coreboot-gerrit March 2024

coreboot-gerrit@coreboot.org

1 participants
3668 discussions

[M] Change in coreboot[main]: security/tpm: replace CONFIG(TPMx) checks with runtime check
by Sergii Dmytruk (Code Review) 21 Mar '24

21 Mar '24

Attention is currently required from: Christian Walter, Cliff Huang, Jan Samek, Julius Werner, Jérémy Compostella, Krystian Hebel, Lance Zhao, Martin L Roth, Michał Żygowski, Tim Wawrzynczak. Sergii Dmytruk has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/69161?usp=email ) Change subject: security/tpm: replace CONFIG(TPMx) checks with runtime check ...................................................................... Patch Set 34: (4 comments) File src/security/vboot/secdata_tpm.c: https://review.coreboot.org/c/coreboot/+/69161/comment/a8452cca_9bcb8da8 : PS34, Line 33: CONFIG(TPM1) > Here too Done https://review.coreboot.org/c/coreboot/+/69161/comment/c1b84bb3_eb3cc74d : PS34, Line 615: } > I think this would be cleaner as […] Done https://review.coreboot.org/c/coreboot/+/69161/comment/22a08422_8c57cc03 : PS34, Line 619: #if CONFIG(TPM1) > While you're rewriting all this, would you mind just separating the TPM version-specific stuff out i […] Did that in CB:81415 to not do any substantial code changes and move code at the same time. https://review.coreboot.org/c/coreboot/+/69161/comment/22b684ab_82589b5e : PS34, Line 632: #if CONFIG(TPM1) > You shouldn't need these either, same reason. Done -- To view, visit https://review.coreboot.org/c/coreboot/+/69161?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: Id9cc25aad8d1d7bfad12b7a92059b1b3641bbfa9 Gerrit-Change-Number: 69161 Gerrit-PatchSet: 34 Gerrit-Owner: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> Gerrit-Reviewer: Christian Walter <christian.walter(a)9elements.com> Gerrit-Reviewer: Cliff Huang <cliff.huang(a)intel.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Jérémy Compostella <jeremy.compostella(a)intel.com> Gerrit-Reviewer: Krystian Hebel <krystian.hebel(a)3mdeb.com> Gerrit-Reviewer: Lance Zhao <lance.zhao(a)gmail.com> Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com> Gerrit-Reviewer: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Tim Wawrzynczak <inforichland(a)gmail.com> Gerrit-Reviewer: Yu-Ping Wu <yupingso(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Jan Samek <jan.samek(a)siemens.com> Gerrit-Attention: Lance Zhao <lance.zhao(a)gmail.com> Gerrit-Attention: Cliff Huang <cliff.huang(a)intel.com> Gerrit-Attention: Martin L Roth <gaumless(a)gmail.com> Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Attention: Jérémy Compostella <jeremy.compostella(a)intel.com> Gerrit-Attention: Christian Walter <christian.walter(a)9elements.com> Gerrit-Attention: Tim Wawrzynczak <inforichland(a)gmail.com> Gerrit-Attention: Julius Werner <jwerner(a)chromium.org> Gerrit-Attention: Krystian Hebel <krystian.hebel(a)3mdeb.com> Gerrit-Attention: Jan Samek <jan.samek(a)siemens.com> Gerrit-Comment-Date: Thu, 21 Mar 2024 19:21:00 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Julius Werner <jwerner(a)chromium.org> Gerrit-MessageType: comment

1 0

[XL] Change in coreboot[main]: security/vboot: extract secdata_tpm{1,2}.c
by Sergii Dmytruk (Code Review) 21 Mar '24

