Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 1 | /* Copyright (c) 2013 The Chromium OS Authors. All rights reserved. |
Randall Spangler | d183644 | 2010-06-10 09:59:04 -0700 | [diff] [blame] | 2 | * Use of this source code is governed by a BSD-style license that can be |
| 3 | * found in the LICENSE file. |
| 4 | * |
| 5 | * Functions for loading a kernel from disk. |
| 6 | * (Firmware portion) |
| 7 | */ |
| 8 | |
Randall Spangler | 7c3ae42 | 2016-05-11 13:50:18 -0700 | [diff] [blame] | 9 | #include "2common.h" |
Randall Spangler | e4136dc | 2016-10-27 14:34:59 -0700 | [diff] [blame] | 10 | #include "2misc.h" |
| 11 | #include "2nvstorage.h" |
Randall Spangler | 13b1097 | 2016-10-14 11:04:27 -0700 | [diff] [blame] | 12 | #include "2rsa.h" |
Randall Spangler | 7c3ae42 | 2016-05-11 13:50:18 -0700 | [diff] [blame] | 13 | #include "2sha.h" |
Joel Kitching | 9adf2aa | 2019-08-20 17:43:50 +0800 | [diff] [blame] | 14 | #include "2sysincludes.h" |
Randall Spangler | d183644 | 2010-06-10 09:59:04 -0700 | [diff] [blame] | 15 | #include "cgptlib.h" |
Bill Richardson | 5deb67f | 2010-07-23 17:22:25 -0700 | [diff] [blame] | 16 | #include "cgptlib_internal.h" |
Dan Ehrenberg | 7c2beb0 | 2014-10-21 16:15:54 -0700 | [diff] [blame] | 17 | #include "gpt_misc.h" |
Randall Spangler | d183644 | 2010-06-10 09:59:04 -0700 | [diff] [blame] | 18 | #include "load_kernel_fw.h" |
Randall Spangler | 946abf1 | 2016-04-15 14:49:40 -0700 | [diff] [blame] | 19 | #include "rollback_index.h" |
Randall Spangler | d183644 | 2010-06-10 09:59:04 -0700 | [diff] [blame] | 20 | #include "utility.h" |
Randall Spangler | 13b1097 | 2016-10-14 11:04:27 -0700 | [diff] [blame] | 21 | #include "vb2_common.h" |
Randall Spangler | e49e8af | 2011-07-08 13:03:32 -0700 | [diff] [blame] | 22 | #include "vboot_api.h" |
Randall Spangler | 83c88cf | 2010-06-11 16:14:18 -0700 | [diff] [blame] | 23 | #include "vboot_common.h" |
Randall Spangler | e49e8af | 2011-07-08 13:03:32 -0700 | [diff] [blame] | 24 | #include "vboot_kernel.h" |
| 25 | |
Stefan Reinauer | 55db6a6 | 2011-03-15 16:23:41 -0700 | [diff] [blame] | 26 | #define LOWEST_TPM_VERSION 0xffffffff |
Randall Spangler | d183644 | 2010-06-10 09:59:04 -0700 | [diff] [blame] | 27 | |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 28 | enum vboot_mode { |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 29 | kBootRecovery = 0, /* Recovery firmware, any dev switch position */ |
| 30 | kBootNormal = 1, /* Normal boot - kernel must be verified */ |
| 31 | kBootDev = 2 /* Developer boot - self-signed kernel ok */ |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 32 | }; |
| 33 | |
| 34 | /** |
| 35 | * Return the boot mode based on the parameters. |
| 36 | * |
| 37 | * @param params Load kernel parameters |
| 38 | * @return The current boot mode. |
| 39 | */ |
Randall Spangler | e4136dc | 2016-10-27 14:34:59 -0700 | [diff] [blame] | 40 | static enum vboot_mode get_kernel_boot_mode(struct vb2_context *ctx) |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 41 | { |
Randall Spangler | e4136dc | 2016-10-27 14:34:59 -0700 | [diff] [blame] | 42 | if (ctx->flags & VB2_CONTEXT_RECOVERY_MODE) |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 43 | return kBootRecovery; |
| 44 | |
Randall Spangler | e4136dc | 2016-10-27 14:34:59 -0700 | [diff] [blame] | 45 | if (ctx->flags & VB2_CONTEXT_DEVELOPER_MODE) |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 46 | return kBootDev; |
| 47 | |
| 48 | return kBootNormal; |
| 49 | }; |
| 50 | |
| 51 | /** |
| 52 | * Check if the parameters require an officially signed OS. |
| 53 | * |
| 54 | * @param params Load kernel parameters |
| 55 | * @return 1 if official OS required; 0 if self-signed kernels are ok |
| 56 | */ |
Randall Spangler | e4136dc | 2016-10-27 14:34:59 -0700 | [diff] [blame] | 57 | static int require_official_os(struct vb2_context *ctx, |
| 58 | const LoadKernelParams *params) |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 59 | { |
| 60 | /* Normal and recovery modes always require official OS */ |
Randall Spangler | e4136dc | 2016-10-27 14:34:59 -0700 | [diff] [blame] | 61 | if (get_kernel_boot_mode(ctx) != kBootDev) |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 62 | return 1; |
| 63 | |
| 64 | /* FWMP can require developer mode to use official OS */ |
| 65 | if (params->fwmp && |
| 66 | (params->fwmp->flags & FWMP_DEV_ENABLE_OFFICIAL_ONLY)) |
| 67 | return 1; |
| 68 | |
| 69 | /* Developer can request official OS via nvstorage */ |
Randall Spangler | e4136dc | 2016-10-27 14:34:59 -0700 | [diff] [blame] | 70 | return vb2_nv_get(ctx, VB2_NV_DEV_BOOT_SIGNED_ONLY); |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 71 | } |
| 72 | |
| 73 | /** |
| 74 | * Return a pointer to the keyblock inside a vblock. |
| 75 | * |
