OLD | NEW |
1 /* Copyright (c) 2011 The Chromium OS Authors. All rights reserved. | 1 /* Copyright (c) 2011 The Chromium OS Authors. All rights reserved. |
2 * Use of this source code is governed by a BSD-style license that can be | 2 * Use of this source code is governed by a BSD-style license that can be |
3 * found in the LICENSE file. | 3 * found in the LICENSE file. |
4 * | 4 * |
5 * High-level firmware API for loading and verifying rewritable firmware. | 5 * High-level firmware API for loading and verifying rewritable firmware. |
6 * (Firmware portion) | 6 * (Firmware portion) |
7 */ | 7 */ |
8 | 8 |
9 #include "gbb_header.h" | 9 #include "gbb_header.h" |
10 #include "load_firmware_fw.h" | 10 #include "load_firmware_fw.h" |
11 #include "rollback_index.h" | 11 #include "rollback_index.h" |
| 12 #include "tpm_bootmode.h" |
12 #include "utility.h" | 13 #include "utility.h" |
13 #include "vboot_common.h" | 14 #include "vboot_common.h" |
14 #include "vboot_nvstorage.h" | 15 #include "vboot_nvstorage.h" |
15 | 16 |
16 /* Static variables for UpdateFirmwareBodyHash(). It's less than | 17 /* Static variables for UpdateFirmwareBodyHash(). It's less than |
17 * optimal to have static variables in a library, but in UEFI the | 18 * optimal to have static variables in a library, but in UEFI the |
18 * caller is deep inside a different firmware stack and doesn't have a | 19 * caller is deep inside a different firmware stack and doesn't have a |
19 * good way to pass the params struct back to us. */ | 20 * good way to pass the params struct back to us. */ |
20 typedef struct VbLoadFirmwareInternal { | 21 typedef struct VbLoadFirmwareInternal { |
21 DigestContext body_digest_context; | 22 DigestContext body_digest_context; |
22 uint64_t body_size_accum; | 23 uint64_t body_size_accum; |
23 } VbLoadFirmwareInternal; | 24 } VbLoadFirmwareInternal; |
24 | 25 |
25 | 26 |
26 void UpdateFirmwareBodyHash(LoadFirmwareParams* params, | 27 void UpdateFirmwareBodyHash(LoadFirmwareParams* params, |
27 uint8_t* data, uint64_t size) { | 28 uint8_t* data, uint64_t size) { |
28 VbLoadFirmwareInternal* lfi = | 29 VbLoadFirmwareInternal* lfi = |
29 (VbLoadFirmwareInternal*)params->load_firmware_internal; | 30 (VbLoadFirmwareInternal*)params->load_firmware_internal; |
30 | 31 |
31 DigestUpdate(&lfi->body_digest_context, data, size); | 32 DigestUpdate(&lfi->body_digest_context, data, size); |
32 lfi->body_size_accum += size; | 33 lfi->body_size_accum += size; |
33 } | 34 } |
34 | 35 |
35 | 36 |
36 int LoadFirmwareSetup(void) { | 37 int LoadFirmwareSetup(void) { |
| 38 /* TODO: handle test errors (requires passing in VbNvContext) */ |
| 39 /* TODO: record timer values (requires passing in VbSharedData) */ |
37 /* TODO: start initializing the TPM */ | 40 /* TODO: start initializing the TPM */ |
38 return LOAD_FIRMWARE_SUCCESS; | 41 return LOAD_FIRMWARE_SUCCESS; |
39 } | 42 } |
40 | 43 |
41 | 44 |
42 int LoadFirmware(LoadFirmwareParams* params) { | 45 int LoadFirmware(LoadFirmwareParams* params) { |
43 VbSharedDataHeader* shared = (VbSharedDataHeader*)params->shared_data_blob; | 46 VbSharedDataHeader* shared = (VbSharedDataHeader*)params->shared_data_blob; |
