Update PCR state with the state of the firmware keyblock flags too.

I re-factored the extend call into its own module, since it doesn't necessarily
need to be couple with rollbackfirmwaresetup.

BUG=chrome-os-partner:2372
TEST=Tried emerge-x86-generic and emerge-arm-generic vboot_reference.

Change-Id: I0d3115b10b686133e63e304570325ebdbd50ae3a

Review URL: http://codereview.chromium.org/6696006

8 files changed, 190 insertions, 38 deletions

diff --git a/firmware/Makefile b/firmware/Makefile
index fcff8bb7..b3a198b5 100644
--- a/firmware/Makefile
+++ b/firmware/Makefile
@@ -40,6 +40,7 @@ LIB_SRCS = \
 	./lib/cryptolib/sha2.c \
 	./lib/cryptolib/sha_utility.c \
 	./lib/rollback_index.c \
+	./lib/tpm_bootmode.c \
 	./lib/stateful_util.c \
 	./lib/tpm_lite/tlcl.c \
 	./lib/utility.c \
diff --git a/firmware/include/tlcl.h b/firmware/include/tlcl.h
index 95310541..8e2af2c6 100644
--- a/firmware/include/tlcl.h
+++ b/firmware/include/tlcl.h
@@ -127,7 +127,7 @@ uint32_t TlclSetGlobalLock(void);
 
 /* Performs a TPM_Extend.
  */
-uint32_t TlclExtend(int pcr_num, uint8_t* in_digest, uint8_t* out_digest);
+uint32_t TlclExtend(int pcr_num, const uint8_t* in_digest, uint8_t* out_digest);
 
 /* Gets the permission bits for the NVRAM space with |index|.
  */
diff --git a/firmware/lib/include/tpm_bootmode.h b/firmware/lib/include/tpm_bootmode.h
new file mode 100644
index 00000000..6213cfe7
--- /dev/null
+++ b/firmware/lib/include/tpm_bootmode.h
@@ -0,0 +1,25 @@
+/* Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ *
+ * Functions for updating the TPM state with the status of boot path.
+ */
+
+#ifndef VBOOT_REFERENCE_TPM_BOOTMODE_H_
+#define VBOOT_REFERENCE_TPM_BOOTMODE_H_
+
+#include "sysincludes.h"
+
+/* Update TPM PCR State with the boot path status.
+ *  [developer_mode]: State of the developer switch.
+ *  [recovery_mode}: State of the recovery mode.
+ *  [fw_keyblock_flags]: Keyblock flags on the to-be-booted
+ *                       RW firmware keyblock.
+ *
+ *  Returns: TPM_SUCCESS if the TPM extend operation succeeds.
+ */
+
+uint32_t SetTPMBootModeState(int developer_mode, int recovery_mode,
+                             int fw_keyblock_flags);
+
+#endif  /* VBOOT_REFERENCE_TPM_BOOTMODE_H_ */
diff --git a/firmware/lib/rollback_index.c b/firmware/lib/rollback_index.c
index 0d9dc8c7..1d532f88 100644
--- a/firmware/lib/rollback_index.c
+++ b/firmware/lib/rollback_index.c
@@ -9,28 +9,10 @@
 #include "rollback_index.h"
 
 #include "tlcl.h"
+#include "tpm_bootmode.h"
 #include "tss_constants.h"
 #include "utility.h"
 
-/* TPM PCR to use for storing dev mode measurements */
-#define DEV_REC_MODE_PCR 0
-/* Input digests for PCR extend */
-#define DEV_OFF_REC_OFF_SHA1_DIGEST ((uint8_t*) "\x14\x89\xf9\x23\xc4\xdc\xa7" \
-                                     "\x29\x17\x8b\x3e\x32\x33\x45\x85\x50" \
-                                     "\xd8\xdd\xdf\x29") /* SHA1("\x00\x00") */
-
-#define DEV_OFF_REC_ON_SHA1_DIGEST ((uint8_t*) "\x3f\x29\x54\x64\x53\x67\x8b" \
-                                    "\x85\x59\x31\xc1\x74\xa9\x7d\x6c\x08" \
-                                    "\x94\xb8\xf5\x46") /* SHA1("\x00\x01") */
-
-#define DEV_ON_REC_OFF_SHA1_DIGEST ((uint8_t*) "\x0e\x35\x6b\xa5\x05\x63\x1f" \
-                                    "\xbf\x71\x57\x58\xbe\xd2\x7d\x50\x3f" \
-                                    "\x8b\x26\x0e\x3a") /* SHA1("\x01\x00") */
-
-#define DEV_ON_REC_ON_SHA1_DIGEST ((uint8_t*) "\x91\x59\xcb\x8b\xce\xe7\xfc" \
-                                    "\xb9\x55\x82\xf1\x40\x96\x0c\xda\xe7" \
-                                    "\x27\x88\xd3\x26") /* SHA1("\x01\x01") */
-
 static int g_rollback_recovery_mode = 0;
 
