src/include/antirollback.h

   1 /* Copyright (c) 2013 The Chromium OS Authors. All rights reserved.
   2  * Use of this source code is governed by a BSD-style license that can be
   3  * found in the LICENSE file.
   4  *
   5  * Functions for querying, manipulating and locking rollback indices
   6  * stored in the TPM NVRAM.
   7  */
   8
   9 #ifndef ANTIROLLBACK_H_
  10 #define ANTIROLLBACK_H_
  11
  12 #include "tpm_lite/tss_constants.h"
  13
  14 struct vb2_context;
  15 enum vb2_pcr_digest;
  16
  17 /* TPM NVRAM location indices. */
  18 #define FIRMWARE_NV_INDEX               0x1007
  19 #define KERNEL_NV_INDEX                 0x1008
  20 /* This is just an opaque space for backup purposes */
  21 #define BACKUP_NV_INDEX                 0x1009
  22
  23 /* Structure definitions for TPM spaces */
  24
  25 /* Flags for firmware space */
  26
  27 /*
  28  * Last boot was developer mode.  TPM ownership is cleared when transitioning
  29  * to/from developer mode.
  30  */
  31 #define FLAG_LAST_BOOT_DEVELOPER 0x01
  32
  33 /* All functions return TPM_SUCCESS (zero) if successful, non-zero if error */
  34
  35 uint32_t antirollback_read_space_firmware(struct vb2_context *ctx);
  36
  37 /**
  38  * Write may be called if the versions change.
  39  */
  40 uint32_t antirollback_write_space_firmware(struct vb2_context *ctx);
  41
  42 /**
  43  * Lock must be called.
  44  */
  45 uint32_t antirollback_lock_space_firmware(void);
  46
  47 /****************************************************************************/
  48
  49 /*
  50  * The following functions are internal apis, listed here for use by unit tests
  51  * only.
  52  */
  53
  54 /**
  55  * Ask vboot for a digest and extend a TPM PCR with it.
  56  */
  57 uint32_t tpm_extend_pcr(struct vb2_context *ctx, int pcr,
  58                         enum vb2_pcr_digest which_digest);
  59
  60 /**
  61  * Issue a TPM_Clear and reenable/reactivate the TPM.
  62  */
  63 uint32_t tpm_clear_and_reenable(void);
  64
  65 /**
  66  * Like tlcl_write(), but checks for write errors due to hitting the 64-write
  67  * limit and clears the TPM when that happens.  This can only happen when the
  68  * TPM is unowned, so it is OK to clear it (and we really have no choice).
  69  * This is not expected to happen frequently, but it could happen.
  70  */
  71 uint32_t safe_write(uint32_t index, const void *data, uint32_t length);
  72
  73 /**
  74  * Similarly to safe_write(), this ensures we don't fail a DefineSpace because
  75  * we hit the TPM write limit.  This is even less likely to happen than with
  76  * writes because we only define spaces once at initialization, but we'd rather
  77  * be paranoid about this.
  78  */
  79 uint32_t safe_define_space(uint32_t index, uint32_t perm, uint32_t size);
  80
  81 /**
  82  * Perform one-time initializations.
  83  *
  84  * Create the NVRAM spaces, and set their initial values as needed.  Sets the
  85  * nvLocked bit and ensures the physical presence command is enabled and
  86  * locked.
  87  */
  88 uint32_t factory_initialize_tpm(struct vb2_context *ctx);
  89
  90 /**
  91  * Start the TPM and establish the root of trust for the antirollback mechanism.
  92  */
  93 uint32_t setup_tpm(struct vb2_context *ctx);
  94
  95 #endif  /* ANTIROLLBACK_H_ */