/src/security/vboot/Kconfig
@@ -17,10 +17,7 @@ menu "Verified Boot (vboot)"
config VBOOT
bool "Verify firmware with vboot."
default n
- select TPM if !MAINBOARD_HAS_TPM2 && !VBOOT_MOCK_SECDATA
- select TPM2 if MAINBOARD_HAS_TPM2 && !VBOOT_MOCK_SECDATA
- select TPM_INIT_FAILURE_IS_FATAL if PC80_SYSTEM && LPC_TPM
- select SKIP_TPM_STARTUP_ON_NORMAL_BOOT if PC80_SYSTEM && LPC_TPM
+ select VBOOT_MOCK_SECDATA if !TPM1 && !TPM2
depends on HAVE_HARD_RESET
help
Enabling VBOOT will use vboot to verify the components of the firmware
diff --git a/src/security/vboot/antirollback.h b/src/security/vboot/antirollback.h
new file mode 100644
index 0000000000..be42f009e7
--- /dev/null
+++ b/src/security/vboot/antirollback.h
@@ -0,0 +1,66 @@
+/* Copyright (c) 2013 The Chromium OS Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ *
+ * Functions for querying, manipulating and locking rollback indices
+ * stored in the TPM NVRAM.
+ */
+
+#ifndef ANTIROLLBACK_H_
+#define ANTIROLLBACK_H_
+
+#include <types.h>
+#include <security/tpm/tspi.h>
+
+struct vb2_context;
+enum vb2_pcr_digest;
+
+/* TPM NVRAM location indices. */
+#define FIRMWARE_NV_INDEX 0x1007
+#define KERNEL_NV_INDEX 0x1008
+/* 0x1009 used to be used as a backup space. Think of conflicts if you
+ * want to use 0x1009 for something else. */
+#define BACKUP_NV_INDEX 0x1009
+#define FWMP_NV_INDEX 0x100a
+#define REC_HASH_NV_INDEX 0x100b
+#define REC_HASH_NV_SIZE VB2_SHA256_DIGEST_SIZE
+
+/* Structure definitions for TPM spaces */
+
+/* Flags for firmware space */
+
+/*
+ * Last boot was developer mode. TPM ownership is cleared when transitioning
+ * to/from developer mode.
+ */
+#define FLAG_LAST_BOOT_DEVELOPER 0x01
+
+/* All functions return TPM_SUCCESS (zero) if successful, non-zero if error */
+
+uint32_t antirollback_read_space_firmware(struct vb2_context *ctx);
+
+/**
+ * Write may be called if the versions change.
+ */
+uint32_t antirollback_write_space_firmware(struct vb2_context *ctx);
+
+/**
+ * Lock must be called.
+ */
+uint32_t antirollback_lock_space_firmware(void);
+
+/* Read recovery hash data from TPM. */
+uint32_t antirollback_read_space_rec_hash(uint8_t *data, uint32_t size);
+/* Write new hash data to recovery space in TPM. */
+uint32_t antirollback_write_space_rec_hash(const uint8_t *data, uint32_t size);
+/* Lock down recovery hash space in TPM. */
+uint32_t antirollback_lock_space_rec_hash(void);
+
+/* Start of the root of trust */
+uint32_t vboot_setup_tpm(struct vb2_context *ctx);
+
+/* vboot_extend_pcr function for vb2 context */
+uint32_t vboot_extend_pcr(struct vb2_context *ctx, int pcr,
+ enum vb2_pcr_digest which_digest);
+
+#endif /* ANTIROLLBACK_H_ */
diff --git a/src/security/vboot/secdata_mock.c b/src/security/vboot/secdata_mock.c
index 4ea53558f9..3075d335f6 100644
--- a/src/security/vboot/secdata_mock.c
+++ b/src/security/vboot/secdata_mock.c
@@ -32,54 +32,50 @@
* stored in the TPM NVRAM.
