scottk/OpenCellular
1
0
Fork 0
mirror of https://github.com/Telecominfraproject/OpenCellular.git synced 2025-11-24 18:25:10 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
fe2c1a231e3893dc3d7ac314e11b04a18c6948e7
OpenCellular/firmware/lib/vboot_firmware.c
Simon Glass 527ba810ef Implementation of Region API 
At present reading data from storage in Vboot is a little fragmented. For
the firmware image, we expect the boot loader to handle this. For the disk
we have a block-level API. For the GBB (which also sits in the firmware
image) we expect the entire thing to be read before Vboot is called.

Add the concept of a region, and an API to read from a region. At present,
and most pressing, is reading from a GBB region. In the future this could
be extended to other parts of the firmware or even the disk.

Move all access to the GBB into this API so that the boot loader can provide
either a GBB region in one large contiguous chunk, or a function to deal with
read requests from vboot.

The call to VbExRegionRead() is behind a flag since not all boot loaders
support it yet.

The main change for boot loaders which don't support this new API is that
vboot will do more behind the scenes. For example, it will allocate memory
for chunks of data that it reads from the GBB, rather than just accessing it
directly. This approach is considerably simpler than trying to pass char **
everywhere and have vboot decide whether something needs to be allocated or
not.

The tests are updated, mainly to include setting up a GBB structure
accessible from VbCommonParams, which is now required by the firmware and
kernel functions. In normal operation this is set up at the start of
VbLoadFIrmware() and VbSelectAndLoadKernel() but for tests which call
children of these functions directly, the GBB structure must be set up
manually by the test.

BUG=chrome-os-partner:21115
BRANCH=none
TEST=manual
FEATURES=test sudo -E  emerge vboot_reference

Change-Id: If2b8bbe467fdbd643239d8d9b5d7aa98df4d286f
Signed-off-by: Simon Glass <sjg@chromium.org>
Signed-off-by: David Hendricks <dhendrix@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/63336
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/167361
2013-08-30 16:47:03 +00:00

