Use the TPM to back up some of the nvram fields

We use a few bytes of battery-backed nvram to save some flags across
reboots. However if the battery discharges completely, these flags are lost.
There aren't any security issues with that since they reset to safe values,
but some of the flags are used to configure how the system boots in
dev-mode.

If a dev-mode user has completely replaced ChromeOS with some other OS, then
she often needs to set the dev_boot_usb and/or dev_boot_legacy flags as well
in order to boot it using Ctrl-U or Ctrl-L. If the battery dies, then those
flags are cleared, and the only way to make the Chromebook boot again is by
going through recovery, which wipes the disk.

This change uses a new NV space in the TPM to back up some of the nvram
flags. These nvram fields will be backed up:

  block_devmode
  dev_boot_legacy
  dev_boot_signed_only
  dev_boot_usb
  fwupdate_tries
  loc_idx

Because writing to the TPM space is slow and limited to an unspecified but
finite number of cycles, we only back up the fields when specifically
requested by the new backup_nvram_request flag. This flag will be set by
crossystem whenever it is used to change any of the fields listed above. The
backup will be attempted at the NEXT boot (because the TPM is locked after
booting), and the backup_nvram_request flag will be cleared if the backup
was successfull.

Note that this CL is for Top of Trunk only. The firmware will create the
required TPM spaces on systems that have never been booted, but we don't yet
have a secure or reliable method to update existing systems.

FYI, on Link, determining that the TPM's backup NV space doesn't exist adds
about 6ms to the boot time. If it does exist, the backup_nvram_request flag
is cleared automatically so it won't check until it's set again.

BUG=chromium:362105
BRANCH=ToT (only!)
TEST=manual

Testing this is a long and involved process. Read on...

First, there are host-side tests for it. In the chroot:

  cd src/platform/ec
  make runtests

Second, to test on a completely NEW system that was first booted with a BIOS
that contains this CL, do this:

  Enter dev-mode
  Use crossystem to set values for the fields listed above
  Confirm that "backup_nvram_request" is set to 1
  Reboot
  Use crossystem to confirm that "backup_nvram_request" is now 0
  Remove the battery and the AC
  Reattach either battery or AC so it will boot again
  Use crossystem to confirm that the backed up fields are still good, while
    the others have been reset to default values
  Switch to normal mode
  Remove the battery and the AC
  Reattach either battery or AC so it will boot again
  Look at the bios info in chrome://system to see what crossystem says
  Confirm that the dev_boot_* flags are all 0, while the others are restored

Third, to set things up to test this on an existing system (I used Link),
you have update the BIOS, delete both the Kernel and Firmware NV spaces in
the TPM, then reboot so that the BIOS will create the Backup, Kernel, and
Firmware spaces. It will only do that if they're all missing.

  Open it up, disable write-protect, attach a servo, etc.
  Switch to dev-mode, log in.
  Run make_dev_firmware.sh

  Reboot in recovery mode, and insert a USB stick with a test image on it.

  NOTE: In order to fiddle with the TPM, we'll *always* have to boot in
  recovery mode, since that's the only time the TPM is left unlocked. That's
  NOT the same as pressing Ctrl-U at the scary boot screen. The rest of
  these steps assume you've booted in recovery mode and are running from the
  test image on the USB stick.

  Run

    make_dev_ssd.sh --remove_rootfs_verification --recovery_key

  Reboot (recovery mode)

  Run

    mv /etc/init/tcsd.conf /etc/init/tcsd.conf.disabled

  Reboot (recovery mode).

  Run "tpmc getvf". It should say

    deactivated 0
    disableForceClear 0
    physicalPresence 1
    physicalPresenceLock 0
    bGlobalLock 0

  Run "tpmc geto". It should say

    Owned: no

  Now you'll need to build the "tpm-nvtool" utility. In the chroot:

    cd src/third_party/tpm/nvtool
    make

  Copy that to the DUT, in /usr/local/bin.

  Now run

    tcsd
    tpm-nvtool --list | grep Index

  You may see a number of spaces, but you should at least see these:

     # NV Index 0x00001007
     # NV Index 0x00001008

  Run

    tpm_takeownership

  It will prompt you for two passwords (and confirm each one). Respond with
  something you can remember like "google".

  Run

    tpm-nvtool  --release --index 0x1007 --owner_password "google"
    tpm-nvtool  --release --index 0x1008 --owner_password "google"

  Verify that it worked with

    tpm-nvtool --list | grep Index

  Power off.

  Using servo, flash the new BIOS that has this CL in it.

  Power on, normally this time (not recovery mode). If all goes well, it
  should create the correct NV spaces and boot into the SSD. Copy tpm-nvtool
  into this image too, and run

    tpm-nvtool --list | grep Index

  You should now see at least these spaces:

     # NV Index 0x00001007
     # NV Index 0x00001008
     # NV Index 0x00001009

  Now you're ready to test the backup/recover feature.

Change-Id: I00031fa0774720147327e2ae0f37e26b34b86341
Signed-off-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/202138
Reviewed-by: Luigi Semenzato <semenzato@chromium.org>

12 files changed, 511 insertions, 13 deletions

diff --git a/firmware/include/vboot_nvstorage.h b/firmware/include/vboot_nvstorage.h
index e6b014aa..534fb7e4 100644
--- a/firmware/include/vboot_nvstorage.h
+++ b/firmware/include/vboot_nvstorage.h
@@ -83,6 +83,8 @@ typedef enum VbNvParam {
 	VBNV_CLEAR_TPM_OWNER_DONE,
 	/* More details on recovery reason */
 	VBNV_RECOVERY_SUBCODE,
+	/* Request that NVRAM be backed up at next boot if possible. */
+	VBNV_BACKUP_NVRAM_REQUEST,
 } VbNvParam;
 
 /* Recovery reason codes for VBNV_RECOVERY_REQUEST */
@@ -260,4 +262,26 @@ int VbNvGet(VbNvContext *context, VbNvParam param, uint32_t *dest);
  */
 int VbNvSet(VbNvContext *context, VbNvParam param, uint32_t value);
 