21 Mar '24

Attention is currently required from: Julius Werner, Yu-Ping Wu. Sergii Dmytruk has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/81415?usp=email ) Change subject: security/vboot: extract secdata_tpm{1,2}.c ...................................................................... security/vboot: extract secdata_tpm{1,2}.c Most of the original secdata_tpm.c was TPM2-specific implementation. Just moving the code around, with trivial tweaks: - drop now unnecessary #ifdef directives from _factory_initialize_tpm() - drop leading underscore from _factory_initialize_tpm{1,2}() (external identifiers should not start with an underscore in C) - drop unused <security/vboot/tpm_common.h> include and sub-includes of tss.h which should be considered its part (so this isn't an indirect inclusion) Change-Id: I0090b748d7d3b2d76a941b87b5885682fd81c4fc Signed-off-by: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> --- M src/security/vboot/Makefile.mk M src/security/vboot/secdata_tpm.c A src/security/vboot/secdata_tpm1.c A src/security/vboot/secdata_tpm2.c A src/security/vboot/secdata_tpm_private.h 5 files changed, 585 insertions(+), 564 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/15/81415/1 diff --git a/src/security/vboot/Makefile.mk b/src/security/vboot/Makefile.mk index 23271ea..48a6c9d 100644 --- a/src/security/vboot/Makefile.mk +++ b/src/security/vboot/Makefile.mk @@ -118,6 +118,14 @@ verstage-y += secdata_tpm.c romstage-y += secdata_tpm.c ramstage-y += secdata_tpm.c + +verstage-$(CONFIG_TPM1) += secdata_tpm1.c +romstage-$(CONFIG_TPM1) += secdata_tpm1.c +ramstage-$(CONFIG_TPM1) += secdata_tpm1.c + +verstage-$(CONFIG_TPM2) += secdata_tpm2.c +romstage-$(CONFIG_TPM2) += secdata_tpm2.c +ramstage-$(CONFIG_TPM2) += secdata_tpm2.c endif verstage-$(CONFIG_TPM) += tpm_common.c diff --git a/src/security/vboot/secdata_tpm.c b/src/security/vboot/secdata_tpm.c index f60a5e2..82198fd 100644 --- a/src/security/vboot/secdata_tpm.c +++ b/src/security/vboot/secdata_tpm.c @@ -5,28 +5,12 @@ * stored in the TPM NVRAM. */ -#include <security/vboot/antirollback.h> -#include <security/vboot/tpm_common.h> -#include <security/tpm/tspi.h> -#include <security/tpm/tss.h> -#include <security/tpm/tss/tcg-1.2/tss_structures.h> -#include <security/tpm/tss/tcg-2.0/tss_structures.h> -#include <vb2_api.h> #include <console/console.h> +#include <security/tpm/tspi.h> +#include <security/vboot/antirollback.h> +#include <vb2_api.h> -#define VBDEBUG(format, args...) \ - printk(BIOS_INFO, "%s():%d: " format, __func__, __LINE__, ## args) - -#define RETURN_ON_FAILURE(tpm_cmd) do { \ - tpm_result_t rc_; \ - if ((rc_ = (tpm_cmd)) != TPM_SUCCESS) { \ - VBDEBUG("Antirollback: %08x returned by " #tpm_cmd \ - "\n", (tpm_result_t)rc_); \ - return rc_; \ - } \ - } while (0) - -static tpm_result_t safe_write(uint32_t index, const void *data, uint32_t length); +#include "secdata_tpm_private.h" tpm_result_t antirollback_read_space_kernel(struct vb2_context *ctx) { @@ -69,554 +53,12 @@ return TPM_SUCCESS; } -#if CONFIG(TPM2) - -static tpm_result_t read_space_mrc_hash(uint32_t index, uint8_t *data) -{ - RETURN_ON_FAILURE(tlcl_read(index, data, - HASH_NV_SIZE)); - return TPM_SUCCESS; -} - -/* - * This is used to initialize the TPM space for recovery hash after defining - * it. Since there is no data available to calculate hash at the point where TPM - * space is defined, initialize it to all 0s. - */ -static const uint8_t mrc_hash_data[HASH_NV_SIZE] = { }; - -/* - * Different sets of NVRAM space attributes apply to the "ro" spaces, - * i.e. those which should not be possible to delete or modify once - * the RO exits, and the rest of the NVRAM spaces. - */ -static const TPMA_NV ro_space_attributes = { - .TPMA_NV_PPWRITE = 1, - .TPMA_NV_AUTHREAD = 1, - .TPMA_NV_PPREAD = 1, - .TPMA_NV_PLATFORMCREATE = 1, - .TPMA_NV_WRITE_STCLEAR = 1, - .TPMA_NV_POLICY_DELETE = 1, -}; - -static const TPMA_NV rw_space_attributes = { - .TPMA_NV_PPWRITE = 1, - .TPMA_NV_AUTHREAD = 1, - .TPMA_NV_PPREAD = 1, - .TPMA_NV_PLATFORMCREATE = 1, - .TPMA_NV_WRITE_STCLEAR = 1, -}; - -static const TPMA_NV rw_auth_space_attributes = { - .TPMA_NV_AUTHWRITE = 1, - .TPMA_NV_AUTHREAD = 1, - .TPMA_NV_NO_DA = 1, - .TPMA_NV_PPREAD = 1, - .TPMA_NV_PPWRITE = 1, - .TPMA_NV_PLATFORMCREATE = 1, - .TPMA_NV_WRITE_STCLEAR = 1, - .TPMA_NV_POLICY_DELETE = 1, -}; - -static const TPMA_NV fwmp_attr = { - .TPMA_NV_PLATFORMCREATE = 1, - .TPMA_NV_OWNERWRITE = 1, - .TPMA_NV_AUTHREAD = 1, - .TPMA_NV_PPREAD = 1, - .TPMA_NV_PPWRITE = 1, -}; - -/* Attributes for spaces that enable zero-touch enrollment (ZTE) */ -static const TPMA_NV zte_attr = { - .TPMA_NV_PLATFORMCREATE = 1, - .TPMA_NV_WRITEDEFINE = 1, - .TPMA_NV_AUTHWRITE = 1, - .TPMA_NV_AUTHREAD = 1, - .TPMA_NV_PPWRITE = 1, - .TPMA_NV_PPREAD = 1, - .TPMA_NV_NO_DA = 1, - .TPMA_NV_POLICY_DELETE = 1, -}; - -static const TPMA_NV zte_rma_bytes_attr = { - .TPMA_NV_PLATFORMCREATE = 1, - .TPMA_NV_BITS = 1, - .TPMA_NV_AUTHWRITE = 1, - .TPMA_NV_AUTHREAD = 1, - .TPMA_NV_PPWRITE = 1, - .TPMA_NV_PPREAD = 1, - .TPMA_NV_NO_DA = 1, - .TPMA_NV_POLICY_DELETE = 1, -}; - -static const TPMA_NV rw_orderly_counter_attributes = { - .TPMA_NV_COUNTER = 1, - .TPMA_NV_ORDERLY = 1, - .TPMA_NV_AUTHREAD = 1, - .TPMA_NV_AUTHWRITE = 1, - .TPMA_NV_PLATFORMCREATE = 1, - .TPMA_NV_WRITE_STCLEAR = 1, - .TPMA_NV_PPREAD = 1, - .TPMA_NV_PPWRITE = 1, - .TPMA_NV_NO_DA = 1, -}; - -/* - * This policy digest was obtained using TPM2_PolicyOR on 3 digests - * corresponding to a sequence of - * -) TPM2_PolicyCommandCode(TPM_CC_NV_UndefineSpaceSpecial), - * -) TPM2_PolicyPCR(PCR0, <extended_value>). - * where <extended value> is - * 1) all zeros = initial, unextended state: - * - Value to extend to initial PCR0: - * <none> - * - Resulting PCR0: - * 0000000000000000000000000000000000000000000000000000000000000000 - * - Policy digest for PolicyCommandCode + PolicyPCR: - * 4B44FC4192DB5AD7167E0135708FD374890A06BFB56317DF01F24F2226542A3F - * 2) result of extending (SHA1(0x00|0x01|0x00) | 00s to SHA256 size) - * - Value to extend to initial PCR0: - * 62571891215b4efc1ceab744ce59dd0b66ea6f73000000000000000000000000 - * - Resulting PCR0: - * 9F9EA866D3F34FE3A3112AE9CB1FBABC6FFE8CD261D42493BC6842A9E4F93B3D - * - Policy digest for PolicyCommandCode + PolicyPCR: - * CB5C8014E27A5F7586AAE42DB4F9776A977BCBC952CA61E33609DA2B2C329418 - * 3) result of extending (SHA1(0x01|0x01|0x00) | 00s to SHA256 size) - * - Value to extend to initial PCR0: - * 47ec8d98366433dc002e7721c9e37d5067547937000000000000000000000000 - * - Resulting PCR0: - * 2A7580E5DA289546F4D2E0509CC6DE155EA131818954D36D49E027FD42B8C8F8 - * - Policy digest for PolicyCommandCode + PolicyPCR: - * E6EF4F0296AC3EF0F53906480985B1BE8058E0E517E5F74A5B8A415EFE339D87 - * Values #2 and #3 correspond to two forms of recovery mode as extended by - * vb2api_get_pcr_digest(). - * As a result, the digest allows deleting the space with UndefineSpaceSpecial - * at early RO stages (before extending PCR0) or from recovery mode. - */ -static const uint8_t pcr0_allowed_policy[] = { - 0x44, 0x44, 0x79, 0x00, 0xCB, 0xB8, 0x3F, 0x5B, 0x15, 0x76, 0x56, - 0x50, 0xEF, 0x96, 0x98, 0x0A, 0x2B, 0x96, 0x6E, 0xA9, 0x09, 0x04, - 0x4A, 0x01, 0xB8, 0x5F, 0xA5, 0x4A, 0x96, 0xFC, 0x59, 0x84}; - -static const uint8_t unsatisfiable_policy[VB2_SHA256_DIGEST_SIZE] = - "hmwhat if RBR beat merc in 2021"; - -static uint32_t define_space(const char *name, uint32_t index, uint32_t length, - const TPMA_NV nv_attributes, - const uint8_t *nv_policy, size_t nv_policy_size) -{ - tpm_result_t rc; - - rc = tlcl2_define_space(index, length, nv_attributes, nv_policy, nv_policy_size); - if (rc == TPM_CB_NV_DEFINED) { - /* - * Continue with writing: it may be defined, but