| 76 | * Must only be called during or after vb2_verify_kernel_vblock(). |
| 77 | * |
| 78 | * @param kbuf Buffer containing vblock |
| 79 | * @return The keyblock pointer. |
| 80 | */ |
| 81 | static struct vb2_keyblock *get_keyblock(uint8_t *kbuf) |
| 82 | { |
| 83 | return (struct vb2_keyblock *)kbuf; |
| 84 | } |
| 85 | |
| 86 | /** |
| 87 | * Return a pointer to the kernel preamble inside a vblock. |
| 88 | * |
| 89 | * Must only be called during or after vb2_verify_kernel_vblock(). |
| 90 | * |
| 91 | * @param kbuf Buffer containing vblock |
| 92 | * @return The kernel preamble pointer. |
| 93 | */ |
| 94 | static struct vb2_kernel_preamble *get_preamble(uint8_t *kbuf) |
| 95 | { |
| 96 | return (struct vb2_kernel_preamble *) |
| 97 | (kbuf + get_keyblock(kbuf)->keyblock_size); |
| 98 | } |
| 99 | |
| 100 | /** |
| 101 | * Return the offset of the kernel body from the start of the vblock. |
| 102 | * |
| 103 | * Must only be called during or after vb2_verify_kernel_vblock(). |
| 104 | * |
| 105 | * @param kbuf Buffer containing vblock |
| 106 | * @return The offset of the kernel body from the vblock start, in bytes. |
| 107 | */ |
| 108 | static uint32_t get_body_offset(uint8_t *kbuf) |
| 109 | { |
| 110 | return (get_keyblock(kbuf)->keyblock_size + |
| 111 | get_preamble(kbuf)->preamble_size); |
| 112 | } |
| 113 | |
| 114 | /** |
| 115 | * Verify a kernel vblock. |
| 116 | * |
| 117 | * @param kbuf Buffer containing the vblock |
| 118 | * @param kbuf_size Size of the buffer in bytes |
| 119 | * @param kernel_subkey Packed kernel subkey to use in validating keyblock |
| 120 | * @param params Load kernel parameters |
| 121 | * @param min_version Minimum kernel version |
| 122 | * @param shpart Destination for verification results |
| 123 | * @param wb Work buffer. Must be at least |
| 124 | * VB2_VERIFY_KERNEL_PREAMBLE_WORKBUF_BYTES bytes. |
| 125 | * @return VB2_SUCCESS, or non-zero error code. |
| 126 | */ |
Joel Kitching | e6700f4 | 2019-07-31 14:12:30 +0800 | [diff] [blame] | 127 | static vb2_error_t vb2_verify_kernel_vblock( |
| 128 | struct vb2_context *ctx, uint8_t *kbuf, uint32_t kbuf_size, |
| 129 | const struct vb2_packed_key *kernel_subkey, |
| 130 | const LoadKernelParams *params, uint32_t min_version, |
| 131 | VbSharedDataKernelPart *shpart, struct vb2_workbuf *wb) |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 132 | { |
| 133 | /* Unpack kernel subkey */ |
| 134 | struct vb2_public_key kernel_subkey2; |
| 135 | if (VB2_SUCCESS != vb2_unpack_key(&kernel_subkey2, kernel_subkey)) { |
| 136 | VB2_DEBUG("Unable to unpack kernel subkey\n"); |
| 137 | return VB2_ERROR_VBLOCK_KERNEL_SUBKEY; |
| 138 | } |
| 139 | |
| 140 | /* Verify the key block. */ |
| 141 | int keyblock_valid = 1; /* Assume valid */ |
| 142 | struct vb2_keyblock *keyblock = get_keyblock(kbuf); |
| 143 | if (VB2_SUCCESS != vb2_verify_keyblock(keyblock, kbuf_size, |
| 144 | &kernel_subkey2, wb)) { |
| 145 | VB2_DEBUG("Verifying key block signature failed.\n"); |
| 146 | shpart->check_result = VBSD_LKP_CHECK_KEY_BLOCK_SIG; |
| 147 | keyblock_valid = 0; |
| 148 | |
| 149 | /* Check if we must have an officially signed kernel */ |
Randall Spangler | e4136dc | 2016-10-27 14:34:59 -0700 | [diff] [blame] | 150 | if (require_official_os(ctx, params)) { |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 151 | VB2_DEBUG("Self-signed kernels not enabled.\n"); |
| 152 | shpart->check_result = VBSD_LKP_CHECK_SELF_SIGNED; |
| 153 | return VB2_ERROR_VBLOCK_SELF_SIGNED; |
| 154 | } |
| 155 | |
| 156 | /* Otherwise, allow the kernel if the key block hash is valid */ |
| 157 | if (VB2_SUCCESS != |
| 158 | vb2_verify_keyblock_hash(keyblock, kbuf_size, wb)) { |
| 159 | VB2_DEBUG("Verifying key block hash failed.\n"); |
| 160 | shpart->check_result = VBSD_LKP_CHECK_KEY_BLOCK_HASH; |
| 161 | return VB2_ERROR_VBLOCK_KEYBLOCK_HASH; |
| 162 | } |
| 163 | } |
| 164 | |
| 165 | /* Check the key block flags against boot flags. */ |
| 166 | if (!(keyblock->keyblock_flags & |
Randall Spangler | e4136dc | 2016-10-27 14:34:59 -0700 | [diff] [blame] | 167 | ((ctx->flags & VB2_CONTEXT_DEVELOPER_MODE) ? |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 168 | KEY_BLOCK_FLAG_DEVELOPER_1 : KEY_BLOCK_FLAG_DEVELOPER_0))) { |
| 169 | VB2_DEBUG("Key block developer flag mismatch.\n"); |
| 170 | shpart->check_result = VBSD_LKP_CHECK_DEV_MISMATCH; |
| 171 | keyblock_valid = 0; |
| 172 | } |
| 173 | if (!(keyblock->keyblock_flags & |
Randall Spangler | e4136dc | 2016-10-27 14:34:59 -0700 | [diff] [blame] | 174 | ((ctx->flags & VB2_CONTEXT_RECOVERY_MODE) ? |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 175 | KEY_BLOCK_FLAG_RECOVERY_1 : KEY_BLOCK_FLAG_RECOVERY_0))) { |
| 176 | VB2_DEBUG("Key block recovery flag mismatch.\n"); |