*/
-#include <security/tpm/antirollback.h>
#include <stdlib.h>
-#include <security/tpm/tss.h>
+#include <security/tpm/tspi.h>
#include <vb2_api.h>
-uint32_t tpm_extend_pcr(struct vb2_context *ctx, int pcr,
- enum vb2_pcr_digest which_digest)
+#include "antirollback.h"
+
+int vb2ex_tpm_clear_owner(struct vb2_context *ctx)
{
- return TPM_SUCCESS;
+ return VB2_SUCCESS;
}
-uint32_t tpm_clear_and_reenable(void)
+uint32_t vboot_extend_pcr(struct vb2_context *ctx, int pcr,
+ enum vb2_pcr_digest which_digest)
{
- return TPM_SUCCESS;
+ return VB2_SUCCESS;
}
uint32_t antirollback_read_space_firmware(struct vb2_context *ctx)
{
vb2api_secdata_create(ctx);
- return TPM_SUCCESS;
+ return VB2_SUCCESS;
}
uint32_t antirollback_write_space_firmware(struct vb2_context *ctx)
{
- return TPM_SUCCESS;
+ return VB2_SUCCESS;
}
uint32_t antirollback_lock_space_firmware()
{
- return TPM_SUCCESS;
+ return VB2_SUCCESS;
}
uint32_t antirollback_lock_space_rec_hash(void)
{
- return TPM_SUCCESS;
+ return VB2_SUCCESS;
}
uint32_t antirollback_read_space_rec_hash(uint8_t *data, uint32_t size)
{
- return TPM_SUCCESS;
+ return VB2_SUCCESS;
}
uint32_t antirollback_write_space_rec_hash(const uint8_t *data, uint32_t size)
{
- return TPM_SUCCESS;
-}
-
-uint32_t tlcl_lib_init(void)
-{
return VB2_SUCCESS;
}
diff --git a/src/security/vboot/secdata_tpm.c b/src/security/vboot/secdata_tpm.c
index a757f02f98..57c107bc3a 100644
--- a/src/security/vboot/secdata_tpm.c
+++ b/src/security/vboot/secdata_tpm.c
@@ -32,10 +32,10 @@
* stored in the TPM NVRAM.
*/
-#include <security/tpm/antirollback.h>
+#include <security/vboot/antirollback.h>
#include <stdlib.h>
#include <string.h>
-#include <security/tpm/tss.h>
+#include <security/tpm/tspi.h>
#include <vb2_api.h>
#include <console/console.h>
@@ -64,7 +64,7 @@
static uint32_t safe_write(uint32_t index, const void *data, uint32_t length);
-uint32_t tpm_extend_pcr(struct vb2_context *ctx, int pcr,
+uint32_t vboot_extend_pcr(struct vb2_context *ctx, int pcr,
enum vb2_pcr_digest which_digest)
{
uint8_t buffer[VB2_PCR_DIGEST_RECOMMENDED_SIZE];
@@ -74,10 +74,10 @@ uint32_t tpm_extend_pcr(struct vb2_context *ctx, int pcr,
rv = vb2api_get_pcr_digest(ctx, which_digest, buffer, &size);
if (rv != VB2_SUCCESS)
return rv;
- if (size < TPM_PCR_DIGEST)
+ if (size < TPM_PCR_MINIMUM_DIGEST_SIZE)
return VB2_ERROR_UNKNOWN;
- return tlcl_extend(pcr, buffer, NULL);
+ return tpm_extend_pcr(pcr, buffer, NULL);
}
static uint32_t read_space_firmware(struct vb2_context *ctx)
@@ -158,6 +158,35 @@ static const uint8_t secdata_kernel[] = {
static const uint8_t rec_hash_data[REC_HASH_NV_SIZE] = { };
#if IS_ENABLED(CONFIG_TPM2)
+/*
+ * Different sets of NVRAM space attributes apply to the "ro" spaces,
+ * i.e. those which should not be possible to delete or modify once
+ * the RO exits, and the rest of the NVRAM spaces.
