summaryrefslogtreecommitdiff
path: root/include/tpm_vendor_cmds.h
Commit message (Collapse)AuthorAgeFilesLines
* cr50: expose spihash PP polling to the hostVadim Bendebury2018-03-031-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | When running the spihash command using gsctool (as opposed to the running it from the Cr50 console), the operator needs to be prompted when the PP button needs to be pressed. This patch extends spihash command implementation by adding a new subcommand for polling physical presence. BRANCH=cr50, cr50-mp BUG=b:73668125 TEST=with the appropriate gsctool changes the user is periodically prompted to press the physical presence button, and eventually it is possible to set up spi hash access to AP and EC. Signed-off-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/930568 Reviewed-by: Randall Spangler <rspangler@chromium.org> (cherry picked from commit d015bc937c0eecf1cb8f1b163874ea69c890dea4) Change-Id: I33b1d8350ff5d017211e5e6de5f6e92f7e8392da Reviewed-on: https://chromium-review.googlesource.com/947420 Reviewed-by: Furquan Shaikh <furquan@chromium.org> Commit-Queue: Furquan Shaikh <furquan@chromium.org> Tested-by: Furquan Shaikh <furquan@chromium.org> Trybot-Ready: Furquan Shaikh <furquan@chromium.org>
* cr50: use single __packed definitionVadim Bendebury2018-02-221-0/+2
| | | | | | | | | | | | | | | | | | | Various parts of Cr50 code and Cr50 related utilities duplicate definition of __packed available in include/common.h. Let's use the same definition everywhere. BRANCH=cr50, cr50-mp BUG=none TEST=make buildall succeeds verified that linker generated map files for Cr50 RW are the same before and after this change. built and used gsctoo and rma_reset Change-Id: Ib91f9bbad1f6822b347f32b393630f592df80d60 Signed-off-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/931929 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* cr50: Convert spihash to TPM vendor commandRandall Spangler2018-02-151-0/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The console command now calls the vendor command to do the work. Otherwise, the same as before. BUG=chromium:804507 BRANCH=cr50 release (after testing) TEST=manual: # Sample sequence spihash ap -> requires physical presence; tap power button spihash 0 1024 -> gives a hash; compare with first 1KB of image.bin spihash dump 0 128 -> dumps first 128 bytes; compare with image.bin spihash 128 128 -> offset works spihash 0 0x100000 -> gives a hash; doesn't watchdog reset spihdev ec spihash 0 1024 -> compare with ec.bin spihash disable # Test timeout spihash ap # Wait 30 seconds spihash 0 1024 -> still works # Wait 60 seconds; goes back disabled automatically spihash 0 1024 -> fails because spihash is disabled # Presence not required when CCD opened ccd open spihash ap -> no PP required spihash 0 1024 -> works spihash disable # Possible for owner to disable via CCD config ccd -> HashFlash is "Always" ccd set HashFlash IfOpened ccd lock spihash ap -> access denied # Cleanup ccd open ccd reset ccd lock Change-Id: Ife9335a1e402a7596d99bf515ec89ff94e8a0044 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/910083 Reviewed-by: Aseda Aboagye <aaboagye@chromium.org> Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
* Add support for HW alertsAnatol Pomazau2018-01-311-0/+1
| | | | | | | | | | | | | | | | | | | | | - Add a vendor command that provides alert counter. Userspace can use it e.g. for user metric analysis. - Add 'alerts' debug console command. It provides information about chip alerts: supported alerts, fuse status, interrupt status, alert counter. - Add 'alerts fire [INT]' command to fire a software defined alert (globalsec/fwN where N is 0,1,2,3). Signed-off-by: Anatol Pomazau <anatol@google.com> BUG=b:63523947 TEST=ran the FW at Pyro and checked alerts data sent to host Change-Id: I7cec0c451ed71076b44dad14a151b147ff1337e8 Reviewed-on: https://chromium-review.googlesource.com/817639 Commit-Ready: Anatol Pomazau <anatol@google.com> Tested-by: Anatol Pomazau <anatol@google.com> Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
* ccd: add distinct return code to indicate that password is requiredVadim Bendebury2018-01-121-0/+1