+/**
+ * Attempt to restore some fields of a lost VbNvContext from a backup area.
+ * The rest of the fields are unchanged, so they'd need to be set to their
+ * appropriate defaults by calling VbNvSetup() first (which is usually how we
+ * know the fields have been lost).
+ *
+ * Returns 0 if success, non-zero if error.
+ *
+ * This may only be called between VbNvSetup() and VbNvTeardown().
+ */
+int RestoreNvFromBackup(VbNvContext *vnc);
+
+/**
+ * Attempt to save some fields of the VbNvContext to a backup area.
+ *
+ * Returns 0 if success, non-zero if error. If it succeeds, it will clear the
+ * VBNV_BACKUP_NVRAM_REQUEST flag in the VbNvContext.
+ *
+ * This may only be called when the backup area is writable.
+ */
+int SaveNvToBackup(VbNvContext *vnc);
+
 #endif  /* VBOOT_REFERENCE_NVSTORAGE_H_ */
diff --git a/firmware/lib/include/rollback_index.h b/firmware/lib/include/rollback_index.h
index 7c410eec..dd0de32a 100644
--- a/firmware/lib/include/rollback_index.h
+++ b/firmware/lib/include/rollback_index.h
@@ -15,6 +15,10 @@
 /* TPM NVRAM location indices. */
 #define FIRMWARE_NV_INDEX               0x1007
 #define KERNEL_NV_INDEX                 0x1008
+/* This is just an opaque space for backup purposes */
+#define BACKUP_NV_INDEX                 0x1009
+#define BACKUP_NV_SIZE 16
+
 
 /* Structure definitions for TPM spaces */
 
@@ -66,6 +70,7 @@ typedef struct RollbackSpaceFirmware {
 	uint8_t crc8;
 } __attribute__((packed)) RollbackSpaceFirmware;
 
+
 /* All functions return TPM_SUCCESS (zero) if successful, non-zero if error */
 
 /*
@@ -115,6 +120,16 @@ uint32_t RollbackKernelRead(uint32_t *version);
 uint32_t RollbackKernelWrite(uint32_t version);
 
 /**
+ * Read backup data.
+ */
+uint32_t RollbackBackupRead(uint8_t *raw);
+
+/**
+ * Write backup data.
+ */
+uint32_t RollbackBackupWrite(uint8_t *raw);
+
+/**
  * Lock must be called.  Internally, it's ignored in recovery mode.
  */
 uint32_t RollbackKernelLock(int recovery_mode);
diff --git a/firmware/lib/include/vboot_common.h b/firmware/lib/include/vboot_common.h
index ca9abd0a..61c7431f 100644
--- a/firmware/lib/include/vboot_common.h
+++ b/firmware/lib/include/vboot_common.h
@@ -15,6 +15,13 @@
 #define ARRAY_SIZE(array) (sizeof(array)/sizeof(array[0]))
 #endif
 
+/* Test an important condition at compile time, not run time */
+#define _BA1_(cond, line) \
+	extern int __build_assertion_ ## line[1 - 2*!(cond)] \
+	__attribute__ ((unused))
+#define _BA0_(c, x) _BA1_(c, x)
+#define BUILD_ASSERT(cond) _BA0_(cond, __LINE__)
+
 /* Error Codes for all common functions. */
 enum {
 	VBOOT_SUCCESS = 0,
diff --git a/firmware/lib/mocked_rollback_index.c b/firmware/lib/mocked_rollback_index.c
index d2f2bea5..86f223b2 100644
--- a/firmware/lib/mocked_rollback_index.c
+++ b/firmware/lib/mocked_rollback_index.c
@@ -7,6 +7,7 @@
  */
 
 #include "sysincludes.h"
+#include "utility.h"
 
 #include "rollback_index.h"
 
@@ -67,3 +68,17 @@ uint32_t RollbackKernelWrite(uint32_t version) {
 uint32_t RollbackKernelLock(int recovery_mode) {
   return TPM_SUCCESS;
 }
+
+static uint8_t rollback_backup[BACKUP_NV_SIZE];
+
+uint32_t RollbackBackupRead(uint8_t *raw)
+{
+	Memcpy(raw, rollback_backup, BACKUP_NV_SIZE);
+	return TPM_SUCCESS;
+}
+
+uint32_t RollbackBackupWrite(uint8_t *raw)
+{
+	Memcpy(rollback_backup, raw, BACKUP_NV_SIZE);
+	return TPM_SUCCESS;
+}
diff --git a/firmware/lib/rollback_index.c b/firmware/lib/rollback_index.c
index e372d9b6..306e9032 100644
--- a/firmware/lib/rollback_index.c
+++ b/firmware/lib/rollback_index.c
@@ -308,15 +308,22 @@ uint32_t OneTimeInitializeTPM(RollbackSpaceFirmware *rsf,
 	Memcpy(rsf, &rsf_init, sizeof(RollbackSpaceFirmware));
 	Memcpy(rsk, &rsk_init, sizeof(RollbackSpaceKernel));
 
-	/* Defines and sets firmware and kernel spaces */
+	/* Define the backup space. No need to initialize it, though. */
+	RETURN_ON_FAILURE(SafeDefineSpace(
+			BACKUP_NV_INDEX, TPM_NV_PER_PPWRITE, BACKUP_NV_SIZE));
+
+	/* Define and initialize the kernel space */
 	RETURN_ON_FAILURE(SafeDefineSpace(KERNEL_NV_INDEX, TPM_NV_PER_PPWRITE,
 					  sizeof(RollbackSpaceKernel)));
 	RETURN_ON_FAILURE(WriteSpaceKernel(rsk));
+
+	/* Do the firmware space last, so we retry if we don't get this far. */
 	RETURN_ON_FAILURE(SafeDefineSpace(
 			FIRMWARE_NV_INDEX,
 			TPM_NV_PER_GLOBALLOCK | TPM_NV_PER_PPWRITE,
 			sizeof(RollbackSpaceFirmware)));
 	RETURN_ON_FAILURE(WriteSpaceFirmware(rsf));
+
 	return TPM_SUCCESS;
 }
 
@@ -531,6 +538,16 @@ uint32_t RollbackKernelWrite(uint32_t version)
 	return TPM_SUCCESS;
 }
 
