summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* signer: fix accessory_rwsig signingstabilize-10895.Bstabilize-10895.56.Brelease-R69-10895.BNick Sanders2018-07-201-3/+9
| | | | | | | | | | | | | | | | | Require that the container passed in is the one containing the specified key, and no other key. So if only one key is present it must be the specified key. BUG=chromium:863464 TEST=run locally BRANCH=None Change-Id: Ieeca5773f35b7bf92beae8a2192ed6e6fd9008e6 Reviewed-on: https://chromium-review.googlesource.com/1136910 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Tested-by: Nick Sanders <nsanders@chromium.org> Reviewed-by: Bob Moragues <moragues@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org>
* image_singing: Add '--nodefault_rw_root' for make_dev_ssd.sh.Hung-Te Lin2018-07-201-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | When the root is default RW mounted, we found that the system is more fragile due to suspend and resume tests. It is found that in early builds, many projects tend to need minor fixes in test image rootfs, for example kernel modules or files read by kernel. Currently the only way to update those files is to reflash whole images, but that's not very practical when the network in manufacturing line is pretty slow. It would be better if we can change a single file. As a result, we want to allow setting the default root mount option when running make_dev_ssd.sh. The new --nodefault_rw_root allows disabling rootfs verification but still mounting rootfs as RO, which makes better chances for system to be stable, and changes can still be made by an explicit 'mount -o rw,remount /'. BUG=None TEST=./make_dev_ssd.sh --remove_rootfs_verification --nodefault_rw_root Change-Id: Ie2675e25b77e638ba6c3be8e2a2a3887a95582fc Reviewed-on: https://chromium-review.googlesource.com/1137966 Commit-Ready: Hung-Te Lin <hungte@chromium.org> Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
* inherit-review-settings-ok/WATCHLISTS: punt old unused filesMike Frysinger2018-07-112-14/+0
| | | | | | | | | | | | BUG=None TEST=precq passes BRANCH=None Change-Id: Ie2062b74671e5f3724cb0d2141b31b53f02123ba Reviewed-on: https://chromium-review.googlesource.com/1132412 Commit-Ready: Mike Frysinger <vapier@chromium.org> Tested-by: Mike Frysinger <vapier@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
* vboot_aux_fw: Add new return code to handle busy casestabilize-10866.BJett Rink2018-07-031-0/+2
| | | | | | | | | | | | | | | | | | We do not want to upgrade the TCPC firmware if the TCPC is the only source of power. Use this new return code to communicate to depthcharge that we do not want upgrade at this time. BRANCH=none BUG=b:78334391 TEST=if PS8751 is the only source of power, then upgrade will gracefully skip. Change-Id: I062c79a2d01f779c30873d48ff4301aca071cca3 Signed-off-by: Jett Rink <jettrink@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1123105 Reviewed-by: Simon Glass <sjg@chromium.org> Reviewed-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Duncan Laurie <dlaurie@google.com>
* nocturne-fp: copypasta script to generate keypair for signing FWNick Sanders2018-07-021-0/+16
| | | | | | | | | | | | | | | All accessories leverage the key format of Hammer therefore this script calls Hammer's one to generate a key pair and renames them. BUG=b:110880196 TEST=Run this script in the chroot. BRANCH=None Change-Id: I955f28fbe2c1dab1b5f76672c34e6022660a77ed Reviewed-on: https://chromium-review.googlesource.com/1121632 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Tested-by: Nick Sanders <nsanders@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org>
* vboot_reference: fix the build for arm64stabilize-nocturne.10828.Bstabilize-nocturne.10819.Bstabilize-atlas.10819.BAdam Kallai2018-06-141-1/+1