| 177 | shpart->check_result = VBSD_LKP_CHECK_REC_MISMATCH; |
| 178 | keyblock_valid = 0; |
| 179 | } |
| 180 | |
| 181 | /* Check for rollback of key version except in recovery mode. */ |
Randall Spangler | e4136dc | 2016-10-27 14:34:59 -0700 | [diff] [blame] | 182 | enum vboot_mode boot_mode = get_kernel_boot_mode(ctx); |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 183 | uint32_t key_version = keyblock->data_key.key_version; |
| 184 | if (kBootRecovery != boot_mode) { |
| 185 | if (key_version < (min_version >> 16)) { |
| 186 | VB2_DEBUG("Key version too old.\n"); |
| 187 | shpart->check_result = VBSD_LKP_CHECK_KEY_ROLLBACK; |
| 188 | keyblock_valid = 0; |
| 189 | } |
| 190 | if (key_version > 0xFFFF) { |
| 191 | /* |
| 192 | * Key version is stored in 16 bits in the TPM, so key |
| 193 | * versions greater than 0xFFFF can't be stored |
| 194 | * properly. |
| 195 | */ |
| 196 | VB2_DEBUG("Key version > 0xFFFF.\n"); |
| 197 | shpart->check_result = VBSD_LKP_CHECK_KEY_ROLLBACK; |
| 198 | keyblock_valid = 0; |
| 199 | } |
| 200 | } |
| 201 | |
| 202 | /* If not in developer mode, key block required to be valid. */ |
| 203 | if (kBootDev != boot_mode && !keyblock_valid) { |
| 204 | VB2_DEBUG("Key block is invalid.\n"); |
| 205 | return VB2_ERROR_VBLOCK_KEYBLOCK; |
| 206 | } |
| 207 | |
| 208 | /* If in developer mode and using key hash, check it */ |
| 209 | if ((kBootDev == boot_mode) && |
| 210 | params->fwmp && (params->fwmp->flags & FWMP_DEV_USE_KEY_HASH)) { |
| 211 | struct vb2_packed_key *key = &keyblock->data_key; |
| 212 | uint8_t *buf = ((uint8_t *)key) + key->key_offset; |
| 213 | uint32_t buflen = key->key_size; |
| 214 | uint8_t digest[VB2_SHA256_DIGEST_SIZE]; |
| 215 | |
| 216 | VB2_DEBUG("Checking developer key hash.\n"); |
| 217 | vb2_digest_buffer(buf, buflen, VB2_HASH_SHA256, |
| 218 | digest, sizeof(digest)); |
| 219 | if (0 != vb2_safe_memcmp(digest, params->fwmp->dev_key_hash, |
| 220 | VB2_SHA256_DIGEST_SIZE)) { |
| 221 | int i; |
| 222 | |
| 223 | VB2_DEBUG("Wrong developer key hash.\n"); |
| 224 | VB2_DEBUG("Want: "); |
| 225 | for (i = 0; i < VB2_SHA256_DIGEST_SIZE; i++) |
| 226 | VB2_DEBUG("%02x", |
| 227 | params->fwmp->dev_key_hash[i]); |
| 228 | VB2_DEBUG("\nGot: "); |
| 229 | for (i = 0; i < VB2_SHA256_DIGEST_SIZE; i++) |
| 230 | VB2_DEBUG("%02x", digest[i]); |
| 231 | VB2_DEBUG("\n"); |
| 232 | |
| 233 | return VB2_ERROR_VBLOCK_DEV_KEY_HASH; |
| 234 | } |
| 235 | } |
| 236 | |
| 237 | /* Get key for preamble verification from the key block. */ |
| 238 | struct vb2_public_key data_key; |
| 239 | if (VB2_SUCCESS != vb2_unpack_key(&data_key, &keyblock->data_key)) { |
| 240 | VB2_DEBUG("Unable to unpack kernel data key\n"); |
| 241 | shpart->check_result = VBSD_LKP_CHECK_DATA_KEY_PARSE; |
| 242 | return VB2_ERROR_UNKNOWN; |
| 243 | } |
| 244 | |
| 245 | /* Verify the preamble, which follows the key block */ |
| 246 | struct vb2_kernel_preamble *preamble = get_preamble(kbuf); |
| 247 | if (VB2_SUCCESS != |
| 248 | vb2_verify_kernel_preamble(preamble, |
| 249 | kbuf_size - keyblock->keyblock_size, |
| 250 | &data_key, |
| 251 | wb)) { |
| 252 | VB2_DEBUG("Preamble verification failed.\n"); |
| 253 | shpart->check_result = VBSD_LKP_CHECK_VERIFY_PREAMBLE; |
| 254 | return VB2_ERROR_UNKNOWN; |
| 255 | } |
| 256 | |
| 257 | /* |
| 258 | * If the key block is valid and we're not in recovery mode, check for |
| 259 | * rollback of the kernel version. |
| 260 | */ |
| 261 | uint32_t combined_version = (key_version << 16) | |
| 262 | (preamble->kernel_version & 0xFFFF); |
| 263 | shpart->combined_version = combined_version; |
| 264 | if (keyblock_valid && kBootRecovery != boot_mode) { |
| 265 | if (combined_version < min_version) { |
| 266 | VB2_DEBUG("Kernel version too low.\n"); |
| 267 | shpart->check_result = VBSD_LKP_CHECK_KERNEL_ROLLBACK; |
| 268 | /* |
| 269 | * If not in developer mode, kernel version |
| 270 | * must be valid. |
| 271 | */ |
| 272 | if (kBootDev != boot_mode) |
| 273 | return VB2_ERROR_UNKNOWN; |
| 274 | } |
| 275 | } |
| 276 | |
| 277 | VB2_DEBUG("Kernel preamble is good.\n"); |
| 278 | shpart->check_result = VBSD_LKP_CHECK_PREAMBLE_VALID; |
| 279 | if (keyblock_valid) |
| 280 | shpart->flags |= VBSD_LKP_FLAG_KEY_BLOCK_VALID; |
| 281 | |
| 282 | return VB2_SUCCESS; |
| 283 | } |
| 284 | |
| 285 | enum vb2_load_partition_flags { |
| 286 | /* Only check the vblock to */ |
| 287 | VB2_LOAD_PARTITION_VBLOCK_ONLY = (1 << 0), |
| 288 | }; |
| 289 | |
| 290 | #define KBUF_SIZE 65536 /* Bytes to read at start of kernel partition */ |
Randall Spangler | e4136dc | 2016-10-27 14:34:59 -0700 | [diff] [blame] | 291 | |
| 292 | /* Minimum context work buffer size needed for vb2_load_partition() */ |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 293 | #define VB2_LOAD_PARTITION_WORKBUF_BYTES \ |
