OLD | NEW |
1 /* Copyright (c) 2011 The Chromium OS Authors. All rights reserved. | 1 /* Copyright (c) 2011 The Chromium OS Authors. All rights reserved. |
2 * Use of this source code is governed by a BSD-style license that can be | 2 * Use of this source code is governed by a BSD-style license that can be |
3 * found in the LICENSE file. | 3 * found in the LICENSE file. |
4 * | 4 * |
5 * High-level firmware API for loading and verifying rewritable firmware. | 5 * High-level firmware API for loading and verifying rewritable firmware. |
6 * (Firmware portion) | 6 * (Firmware portion) |
7 */ | 7 */ |
8 | 8 |
9 #include "gbb_header.h" | 9 #include "gbb_header.h" |
10 #include "load_firmware_fw.h" | 10 #include "load_firmware_fw.h" |
(...skipping 91 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
102 | 102 |
103 /* Must have a root key from the GBB */ | 103 /* Must have a root key from the GBB */ |
104 if (!gbb) { | 104 if (!gbb) { |
105 VBDEBUG(("No GBB\n")); | 105 VBDEBUG(("No GBB\n")); |
106 goto LoadFirmwareExit; | 106 goto LoadFirmwareExit; |
107 } | 107 } |
108 root_key = (VbPublicKey*)((uint8_t*)gbb + gbb->rootkey_offset); | 108 root_key = (VbPublicKey*)((uint8_t*)gbb + gbb->rootkey_offset); |
109 | 109 |
110 /* Parse flags */ | 110 /* Parse flags */ |
111 is_dev = (params->boot_flags & BOOT_FLAG_DEVELOPER ? 1 : 0); | 111 is_dev = (params->boot_flags & BOOT_FLAG_DEVELOPER ? 1 : 0); |
| 112 if (is_dev) |
| 113 shared->flags |= VBSD_LF_DEV_SWITCH_ON; |
112 | 114 |
113 /* Initialize the TPM and read rollback indices. */ | 115 /* Initialize the TPM and read rollback indices. */ |
114 VBPERFSTART("VB_TPMI"); | 116 VBPERFSTART("VB_TPMI"); |
115 status = RollbackFirmwareSetup(is_dev, &tpm_version); | 117 status = RollbackFirmwareSetup(is_dev, &tpm_version); |
116 if (0 != status) { | 118 if (0 != status) { |
117 VBDEBUG(("Unable to setup TPM and read stored versions.\n")); | 119 VBDEBUG(("Unable to setup TPM and read stored versions.\n")); |
118 VBPERFEND("VB_TPMI"); | 120 VBPERFEND("VB_TPMI"); |
119 if (status == TPM_E_MUST_REBOOT) | 121 if (status == TPM_E_MUST_REBOOT) |
120 retval = LOAD_FIRMWARE_REBOOT; | 122 retval = LOAD_FIRMWARE_REBOOT; |
121 else | 123 else |
122 recovery = VBNV_RECOVERY_RO_TPM_ERROR; | 124 recovery = VBNV_RECOVERY_RO_TPM_ERROR; |
123 goto LoadFirmwareExit; | 125 goto LoadFirmwareExit; |
124 } | 126 } |
| 127 shared->fw_version_tpm_start = tpm_version; |
125 VBPERFEND("VB_TPMI"); | 128 VBPERFEND("VB_TPMI"); |
126 | 129 |
127 /* Read try-b count and decrement if necessary */ | 130 /* Read try-b count and decrement if necessary */ |
128 VbNvGet(vnc, VBNV_TRY_B_COUNT, &try_b_count); | 131 VbNvGet(vnc, VBNV_TRY_B_COUNT, &try_b_count); |
129 if (0 != try_b_count) | 132 if (0 != try_b_count) { |
130 VbNvSet(vnc, VBNV_TRY_B_COUNT, try_b_count - 1); | 133 VbNvSet(vnc, VBNV_TRY_B_COUNT, try_b_count - 1); |
| 134 shared->flags |= VBSD_FWB_TRIED; |
| 135 } |
131 VbNvSet(vnc, VBNV_TRIED_FIRMWARE_B, try_b_count ? 1 : 0); | 136 VbNvSet(vnc, VBNV_TRIED_FIRMWARE_B, try_b_count ? 1 : 0); |