+uint32_t RollbackBackupRead(uint8_t *raw)
+{
+	return TPM_SUCCESS;
+}
+
+uint32_t RollbackBackupWrite(uint8_t *raw)
+{
+	return TPM_SUCCESS;
+}
+
 uint32_t RollbackKernelLock(int recovery_mode)
 {
 	return TPM_SUCCESS;
@@ -625,6 +642,29 @@ uint32_t RollbackKernelWrite(uint32_t version)
 	return WriteSpaceKernel(&rsk);
 }
 
+/*
+ * We don't really care whether the TPM owner has been messing with this or
+ * not. We lock it along with the Kernel space just to avoid problems, but it's
+ * only useful in dev-mode and only when the battery has been drained
+ * completely. There aren't any security issues. It's just in the TPM because
+ * we don't have any other place to keep it.
+ */
+uint32_t RollbackBackupRead(uint8_t *raw)
+{
+	uint32_t r;
+	r = TlclRead(BACKUP_NV_INDEX, raw, BACKUP_NV_SIZE);
+	VBDEBUG(("TPM: %s returning 0x%x\n", __func__, r));
+	return r;
+}
+
+uint32_t RollbackBackupWrite(uint8_t *raw)
+{
+	uint32_t r;
+	r = TlclWrite(BACKUP_NV_INDEX, raw, BACKUP_NV_SIZE);
+	VBDEBUG(("TPM: %s returning 0x%x\n", __func__, r));
+	return r;
+}
+
 uint32_t RollbackKernelLock(int recovery_mode)
 {
 	if (recovery_mode)
diff --git a/firmware/lib/vboot_api_init.c b/firmware/lib/vboot_api_init.c
index 58bc215f..b83214f2 100644
--- a/firmware/lib/vboot_api_init.c
+++ b/firmware/lib/vboot_api_init.c
@@ -36,6 +36,9 @@ VbError_t VbInit(VbCommonParams *cparams, VbInitParams *iparams)
 	uint32_t disable_dev_request = 0;
 	uint32_t clear_tpm_owner_request = 0;
 	int is_dev = 0;
+	uint32_t backup_requested = 0;
+	uint32_t backup_for_safety = 0;
+	int lost_nvram;
 
 	/* Initialize output flags */
 	iparams->out_flags = 0;
@@ -45,11 +48,12 @@ VbError_t VbInit(VbCommonParams *cparams, VbInitParams *iparams)
 		return retval;
 
 	VBDEBUG(("VbInit() input flags 0x%x gbb flags 0x%x\n", iparams->flags,
-		gbb.flags));
+		 gbb.flags));
 
 	/* Set up NV storage */
 	VbExNvStorageRead(vnc.raw);
 	VbNvSetup(&vnc);
+	lost_nvram = vnc.regenerate_crc;
 
 	/* Initialize shared data structure */
 	if (0 != VbSharedDataInit(shared, cparams->shared_data_size)) {
@@ -184,7 +188,7 @@ VbError_t VbInit(VbCommonParams *cparams, VbInitParams *iparams)
 		 * dev-switch will be disabled by default)
 		 */
 		VBDEBUG(("TPM: Call RollbackFirmwareSetup(r%d, d%d)\n",
-			recovery, is_hw_dev));
+			 recovery, is_hw_dev));
 		tpm_status = RollbackFirmwareSetup(is_hw_dev,
 						   disable_dev_request,
 						   clear_tpm_owner_request,
@@ -248,6 +252,17 @@ VbError_t VbInit(VbCommonParams *cparams, VbInitParams *iparams)
 		}
 	}
 
+	/*
+	 * If the nvram state was lost, try to restore the bits we care about
+	 * from the backup in the TPM. It's okay if we can't, though.
+	 * Note: None of the bits that we back up should have been referenced
+	 * before this point. Otherwise, they'll just be overwritten here.
+	 * All the other bits will be unchanged from whatever has happened to
+	 * them since VbNvSetup() reinitialized the VbNvContext.
+	 */
+	if (lost_nvram)
+		RestoreNvFromBackup(&vnc);
+
 	/* Allow BIOS to load arbitrary option ROMs? */
 	if (gbb.flags & GBB_FLAG_LOAD_OPTION_ROMS)
 		iparams->out_flags |= VB_INIT_OUT_ENABLE_OPROM;
@@ -295,6 +310,14 @@ VbError_t VbInit(VbCommonParams *cparams, VbInitParams *iparams)
 		VbNvSet(&vnc, VBNV_DEV_BOOT_USB, 0);
 		VbNvSet(&vnc, VBNV_DEV_BOOT_LEGACY, 0);
 		VbNvSet(&vnc, VBNV_DEV_BOOT_SIGNED_ONLY, 0);
+		/*
+		 * Back up any changes now, so these values can't be forgotten
+		 * by draining the battery. We really only care about these
+		 * three fields, but it's uncommon for any others to change so
+		 * this is an easier test than checking each one.
+		 */
+		if (vnc.regenerate_crc)
+			backup_for_safety = 1;
 
 		/*
 		 * If we don't need the VGA option ROM but got it anyway, stop
@@ -309,7 +332,15 @@ VbError_t VbInit(VbCommonParams *cparams, VbInitParams *iparams)
 		}
 	}
 
- VbInit_exit:
+VbInit_exit:
+	/*
+	 * If we successfully backup the NV storage, it will clear the
+	 * VBNV_BACKUP_NVRAM_REQUEST field, so we want to do it before
+	 * calling VbNvTeardown(). It's okay if we can't backup, though.
+	 */
+	VbNvGet(&vnc, VBNV_BACKUP_NVRAM_REQUEST, &backup_requested);
+	if (backup_requested || backup_for_safety)
+		SaveNvToBackup(&vnc);
 
 	/* Tear down NV storage */
 	VbNvTeardown(&vnc);
diff --git a/firmware/lib/vboot_display.c b/firmware/lib/vboot_display.c
index 6e0c93ac..c66af8df 100644
--- a/firmware/lib/vboot_display.c
+++ b/firmware/lib/vboot_display.c
@@ -211,6 +211,7 @@ VbError_t VbDisplayScreenFromGBB(VbCommonParams *cparams, uint32_t screen,
 	if (localization >= hdr.number_of_localizations) {
 		localization = 0;
 		VbNvSet(vncptr, VBNV_LOCALIZATION_INDEX, localization);
+		VbNvSet(vncptr, VBNV_BACKUP_NVRAM_REQUEST, 1);
 	}
 