| 294 | (VB2_VERIFY_KERNEL_PREAMBLE_WORKBUF_BYTES + KBUF_SIZE) |
| 295 | |
| 296 | /** |
| 297 | * Load and verify a partition from the stream. |
| 298 | * |
Randall Spangler | e4136dc | 2016-10-27 14:34:59 -0700 | [diff] [blame] | 299 | * @param ctx Vboot context |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 300 | * @param stream Stream to load kernel from |
| 301 | * @param kernel_subkey Key to use to verify vblock |
| 302 | * @param flags Flags (one or more of vb2_load_partition_flags) |
| 303 | * @param params Load-kernel parameters |
| 304 | * @param min_version Minimum kernel version from TPM |
| 305 | * @param shpart Destination for verification results |
Joel Kitching | 3eb00ef | 2019-05-23 15:33:54 +0800 | [diff] [blame] | 306 | * @param wb Workbuf for data storage |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 307 | * @return VB2_SUCCESS, or non-zero error code. |
| 308 | */ |
Joel Kitching | e6700f4 | 2019-07-31 14:12:30 +0800 | [diff] [blame] | 309 | static vb2_error_t vb2_load_partition( |
| 310 | struct vb2_context *ctx, VbExStream_t stream, |
| 311 | const struct vb2_packed_key *kernel_subkey, uint32_t flags, |
| 312 | LoadKernelParams *params, uint32_t min_version, |
| 313 | VbSharedDataKernelPart *shpart, struct vb2_workbuf *wb) |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 314 | { |
Raul E Rangel | 4c1a6f4 | 2019-06-17 10:48:55 -0600 | [diff] [blame] | 315 | uint64_t read_us = 0, start_ts; |
Joel Kitching | 3eb00ef | 2019-05-23 15:33:54 +0800 | [diff] [blame] | 316 | struct vb2_workbuf wblocal = *wb; |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 317 | |
| 318 | /* Allocate kernel header buffer in workbuf */ |
| 319 | uint8_t *kbuf = vb2_workbuf_alloc(&wblocal, KBUF_SIZE); |
| 320 | if (!kbuf) |
| 321 | return VB2_ERROR_LOAD_PARTITION_WORKBUF; |
| 322 | |
Raul E Rangel | 4c1a6f4 | 2019-06-17 10:48:55 -0600 | [diff] [blame] | 323 | start_ts = VbExGetTimer(); |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 324 | if (VbExStreamRead(stream, KBUF_SIZE, kbuf)) { |
| 325 | VB2_DEBUG("Unable to read start of partition.\n"); |
| 326 | shpart->check_result = VBSD_LKP_CHECK_READ_START; |
| 327 | return VB2_ERROR_LOAD_PARTITION_READ_VBLOCK; |
| 328 | } |
Raul E Rangel | 4c1a6f4 | 2019-06-17 10:48:55 -0600 | [diff] [blame] | 329 | read_us += VbExGetTimer() - start_ts; |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 330 | |
| 331 | if (VB2_SUCCESS != |
Randall Spangler | e4136dc | 2016-10-27 14:34:59 -0700 | [diff] [blame] | 332 | vb2_verify_kernel_vblock(ctx, kbuf, KBUF_SIZE, kernel_subkey, |
| 333 | params, min_version, shpart, &wblocal)) { |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 334 | return VB2_ERROR_LOAD_PARTITION_VERIFY_VBLOCK; |
| 335 | } |
| 336 | |
| 337 | if (flags & VB2_LOAD_PARTITION_VBLOCK_ONLY) |
| 338 | return VB2_SUCCESS; |
| 339 | |
| 340 | struct vb2_keyblock *keyblock = get_keyblock(kbuf); |
| 341 | struct vb2_kernel_preamble *preamble = get_preamble(kbuf); |
| 342 | |
| 343 | /* |
| 344 | * Make sure the kernel starts at or before what we already read into |
| 345 | * kbuf. |
| 346 | * |
| 347 | * We could deal with a larger offset by reading and discarding the |
| 348 | * data in between the vblock and the kernel data. |
| 349 | */ |
| 350 | uint32_t body_offset = get_body_offset(kbuf); |
| 351 | if (body_offset > KBUF_SIZE) { |
| 352 | shpart->check_result = VBSD_LKP_CHECK_BODY_OFFSET; |
| 353 | VB2_DEBUG("Kernel body offset is %u > 64KB.\n", body_offset); |
| 354 | return VB2_ERROR_LOAD_PARTITION_BODY_OFFSET; |
| 355 | } |
| 356 | |
| 357 | uint8_t *kernbuf = params->kernel_buffer; |
| 358 | uint32_t kernbuf_size = params->kernel_buffer_size; |
| 359 | if (!kernbuf) { |
| 360 | /* Get kernel load address and size from the header. */ |
| 361 | kernbuf = (uint8_t *)((long)preamble->body_load_address); |
| 362 | kernbuf_size = preamble->body_signature.data_size; |
| 363 | } else if (preamble->body_signature.data_size > kernbuf_size) { |
| 364 | VB2_DEBUG("Kernel body doesn't fit in memory.\n"); |
| 365 | shpart->check_result = VBSD_LKP_CHECK_BODY_EXCEEDS_MEM; |
| 366 | return VB2_ERROR_LOAD_PARTITION_BODY_SIZE; |
| 367 | } |
| 368 | |
| 369 | uint32_t body_toread = preamble->body_signature.data_size; |
| 370 | uint8_t *body_readptr = kernbuf; |
| 371 | |
| 372 | /* |
| 373 | * If we've already read part of the kernel, copy that to the beginning |
| 374 | * of the kernel buffer. |
| 375 | */ |
| 376 | uint32_t body_copied = KBUF_SIZE - body_offset; |
| 377 | if (body_copied > body_toread) |
| 378 | body_copied = body_toread; /* Don't over-copy tiny kernel */ |
| 379 | memcpy(body_readptr, kbuf + body_offset, body_copied); |
| 380 | body_toread -= body_copied; |
| 381 | body_readptr += body_copied; |