44 GoogleBinaryBlockHeader* gbb = (GoogleBinaryBlockHeader*)params->gbb_data; | 47 GoogleBinaryBlockHeader* gbb = (GoogleBinaryBlockHeader*)params->gbb_data; |
45 VbPublicKey* root_key; | 48 VbPublicKey* root_key; |
46 VbLoadFirmwareInternal* lfi; | 49 VbLoadFirmwareInternal* lfi; |
47 VbNvContext* vnc = params->nv_context; | 50 VbNvContext* vnc = params->nv_context; |
48 | 51 |
49 uint32_t try_b_count; | 52 uint32_t try_b_count; |
50 uint32_t tpm_version = 0; | 53 uint32_t tpm_version = 0; |
51 uint64_t lowest_version = 0xFFFFFFFF; | 54 uint64_t lowest_version = 0xFFFFFFFF; |
52 uint32_t status; | 55 uint32_t status; |
| 56 uint32_t test_err = 0; |
53 int good_index = -1; | 57 int good_index = -1; |
| 58 uint64_t boot_fw_keyblock_flags = 0; |
54 int is_dev; | 59 int is_dev; |
55 int index; | 60 int index; |
56 int i; | 61 int i; |
57 | 62 |
58 int retval = LOAD_FIRMWARE_RECOVERY; | 63 int retval = LOAD_FIRMWARE_RECOVERY; |
59 int recovery = VBNV_RECOVERY_RO_UNSPECIFIED; | 64 int recovery = VBNV_RECOVERY_RO_UNSPECIFIED; |
60 | 65 |
61 /* Clear output params in case we fail */ | 66 /* Clear output params in case we fail */ |
62 params->firmware_index = 0; | 67 params->firmware_index = 0; |
63 | 68 |
64 VBDEBUG(("LoadFirmware started...\n")); | 69 VBDEBUG(("LoadFirmware started...\n")); |
65 | 70 |
66 /* Setup NV storage */ | 71 /* Setup NV storage */ |
67 VbNvSetup(vnc); | 72 VbNvSetup(vnc); |
68 | 73 |
69 /* Initialize shared data structure. */ | 74 /* Initialize shared data structure. */ |
70 if (0 != VbSharedDataInit(shared, params->shared_data_size)) { | 75 if (0 != VbSharedDataInit(shared, params->shared_data_size)) { |
71 VBDEBUG(("Shared data init error\n")); | 76 VBDEBUG(("Shared data init error\n")); |
72 recovery = VBNV_RECOVERY_RO_SHARED_DATA; | 77 recovery = VBNV_RECOVERY_RO_SHARED_DATA; |
73 goto LoadFirmwareExit; | 78 goto LoadFirmwareExit; |
74 } | 79 } |
| 80 shared->timer_load_firmware_enter = VbGetTimer(); |
| 81 |
| 82 /* Handle test errors */ |
| 83 VbNvGet(vnc, VBNV_TEST_ERROR_FUNC, &test_err); |
| 84 if (VBNV_TEST_ERROR_LOAD_FIRMWARE == test_err) { |
| 85 /* Get error code */ |
| 86 VbNvGet(vnc, VBNV_TEST_ERROR_NUM, &test_err); |
| 87 /* Clear test params so we don't repeat the error */ |
| 88 VbNvSet(vnc, VBNV_TEST_ERROR_FUNC, 0); |
| 89 VbNvSet(vnc, VBNV_TEST_ERROR_NUM, 0); |
| 90 /* Handle error codes */ |
| 91 switch (test_err) { |
| 92 case LOAD_FIRMWARE_RECOVERY: |
| 93 recovery = VBNV_RECOVERY_RO_TEST_LF; |
| 94 goto LoadFirmwareExit; |
| 95 case LOAD_FIRMWARE_REBOOT: |
| 96 retval = test_err; |
| 97 goto LoadFirmwareExit; |
| 98 default: |
| 99 break; |
| 100 } |
| 101 } |
75 | 102 |
76 /* Must have a root key from the GBB */ | 103 /* Must have a root key from the GBB */ |
77 if (!gbb) { | 104 if (!gbb) { |
78 VBDEBUG(("No GBB\n")); | 105 VBDEBUG(("No GBB\n")); |
79 goto LoadFirmwareExit; | 106 goto LoadFirmwareExit; |
80 } | 107 } |
81 root_key = (VbPublicKey*)((uint8_t*)gbb + gbb->rootkey_offset); | 108 root_key = (VbPublicKey*)((uint8_t*)gbb + gbb->rootkey_offset); |
82 | 109 |
83 /* Parse flags */ | 110 /* Parse flags */ |
84 is_dev = (params->boot_flags & BOOT_FLAG_DEVELOPER ? 1 : 0); | 111 is_dev = (params->boot_flags & BOOT_FLAG_DEVELOPER ? 1 : 0); |