 	/* Display all bitmaps for the image */
@@ -641,6 +642,7 @@ VbError_t VbCheckDisplayKey(VbCommonParams *cparams, uint32_t key,
 		VBDEBUG(("VbCheckDisplayKey() - change localization to %d\n",
 			 (int)loc));
 		VbNvSet(vncptr, VBNV_LOCALIZATION_INDEX, loc);
+		VbNvSet(vncptr, VBNV_BACKUP_NVRAM_REQUEST, 1);
 
 #ifdef SAVE_LOCALE_IMMEDIATELY
 		VbNvTeardown(vncptr);  /* really only computes checksum */
diff --git a/firmware/lib/vboot_nvstorage.c b/firmware/lib/vboot_nvstorage.c
index 9b2eca1b..258e5aff 100644
--- a/firmware/lib/vboot_nvstorage.c
+++ b/firmware/lib/vboot_nvstorage.c
@@ -10,6 +10,7 @@
 
 #include "crc8.h"
 #include "utility.h"
+#include "rollback_index.h"
 #include "vboot_common.h"
 #include "vboot_nvstorage.h"
 
@@ -27,6 +28,7 @@
 #define BOOT_DEBUG_RESET_MODE           0x80
 #define BOOT_DISABLE_DEV_REQUEST        0x40
 #define BOOT_OPROM_NEEDED               0x20
+#define BOOT_BACKUP_NVRAM               0x10
 #define BOOT_TRY_B_COUNT_MASK           0x0F
 
 #define RECOVERY_OFFSET              2
@@ -153,6 +155,10 @@ int VbNvGet(VbNvContext *context, VbNvParam param, uint32_t *dest)
 		*dest = (raw[TPM_FLAGS_OFFSET] & TPM_CLEAR_OWNER_DONE ? 1 : 0);
 		return 0;
 
+	case VBNV_BACKUP_NVRAM_REQUEST:
+		*dest = (raw[BOOT_OFFSET] & BOOT_BACKUP_NVRAM ? 1 : 0);
+		return 0;
+
 	default:
 		return 1;
 	}
@@ -276,6 +282,14 @@ int VbNvSet(VbNvContext *context, VbNvParam param, uint32_t value)
 			raw[TPM_FLAGS_OFFSET] &= ~TPM_CLEAR_OWNER_DONE;
 		break;
 
+	case VBNV_BACKUP_NVRAM_REQUEST:
+		if (value)
+			raw[BOOT_OFFSET] |= BOOT_BACKUP_NVRAM;
+		else
+			raw[BOOT_OFFSET] &= ~BOOT_BACKUP_NVRAM;
+		break;
+
+
 	default:
 		return 1;
 	}
@@ -284,3 +298,81 @@ int VbNvSet(VbNvContext *context, VbNvParam param, uint32_t value)
 	context->regenerate_crc = 1;
 	return 0;
 }
+
+/* These are the fields of the nvram that we want to back up. */
+static const VbNvParam backup_params[] = {
+	VBNV_KERNEL_FIELD,
+	VBNV_LOCALIZATION_INDEX,
+	VBNV_DEV_BOOT_USB,
+	VBNV_DEV_BOOT_LEGACY,
+	VBNV_DEV_BOOT_SIGNED_ONLY,
+};
+
+/* We can't back things up if there isn't enough storage. */
+BUILD_ASSERT(VBNV_BLOCK_SIZE <= BACKUP_NV_SIZE);
+
+int RestoreNvFromBackup(VbNvContext *vnc)
+{
+	VbNvContext bvnc;
+	uint32_t value;
+	int i;
+
+	VBDEBUG(("TPM: %s()\n", __func__));
+
+	if (TPM_SUCCESS != RollbackBackupRead(bvnc.raw))
+		return 1;
+
+	VbNvSetup(&bvnc);
+	if (bvnc.regenerate_crc) {
+		VBDEBUG(("TPM: Oops, backup is no good.\n"));
+		return 1;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(backup_params); i++) {
+		VbNvGet(&bvnc, backup_params[i], &value);
+		VbNvSet(vnc, backup_params[i], value);
+	}
+
+	/* VbNvTeardown(&bvnc); is not needed. We're done with it. */
+	return 0;
+}
+
+int SaveNvToBackup(VbNvContext *vnc)
+{
+	VbNvContext bvnc;
+	uint32_t value;
+	int i;
+
+	VBDEBUG(("TPM: %s()\n", __func__));
+
+	/* Read it first. No point in writing the same data. */
+	if (TPM_SUCCESS != RollbackBackupRead(bvnc.raw))
+		return 1;
+
+	VbNvSetup(&bvnc);
+	VBDEBUG(("TPM: existing backup is %s\n",
+		 bvnc.regenerate_crc ? "bad" : "good"));
+
+	for (i = 0; i < ARRAY_SIZE(backup_params); i++) {
+		VbNvGet(vnc, backup_params[i], &value);
+		VbNvSet(&bvnc, backup_params[i], value);
+	}
+
+	VbNvTeardown(&bvnc);
+
+	if (!bvnc.raw_changed) {
+		VBDEBUG(("TPM: Nothing's changed, not writing backup\n"));
+		/* Clear the request flag, since we're happy. */
+		VbNvSet(vnc, VBNV_BACKUP_NVRAM_REQUEST, 0);
+		return 0;
+	}
+
+	if (TPM_SUCCESS == RollbackBackupWrite(bvnc.raw)) {
+		/* Clear the request flag if we wrote successfully too */
+		VbNvSet(vnc, VBNV_BACKUP_NVRAM_REQUEST, 0);
+		return 0;
+	}
+
+	VBDEBUG(("TPM: Sorry, couldn't write backup.\n"));
+	return 1;
+}
diff --git a/host/lib/crossystem.c b/host/lib/crossystem.c
index ba614ccb..5e08c391 100644
--- a/host/lib/crossystem.c
+++ b/host/lib/crossystem.c
@@ -133,6 +133,19 @@ VbSetNvCleanup:
   return retval;
 }
 
