From ca0e82685989a08c6adaa52fc8d33546cd3bb1a2 Mon Sep 17 00:00:00 2001 From: Nicolas Boichat Date: Wed, 8 Mar 2017 17:49:25 -0800 Subject: common/rollback: Add support for rollback protection Implement actual rollback protection. First, we add a new field in the version structure, which is an incrementing integer (we'll start by shipping images with version 0, and gradually increase the number as required). This allows us to release new versions of the EC without necessarily bumping the rollback protection. For the rollback protection block itself, it contains 2 sub-blocks of equal size (normally, 2k), that are individually erasable. The rollback code looks at both, and takes the most restrictive one to determine the desired rollback minimum version. The blocks are also allowed to be erased (full of 1's), in which case the rollback minimum version is assumed to be 0. We also add an FMAP entry, in case we later decide to allow the signer to increment the rollback version. Also note that, like any version_data struct change, this change breaks compatibility between old and new RO/RW. Follow-up code will take care of auto-updating the rollback block as required, and properly manage block protection. BRANCH=none BUG=b:35586219 TEST=Flash hammer rollbackinfo => 1 version 0 block, 1 empty block, RW verifies correctly. rollbackupdate 0; rollbackinfo => No change rollbackupdate 1; reboot => RO refuses to jump to RW rollbackupdate 2, 3, 4; rollbackinfo => Writes alternate between the 2 blocks. rollbackupdate 2 => Refuses to downgrade version Change-Id: Ia969afb481a93deb912b9153bdd95ace01ad8fa7 Reviewed-on: https://chromium-review.googlesource.com/452815 Commit-Ready: Nicolas Boichat Tested-by: Nicolas Boichat Reviewed-by: Randall Spangler Reviewed-by: Vincent Palatin --- common/version.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'common/version.c') diff --git a/common/version.c b/common/version.c index ff8207bf2c..06cbfbab01 100644 --- a/common/version.c +++ b/common/version.c @@ -7,9 +7,13 @@ #include #include "common.h" +#include "compile_time_macros.h" #include "ec_version.h" #include "version.h" +BUILD_ASSERT(CONFIG_ROLLBACK_VERSION >= 0); +BUILD_ASSERT(CONFIG_ROLLBACK_VERSION <= INT32_MAX); + const struct image_data __keep current_image_data __attribute__((section(".rodata.ver"))) = { .cookie1 = CROS_EC_IMAGE_DATA_COOKIE1, @@ -17,6 +21,7 @@ const struct image_data __keep current_image_data #ifndef TEST_BUILD .size = (const uintptr_t)&__image_size, #endif + .rollback_version = CONFIG_ROLLBACK_VERSION, .cookie2 = CROS_EC_IMAGE_DATA_COOKIE2, }; -- cgit v1.2.1