1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
|
/* Copyright (c) 2014 The Chromium OS Authors. All rights reserved.
* Use of this source code is governed by a BSD-style license that can be
* found in the LICENSE file.
*
* Secure non-volatile storage routines
*/
#ifndef VBOOT_REFERENCE_2SECDATA_H_
#define VBOOT_REFERENCE_2SECDATA_H_
/* Avoid circular dependency with 2api.h */
struct vb2_context;
typedef uint32_t vb2_error_t;
/*****************************************************************************/
/* Firmware version space */
#define VB2_SECDATA_VERSION 2
/* Flags for firmware space */
enum vb2_secdata_flags {
/*
* Last boot was developer mode. TPM ownership is cleared when
* transitioning to/from developer mode. Set/cleared by
* vb2_check_dev_switch().
*/
VB2_SECDATA_FLAG_LAST_BOOT_DEVELOPER = (1 << 0),
/*
* Virtual developer mode switch is on. Set/cleared by the
* keyboard-controlled dev screens in recovery mode. Cleared by
* vb2_check_dev_switch().
*/
VB2_SECDATA_FLAG_DEV_MODE = (1 << 1),
};
/* Secure data area (firmware space) */
struct vb2_secdata {
/* Struct version, for backwards compatibility */
uint8_t struct_version;
/* Flags; see vb2_secdata_flags */
uint8_t flags;
/* Firmware versions */
uint32_t fw_versions;
/* Reserved for future expansion */
uint8_t reserved[3];
/* CRC; must be last field in struct */
uint8_t crc8;
} __attribute__((packed));
/* Which param to get/set for vb2_secdata_get() / vb2_secdata_set() */
enum vb2_secdata_param {
/* Flags; see vb2_secdata_flags */
VB2_SECDATA_FLAGS = 0,
/* Firmware versions */
VB2_SECDATA_VERSIONS,
};
/*****************************************************************************/
/* Kernel version space */
/* Kernel space - KERNEL_NV_INDEX, locked with physical presence. */
#define VB2_SECDATAK_VERSION 2
#define VB2_SECDATAK_UID 0x4752574c /* 'GRWL' */
struct vb2_secdatak {
/* Struct version, for backwards compatibility */
uint8_t struct_version;
/* Unique ID to detect space redefinition */
uint32_t uid;
/* Kernel versions */
uint32_t kernel_versions;
/* Reserved for future expansion */
uint8_t reserved[3];
/* CRC; must be last field in struct */
uint8_t crc8;
} __attribute__((packed));
/* Which param to get/set for vb2_secdatak_get() / vb2_secdatak_set() */
enum vb2_secdatak_param {
/* Kernel versions */
VB2_SECDATAK_VERSIONS = 0,
};
/*****************************************************************************/
/* Firmware version space functions */
/**
* Initialize the secure storage context and verify its CRC.
*
* This must be called before vb2_secdata_get() or vb2_secdata_set().
*
* @param ctx Context pointer
* @return VB2_SUCCESS, or non-zero error code if error.
*/
vb2_error_t vb2_secdata_init(struct vb2_context *ctx);
/**
* Read a secure storage value.
*
* @param ctx Context pointer
* @param param Parameter to read
* @param dest Destination for value
* @return VB2_SUCCESS, or non-zero error code if error.
*/
vb2_error_t vb2_secdata_get(struct vb2_context *ctx,
enum vb2_secdata_param param, uint32_t *dest);
/**
* Write a secure storage value.
*
* @param ctx Context pointer
* @param param Parameter to write
* @param value New value
* @return VB2_SUCCESS, or non-zero error code if error.
*/
vb2_error_t vb2_secdata_set(struct vb2_context *ctx,
enum vb2_secdata_param param, uint32_t value);
/*****************************************************************************/
/* Kernel version space functions
*
* These are separate functions so that they don't bloat the size of the early
* boot code which uses the firmware version space functions.
*/
/**
* Initialize the secure storage context and verify its CRC.
*
* This must be called before vb2_secdatak_get() or vb2_secdatak_set().
*
* @param ctx Context pointer
* @return VB2_SUCCESS, or non-zero error code if error.
*/
vb2_error_t vb2_secdatak_init(struct vb2_context *ctx);
/**
* Read a secure storage value.
*
* @param ctx Context pointer
* @param param Parameter to read
* @param dest Destination for value
* @return VB2_SUCCESS, or non-zero error code if error.
*/
vb2_error_t vb2_secdatak_get(struct vb2_context *ctx,
enum vb2_secdatak_param param, uint32_t *dest);
/**
* Write a secure storage value.
*
* @param ctx Context pointer
* @param param Parameter to write
* @param value New value
* @return VB2_SUCCESS, or non-zero error code if error.
*/
vb2_error_t vb2_secdatak_set(struct vb2_context *ctx,
enum vb2_secdatak_param param, uint32_t value);
#endif /* VBOOT_REFERENCE_2SECDATA_H_ */
|