+/*
+ * Set a param value, and try to flag it for persistent backup.
+ * It's okay if backup isn't supported. It's best-effort only.
+ */
+static int VbSetNvStorage_WithBackup(VbNvParam param, int value)
+{
+  int retval;
+  retval = VbSetNvStorage(param, value);
+  if (!retval)
+    VbSetNvStorage(VBNV_BACKUP_NVRAM_REQUEST, 1);
+  return retval;
+}
+
 /* Find what build/debug status is specified on the kernel command
  * line, if any. */
 static VbBuildOption VbScanBuildOption(void) {
@@ -458,6 +471,8 @@ int VbGetSystemPropertyInt(const char* name) {
     }
   } else if (!strcasecmp(name,"loc_idx")) {
     value = VbGetNvStorage(VBNV_LOCALIZATION_INDEX);
+  } else if (!strcasecmp(name,"backup_nvram_request")) {
+    value = VbGetNvStorage(VBNV_BACKUP_NVRAM_REQUEST);
   } else if (!strcasecmp(name,"dev_boot_usb")) {
     value = VbGetNvStorage(VBNV_DEV_BOOT_USB);
   } else if (!strcasecmp(name,"dev_boot_legacy")) {
@@ -558,13 +573,18 @@ int VbSetSystemPropertyInt(const char* name, int value) {
     return VbSetNvStorage(VBNV_CLEAR_TPM_OWNER_DONE, 0);
   } else if (!strcasecmp(name,"fwb_tries")) {
     return VbSetNvStorage(VBNV_TRY_B_COUNT, value);
+  } else if (!strcasecmp(name,"oprom_needed")) {
+    return VbSetNvStorage(VBNV_OPROM_NEEDED, value);
+  } else if (!strcasecmp(name,"backup_nvram_request")) {
+      /* Best-effort only, since it requires firmware and TPM support. */
+    return VbSetNvStorage(VBNV_BACKUP_NVRAM_REQUEST, value);
   } else if (!strcasecmp(name,"fwupdate_tries")) {
     int kern_nv = VbGetNvStorage(VBNV_KERNEL_FIELD);
     if (kern_nv == -1)
       return -1;
     kern_nv &= ~KERN_NV_FWUPDATE_TRIES_MASK;
     kern_nv |= (value & KERN_NV_FWUPDATE_TRIES_MASK);
-    return VbSetNvStorage(VBNV_KERNEL_FIELD, kern_nv);
+    return VbSetNvStorage_WithBackup(VBNV_KERNEL_FIELD, kern_nv);
   } else if (!strcasecmp(name,"block_devmode")) {
     int kern_nv = VbGetNvStorage(VBNV_KERNEL_FIELD);
     if (kern_nv == -1)
@@ -572,17 +592,15 @@ int VbSetSystemPropertyInt(const char* name, int value) {
     kern_nv &= ~KERN_NV_BLOCK_DEVMODE_FLAG;
     if (value)
 	kern_nv |= KERN_NV_BLOCK_DEVMODE_FLAG;
-    return VbSetNvStorage(VBNV_KERNEL_FIELD, kern_nv);
+    return VbSetNvStorage_WithBackup(VBNV_KERNEL_FIELD, kern_nv);
   } else if (!strcasecmp(name,"loc_idx")) {
-    return VbSetNvStorage(VBNV_LOCALIZATION_INDEX, value);
+    return VbSetNvStorage_WithBackup(VBNV_LOCALIZATION_INDEX, value);
   } else if (!strcasecmp(name,"dev_boot_usb")) {
-    return VbSetNvStorage(VBNV_DEV_BOOT_USB, value);
+    return VbSetNvStorage_WithBackup(VBNV_DEV_BOOT_USB, value);
   } else if (!strcasecmp(name,"dev_boot_legacy")) {
-    return VbSetNvStorage(VBNV_DEV_BOOT_LEGACY, value);
+    return VbSetNvStorage_WithBackup(VBNV_DEV_BOOT_LEGACY, value);
   } else if (!strcasecmp(name,"dev_boot_signed_only")) {
-    return VbSetNvStorage(VBNV_DEV_BOOT_SIGNED_ONLY, value);
-  } else if (!strcasecmp(name,"oprom_needed")) {
-    return VbSetNvStorage(VBNV_OPROM_NEEDED, value);
+    return VbSetNvStorage_WithBackup(VBNV_DEV_BOOT_SIGNED_ONLY, value);
   }
 
   return -1;
diff --git a/tests/rollback_index2_tests.c b/tests/rollback_index2_tests.c
index 6d28a9c9..853bfc86 100644
--- a/tests/rollback_index2_tests.c
+++ b/tests/rollback_index2_tests.c
@@ -520,6 +520,8 @@ static void OneTimeInitTest(void)
 		    "TlclForceClear()\n"
 		    "TlclSetEnable()\n"
 		    "TlclSetDeactivated(0)\n"
+		    /* backup space */
+		    "TlclDefineSpace(0x1009, 0x1, 16)\n"
 		    /* kernel space */
 		    "TlclDefineSpace(0x1008, 0x1, 13)\n"
 		    "TlclWrite(0x1008, 13)\n"
@@ -549,6 +551,8 @@ static void OneTimeInitTest(void)
 		    "TlclForceClear()\n"
 		    "TlclSetEnable()\n"
 		    "TlclSetDeactivated(0)\n"
+		    /* backup space */
+		    "TlclDefineSpace(0x1009, 0x1, 16)\n"
 		    /* kernel space */
 		    "TlclDefineSpace(0x1008, 0x1, 13)\n"
 		    "TlclWrite(0x1008, 13)\n"
@@ -570,6 +574,8 @@ static void OneTimeInitTest(void)
 		    "TlclForceClear()\n"
 		    "TlclSetEnable()\n"
 		    "TlclSetDeactivated(0)\n"
+		    /* backup space */
+		    "TlclDefineSpace(0x1009, 0x1, 16)\n"
 		    /* kernel space */
 		    "TlclDefineSpace(0x1008, 0x1, 13)\n"
 		    "TlclWrite(0x1008, 13)\n"
@@ -664,6 +670,8 @@ static void SetupTpmTest(void)
 		    "TlclForceClear()\n"
 		    "TlclSetEnable()\n"
 		    "TlclSetDeactivated(0)\n"
+		    /* backup space */
+		    "TlclDefineSpace(0x1009, 0x1, 16)\n"
 		    "TlclDefineSpace(0x1008, 0x1, 13)\n"
 		    "TlclWrite(0x1008, 13)\n"
 		    "TlclRead(0x1008, 13)\n"
diff --git a/tests/vboot_api_init_tests.c b/tests/vboot_api_init_tests.c
index 9aa34b41..96ab9d33 100644
--- a/tests/vboot_api_init_tests.c
+++ b/tests/vboot_api_init_tests.c
@@ -32,6 +32,9 @@ static uint32_t mock_tpm_version;
 static uint32_t mock_rfs_retval;
 static int rfs_clear_tpm_request;
 static int rfs_disable_dev_request;
+static uint8_t backup_space[BACKUP_NV_SIZE];
+static int backup_write_called;
+static int backup_read_called;
 