132 | 137 |
133 /* Allocate our internal data */ | 138 /* Allocate our internal data */ |
134 lfi = (VbLoadFirmwareInternal*)Malloc(sizeof(VbLoadFirmwareInternal)); | 139 lfi = (VbLoadFirmwareInternal*)Malloc(sizeof(VbLoadFirmwareInternal)); |
135 if (!lfi) | 140 if (!lfi) |
136 return LOAD_FIRMWARE_RECOVERY; | 141 return LOAD_FIRMWARE_RECOVERY; |
137 | 142 |
138 params->load_firmware_internal = (uint8_t*)lfi; | 143 params->load_firmware_internal = (uint8_t*)lfi; |
139 | 144 |
140 /* Loop over indices */ | 145 /* Loop over indices */ |
141 for (i = 0; i < 2; i++) { | 146 for (i = 0; i < 2; i++) { |
142 VbKeyBlockHeader* key_block; | 147 VbKeyBlockHeader* key_block; |
143 uint64_t vblock_size; | 148 uint64_t vblock_size; |
144 VbFirmwarePreambleHeader* preamble; | 149 VbFirmwarePreambleHeader* preamble; |
145 RSAPublicKey* data_key; | 150 RSAPublicKey* data_key; |
146 uint64_t key_version; | 151 uint64_t key_version; |
147 uint64_t combined_version; | 152 uint64_t combined_version; |
148 uint8_t* body_digest; | 153 uint8_t* body_digest; |
| 154 uint8_t* check_result; |
149 | 155 |
150 /* If try B count is non-zero try firmware B first */ | 156 /* If try B count is non-zero try firmware B first */ |
151 index = (try_b_count ? 1 - i : i); | 157 index = (try_b_count ? 1 - i : i); |
152 if (0 == index) { | 158 if (0 == index) { |
153 key_block = (VbKeyBlockHeader*)params->verification_block_0; | 159 key_block = (VbKeyBlockHeader*)params->verification_block_0; |
154 vblock_size = params->verification_size_0; | 160 vblock_size = params->verification_size_0; |
| 161 check_result = &shared->check_fw_a_result; |
155 } else { | 162 } else { |
156 key_block = (VbKeyBlockHeader*)params->verification_block_1; | 163 key_block = (VbKeyBlockHeader*)params->verification_block_1; |
157 vblock_size = params->verification_size_1; | 164 vblock_size = params->verification_size_1; |
| 165 check_result = &shared->check_fw_b_result; |
158 } | 166 } |
159 | 167 |
160 /* Check the key block flags against the current boot mode. Do this | 168 /* Check the key block flags against the current boot mode. Do this |
161 * before verifying the key block, since flags are faster to check than | 169 * before verifying the key block, since flags are faster to check than |
162 * the RSA signature. */ | 170 * the RSA signature. */ |
163 if (!(key_block->key_block_flags & | 171 if (!(key_block->key_block_flags & |
164 (is_dev ? KEY_BLOCK_FLAG_DEVELOPER_1 : | 172 (is_dev ? KEY_BLOCK_FLAG_DEVELOPER_1 : |
165 KEY_BLOCK_FLAG_DEVELOPER_0))) { | 173 KEY_BLOCK_FLAG_DEVELOPER_0))) { |
166 VBDEBUG(("Developer flag mismatch.\n")); | 174 VBDEBUG(("Developer flag mismatch.\n")); |
| 175 *check_result = VBSD_LF_CHECK_DEV_MISMATCH; |
167 continue; | 176 continue; |
168 } | 177 } |
169 /* RW firmware never runs in recovery mode. */ | 178 /* RW firmware never runs in recovery mode. */ |
170 if (!(key_block->key_block_flags & KEY_BLOCK_FLAG_RECOVERY_0)) { | 179 if (!(key_block->key_block_flags & KEY_BLOCK_FLAG_RECOVERY_0)) { |
