lib/tpm2: do not create all NVRAM spaces with the same set of attributes

Hardware / Coreboot - Vadim Bendebury [chromium.org] - 14 November 2016 12:11 UTC

The TPM spaces created by the RO need to have different attributes depending on the space's use. The firmware rollback counter and MRC hash spaces are created by the RO code and need to be protected at the highest level: it should be impossible to delete or modify the space once the RO exits, and it is how it is done before this patch.

The rest of the spaces should be possible to modify or recreate even after the RO exits. Let's use different set of NVRAM space attributes to achieve that, and set the 'pcr0 unchanged' policy only for the firmware counter and MRC cache spaces.

The definitions of the attributes can be found in "Trusted Platform Module Library Part 2: Structures", Revision 01.16, section "13.2 TPMA_NV (NV Index Attributes)."

CQ-DEPEND=CL:410127 BRANCH=none BUG=chrome-os-partner:59651 TEST=verified that the reef system boots fine in both normal and recovery modes; using tpmc confirmed that firmware, kernel and MRC cache NVRAM spaces are readable in both and writeable only in recovery mode.

Change-Id: I1a1d2459f56ec929c9a92b39175888b8d1bcda55

289ee8f lib/tpm2: do not create all NVRAM spaces with the same set of attributes
src/lib/tpm2_tlcl.c | 64 +++++++++++++++++++++++++++++++++------------------
1 file changed, 42 insertions(+), 22 deletions(-)

Upstream: review.coreboot.org

  • Share