| | | | | | | | | | | | | | | | | Add "arm64" support to Makefile to use crossystem_arch.c implementation from host/arm/lib directory, in order to avoid the code duplication. BUG=None TEST='emerge-arm64-generic vboot_reference' works correctly BRANCH=None Change-Id: I349f8b2055c9be6ebaeb6f322e3b22260465dd5a Reviewed-on: https://chromium-review.googlesource.com/1082195 Commit-Ready: Adam Kallai <kadam@inf.u-szeged.hu> Tested-by: Adam Kallai <kadam@inf.u-szeged.hu> Reviewed-by: Randall Spangler <rspangler@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org>
* keygeneration: make the certificates valid for 10 yearsfirmware-nami-10775.Bfirmware-nami-10775.130.Bfirmware-nami-10775.108.BEdward Hyunkoo Jee2018-06-061-3/+3
| | | | | | | | | | | | | | | | | | | UEFI firmware implementations are unlikely to validate the "days". However we'd better specify a reasonable value. We learned that setting the "days" argument to a large number can cause unexpected results due to overflow. GCE team has decided to set this value as 10 years. BUG=b:62189155 TEST=None BRANCH=none Change-Id: If0375251b41e9584708355a6fd32192aa5ad0c1a Reviewed-on: https://chromium-review.googlesource.com/1088165 Commit-Ready: Edward Jee <edjee@google.com> Tested-by: Edward Jee <edjee@google.com> Reviewed-by: Mike Frysinger <vapier@chromium.org>
* futility: Add --arch=arm64 option to vbutil_kernelAdam Kallai2018-06-011-1/+2
| | | | | | | | | | | | | | | | | | | | vbutil_kernel already supports 64bit arm architecture, but it just allows "aarch64" option. However other script, for example build_kernel_image uses ARCH environment variable, which for arm64-generic overlay is defined as "arm64". So vbutil_kernel will refuse the call. BUG=None TEST=run vbutil_kernel --arch=arm64 Check that the "Unknown architecture string: arm64" is gone BRANCH=None Change-Id: I94c547d6b6940ab8c622a6b8cff49b5f83c1fcad Reviewed-on: https://chromium-review.googlesource.com/1080529 Commit-Ready: Adam Kallai <kadam@inf.u-szeged.hu> Tested-by: Adam Kallai <kadam@inf.u-szeged.hu> Reviewed-by: Mike Frysinger <vapier@chromium.org>
* stop statically linking crossystemMike Frysinger2018-05-311-3/+2
| | | | | | | | | | | | | | | | | Now that initramfs, firmware updater, and auto-updater are all using dynamically linked programs, there's no need to produce a static build of crossystem anymore. BUG=chromium:765499 TEST=precq passes (includes vmtests w/AU) BRANCH=None Change-Id: I5aa123e662040ff5d9f2328c0f036b648fc629fb Reviewed-on: https://chromium-review.googlesource.com/667881 Commit-Ready: Mike Frysinger <vapier@chromium.org> Tested-by: Mike Frysinger <vapier@chromium.org> Reviewed-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Don Garrett <dgarrett@chromium.org>
* keygeneration: add --no-pk option for UEFI key generationstabilize-nocturne.10736.Bstabilize-atlas.10736.BEdward Hyunkoo Jee2018-05-292-16/+26
| | | | | | | | | | | | | | | In case PK has been generated in HSM, no need to generate them in software. BUG=b:62189155 TEST=See CL:*630434. BRANCH=none Change-Id: I2180b340e992b678e46920a1142d3b7101c8158f Reviewed-on: https://chromium-review.googlesource.com/1071242 Commit-Ready: Edward Jee <edjee@google.com> Tested-by: Edward Jee <edjee@google.com> Reviewed-by: Mike Frysinger <vapier@chromium.org>
* tpm_lite: stub: retry in case of TPM comm errorstabilize-10718.88.Bstabilize-10718.71.Bstabilize-10718.69.Bstabilize-10718.111.Brelease-R68-10718.BAndrey Pronin2018-05-241-7/+45
| | | | | | | | | | | | | | | | | | | | This CL retries reads and writes from/to TPM device if an error is returned by read()/write(), up to 3 total attempts. This is useful case of transient TPM communication errors that go away after a single retry. Without this CL, after such errors the encstateful key might be regenerated and encstateful data wiped. BRANCH=none BUG=chromium:702724 TEST=1) normal boot still works; 2) simulate a single error, verify that it retries. Change-Id: I259882209df0aad66cd083729f746ea45909922b Reviewed-on: https://chromium-review.googlesource.com/1067939 Commit-Ready: Andrey Pronin <apronin@chromium.org> Tested-by: Andrey Pronin <apronin@chromium.org> Reviewed-by: Andrey Pronin <apronin@chromium.org>
* crossystem: Add BINF3_LEGACY for systems boot in legacy mode.Hung-Te Lin2018-05-232-0/+3