| | | | | | | | | | | | | | | | | | When user is trying to execute 'ccd open' or 'ccd unlock' and password is set, the return error code does not allow to tell the reason for the command failure. Let's add a distinct return code to indicate this condition so that the user can supply password. BRANCH=cr50 BUG=b:62537474 TEST=verified along with the accompanying gsctool modifications. Change-Id: I286f87ab12114cd7dd7ebcdf0e321f7a24723367 Signed-off-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/861208 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* ccd: add 'in progress' return valueVadim Bendebury2018-01-121-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | Depending on device configuration and compile time options, CCD commands 'open' and 'unlock' could either be executed immediately, or require the user to take the device through physical presence state machine. As these commands execute through TPM vendor commands, there needs to be a different return value indicating that the command action is not finished and PP process is in progress. Let's add another vendor command return value, and do not consider it a failure if vendor command returns this value in response to 'ccd open' or 'ccd unlock'. BRANCH=cr50 BUG=b:62537474 TEST=took an Eve through 'ccd open' sequence Change-Id: Ie62ccfb4319a13b6fb6c1c854a0ea26beb9f517c Signed-off-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/860999 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* ccd: prepare for handling crucial CCD commands through TPM task contextVadim Bendebury2018-01-101-1/+5
| | | | | | | | | | | | | | | | | | | | We want CCD commands lock, open, password, and unlock (at least to start with) to be available over both CLI and through crosh (i.e. coming over /dev/tpm0). Let's allocate a TPM vendor command for handling all CCD subcommands, and move to this new framework the 'ccd password' command, which already is available over vendor command. BRANCH=cr50 BUG=b:62537474 TEST=verified that 'ccd password' still works both over Suzy-Q CLI and using gsctool on the target. Change-Id: I2d06230b762f47af7e580b188a587bc5678ca169 Signed-off-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/853280 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* ccd: restrict password setting to allowed statesVadim Bendebury2017-12-111-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Setting password should be allowed only after the owner logged in for the first time and before they log out or someone else logs in. Once any other user but the owner logs in, it should become impossible to set password until the device is reset. As proposed here, this would apply to both attempts to set password through crosh and Cr50 console. Password handling on Cr50 passes the following states: - password setting is not allowed after Cr50 reset until an upstart (as opposed to resume) TPM startup happens, as signalled by the TPM callback. After the proper TPM reset the state changes to 'POST_RESET_STATE' which means that the device was just reset/rebooted (not resumed) and no user logged in yet. - if the owner logs in in this state, the state changes to 'PASSWORD_ALLOWED_STATE'. The owner can open crosh session and set the password. - when the owner logs out or any user but the owner logs in, the state changes to PASSWORD_NOT_ALLOWED_STATE and does not change until TPM is reset. This makes sure that password can be set only by the owner and only before anybody else logged in. Separate changes to the TPM library code make sure that TPM reset is reported through the platform layer, so that POST_RESET_STATE is entered. BRANCH=cr50 BUG=b:67007578 TEST=with the rest of the infrastructure in place verified that password can be set only when the owner logged in for the first time before anybody else logs in or the owner logs out. Change-Id: Ieaa3dc8ff9d2e43ae11151eb31173220f5c75b58 Signed-off-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/804141 Reviewed-by: Randall Spangler <rspangler@chromium.org> Reviewed-by: Andrey Pronin <apronin@chromium.org>
* cr50: ccd: add vendor command to disable RMA modeVadim Bendebury2017-11-281-0/+1
| | | | | | | | | | | | | | | | | The new vendor command takes the CCD state machine through necessary transitions leaving it in the CCD locked state. It succeeds only if user password is not set and CCD capabilities are right, which is guaranteed to be the case after an RMA unlock. BRANCH=cr50 BUG=b:68213540 TEST=tested using the modified gsctool utility. Change-Id: Ic2cce34e74b1ff476841cfa1a99f50d6a947c315 Signed-off-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/784352 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* ccd: pass 'ccd password' execution through tpm task contextVadim Bendebury2017-10-271-0/+1