171 VBDEBUG(("Recovery flag mismatch.\n")); | 180 VBDEBUG(("Recovery flag mismatch.\n")); |
| 181 *check_result = VBSD_LF_CHECK_REC_MISMATCH; |
172 continue; | 182 continue; |
173 } | 183 } |
174 | 184 |
175 /* Verify the key block */ | 185 /* Verify the key block */ |
176 VBPERFSTART("VB_VKB"); | 186 VBPERFSTART("VB_VKB"); |
177 if ((0 != KeyBlockVerify(key_block, vblock_size, root_key, 0))) { | 187 if ((0 != KeyBlockVerify(key_block, vblock_size, root_key, 0))) { |
178 VBDEBUG(("Key block verification failed.\n")); | 188 VBDEBUG(("Key block verification failed.\n")); |
| 189 *check_result = VBSD_LF_CHECK_VERIFY_KEYBLOCK; |
179 VBPERFEND("VB_VKB"); | 190 VBPERFEND("VB_VKB"); |
180 continue; | 191 continue; |
181 } | 192 } |
182 VBPERFEND("VB_VKB"); | 193 VBPERFEND("VB_VKB"); |
183 | 194 |
184 /* Check for rollback of key version. */ | 195 /* Check for rollback of key version. */ |
185 key_version = key_block->data_key.key_version; | 196 key_version = key_block->data_key.key_version; |
186 if (key_version < (tpm_version >> 16)) { | 197 if (key_version < (tpm_version >> 16)) { |
187 VBDEBUG(("Key rollback detected.\n")); | 198 VBDEBUG(("Key rollback detected.\n")); |
| 199 *check_result = VBSD_LF_CHECK_KEY_ROLLBACK; |
188 continue; | 200 continue; |
189 } | 201 } |
190 | 202 |
191 /* Get the key for preamble/data verification from the key block. */ | 203 /* Get the key for preamble/data verification from the key block. */ |
192 data_key = PublicKeyToRSA(&key_block->data_key); | 204 data_key = PublicKeyToRSA(&key_block->data_key); |
193 if (!data_key) { | 205 if (!data_key) { |
194 VBDEBUG(("Unable to parse data key.\n")); | 206 VBDEBUG(("Unable to parse data key.\n")); |
| 207 *check_result = VBSD_LF_CHECK_DATA_KEY_PARSE; |
195 continue; | 208 continue; |
196 } | 209 } |
197 | 210 |
198 /* Verify the preamble, which follows the key block. */ | 211 /* Verify the preamble, which follows the key block. */ |
199 VBPERFSTART("VB_VPB"); | 212 VBPERFSTART("VB_VPB"); |
200 preamble = (VbFirmwarePreambleHeader*)((uint8_t*)key_block + | 213 preamble = (VbFirmwarePreambleHeader*)((uint8_t*)key_block + |
201 key_block->key_block_size); | 214 key_block->key_block_size); |
202 if ((0 != VerifyFirmwarePreamble(preamble, | 215 if ((0 != VerifyFirmwarePreamble(preamble, |
203 vblock_size - key_block->key_block_size, | 216 vblock_size - key_block->key_block_size, |
204 data_key))) { | 217 data_key))) { |
205 VBDEBUG(("Preamble verfication failed.\n")); | 218 VBDEBUG(("Preamble verfication failed.\n")); |
| 219 *check_result = VBSD_LF_CHECK_VERIFY_PREAMBLE; |
206 RSAPublicKeyFree(data_key); | 220 RSAPublicKeyFree(data_key); |
207 VBPERFEND("VB_VPB"); | 221 VBPERFEND("VB_VPB"); |
208 continue; | 222 continue; |
209 } | 223 } |
210 VBPERFEND("VB_VPB"); | 224 VBPERFEND("VB_VPB"); |
211 | 225 |
212 /* Check for rollback of firmware version. */ | 226 /* Check for rollback of firmware version. */ |
213 combined_version = ((key_version << 16) | | 227 combined_version = ((key_version << 16) | |