+ */
+const static TPMA_NV ro_space_attributes = {
+ .TPMA_NV_PPWRITE = 1,
+ .TPMA_NV_AUTHREAD = 1,
+ .TPMA_NV_PPREAD = 1,
+ .TPMA_NV_PLATFORMCREATE = 1,
+ .TPMA_NV_WRITE_STCLEAR = 1,
+ .TPMA_NV_POLICY_DELETE = 1,
+};
+
+const static TPMA_NV rw_space_attributes = {
+ .TPMA_NV_PPWRITE = 1,
+ .TPMA_NV_AUTHREAD = 1,
+ .TPMA_NV_PPREAD = 1,
+ .TPMA_NV_PLATFORMCREATE = 1,
+};
+
+/*
+ * This policy digest was obtained using TPM2_PolicyPCR
+ * selecting only PCR_0 with a value of all zeros.
+ */
+const static uint8_t pcr0_unchanged_policy[] = {
+ 0x09, 0x93, 0x3C, 0xCE, 0xEB, 0xB4, 0x41, 0x11, 0x18, 0x81, 0x1D,
+ 0xD4, 0x47, 0x78, 0x80, 0x08, 0x88, 0x86, 0x62, 0x2D, 0xD7, 0x79,
+ 0x94, 0x46, 0x62, 0x26, 0x68, 0x8E, 0xEE, 0xE6, 0x6A, 0xA1};
/* Nothing special in the TPM2 path yet. */
static uint32_t safe_write(uint32_t index, const void *data, uint32_t length)
@@ -166,11 +195,13 @@ static uint32_t safe_write(uint32_t index, const void *data, uint32_t length)
}
static uint32_t set_space(const char *name, uint32_t index, const void *data,
- uint32_t length)
+ uint32_t length, const TPMA_NV nv_attributes,
+ const uint8_t *nv_policy, size_t nv_policy_size)
{
uint32_t rv;
- rv = tlcl_define_space(index, length);
+ rv = tlcl_define_space(index, length, nv_attributes, nv_policy,
+ nv_policy_size);
if (rv == TPM_E_NV_DEFINED) {
/*
* Continue with writing: it may be defined, but not written
@@ -193,19 +224,22 @@ static uint32_t set_space(const char *name, uint32_t index, const void *data,
static uint32_t set_firmware_space(const void *firmware_blob)
{
return set_space("firmware", FIRMWARE_NV_INDEX, firmware_blob,
- VB2_SECDATA_SIZE);
+ VB2_SECDATA_SIZE, ro_space_attributes,
+ pcr0_unchanged_policy, sizeof(pcr0_unchanged_policy));
}
static uint32_t set_kernel_space(const void *kernel_blob)
{
return set_space("kernel", KERNEL_NV_INDEX, kernel_blob,
- sizeof(secdata_kernel));
+ sizeof(secdata_kernel), rw_space_attributes, NULL, 0);
}
static uint32_t set_rec_hash_space(const uint8_t *data)
{
return set_space("MRC Hash", REC_HASH_NV_INDEX, data,
- REC_HASH_NV_SIZE);
+ REC_HASH_NV_SIZE,
+ ro_space_attributes, pcr0_unchanged_policy,
+ sizeof(pcr0_unchanged_policy));
}
static uint32_t _factory_initialize_tpm(struct vb2_context *ctx)
@@ -228,13 +262,6 @@ static uint32_t _factory_initialize_tpm(struct vb2_context *ctx)
return TPM_SUCCESS;
}
-uint32_t tpm_clear_and_reenable(void)
-{
- VBDEBUG("TPM: Clear and re-enable\n");
- RETURN_ON_FAILURE(tlcl_force_clear());
- return TPM_SUCCESS;
-}
-
uint32_t antirollback_lock_space_firmware(void)
{
return tlcl_lock_nv_write(FIRMWARE_NV_INDEX);
@@ -247,16 +274,6 @@ uint32_t antirollback_lock_space_rec_hash(void)
#else
-uint32_t tpm_clear_and_reenable(void)
-{
- VBDEBUG("TPM: Clear and re-enable\n");
- RETURN_ON_FAILURE(tlcl_force_clear());
- RETURN_ON_FAILURE(tlcl_set_enable());
- RETURN_ON_FAILURE(tlcl_set_deactivated(0));
-
- return TPM_SUCCESS;
-}
-
/**
* Like tlcl_write(), but checks for write errors due to hitting the 64-write
* limit and clears the TPM when that happens. This can only happen when the
@@ -416,110 +433,22 @@ static uint32_t factory_initialize_tpm(struct vb2_context *ctx)
return TPM_SUCCESS;
}
-/*
