TPM cleanup

firmware/lib/rollback_index.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Functions for querying, manipulating and locking rollback indices
  * stored in the TPM NVRAM.
  */
 
 #include "rollback_index.h"
 
@@ skipping 12 matching lines @@
       VBDEBUG(("Rollback: %08x returned by " #tpm_command "\n", (int)result)); \
       return result;                                    \
     }                                                   \
   } while (0)
 
 uint32_t TPMClearAndReenable(void) {
   VBDEBUG(("TPM: Clear and re-enable\n"));
   RETURN_ON_FAILURE(TlclForceClear());
   RETURN_ON_FAILURE(TlclSetEnable());
   RETURN_ON_FAILURE(TlclSetDeactivated(0));
-  
+
   return TPM_SUCCESS;
 }
 
 /* Like TlclWrite(), but checks for write errors due to hitting the 64-write
  * limit and clears the TPM when that happens.  This can only happen when the
  * TPM is unowned, so it is OK to clear it (and we really have no choice).
  * This is not expected to happen frequently, but it could happen.
  */
 static uint32_t SafeWrite(uint32_t index, uint8_t* data, uint32_t length) {
   uint32_t result = TlclWrite(index, data, length);
@@ skipping 48 matching lines @@
   }
   return result;
 }
 
 /* Creates the NVRAM spaces, and sets their initial values as needed.
  */
 static uint32_t InitializeSpaces(void) {
   uint32_t zero = 0;
   uint32_t firmware_perm = TPM_NV_PER_GLOBALLOCK | TPM_NV_PER_PPWRITE;
   uint8_t nvlocked = 0;
-  uint32_t i;
 
   VBDEBUG(("TPM: Initializing spaces\n"));
 
-#ifdef FORCE_CLEAR_ON_INIT
   /* Force the TPM clear, in case it previously had an owner, so that we can
    * redefine the NVRAM spaces. */
   RETURN_ON_FAILURE(TPMClearAndReenable());
-#endif
 
   /* The TPM will not enforce the NV authorization restrictions until the 
    * execution of a TPM_NV_DefineSpace with the handle of TPM_NV_INDEX_LOCK.
    * Create that space if it doesn't already exist. */
   RETURN_ON_FAILURE(TlclGetFlags(NULL, NULL, &nvlocked));
   VBDEBUG(("TPM: nvlocked=%d\n", nvlocked));
   if (!nvlocked) {
     VBDEBUG(("TPM: Enabling NV locking\n"));
     RETURN_ON_FAILURE(TlclSetNvLocked());
   }
 
-  /* If the spaces were previously defined, we need to undefine them before we
-   * can redefine them.  Undefine by setting size=0.  Ignore these return codes,
-   * since they fail if the spaces aren't actually defined? */
-  for (i = FIRST_ROLLBACK_NV_INDEX; i <= LAST_ROLLBACK_NV_INDEX; i++)
-    SafeDefineSpace(i, firmware_perm, 0);
-
   RETURN_ON_FAILURE(SafeDefineSpace(FIRMWARE_VERSIONS_NV_INDEX,
                                     firmware_perm, sizeof(uint32_t)));
   RETURN_ON_FAILURE(SafeWrite(FIRMWARE_VERSIONS_NV_INDEX,
                               (uint8_t*) &zero, sizeof(uint32_t)));
 
   RETURN_ON_FAILURE(InitializeKernelVersionsSpaces());
 
   /* The space KERNEL_VERSIONS_BACKUP_NV_INDEX is used to protect the kernel
    * versions.  The content of space KERNEL_MUST_USE_BACKUP determines whether
    * only the backup value should be trusted.
@@ skipping 193 matching lines @@
   VBDEBUG(("TPM: SetupTPM() succeeded\n"));
   return TPM_SUCCESS;
 }
 
 /* disable MSVC warnings on unused arguments */
 __pragma(warning (disable: 4100))
 
 
 #ifdef DISABLE_ROLLBACK_TPM
 
-/* Dummy implementations which don't call into the tpm_lite library */
+/* Dummy implementations which don't support TPM rollback protection */
 
 uint32_t RollbackFirmwareSetup(int developer_mode) {
+#ifndef CHROMEOS_ENVIRONMENT
+  /* Initialize the TPM, but ignore return codes.  In ChromeOS
+   * environment, don't even talk to the TPM. */
+  TlclLibInit();
+  TlclStartup();
+#endif
   return TPM_SUCCESS;
 }
 
 uint32_t RollbackFirmwareRead(uint16_t* key_version, uint16_t* version) {
   *key_version = *version = 0;
   return TPM_SUCCESS;
 }
 
 uint32_t RollbackFirmwareWrite(uint16_t key_version, uint16_t version) {
   return TPM_SUCCESS;
 }
 
 uint32_t RollbackFirmwareLock(void) {
   return TPM_SUCCESS;
 }
 
 uint32_t RollbackKernelRecovery(int developer_mode) {
+#ifndef CHROMEOS_ENVIRONMENT
+  /* Initialize the TPM, but ignore return codes.  In ChromeOS
+   * environment, don't even talk to the TPM. */
+  TlclLibInit();
+  TlclStartup();
+#endif
   return TPM_SUCCESS;
 }
 
 uint32_t RollbackKernelRead(uint16_t* key_version, uint16_t* version) {
   *key_version = *version = 0;
   return TPM_SUCCESS;
 }
 
 uint32_t RollbackKernelWrite(uint16_t key_version, uint16_t version) {
   return TPM_SUCCESS;
@@ skipping 75 matching lines @@
 
 uint32_t RollbackKernelLock(void) {
   if (!g_rollback_recovery_mode) {
     return TlclLockPhysicalPresence();
   } else {
     return TPM_SUCCESS;
   }
 }
 
 #endif // DISABLE_ROLLBACK_TPM