| 112 if (is_dev) |
| 113 shared->flags |= VBSD_LF_DEV_SWITCH_ON; |
85 | 114 |
86 /* Initialize the TPM and read rollback indices. */ | 115 /* Initialize the TPM and read rollback indices. */ |
87 VBPERFSTART("VB_TPMI"); | 116 VBPERFSTART("VB_TPMI"); |
88 status = RollbackFirmwareSetup(is_dev, &tpm_version); | 117 status = RollbackFirmwareSetup(is_dev, &tpm_version); |
89 if (0 != status) { | 118 if (0 != status) { |
90 VBDEBUG(("Unable to setup TPM and read stored versions.\n")); | 119 VBDEBUG(("Unable to setup TPM and read stored versions.\n")); |
91 VBPERFEND("VB_TPMI"); | 120 VBPERFEND("VB_TPMI"); |
92 if (status == TPM_E_MUST_REBOOT) | 121 if (status == TPM_E_MUST_REBOOT) |
93 retval = LOAD_FIRMWARE_REBOOT; | 122 retval = LOAD_FIRMWARE_REBOOT; |
94 else | 123 else |
95 recovery = VBNV_RECOVERY_RO_TPM_ERROR; | 124 recovery = VBNV_RECOVERY_RO_TPM_ERROR; |
96 goto LoadFirmwareExit; | 125 goto LoadFirmwareExit; |
97 } | 126 } |
| 127 shared->fw_version_tpm_start = tpm_version; |
| 128 shared->fw_version_tpm = tpm_version; |
98 VBPERFEND("VB_TPMI"); | 129 VBPERFEND("VB_TPMI"); |
99 | 130 |
100 /* Read try-b count and decrement if necessary */ | 131 /* Read try-b count and decrement if necessary */ |
101 VbNvGet(vnc, VBNV_TRY_B_COUNT, &try_b_count); | 132 VbNvGet(vnc, VBNV_TRY_B_COUNT, &try_b_count); |
102 if (0 != try_b_count) | 133 if (0 != try_b_count) { |
103 VbNvSet(vnc, VBNV_TRY_B_COUNT, try_b_count - 1); | 134 VbNvSet(vnc, VBNV_TRY_B_COUNT, try_b_count - 1); |
104 VbNvSet(vnc, VBNV_TRIED_FIRMWARE_B, try_b_count ? 1 : 0); | 135 shared->flags |= VBSD_FWB_TRIED; |
| 136 } |
105 | 137 |
106 /* Allocate our internal data */ | 138 /* Allocate our internal data */ |
107 lfi = (VbLoadFirmwareInternal*)Malloc(sizeof(VbLoadFirmwareInternal)); | 139 lfi = (VbLoadFirmwareInternal*)Malloc(sizeof(VbLoadFirmwareInternal)); |
108 if (!lfi) | 140 if (!lfi) |
109 return LOAD_FIRMWARE_RECOVERY; | 141 return LOAD_FIRMWARE_RECOVERY; |
110 | 142 |
111 params->load_firmware_internal = (uint8_t*)lfi; | 143 params->load_firmware_internal = (uint8_t*)lfi; |
112 | 144 |
113 /* Loop over indices */ | 145 /* Loop over indices */ |
114 for (i = 0; i < 2; i++) { | 146 for (i = 0; i < 2; i++) { |
115 VbKeyBlockHeader* key_block; | 147 VbKeyBlockHeader* key_block; |
116 uint64_t vblock_size; | 148 uint64_t vblock_size; |
117 VbFirmwarePreambleHeader* preamble; | 149 VbFirmwarePreambleHeader* preamble; |
118 RSAPublicKey* data_key; | 150 RSAPublicKey* data_key; |
119 uint64_t key_version; | 151 uint64_t key_version; |
120 uint64_t combined_version; | 152 uint64_t combined_version; |
121 uint8_t* body_digest; | 153 uint8_t* body_digest; |
| 154 uint8_t* check_result; |
122 | 155 |
123 /* If try B count is non-zero try firmware B first */ | 156 /* If try B count is non-zero try firmware B first */ |
124 index = (try_b_count ? 1 - i : i); | 157 index = (try_b_count ? 1 - i : i); |
125 if (0 == index) { | 158 if (0 == index) { |
126 key_block = (VbKeyBlockHeader*)params->verification_block_0; | 159 key_block = (VbKeyBlockHeader*)params->verification_block_0; |
