From: Stephen Carlson stcarlso@linux.microsoft.com

Rollback devices currently implement operations to store an OS anti-rollback monotonic counter. Existing devices such as the Trusted Platform Module (TPM) already support this operation, but this uclass provides abstraction for current and future devices that may support different features.

- New Driver Model uclass UCLASS_ROLLBACK. - New config CONFIG_DM_ROLLBACK to enable security device support. - New driver rollback-sandbox matching "rollback,sandbox", enabled with new config CONFIG_ROLLBACK_SANDBOX.

Signed-off-by: Stephen Carlson stcarlso@linux.microsoft.com Signed-off-by: Sean Edmond seanedmond@microsoft.com --- MAINTAINERS | 9 ++++ drivers/Kconfig | 2 + drivers/Makefile | 1 + drivers/rollback/Kconfig | 25 +++++++++++ drivers/rollback/Makefile | 6 +++ drivers/rollback/rollback-sandbox.c | 65 +++++++++++++++++++++++++++++ drivers/rollback/rollback-uclass.c | 30 +++++++++++++ include/dm/uclass-id.h | 1 + include/rollback.h | 42 +++++++++++++++++++ 9 files changed, 181 insertions(+) create mode 100644 drivers/rollback/Kconfig create mode 100644 drivers/rollback/Makefile create mode 100644 drivers/rollback/rollback-sandbox.c create mode 100644 drivers/rollback/rollback-uclass.c create mode 100644 include/rollback.h

diff --git a/MAINTAINERS b/MAINTAINERS index bf851cffd6..de14724c27 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -1438,6 +1438,15 @@ F: cmd/seama.c F: doc/usage/cmd/seama.rst F: test/cmd/seama.c

+ROLLBACK +M: Stephen Carlson stcarlso@linux.microsoft.com +M: Sean Edmond seanedmond@microsoft.com +S: Maintained +F: drivers/rollback/Kconfig +F: drivers/rollback/Makefile +F: drivers/rollback/rollback-sandbox.c +F: drivers/rollback/rollback-uclass.c + SEMIHOSTING R: Sean Anderson sean.anderson@seco.com S: Orphaned diff --git a/drivers/Kconfig b/drivers/Kconfig index a25f6ae02f..faa7cbb72b 100644 --- a/drivers/Kconfig +++ b/drivers/Kconfig @@ -116,6 +116,8 @@ source "drivers/rtc/Kconfig"

source "drivers/scsi/Kconfig"

+source "drivers/rollback/Kconfig" + source "drivers/serial/Kconfig"