| | | | | | | | | | | | | | | | | | It is necessary to be able to set password both from the Cr50 console and through a vendor command. This patch moves all password management logic to the TPM task context using the alternative vendor command path. BRANCH=cr50 BUG=b:62537474 TEST=verified that using Cr50 console CCD password still can be set and cleared as before. Change-Id: I0574caf931e3717567fdb270e406643eac47764b Signed-off-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/740914 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* g: rename usb_updater into gsctoolVadim Bendebury2017-10-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The usb_updater utility has long been not just an updater, and has long been using other interfaces in addition to USB. gsctool is a much more suitable name. CQ-DEPEND=CL:709776 BRANCH=cr50 BUG=b:67007500 TEST=verified that make -C ./extra/usb_updater generates ./extra/usb_updater/gsctool: $ ./extra/usb_updater/gsctool --help Usage: gsctool [options] <binary image> This updates the Cr50 RW firmware over USB. The required argument is the full RO+RW image. Options: [...] $ Change-Id: I3ab70c28acf3664ddefaa923a87ba1fd5c3c437b Signed-off-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/709738 Reviewed-by: Mary Ruthven <mruthven@chromium.org>
* common: add TPM vendor command to support RMA authenticationVadim Bendebury2017-10-021-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | The new vendor command operates in two modes: when received with a zero size payload, it triggers the Cr50 to generate a new RMA authentication challenge and the expected authentication code value. When receive with the payload, it compares the received payload with the pre-calculate authentication code, and returns to the host the comparison result (passed/not passed). A care is taken not to accept payload until at least there is a valid calculated auth code present (to avoid reporting a match on a payload of all zeros). Test config needed to be modified to allow compiling of the ccprintf wrapper. BRANCH=cr50 BUG=b:37952913 TEST=with the rest of the patches applied observed expected behavior of generating challenge/response and verifying the auth code. Change-Id: I30638b0ceef68830565f222dd1f4af17cfc8d7ef Signed-off-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/690992
* cr50: Add vendor cmd to query rec btn state.Aseda Aboagye2017-08-291-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In order to test certain devices in the test lab using cased closed debugging (CCD), we need a mechanism to programmatically "press" the recovery button. Even though this signal is being buffered through the EC to the AP, and the EC could theoretically set it if needed, we cannot trust the EC in its RO image since it may speak to the outside world over USB PD. Instead, this commit introduces a console command on cr50 that can be used to force the recovery button state to be pressed. However, it is gated behind the CCD capabilities defaulting to the IfOpened state. Additionally, a new vendor command is added to query the trusted state of the recovery button. The AP should use this command instead of trusting the GPIO connected to it. BUG=b:37751915, b:64146626 BRANCH=cr50 TEST=Flash cr50. Press KEY0, verify that reported rec btn follows the state of the button. TEST=`recbtnforce enable` causes the button to be reported as pressed. Physical presses of the button do not alter the reported state. TEST=`recbtnforce disable` causes the reported state to follow that of the physical button. TEST=The `recbtnforce` command is set to the IfOpened capability by default. TEST=CCD locking the DUT and attempting to force the recovery button results in an error of access denied. The physical state is reported. TEST=From the AP, issue the vendor command to retrieve the button state and verify that it behaves as expected. Change-Id: Ib8c2928e75e5f9a1a83c5361664efc3fa0ae2ddb Signed-off-by: Aseda Aboagye <aaboagye@google.com> Reviewed-on: https://chromium-review.googlesource.com/635955 Commit-Ready: Aseda Aboagye <aaboagye@chromium.org> Tested-by: Aseda Aboagye <aaboagye@chromium.org> Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
* tpm: Add optional event loggingShawn Nematbakhsh2017-08-101-0/+2