127 vblock_size = params->verification_size_0; | 160 vblock_size = params->verification_size_0; |
| 161 check_result = &shared->check_fw_a_result; |
128 } else { | 162 } else { |
129 key_block = (VbKeyBlockHeader*)params->verification_block_1; | 163 key_block = (VbKeyBlockHeader*)params->verification_block_1; |
130 vblock_size = params->verification_size_1; | 164 vblock_size = params->verification_size_1; |
| 165 check_result = &shared->check_fw_b_result; |
131 } | 166 } |
132 | 167 |
133 /* Check the key block flags against the current boot mode. Do this | 168 /* Check the key block flags against the current boot mode. Do this |
134 * before verifying the key block, since flags are faster to check than | 169 * before verifying the key block, since flags are faster to check than |
135 * the RSA signature. */ | 170 * the RSA signature. */ |
136 if (!(key_block->key_block_flags & | 171 if (!(key_block->key_block_flags & |
137 (is_dev ? KEY_BLOCK_FLAG_DEVELOPER_1 : | 172 (is_dev ? KEY_BLOCK_FLAG_DEVELOPER_1 : |
138 KEY_BLOCK_FLAG_DEVELOPER_0))) { | 173 KEY_BLOCK_FLAG_DEVELOPER_0))) { |
139 VBDEBUG(("Developer flag mismatch.\n")); | 174 VBDEBUG(("Developer flag mismatch.\n")); |
| 175 *check_result = VBSD_LF_CHECK_DEV_MISMATCH; |
140 continue; | 176 continue; |
141 } | 177 } |
142 /* RW firmware never runs in recovery mode. */ | 178 /* RW firmware never runs in recovery mode. */ |
143 if (!(key_block->key_block_flags & KEY_BLOCK_FLAG_RECOVERY_0)) { | 179 if (!(key_block->key_block_flags & KEY_BLOCK_FLAG_RECOVERY_0)) { |
144 VBDEBUG(("Recovery flag mismatch.\n")); | 180 VBDEBUG(("Recovery flag mismatch.\n")); |
| 181 *check_result = VBSD_LF_CHECK_REC_MISMATCH; |
145 continue; | 182 continue; |
146 } | 183 } |
147 | 184 |
148 /* Verify the key block */ | 185 /* Verify the key block */ |
149 VBPERFSTART("VB_VKB"); | 186 VBPERFSTART("VB_VKB"); |
150 if ((0 != KeyBlockVerify(key_block, vblock_size, root_key, 0))) { | 187 if ((0 != KeyBlockVerify(key_block, vblock_size, root_key, 0))) { |
151 VBDEBUG(("Key block verification failed.\n")); | 188 VBDEBUG(("Key block verification failed.\n")); |
| 189 *check_result = VBSD_LF_CHECK_VERIFY_KEYBLOCK; |
152 VBPERFEND("VB_VKB"); | 190 VBPERFEND("VB_VKB"); |
153 continue; | 191 continue; |
154 } | 192 } |
155 VBPERFEND("VB_VKB"); | 193 VBPERFEND("VB_VKB"); |
156 | 194 |
157 /* Check for rollback of key version. */ | 195 /* Check for rollback of key version. */ |
158 key_version = key_block->data_key.key_version; | 196 key_version = key_block->data_key.key_version; |
159 if (key_version < (tpm_version >> 16)) { | 197 if (key_version < (tpm_version >> 16)) { |
160 VBDEBUG(("Key rollback detected.\n")); | 198 VBDEBUG(("Key rollback detected.\n")); |
| 199 *check_result = VBSD_LF_CHECK_KEY_ROLLBACK; |
161 continue; | 200 continue; |
162 } | 201 } |
163 | 202 |
164 /* Get the key for preamble/data verification from the key block. */ | 203 /* Get the key for preamble/data verification from the key block. */ |
165 data_key = PublicKeyToRSA(&key_block->data_key); | 204 data_key = PublicKeyToRSA(&key_block->data_key); |
166 if (!data_key) { | 205 if (!data_key) { |
167 VBDEBUG(("Unable to parse data key.\n")); | 206 VBDEBUG(("Unable to parse data key.\n")); |