source "drivers/smem/Kconfig" diff --git a/drivers/Makefile b/drivers/Makefile index efc2a4afb2..f6cfb48cb6 100644 --- a/drivers/Makefile +++ b/drivers/Makefile @@ -98,6 +98,7 @@ obj-$(CONFIG_PCH) += pch/ obj-$(CONFIG_DM_REBOOT_MODE) += reboot-mode/ obj-y += rtc/ obj-y += scsi/ +obj-y += rollback/ obj-y += sound/ obj-y += spmi/ obj-y += watchdog/ diff --git a/drivers/rollback/Kconfig b/drivers/rollback/Kconfig new file mode 100644 index 0000000000..31f5a3f56d --- /dev/null +++ b/drivers/rollback/Kconfig @@ -0,0 +1,25 @@ +config DM_ROLLBACK + bool "Support rollback devices with driver model" + depends on DM + help + This option enables support for the rollback uclass which supports + devices intended to provide the anti-rollback feature during + boot. These devices might encapsulate existing features of TPM + or TEE devices, but can also be dedicated security processors + implemented in specific hardware. + +config ROLLBACK_SANDBOX + bool "Enable sandbox rollback driver" + depends on DM_ROLLBACK + help + This driver supports a simulated rollback device that uses volatile + memory to store secure data and begins uninitialized. This + implementation allows OS images with security requirements to be + loaded in the sandbox environment. + +config ROLLBACK_TPM + bool "Enable TPM rollback driver" + depends on TPM && TPM_V2 && DM_ROLLBACK + help + This driver supports a rollback device based on existing TPM + functionality. diff --git a/drivers/rollback/Makefile b/drivers/rollback/Makefile new file mode 100644 index 0000000000..4e7fa46041 --- /dev/null +++ b/drivers/rollback/Makefile @@ -0,0 +1,6 @@ +# SPDX-License-Identifier: GPL-2.0+ +# +# (C) Copyright 2021 Microsoft, Inc. + +obj-$(CONFIG_DM_ROLLBACK) += rollback-uclass.o +obj-$(CONFIG_ROLLBACK_SANDBOX) += rollback-sandbox.o diff --git a/drivers/rollback/rollback-sandbox.c b/drivers/rollback/rollback-sandbox.c new file mode 100644 index 0000000000..acbe6d2303 --- /dev/null +++ b/drivers/rollback/rollback-sandbox.c @@ -0,0 +1,65 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright (c) 2021 Microsoft, Inc + * Written by Stephen Carlson stcarlso@microsoft.com + */ + +#include <common.h> +#include <dm.h> +#include <fdtdec.h> +#include <rollback.h> + +static struct rollback_state { + u64 rollback_idx; +}; + +static int sb_rollback_idx_get(struct udevice *dev, u64 *rollback_idx) +{ + struct rollback_state *priv = dev_get_priv(dev); + + if (!rollback_idx) + return -EINVAL; + + *rollback_idx = priv->rollback_idx; + return 0; +} + +static int sb_rollback_idx_set(struct udevice *dev, u64 rollback_idx) +{ + struct rollback_state *priv = dev_get_priv(dev); + u64 old_rollback_idx; + + old_rollback_idx = priv->rollback_idx; + if (rollback_idx < old_rollback_idx) + return -EPERM; + + priv->rollback_idx = rollback_idx; + return 0; +} + +static const struct rollback_ops rollback_sandbox_ops = { + .rollback_idx_get = sb_rollback_idx_get, + .rollback_idx_set = sb_rollback_idx_set, +}; + +static int rollback_sandbox_probe(struct udevice *dev) +{ + struct rollback_state *priv = dev_get_priv(dev); + + priv->rollback_idx = 0ULL; + return 0; +} + +static const struct udevice_id rollback_sandbox_ids[] = { + { .compatible = "sandbox,rollback" }, + { } +}; + +U_BOOT_DRIVER(rollback_sandbox) = { + .name = "rollback_sandbox", + .id = UCLASS_ROLLBACK, + .priv_auto = sizeof(struct rollback_state), + .of_match = rollback_sandbox_ids, + .probe = rollback_sandbox_probe, + .ops = &rollback_sandbox_ops, +}; diff --git a/drivers/rollback/rollback-uclass.c b/drivers/rollback/rollback-uclass.c new file mode 100644 index 0000000000..1fc5486b0d --- /dev/null +++ b/drivers/rollback/rollback-uclass.c @@ -0,0 +1,30 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright (c) 2021 Microsoft, Inc + * Written by Stephen Carlson stcarlso@microsoft.com + */ + +#include <common.h> +#include <dm.h> +#include <rollback.h> + +int rollback_idx_get(struct udevice *dev, uint64_t *rollback_idx) +{ + if (!dev || !rollback_idx) + return -EINVAL; + + return rollback_get_ops(dev)->rollback_idx_get(dev, rollback_idx); +} + +int rollback_idx_set(struct udevice *dev, uint64_t rollback_idx) +{ + if (!dev) + return -EINVAL; + + return rollback_get_ops(dev)->rollback_idx_set(dev, rollback_idx); +} + +UCLASS_DRIVER(rollback) = { + .id = UCLASS_ROLLBACK, + .name = "rollback", +}; diff --git a/include/dm/uclass-id.h b/include/dm/uclass-id.h index 0432c95c9e..4b8b730d87 100644 --- a/include/dm/uclass-id.h +++ b/include/dm/uclass-id.h @@ -124,6 +124,7 @@ enum uclass_id { UCLASS_RTC, /* Real time clock device */ UCLASS_SCMI_AGENT, /* Interface with an SCMI server */ UCLASS_SCSI, /* SCSI device */ + UCLASS_ROLLBACK, /* Rollback device */ UCLASS_SERIAL, /* Serial UART */ UCLASS_SIMPLE_BUS, /* Bus with child devices */ UCLASS_SMEM, /* Shared memory interface */ diff --git a/include/rollback.h b/include/rollback.h new file mode 100644 index 0000000000..60dfd62dea --- /dev/null +++ b/include/rollback.h @@ -0,0 +1,42 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * Copyright (c) 2021 Microsoft, Inc. + */ + +#ifndef _ROLLBACK_H_ +#define _ROLLBACK_H_ + +#include <stdint.h> + +/* Access the rollback operations for a device */ +#define rollback_get_ops(dev) ((struct rollback_ops *)(dev)->driver->ops) + +/** + * rollback_idx_get() Gets the OS anti-rollback version number + * + * @dev: Device to check + * @rollback_idx: The retrieved anti-rollback version + * @return 0 if OK, -ve on error + */ +int rollback_idx_get(struct udevice *dev, uint64_t *rollback_idx); + +/** + * rollback_idx_set() Sets the OS anti-rollback version number. + * + * @dev: Device to modify + * @rollback_idx: The new anti-rollback version to set + * @return 0 if OK, -ve on error + */ +int rollback_idx_set(struct udevice *dev, uint64_t rollback_idx); + +/** + * struct rollback_ops - Driver model rollback operations + * + * Refer to the functions above for the description of each operation. + */ +struct rollback_ops { + int (*rollback_idx_get)(struct udevice *dev, uint64_t *rollback_idx); + int (*rollback_idx_set)(struct udevice *dev, uint64_t rollback_idx); +}; + +#endif

