/* Copyright (c) 2010 The Chromium OS Authors. All rights reserved. * Use of this source code is governed by a BSD-style license that can be * found in the LICENSE file. * * Functions for querying, manipulating and locking rollback indices * stored in the TPM NVRAM. */ #include "rollback_index.h" #include "tlcl.h" #include "tss_constants.h" #include "utility.h" uint16_t g_firmware_key_version = 0; uint16_t g_firmware_version = 0; uint16_t g_kernel_key_version = 0; uint16_t g_kernel_version = 0; #define RETURN_ON_FAILURE(tpm_command) do { \ uint32_t result; \ if ((result = (tpm_command)) != TPM_SUCCESS) { \ return result; \ } \ } while (0) static uint32_t TPMClearAndReenable() { RETURN_ON_FAILURE(TlclForceClear()); RETURN_ON_FAILURE(TlclSetEnable()); RETURN_ON_FAILURE(TlclSetDeactivated(0)); return TPM_SUCCESS; } /* Like TlclWrite(), but checks for write errors due to hitting the 64-write * limit and clears the TPM when that happens. This can only happen when the * TPM is unowned, so it is OK to clear it (and we really have no choice). * This is not expected to happen frequently, but it could happen. */ static uint32_t SafeWrite(uint32_t index, uint8_t* data, uint32_t length) { uint32_t result = TlclWrite(index, data, length); if (result == TPM_E_MAXNVWRITES) { RETURN_ON_FAILURE(TPMClearAndReenable()); return TlclWrite(index, data, length); } else { return result; } } static uint32_t InitializeKernelVersionsSpaces(void) { RETURN_ON_FAILURE(TlclDefineSpace(KERNEL_VERSIONS_NV_INDEX, TPM_NV_PER_PPWRITE, KERNEL_SPACE_SIZE)); RETURN_ON_FAILURE(SafeWrite(KERNEL_VERSIONS_NV_INDEX, KERNEL_SPACE_INIT_DATA, KERNEL_SPACE_SIZE)); return TPM_SUCCESS; } /* When the return value is TPM_SUCCESS, this function sets *|initialized| to 1 * if the spaces have been fully initialized, to 0 if not. Otherwise * *|initialized| is not changed. */ static uint32_t GetSpacesInitialized(int* initialized) { uint32_t space_holder; uint32_t result; result = TlclRead(TPM_IS_INITIALIZED_NV_INDEX, (uint8_t*) &space_holder, sizeof(space_holder)); switch (result) { case TPM_SUCCESS: *initialized = 1; break; case TPM_E_BADINDEX: *initialized = 0; result = TPM_SUCCESS; break; } return result; } /* Creates the NVRAM spaces, and sets their initial values as needed. */ static uint32_t InitializeSpaces(void) { uint32_t zero = 0; uint32_t firmware_perm = TPM_NV_PER_GLOBALLOCK | TPM_NV_PER_PPWRITE; VBDEBUG(("Initializing spaces\n")); RETURN_ON_FAILURE(TlclSetNvLocked()); RETURN_ON_FAILURE(TlclDefineSpace(FIRMWARE_VERSIONS_NV_INDEX, firmware_perm, sizeof(uint32_t))); RETURN_ON_FAILURE(SafeWrite(FIRMWARE_VERSIONS_NV_INDEX, (uint8_t*) &zero, sizeof(uint32_t))); RETURN_ON_FAILURE(InitializeKernelVersionsSpaces()); /* The space KERNEL_VERSIONS_BACKUP_NV_INDEX is used to protect the kernel * versions. The content of space KERNEL_MUST_USE_BACKUP determines whether * only the backup value should be trusted. */ RETURN_ON_FAILURE(TlclDefineSpace(KERNEL_VERSIONS_BACKUP_NV_INDEX, firmware_perm, sizeof(uint32_t))); RETURN_ON_FAILURE(SafeWrite(KERNEL_VERSIONS_BACKUP_NV_INDEX, (uint8_t*) &zero, sizeof(uint32_t))); RETURN_ON_FAILURE(TlclDefineSpace(KERNEL_MUST_USE_BACKUP_NV_INDEX, firmware_perm, sizeof(uint32_t))); RETURN_ON_FAILURE(SafeWrite(KERNEL_MUST_USE_BACKUP_NV_INDEX, (uint8_t*) &zero, sizeof(uint32_t))); RETURN_ON_FAILURE(TlclDefineSpace(DEVELOPER_MODE_NV_INDEX, firmware_perm, sizeof(uint32_t))); RETURN_ON_FAILURE(SafeWrite(DEVELOPER_MODE_NV_INDEX, (uint8_t*) &zero, sizeof(uint32_t))); /* The space TPM_IS_INITIALIZED_NV_INDEX is used to indicate that the TPM * initialization has completed. Without it we cannot be sure that the last * space to be created was also initialized (power could have been lost right * after its creation). */ RETURN_ON_FAILURE(TlclDefineSpace(TPM_IS_INITIALIZED_NV_INDEX, firmware_perm, sizeof(uint32_t))); return TPM_SUCCESS; } static uint32_t SetDistrustKernelSpaceAtNextBoot(uint32_t distrust) { uint32_t must_use_backup; RETURN_ON_FAILURE(TlclRead(KERNEL_MUST_USE_BACKUP_NV_INDEX, (uint8_t*) &must_use_backup, sizeof(uint32_t))); if (must_use_backup != distrust) { RETURN_ON_FAILURE(SafeWrite(KERNEL_MUST_USE_BACKUP_NV_INDEX, (uint8_t*) &distrust, sizeof(uint32_t))); } return TPM_SUCCESS; } static uint32_t GetTPMRollbackIndices(int type) { uint32_t firmware_versions; uint32_t kernel_versions; /* We perform the reads, making sure they succeed. A failure means that the * rollback index locations are missing or somehow messed up. We let the * caller deal with that. */ switch (type) { case FIRMWARE_VERSIONS: RETURN_ON_FAILURE(TlclRead(FIRMWARE_VERSIONS_NV_INDEX, (uint8_t*) &firmware_versions, sizeof(firmware_versions))); g_firmware_key_version = (uint16_t) (firmware_versions >> 16); g_firmware_version = (uint16_t) (firmware_versions & 0xffff); break; case KERNEL_VERSIONS: RETURN_ON_FAILURE(TlclRead(KERNEL_VERSIONS_NV_INDEX, (uint8_t*) &kernel_versions, sizeof(kernel_versions))); g_kernel_key_version = (uint16_t) (kernel_versions >> 16); g_kernel_version = (uint16_t) (kernel_versions & 0xffff); break; } return TPM_SUCCESS; } /* Checks if the kernel version space has been mucked with. If it has, * reconstructs it using the backup value. */ uint32_t RecoverKernelSpace(void) { uint32_t perms = 0; uint8_t buffer[KERNEL_SPACE_SIZE]; int read_OK = 0; int perms_OK = 0; uint32_t backup_combined_versions; uint32_t must_use_backup; RETURN_ON_FAILURE(TlclRead(KERNEL_MUST_USE_BACKUP_NV_INDEX, (uint8_t*) &must_use_backup, sizeof(uint32_t))); /* must_use_backup is true if the previous boot entered recovery mode. */ read_OK = TlclRead(KERNEL_VERSIONS_NV_INDEX, (uint8_t*) &buffer, KERNEL_SPACE_SIZE) == TPM_SUCCESS; if (read_OK) { RETURN_ON_FAILURE(TlclGetPermissions(KERNEL_VERSIONS_NV_INDEX, &perms)); perms_OK = perms == TPM_NV_PER_PPWRITE; } if (!must_use_backup && read_OK && perms_OK && !Memcmp(buffer + sizeof(uint32_t), KERNEL_SPACE_UID, KERNEL_SPACE_UID_SIZE)) { /* Everything is fine. This is the normal, frequent path. */ return TPM_SUCCESS; } /* Either we detected that something went wrong, or we cannot trust the * PP-protected kernel space. Attempts to fix. It is not always necessary * to redefine the space, but we might as well, since this path should be * taken quite seldom (after recovery mode and after an attack). */ RETURN_ON_FAILURE(InitializeKernelVersionsSpaces()); RETURN_ON_FAILURE(TlclRead(KERNEL_VERSIONS_BACKUP_NV_INDEX, (uint8_t*) &backup_combined_versions, sizeof(uint32_t))); RETURN_ON_FAILURE(SafeWrite(KERNEL_VERSIONS_NV_INDEX, (uint8_t*) &backup_combined_versions, sizeof(uint32_t))); if (must_use_backup) { uint32_t zero = 0; RETURN_ON_FAILURE(SafeWrite(KERNEL_MUST_USE_BACKUP_NV_INDEX, (uint8_t*) &zero, 0)); } return TPM_SUCCESS; } static uint32_t BackupKernelSpace(void) { uint32_t kernel_versions; uint32_t backup_versions; RETURN_ON_FAILURE(TlclRead(KERNEL_VERSIONS_NV_INDEX, (uint8_t*) &kernel_versions, sizeof(uint32_t))); RETURN_ON_FAILURE(TlclRead(KERNEL_VERSIONS_BACKUP_NV_INDEX, (uint8_t*) &backup_versions, sizeof(uint32_t))); if (kernel_versions == backup_versions) { return TPM_SUCCESS; } else if (kernel_versions < backup_versions) { /* This cannot happen. We're screwed. */ return TPM_E_INTERNAL_INCONSISTENCY; } RETURN_ON_FAILURE(SafeWrite(KERNEL_VERSIONS_BACKUP_NV_INDEX, (uint8_t*) &kernel_versions, sizeof(uint32_t))); return TPM_SUCCESS; } /* Checks for transitions between protected mode to developer mode. When going * into developer mode, clear the TPM. */ static uint32_t CheckDeveloperModeTransition(uint32_t current_developer) { uint32_t past_developer; RETURN_ON_FAILURE(TlclRead(DEVELOPER_MODE_NV_INDEX, (uint8_t*) &past_developer, sizeof(past_developer))); if (past_developer != current_developer) { RETURN_ON_FAILURE(TPMClearAndReenable()); RETURN_ON_FAILURE(SafeWrite(DEVELOPER_MODE_NV_INDEX, (uint8_t*) ¤t_developer, sizeof(current_developer))); } return TPM_SUCCESS; } static uint32_t SetupTPM_(int mode, int developer_flag) { uint8_t disable; uint8_t deactivated; TlclLibInit(); RETURN_ON_FAILURE(TlclStartup()); RETURN_ON_FAILURE(TlclContinueSelfTest()); RETURN_ON_FAILURE(TlclAssertPhysicalPresence()); /* Checks that the TPM is enabled and activated. */ RETURN_ON_FAILURE(TlclGetFlags(&disable, &deactivated)); if (disable || deactivated) { RETURN_ON_FAILURE(TlclSetEnable()); RETURN_ON_FAILURE(TlclSetDeactivated(0)); return TPM_E_MUST_REBOOT; } /* We expect this to fail the first time we run on a device, because the TPM * has not been initialized yet. */ if (RecoverKernelSpace() != TPM_SUCCESS) { int initialized = 0; RETURN_ON_FAILURE(GetSpacesInitialized(&initialized)); if (initialized) { return TPM_E_ALREADY_INITIALIZED; } else { RETURN_ON_FAILURE(InitializeSpaces()); RETURN_ON_FAILURE(RecoverKernelSpace()); } } RETURN_ON_FAILURE(BackupKernelSpace()); RETURN_ON_FAILURE(SetDistrustKernelSpaceAtNextBoot(mode == RO_RECOVERY_MODE)); RETURN_ON_FAILURE(GetTPMRollbackIndices(FIRMWARE_VERSIONS)); RETURN_ON_FAILURE(GetTPMRollbackIndices(KERNEL_VERSIONS)); RETURN_ON_FAILURE(CheckDeveloperModeTransition(developer_flag)); /* As a courtesy (I hope) to the caller, lock the firmware versions if we are * in recovery mode. The normal mode may need to update the firmware * versions, so they cannot be locked here. */ if (mode == RO_RECOVERY_MODE) { RETURN_ON_FAILURE(LockFirmwareVersions()); } return TPM_SUCCESS; } /* SetupTPM starts the TPM and establishes the root of trust for the * anti-rollback mechanism. SetupTPM can fail for three reasons. 1 A bug. 2 a * TPM hardware failure. 