not written - * to. In that case a subsequent tlcl_read() would still return - * TPM_BADINDEX on TPM 2.0. The cases when some non-firmware - * space is defined while the firmware space is not there - * should be rare (interrupted initialization), so no big harm - * in writing once again even if it was written already. - */ - VBDEBUG("%s: %s space already exists\n", __func__, name); - rc = TPM_SUCCESS; - } - - return rc; -} - -static tpm_result_t setup_space(const char *name, uint32_t index, const void *data, - uint32_t length, const TPMA_NV nv_attributes, - const uint8_t *nv_policy, size_t nv_policy_size) -{ - tpm_result_t rc; - - rc = define_space(name, index, length, nv_attributes, nv_policy, - nv_policy_size); - if (rc != TPM_SUCCESS) - return rc; - - return safe_write(index, data, length); -} - -static tpm_result_t setup_firmware_space(struct vb2_context *ctx) -{ - uint32_t firmware_space_size = vb2api_secdata_firmware_create(ctx); - - return setup_space("firmware", FIRMWARE_NV_INDEX, - ctx->secdata_firmware, firmware_space_size, - ro_space_attributes, pcr0_allowed_policy, - sizeof(pcr0_allowed_policy)); -} - -static tpm_result_t setup_fwmp_space(struct vb2_context *ctx) -{ - uint32_t fwmp_space_size = vb2api_secdata_fwmp_create(ctx); - - return setup_space("FWMP", FWMP_NV_INDEX, ctx->secdata_fwmp, fwmp_space_size, - fwmp_attr, NULL, 0); -} - -static tpm_result_t setup_kernel_space(struct vb2_context *ctx) -{ - uint32_t kernel_space_size = vb2api_secdata_kernel_create(ctx); - - return setup_space("kernel", KERNEL_NV_INDEX, ctx->secdata_kernel, - kernel_space_size, rw_space_attributes, NULL, 0); -} - -static tpm_result_t set_mrc_hash_space(uint32_t index, const uint8_t *data) -{ - if (index == MRC_REC_HASH_NV_INDEX) { - return setup_space("RO MRC Hash", index, data, HASH_NV_SIZE, - ro_space_attributes, pcr0_allowed_policy, - sizeof(pcr0_allowed_policy)); - } else { - return setup_space("RW MRC Hash", index, data, HASH_NV_SIZE, - rw_space_attributes, NULL, 0); - } -} - -/** - * Set up the Zero-Touch Enrollment(ZTE) related spaces. - * - * These spaces are not used by firmware, but we do need to initialize them. - */ -static tpm_result_t setup_zte_spaces(void) -{ - tpm_result_t rc; - uint64_t rma_bytes_counter_default = 0; - uint8_t rma_sn_bits_default[16]; - uint8_t board_id_default[12]; - - /* Initialize defaults: Board ID and RMA+SN Bits must be initialized - to all 0xFFs. */ - memset(rma_sn_bits_default, 0xFF, ARRAY_SIZE(rma_sn_bits_default)); - memset(board_id_default, 0xFF, ARRAY_SIZE(board_id_default)); - - /* Set up RMA + SN Bits */ - rc = setup_space("RMA + SN Bits", ZTE_RMA_SN_BITS_INDEX, - rma_sn_bits_default, sizeof(rma_sn_bits_default), - zte_attr, - unsatisfiable_policy, sizeof(unsatisfiable_policy)); - if (rc != TPM_SUCCESS) { - VBDEBUG("%s: Failed to set up RMA + SN Bits space with error %#x\n", __func__, rc); - return rc; - } - - rc = setup_space("Board ID", ZTE_BOARD_ID_NV_INDEX, - board_id_default, sizeof(board_id_default), - zte_attr, - unsatisfiable_policy, sizeof(unsatisfiable_policy)); - if (rc != TPM_SUCCESS) { - VBDEBUG("%s: Failed to set up Board ID space with error %#x\n", __func__, rc); - return rc; - } - - /* Set up RMA Bytes counter */ - rc = define_space("RMA Bytes Counter", ZTE_RMA_BYTES_COUNTER_INDEX, - sizeof(rma_bytes_counter_default), - zte_rma_bytes_attr, - unsatisfiable_policy, sizeof(unsatisfiable_policy)); - if (rc != TPM_SUCCESS) { - VBDEBUG("%s: Failed to define RMA Bytes space with error %#x\n", __func__, rc); - return rc; - } - - /* - * Since the RMA counter has the BITS attribute, we need to call - * TPM2_NV_SetBits() in order to initialize it. - */ - rc = tlcl2_set_bits(ZTE_RMA_BYTES_COUNTER_INDEX, rma_bytes_counter_default); - if (rc != TPM_SUCCESS) { - VBDEBUG("%s: Failed to init RMA Bytes counter space wit error %#x\n", - __func__, rc); - return rc; - } - - return rc; -} - -/* - * Set up enterprise rollback space. - * - * This space is not used by firmware but needs to survive owner clear. Thus, it - * needs to be created here. - */ -static tpm_result_t enterprise_rollback_create_space(void) -{ - uint8_t rollback_space_default[32] = {0}; - - return setup_space("Enterprise Rollback Space", - ENT_ROLLBACK_SPACE_INDEX, rollback_space_default, - sizeof(rollback_space_default), rw_auth_space_attributes, - unsatisfiable_policy, sizeof(unsatisfiable_policy)); -} - -static tpm_result_t setup_widevine_counter_spaces(void) -{ - uint32_t index; - tpm_result_t rc; - - for (index = 0; index < NUM_WIDEVINE_COUNTERS; index++) { - rc = define_space(WIDEVINE_COUNTER_NAME, - WIDEVINE_COUNTER_NV_INDEX(index), - WIDEVINE_COUNTER_SIZE, - rw_orderly_counter_attributes, - NULL, - 0); - if (rc != TPM_SUCCESS) - return rc; - } - return rc; -} - -static tpm_result_t _factory_initialize_tpm2(struct vb2_context *ctx) -{ - RETURN_ON_FAILURE(tlcl_force_clear()); - - /* - * Of all NVRAM spaces defined by this function the firmware space - * must be defined last, because its existence is considered an - * indication that TPM factory initialization was successfully - * completed. - */ - RETURN_ON_FAILURE(setup_kernel_space(ctx)); - - /* - * Define and set rec hash space, if available. No need to - * create the RW hash space because we will definitely boot - * once in normal mode before shipping, meaning that the space - * will get created with correct permissions while still in - * our hands. - */ - if (CONFIG(VBOOT_HAS_REC_HASH_SPACE)) - RETURN_ON_FAILURE(set_mrc_hash_space(MRC_REC_HASH_NV_INDEX, mrc_hash_data)); - - /* Define and write firmware management parameters space. */ - RETURN_ON_FAILURE(setup_fwmp_space(ctx)); - - /* - * Define and write zero-touch enrollment (ZTE) spaces. For ChromeOS devices with - * Google TPM, these are set up elsewhere via TPM vendor commands. - */ - if (CONFIG(CHROMEOS) && !(CONFIG(TPM_GOOGLE))) - RETURN_ON_FAILURE(setup_zte_spaces()); - - /* - * On TPM 2.0, create a space that survives TPM clear. This allows to - * securely lock data during enterprise rollback by binding to this - * space's value. - */ - if (CONFIG(CHROMEOS)) - RETURN_ON_FAILURE(enterprise_rollback_create_space()); - - /* Define widevine counter space. No need to increment/write to the secure counters - and are expected to be incremented during the first use. */ - if (CONFIG(VBOOT_DEFINE_WIDEVINE_COUNTERS)) - RETURN_ON_FAILURE(setup_widevine_counter_spaces()); - - RETURN_ON_FAILURE(setup_firmware_space(ctx)); - - return TPM_SUCCESS; -} - -tpm_result_t antirollback_read_space_mrc_hash(uint32_t index, uint8_t *data, uint32_t size) -{ - if (size != HASH_NV_SIZE) { - VBDEBUG("TPM: Incorrect buffer size for hash idx %#x. " - "(Expected=%#x Actual=%#x).\n", index, HASH_NV_SIZE, - size); - return TPM_CB_READ_FAILURE; - } - return read_space_mrc_hash(index, data); -} - -tpm_result_t antirollback_write_space_mrc_hash(uint32_t index, const uint8_t *data, uint32_t size) -{ - uint8_t spc_data[HASH_NV_SIZE]; - tpm_result_t rc; - - if (size != HASH_NV_SIZE) { - VBDEBUG("TPM: Incorrect buffer size for hash idx %#x. " - "(Expected=%#x Actual=%#x).\n", index, HASH_NV_SIZE, - size); - return TPM_CB_WRITE_FAILURE; - } - - rc = read_space_mrc_hash(index, spc_data); - if (rc == TPM_BADINDEX) { - /* - * If space is not defined already for hash, define - * new space. - */ - VBDEBUG("TPM: Initializing hash space.\n"); - return set_mrc_hash_space(index, data); - } - - if (rc != TPM_SUCCESS) - return rc; - - return safe_write(index, data, size); -} - -tpm_result_t antirollback_lock_space_mrc_hash(uint32_t index) -{ - return tlcl2_lock_nv_write(index); -} - -static tpm_result_t read_space_vbios_hash(uint8_t *data) -{ - RETURN_ON_FAILURE(tlcl_read(VBIOS_CACHE_NV_INDEX, data, HASH_NV_SIZE)); - return TPM_SUCCESS; -} - -tpm_result_t antirollback_read_space_vbios_hash(uint8_t *data, uint32_t size) -{ - if (size != HASH_NV_SIZE) { - VBDEBUG("TPM: Incorrect buffer size for hash idx %#x. " - "(Expected=%#x Actual=%#x).