From: Stephen Carlson stcarlso@linux.microsoft.com

New config CONFIG_ROLLBACK_CHECK to enable enforcement of OS anti-rollback counter during image loading.

Images with an anti-rollback counter value "rollback" declared in the FDT will be compared against the current device anti-rollback counter value, and older images will not pass signature validation. If the image is newer, the device anti-rollback counter value will be updated.

Signed-off-by: Stephen Carlson stcarlso@linux.microsoft.com Signed-off-by: Sean Edmond seanedmond@microsoft.com --- boot/Kconfig | 9 +++++ boot/image-fit-sig.c | 92 ++++++++++++++++++++++++++++++++++++++++++++ boot/image-fit.c | 31 +++++++++++++++ include/image.h | 6 ++- 4 files changed, 137 insertions(+), 1 deletion(-)

diff --git a/boot/Kconfig b/boot/Kconfig index e8fb03b801..9180a1c8dc 100644 --- a/boot/Kconfig +++ b/boot/Kconfig @@ -103,6 +103,15 @@ config FIT_CIPHER Enable the feature of data ciphering/unciphering in the tool mkimage and in the u-boot support of the FIT image.

+config FIT_ROLLBACK_CHECK + bool "Enable Anti rollback version check for FIT images" + depends on FIT_SIGNATURE + default n + help + Enables FIT image anti-rollback protection. This feature is required + when a platform needs to retire previous versions of FIT images due to + security flaws and prevent devices from being reverted to them. + config FIT_VERBOSE bool "Show verbose messages when FIT images fail" depends on FIT diff --git a/boot/image-fit-sig.c b/boot/image-fit-sig.c index 12369896fe..91eaf4baa8 100644 --- a/boot/image-fit-sig.c +++ b/boot/image-fit-sig.c @@ -11,6 +11,8 @@ #include <log.h> #include <malloc.h> #include <asm/global_data.h> +#include <dm.h> +#include <rollback.h> DECLARE_GLOBAL_DATA_PTR; #endif /* !USE_HOSTCC*/ #include <fdt_region.h> @@ -63,6 +65,44 @@ struct image_region *fit_region_make_list(const void *fit, return region; }