| | | | | | | | | | | | | | | | | | Allow TPM to log events in a circular buffer through tpm_log_event(). Logs can be retrieved through a new vendor command VENDOR_CC_POP_LOG_ENTRY. BUG=b:63760920 TEST=On eve, store TPM logs through 'logentry' cr50 console command, verify logs are fetched correctly through 'trunks_send --pop_logentry'. BRANCH=None Signed-off-by: Shawn Nematbakhsh <shawnn@chromium.org> Change-Id: Idbc405728c0ba68078447fb59717d6115830e3d8 Reviewed-on: https://chromium-review.googlesource.com/599352 Commit-Ready: Shawn N <shawnn@chromium.org> Tested-by: Shawn N <shawnn@chromium.org> Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
* cr50: add U2F supportVincent Palatin2017-06-291-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implement U2F (universal second factor authentication) feature over TPM vendor commands. The raw U2F APDU as defined by the FIDO Alliance 'U2F Raw Message Formats' specification can be sent using the VENDOR_CC_U2F_APDU command. So the vendor command is taking a ISO7816-4:2005 APDU format frame as input as defined by the spec and returns another APDU using ISO7816-4 status code. The APDU is processed by the common U2F code using u2f_apdu_rcv(), this hardware specific code provides: - the user physical presence detection (done by the power button press) returned by the pop_check_presence() callback. - the connection to the cryptographic hardware to generate/derive the keys used by the U2F and individual attestation functions. This feature/vendor command has 3 modes: - disabled - U2F (only the commands/flags defined by the U2F specification) - G2F (the U2F commands plus some extensions for individual attestation) Signed-off-by: Vincent Palatin <vpalatin@chromium.org> BRANCH=cr50 BUG=b:35545754 TEST=pass U2FTest and HIDTest. Change-Id: Ic2591f369763fb4ba67926e2b4a0c2cd35330a18 Reviewed-on: https://chromium-review.googlesource.com/518139 Commit-Ready: Vincent Palatin <vpalatin@chromium.org> Tested-by: Vincent Palatin <vpalatin@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
* cr50: usb_upgrade: allow responses lager than requestsVadim Bendebury2017-06-061-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When invoking vendor command handlers in try_vendor_command(), the buffer containing the command is passed to the handler to communicate the command contents and to hold the command execution return data. It was fine when invoking vendor command handlers from the TPM stack, as the receive buffer is 4K in size and is large enough for any expected vendor command response. It is different in case of USB: the command is in the receive buffer of the USB queue, and the response data could easily exceed the command size, which would cause corruption of the USB receive queue contents when the response data is placed into the same buffer where the command is. Let's introduce a local storage to pass the command and receive the response data from the handler. 32 bytes is enough for the foreseeable future, should a need arise for a larger buffer, testing would result in an error (a new error type is added to indicate insufficient buffer space for command processing). BRANCH=none BUG=b:35587387,b:35587053 TEST=with the rest of the patches applied verified proper processing of the 'Get Board ID' command for which response size exceeds the request size. Change-Id: I2131496f3a99c7f3a1869905120a453d75efbdce Signed-off-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/525092 Reviewed-by: Aseda Aboagye <aaboagye@chromium.org>
* cr50: Add console and TPM vendor commands to get/set board IDPhilip Chen2017-06-021-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds vendor and console commands to read and write the board ID space in the INFO1 block. Current image's board ID settings are saved in the image header by the latest codesigner. Board ID write attempts are rejected if the board ID space is already initialized, or if the currently running image will not be allowed to run with the new board ID space settings. Error codes are returned to the caller as a single byte value. Successful read command returns 12 bytes of the board ID space contents. The console command always allows to read the board ID value, and allows to write it if the image was built with debug enabled. BUG=b:35586335 BRANCH=cr50 TEST=as follows: - verified that board ID can be read by any image and set by debug images. - with the upcoming patches verified the ability to set and read board ID values using vendor commands. Change-Id: I35a3e2db92175a29de8011172b80091065b27414 Signed-off-by: Philip Chen <philipchen@google.com> Signed-off-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/522234 Reviewed-by: Aseda Aboagye <aaboagye@chromium.org> Reviewed-by: Mary Ruthven <mruthven@chromium.org>