 /* disable MSVC warning on const logical expression (as in } while(0);) */
@@ -294,7 +276,6 @@ uint32_t RollbackFirmwareSetup(int developer_mode, uint32_t* version) {
   TlclStartup();
   TlclContinueSelfTest();
 #endif
-
   *version = 0;
   return TPM_SUCCESS;
 }
@@ -348,23 +329,14 @@ uint32_t RollbackS3Resume(void) {
 
 uint32_t RollbackFirmwareSetup(int developer_mode, uint32_t* version) {
   RollbackSpaceFirmware rsf;
-  uint8_t out_digest[20];  /* For PCR extend output */
 
   RETURN_ON_FAILURE(SetupTPM(0, developer_mode, &rsf));
   *version = rsf.fw_versions;
   VBDEBUG(("TPM: RollbackFirmwareSetup %x\n", (int)rsf.fw_versions));
-  if (developer_mode)
-    RETURN_ON_FAILURE(TlclExtend(DEV_REC_MODE_PCR, DEV_ON_REC_OFF_SHA1_DIGEST,
-                                 out_digest));
-  else
-    RETURN_ON_FAILURE(TlclExtend(DEV_REC_MODE_PCR, DEV_OFF_REC_OFF_SHA1_DIGEST,
-                                 out_digest));
-  VBDEBUG(("TPM: RollbackFirmwareSetup dev mode PCR out_digest %02x %02x %02x "
-           "%02x\n", out_digest, out_digest+1, out_digest+2, out_digest+3));
-
   return TPM_SUCCESS;
 }
 
+
 uint32_t RollbackFirmwareWrite(uint32_t version) {
   RollbackSpaceFirmware rsf;
 
@@ -390,12 +362,10 @@ uint32_t RollbackKernelRecovery(int developer_mode) {
    * kernel will fix the TPM (if needed) and lock it ASAP.  We leave
    * Physical Presence on in either case. */
   rvs = SetupTPM(1, developer_mode, &rsf);
-  if (developer_mode)
-    rve = TlclExtend(DEV_REC_MODE_PCR, DEV_ON_REC_ON_SHA1_DIGEST, out_digest);
-  else
-    rve = TlclExtend(DEV_REC_MODE_PCR, DEV_OFF_REC_ON_SHA1_DIGEST, out_digest);
-  VBDEBUG(("TPM: RollbackKernelRecovery dev mode PCR out_digest %02x %02x %02x "
-           "%02x\n", out_digest, out_digest+1, out_digest+2, out_digest+3));
+  rve = SetTPMBootModeState(developer_mode,
+                            1,  /* Recovery Mode Status. */
+                            0);  /* In recovery mode, there is no RW firmware
+                                  * keyblock flag. */
   return (TPM_SUCCESS == rvs) ? rve : rvs;
 }
 