+static int fit_image_verify_rollback(const void *fit, int image_noffset) +{ +#if !defined(USE_HOSTCC) + u64 image_rollback; + u64 plat_rollback = 0ULL; + struct udevice *dev; + int ret; + + ret = fit_image_get_rollback(fit, image_noffset, &image_rollback); + + /* If the FIT doesn't contain the rollback property, assume an + * anti-rollback version number of 0. This ensures failure + * if the platform anti-rollback version number is non-zero + */ + if (ret) + image_rollback = 0; + + ret = uclass_first_device_err(UCLASS_ROLLBACK, &dev); + if (ret) + return ret; + + ret = rollback_idx_get(dev, &plat_rollback); + if (ret) + return -EIO; + + if (image_rollback < plat_rollback) { + return -EPERM; + } else if (image_rollback > plat_rollback) { + ret = rollback_idx_set(dev, image_rollback); + printf(" Updating OS anti-rollback to %llu from %llu\n", + image_rollback, plat_rollback); + return ret; + } +#endif + + return 0; +} + static int fit_image_setup_verify(struct image_sign_info *info, const void *fit, int noffset, const void *key_blob, int required_keynode, @@ -175,6 +215,16 @@ static int fit_image_verify_sig(const void *fit, int image_noffset, goto error; }

+ if (!tools_build()) { + if (FIT_IMAGE_ENABLE_ROLLBACK_CHECK && verified) { + ret = fit_image_verify_rollback(fit, image_noffset); + if (ret) { + err_msg = "Anti-rollback verification failed"; + goto error; + } + } + } + return verified ? 0 : -EPERM;

error: @@ -385,6 +435,38 @@ static int fit_config_check_sig(const void *fit, int noffset, int conf_noffset, return 0; }

+static int fit_config_verify_rollback(const void *fit, int conf_noffset, + int sig_offset) +{ + static const char default_list[] = FIT_KERNEL_PROP "\0" + FIT_FDT_PROP; + int ret, len; + const char *prop, *iname, *end; + int image_noffset; + + /* If there is "sign-images" property, use that */ + prop = fdt_getprop(fit, sig_offset, "sign-images", &len); + if (!prop) { + prop = default_list; + len = sizeof(default_list); + } + + /* Locate the images */ + end = prop + len; + for (iname = prop; iname < end; iname += strlen(iname) + 1) { + image_noffset = fit_conf_get_prop_node(fit, conf_noffset, + iname, IH_PHASE_NONE); + if (image_noffset < 0) + return -ENOENT; + + ret = fit_image_verify_rollback(fit, image_noffset); + if (ret) + return ret; + } + + return 0; +} + /** * fit_config_verify_key() - Verify that a configuration is signed with a key * @@ -444,6 +526,16 @@ static int fit_config_verify_key(const void *fit, int conf_noffset, goto error; }

+ if (!tools_build()) { + if (FIT_IMAGE_ENABLE_ROLLBACK_CHECK && verified) { + ret = fit_config_verify_rollback(fit, conf_noffset, noffset); + if (ret) { + err_msg = "Anti-rollback verification failed"; + goto error; + } + } + } + if (verified) return 0;

diff --git a/boot/image-fit.c b/boot/image-fit.c index 3cc556b727..510cb51cd5 100644 --- a/boot/image-fit.c +++ b/boot/image-fit.c @@ -1084,6 +1084,37 @@ int fit_image_get_data_and_size(const void *fit, int noffset, return ret; }

+/** + * fit_image_get_rollback - get anti-rollback counter + * @fit: pointer to the FIT image header + * @noffset: component image node offset + * @rollback: holds the rollback property value + * + * returns: + * 0, on success + * -ENOENT if the property could not be found + */ +int fit_image_get_rollback(const void *fit, int noffset, uint64_t *rollback) +{ + const fdt64_t *val; + int len; + + val = fdt_getprop(fit, noffset, FIT_ROLLBACK_PROP, &len); + + if (!val) { + printf("error! Can't find property %s in FIT\n", FIT_ROLLBACK_PROP); + return -ENOENT; + } + if (len != sizeof(uint64_t)) { + printf("Property %s must be 64-bits\n", FIT_ROLLBACK_PROP); + return -ENOENT; + } + + *rollback = fdt64_to_cpu(*val); + + return 0; +} + /** * fit_image_hash_get_algo - get hash algorithm name * @fit: pointer to the FIT format image header diff --git a/include/image.h b/include/image.h index 01a6787d21..3283cd7717 100644 --- a/include/image.h +++ b/include/image.h @@ -1024,6 +1024,7 @@ int booti_setup(ulong image, ulong *relocated_addr, ulong *size, #define FIT_COMP_PROP "compression" #define FIT_ENTRY_PROP "entry" #define FIT_LOAD_PROP "load" +#define FIT_ROLLBACK_PROP "rollback"