 /* Reset mock data (for use before each test) */
 static void ResetMocks(void)
@@ -53,6 +56,10 @@ static void ResetMocks(void)
 	VbNvSetup(&vnc);
 	VbNvTeardown(&vnc);                   /* So CRC gets generated */
 
+	Memset(backup_space, 0, sizeof(backup_space));
+	backup_write_called = 0;
+	backup_read_called = 0;
+
 	Memset(&shared_data, 0, sizeof(shared_data));
 	VbSharedDataInit(shared, sizeof(shared_data));
 
@@ -79,11 +86,25 @@ VbError_t VbExNvStorageRead(uint8_t *buf)
 
 VbError_t VbExNvStorageWrite(const uint8_t *buf)
 {
-	nv_write_called = 1;
+	nv_write_called++;
 	Memcpy(vnc.raw, buf, sizeof(vnc.raw));
 	return VBERROR_SUCCESS;
 }
 
+uint32_t RollbackBackupRead(uint8_t *raw)
+{
+	backup_read_called++;
+	Memcpy(raw, backup_space, sizeof(backup_space));
+	return TPM_SUCCESS;
+}
+
+uint32_t RollbackBackupWrite(uint8_t *raw)
+{
+	backup_write_called++;
+	Memcpy(backup_space, raw, sizeof(backup_space));
+	return TPM_SUCCESS;
+}
+
 uint64_t VbExGetTimer(void)
 {
 	/*
@@ -514,10 +535,233 @@ static void VbInitTestTPM(void)
 	TEST_EQ(rfs_clear_tpm_request, 1, "rfs tpm clear request");
 }
 