| 382 | |
| 383 | /* Read the kernel data */ |
Raul E Rangel | 4c1a6f4 | 2019-06-17 10:48:55 -0600 | [diff] [blame] | 384 | start_ts = VbExGetTimer(); |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 385 | if (body_toread && VbExStreamRead(stream, body_toread, body_readptr)) { |
| 386 | VB2_DEBUG("Unable to read kernel data.\n"); |
| 387 | shpart->check_result = VBSD_LKP_CHECK_READ_DATA; |
| 388 | return VB2_ERROR_LOAD_PARTITION_READ_BODY; |
| 389 | } |
Raul E Rangel | 4c1a6f4 | 2019-06-17 10:48:55 -0600 | [diff] [blame] | 390 | read_us += VbExGetTimer() - start_ts; |
| 391 | VB2_DEBUG("read %" PRIu32 " KB in %" PRIu64 " ms at %" PRIu64 " KB/s.\n", |
| 392 | (body_toread + KBUF_SIZE) / 1024, read_us / 1000, |
| 393 | ((uint64_t)(body_toread + KBUF_SIZE) * 1000 * 1000) / |
| 394 | (read_us * 1024)); |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 395 | |
| 396 | /* Get key for preamble/data verification from the key block. */ |
| 397 | struct vb2_public_key data_key; |
| 398 | if (VB2_SUCCESS != vb2_unpack_key(&data_key, &keyblock->data_key)) { |
| 399 | VB2_DEBUG("Unable to unpack kernel data key\n"); |
| 400 | shpart->check_result = VBSD_LKP_CHECK_DATA_KEY_PARSE; |
| 401 | return VB2_ERROR_LOAD_PARTITION_DATA_KEY; |
| 402 | } |
| 403 | |
| 404 | /* Verify kernel data */ |
| 405 | if (VB2_SUCCESS != vb2_verify_data(kernbuf, kernbuf_size, |
| 406 | &preamble->body_signature, |
| 407 | &data_key, &wblocal)) { |
| 408 | VB2_DEBUG("Kernel data verification failed.\n"); |
| 409 | shpart->check_result = VBSD_LKP_CHECK_VERIFY_DATA; |
| 410 | return VB2_ERROR_LOAD_PARTITION_VERIFY_BODY; |
| 411 | } |
| 412 | |
| 413 | /* If we're still here, the kernel is valid */ |
| 414 | VB2_DEBUG("Partition is good.\n"); |
| 415 | shpart->check_result = VBSD_LKP_CHECK_KERNEL_GOOD; |
| 416 | |
| 417 | /* Save kernel data back to parameters */ |
| 418 | params->bootloader_address = preamble->bootloader_address; |
| 419 | params->bootloader_size = preamble->bootloader_size; |
| 420 | params->flags = vb2_kernel_get_flags(preamble); |
| 421 | if (!params->kernel_buffer) { |
| 422 | params->kernel_buffer = kernbuf; |
| 423 | params->kernel_buffer_size = kernbuf_size; |
| 424 | } |
| 425 | |
| 426 | return VB2_SUCCESS; |
| 427 | } |
Randall Spangler | 640fb51 | 2011-03-03 10:11:17 -0800 | [diff] [blame] | 428 | |
Joel Kitching | 90671fa | 2019-07-31 13:17:08 +0800 | [diff] [blame] | 429 | vb2_error_t LoadKernel(struct vb2_context *ctx, LoadKernelParams *params) |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 430 | { |
Randall Spangler | 79c1c61 | 2018-01-03 13:42:40 -0800 | [diff] [blame] | 431 | struct vb2_shared_data *sd = vb2_get_sd(ctx); |
Joel Kitching | 3eb00ef | 2019-05-23 15:33:54 +0800 | [diff] [blame] | 432 | struct vb2_workbuf wb; |
Randall Spangler | 79c1c61 | 2018-01-03 13:42:40 -0800 | [diff] [blame] | 433 | VbSharedDataHeader *shared = sd->vbsd; |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 434 | VbSharedDataKernelCall *shcall = NULL; |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 435 | int found_partitions = 0; |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 436 | uint32_t lowest_version = LOWEST_TPM_VERSION; |
Joel Kitching | 9908a9a | 2019-07-29 18:53:38 +0800 | [diff] [blame] | 437 | vb2_error_t retval = VB2_ERROR_UNKNOWN; |
Randall Spangler | dff5852 | 2017-11-27 15:37:13 -0800 | [diff] [blame] | 438 | int recovery = VB2_RECOVERY_LK_UNSPECIFIED; |
Joel Kitching | e6700f4 | 2019-07-31 14:12:30 +0800 | [diff] [blame] | 439 | vb2_error_t rv; |
Randall Spangler | d183644 | 2010-06-10 09:59:04 -0700 | [diff] [blame] | 440 | |
Joel Kitching | 3eb00ef | 2019-05-23 15:33:54 +0800 | [diff] [blame] | 441 | vb2_workbuf_from_ctx(ctx, &wb); |
| 442 | |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 443 | /* Clear output params in case we fail */ |
| 444 | params->partition_number = 0; |
| 445 | params->bootloader_address = 0; |
| 446 | params->bootloader_size = 0; |
Furquan Shaikh | b7d1f03 | 2015-02-03 16:28:31 -0800 | [diff] [blame] | 447 | params->flags = 0; |
Bill Richardson | e272940 | 2010-07-22 12:23:47 -0700 | [diff] [blame] | 448 | |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 449 | /* |
| 450 | * Set up tracking for this call. This wraps around if called many |
| 451 | * times, so we need to initialize the call entry each time. |
| 452 | */ |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 453 | shcall = shared->lk_calls + |
| 454 | (shared->lk_call_count & (VBSD_MAX_KERNEL_CALLS - 1)); |
| 455 | memset(shcall, 0, sizeof(*shcall)); |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 456 | shcall->boot_flags = (uint32_t)params->boot_flags; |