| | | | | | | | | | | | | | | | | | | | | The BINF3 (VBT7) reflects the firmware type, and we need that to describe which type of firmware was booted. The 'legacy' did not have its own value definition, but without that we can't make sure if the system is running a non-chrome firmware or simply entered legacy boot path. CL:1054307 introduced a new value (0x4) for legacy type and we should handle it in crossystem mainfw_type command. BUG=b:79130310 TEST=emerge-eve coreboot depthcharge chromeos-bootimage; Boot in legacy mode and see crossystem reporting 'legacy' for mainfw_type. Change-Id: I4a1165e547e70c634d45054f56d1357ae5af2a83 Reviewed-on: https://chromium-review.googlesource.com/1068556 Commit-Ready: Hung-Te Lin <hungte@chromium.org> Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
* vboot_reference: Build host tools conditionally.Manoj Gupta2018-05-161-1/+6
| | | | | | | | | | | | | | | | | Some of the tools and utilities in vboot_reference do not build with sanitizers enabled. To avoid this, do not build them when NO_BUILD_TOOLS is defined. CQ-DEPEND=CL:1060156 BUG=chromium:841588 TEST=USE="fuzzer" emerge-amd64-generic vboot_reference does not build host tools TEST=emerge-falco vboot_reference builds all tools. Change-Id: If238c98d4058db20765731237153bc6969a06375 Reviewed-on: https://chromium-review.googlesource.com/1060154 Commit-Ready: Manoj Gupta <manojgupta@chromium.org> Tested-by: Manoj Gupta <manojgupta@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
* tpm_lite: Set O_CLOEXEC when opening TPM device.stabilize-10682.BMattias Nissler2018-05-141-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This sets O_CLOEXEC when opening the TPM device to make sure the file descriptor isn't shared across processes. The TPM character device exposes the raw communication channel to send/receive commands to/from the TPM. The TPM is not designed for concurrent access by multiple users and the kernel driver already returns EBUSY on open when a different process has already opened it. Consequently, it only makes sense to have the /dev/tpm0 file descriptor be closed automatically on exec(). None of the callers I'm aware of need to share the TPM file descriptor across processes, and mount-encrypted has some ad-hoc code to close the descriptor when it does fork+exec to spawn a helper. The existing code isn't consistent and comprehensive (mount-encrypted spawns other helpers where it forgets to close the file descriptor), so the plan is to set O_CLOEXEC and remove the ad-hoc code. BRANCH=None BUG=None TEST=Compiles, passes tests, image boots. Change-Id: Ia6e73fb12e8f2ed8fe99b4c53ea6eb8cda4a21f5 Reviewed-on: https://chromium-review.googlesource.com/1055569 Commit-Ready: Mattias Nissler <mnissler@chromium.org> Tested-by: Mattias Nissler <mnissler@chromium.org> Reviewed-by: Andrey Pronin <apronin@chromium.org>
* image_signing: Add sha1sum of the recovery key to VERSION.signer.Marco Chen2018-05-141-0/+5
| | | | | | | | | | | | | | | | | | | | firmware_keys field in the HWID database also contains hash of recovery key so need this information as well in order to deprecate firmware_keys field. BUG=chromium:763328 TEST=1) ~/trunk/src/platform/vboot_reference/scripts/image_signing/sign_official_build.sh recovery ./chromeos_10644.0.0_soraka_recovery_dev-channel_mp.bin ./src/platform/vboot_reference/tests/devkeys ./output.bin 2) verify output file - VERSION.signer. BRANCH=None Change-Id: If2be93723e95d46fc0546239695be27c3229275c Reviewed-on: https://chromium-review.googlesource.com/1053334 Commit-Ready: Marco Chen <marcochen@chromium.org> Tested-by: Marco Chen <marcochen@chromium.org> Reviewed-by: Wei-Han Chen <stimim@chromium.org> Reviewed-by: C Shapiro <shapiroc@google.com>
* make_dev_firmware.sh: correct typoNick Sanders2018-05-101-1/+1
| | | | | | | | | | | | | | | chromoes-tpm-recovery was misspelled, correct to chromeos-tpm-recovery BRANCH=None BUG=None TEST=None Change-Id: Ia3109348eed59f27b08d5261fbcc3d1d93067e89 Reviewed-on: https://chromium-review.googlesource.com/1043494 Commit-Ready: Nick Sanders <nsanders@chromium.org> Tested-by: Nick Sanders <nsanders@chromium.org> Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