+static void VbInitTestBackup(void)
+{
+	VbNvContext tmp_vnc;
+	uint32_t u, nv_w, bu_r;
+
+	ResetMocks();
+	/* Normal mode call */
+	TestVbInit(0, 0, "normal mode, no backup");
+	TEST_EQ(shared->flags, 0, "  shared flags");
+	TEST_EQ(iparams.out_flags, 0, "  out flags");
+	TEST_EQ(nv_write_called, 0,
+		"  NV write not called since nothing changed");
+
+	ResetMocks();
+	/* Now set some params that should be backed up. */
+	VbNvSet(&vnc, VBNV_KERNEL_FIELD, 0xaabbccdd);
+	VbNvSet(&vnc, VBNV_LOCALIZATION_INDEX, 0xa5);
+	VbNvSet(&vnc, VBNV_DEV_BOOT_USB, 1);
+	VbNvSet(&vnc, VBNV_DEV_BOOT_LEGACY, 1);
+	VbNvSet(&vnc, VBNV_DEV_BOOT_SIGNED_ONLY, 1);
+	/* and some that don't */
+	VbNvSet(&vnc, VBNV_OPROM_NEEDED, 1);
+	VbNvSet(&vnc, VBNV_TRY_B_COUNT, 3);
+	/* Make sure they're clean */
+	VbNvTeardown(&vnc);
+	/* Normal mode call */
+	TestVbInit(0, 0, "normal mode, some backup");
+	TEST_EQ(shared->flags, 0, "  shared flags");
+	TEST_EQ(iparams.out_flags, 0, "  out flags");
+	TEST_EQ(nv_write_called, 1,
+		"  Write NV because things have changed");
+	/* Some fields should be unchanged */
+	VbNvGet(&vnc, VBNV_KERNEL_FIELD, &u);
+	TEST_EQ(u, 0xaabbccdd, "  NV kernel field");
+	VbNvGet(&vnc, VBNV_LOCALIZATION_INDEX, &u);
+	TEST_EQ(u, 0xa5, "  NV localization index");
+	VbNvGet(&vnc, VBNV_OPROM_NEEDED, &u);
+	TEST_EQ(u, 1, "  NV oprom_needed");
+	VbNvGet(&vnc, VBNV_TRY_B_COUNT, &u);
+	TEST_EQ(u, 3, "  NV try_b_count");
+	/* But normal mode should have cleared the DEV_BOOT flags */
+	VbNvGet(&vnc, VBNV_DEV_BOOT_USB, &u);
+	TEST_EQ(u, 0, "  NV dev_boot_usb");
+	VbNvGet(&vnc, VBNV_DEV_BOOT_LEGACY, &u);
+	TEST_EQ(u, 0, "  NV dev_boot_legacy");
+	VbNvGet(&vnc, VBNV_DEV_BOOT_SIGNED_ONLY, &u);
+	TEST_EQ(u, 0, "  NV dev_boot_signed_only");
+	/* So we should have written the backup */
+	TEST_EQ(backup_write_called, 1, "  Backup written once");
+	/* And the backup should reflect the persisent flags. */
+	Memset(&tmp_vnc, 0, sizeof(tmp_vnc));
+	TEST_EQ(0, RestoreNvFromBackup(&tmp_vnc), "read from backup");
+	VbNvGet(&tmp_vnc, VBNV_KERNEL_FIELD, &u);
+	TEST_EQ(u, 0xaabbccdd, "  BU kernel field");
+	VbNvGet(&tmp_vnc, VBNV_LOCALIZATION_INDEX, &u);
+	TEST_EQ(u, 0xa5, "  BU localization index");
+	VbNvGet(&tmp_vnc, VBNV_DEV_BOOT_USB, &u);
+	TEST_EQ(u, 0, "  BU dev_boot_usb");
+	VbNvGet(&tmp_vnc, VBNV_DEV_BOOT_LEGACY, &u);
+	TEST_EQ(u, 0, "  BU dev_boot_legacy");
+	VbNvGet(&tmp_vnc, VBNV_DEV_BOOT_SIGNED_ONLY, &u);
+	TEST_EQ(u, 0, "  BU dev_boot_signed_only");
+	/* but not the others */
+	VbNvGet(&tmp_vnc, VBNV_OPROM_NEEDED, &u);
+	TEST_EQ(u, 0, "  BU oprom_needed");
+	VbNvGet(&tmp_vnc, VBNV_TRY_B_COUNT, &u);
+	TEST_EQ(u, 0, "  BU try_b_count");
+
+	/*
+	 * If we change one of the non-backed-up NVRAM params and try
+	 * again, we shouldn't need to backup again.
+	 */
+	VbNvSet(&vnc, VBNV_OPROM_NEEDED, 0);
+	VbNvSet(&vnc, VBNV_TRY_B_COUNT, 2);
+	/* Make sure they're clean */
+	VbNvTeardown(&vnc);
+	/* Normal mode call */
+	TestVbInit(0, 0, "normal mode, expect no backup");
+	TEST_EQ(shared->flags, 0, "  shared flags");
+	TEST_EQ(iparams.out_flags, 0, "  out flags");
+	TEST_EQ(backup_write_called, 1, "  Backup still only written once");
+
+	/* Now switch to dev-mode. */
+	iparams.flags = VB_INIT_FLAG_DEV_SWITCH_ON;
+	TestVbInit(0, 0, "Dev mode on");
+	TEST_EQ(shared->recovery_reason, 0, "  recovery reason");
+	TEST_EQ(iparams.out_flags,
+		VB_INIT_OUT_CLEAR_RAM |
+		VB_INIT_OUT_ENABLE_DISPLAY |
+		VB_INIT_OUT_ENABLE_USB_STORAGE |
+		VB_INIT_OUT_ENABLE_DEVELOPER |
+		VB_INIT_OUT_ENABLE_ALTERNATE_OS, "  out flags");
+	TEST_EQ(shared->flags, VBSD_BOOT_DEV_SWITCH_ON, "  shared flags");
+	TEST_EQ(backup_write_called, 1, "  Still only one backup");
+
+	/* Now change some params that should be backed up. */
+	VbNvSet(&vnc, VBNV_KERNEL_FIELD, 0xdeadbeef);
+	VbNvSet(&vnc, VBNV_LOCALIZATION_INDEX, 0x5a);
+	VbNvSet(&vnc, VBNV_DEV_BOOT_USB, 1);
+	VbNvSet(&vnc, VBNV_DEV_BOOT_LEGACY, 1);
+	VbNvSet(&vnc, VBNV_DEV_BOOT_SIGNED_ONLY, 1);
+	/* and some that don't */
+	VbNvSet(&vnc, VBNV_OPROM_NEEDED, 1);
+	VbNvSet(&vnc, VBNV_TRY_B_COUNT, 4);
+	/* Make sure they're clean */
+	VbNvTeardown(&vnc);
+	TestVbInit(0, 0, "Dev mode on");
+	TEST_EQ(shared->recovery_reason, 0, "  recovery reason");
+	TEST_EQ(iparams.out_flags,
+		VB_INIT_OUT_CLEAR_RAM |
+		VB_INIT_OUT_ENABLE_DISPLAY |
+		VB_INIT_OUT_ENABLE_USB_STORAGE |
+		VB_INIT_OUT_ENABLE_DEVELOPER, "  out flags");
+	TEST_EQ(shared->flags, VBSD_BOOT_DEV_SWITCH_ON, "  shared flags");
+	TEST_EQ(backup_write_called, 1, "  Once more, one backup");
+
+	/* But if we explictly request a backup, they'll get saved. */
+	VbNvSet(&vnc, VBNV_BACKUP_NVRAM_REQUEST, 1);
+	VbNvTeardown(&vnc);
+	TestVbInit(0, 0, "Dev mode on");
+	TEST_EQ(shared->recovery_reason, 0, "  recovery reason");
+	TEST_EQ(iparams.out_flags,
+		VB_INIT_OUT_CLEAR_RAM |
+		VB_INIT_OUT_ENABLE_DISPLAY |
+		VB_INIT_OUT_ENABLE_USB_STORAGE |