Randall Spangler | e4136dc | 2016-10-27 14:34:59 -0700 | [diff] [blame] | 457 | shcall->boot_mode = get_kernel_boot_mode(ctx); |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 458 | shcall->sector_size = (uint32_t)params->bytes_per_lba; |
Dan Ehrenberg | 3f4d8d0 | 2014-12-02 08:21:57 -0800 | [diff] [blame] | 459 | shcall->sector_count = params->streaming_lba_count; |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 460 | shared->lk_call_count++; |
Randall Spangler | 17c7126 | 2011-03-18 11:24:27 -0700 | [diff] [blame] | 461 | |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 462 | /* Choose key to verify kernel */ |
| 463 | struct vb2_packed_key *kernel_subkey; |
| 464 | if (kBootRecovery == shcall->boot_mode) { |
| 465 | /* Use the recovery key to verify the kernel */ |
Joel Kitching | b4b4507 | 2019-06-09 12:44:32 +0800 | [diff] [blame] | 466 | rv = vb2_gbb_read_recovery_key(ctx, &kernel_subkey, NULL, &wb); |
| 467 | if (VB2_SUCCESS != rv) { |
| 468 | VB2_DEBUG("GBB read recovery key failed.\n"); |
| 469 | retval = VBERROR_INVALID_GBB; |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 470 | goto load_kernel_exit; |
Joel Kitching | b4b4507 | 2019-06-09 12:44:32 +0800 | [diff] [blame] | 471 | } |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 472 | } else { |
| 473 | /* Use the kernel subkey passed from firmware verification */ |
| 474 | kernel_subkey = (struct vb2_packed_key *)&shared->kernel_subkey; |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 475 | } |
Randall Spangler | 17c7126 | 2011-03-18 11:24:27 -0700 | [diff] [blame] | 476 | |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 477 | /* Read GPT data */ |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 478 | GptData gpt; |
| 479 | gpt.sector_bytes = (uint32_t)params->bytes_per_lba; |
Dan Ehrenberg | 3f4d8d0 | 2014-12-02 08:21:57 -0800 | [diff] [blame] | 480 | gpt.streaming_drive_sectors = params->streaming_lba_count; |
| 481 | gpt.gpt_drive_sectors = params->gpt_lba_count; |
| 482 | gpt.flags = params->boot_flags & BOOT_FLAG_EXTERNAL_GPT |
| 483 | ? GPT_FLAG_EXTERNAL : 0; |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 484 | if (0 != AllocAndReadGptData(params->disk_handle, &gpt)) { |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 485 | VB2_DEBUG("Unable to read GPT data\n"); |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 486 | shcall->check_result = VBSD_LKC_CHECK_GPT_READ_ERROR; |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 487 | goto gpt_done; |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 488 | } |
Randall Spangler | d183644 | 2010-06-10 09:59:04 -0700 | [diff] [blame] | 489 | |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 490 | /* Initialize GPT library */ |
| 491 | if (GPT_SUCCESS != GptInit(&gpt)) { |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 492 | VB2_DEBUG("Error parsing GPT\n"); |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 493 | shcall->check_result = VBSD_LKC_CHECK_GPT_PARSE_ERROR; |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 494 | goto gpt_done; |
Randall Spangler | 13b1097 | 2016-10-14 11:04:27 -0700 | [diff] [blame] | 495 | } |
| 496 | |
Gwendal Grignou | e2e14ae | 2015-04-27 09:46:52 -0700 | [diff] [blame] | 497 | /* Loop over candidate kernel partitions */ |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 498 | uint64_t part_start, part_size; |
Gwendal Grignou | e2e14ae | 2015-04-27 09:46:52 -0700 | [diff] [blame] | 499 | while (GPT_SUCCESS == |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 500 | GptNextKernelEntry(&gpt, &part_start, &part_size)) { |
Randall Spangler | d183644 | 2010-06-10 09:59:04 -0700 | [diff] [blame] | 501 | |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 502 | VB2_DEBUG("Found kernel entry at %" |
| 503 | PRIu64 " size %" PRIu64 "\n", |
| 504 | part_start, part_size); |
Randall Spangler | d183644 | 2010-06-10 09:59:04 -0700 | [diff] [blame] | 505 | |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 506 | /* |
| 507 | * Set up tracking for this partition. This wraps around if |
| 508 | * called many times, so initialize the partition entry each |
| 509 | * time. |
| 510 | */ |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 511 | VbSharedDataKernelPart *shpart = |
| 512 | shcall->parts + (shcall->kernel_parts_found |
Gwendal Grignou | e2e14ae | 2015-04-27 09:46:52 -0700 | [diff] [blame] | 513 | & (VBSD_MAX_KERNEL_PARTS - 1)); |
Randall Spangler | 664096b | 2016-10-13 16:16:41 -0700 | [diff] [blame] | 514 | memset(shpart, 0, sizeof(VbSharedDataKernelPart)); |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 515 | shpart->sector_start = part_start; |
| 516 | shpart->sector_count = part_size; |
| 517 | /* |
| 518 | * TODO: GPT partitions start at 1, but cgptlib starts them at |
| 519 | * 0. Adjust here, until cgptlib is fixed. |
| 520 | */ |
| 521 | shpart->gpt_index = (uint8_t)(gpt.current_kernel + 1); |