- * SetupTPM starts the TPM and establishes the root of trust for the
- * anti-rollback mechanism. SetupTPM can fail for three reasons. 1 A bug. 2 a
- * TPM hardware failure. 3 An unexpected TPM state due to some attack. In
- * general we cannot easily distinguish the kind of failure, so our strategy is
- * to reboot in recovery mode in all cases. The recovery mode calls SetupTPM
- * again, which executes (almost) the same sequence of operations. There is a
- * good chance that, if recovery mode was entered because of a TPM failure, the
- * failure will repeat itself. (In general this is impossible to guarantee
- * because we have no way of creating the exact TPM initial state at the
- * previous boot.) In recovery mode, we ignore the failure and continue, thus
- * giving the recovery kernel a chance to fix things (that's why we don't set
- * bGlobalLock). The choice is between a knowingly insecure device and a
- * bricked device.
- *
- * As a side note, observe that we go through considerable hoops to avoid using
- * the STCLEAR permissions for the index spaces. We do this to avoid writing
- * to the TPM flashram at every reboot or wake-up, because of concerns about
- * the durability of the NVRAM.
- */
-uint32_t setup_tpm(struct vb2_context *ctx)
+uint32_t vboot_setup_tpm(struct vb2_context *ctx)
{
- uint8_t disable;
- uint8_t deactivated;
uint32_t result;
- RETURN_ON_FAILURE(tlcl_lib_init());
-
- /* Handle special init for S3 resume path */
- if (ctx->flags & VB2_CONTEXT_S3_RESUME) {
- result = tlcl_resume();
- if (result == TPM_E_INVALID_POSTINIT)
- printk(BIOS_DEBUG, "TPM: Already initialized.\n");
- return TPM_SUCCESS;
- }
-
- if (IS_ENABLED(CONFIG_VBOOT_SOFT_REBOOT_WORKAROUND)) {
- result = tlcl_startup();
- if (result == TPM_E_INVALID_POSTINIT) {
- /*
- * Some prototype hardware doesn't reset the TPM on a CPU
- * reset. We do a hard reset to get around this.
- */
- VBDEBUG("TPM: soft reset detected\n");
- ctx->flags |= VB2_CONTEXT_SECDATA_WANTS_REBOOT;
- return TPM_E_MUST_REBOOT;
- } else if (result != TPM_SUCCESS) {
- VBDEBUG("TPM: tlcl_startup returned %08x\n", result);
- return result;
- }
- } else
- RETURN_ON_FAILURE(tlcl_startup());
-
- /*
- * Some TPMs start the self test automatically at power on. In that case
- * we don't need to call ContinueSelfTest. On some (other) TPMs,
- * continue_self_test may block. In that case, we definitely don't want
- * to call it here. For TPMs in the intersection of these two sets, we
- * are screwed. (In other words: TPMs that require manually starting the
- * self-test AND block will have poor performance until we split
- * tlcl_send_receive() into send() and receive(), and have a state
- * machine to control setup.)
- *
- * This comment is likely to become obsolete in the near future, so
- * don't trust it. It may have not been updated.
- */
-#ifdef TPM_MANUAL_SELFTEST
-#ifdef TPM_BLOCKING_CONTINUESELFTEST
-#warning "lousy TPM!"
-#endif
- RETURN_ON_FAILURE(tlcl_continue_self_test());
-#endif
- result = tlcl_assert_physical_presence();
- if (result != TPM_SUCCESS) {
- /*
- * It is possible that the TPM was delivered with the physical
- * presence command disabled. This tries enabling it, then
- * tries asserting PP again.
