174 lines
5.3 KiB
C
174 lines
5.3 KiB
C
/* Copyright (c) 2013 The Chromium OS Authors. All rights reserved.
|
|
* Use of this source code is governed by a BSD-style license that can be
|
|
* found in the LICENSE file.
|
|
*
|
|
* Functions for querying, manipulating and locking secure data spaces
|
|
* stored in the TPM NVRAM.
|
|
*/
|
|
|
|
#ifndef VBOOT_REFERENCE_SECDATA_TPM_H_
|
|
#define VBOOT_REFERENCE_SECDATA_TPM_H_
|
|
|
|
#include "2return_codes.h"
|
|
#include "2sysincludes.h"
|
|
#include "tss_constants.h"
|
|
|
|
/* TPM NVRAM location indices. */
|
|
#define FIRMWARE_NV_INDEX 0x1007
|
|
#define KERNEL_NV_INDEX 0x1008
|
|
/* This is just an opaque space for backup purposes */
|
|
#define BACKUP_NV_INDEX 0x1009
|
|
#define BACKUP_NV_SIZE 16
|
|
#define FWMP_NV_INDEX 0x100a
|
|
#define FWMP_NV_MAX_SIZE 128
|
|
#define REC_HASH_NV_INDEX 0x100b
|
|
#define REC_HASH_NV_SIZE VB2_SHA256_DIGEST_SIZE
|
|
/* Space to hold a temporary SHA256 digest of a public key for USB autoconfig;
|
|
* see crbug.com/845589. */
|
|
#define OOBE_USB_AUTOCONFIG_KEY_DIGEST_NV_INDEX 0x100c
|
|
#define OOBE_USB_AUTOCONFIG_KEY_DIGEST_NV_SIZE VB2_SHA256_DIGEST_SIZE
|
|
|
|
/* Structure definitions for TPM spaces */
|
|
|
|
/* Kernel space - KERNEL_NV_INDEX, locked with physical presence. */
|
|
#define ROLLBACK_SPACE_KERNEL_VERSION 2
|
|
#define ROLLBACK_SPACE_KERNEL_UID 0x4752574C /* 'GRWL' */
|
|
|
|
typedef struct RollbackSpaceKernel {
|
|
/* Struct version, for backwards compatibility */
|
|
uint8_t struct_version;
|
|
/* Unique ID to detect space redefinition */
|
|
uint32_t uid;
|
|
/* Kernel versions */
|
|
uint32_t kernel_versions;
|
|
/* Reserved for future expansion */
|
|
uint8_t reserved[3];
|
|
/* Checksum (v2 and later only) */
|
|
uint8_t crc8;
|
|
} __attribute__((packed)) RollbackSpaceKernel;
|
|
|
|
/* Flags for firmware space */
|
|
/*
|
|
* Last boot was developer mode. TPM ownership is cleared when transitioning
|
|
* to/from developer mode.
|
|
*/
|
|
#define FLAG_LAST_BOOT_DEVELOPER 0x01
|
|
/*
|
|
* Some systems may not have a dedicated dev-mode switch, but enter and leave
|
|
* dev-mode through some recovery-mode magic keypresses. For those systems, the
|
|
* dev-mode "switch" state is in this bit (0=normal, 1=dev). To make it work, a
|
|
* new flag is passed to VbInit(), indicating that the system lacks a physical
|
|
* dev-mode switch. If a physical switch is present, this bit is ignored.