| 522 | shcall->kernel_parts_found++; |
Randall Spangler | 695cd16 | 2010-06-15 23:38:23 -0700 | [diff] [blame] | 523 | |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 524 | /* Found at least one kernel partition. */ |
| 525 | found_partitions++; |
Randall Spangler | 17c7126 | 2011-03-18 11:24:27 -0700 | [diff] [blame] | 526 | |
Randall Spangler | 4184e62 | 2014-10-08 16:41:01 -0700 | [diff] [blame] | 527 | /* Set up the stream */ |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 528 | VbExStream_t stream = NULL; |
Randall Spangler | 4184e62 | 2014-10-08 16:41:01 -0700 | [diff] [blame] | 529 | if (VbExStreamOpen(params->disk_handle, |
| 530 | part_start, part_size, &stream)) { |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 531 | VB2_DEBUG("Partition error getting stream.\n"); |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 532 | shpart->check_result = VBSD_LKP_CHECK_TOO_SMALL; |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 533 | VB2_DEBUG("Marking kernel as invalid.\n"); |
| 534 | GptUpdateKernelEntry(&gpt, GPT_UPDATE_ENTRY_BAD); |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 535 | continue; |
Randall Spangler | 4184e62 | 2014-10-08 16:41:01 -0700 | [diff] [blame] | 536 | } |
Randall Spangler | d183644 | 2010-06-10 09:59:04 -0700 | [diff] [blame] | 537 | |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 538 | uint32_t lpflags = 0; |
| 539 | if (params->partition_number > 0) { |
| 540 | /* |
| 541 | * If we already have a good kernel, we only needed to |
| 542 | * look at the vblock versions to check for rollback. |
| 543 | */ |
| 544 | lpflags |= VB2_LOAD_PARTITION_VBLOCK_ONLY; |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 545 | } |
Randall Spangler | d183644 | 2010-06-10 09:59:04 -0700 | [diff] [blame] | 546 | |
Joel Kitching | b4b4507 | 2019-06-09 12:44:32 +0800 | [diff] [blame] | 547 | rv = vb2_load_partition(ctx, |
| 548 | stream, |
| 549 | kernel_subkey, |
| 550 | lpflags, |
| 551 | params, |
| 552 | shared->kernel_version_tpm, |
| 553 | shpart, |
| 554 | &wb); |
Randall Spangler | 4184e62 | 2014-10-08 16:41:01 -0700 | [diff] [blame] | 555 | VbExStreamClose(stream); |
Randall Spangler | 4184e62 | 2014-10-08 16:41:01 -0700 | [diff] [blame] | 556 | |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 557 | if (rv != VB2_SUCCESS) { |
| 558 | VB2_DEBUG("Marking kernel as invalid.\n"); |
| 559 | GptUpdateKernelEntry(&gpt, GPT_UPDATE_ENTRY_BAD); |
| 560 | continue; |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 561 | } |
Randall Spangler | d183644 | 2010-06-10 09:59:04 -0700 | [diff] [blame] | 562 | |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 563 | int keyblock_valid = (shpart->flags & |
| 564 | VBSD_LKP_FLAG_KEY_BLOCK_VALID); |
| 565 | if (keyblock_valid) { |
| 566 | shared->flags |= VBSD_KERNEL_KEY_VERIFIED; |
| 567 | /* Track lowest version from a valid header. */ |
| 568 | if (lowest_version > shpart->combined_version) |
| 569 | lowest_version = shpart->combined_version; |
| 570 | } |
| 571 | VB2_DEBUG("Key block valid: %d\n", keyblock_valid); |
| 572 | VB2_DEBUG("Combined version: %u\n", shpart->combined_version); |
Randall Spangler | 17c7126 | 2011-03-18 11:24:27 -0700 | [diff] [blame] | 573 | |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 574 | /* |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 575 | * If we're only looking at headers, we're done with this |
| 576 | * partition. |
| 577 | */ |
| 578 | if (lpflags & VB2_LOAD_PARTITION_VBLOCK_ONLY) |
| 579 | continue; |
| 580 | |
| 581 | /* |
| 582 | * Otherwise, we found a partition we like. |
| 583 | * |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 584 | * TODO: GPT partitions start at 1, but cgptlib starts them at |
| 585 | * 0. Adjust here, until cgptlib is fixed. |
| 586 | */ |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 587 | params->partition_number = gpt.current_kernel + 1; |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 588 | |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 589 | /* |
| 590 | * TODO: GetCurrentKernelUniqueGuid() should take a destination |
| 591 | * size, or the dest should be a struct, so we know it's big |
| 592 | * enough. |
| 593 | */ |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 594 | GetCurrentKernelUniqueGuid(&gpt, ¶ms->partition_guid); |
Randall Spangler | 741d2b2 | 2010-08-20 16:37:12 -0700 | [diff] [blame] | 595 | |
Patrick Georgi | ebf886b | 2015-02-10 14:58:28 +0100 | [diff] [blame] | 596 | /* Update GPT to note this is the kernel we're trying. |
| 597 | * But not when we assume that the boot process may |
| 598 | * not complete for valid reasons (eg. early shutdown). |
| 599 | */ |
| 600 | if (!(shared->flags & VBSD_NOFAIL_BOOT)) |
