blob: a01c7f570649b746c4b598c31a231ffa5881eeb0 [file] [log] [blame]
Randall Spanglera7ab8b52014-06-10 17:05:08 -07001/* Copyright (c) 2014 The Chromium OS Authors. All rights reserved.
2 * Use of this source code is governed by a BSD-style license that can be
3 * found in the LICENSE file.
4 *
5 * Externally-callable APIs
6 * (Firmware portion)
7 */
8
9#include "2sysincludes.h"
10#include "2api.h"
11#include "2common.h"
12#include "2misc.h"
13#include "2nvstorage.h"
14#include "2secdata.h"
15#include "2sha.h"
16#include "2rsa.h"
17
18int vb2api_secdata_check(const struct vb2_context *ctx)
19{
20 return vb2_secdata_check_crc(ctx);
21}
22
23int vb2api_secdata_create(struct vb2_context *ctx)
24{
25 return vb2_secdata_create(ctx);
26}
27
28void vb2api_fail(struct vb2_context *ctx, uint8_t reason, uint8_t subcode)
29{
30 /* Initialize the vboot context if it hasn't been yet */
31 vb2_init_context(ctx);
32
33 vb2_fail(ctx, reason, subcode);
34}
35
36int vb2api_fw_phase1(struct vb2_context *ctx)
37{
Randall Spanglera7ab8b52014-06-10 17:05:08 -070038 int rv;
39
40 /* Initialize the vboot context if it hasn't been yet */
41 vb2_init_context(ctx);
42
43 /* Initialize NV context */
44 vb2_nv_init(ctx);
45
46 /* Initialize secure data */
47 rv = vb2_secdata_init(ctx);
48 if (rv)
Aaron Durbin941e25f2014-10-29 15:08:39 -050049 vb2_fail(ctx, VB2_RECOVERY_SECDATA_INIT, rv);
50
51 /* Load and parse the GBB header */
52 rv = vb2_fw_parse_gbb(ctx);
53 if (rv)
54 vb2_fail(ctx, VB2_RECOVERY_GBB_HEADER, rv);
55
56 /* Check for dev switch */
57 rv = vb2_check_dev_switch(ctx);
58 if (rv)
59 vb2_fail(ctx, VB2_RECOVERY_DEV_SWITCH, rv);
Randall Spanglera7ab8b52014-06-10 17:05:08 -070060
61 /*
62 * Check for recovery. Note that this function returns void, since
63 * any errors result in requesting recovery.
64 */
65 vb2_check_recovery(ctx);
66
67 /* Return error if recovery is needed */
68 if (ctx->flags & VB2_CONTEXT_RECOVERY_MODE) {
69 /* Always clear RAM when entering recovery mode */
70 ctx->flags |= VB2_CONTEXT_CLEAR_RAM;
71
72 return VB2_ERROR_API_PHASE1_RECOVERY;
73 }
74
75 return VB2_SUCCESS;
76}
77
78int vb2api_fw_phase2(struct vb2_context *ctx)
79{
80 int rv;
81
Randall Spanglera7ab8b52014-06-10 17:05:08 -070082 /* Always clear RAM when entering developer mode */
83 if (ctx->flags & VB2_CONTEXT_DEVELOPER_MODE)
84 ctx->flags |= VB2_CONTEXT_CLEAR_RAM;
85
86 /* Check for explicit request to clear TPM */
87 rv = vb2_check_tpm_clear(ctx);
88 if (rv) {