214 (preamble->firmware_version & 0xFFFF)); | 228 (preamble->firmware_version & 0xFFFF)); |
215 if (combined_version < tpm_version) { | 229 if (combined_version < tpm_version) { |
216 VBDEBUG(("Firmware version rollback detected.\n")); | 230 VBDEBUG(("Firmware version rollback detected.\n")); |
| 231 *check_result = VBSD_LF_CHECK_FW_ROLLBACK; |
217 RSAPublicKeyFree(data_key); | 232 RSAPublicKeyFree(data_key); |
218 continue; | 233 continue; |
219 } | 234 } |
220 | 235 |
| 236 /* Header for this firmware is valid */ |
| 237 *check_result = VBSD_LF_CHECK_HEADER_VALID; |
| 238 |
221 /* Check for lowest key version from a valid header. */ | 239 /* Check for lowest key version from a valid header. */ |
222 if (lowest_version > combined_version) | 240 if (lowest_version > combined_version) |
223 lowest_version = combined_version; | 241 lowest_version = combined_version; |
224 | 242 |
225 /* If we already have good firmware, no need to read another one; | 243 /* If we already have good firmware, no need to read another one; |
226 * we only needed to look at the versions to check for | 244 * we only needed to look at the versions to check for |
227 * rollback. */ | 245 * rollback. */ |
228 if (-1 != good_index) | 246 if (-1 != good_index) |
229 continue; | 247 continue; |
230 | 248 |
231 /* Read the firmware data */ | 249 /* Read the firmware data */ |
232 VBPERFSTART("VB_RFD"); | 250 VBPERFSTART("VB_RFD"); |
233 DigestInit(&lfi->body_digest_context, data_key->algorithm); | 251 DigestInit(&lfi->body_digest_context, data_key->algorithm); |
234 lfi->body_size_accum = 0; | 252 lfi->body_size_accum = 0; |
235 if (0 != GetFirmwareBody(params, index)) { | 253 if (0 != GetFirmwareBody(params, index)) { |
236 VBDEBUG(("GetFirmwareBody() failed for index %d\n", index)); | 254 VBDEBUG(("GetFirmwareBody() failed for index %d\n", index)); |
| 255 *check_result = VBSD_LF_CHECK_GET_FW_BODY; |
237 RSAPublicKeyFree(data_key); | 256 RSAPublicKeyFree(data_key); |
238 VBPERFEND("VB_RFD"); | 257 VBPERFEND("VB_RFD"); |
239 continue; | 258 continue; |
240 } | 259 } |
241 if (lfi->body_size_accum != preamble->body_signature.data_size) { | 260 if (lfi->body_size_accum != preamble->body_signature.data_size) { |
242 VBDEBUG(("Hash updated %d bytes but expected %d\n", | 261 VBDEBUG(("Hash updated %d bytes but expected %d\n", |
243 (int)lfi->body_size_accum, | 262 (int)lfi->body_size_accum, |
244 (int)preamble->body_signature.data_size)); | 263 (int)preamble->body_signature.data_size)); |
| 264 *check_result = VBSD_LF_CHECK_HASH_WRONG_SIZE; |
245 RSAPublicKeyFree(data_key); | 265 RSAPublicKeyFree(data_key); |
246 VBPERFEND("VB_RFD"); | 266 VBPERFEND("VB_RFD"); |
247 continue; | 267 continue; |
248 } | 268 } |
249 VBPERFEND("VB_RFD"); | 269 VBPERFEND("VB_RFD"); |
250 | 270 |
251 /* Verify firmware data */ | 271 /* Verify firmware data */ |
252 VBPERFSTART("VB_VFD"); | 272 VBPERFSTART("VB_VFD"); |
253 body_digest = DigestFinal(&lfi->body_digest_context); | 273 body_digest = DigestFinal(&lfi->body_digest_context); |