| 207 *check_result = VBSD_LF_CHECK_DATA_KEY_PARSE; |
168 continue; | 208 continue; |
169 } | 209 } |
170 | 210 |
171 /* Verify the preamble, which follows the key block. */ | 211 /* Verify the preamble, which follows the key block. */ |
172 VBPERFSTART("VB_VPB"); | 212 VBPERFSTART("VB_VPB"); |
173 preamble = (VbFirmwarePreambleHeader*)((uint8_t*)key_block + | 213 preamble = (VbFirmwarePreambleHeader*)((uint8_t*)key_block + |
174 key_block->key_block_size); | 214 key_block->key_block_size); |
175 if ((0 != VerifyFirmwarePreamble(preamble, | 215 if ((0 != VerifyFirmwarePreamble(preamble, |
176 vblock_size - key_block->key_block_size, | 216 vblock_size - key_block->key_block_size, |
177 data_key))) { | 217 data_key))) { |
178 VBDEBUG(("Preamble verfication failed.\n")); | 218 VBDEBUG(("Preamble verfication failed.\n")); |
| 219 *check_result = VBSD_LF_CHECK_VERIFY_PREAMBLE; |
179 RSAPublicKeyFree(data_key); | 220 RSAPublicKeyFree(data_key); |
180 VBPERFEND("VB_VPB"); | 221 VBPERFEND("VB_VPB"); |
181 continue; | 222 continue; |
182 } | 223 } |
183 VBPERFEND("VB_VPB"); | 224 VBPERFEND("VB_VPB"); |
184 | 225 |
185 /* Check for rollback of firmware version. */ | 226 /* Check for rollback of firmware version. */ |
186 combined_version = ((key_version << 16) | | 227 combined_version = ((key_version << 16) | |
187 (preamble->firmware_version & 0xFFFF)); | 228 (preamble->firmware_version & 0xFFFF)); |
188 if (combined_version < tpm_version) { | 229 if (combined_version < tpm_version) { |
189 VBDEBUG(("Firmware version rollback detected.\n")); | 230 VBDEBUG(("Firmware version rollback detected.\n")); |
| 231 *check_result = VBSD_LF_CHECK_FW_ROLLBACK; |
190 RSAPublicKeyFree(data_key); | 232 RSAPublicKeyFree(data_key); |
191 continue; | 233 continue; |
192 } | 234 } |
193 | 235 |
| 236 /* Header for this firmware is valid */ |
| 237 *check_result = VBSD_LF_CHECK_HEADER_VALID; |
| 238 |
194 /* Check for lowest key version from a valid header. */ | 239 /* Check for lowest key version from a valid header. */ |
195 if (lowest_version > combined_version) | 240 if (lowest_version > combined_version) |
196 lowest_version = combined_version; | 241 lowest_version = combined_version; |
197 | 242 |
198 /* If we already have good firmware, no need to read another one; | 243 /* If we already have good firmware, no need to read another one; |
199 * we only needed to look at the versions to check for | 244 * we only needed to look at the versions to check for |
200 * rollback. */ | 245 * rollback. */ |
201 if (-1 != good_index) | 246 if (-1 != good_index) |
202 continue; | 247 continue; |
203 | 248 |
204 /* Read the firmware data */ | 249 /* Read the firmware data */ |
205 VBPERFSTART("VB_RFD"); | 250 VBPERFSTART("VB_RFD"); |
206 DigestInit(&lfi->body_digest_context, data_key->algorithm); | 251 DigestInit(&lfi->body_digest_context, data_key->algorithm); |
207 lfi->body_size_accum = 0; | 252 lfi->body_size_accum = 0; |
208 if (0 != GetFirmwareBody(params, index)) { | 253 if (0 != GetFirmwareBody(params, index)) { |
209 VBDEBUG(("GetFirmwareBody() failed for index %d\n", index)); | 254 VBDEBUG(("GetFirmwareBody() failed for index %d\n", index)); |