89 vb2_fail(ctx, VB2_RECOVERY_TPM_CLEAR_OWNER, rv);
90 return rv;
91 }
92
93 /* Decide which firmware slot to try this boot */
94 rv = vb2_select_fw_slot(ctx);
95 if (rv) {
96 vb2_fail(ctx, VB2_RECOVERY_FW_SLOT, rv);
97 return rv;
98 }
99
100 return VB2_SUCCESS;
101}
102
103int vb2api_fw_phase3(struct vb2_context *ctx)
104{
105 int rv;
106
107 /* Verify firmware keyblock */
Randall Spanglerf18038b2014-10-23 15:55:21 -0700108 rv = vb2_load_fw_keyblock(ctx);
Randall Spanglera7ab8b52014-06-10 17:05:08 -0700109 if (rv) {
110 vb2_fail(ctx, VB2_RECOVERY_RO_INVALID_RW, rv);
111 return rv;
112 }
113
114 /* Verify firmware preamble */
Randall Spanglerf18038b2014-10-23 15:55:21 -0700115 rv = vb2_load_fw_preamble(ctx);
Randall Spanglera7ab8b52014-06-10 17:05:08 -0700116 if (rv) {
117 vb2_fail(ctx, VB2_RECOVERY_RO_INVALID_RW, rv);
118 return rv;
119 }
120
121 return VB2_SUCCESS;
122}
123
124int vb2api_init_hash(struct vb2_context *ctx, uint32_t tag, uint32_t *size)
125{
126 struct vb2_shared_data *sd = vb2_get_sd(ctx);
127 const struct vb2_fw_preamble *pre;
128 struct vb2_digest_context *dc;
129 struct vb2_public_key key;
130 struct vb2_workbuf wb;
131 int rv;
132
133 vb2_workbuf_from_ctx(ctx, &wb);
134
135 if (tag == VB2_HASH_TAG_INVALID)
136 return VB2_ERROR_API_INIT_HASH_TAG;
137
138 /* Get preamble pointer */
139 if (!sd->workbuf_preamble_size)
140 return VB2_ERROR_API_INIT_HASH_PREAMBLE;
141 pre = (const struct vb2_fw_preamble *)
142 (ctx->workbuf + sd->workbuf_preamble_offset);
143
144 /* For now, we only support the firmware body tag */
145 if (tag != VB2_HASH_TAG_FW_BODY)
146 return VB2_ERROR_API_INIT_HASH_TAG;
147
148 /* Allocate workbuf space for the hash */
149 if (sd->workbuf_hash_size) {
150 dc = (struct vb2_digest_context *)
151 (ctx->workbuf + sd->workbuf_hash_offset);
152 } else {
153 uint32_t dig_size = sizeof(*dc);
154
155 dc = vb2_workbuf_alloc(&wb, dig_size);
156 if (!dc)
157 return VB2_ERROR_API_INIT_HASH_WORKBUF;
158
159 sd->workbuf_hash_offset = vb2_offset_of(ctx->workbuf, dc);
160 sd->workbuf_hash_size = dig_size;
161 ctx->workbuf_used = sd->workbuf_hash_offset + dig_size;
162 }
163
164 /*
165 * Unpack the firmware data key to see which hashing algorithm we
166 * should use.
167 *
168 * TODO: really, the firmware body should be hashed, and not signed,
169 * because the signature we're checking is already signed as part of
170 * the firmware preamble. But until we can change the signing scripts,
171 * we're stuck with a signature here instead of a hash.