| 601 | GptUpdateKernelEntry(&gpt, GPT_UPDATE_ENTRY_TRY); |
Randall Spangler | 741d2b2 | 2010-08-20 16:37:12 -0700 | [diff] [blame] | 602 | |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 603 | /* |
| 604 | * If we're in recovery mode or we're about to boot a |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 605 | * non-officially-signed kernel, there's no rollback |
| 606 | * protection, so we can stop at the first valid kernel. |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 607 | */ |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 608 | if (kBootRecovery == shcall->boot_mode || !keyblock_valid) { |
| 609 | VB2_DEBUG("In recovery mode or dev-signed kernel\n"); |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 610 | break; |
| 611 | } |
Randall Spangler | d183644 | 2010-06-10 09:59:04 -0700 | [diff] [blame] | 612 | |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 613 | /* |
| 614 | * Otherwise, we do care about the key index in the TPM. If |
| 615 | * the good partition's key version is the same as the tpm, |
| 616 | * then the TPM doesn't need updating; we can stop now. |
| 617 | * Otherwise, we'll check all the other headers to see if they |
| 618 | * contain a newer key. |
| 619 | */ |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 620 | if (shpart->combined_version == shared->kernel_version_tpm) { |
| 621 | VB2_DEBUG("Same kernel version\n"); |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 622 | break; |
| 623 | } |
Gwendal Grignou | e2e14ae | 2015-04-27 09:46:52 -0700 | [diff] [blame] | 624 | } /* while(GptNextKernelEntry) */ |
Randall Spangler | 49cb0d3 | 2013-01-29 14:28:16 -0800 | [diff] [blame] | 625 | |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 626 | gpt_done: |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 627 | /* Write and free GPT data */ |
| 628 | WriteAndFreeGptData(params->disk_handle, &gpt); |
Randall Spangler | d183644 | 2010-06-10 09:59:04 -0700 | [diff] [blame] | 629 | |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 630 | /* Handle finding a good partition */ |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 631 | if (params->partition_number > 0) { |
| 632 | VB2_DEBUG("Good partition %d\n", params->partition_number); |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 633 | shcall->check_result = VBSD_LKC_CHECK_GOOD_PARTITION; |
| 634 | shared->kernel_version_lowest = lowest_version; |
| 635 | /* |
| 636 | * Sanity check - only store a new TPM version if we found one. |
| 637 | * If lowest_version is still at its initial value, we didn't |
| 638 | * find one; for example, we're in developer mode and just |
| 639 | * didn't look. |
| 640 | */ |
| 641 | if (lowest_version != LOWEST_TPM_VERSION && |
| 642 | lowest_version > shared->kernel_version_tpm) |
| 643 | shared->kernel_version_tpm = lowest_version; |
Randall Spangler | d183644 | 2010-06-10 09:59:04 -0700 | [diff] [blame] | 644 | |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 645 | /* Success! */ |
Joel Kitching | cf49e7b | 2019-07-29 18:51:00 +0800 | [diff] [blame] | 646 | retval = VB2_SUCCESS; |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 647 | } else if (found_partitions > 0) { |
| 648 | shcall->check_result = VBSD_LKC_CHECK_INVALID_PARTITIONS; |
Randall Spangler | dff5852 | 2017-11-27 15:37:13 -0800 | [diff] [blame] | 649 | recovery = VB2_RECOVERY_RW_INVALID_OS; |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 650 | retval = VBERROR_INVALID_KERNEL_FOUND; |
| 651 | } else { |
| 652 | shcall->check_result = VBSD_LKC_CHECK_NO_PARTITIONS; |
Randall Spangler | dff5852 | 2017-11-27 15:37:13 -0800 | [diff] [blame] | 653 | recovery = VB2_RECOVERY_RW_NO_OS; |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 654 | retval = VBERROR_NO_KERNEL_FOUND; |
| 655 | } |
Randall Spangler | d183644 | 2010-06-10 09:59:04 -0700 | [diff] [blame] | 656 | |
Randall Spangler | f182401 | 2016-10-25 10:00:27 -0700 | [diff] [blame] | 657 | load_kernel_exit: |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 658 | /* Store recovery request, if any */ |
Randall Spangler | e4136dc | 2016-10-27 14:34:59 -0700 | [diff] [blame] | 659 | vb2_nv_set(ctx, VB2_NV_RECOVERY_REQUEST, |
Joel Kitching | cf49e7b | 2019-07-29 18:51:00 +0800 | [diff] [blame] | 660 | VB2_SUCCESS != retval ? |
Randall Spangler | dff5852 | 2017-11-27 15:37:13 -0800 | [diff] [blame] | 661 | recovery : VB2_RECOVERY_NOT_REQUESTED); |
Randall Spangler | 640fb51 | 2011-03-03 10:11:17 -0800 | [diff] [blame] | 662 | |
Randall Spangler | eedd429 | 2016-11-01 15:29:05 -0700 | [diff] [blame] | 663 | shcall->return_code = (uint8_t)retval; |
Randall Spangler | 7993f25 | 2013-01-29 15:01:12 -0800 | [diff] [blame] | 664 | return retval; |
Randall Spangler | d183644 | 2010-06-10 09:59:04 -0700 | [diff] [blame] | 665 | } |