366 lines
10 KiB
C
Raw Blame History

/* Copyright (c) 2013 The Chromium OS Authors. All rights reserved.
* Use of this source code is governed by a BSD-style license that can be
* found in the LICENSE file.
*
* High-level firmware API for loading and verifying rewritable firmware.
* (Firmware portion)
*/
#include "sysincludes.h"
#include "region.h"
#include "gbb_access.h"
#include "gbb_header.h"
#include "load_firmware_fw.h"
#include "utility.h"
#include "vboot_api.h"
#include "vboot_common.h"
#include "vboot_nvstorage.h"
/*
* Static variables for UpdateFirmwareBodyHash(). It's less than optimal to
* have static variables in a library, but in UEFI the caller is deep inside a
* different firmware stack and doesn't have a good way to pass the params
* struct back to us.
*/
typedef struct VbLoadFirmwareInternal {
DigestContext body_digest_context;
uint32_t body_size_accum;
} VbLoadFirmwareInternal;
void VbUpdateFirmwareBodyHash(VbCommonParams *cparams, uint8_t *data,
uint32_t size)
{
VbLoadFirmwareInternal *lfi =
(VbLoadFirmwareInternal*)cparams->vboot_context;
DigestUpdate(&lfi->body_digest_context, data, size);
lfi->body_size_accum += size;
}
int LoadFirmware(VbCommonParams *cparams, VbSelectFirmwareParams *fparams,
VbNvContext *vnc)
{
VbSharedDataHeader *shared =
(VbSharedDataHeader *)cparams->shared_data_blob;
GoogleBinaryBlockHeader *gbb = cparams->gbb;
VbPublicKey *root_key = NULL;
VbLoadFirmwareInternal *lfi;
uint32_t try_b_count;
uint32_t lowest_version = 0xFFFFFFFF;
int good_index = -1;
int is_dev;
int index;
int i;
int retval = VBERROR_UNKNOWN;
int recovery = VBNV_RECOVERY_RO_UNSPECIFIED;
/* Clear output params in case we fail */
shared->firmware_index = 0xFF;
VBDEBUG(("LoadFirmware started...\n"));
/* Must have a root key from the GBB */
retval = VbGbbReadRootKey(cparams, &root_key);
if (retval) {
VBDEBUG(("No GBB\n"));
retval = VBERROR_INVALID_GBB;
goto LoadFirmwareExit;
}
/* Parse flags */
is_dev = (shared->flags & VBSD_BOOT_DEV_SWITCH_ON ? 1 : 0);
if (is_dev)
shared->flags |= VBSD_LF_DEV_SWITCH_ON;
/* Read try-b count and decrement if necessary */
VbNvGet(vnc, VBNV_TRY_B_COUNT, &try_b_count);
if (0 != try_b_count) {
VbNvSet(vnc, VBNV_TRY_B_COUNT, try_b_count - 1);
shared->flags |= VBSD_FWB_TRIED;
}
/* Allocate our internal data */
lfi = (VbLoadFirmwareInternal *)
VbExMalloc(sizeof(VbLoadFirmwareInternal));
cparams->vboot_context = lfi;
/* Loop over indices */
for (i = 0; i < 2; i++) {
VbKeyBlockHeader *key_block;
uint32_t vblock_size;
VbFirmwarePreambleHeader *preamble;
RSAPublicKey *data_key;
uint64_t key_version;
uint32_t combined_version;
uint8_t *body_digest;
uint8_t *check_result;
/* If try B count is non-zero try firmware B first */
index = (try_b_count ? 1 - i : i);
if (0 == index) {
key_block = (VbKeyBlockHeader *)
fparams->verification_block_A;
vblock_size = fparams->verification_size_A;
check_result = &shared->check_fw_a_result;
} else {
key_block = (VbKeyBlockHeader *)
fparams->verification_block_B;
vblock_size = fparams->verification_size_B;
check_result = &shared->check_fw_b_result;
}
/*
* Check the key block flags against the current boot mode. Do
* this before verifying the key block, since flags are faster
* to check than the RSA signature.
*/
if (!(key_block->key_block_flags &
(is_dev ? KEY_BLOCK_FLAG_DEVELOPER_1 :
KEY_BLOCK_FLAG_DEVELOPER_0))) {
VBDEBUG(("Developer flag mismatch.\n"));
*check_result = VBSD_LF_CHECK_DEV_MISMATCH;
continue;
}
/* RW firmware never runs in recovery mode. */
if (!(key_block->key_block_flags & KEY_BLOCK_FLAG_RECOVERY_0)) {
VBDEBUG(("Recovery flag mismatch.\n"));
*check_result = VBSD_LF_CHECK_REC_MISMATCH;
continue;
}
/* Verify the key block */
if ((0 != KeyBlockVerify(key_block, vblock_size,
root_key, 0))) {
VBDEBUG(("Key block verification failed.\n"));
*check_result = VBSD_LF_CHECK_VERIFY_KEYBLOCK;
continue;
}
/* Check for rollback of key version. */
key_version = key_block->data_key.key_version;
if (!(gbb->flags & GBB_FLAG_DISABLE_FW_ROLLBACK_CHECK)) {
if (key_version < (shared->fw_version_tpm >> 16)) {
VBDEBUG(("Key rollback detected.\n"));
*check_result = VBSD_LF_CHECK_KEY_ROLLBACK;
continue;
}
if (key_version > 0xFFFF) {
/*
* Key version is stored in 16 bits in the TPM,
* so key versions greater than 0xFFFF can't be
* stored properly.
*/
VBDEBUG(("Key version > 0xFFFF.\n"));
*check_result = VBSD_LF_CHECK_KEY_ROLLBACK;
continue;
}
}
/* Get key for preamble/data verification from the key block. */
data_key = PublicKeyToRSA(&key_block->data_key);
if (!data_key) {
VBDEBUG(("Unable to parse data key.\n"));
*check_result = VBSD_LF_CHECK_DATA_KEY_PARSE;
continue;
}
/* Verify the preamble, which follows the key block. */
preamble = (VbFirmwarePreambleHeader *)
((uint8_t *)key_block + key_block->key_block_size);
if ((0 != VerifyFirmwarePreamble(
preamble,
vblock_size - key_block->key_block_size,
data_key))) {
VBDEBUG(("Preamble verfication failed.\n"));
*check_result = VBSD_LF_CHECK_VERIFY_PREAMBLE;
RSAPublicKeyFree(data_key);
continue;
}