254 if (0 != VerifyDigest(body_digest, &preamble->body_signature, data_key)) { | 274 if (0 != VerifyDigest(body_digest, &preamble->body_signature, data_key)) { |
255 VBDEBUG(("Firmware body verification failed.\n")); | 275 VBDEBUG(("Firmware body verification failed.\n")); |
| 276 *check_result = VBSD_LF_CHECK_VERIFY_BODY; |
256 RSAPublicKeyFree(data_key); | 277 RSAPublicKeyFree(data_key); |
257 Free(body_digest); | 278 Free(body_digest); |
258 VBPERFEND("VB_VFD"); | 279 VBPERFEND("VB_VFD"); |
259 continue; | 280 continue; |
260 } | 281 } |
261 VBPERFEND("VB_VFD"); | 282 VBPERFEND("VB_VFD"); |
262 | 283 |
263 /* Done with the digest and data key, so can free them now */ | 284 /* Done with the digest and data key, so can free them now */ |
264 RSAPublicKeyFree(data_key); | 285 RSAPublicKeyFree(data_key); |
265 Free(body_digest); | 286 Free(body_digest); |
266 | 287 |
267 /* If we're still here, the firmware is valid. */ | 288 /* If we're still here, the firmware is valid. */ |
268 VBDEBUG(("Firmware %d is valid.\n", index)); | 289 VBDEBUG(("Firmware %d is valid.\n", index)); |
| 290 *check_result = VBSD_LF_CHECK_VALID; |
269 if (-1 == good_index) { | 291 if (-1 == good_index) { |
270 /* Save the key we actually used */ | 292 /* Save the key we actually used */ |
271 if (0 != VbSharedDataSetKernelKey(shared, &preamble->kernel_subkey)) { | 293 if (0 != VbSharedDataSetKernelKey(shared, &preamble->kernel_subkey)) { |
272 VBDEBUG(("Unable to save kernel subkey to shared data.\n")); | 294 VBDEBUG(("Unable to save kernel subkey to shared data.\n")); |
273 continue; /* The firmware signature was good, but the public | 295 continue; /* The firmware signature was good, but the public |
274 * key was bigger that the caller can handle. */ | 296 * key was bigger that the caller can handle. */ |
275 } | 297 } |
276 | 298 |
277 /* Save the good index, now that we're sure we can actually use | 299 /* Save the good index, now that we're sure we can actually use |
278 * this firmware. That's the one we'll boot. */ | 300 * this firmware. That's the one we'll boot. */ |
(...skipping 26 matching lines...) Expand all Loading... |
305 } | 327 } |
306 | 328 |
307 /* Free internal data */ | 329 /* Free internal data */ |
308 Free(lfi); | 330 Free(lfi); |
309 params->load_firmware_internal = NULL; | 331 params->load_firmware_internal = NULL; |
310 | 332 |
311 /* Handle finding good firmware */ | 333 /* Handle finding good firmware */ |
312 if (good_index >= 0) { | 334 if (good_index >= 0) { |
313 | 335 |
314 /* Update TPM if necessary */ | 336 /* Update TPM if necessary */ |
| 337 shared->fw_version_lowest = (uint32_t)lowest_version; |
315 if (lowest_version > tpm_version) { | 338 if (lowest_version > tpm_version) { |
316 VBPERFSTART("VB_TPMU"); | 339 VBPERFSTART("VB_TPMU"); |
317 status = RollbackFirmwareWrite((uint32_t)lowest_version); | 340 status = RollbackFirmwareWrite((uint32_t)lowest_version); |
318 VBPERFEND("VB_TPMU"); | 341 VBPERFEND("VB_TPMU"); |
319 if (0 != status) { | 342 if (0 != status) { |