\n", VBIOS_CACHE_NV_INDEX, HASH_NV_SIZE, - size); - return TPM_CB_READ_FAILURE; - } - return read_space_vbios_hash(data); -} - -tpm_result_t antirollback_write_space_vbios_hash(const uint8_t *data, uint32_t size) -{ - uint8_t spc_data[HASH_NV_SIZE]; - tpm_result_t rc; - - if (size != HASH_NV_SIZE) { - VBDEBUG("TPM: Incorrect buffer size for hash idx %#x. " - "(Expected=%#x Actual=%#x).\n", VBIOS_CACHE_NV_INDEX, HASH_NV_SIZE, - size); - return TPM_CB_WRITE_FAILURE; - } - - rc = read_space_vbios_hash(spc_data); - if (rc == TPM_BADINDEX) { - /* - * If space is not defined already for hash, define - * new space. - */ - VBDEBUG("TPM: Initializing hash space.\n"); - return setup_space("VBIOS Cache Hash", VBIOS_CACHE_NV_INDEX, data, HASH_NV_SIZE, - rw_space_attributes, NULL, 0); - } - - if (rc != TPM_SUCCESS) - return rc; - - return safe_write(VBIOS_CACHE_NV_INDEX, data, size); -} - -#endif /* CONFIG(TPM2) */ - -#if CONFIG(TPM1) - -/** - * Similarly to safe_write(), this ensures we don't fail a DefineSpace because - * we hit the TPM write limit. This is even less likely to happen than with - * writes because we only define spaces once at initialization, but we'd - * rather be paranoid about this. - */ -static tpm_result_t safe_define_space(uint32_t index, uint32_t perm, uint32_t size) -{ - tpm_result_t rc = tlcl1_define_space(index, perm, size); - if (rc == TPM_MAXNVWRITES) { - RETURN_ON_FAILURE(tpm_clear_and_reenable()); - return tlcl1_define_space(index, perm, size); - } else { - return rc; - } -} - -static tpm_result_t _factory_initialize_tpm1(struct vb2_context *ctx) -{ - TPM_PERMANENT_FLAGS pflags; - tpm_result_t rc; - - vb2api_secdata_firmware_create(ctx); - vb2api_secdata_kernel_create_v0(ctx); - - rc = tlcl1_get_permanent_flags(&pflags); - if (rc != TPM_SUCCESS) - return rc; - - /* - * TPM may come from the factory without physical presence finalized. - * Fix if necessary. - */ - VBDEBUG("TPM: physicalPresenceLifetimeLock=%d\n", - pflags.physicalPresenceLifetimeLock); - if (!pflags.physicalPresenceLifetimeLock) { - VBDEBUG("TPM: Finalizing physical presence\n"); - RETURN_ON_FAILURE(tlcl_finalize_physical_presence()); - } - - /* - * The TPM will not enforce the NV authorization restrictions until the - * execution of a TPM_NV_DefineSpace with the handle of - * TPM_NV_INDEX_LOCK. Here we create that space if it doesn't already - * exist. */ - VBDEBUG("TPM: nvLocked=%d\n", pflags.nvLocked); - if (!pflags.nvLocked) { - VBDEBUG("TPM: Enabling NV locking\n"); - RETURN_ON_FAILURE(tlcl1_set_nv_locked()); - } - - /* Clear TPM owner, in case the TPM is already owned for some reason. */ - VBDEBUG("TPM: Clearing owner\n"); - RETURN_ON_FAILURE(tpm_clear_and_reenable()); - - /* Define and write secdata_kernel space. */ - RETURN_ON_FAILURE(safe_define_space(KERNEL_NV_INDEX, - TPM_NV_PER_PPWRITE, - VB2_SECDATA_KERNEL_SIZE_V02)); - RETURN_ON_FAILURE(safe_write(KERNEL_NV_INDEX, - ctx->secdata_kernel, - VB2_SECDATA_KERNEL_SIZE_V02)); - - /* Define and write secdata_firmware space. */ - RETURN_ON_FAILURE(safe_define_space(FIRMWARE_NV_INDEX, - TPM_NV_PER_GLOBALLOCK | - TPM_NV_PER_PPWRITE, - VB2_SECDATA_FIRMWARE_SIZE)); - RETURN_ON_FAILURE(safe_write(FIRMWARE_NV_INDEX, - ctx->secdata_firmware, - VB2_SECDATA_FIRMWARE_SIZE)); - - return TPM_SUCCESS; -} - -#endif /* CONFIG(TPM1) */ - -static tpm_result_t safe_write(uint32_t index, const void *data, uint32_t length) -{ - tpm_result_t rc = tlcl_write(index, data, length); - if (tlcl_get_family() == TPM_1 && rc == TPM_MAXNVWRITES) { - /** - * Clear the TPM on write error due to hitting the 64-write - * limit. This can only happen when the TPM is unowned, so it - * is OK to clear it (and we really have no choice). This is - * not expected to happen frequently, but it could happen. - */ - RETURN_ON_FAILURE(tpm_clear_and_reenable()); - rc = tlcl_write(index, data, length); - } - return rc; -} - static uint32_t _factory_initialize_tpm(struct vb2_context *ctx) { -#if CONFIG(TPM1) if (tlcl_get_family() == TPM_1) - return _factory_initialize_tpm1(ctx); -#endif -#if CONFIG(TPM2) + return factory_initialize_tpm1(ctx); if (tlcl_get_family() == TPM_2) - return _factory_initialize_tpm2(ctx); -#endif + return factory_initialize_tpm2(ctx); return TPM_CB_CORRUPTED_STATE; } diff --git a/src/security/vboot/secdata_tpm1.c b/src/security/vboot/secdata_tpm1.c new file mode 100644 index 0000000..b66b939 --- /dev/null +++ b/src/security/vboot/secdata_tpm1.c @@ -0,0 +1,83 @@ +/* SPDX-License-Identifier: BSD-3-Clause */ + +#include <security/tpm/tspi.h> +#include <security/tpm/tss.h> +#include <security/vboot/antirollback.h> +#include <vb2_api.h> + +#include "secdata_tpm_private.h" + +/** + * Similarly to safe_write(), this ensures we don't fail a DefineSpace because + * we hit the TPM write limit. This is even less likely to happen than with + * writes because we only define spaces once at initialization, but we'd + * rather be paranoid about this. + */ +static tpm_result_t safe_define_space(uint32_t index, uint32_t perm, uint32_t size) +{ + tpm_result_t rc = tlcl1_define_space(index, perm, size); + if (rc == TPM_MAXNVWRITES) { + RETURN_ON_FAILURE(tpm_clear_and_reenable()); + return tlcl1_define_space(index, perm, size); + } else { + return rc; + } +} + +tpm_result_t factory_initialize_tpm1(struct vb2_context *ctx) +{ + TPM_PERMANENT_FLAGS pflags; + tpm_result_t rc; + + vb2api_secdata_firmware_create(ctx); + vb2api_secdata_kernel_create_v0(ctx); + + rc = tlcl1_get_permanent_flags(&pflags); + if (rc != TPM_SUCCESS) + return rc; + + /* + * TPM may come from the factory without physical presence finalized. + * Fix if necessary. + */ + VBDEBUG("TPM: physicalPresenceLifetimeLock=%d\n", + pflags.physicalPresenceLifetimeLock); + if (!pflags.physicalPresenceLifetimeLock) { + VBDEBUG("TPM: Finalizing physical presence\n"); + RETURN_ON_FAILURE(tlcl_finalize_physical_presence()); + } + + /* + * The TPM will not enforce the NV authorization restrictions until the + * execution of a TPM_NV_DefineSpace with the handle of + * TPM_NV_INDEX_LOCK. Here we create that space if it doesn't already + * exist. */ + VBDEBUG("TPM: nvLocked=%d\n", pflags.nvLocked); + if (!pflags.nvLocked) { + VBDEBUG("TPM: Enabling NV locking\n"); + RETURN_ON_FAILURE(tlcl1_set_nv_locked()); + } + + /* Clear TPM owner, in case the TPM is already owned for some reason. */ + VBDEBUG("TPM: Clearing owner\n"); + RETURN_ON_FAILURE(tpm_clear_and_reenable()); + + /* Define and write secdata_kernel space. */ + RETURN_ON_FAILURE(safe_define_space(KERNEL_NV_INDEX, + TPM_NV_PER_PPWRITE, + VB2_SECDATA_KERNEL_SIZE_V02)); + RETURN_ON_FAILURE(safe_write(KERNEL_NV_INDEX, + ctx->secdata_kernel, + VB2_SECDATA_KERNEL_SIZE_V02)); + + /* Define and write secdata_firmware space. */ + RETURN_ON_FAILURE(safe_define_space(FIRMWARE_NV_INDEX, + TPM_NV_PER_GLOBALLOCK | + TPM_NV_PER_PPWRITE, + VB2_SECDATA_FIRMWARE_SIZE)); + RETURN_ON_FAILURE(safe_write(FIRMWARE_NV_INDEX, + ctx->secdata_firmware, + VB2_SECDATA_FIRMWARE_SIZE)); + + return TPM_SUCCESS; +} diff --git a/src/security/vboot/secdata_tpm2.c b/src/security/vboot/secdata_tpm2.c new file mode 100644 index 0000000..075e481 --- /dev/null +++ b/src/security/vboot/secdata_tpm2.c @@ -0,0 +1,446 @@ +/* SPDX-License-Identifier: BSD-3-Clause */ + +#include <security/vboot/antirollback.h> +#include <security/tpm/tss.h> +#include <vb2_api.h> + +#include "secdata_tpm_private.h" + +static tpm_result_t read_space_mrc_hash(uint32_t