erebion/coreboot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

tpm2: use pcr0 dependent nvram define space policy

Browse source 
The TPM2 specification allows defining NV ram spaces in such manner,
that it is impossible to remove the space, unless a certain PCR is in
a certain state.

This comes in handy when defining spaces for rollback counters: make
their removal depend on PCR0 being in the default state. Then extend
PCR0 to any value. This will guarantee that the spaces can not be
deleted.

Also, there is no need in creating firmware and kernel rollback spaces
with different privileges: they both can be created with the same set of
properties, the firmware space could be locked by the RO firmware, and
the kernel space could be locked by the RW firmware thus providing
necessary privilege levels.

BRANCH=none
BUG=chrome-os-partner:50645, chrome-os-partner:55063
TEST=with the rest of the patches applied it is possible to boot into
      Chrome OS maintaining two rollback counter spaces in the TPM NV
      ram locked at different phases of the boot process.

Change-Id: I69e5ada65a5f15a8c04be9def92a8e1f4b753d9a
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/358094
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
This commit is contained in:
Vadim Bendebury 2016-07-03 15:24:23 -07:00 • committed by chrome-bot
commit 36317f5e85
3 changed files with 25 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/vendorcode/google/chromeos/vboot2/antirollback.c
View file

@ -128,7 +128,6 @@ static uint32_t safe_write(uint32_t index, const void *data, uint32_t length)
static uint32_t set_firmware_space(const void *firmware_blob)
{
RETURN_ON_FAILURE(tlcl_define_space(FIRMWARE_NV_INDEX,
high_privilege,
VB2_SECDATA_SIZE));
RETURN_ON_FAILURE(safe_write(FIRMWARE_NV_INDEX, firmware_blob,
VB2_SECDATA_SIZE));
@ -138,7 +137,6 @@ static uint32_t set_firmware_space(const void *firmware_blob)
static uint32_t set_kernel_space(const void *kernel_blob)
{
RETURN_ON_FAILURE(tlcl_define_space(KERNEL_NV_INDEX,
low_privilege,
sizeof(secdata_kernel)));
RETURN_ON_FAILURE(safe_write(KERNEL_NV_INDEX, kernel_blob,
sizeof(secdata_kernel)));