+		VB_INIT_OUT_ENABLE_DEVELOPER, "  out flags");
+	TEST_EQ(shared->flags, VBSD_BOOT_DEV_SWITCH_ON, "  shared flags");
+	TEST_EQ(backup_write_called, 2, "  Two backups now");
+	VbNvGet(&vnc, VBNV_BACKUP_NVRAM_REQUEST, &u);
+	TEST_EQ(u, 0, "  backup_request cleared");
+	/* Quick check that the non-backed-up stuff is still valid */
+	VbNvGet(&vnc, VBNV_OPROM_NEEDED, &u);
+	TEST_EQ(u, 1, "  NV oprom_needed");
+	VbNvGet(&vnc, VBNV_TRY_B_COUNT, &u);
+	TEST_EQ(u, 4, "  NV try_b_count");
+	/* But only the stuff we care about was backed up */
+	Memset(&tmp_vnc, 0, sizeof(tmp_vnc));
+	TEST_EQ(0, RestoreNvFromBackup(&tmp_vnc), "read from backup");
+	VbNvGet(&tmp_vnc, VBNV_KERNEL_FIELD, &u);
+	TEST_EQ(u, 0xdeadbeef, "  BU kernel field");
+	VbNvGet(&tmp_vnc, VBNV_LOCALIZATION_INDEX, &u);
+	TEST_EQ(u, 0x5a, "  BU localization index");
+	VbNvGet(&tmp_vnc, VBNV_DEV_BOOT_USB, &u);
+	TEST_EQ(u, 1, "  BU dev_boot_usb");
+	VbNvGet(&tmp_vnc, VBNV_DEV_BOOT_LEGACY, &u);
+	TEST_EQ(u, 1, "  BU dev_boot_legacy");
+	VbNvGet(&tmp_vnc, VBNV_DEV_BOOT_SIGNED_ONLY, &u);
+	TEST_EQ(u, 1, "  BU dev_boot_signed_only");
+	/* but not the others */
+	VbNvGet(&tmp_vnc, VBNV_OPROM_NEEDED, &u);
+	TEST_EQ(u, 0, "  BU oprom_needed");
+	VbNvGet(&tmp_vnc, VBNV_TRY_B_COUNT, &u);
+	TEST_EQ(u, 0, "  BU try_b_count");
+
+	/* If we lose the NV storage, the backup bits will be restored */
+	vnc.raw[0] = 0;
+	bu_r = backup_read_called;
+	nv_w = nv_write_called;
+	TestVbInit(0, 0, "Dev mode on");
+	TEST_EQ(shared->recovery_reason, 0, "  recovery reason");
+	TEST_EQ(iparams.out_flags,
+		VB_INIT_OUT_CLEAR_RAM |
+		VB_INIT_OUT_ENABLE_DISPLAY |
+		VB_INIT_OUT_ENABLE_USB_STORAGE |
+		VB_INIT_OUT_ENABLE_DEVELOPER, "  out flags");
+	TEST_EQ(shared->flags, VBSD_BOOT_DEV_SWITCH_ON, "  shared flags");
+	TEST_EQ(backup_write_called, 2, "  Still just two backups now");
+	TEST_EQ(backup_read_called, bu_r + 1, "  One more backup read");
+	TEST_EQ(nv_write_called, nv_w + 1, "  One more NV write");
+	/* The non-backed-up stuff is reset to defaults */
+	VbNvGet(&vnc, VBNV_OPROM_NEEDED, &u);
+	TEST_EQ(u, 0, "  NV oprom_needed");
+	VbNvGet(&vnc, VBNV_TRY_B_COUNT, &u);
+	TEST_EQ(u, 0, "  NV try_b_count");
+	/* And the backed up stuff is restored */
+	VbNvGet(&vnc, VBNV_KERNEL_FIELD, &u);
+	TEST_EQ(u, 0xdeadbeef, "  BU kernel field");
+	VbNvGet(&vnc, VBNV_LOCALIZATION_INDEX, &u);
+	TEST_EQ(u, 0x5a, "  BU localization index");
+	VbNvGet(&vnc, VBNV_DEV_BOOT_USB, &u);
+	TEST_EQ(u, 1, "  BU dev_boot_usb");
+	VbNvGet(&vnc, VBNV_DEV_BOOT_LEGACY, &u);
+	TEST_EQ(u, 1, "  BU dev_boot_legacy");
+	VbNvGet(&vnc, VBNV_DEV_BOOT_SIGNED_ONLY, &u);
+	TEST_EQ(u, 1, "  BU dev_boot_signed_only");
+
+	/*
+	 * But if we lose the NV storage and go back to normal mode at the same
+	 * time, then the DEV_BOOT_* flags will be cleared.
+	 */
+	vnc.raw[0] = 0;
+	bu_r = backup_read_called;
+	nv_w = nv_write_called;
+	iparams.flags = 0;
+	TestVbInit(0, 0, "Back to normal mode");
+	TEST_EQ(shared->recovery_reason, 0, "  recovery reason");
+	TEST_EQ(iparams.out_flags, 0, "  out flags");
+	TEST_EQ(shared->flags, 0, "  shared flags");
+	/* We read twice: once to restore, once for read-prior-to-write */
+	TEST_EQ(backup_read_called, bu_r + 2, "  Two more backup reads");
+	TEST_EQ(backup_write_called, 3, "  Backup write due clearing DEV_*");
+	TEST_EQ(nv_write_called, nv_w + 1, "  One more NV write");
+	/* The non-backed-up stuff is reset to defaults */
+	VbNvGet(&vnc, VBNV_OPROM_NEEDED, &u);
+	TEST_EQ(u, 0, "  NV oprom_needed");
+	VbNvGet(&vnc, VBNV_TRY_B_COUNT, &u);
+	TEST_EQ(u, 0, "  NV try_b_count");
+	/* And the backed up stuff is restored */
+	VbNvGet(&vnc, VBNV_KERNEL_FIELD, &u);
+	TEST_EQ(u, 0xdeadbeef, "  BU kernel field");
+	VbNvGet(&vnc, VBNV_LOCALIZATION_INDEX, &u);
+	TEST_EQ(u, 0x5a, "  BU localization index");
+	/* But not the DEV_BOOT_* flags */
+	VbNvGet(&vnc, VBNV_DEV_BOOT_USB, &u);
+	TEST_EQ(u, 0, "  BU dev_boot_usb");
+	VbNvGet(&vnc, VBNV_DEV_BOOT_LEGACY, &u);
+	TEST_EQ(u, 0, "  BU dev_boot_legacy");
+	VbNvGet(&vnc, VBNV_DEV_BOOT_SIGNED_ONLY, &u);
+	TEST_EQ(u, 0, "  BU dev_boot_signed_only");
+}
+
+
 int main(int argc, char *argv[])
 {
 	VbInitTest();
 	VbInitTestTPM();
+	VbInitTestBackup();
 
 	return gTestSuccess ? 0 : 255;
 }
diff --git a/utility/crossystem.c b/utility/crossystem.c
index 9a55d17e..5ffb5af1 100644
--- a/utility/crossystem.c
+++ b/utility/crossystem.c
@@ -32,6 +32,8 @@ typedef struct Param {
 /* List of parameters, terminated with a param with NULL name */
 const Param sys_param_list[] = {
   {"arch", IS_STRING, "Platform architecture"},
+  {"backup_nvram_request", CAN_WRITE,
+   "Backup the nvram somewhere at the next boot. Cleared on success."},
   {"block_devmode", CAN_WRITE, "Block all use of developer mode"},
   {"clear_tpm_owner_request", CAN_WRITE, "Clear TPM owner on next boot"},
   {"clear_tpm_owner_done", CAN_WRITE, "Clear TPM owner done"},