index, uint8_t *data) +{ + RETURN_ON_FAILURE(tlcl_read(index, data, + HASH_NV_SIZE)); + return TPM_SUCCESS; +} + +/* + * This is used to initialize the TPM space for recovery hash after defining + * it. Since there is no data available to calculate hash at the point where TPM + * space is defined, initialize it to all 0s. + */ +static const uint8_t mrc_hash_data[HASH_NV_SIZE] = { }; + +/* + * Different sets of NVRAM space attributes apply to the "ro" spaces, + * i.e. those which should not be possible to delete or modify once + * the RO exits, and the rest of the NVRAM spaces. + */ +static const TPMA_NV ro_space_attributes = { + .TPMA_NV_PPWRITE = 1, + .TPMA_NV_AUTHREAD = 1, + .TPMA_NV_PPREAD = 1, + .TPMA_NV_PLATFORMCREATE = 1, + .TPMA_NV_WRITE_STCLEAR = 1, + .TPMA_NV_POLICY_DELETE = 1, +}; + +static const TPMA_NV rw_space_attributes = { + .TPMA_NV_PPWRITE = 1, + .TPMA_NV_AUTHREAD = 1, + .TPMA_NV_PPREAD = 1, + .TPMA_NV_PLATFORMCREATE = 1, + .TPMA_NV_WRITE_STCLEAR = 1, +}; + +static const TPMA_NV rw_auth_space_attributes = { + .TPMA_NV_AUTHWRITE = 1, + .TPMA_NV_AUTHREAD = 1, + .TPMA_NV_NO_DA = 1, + .TPMA_NV_PPREAD = 1, + .TPMA_NV_PPWRITE = 1, + .TPMA_NV_PLATFORMCREATE = 1, + .TPMA_NV_WRITE_STCLEAR = 1, + .TPMA_NV_POLICY_DELETE = 1, +}; + +static const TPMA_NV fwmp_attr = { + .TPMA_NV_PLATFORMCREATE = 1, + .TPMA_NV_OWNERWRITE = 1, + .TPMA_NV_AUTHREAD = 1, + .TPMA_NV_PPREAD = 1, + .TPMA_NV_PPWRITE = 1, +}; + +/* Attributes for spaces that enable zero-touch enrollment (ZTE) */ +static const TPMA_NV zte_attr = { + .TPMA_NV_PLATFORMCREATE = 1, + .TPMA_NV_WRITEDEFINE = 1, + .TPMA_NV_AUTHWRITE = 1, + .TPMA_NV_AUTHREAD = 1, + .TPMA_NV_PPWRITE = 1, + .TPMA_NV_PPREAD = 1, + .TPMA_NV_NO_DA = 1, + .TPMA_NV_POLICY_DELETE = 1, +}; + +static const TPMA_NV zte_rma_bytes_attr = { + .TPMA_NV_PLATFORMCREATE = 1, + .TPMA_NV_BITS = 1, + .TPMA_NV_AUTHWRITE = 1, + .TPMA_NV_AUTHREAD = 1, + .TPMA_NV_PPWRITE = 1, + .TPMA_NV_PPREAD = 1, + .TPMA_NV_NO_DA = 1, + .TPMA_NV_POLICY_DELETE = 1, +}; + +static const TPMA_NV rw_orderly_counter_attributes = { + .TPMA_NV_COUNTER = 1, + .TPMA_NV_ORDERLY = 1, + .TPMA_NV_AUTHREAD = 1, + .TPMA_NV_AUTHWRITE = 1, + .TPMA_NV_PLATFORMCREATE = 1, + .TPMA_NV_WRITE_STCLEAR = 1, + .TPMA_NV_PPREAD = 1, + .TPMA_NV_PPWRITE = 1, + .TPMA_NV_NO_DA = 1, +}; + +/* + * This policy digest was obtained using TPM2_PolicyOR on 3 digests + * corresponding to a sequence of + * -) TPM2_PolicyCommandCode(TPM_CC_NV_UndefineSpaceSpecial), + * -) TPM2_PolicyPCR(PCR0, <extended_value>). + * where <extended value> is + * 1) all zeros = initial, unextended state: + * - Value to extend to initial PCR0: + * <none> + * - Resulting PCR0: + * 0000000000000000000000000000000000000000000000000000000000000000 + * - Policy digest for PolicyCommandCode + PolicyPCR: + * 4B44FC4192DB5AD7167E0135708FD374890A06BFB56317DF01F24F2226542A3F + * 2) result of extending (SHA1(0x00|0x01|0x00) | 00s to SHA256 size) + * - Value to extend to initial PCR0: + * 62571891215b4efc1ceab744ce59dd0b66ea6f73000000000000000000000000 + * - Resulting PCR0: + * 9F9EA866D3F34FE3A3112AE9CB1FBABC6FFE8CD261D42493BC6842A9E4F93B3D + * - Policy digest for PolicyCommandCode + PolicyPCR: + * CB5C8014E27A5F7586AAE42DB4F9776A977BCBC952CA61E33609DA2B2C329418 + * 3) result of extending (SHA1(0x01|0x01|0x00) | 00s to SHA256 size) + * - Value to extend to initial PCR0: + * 47ec8d98366433dc002e7721c9e37d5067547937000000000000000000000000 + * - Resulting PCR0: + * 2A7580E5DA289546F4D2E0509CC6DE155EA131818954D36D49E027FD42B8C8F8 + * - Policy digest for PolicyCommandCode + PolicyPCR: + * E6EF4F0296AC3EF0F53906480985B1BE8058E0E517E5F74A5B8A415EFE339D87 + * Values #2 and #3 correspond to two forms of recovery mode as extended by + * vb2api_get_pcr_digest(). + * As a result, the digest allows deleting the space with UndefineSpaceSpecial + * at early RO stages (before extending PCR0) or from recovery mode. + */ +static const uint8_t pcr0_allowed_policy[] = { + 0x44, 0x44, 0x79, 0x00, 0xCB, 0xB8, 0x3F, 0x5B, 0x15, 0x76, 0x56, + 0x50, 0xEF, 0x96, 0x98, 0x0A, 0x2B, 0x96, 0x6E, 0xA9, 0x09, 0x04, + 0x4A, 0x01, 0xB8, 0x5F, 0xA5, 0x4A, 0x96, 0xFC, 0x59, 0x84}; + +static const uint8_t unsatisfiable_policy[VB2_SHA256_DIGEST_SIZE] = + "hmwhat if RBR beat merc in 2021"; + +static uint32_t define_space(const char *name, uint32_t index, uint32_t length, + const TPMA_NV nv_attributes, + const uint8_t *nv_policy, size_t nv_policy_size) +{ + tpm_result_t rc; + + rc = tlcl2_define_space(index, length, nv_attributes, nv_policy, nv_policy_size); + if (rc == TPM_CB_NV_DEFINED) { + /* + * Continue with writing: it may be defined, but not written + * to. In that case a subsequent tlcl_read() would still return + * TPM_BADINDEX on TPM 2.0. The cases when some non-firmware + * space is defined while the firmware space is not there + * should be rare (interrupted initialization), so no big harm + * in writing once again even if it was written already. + */ + VBDEBUG("%s: %s space already exists\n", __func__, name); + rc = TPM_SUCCESS; + } + + return rc; +} + +static tpm_result_t setup_space(const char *name, uint32_t index, const void *data, + uint32_t length, const TPMA_NV nv_attributes, + const uint8_t *nv_policy, size_t nv_policy_size) +{ + tpm_result_t rc; + + rc = define_space(name, index, length, nv_attributes, nv_policy, + nv_policy_size); + if (rc != TPM_SUCCESS) + return rc; + + return safe_write(index, data, length); +} + +static tpm_result_t setup_firmware_space(struct vb2_context *ctx) +{ + uint32_t firmware_space_size = vb2api_secdata_firmware_create(ctx); + + return setup_space("firmware", FIRMWARE_NV_INDEX, + ctx->secdata_firmware, firmware_space_size, + ro_space_attributes, pcr0_allowed_policy, + sizeof(pcr0_allowed_policy)); +} + +static tpm_result_t setup_fwmp_space(struct vb2_context *ctx) +{ + uint32_t fwmp_space_size = vb2api_secdata_fwmp_create(ctx); + + return setup_space("FWMP", FWMP_NV_INDEX, ctx->secdata_fwmp, fwmp_space_size, + fwmp_attr, NULL, 0); +} + +static tpm_result_t setup_kernel_space(struct vb2_context *ctx) +{ + uint32_t kernel_space_size = vb2api_secdata_kernel_create(ctx); + + return setup_space("kernel", KERNEL_NV_INDEX, ctx->secdata_kernel, + kernel_space_size, rw_space_attributes, NULL, 0); +} + +static tpm_result_t set_mrc_hash_space(uint32_t index, const uint8_t *data) +{ + if (index == MRC_REC_HASH_NV_INDEX) { + return setup_space("RO MRC Hash", index, data, HASH_NV_SIZE, + ro_space_attributes, pcr0_allowed_policy, + sizeof(pcr0_allowed_policy)); + } else { + return setup_space("RW MRC Hash", index, data, HASH_NV_SIZE, + rw_space_attributes, NULL, 0); + } +} + +/** + * Set up the Zero-Touch Enrollment(ZTE) related spaces. + * + * These spaces are not used by firmware, but we do need to initialize them. + */ +static tpm_result_t setup_zte_spaces(void) +{ + tpm_result_t rc; + uint64_t rma_bytes_counter_default = 0; + uint8_t rma_sn_bits_default[16]; + uint8_t board_id_default[12]; + + /* Initialize defaults: Board ID and RMA+SN Bits must be initialized + to all 0xFFs. */ + memset(rma_sn_bits_default, 0xFF, ARRAY_SIZE(rma_sn_bits_default)); + memset(board_id_default, 0xFF, ARRAY_SIZE(board_id_default)); + + /* Set up RMA + SN Bits */ + rc = setup_space("RMA + SN Bits", ZTE_RMA_SN_BITS_INDEX, + rma_sn_bits_default, sizeof(rma_sn_bits_default), + zte_attr, + unsatisfiable_policy, sizeof(unsatisfiable_policy)); + if (rc != TPM_SUCCESS) { + VBDEBUG("%s: Failed to set up RMA + SN Bits space with error %#x\n", __func__, rc); + return rc; + } + + rc = setup_space("Board ID", ZTE_BOARD_ID_NV_INDEX, + board_id_default, sizeof(board_id_default), + zte_attr, + unsatisfiable_policy, sizeof(unsatisfiable_policy)); + if (rc != TPM_SUCCESS) { + VBDEBUG("%s: Failed to set up Board ID space with error %#x\n", __func__, rc); + return rc; + } + + /* Set up RMA Bytes counter */ + rc = define_space("RMA Bytes Counter", ZTE_RMA_BYTES_COUNTER_INDEX, + sizeof(rma_bytes_counter_default), + zte_rma_bytes_attr, + unsatisfiable_policy, sizeof(unsatisfiable_policy)); + if (rc != TPM_SUCCESS) { + VBDEBUG("%s: Failed to define RMA Bytes space with error %#x\n", __func__, rc); + return rc; + } + + /* + * Since the RMA counter has the BITS attribute, we need to call + * TPM2_NV_SetBits() in order to initialize it. + */ + rc = tlcl2_set_bits(ZTE_RMA_BYTES_COUNTER_INDEX, rma_bytes_counter_default); + if (rc != TPM_SUCCESS) { + VBDEBUG("%s: Failed to init RMA Bytes counter space wit error %#x\n", + __func__, rc); + return rc; + } + + return rc; +} + +/* + * Set up enterprise rollback space. + * + * This space is not used by firmware but needs to survive owner clear. Thus, it + * needs to be created here. + */ +static tpm_result_t enterprise_rollback_create_space(void) +{ + uint8_t rollback_space_default[32] = {0}; + + return setup_space("Enterprise Rollback Space", + ENT_ROLLBACK_SPACE_INDEX, rollback_space_default, + sizeof(rollback_space_default), rw_auth_space_attributes, + unsatisfiable_policy, sizeof(unsatisfiable_policy)); +} + +static tpm_result_t setup_widevine_counter_spaces(void) +{ + uint32_t index; + tpm_result_t rc; + + for (index = 0; index < NUM_WIDEVINE_COUNTERS; index++) { + rc = define_space(WIDEVINE_COUNTER_NAME, + WIDEVINE_COUNTER_NV_INDEX(index), + WIDEVINE_COUNTER_SIZE, + rw_orderly_counter_attributes, + NULL, + 0); + if (rc != TPM_SUCCESS) + return rc; + } + return rc; +} + +tpm_result_t factory_initialize_tpm2(struct vb2_context *ctx) +{ + RETURN_ON_FAILURE(tlcl_force_clear()); + + /* + * Of all NVRAM spaces defined by this function the firmware space + * must be defined last, because its existence is considered an + * indication that TPM factory initialization was successfully + * completed. + */ + RETURN_ON_FAILURE(setup_kernel_space(ctx)); + + /* + * Define and set rec hash space, if available. No need to + * create the RW hash space because we will definitely boot + * once in normal mode before shipping, meaning that the space + * will get created with correct permissions while still in + * our hands. + */ + if (CONFIG(VBOOT_HAS_REC_HASH_SPACE)) + RETURN_ON_FAILURE(set_mrc_hash_space(MRC_REC_HASH_NV_INDEX, mrc_hash_data)); + + /* Define and write firmware management parameters space. */ + RETURN_ON_FAILURE(setup_fwmp_space(ctx)); + + /* + * Define and write zero-touch enrollment (ZTE) spaces. For ChromeOS devices with + * Google TPM, these are set up elsewhere via TPM vendor commands. + */ + if (CONFIG(CHROMEOS) && !(CONFIG(TPM_GOOGLE))) + RETURN_ON_FAILURE(setup_zte_spaces()); + + /* + * On TPM 2.0, create a space that survives TPM clear. This allows to + * securely lock data during enterprise rollback by binding to this + * space's value. + */ + if (CONFIG(CHROMEOS)) + RETURN_ON_FAILURE(enterprise_rollback_create_space()); + + /* Define widevine counter space. No need to increment/write to the secure counters + and are expected to be incremented during the first use. */ + if (CONFIG(VBOOT_DEFINE_WIDEVINE_COUNTERS)) + RETURN_ON_FAILURE(setup_widevine_counter_spaces()); + + RETURN_ON_FAILURE(setup_firmware_space(ctx)); + + return TPM_SUCCESS; +} + +tpm_result_t antirollback_read_space_mrc_hash(uint32_t index, uint8_t *data, uint32_t size) +{ + if (size != HASH_NV_SIZE) { + VBDEBUG("TPM: Incorrect buffer size for hash idx %#x. " + "(Expected=%#x Actual=%#x).\n", index, HASH_NV_SIZE, + size); + return TPM_CB_READ_FAILURE; + } + return read_space_mrc_hash(index, data); +} + +tpm_result_t antirollback_write_space_mrc_hash(uint32_t index, const uint8_t *data, uint32_t size) +{ + uint8_t spc_data[HASH_NV_SIZE]; + tpm_result_t rc; + + if (size != HASH_NV_SIZE) { + VBDEBUG("TPM: Incorrect buffer size for hash idx %#x. " + "(Expected=%#x Actual=%#x).\n", index, HASH_NV_SIZE, + size); + return TPM_CB_WRITE_FAILURE; + } + + rc = read_space_mrc_hash(index, spc_data); + if (rc == TPM_BADINDEX) { + /* + * If space is not defined already for hash, define + * new space. + */ + VBDEBUG("TPM: Initializing hash space.\n"); + return set_mrc_hash_space(index, data); + } + + if (rc != TPM_SUCCESS) + return rc; + + return safe_write(index, data, size); +} + +tpm_result_t antirollback_lock_space_mrc_hash(uint32_t index) +{ + return tlcl2_lock_nv_write(index); +} + +static tpm_result_t read_space_vbios_hash(uint8_t *data) +{ + RETURN_ON_FAILURE(tlcl_read(VBIOS_CACHE_NV_INDEX, data, HASH_NV_SIZE)); + return TPM_SUCCESS; +} + +tpm_result_t antirollback_read_space_vbios_hash(uint8_t *data, uint32_t size) +{ + if (size != HASH_NV_SIZE) { + VBDEBUG("TPM: Incorrect buffer size for hash idx %#x. " + "(Expected=%#x Actual=%#x).\n", VBIOS_CACHE_NV_INDEX, HASH_NV_SIZE, + size); + return TPM_CB_READ_FAILURE; + } + return read_space_vbios_hash(data); +} + +tpm_result_t antirollback_write_space_vbios_hash(const uint8_t *data, uint32_t size) +{ + uint8_t spc_data[HASH_NV_SIZE]; + tpm_result_t rc; + + if (size != HASH_NV_SIZE) { + VBDEBUG("TPM: Incorrect buffer size for hash idx %#x. " + "(Expected=%#x Actual=%#x).\n", VBIOS_CACHE_NV_INDEX, HASH_NV_SIZE, + size); + return TPM_CB_WRITE_FAILURE; + } + + rc = read_space_vbios_hash(spc_data); + if (rc == TPM_BADINDEX) { + /* + * If space is not defined already for hash, define + * new space. + */ + VBDEBUG("TPM: Initializing hash space.\n"); + return setup_space("VBIOS Cache Hash", VBIOS_CACHE_NV_INDEX, data, HASH_NV_SIZE, + rw_space_attributes, NULL, 0); + } + + if (rc != TPM_SUCCESS) + return rc; + + return safe_write(VBIOS_CACHE_NV_INDEX, data, size); +} diff --git a/src/security/vboot/secdata_tpm_private.h b/src/security/vboot/secdata_tpm_private.h new file mode 100644 index 0000000..bcea92f --- /dev/null +++ b/src/security/vboot/secdata_tpm_private.h @@ -0,0 +1,42 @@ +/* SPDX-License-Identifier: BSD-3-Clause */ + +#ifndef __VBOOT_SECDATA_TPM_PRIVATE_H__ +#define __VBOOT_SECDATA_TPM_PRIVATE_H__ + +#include <console/console.h> +#include <security/tpm/tss.h> +#include <vb2_api.h> + +#define VBDEBUG(format, args...) \ + printk(BIOS_INFO, "%s():%d: " format, __func__, __LINE__, ## args) + +#define RETURN_ON_FAILURE(tpm_cmd) do { \ + tpm_result_t rc_; \ + if ((rc_ = (tpm_cmd)) != TPM_SUCCESS) { \ + VBDEBUG("Antirollback: %08x returned by " #tpm_cmd \ + "\n", (tpm_result_t)rc_); \ + return rc_; \ + } \ + } while (0) + +static tpm_result_t safe_write(uint32_t index, const void *data, uint32_t length) +{ + tpm_result_t rc = tlcl_write(index, data, length); + if (tlcl_get_family() == TPM_1 && rc == TPM_MAXNVWRITES) { + /** + * Clear the TPM on write error due to hitting the 64-write + * limit. This can only happen when the TPM is unowned, so it + * is OK to clear it (and we really have no choice). This is + * not expected to happen frequently, but it could happen. + */ + RETURN_ON_FAILURE(tpm_clear_and_reenable()); + rc = tlcl_write(index, data, length); + } + return rc; +} + +tpm_result_t factory_initialize_tpm1(struct vb2_context *ctx); + +tpm_result_t factory_initialize_tpm2(struct vb2_context *ctx); + +#endif /* __VBOOT_SECDATA_TPM_PRIVATE_H__ */ -- To view, visit https://review.coreboot.org/c/coreboot/+/81415?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I0090b748d7d3b2d76a941b87b5885682fd81c4fc Gerrit-Change-Number: 81415 Gerrit-PatchSet: 1 Gerrit-Owner: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Yu-Ping Wu <yupingso(a)google.com> Gerrit-Attention: Julius Werner <jwerner(a)chromium.org> Gerrit-Attention: Yu-Ping Wu <yupingso(a)google.com> Gerrit-MessageType: newchange