172 */
173 if (!sd->workbuf_data_key_size)
174 return VB2_ERROR_API_INIT_HASH_DATA_KEY;
175
176 rv = vb2_unpack_key(&key,
177 ctx->workbuf + sd->workbuf_data_key_offset,
178 sd->workbuf_data_key_size);
179 if (rv)
180 return rv;
181
182 sd->hash_tag = tag;
183 sd->hash_remaining_size = pre->body_signature.data_size;
184
185 if (size)
186 *size = pre->body_signature.data_size;
187
Randall Spangler4eef8122014-10-23 10:07:54 -0700188 return vb2_digest_init(dc, key.hash_alg);
Randall Spanglera7ab8b52014-06-10 17:05:08 -0700189}
190
191int vb2api_extend_hash(struct vb2_context *ctx,
192 const void *buf,
193 uint32_t size)
194{
195 struct vb2_shared_data *sd = vb2_get_sd(ctx);
196 struct vb2_digest_context *dc = (struct vb2_digest_context *)
197 (ctx->workbuf + sd->workbuf_hash_offset);
198
199 /* Must have initialized hash digest work area */
200 if (!sd->workbuf_hash_size)
201 return VB2_ERROR_API_EXTEND_HASH_WORKBUF;
202
203 /* Don't extend past the data we expect to hash */
204 if (!size || size > sd->hash_remaining_size)
205 return VB2_ERROR_API_EXTEND_HASH_SIZE;
206
207 sd->hash_remaining_size -= size;
208
209 return vb2_digest_extend(dc, buf, size);
210}
211
212int vb2api_check_hash(struct vb2_context *ctx)
213{
214 struct vb2_shared_data *sd = vb2_get_sd(ctx);
215 struct vb2_digest_context *dc = (struct vb2_digest_context *)
216 (ctx->workbuf + sd->workbuf_hash_offset);
217 struct vb2_workbuf wb;
218
219 uint8_t *digest;
Randall Spangler4eef8122014-10-23 10:07:54 -0700220 uint32_t digest_size = vb2_digest_size(dc->hash_alg);
Randall Spanglera7ab8b52014-06-10 17:05:08 -0700221
222 struct vb2_fw_preamble *pre;
223 struct vb2_public_key key;
224 int rv;
225
226 vb2_workbuf_from_ctx(ctx, &wb);
227
228 /* Get preamble pointer */
229 if (!sd->workbuf_preamble_size)
230 return VB2_ERROR_API_CHECK_HASH_PREAMBLE;
231 pre = (struct vb2_fw_preamble *)
232 (ctx->workbuf + sd->workbuf_preamble_offset);
233
234 /* Must have initialized hash digest work area */
235 if (!sd->workbuf_hash_size)
236 return VB2_ERROR_API_CHECK_HASH_WORKBUF;
237
238 /* Should have hashed the right amount of data */
239 if (sd->hash_remaining_size)
240 return VB2_ERROR_API_CHECK_HASH_SIZE;
241
242 /* Allocate the digest */
243 digest = vb2_workbuf_alloc(&wb, digest_size);
244 if (!digest)
245 return VB2_ERROR_API_CHECK_HASH_WORKBUF_DIGEST;
246
247 /* Finalize the digest */
248 rv = vb2_digest_finalize(dc, digest, digest_size);
249 if (rv)
250 return rv;
251
252 /* The code below is specific to the body signature */
253 if (sd->hash_tag != VB2_HASH_TAG_FW_BODY)
254 return VB2_ERROR_API_CHECK_HASH_TAG;
255
256 /*
257 * The body signature is currently a *signature* of the body data, not
258 * just its hash. So we need to verify the signature.
259 */
260
261 /* Unpack the data key */
262 if (!sd->workbuf_data_key_size)
263 return VB2_ERROR_API_CHECK_HASH_DATA_KEY;
264
265 rv = vb2_unpack_key(&key,
266 ctx->workbuf + sd->workbuf_data_key_offset,
267 sd->workbuf_data_key_size);
268 if (rv)
269 return rv;
270
Randall Spanglera7ab8b52014-06-10 17:05:08 -0700271 /*
272 * Check digest vs. signature. Note that this destroys the signature.
273 * That's ok, because we only check each signature once per boot.
274 */
Randall Spangler95047542014-10-17 16:41:46 -0700275 rv = vb2_verify_digest(&key, &pre->body_signature, digest, &wb);
Daisuke Nojiri5b638032014-06-21 17:36:57 -0700276 if (rv)
277 vb2_fail(ctx, VB2_RECOVERY_RO_INVALID_RW, rv);
278
Randall Spanglera7ab8b52014-06-10 17:05:08 -0700279 return rv;
280}