3 An unexpected TPM state due to some attack. In * general we cannot easily distinguish the kind of failure, so our strategy is * to reboot in recovery mode in all cases. The recovery mode calls SetupTPM * again, which executes (almost) the same sequence of operations. There is a * good chance that, if recovery mode was entered because of a TPM failure, the * failure will repeat itself. (In general this is impossible to guarantee * because we have no way of creating the exact TPM initial state at the * previous boot.) In recovery mode, we ignore the failure and continue, thus * giving the recovery kernel a chance to fix things (that's why we don't set * bGlobalLock). The choice is between a knowingly insecure device and a * bricked device. * * As a side note, observe that we go through considerable hoops to avoid using * the STCLEAR permissions for the index spaces. We do this to avoid writing * to the TPM flashram at every reboot or wake-up, because of concerns about * the durability of the NVRAM. */ uint32_t SetupTPM(int mode, int developer_flag) { switch (mode) { case RO_RECOVERY_MODE: case RO_NORMAL_MODE: { uint32_t result = SetupTPM_(mode, developer_flag); if (mode == RO_NORMAL_MODE) { return result; } else { /* In recovery mode we want to keep going even if there are errors. */ return TPM_SUCCESS; } } case RW_NORMAL_MODE: RETURN_ON_FAILURE(GetTPMRollbackIndices(KERNEL_VERSIONS)); default: return TPM_E_INTERNAL_INCONSISTENCY; } } uint32_t GetStoredVersions(int type, uint16_t* key_version, uint16_t* version) { /* TODO: should verify that SetupTPM() has been called. * * Note that SetupTPM() does hardware setup AND sets global variables. When * we get down into kernel verification, the hardware setup persists, but we * lose the global variables. */ switch (type) { case FIRMWARE_VERSIONS: *key_version = g_firmware_key_version; *version = g_firmware_version; break; case KERNEL_VERSIONS: *key_version = g_kernel_key_version; *version = g_kernel_version; break; } return TPM_SUCCESS; } uint32_t WriteStoredVersions(int type, uint16_t key_version, uint16_t version) { uint32_t combined_version = (key_version << 16) & version; switch (type) { case FIRMWARE_VERSIONS: RETURN_ON_FAILURE(SafeWrite(FIRMWARE_VERSIONS_NV_INDEX, (uint8_t*) &combined_version, sizeof(uint32_t))); break; case KERNEL_VERSIONS: RETURN_ON_FAILURE(SafeWrite(KERNEL_VERSIONS_NV_INDEX, (uint8_t*) &combined_version, sizeof(uint32_t))); } return TPM_SUCCESS; } uint32_t LockFirmwareVersions() { return TlclSetGlobalLock(); } uint32_t LockKernelVersionsByLockingPP() { return TlclLockPhysicalPresence(); } /* NEW APIS! HELP ME LUIGI, YOU'RE MY ONLY HOPE! */ uint32_t RollbackFirmwareSetup(int developer_mode, uint16_t* key_version, uint16_t* version) { return TPM_SUCCESS; } uint32_t RollbackFirmwareWrite(uint16_t key_version, uint16_t version) { return TPM_SUCCESS; } uint32_t RollbackFirmwareLock(void) { return TPM_SUCCESS; } uint32_t RollbackKernelRecovery(int developer_mode) { return TPM_SUCCESS; } uint32_t RollbackKernelRead(uint16_t* key_version, uint16_t* version) { return TPM_SUCCESS; } uint32_t RollbackKernelWrite(uint16_t key_version, uint16_t version) { return TPM_SUCCESS; } uint32_t RollbackKernelLock(void) { return TPM_SUCCESS; }