1 0

[M] Change in coreboot[main]: security/tpm: replace CONFIG(TPMx) checks with runtime check
by Sergii Dmytruk (Code Review) 21 Mar '24

21 Mar '24

Attention is currently required from: Christian Walter, Cliff Huang, Jan Samek, Jérémy Compostella, Krystian Hebel, Lance Zhao, Martin L Roth, Michał Żygowski, Sergii Dmytruk, Tim Wawrzynczak. Hello Christian Walter, Cliff Huang, Julius Werner, Jérémy Compostella, Krystian Hebel, Lance Zhao, Martin L Roth, Michał Żygowski, Tim Wawrzynczak, Yu-Ping Wu, build bot (Jenkins), I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/69161?usp=email to look at the new patch set (#35). The following approvals got outdated and were removed: Verified+1 by build bot (Jenkins) Change subject: security/tpm: replace CONFIG(TPMx) checks with runtime check ...................................................................... security/tpm: replace CONFIG(TPMx) checks with runtime check This prepares the code for enabling both CONFIG_TPM1 and CONFIG_TPM2 during compilation, in which case actual TPM family in use can be determined at runtime. In some places both compile-time and runtime checks are necessary. Yet in places like probe functions runtime state checks don't make sense as runtime state is defined by results of probing. Change-Id: Id9cc25aad8d1d7bfad12b7a92059b1b3641bbfa9 Ticket: https://ticket.coreboot.org/issues/433 Signed-off-by: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> --- M src/acpi/acpi.c M src/drivers/crb/tis.c M src/drivers/crb/tpm.c M src/drivers/crb/tpm.h M src/drivers/pc80/tpm/tis.c M src/drivers/tpm/ppi.c M src/security/tpm/tspi/crtm.h M src/security/tpm/tspi/tspi.c M src/security/tpm/tss.h M src/security/vboot/secdata_tpm.c M src/security/vboot/tpm_common.c M src/vendorcode/google/chromeos/cse_board_reset.c M src/vendorcode/google/chromeos/tpm2.c 13 files changed, 153 insertions(+), 70 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/61/69161/35 -- To view, visit https://review.coreboot.org/c/coreboot/+/69161?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: Id9cc25aad8d1d7bfad12b7a92059b1b3641bbfa9 Gerrit-Change-Number: 69161 Gerrit-PatchSet: 35 Gerrit-Owner: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> Gerrit-Reviewer: Christian Walter <christian.walter(a)9elements.com> Gerrit-Reviewer: Cliff Huang <cliff.huang(a)intel.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Jérémy Compostella <jeremy.compostella(a)intel.com> Gerrit-Reviewer: Krystian Hebel <krystian.hebel(a)3mdeb.com> Gerrit-Reviewer: Lance Zhao <lance.zhao(a)gmail.com> Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com> Gerrit-Reviewer: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Tim Wawrzynczak <inforichland(a)gmail.com> Gerrit-Reviewer: Yu-Ping Wu <yupingso(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Jan Samek <jan.samek(a)siemens.com> Gerrit-Attention: Lance Zhao <lance.zhao(a)gmail.com> Gerrit-Attention: Cliff Huang <cliff.huang(a)intel.com> Gerrit-Attention: Martin L Roth <gaumless(a)gmail.com> Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Attention: Jérémy Compostella <jeremy.compostella(a)intel.com> Gerrit-Attention: Christian Walter <christian.walter(a)9elements.com> Gerrit-Attention: Tim Wawrzynczak <inforichland(a)gmail.com> Gerrit-Attention: Krystian Hebel <krystian.hebel(a)3mdeb.com> Gerrit-Attention: Jan Samek <jan.samek(a)siemens.com> Gerrit-Attention: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> Gerrit-MessageType: newpatchset