| 255 *check_result = VBSD_LF_CHECK_GET_FW_BODY; |
210 RSAPublicKeyFree(data_key); | 256 RSAPublicKeyFree(data_key); |
211 VBPERFEND("VB_RFD"); | 257 VBPERFEND("VB_RFD"); |
212 continue; | 258 continue; |
213 } | 259 } |
214 if (lfi->body_size_accum != preamble->body_signature.data_size) { | 260 if (lfi->body_size_accum != preamble->body_signature.data_size) { |
215 VBDEBUG(("Hash updated %d bytes but expected %d\n", | 261 VBDEBUG(("Hash updated %d bytes but expected %d\n", |
216 (int)lfi->body_size_accum, | 262 (int)lfi->body_size_accum, |
217 (int)preamble->body_signature.data_size)); | 263 (int)preamble->body_signature.data_size)); |
| 264 *check_result = VBSD_LF_CHECK_HASH_WRONG_SIZE; |
218 RSAPublicKeyFree(data_key); | 265 RSAPublicKeyFree(data_key); |
219 VBPERFEND("VB_RFD"); | 266 VBPERFEND("VB_RFD"); |
220 continue; | 267 continue; |
221 } | 268 } |
222 VBPERFEND("VB_RFD"); | 269 VBPERFEND("VB_RFD"); |
223 | 270 |
224 /* Verify firmware data */ | 271 /* Verify firmware data */ |
225 VBPERFSTART("VB_VFD"); | 272 VBPERFSTART("VB_VFD"); |
226 body_digest = DigestFinal(&lfi->body_digest_context); | 273 body_digest = DigestFinal(&lfi->body_digest_context); |
227 if (0 != VerifyDigest(body_digest, &preamble->body_signature, data_key)) { | 274 if (0 != VerifyDigest(body_digest, &preamble->body_signature, data_key)) { |
228 VBDEBUG(("Firmware body verification failed.\n")); | 275 VBDEBUG(("Firmware body verification failed.\n")); |
| 276 *check_result = VBSD_LF_CHECK_VERIFY_BODY; |
229 RSAPublicKeyFree(data_key); | 277 RSAPublicKeyFree(data_key); |
230 Free(body_digest); | 278 Free(body_digest); |
231 VBPERFEND("VB_VFD"); | 279 VBPERFEND("VB_VFD"); |
232 continue; | 280 continue; |
233 } | 281 } |
234 VBPERFEND("VB_VFD"); | 282 VBPERFEND("VB_VFD"); |
235 | 283 |
236 /* Done with the digest and data key, so can free them now */ | 284 /* Done with the digest and data key, so can free them now */ |
237 RSAPublicKeyFree(data_key); | 285 RSAPublicKeyFree(data_key); |
238 Free(body_digest); | 286 Free(body_digest); |
239 | 287 |
240 /* If we're still here, the firmware is valid. */ | 288 /* If we're still here, the firmware is valid. */ |
241 VBDEBUG(("Firmware %d is valid.\n", index)); | 289 VBDEBUG(("Firmware %d is valid.\n", index)); |
| 290 *check_result = VBSD_LF_CHECK_VALID; |
242 if (-1 == good_index) { | 291 if (-1 == good_index) { |
243 /* Save the key we actually used */ | 292 /* Save the key we actually used */ |
244 if (0 != VbSharedDataSetKernelKey(shared, &preamble->kernel_subkey)) { | 293 if (0 != VbSharedDataSetKernelKey(shared, &preamble->kernel_subkey)) { |
245 VBDEBUG(("Unable to save kernel subkey to shared data.\n")); | 294 VBDEBUG(("Unable to save kernel subkey to shared data.\n")); |
246 continue; /* The firmware signature was good, but the public | 295 continue; /* The firmware signature was good, but the public |
247 * key was bigger that the caller can handle. */ | 296 * key was bigger that the caller can handle. */ |
248 } | 297 } |
249 | 298 |
250 /* Save the good index, now that we're sure we can actually use | 299 /* Save the good index, now that we're sure we can actually use |