/* Check for rollback of firmware version. */
combined_version = (uint32_t)((key_version << 16) |
(preamble->firmware_version & 0xFFFF));
if (combined_version < shared->fw_version_tpm &&
!(gbb->flags & GBB_FLAG_DISABLE_FW_ROLLBACK_CHECK)) {
VBDEBUG(("Firmware version rollback detected.\n"));
*check_result = VBSD_LF_CHECK_FW_ROLLBACK;
RSAPublicKeyFree(data_key);
continue;
}
/* Header for this firmware is valid */
*check_result = VBSD_LF_CHECK_HEADER_VALID;
/* Check for lowest key version from a valid header. */
if (lowest_version > combined_version)
lowest_version = combined_version;
/*
* If we already have good firmware, no need to read another
* one; we only needed to look at the versions to check for
* rollback.
*/
if (-1 != good_index) {
RSAPublicKeyFree(data_key);
continue;
}
/* Handle preamble flag for using the RO normal/dev code path */
VBDEBUG(("Preamble flags %#x\n", VbGetFirmwarePreambleFlags(preamble)));
if (VbGetFirmwarePreambleFlags(preamble) &
VB_FIRMWARE_PREAMBLE_USE_RO_NORMAL) {
/* Fail if calling firmware doesn't support RO normal */
if (!(shared->flags & VBSD_BOOT_RO_NORMAL_SUPPORT)) {
VBDEBUG(("No RO normal support.\n"));
*check_result = VBSD_LF_CHECK_NO_RO_NORMAL;
RSAPublicKeyFree(data_key);
continue;
}
/* Use the RO normal code path */
shared->flags |= VBSD_LF_USE_RO_NORMAL;
} else {
VbError_t rv;
/* Read the firmware data */
DigestInit(&lfi->body_digest_context,
data_key->algorithm);
lfi->body_size_accum = 0;
rv = VbExHashFirmwareBody(
cparams,
(index ? VB_SELECT_FIRMWARE_B :
VB_SELECT_FIRMWARE_A));
if (VBERROR_SUCCESS != rv) {
VBDEBUG(("VbExHashFirmwareBody() failed for "
"index %d\n", index));
*check_result = VBSD_LF_CHECK_GET_FW_BODY;
RSAPublicKeyFree(data_key);
continue;
}
if (lfi->body_size_accum !=
preamble->body_signature.data_size) {
VBDEBUG(("Hashed %d bytes but expected %d\n",
(int)lfi->body_size_accum,
(int)preamble->body_signature.data_size));
*check_result = VBSD_LF_CHECK_HASH_WRONG_SIZE;
RSAPublicKeyFree(data_key);
continue;
}
/* Verify firmware data */
body_digest = DigestFinal(&lfi->body_digest_context);
if (0 != VerifyDigest(body_digest,
&preamble->body_signature,
data_key)) {
VBDEBUG(("FW body verification failed.\n"));
*check_result = VBSD_LF_CHECK_VERIFY_BODY;
RSAPublicKeyFree(data_key);
VbExFree(body_digest);
continue;
}
VbExFree(body_digest);
}
/* Done with the data key, so can free it now */
RSAPublicKeyFree(data_key);
/* If we're still here, the firmware is valid. */
VBDEBUG(("Firmware %d is valid.\n", index));
*check_result = VBSD_LF_CHECK_VALID;
if (-1 == good_index) {
/* Save the key we actually used */
if (0 != VbSharedDataSetKernelKey(
shared, &preamble->kernel_subkey)) {
/*
* The firmware signature was good, but the
* public key was bigger that the caller can
* handle.
*/
VBDEBUG(("Unable to save kernel subkey.\n"));
continue;
}
/*
* Save the good index, now that we're sure we can
* actually use this firmware. That's the one we'll
* boot.
*/
good_index = index;
shared->firmware_index = (uint8_t)index;
shared->fw_keyblock_flags = key_block->key_block_flags;
/*
* If the good firmware's key version is the same as
* the tpm, then the TPM doesn't need updating; we can
* stop now. Otherwise, we'll check all the other
* headers to see if they contain a newer key.
*/
if (combined_version == shared->fw_version_tpm)
break;
}
}
/* Free internal data */
VbExFree(lfi);
cparams->vboot_context = NULL;
/* Handle finding good firmware */
if (good_index >= 0) {
/* Save versions we found */
shared->fw_version_lowest = lowest_version;
if (lowest_version > shared->fw_version_tpm)
shared->fw_version_tpm = lowest_version;
/* Success */
VBDEBUG(("Will boot firmware index %d\n",
(int)shared->firmware_index));
retval = VBERROR_SUCCESS;
} else {
uint8_t a = shared->check_fw_a_result;
uint8_t b = shared->check_fw_b_result;
uint8_t best_check;
/* No good firmware, so go to recovery mode. */
VBDEBUG(("Alas, no good firmware.\n"));
recovery = VBNV_RECOVERY_RO_INVALID_RW;
retval = VBERROR_LOAD_FIRMWARE;
/*
* If the best check result fits in the range of recovery
* reasons, provide more detail on how far we got in
* validation.
*/
best_check = (a > b ? a : b) +
VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN;
if (best_check >= VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN &&
best_check <= VBNV_RECOVERY_RO_INVALID_RW_CHECK_MAX)
recovery = best_check;
}
LoadFirmwareExit:
VbExFree(root_key);
/* Store recovery request, if any */
VbNvSet(vnc, VBNV_RECOVERY_REQUEST, VBERROR_SUCCESS != retval ?
recovery : VBNV_RECOVERY_NOT_REQUESTED);
/* If the system does not support RO_NORMAL and LoadFirmware()
* encountered an error, update the shared recovery reason if
* recovery was not previously requested. */
if (!(shared->flags & VBSD_BOOT_RO_NORMAL_SUPPORT) &&
VBNV_RECOVERY_NOT_REQUESTED == shared->recovery_reason &&
VBERROR_SUCCESS != retval) {
VBDEBUG(("RO normal but we got an error.\n"));
shared->recovery_reason = recovery;
}
return retval;
}
Reference in New Issue View Git Blame Copy Permalink