1 0

[M] Change in coreboot[main]: soc/intel/apollolake: Add a loader for the IBB
by Sean Rhodes (Code Review) 21 Mar '24

21 Mar '24

Attention is currently required from: Andrey Petrov, Angel Pons, Arthur Heymans, Michał Żygowski, Subrata Banik. Sean Rhodes has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/65270?usp=email ) Change subject: soc/intel/apollolake: Add a loader for the IBB ...................................................................... Patch Set 75: (1 comment) File src/soc/intel/apollolake/bootflow.md: https://review.coreboot.org/c/coreboot/+/65270/comment/450e18fb_8dfb7e6f : PS74, Line 11: When we enter the bootblock, the first 128k will be copied : into the SRAM. This will contain the IBBL partition (bootblock) : and whatever will fix of the IBB partition. > Done Sorry - missed the first part. Stitching with FIT, not a problem. For coreboot hacking IFWI together - existing microcode isn't changed (seem to remember Arthur trying to change it and having problems with size mismatches) -- To view, visit https://review.coreboot.org/c/coreboot/+/65270?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: Ia41e3909f8099d2ea864166e9ea03e10e40a1b68 Gerrit-Change-Number: 65270 Gerrit-PatchSet: 75 Gerrit-Owner: Sean Rhodes <sean(a)starlabs.systems> Gerrit-Reviewer: Andrey Petrov <andrey.petrov(a)gmail.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Angel Pons <th3fanbus(a)gmail.com> Gerrit-CC: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-CC: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-CC: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-CC: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Attention: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Attention: Andrey Petrov <andrey.petrov(a)gmail.com> Gerrit-Comment-Date: Thu, 21 Mar 2024 19:07:47 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Sean Rhodes <sean(a)starlabs.systems> Comment-In-Reply-To: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: comment

1 0

[L] Change in coreboot[main]: mb/starlabs/starbook/cml: Switch to the merlin EC
by Sean Rhodes (Code Review) 21 Mar '24

21 Mar '24

Sean Rhodes has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/81411?usp=email ) Change subject: mb/starlabs/starbook/cml: Switch to the merlin EC ...................................................................... Set Ready For Review -- To view, visit https://review.coreboot.org/c/coreboot/+/81411?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I27062c38c10df1d03f563b2f5391f79a3b6ee4fe Gerrit-Change-Number: 81411 Gerrit-PatchSet: 1 Gerrit-Owner: Sean Rhodes <sean(a)starlabs.systems> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Thu, 21 Mar 2024 19:02:22 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

[S] Change in coreboot[main]: mb/starlabs/starbook/kbl: Use function for getting power profile
by Sean Rhodes (Code Review) 21 Mar '24

21 Mar '24

Sean Rhodes has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/81412?usp=email ) Change subject: mb/starlabs/starbook/kbl: Use function for getting power profile ...................................................................... Set Ready For Review -- To view, visit https://review.coreboot.org/c/coreboot/+/81412?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I07ce71e20bd71229bb0cd3438ab59140cd0d8b42 Gerrit-Change-Number: 81412 Gerrit-PatchSet: 1 Gerrit-Owner: Sean Rhodes <sean(a)starlabs.systems> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Thu, 21 Mar 2024 19:02:20 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

[XS] Change in coreboot[main]: mb/starlabs/starbook/kbl: Configure the TCC Offset based on Power Pro...
by Sean Rhodes (Code Review) 21 Mar '24

21 Mar '24

Sean Rhodes has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/81413?usp=email ) Change subject: mb/starlabs/starbook/kbl: Configure the TCC Offset based on Power Profile ...................................................................... Set Ready For Review -- To view, visit https://review.coreboot.org/c/coreboot/+/81413?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I58940441a7cefc7a2a07e5e9f7e8a15cb8730ef3 Gerrit-Change-Number: 81413 Gerrit-PatchSet: 1 Gerrit-Owner: Sean Rhodes <sean(a)starlabs.systems> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Thu, 21 Mar 2024 19:02:17 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

[XS] Change in coreboot[main]: mb/starlabs/labtop/cml: Increase TCC Offset
by Sean Rhodes (Code Review) 21 Mar '24

21 Mar '24

Sean Rhodes has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/81414?usp=email ) Change subject: mb/starlabs/labtop/cml: Increase TCC Offset ...................................................................... Set Ready For Review -- To view, visit https://review.coreboot.org/c/coreboot/+/81414?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: Ibffeeab67a7277625db9bdedca36d759ff0e72f6 Gerrit-Change-Number: 81414 Gerrit-PatchSet: 1 Gerrit-Owner: Sean Rhodes <sean(a)starlabs.systems> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Thu, 21 Mar 2024 19:02:16 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

[XS] Change in coreboot[main]: mb/google/brox: Configure I2C timing for I2C devices
by Felix Held (Code Review) 21 Mar '24

21 Mar '24

Felix Held has submitted this change. ( https://review.coreboot.org/c/coreboot/+/81348?usp=email ) Change subject: mb/google/brox: Configure I2C timing for I2C devices ...................................................................... mb/google/brox: Configure I2C timing for I2C devices Configure I2C0/1 timing in devicetree to meet timing requirement. (THIGH(us) minimum is 0.6us). Before: I2C0 : THIGH(us) 0.595us I2C1 : THIGH(us) 0.582us After: I2C0 : THIGH(us) 0.673us I2C1 : THIGH(us) 0.666us Change-Id: I79af4fde4eb08d4eb896794756a633701bebb755 Signed-off-by: Ivy Jian <ivy.jian(a)quanta.corp-partner.google.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/81348 Reviewed-by: Shelley Chen <shchen(a)google.com> Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> Reviewed-by: Karthik Ramasubramanian <kramasub(a)google.com> --- M src/mainboard/google/brox/variants/baseboard/brox/devicetree.cb 1 file changed, 2 insertions(+), 2 deletions(-) Approvals: build bot (Jenkins): Verified Shelley Chen: Looks good to me, approved Karthik Ramasubramanian: Looks good to me, approved diff --git a/src/mainboard/google/brox/variants/baseboard/brox/devicetree.cb b/src/mainboard/google/brox/variants/baseboard/brox/devicetree.cb index 3e0e7fb..9ed0602 100644 --- a/src/mainboard/google/brox/variants/baseboard/brox/devicetree.cb +++ b/src/mainboard/google/brox/variants/baseboard/brox/devicetree.cb @@ -97,13 +97,13 @@ .i2c[0] = { .speed = I2C_SPEED_FAST, .rise_time_ns = 650, - .fall_time_ns = 400, + .fall_time_ns = 350, .data_hold_time_ns = 50, }, .i2c[1] = { .speed = I2C_SPEED_FAST, .rise_time_ns = 600, - .fall_time_ns = 400, + .fall_time_ns = 350, .data_hold_time_ns = 50, }, .i2c[2] = { -- To view, visit https://review.coreboot.org/c/coreboot/+/81348?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I79af4fde4eb08d4eb896794756a633701bebb755 Gerrit-Change-Number: 81348 Gerrit-PatchSet: 2 Gerrit-Owner: Ivy Jian <ivy.jian(a)quanta.corp-partner.google.com> Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Reviewer: Karthik Ramasubramanian <kramasub(a)google.com> Gerrit-Reviewer: Shelley Chen <shchen(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-MessageType: merged

1 0

[S] Change in coreboot[main]: drivers/i2c/tas5825m: Allow using I2C bus
by Jeremy Soller (Code Review) 21 Mar '24

21 Mar '24

Attention is currently required from: Tim Crawford. Jeremy Soller has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/81126?usp=email ) Change subject: drivers/i2c/tas5825m: Allow using I2C bus ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://review.coreboot.org/c/coreboot/+/81126?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I2233d6977fd460b53e27260cdfabe42e30b98041 Gerrit-Change-Number: 81126 Gerrit-PatchSet: 1 Gerrit-Owner: Tim Crawford <tcrawford(a)system76.com> Gerrit-Reviewer: Jeremy Soller <jeremy(a)system76.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Tim Crawford <tcrawford(a)system76.com> Gerrit-Comment-Date: Thu, 21 Mar 2024 17:28:30 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

coreboot-gerrit March 2024