|
|
*/
|
|
#define FLAG_VIRTUAL_DEV_MODE_ON 0x02
|
|
|
|
/* Firmware space - FIRMWARE_NV_INDEX, locked with global lock. */
|
|
#define ROLLBACK_SPACE_FIRMWARE_VERSION 2
|
|
|
|
typedef struct RollbackSpaceFirmware {
|
|
/* Struct version, for backwards compatibility */
|
|
uint8_t struct_version;
|
|
/* Flags (see FLAG_* above) */
|
|
uint8_t flags;
|
|
/* Firmware versions */
|
|
uint32_t fw_versions;
|
|
/* Reserved for future expansion */
|
|
uint8_t reserved[3];
|
|
/* Checksum (v2 and later only) */
|
|
uint8_t crc8;
|
|
} __attribute__((packed)) RollbackSpaceFirmware;
|
|
|
|
#define FWMP_HASH_SIZE 32 /* Enough for SHA-256 */
|
|
|
|
/* Firmware management parameters */
|
|
struct RollbackSpaceFwmp {
|
|
/* CRC-8 of fields following struct_size */
|
|
uint8_t crc;
|
|
/* Structure size in bytes */
|
|
uint8_t struct_size;
|
|
/* Structure version */
|
|
uint8_t struct_version;
|
|
/* Reserved; ignored by current reader */
|
|
uint8_t reserved0;
|
|
/* Flags; see enum fwmp_flags */
|
|
uint32_t flags;
|
|
/* Hash of developer kernel key */
|
|
uint8_t dev_key_hash[FWMP_HASH_SIZE];
|
|
} __attribute__((packed));
|
|
|
|
#define ROLLBACK_SPACE_FWMP_VERSION 0x10 /* 1.0 */
|
|
|
|
enum fwmp_flags {
|
|
FWMP_DEV_DISABLE_BOOT = (1 << 0),
|
|
FWMP_DEV_DISABLE_RECOVERY = (1 << 1),
|
|
FWMP_DEV_ENABLE_USB = (1 << 2),
|
|
FWMP_DEV_ENABLE_LEGACY = (1 << 3),
|
|
FWMP_DEV_ENABLE_OFFICIAL_ONLY = (1 << 4),
|
|
FWMP_DEV_USE_KEY_HASH = (1 << 5),
|
|
/* CCD = case-closed debugging on cr50; flag implemented on cr50 */
|
|
FWMP_DEV_DISABLE_CCD_UNLOCK = (1 << 6),
|
|
};
|
|
|
|
/* All functions return TPM_SUCCESS (zero) if successful, non-zero if error */
|
|
|
|
/*
|
|
* These functions are callable from VbSelectAndLoadKernel(). They may use
|
|
* global variables.
|
|
*/
|
|
|
|
uint32_t ReadSpaceFirmware(RollbackSpaceFirmware *rsf);
|
|
uint32_t WriteSpaceFirmware(RollbackSpaceFirmware *rsf);
|
|
uint32_t ReadSpaceKernel(RollbackSpaceKernel *rsk);
|
|
uint32_t WriteSpaceKernel(RollbackSpaceKernel *rsk);
|
|
|
|
/**
|
|
* Read stored kernel version.
|
|
*/
|
|
uint32_t RollbackKernelRead(uint32_t *version);
|
|
|
|
/**
|
|
* Write stored kernel version.
|
|
*/
|
|
uint32_t RollbackKernelWrite(uint32_t version);
|
|
|
|
/**
|
|
* Lock must be called. Internally, it's ignored in recovery mode.
|
|
*/
|
|
uint32_t RollbackKernelLock(int recovery_mode);
|
|
|
|
/**
|
|
* Read and validate firmware management parameters.
|
|
*
|
|
* Absence of a FWMP is not an error; in this case, fwmp will be cleared.
|
|
*
|
|
* Returns non-zero if error.
|
|
*/
|
|
uint32_t RollbackFwmpRead(struct RollbackSpaceFwmp *fwmp);
|
|
|
|
/****************************************************************************/
|
|
|
|
/*
|
|
* The following functions are internal apis, listed here for use by unit tests
|
|
* only.
|
|
*/
|
|
|
|
/**
|
|
* Issue a TPM_Clear and reenable/reactivate the TPM.
|
|
*/
|
|
uint32_t TPMClearAndReenable(void);
|
|
|
|
/**
|
|
* Like TlclWrite(), but checks for write errors due to hitting the 64-write
|
|
* limit and clears the TPM when that happens. This can only happen when the
|
|
* TPM is unowned, so it is OK to clear it (and we really have no choice).
|
|
* This is not expected to happen frequently, but it could happen.
|
|
*/
|
|
uint32_t SafeWrite(uint32_t index, const void *data, uint32_t length);
|
|
|
|
/**
|
|
* Utility function to turn the virtual dev-mode flag on or off. 0=off, 1=on.
|
|
*/
|
|
vb2_error_t SetVirtualDevMode(int val);
|
|
|
|
#endif /* VBOOT_REFERENCE_SECDATA_TPM_H_ */
|