320 VBDEBUG(("Unable to write stored versions.\n")); | 343 VBDEBUG(("Unable to write stored versions.\n")); |
321 if (status == TPM_E_MUST_REBOOT) | 344 if (status == TPM_E_MUST_REBOOT) |
322 retval = LOAD_FIRMWARE_REBOOT; | 345 retval = LOAD_FIRMWARE_REBOOT; |
323 else | 346 else |
324 recovery = VBNV_RECOVERY_RO_TPM_ERROR; | 347 recovery = VBNV_RECOVERY_RO_TPM_ERROR; |
325 goto LoadFirmwareExit; | 348 goto LoadFirmwareExit; |
326 } | 349 } |
327 } | 350 } |
328 | 351 |
329 /* Lock firmware versions in TPM */ | 352 /* Lock firmware versions in TPM */ |
330 VBPERFSTART("VB_TPML"); | 353 VBPERFSTART("VB_TPML"); |
331 status = RollbackFirmwareLock(); | 354 status = RollbackFirmwareLock(); |
332 VBPERFEND("VB_TPML"); | 355 VBPERFEND("VB_TPML"); |
333 if (0 != status) { | 356 if (0 != status) { |
334 VBDEBUG(("Unable to lock firmware versions.\n")); | 357 VBDEBUG(("Unable to lock firmware versions.\n")); |
335 if (status == TPM_E_MUST_REBOOT) | 358 if (status == TPM_E_MUST_REBOOT) |
336 retval = LOAD_FIRMWARE_REBOOT; | 359 retval = LOAD_FIRMWARE_REBOOT; |
337 else | 360 else |
338 recovery = VBNV_RECOVERY_RO_TPM_ERROR; | 361 recovery = VBNV_RECOVERY_RO_TPM_ERROR; |
339 goto LoadFirmwareExit; | 362 goto LoadFirmwareExit; |
340 } | 363 } |
341 | 364 |
342 /* Success */ | 365 /* Success */ |
343 VBDEBUG(("Will boot firmware index %d\n", (int)params->firmware_index)); | 366 VBDEBUG(("Will boot firmware index %d\n", (int)params->firmware_index)); |
| 367 shared->firmware_index = (uint8_t)params->firmware_index; |
344 retval = LOAD_FIRMWARE_SUCCESS; | 368 retval = LOAD_FIRMWARE_SUCCESS; |
345 } else { | 369 } else { |
346 /* No good firmware, so go to recovery mode. */ | 370 /* No good firmware, so go to recovery mode. */ |
347 VBDEBUG(("Alas, no good firmware.\n")); | 371 VBDEBUG(("Alas, no good firmware.\n")); |
348 recovery = VBNV_RECOVERY_RO_INVALID_RW; | 372 recovery = VBNV_RECOVERY_RO_INVALID_RW; |
349 } | 373 } |
350 | 374 |
351 LoadFirmwareExit: | 375 LoadFirmwareExit: |
352 /* Store recovery request, if any, then tear down non-volatile storage */ | 376 /* Store recovery request, if any, then tear down non-volatile storage */ |
353 VbNvSet(vnc, VBNV_RECOVERY_REQUEST, LOAD_FIRMWARE_RECOVERY == retval ? | 377 VbNvSet(vnc, VBNV_RECOVERY_REQUEST, LOAD_FIRMWARE_RECOVERY == retval ? |
(...skipping 18 matching lines...) Expand all Loading... |
372 uint32_t status = RollbackS3Resume(); | 396 uint32_t status = RollbackS3Resume(); |
373 | 397 |
374 /* If we can't resume, just do a full reboot. No need to go to recovery | 398 /* If we can't resume, just do a full reboot. No need to go to recovery |
375 * mode here, since if the TPM is really broken we'll catch it on the | 399 * mode here, since if the TPM is really broken we'll catch it on the |
376 * next boot. */ | 400 * next boot. */ |
377 if (status == TPM_SUCCESS) | 401 if (status == TPM_SUCCESS) |
378 return LOAD_FIRMWARE_SUCCESS; | 402 return LOAD_FIRMWARE_SUCCESS; |
379 else | 403 else |
380 return LOAD_FIRMWARE_REBOOT; | 404 return LOAD_FIRMWARE_REBOOT; |
381 } | 405 } |
OLD | NEW |