* cr50: add vendor command to restore corrupted headerVadim Bendebury2017-03-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The upcoming move of the Cr50 firmware update to the background requires postponing the activation of the newly uploaded Cr50 image to a later point in time, when the AP is ready to switch to start using the new Cr50 image. The suggested way of achieving it is as follows: when downloading the new image, the current Cr50 code modifies the header's 'image_size' field, setting its top bit to 1. This both makes the size invalid and guarantees that the new image would not verify on the following Cr50 restarts. When the AP is ready to switch to running the new Cr50 image, it will send a vendor command, which would trigger the currently running Cr50 image to restore the other image's size field. This vendor command would also communicate the timeout for the Cr50 to wait before rebooting, if there has been at least one header (ro or rw) restored. Rebooting the Cr50 would trigger rebooting the AP, resulting in the entire system running the updated firmware. Response sent to the AP will indicate if there has been a header restored and the reboot is indeed upcoming, this would allow the AP to quiesce the state of the device to handle the reboot gracefully. BRANCH=cr50 BUG=b:35580805 TEST=with the rest of the patches applied observed the system properly after the new header version was restored. Change-Id: Ia1edee67b6aa8f458810d5dc2931477cfaab1566 Signed-off-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/457676 Reviewed-by: Aaron Durbin <adurbin@chromium.org>
* cr50: vendor command to report tpm stateVadim Bendebury2017-01-281-0/+4
| | | | | | | | | | | | | | | | | | | | | | | This vendor command allows the host to retrieve the internal TPM state. The first version of the command will return the failure information collected during assert, if it ever happened, retry counter value and the maximum retry counter value to be able to detect if TPM is in lockout. The structure is packed, it is serialized before being sent to the host. BRANCH=none BUG=chrome-os-partner:60555 TEST=when running on a reef with a depthcharge image capable of displaying TPM state on errors observed state information added to the recovery screen text display. Change-Id: I9d37f7a971013ce802f63218d43697fab68276c9 Signed-off-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/430952 Reviewed-by: Aaron Durbin <adurbin@chromium.org> Reviewed-by: Andrey Pronin <apronin@chromium.org>
* cr50: vendor command to enable nvmem commitsVadim Bendebury2017-01-051-0/+1
| | | | | | | | | | | | | | | | | | | | | TPM NVMEM commits are reenabled as soon as the system boots into Chrome OS. However, sometimes the device does not boot into Chrome OS, in which case it is necessary to be able to reinstate NVMEM commits explicitly. The new vendor command will provide this functionality. BRANCH=none BUG=chrome-os-partner:59873 TEST=added code to depthcharge to issue the new vendor command if the system falls into recovery mode, verify that commits are re-instated once the command is issued. Change-Id: I3c06b27175751dc2c095911441935eee62ed9c50 Reviewed-on: https://chromium-review.googlesource.com/424064 Commit-Ready: Vadim Bendebury <vbendeb@chromium.org> Tested-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-by: Aaron Durbin <adurbin@chromium.org>
* cr50: add vendor command to invalidate inactive rwMary Ruthven2016-12-161-0/+1
| | | | | | | | | | | | | | | | | | | | This adds a vendor command to invalidate the old rw. It should be used when the tpm has been validated. BUG=chrome-os-partner:55667 BRANCH=none TEST=manual run the vendor command run 'ver' on the cr50 console and verify the inactive RW version is Error reboot cr50 10 times and make sure there is no rollback. Change-Id: Ibec3dde77d6b1ab921e43613d54638b7318f3f57 Signed-off-by: Mary Ruthven <mruthven@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/420407 Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
* tpm: move extension and vendor command definitions into own fileVadim Bendebury2016-11-281-0/+82
Let's make sure that both embedded and host side use the same command definitions. To avoid host compilation problems move the definitions into a separate file. BRANCH=none BUG=none TEST=compilation still works. Change-Id: Id0d85a51aebabed0637965b3b19d7ed42c46e75e Signed-off-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/414945 Reviewed-by: Bill Richardson <wfrichar@chromium.org>
View Lorry Controller Status