diff --git a/firmware/lib/tpm_bootmode.c b/firmware/lib/tpm_bootmode.c
new file mode 100644
index 00000000..77731355
--- /dev/null
+++ b/firmware/lib/tpm_bootmode.c
@@ -0,0 +1,133 @@
+/* Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ *
+ * Functions for updating the TPM state with the status of boot path.
+ */
+
+#include "tpm_bootmode.h"
+
+#include "tlcl.h"
+#include "utility.h"
+
+/* TPM PCR to use for storing boot mode measurements. */
+#define BOOT_MODE_PCR 0
+
+/* Input digests for PCR extend.
+ * These are calculated as:
+ *    SHA1("|Developer_Mode||Recovery_Mode||Keyblock_Mode|").
+ * Developer_Mode can be 0 or 1.
+ * Recovery_Mode can be 0 or 1.
+ * Keyblock flags are defined in vboot_struct.h
+ *
+ * We map them to Keyblock_Mode as follows:
+ *   -----------------------------------------
+ *   Keyblock Flags            | Keyblock Mode
+ *   -----------------------------------------
+ *   6 (Dev-signed firmware)   |     2
+ *   7 Normal-signed firmware  |     1
+ *   (anything else)           |     0
+ */
+const uint8_t kBootStateSHA1Digests[][20] = {
+  /* SHA1("\x00\x00\x00") */
+  "\x29\xe2\xdc\xfb\xb1\x6f\x63\xbb\x02\x54\xdf\x75\x85\xa1\x5b\xb6"
+  "\xfb\x5e\x92\x7d",
+
+  /* SHA1("\x00\x00\x01") */
+  "\x25\x47\xcc\x73\x6e\x95\x1f\xa4\x91\x98\x53\xc4\x3a\xe8\x90\x86"
+  "\x1a\x3b\x32\x64",
+
+  /* SHA1("\x00\x00\x02") */
+  "\x1e\xf6\x24\x48\x2d\x62\x0e\x43\xe6\xd3\x4d\xa1\xaf\xe4\x62\x67"
+  "\xfc\x69\x5d\x9b",
+
+  /* SHA1("\x00\x01\x00") */
+  "\x62\x57\x18\x91\x21\x5b\x4e\xfc\x1c\xea\xb7\x44\xce\x59\xdd\x0b"
+  "\x66\xea\x6f\x73",
+
+  /* SHA1("\x00\x01\x01") */
+  "\xee\xe4\x47\xed\xc7\x9f\xea\x1c\xa7\xc7\xd3\x4e\x46\x32\x61\xcd"
+  "\xa4\xba\x33\x9e",
+
+  /* SHA1("\x00\x01\x02") */
+  "\x0c\x7a\x62\x3f\xd2\xbb\xc0\x5b\x06\x42\x3b\xe3\x59\xe4\x02\x1d"
+  "\x36\xe7\x21\xad",
+
+  /* SHA1("\x01\x00\x00") */
+  "\x95\x08\xe9\x05\x48\xb0\x44\x0a\x4a\x61\xe5\x74\x3b\x76\xc1\xe3"
+  "\x09\xb2\x3b\x7f",
+
+  /* SHA1("\x01\x00\x01") */
+  "\xc4\x2a\xc1\xc4\x6f\x1d\x4e\x21\x1c\x73\x5c\xc7\xdf\xad\x4f\xf8"
+  "\x39\x11\x10\xe9",
+
+  /* SHA1("\x01\x00\x02") */
+  "\xfa\x01\x0d\x26\x64\xcc\x5b\x3b\x82\xee\x48\x8f\xe2\xb9\xf5\x0f"
+  "\x49\x32\xeb\x8f",
+
+  /* SHA1("\x01\x01\x00") */
+  "\x47\xec\x8d\x98\x36\x64\x33\xdc\x00\x2e\x77\x21\xc9\xe3\x7d\x50"
+  "\x67\x54\x79\x37",
+
+  /* SHA1("\x01\x01\x01") */
+  "\x28\xd8\x6c\x56\xb3\xbf\x26\xd2\x36\x56\x9b\x8d\xc8\xc3\xf9\x1f"
+  "\x32\xf4\x7b\xc7",
+
+  /* SHA1("\x01\x01\x02") */
+  "\x12\xa3\x40\xd7\x89\x7f\xe7\x13\xfc\x8f\x02\xac\x53\x65\xb8\x6e"
+  "\xbf\x35\x31\x78",
+};
+
+#define MAX_BOOT_STATE_INDEX (sizeof(kBootStateSHA1Digests)/sizeof(char[20]))
+
+/* Used for PCR extend when the passed-in boot state is invalid or
+ * if there is an internal error. */
+const uint8_t kBootInvalidSHA1Digest[20] = {
+  "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+  "\xff\xff\xff\xff"
+};
+
+/* Given the boot state, return the correct SHA1 digest index for TPMExtend
+ * in kBootStateSHA1Digests[]. */
+int GetBootStateIndex(int dev_mode, int rec_mode, int keyblock_flags) {
+  int index = 0;
+
+  /* Convert keyblock flags into keyblock mode which we use to index into
+   * kBootStateSHA1Digest[]. */
+  switch(keyblock_flags) {
+    case 6:  /* KEY_BLOCK_FLAG_RECOVERY_0 | KEY_BLOCK_FLAG_DEVELOPER_1 */
+      /* Developer firmware. */
+      index = 2;
+      break;
+    case 7:  /* KEY_BLOCK_FLAG_RECOVERY_0 | KEY_BLOCK_FLAG_DEVELOPER_0
+              *  | KEY_BLOCK_FLAGS_DEVELOPER_1 */
+      index = 1;
+      break;
+    default:
+      index = 0;  /* Any other keyblock flags. */
+  };
+
+  if (rec_mode)
+    index += 3;
+  if (dev_mode)
+    index += 6;
+  return index;
+}
+
+uint32_t SetTPMBootModeState(int developer_mode, int recovery_mode,
+                             int fw_keyblock_flags) {
+  uint32_t result;
+  const uint8_t* in_digest = NULL;
+  uint8_t out_digest[20];  /* For PCR extend output. */
+  int digest_index = GetBootStateIndex(developer_mode, recovery_mode,
+                                       fw_keyblock_flags);
+
+  if (digest_index >= 0 && digest_index < MAX_BOOT_STATE_INDEX)
+    in_digest = kBootStateSHA1Digests[digest_index];
+  else
+    in_digest = kBootInvalidSHA1Digest;  /* Internal out of bounds error. */
+  result = TlclExtend(BOOT_MODE_PCR, in_digest, out_digest);
+  VBDEBUG(("TPM: SetTPMBootModeState boot mode PCR out_digest %02x %02x %02x "
+           "%02x\n", out_digest, out_digest+1, out_digest+2, out_digest+3));
+  return result;
+}
diff --git a/firmware/lib/tpm_lite/tlcl.c b/firmware/lib/tpm_lite/tlcl.c
index 12742d8e..a3af5b5a 100644
--- a/firmware/lib/tpm_lite/tlcl.c
+++ b/firmware/lib/tpm_lite/tlcl.c
@@ -291,7 +291,8 @@ uint32_t TlclSetGlobalLock(void) {
   return TlclWrite(TPM_NV_INDEX0, (uint8_t*) &x, 0);
 }
 