251 * this firmware. That's the one we'll boot. */ | 300 * this firmware. That's the one we'll boot. */ |
252 good_index = index; | 301 good_index = index; |
253 params->firmware_index = index; | 302 params->firmware_index = index; |
| 303 /* Since we now know which firmware to boot, we can update the |
| 304 * bootable firmware key block mode. */ |
| 305 boot_fw_keyblock_flags = key_block->key_block_flags; |
254 | 306 |
255 /* If the good firmware's key version is the same as the tpm, | 307 /* If the good firmware's key version is the same as the tpm, |
256 * then the TPM doesn't need updating; we can stop now. | 308 * then the TPM doesn't need updating; we can stop now. |
257 * Otherwise, we'll check all the other headers to see if they | 309 * Otherwise, we'll check all the other headers to see if they |
258 * contain a newer key. */ | 310 * contain a newer key. */ |
259 if (combined_version == tpm_version) | 311 if (combined_version == tpm_version) |
260 break; | 312 break; |
261 } | 313 } |
262 } | 314 } |
263 | 315 |
| 316 /* At this point, we have a good idea of how we are going to boot. Update the |
| 317 * TPM with this state information. |
| 318 */ |
| 319 status = SetTPMBootModeState(is_dev, 0, (int)boot_fw_keyblock_flags); |
| 320 if (0 != status) { |
| 321 VBDEBUG(("Unable to update the TPM with boot mode information.\n")); |
| 322 if (status == TPM_E_MUST_REBOOT) |
| 323 retval = LOAD_FIRMWARE_REBOOT; |
| 324 else |
| 325 recovery = VBNV_RECOVERY_RO_TPM_ERROR; |
| 326 goto LoadFirmwareExit; |
| 327 } |
| 328 |
264 /* Free internal data */ | 329 /* Free internal data */ |
265 Free(lfi); | 330 Free(lfi); |
266 params->load_firmware_internal = NULL; | 331 params->load_firmware_internal = NULL; |
267 | 332 |
268 /* Handle finding good firmware */ | 333 /* Handle finding good firmware */ |
269 if (good_index >= 0) { | 334 if (good_index >= 0) { |
270 | 335 |
271 /* Update TPM if necessary */ | 336 /* Update TPM if necessary */ |
| 337 shared->fw_version_lowest = (uint32_t)lowest_version; |
272 if (lowest_version > tpm_version) { | 338 if (lowest_version > tpm_version) { |
273 VBPERFSTART("VB_TPMU"); | 339 VBPERFSTART("VB_TPMU"); |
274 status = RollbackFirmwareWrite((uint32_t)lowest_version); | 340 status = RollbackFirmwareWrite((uint32_t)lowest_version); |
275 VBPERFEND("VB_TPMU"); | 341 VBPERFEND("VB_TPMU"); |
276 if (0 != status) { | 342 if (0 != status) { |
277 VBDEBUG(("Unable to write stored versions.\n")); | 343 VBDEBUG(("Unable to write stored versions.\n")); |
278 if (status == TPM_E_MUST_REBOOT) | 344 if (status == TPM_E_MUST_REBOOT) |
279 retval = LOAD_FIRMWARE_REBOOT; | 345 retval = LOAD_FIRMWARE_REBOOT; |
280 else | 346 else |
281 recovery = VBNV_RECOVERY_RO_TPM_ERROR; | 347 recovery = VBNV_RECOVERY_RO_TPM_ERROR; |
282 goto LoadFirmwareExit; | 348 goto LoadFirmwareExit; |
283 } | 349 } |
| 350 shared->fw_version_tpm = (uint32_t)lowest_version; |
284 } | 351 } |
285 | 352 |
286 /* Lock firmware versions in TPM */ | 353 /* Lock firmware versions in TPM */ |
287 VBPERFSTART("VB_TPML"); | 354 VBPERFSTART("VB_TPML"); |
288 status = RollbackFirmwareLock(); | 355 status = RollbackFirmwareLock(); |