- */
- RETURN_ON_FAILURE(tlcl_physical_presence_cmd_enable());
- RETURN_ON_FAILURE(tlcl_assert_physical_presence());
- }
-
- /* Check that the TPM is enabled and activated. */
- RETURN_ON_FAILURE(tlcl_get_flags(&disable, &deactivated, NULL));
- if (disable || deactivated) {
- VBDEBUG("TPM: disabled (%d) or deactivated (%d). Fixing...\n",
- disable, deactivated);
- RETURN_ON_FAILURE(tlcl_set_enable());
- RETURN_ON_FAILURE(tlcl_set_deactivated(0));
- VBDEBUG("TPM: Must reboot to re-enable\n");
+ result = tpm_setup(ctx->flags & VB2_CONTEXT_S3_RESUME);
+ if (result == TPM_E_MUST_REBOOT)
ctx->flags |= VB2_CONTEXT_SECDATA_WANTS_REBOOT;
- return TPM_E_MUST_REBOOT;
- }
- VBDEBUG("TPM: SetupTPM() succeeded\n");
- return TPM_SUCCESS;
+ return result;
}
uint32_t antirollback_read_space_firmware(struct vb2_context *ctx)
{
uint32_t rv;
- rv = setup_tpm(ctx);
+ rv = vboot_setup_tpm(ctx);
if (rv)
return rv;
@@ -585,3 +514,13 @@ uint32_t antirollback_write_space_rec_hash(const uint8_t *data, uint32_t size)
return write_secdata(REC_HASH_NV_INDEX, data, size);
}
+
+int vb2ex_tpm_clear_owner(struct vb2_context *ctx)
+{
+ uint32_t rv;
+ printk(BIOS_INFO, "Clearing TPM owner\n");
+ rv = tpm_clear_and_reenable();
+ if (rv)
+ return VB2_ERROR_EX_TPM_CLEAR_OWNER;
+ return VB2_SUCCESS;
+}
diff --git a/src/security/vboot/vboot_logic.c b/src/security/vboot/vboot_logic.c
index 2600f84945..9710ae2e7c 100644
--- a/src/security/vboot/vboot_logic.c
+++ b/src/security/vboot/vboot_logic.c
@@ -13,7 +13,6 @@
* GNU General Public License for more details.
*/
-#include <security/tpm/antirollback.h>
#include <arch/exception.h>
#include <assert.h>
#include <bootmode.h>
@@ -27,6 +26,8 @@
#include <security/vboot/misc.h>
#include <security/vboot/vbnv.h>
+#include "antirollback.h"
+
/* The max hash size to expect is for SHA512. */
#define VBOOT_MAX_HASH_SIZE VB2_SHA512_DIGEST_SIZE
@@ -53,16 +54,6 @@ void vb2ex_printf(const char *func, const char *fmt, ...)
return;
}
-int vb2ex_tpm_clear_owner(struct vb2_context *ctx)
-{
- uint32_t rv;
- printk(BIOS_INFO, "Clearing TPM owner\n");
- rv = tpm_clear_and_reenable();
- if (rv)
- return VB2_ERROR_EX_TPM_CLEAR_OWNER;
- return VB2_SUCCESS;
-}
-
int vb2ex_read_resource(struct vb2_context *ctx,
enum vb2_resource_index index,
uint32_t offset,
@@ -290,8 +281,8 @@ static void save_if_needed(struct vb2_context *ctx)
static uint32_t extend_pcrs(struct vb2_context *ctx)
{
- return tpm_extend_pcr(ctx, 0, BOOT_MODE_PCR) ||
- tpm_extend_pcr(ctx, 1, HWID_DIGEST_PCR);
+ return vboot_extend_pcr(ctx, 0, BOOT_MODE_PCR) ||
+ vboot_extend_pcr(ctx, 1, HWID_DIGEST_PCR);
}
/**