-uint32_t TlclExtend(int pcr_num, uint8_t* in_digest, uint8_t* out_digest) {
+uint32_t TlclExtend(int pcr_num, const uint8_t* in_digest,
+                    uint8_t* out_digest) {
   struct s_tpm_extend_cmd cmd;
   uint8_t response[kTpmResponseHeaderLength + kPcrDigestLength];
   uint32_t result;
diff --git a/firmware/lib/vboot_firmware.c b/firmware/lib/vboot_firmware.c
index bfe91866..95db892c 100644
--- a/firmware/lib/vboot_firmware.c
+++ b/firmware/lib/vboot_firmware.c
@@ -9,6 +9,7 @@
 #include "gbb_header.h"
 #include "load_firmware_fw.h"
 #include "rollback_index.h"
+#include "tpm_bootmode.h"
 #include "utility.h"
 #include "vboot_common.h"
 #include "vboot_nvstorage.h"
@@ -53,6 +54,7 @@ int LoadFirmware(LoadFirmwareParams* params) {
   uint32_t status;
   uint32_t test_err = 0;
   int good_index = -1;
+  int boot_fw_keyblock_flags = 0;
   int is_dev;
   int index;
   int i;
@@ -274,6 +276,9 @@ int LoadFirmware(LoadFirmwareParams* params) {
        * this firmware.  That's the one we'll boot. */
       good_index = index;
       params->firmware_index = index;
+      /* Since we now know which firmware to boot, we can update the
+       * bootable firmware key block mode. */
+      boot_fw_keyblock_flags = key_block->key_block_flags;
 
       /* If the good firmware's key version is the same as the tpm,
        * then the TPM doesn't need updating; we can stop now.
@@ -284,6 +289,19 @@ int LoadFirmware(LoadFirmwareParams* params) {
     }
   }
 
+  /* At this point, we have a good idea of how we are going to boot. Update the
+   * TPM with this state information.
+   */
+  status = SetTPMBootModeState(is_dev, 0, boot_fw_keyblock_flags);
+  if (0 != status) {
+    VBDEBUG(("Unable to update the TPM with boot mode information.\n"));
+    if (status == TPM_E_MUST_REBOOT)
+      retval = LOAD_FIRMWARE_REBOOT;
+    else
+      recovery = VBNV_RECOVERY_RO_TPM_ERROR;
+    goto LoadFirmwareExit;
+  }
+
   /* Free internal data */
   Free(lfi);
   params->load_firmware_internal = NULL;
diff --git a/firmware/linktest/main.c b/firmware/linktest/main.c
index 6f5b83e4..16c4bf50 100644
--- a/firmware/linktest/main.c
+++ b/firmware/linktest/main.c
@@ -8,6 +8,7 @@
 #include "load_kernel_fw.h"
 #include "rollback_index.h"
 #include "tlcl.h"
+#include "tpm_bootmode.h"
 #include "vboot_common.h"
 #include "vboot_kernel.h"
 #include "vboot_nvstorage.h"
@@ -37,6 +38,9 @@ int main(void)
   RollbackKernelWrite(0);
   RollbackKernelLock();
 
+  /* tpm_bootmode.c */
+  SetTPMBootModeState(0, 0, 0);
+
   /* tlcl.h */
   TlclLibInit();
   TlclCloseDevice();