/* configuration node */ #define FIT_KERNEL_PROP "kernel" @@ -1105,6 +1106,7 @@ int fit_image_get_data_size_unciphered(const void *fit, int noffset, size_t *data_size); int fit_image_get_data_and_size(const void *fit, int noffset, const void **data, size_t *size); +int fit_image_get_rollback(const void *fit, int noffset, uint64_t *rollback_idx);

/** * fit_get_data_node() - Get verified image data for an image @@ -1389,6 +1391,7 @@ int calculate_hash(const void *data, int data_len, const char *algo, * device */ #if defined(USE_HOSTCC) +# define FIT_IMAGE_ENABLE_ROLLBACK_CHECK 0 # if defined(CONFIG_FIT_SIGNATURE) # define IMAGE_ENABLE_SIGN 1 # define FIT_IMAGE_ENABLE_VERIFY 1 @@ -1399,7 +1402,8 @@ int calculate_hash(const void *data, int data_len, const char *algo, # endif #else # define IMAGE_ENABLE_SIGN 0 -# define FIT_IMAGE_ENABLE_VERIFY CONFIG_IS_ENABLED(FIT_SIGNATURE) +# define FIT_IMAGE_ENABLE_VERIFY CONFIG_IS_ENABLED(FIT_SIGNATURE) +# define FIT_IMAGE_ENABLE_ROLLBACK_CHECK CONFIG_IS_ENABLED(FIT_ROLLBACK_CHECK) #endif

#ifdef USE_HOSTCC

From: Sean Edmond seanedmond@microsoft.com

Adds a test for a sandbox and TPM backed rollback driver.

Allows for testing of anti-rollback version number get/set API using the rollback driver.

Signed-off-by: Sean Edmond seanedmond@microsoft.com --- arch/sandbox/dts/test.dts | 9 +++++ configs/sandbox_defconfig | 3 ++ test/dm/Makefile | 1 + test/dm/rollback.c | 78 +++++++++++++++++++++++++++++++++++++++ 4 files changed, 91 insertions(+) create mode 100644 test/dm/rollback.c

diff --git a/arch/sandbox/dts/test.dts b/arch/sandbox/dts/test.dts index f351d5cb84..1226bad6a6 100644 --- a/arch/sandbox/dts/test.dts +++ b/arch/sandbox/dts/test.dts @@ -1263,6 +1263,10 @@ backlight = <&backlight 0 100>; };

+ rollback@0 { + compatible = "sandbox,rollback"; + }; + scsi { compatible = "sandbox,scsi"; sandbox,filepath = "scsi.img"; @@ -1376,6 +1380,11 @@

tpm2 { compatible = "sandbox,tpm2"; + + rollback@1 { + compatible = "tpm,rollback"; + rollback-nv-index = <0x1001007>; + }; };