289 VBPERFEND("VB_TPML"); | 356 VBPERFEND("VB_TPML"); |
290 if (0 != status) { | 357 if (0 != status) { |
291 VBDEBUG(("Unable to lock firmware versions.\n")); | 358 VBDEBUG(("Unable to lock firmware versions.\n")); |
292 if (status == TPM_E_MUST_REBOOT) | 359 if (status == TPM_E_MUST_REBOOT) |
293 retval = LOAD_FIRMWARE_REBOOT; | 360 retval = LOAD_FIRMWARE_REBOOT; |
294 else | 361 else |
295 recovery = VBNV_RECOVERY_RO_TPM_ERROR; | 362 recovery = VBNV_RECOVERY_RO_TPM_ERROR; |
296 goto LoadFirmwareExit; | 363 goto LoadFirmwareExit; |
297 } | 364 } |
298 | 365 |
299 /* Success */ | 366 /* Success */ |
300 VBDEBUG(("Will boot firmware index %d\n", (int)params->firmware_index)); | 367 VBDEBUG(("Will boot firmware index %d\n", (int)params->firmware_index)); |
| 368 shared->firmware_index = (uint8_t)params->firmware_index; |
301 retval = LOAD_FIRMWARE_SUCCESS; | 369 retval = LOAD_FIRMWARE_SUCCESS; |
302 } else { | 370 } else { |
303 /* No good firmware, so go to recovery mode. */ | 371 /* No good firmware, so go to recovery mode. */ |
304 VBDEBUG(("Alas, no good firmware.\n")); | 372 VBDEBUG(("Alas, no good firmware.\n")); |
305 recovery = VBNV_RECOVERY_RO_INVALID_RW; | 373 recovery = VBNV_RECOVERY_RO_INVALID_RW; |
306 } | 374 } |
307 | 375 |
308 LoadFirmwareExit: | 376 LoadFirmwareExit: |
309 /* Store recovery request, if any, then tear down non-volatile storage */ | 377 /* Store recovery request, if any, then tear down non-volatile storage */ |
310 VbNvSet(vnc, VBNV_RECOVERY_REQUEST, LOAD_FIRMWARE_RECOVERY == retval ? | 378 VbNvSet(vnc, VBNV_RECOVERY_REQUEST, LOAD_FIRMWARE_RECOVERY == retval ? |
311 recovery : VBNV_RECOVERY_NOT_REQUESTED); | 379 recovery : VBNV_RECOVERY_NOT_REQUESTED); |
312 VbNvTeardown(vnc); | 380 VbNvTeardown(vnc); |
313 | 381 |
| 382 shared->timer_load_firmware_exit = VbGetTimer(); |
| 383 |
314 /* Note that we don't reduce params->shared_data_size to shared->data_used, | 384 /* Note that we don't reduce params->shared_data_size to shared->data_used, |
315 * since we want to leave space for LoadKernel() to add to the shared data | 385 * since we want to leave space for LoadKernel() to add to the shared data |
316 * buffer. */ | 386 * buffer. */ |
317 | 387 |
318 return retval; | 388 return retval; |
319 } | 389 } |
320 | 390 |
321 | 391 |
322 int S3Resume(void) { | 392 int S3Resume(void) { |
| 393 |
| 394 /* TODO: handle test errors (requires passing in VbNvContext) */ |
| 395 |
323 /* Resume the TPM */ | 396 /* Resume the TPM */ |
324 uint32_t status = RollbackS3Resume(); | 397 uint32_t status = RollbackS3Resume(); |
325 | 398 |
326 /* If we can't resume, just do a full reboot. No need to go to recovery | 399 /* If we can't resume, just do a full reboot. No need to go to recovery |
327 * mode here, since if the TPM is really broken we'll catch it on the | 400 * mode here, since if the TPM is really broken we'll catch it on the |
328 * next boot. */ | 401 * next boot. */ |
329 if (status == TPM_SUCCESS) | 402 if (status == TPM_SUCCESS) |
330 return LOAD_FIRMWARE_SUCCESS; | 403 return LOAD_FIRMWARE_SUCCESS; |
331 else | 404 else |
332 return LOAD_FIRMWARE_REBOOT; | 405 return LOAD_FIRMWARE_REBOOT; |
333 } | 406 } |
OLD | NEW |