tpm { diff --git a/configs/sandbox_defconfig b/configs/sandbox_defconfig index 1cd1c2ed7c..f2bd10fbf0 100644 --- a/configs/sandbox_defconfig +++ b/configs/sandbox_defconfig @@ -346,3 +346,6 @@ CONFIG_UNIT_TEST=y CONFIG_UT_TIME=y CONFIG_UT_DM=y CONFIG_ARM_FFA_TRANSPORT=y +CONFIG_DM_ROLLBACK=y +CONFIG_ROLLBACK_SANDBOX=y +CONFIG_ROLLBACK_TPM=y diff --git a/test/dm/Makefile b/test/dm/Makefile index 7ed00733c1..3875ec4f4b 100644 --- a/test/dm/Makefile +++ b/test/dm/Makefile @@ -104,6 +104,7 @@ obj-$(CONFIG_DM_RNG) += rng.o obj-$(CONFIG_DM_RTC) += rtc.o obj-$(CONFIG_SCMI_FIRMWARE) += scmi.o obj-$(CONFIG_SCSI) += scsi.o +obj-$(CONFIG_DM_ROLLBACK) += security.o obj-$(CONFIG_DM_SERIAL) += serial.o obj-$(CONFIG_DM_SPI_FLASH) += sf.o obj-$(CONFIG_SIMPLE_BUS) += simple-bus.o diff --git a/test/dm/rollback.c b/test/dm/rollback.c new file mode 100644 index 0000000000..a2984797f9 --- /dev/null +++ b/test/dm/rollback.c @@ -0,0 +1,78 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright 2023 Microsoft Corporation + * Written by Sean Edmond seanedmond@microsoft.com + */ + +#include <common.h> +#include <dm.h> +#include <rollback.h> +#include <log.h> +#include <dm/test.h> +#include <test/test.h> +#include <test/ut.h> + +/* + * get_rollback() - Get a rollback driver of a given driver name + * + * @devp: Returns the rollback device + * @driver_name: Driver name to find + * Returns: 0 if OK, -ENODEV if not found + */ +static int get_rollback(struct udevice **devp, char *driver_name) +{ + struct udevice *dev; + + uclass_foreach_dev_probe(UCLASS_ROLLBACK, dev) { + if (strcmp(dev->driver->name, driver_name) == 0) { + *devp = dev; + return 0; + } + } + + return -ENODEV; +} + +/* Basic test of rollback driver Anti rollback version number read/write */ +static int test_rollback_idx(struct unit_test_state *uts, char *driver_name) +{ + struct udevice *dev; + u64 rollback_idx; + + /* get the rollback driver */ + ut_assertok(get_rollback(&dev, driver_name)); + + /* ensure initial value is 0 */ + rollback_idx_get(dev, &rollback_idx); + ut_asserteq(0, rollback_idx); + + /* write 1 and ensure it's read back */ + rollback_idx_set(dev, 1); + rollback_idx_get(dev, &rollback_idx); + ut_asserteq(1, rollback_idx); + + /* write all ones and ensure it's read back */ + rollback_idx_set(dev, 0xffffffffffffffffULL); + rollback_idx_get(dev, &rollback_idx); + ut_asserteq(0xffffffffffffffffULL, rollback_idx); + + return 0; +} + +static int dm_test_rollback_sandbox(struct unit_test_state *uts) +{ + ut_assertok(test_rollback_idx(uts, "rollback_sandbox")); + + return 0; +} + +DM_TEST(dm_test_rollback_sandbox, UT_TESTF_SCAN_FDT); + +static int dm_test_rollback_tpm(struct unit_test_state *uts) +{ + ut_assertok(test_rollback_idx(uts, "rollback_tpm")); + + return 0; +} + +DM_TEST(dm_test_rollback_tpm, UT_TESTF_SCAN_FDT);

From: Sean Edmond seanedmond@microsoft.com

The TPM 2.0 command reference shows "auth" (type TPM2B_AUTH) before "publicInfo" (type TPM2B_NV_PUBLIC).

The TPM v2 driver was updated to add this field. The sandbox driver needs to be updated to match the driver implementation.

Signed-off-by: Sean Edmond seanedmond@microsoft.com --- drivers/tpm/tpm2_tis_sandbox.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/tpm/tpm2_tis_sandbox.c b/drivers/tpm/tpm2_tis_sandbox.c index e4004cfcca..3e38d28637 100644 --- a/drivers/tpm/tpm2_tis_sandbox.c +++ b/drivers/tpm/tpm2_tis_sandbox.c @@ -758,8 +758,10 @@ static int sandbox_tpm2_xfer(struct udevice *dev, const u8 *sendbuf, break; } case TPM2_CC_NV_DEFINE_SPACE: { - int policy_size, index, seq; + int policy_size, auth_size, index, seq;

+ auth_size = get_unaligned_be16(sent); + sent += 2 + auth_size; policy_size = get_unaligned_be16(sent + 12); index = get_unaligned_be32(sent + 2); sent += 14 + policy_size;