* image_signing: Add sha1sum of a key without loem keyset to VERSION.signer.Marco Chen2018-05-091-0/+5
| | | | | | | | | | | | | | | | | | | | | | CL:866522 supported the case of loem and uni-build projects but not for the project with one key only. After this CL, `gooftool finalize` can refer to VERSION.signer in order to get correct firmware key hash from recovery image. As the result, firmware_keys field can be removed from HWID database. BUG=chromium:763328 TEST=1) ~/trunk/src/platform/vboot_reference/scripts/image_signing/sign_official_build.sh recovery ./chromeos_10644.0.0_soraka_recovery_dev-channel_mp.bin ./src/platform/vboot_reference/tests/devkeys ./output.bin 2) verify output file - VERSION.signer. BRANCH=None Change-Id: I376cd7038c0fe1d5cc71cb39cbabeb5e79994407 Reviewed-on: https://chromium-review.googlesource.com/1051429 Commit-Ready: Marco Chen <marcochen@chromium.org> Tested-by: Marco Chen <marcochen@chromium.org> Reviewed-by: Marco Chen <marcochen@chromium.org> Reviewed-by: C Shapiro <shapiroc@google.com>
* sign_official_build: switch kernel/firmware signing to loopdevsMike Frysinger2018-05-092-29/+62
| | | | | | | | | | | | | | | | | | | | | | | | | Newer versions of util-linux/mount don't like when you create overlapping loopback files. Since we always create a loopback of the entire image, this means every mount fails. We can change the few users in here over to using the existing loopback partitions rather than continuing to create their own from scratch. This makes the code a bit simpler. However, we currently duplicate some of the mount image helpers so that one version works off of a disk image while the other uses loopbacks. Cleaning this up requires a number of changes in other files which we'll want to do eventually, just not right now (to minimize risk). BUG=chromium:714598 TEST=image signing works on newer gLinux installs BRANCH=None Change-Id: I31b35636b3b271e97070d283f8cb74d3183d8ec8 Reviewed-on: https://chromium-review.googlesource.com/1034435 Commit-Ready: Mike Frysinger <vapier@chromium.org> Tested-by: Mike Frysinger <vapier@chromium.org> Reviewed-by: Jason Clinton <jclinton@chromium.org>
* sign_official_build.sh: dump more md5sum on bios.binstabilize-nocturne.10646.BYH Lin2018-05-021-0/+31
| | | | | | | | | | | | | | | | Dumping md5sum information along the way of signing bios.bin to shed some lights on the signing process in order to debug the first slot issue. BUG=b:77252439 TEST=None BRANCH=None Change-Id: I5083d6db2eee42c5cc9588606f95bbffba0c00ff Reviewed-on: https://chromium-review.googlesource.com/1036802 Commit-Ready: YH Lin <yueherngl@chromium.org> Tested-by: YH Lin <yueherngl@chromium.org> Reviewed-by: C Shapiro <shapiroc@google.com>
* cgpt: Remove unnecessary 512-byte sector check and minimum lba count checks.Sam Hurst2018-05-012-11/+48
| | | | | | | | | | | | | | | | This was an oversight from a previous CL:1007498 that removed the 512 block size restrictions. BUG=b:77540192 BRANCH=none TEST=manual make runtests passed. Change-Id: I75b3ffebcc25afdde3774bcbb4a9600215a04436 Reviewed-on: https://chromium-review.googlesource.com/1031193 Commit-Ready: Sam Hurst <shurst@google.com> Tested-by: Sam Hurst <shurst@google.com> Reviewed-by: Julius Werner <jwerner@chromium.org>
* gbb_flags_common.sh: Add GBB_FLAG_ENABLE_UDC to help textFurquan Shaikh2018-04-261-0/+1
| | | | | | | | | | | | | BUG=b:78577893 BRANCH=None TEST=None Change-Id: I1905f53aadb0ae882dc4cf9f4fd214b4ccdfc440 Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/1029429 Commit-Ready: Furquan Shaikh <furquan@chromium.org> Tested-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Duncan Laurie <dlaurie@google.com>
* image_signing: clean up UEFI signing/verifying codeEdward Hyunkoo Jee2018-04-255-51/+74
| | | | | | | | | | | | | | | | Follow up the code review comments on CL:995175, which was merged as 1493e938e45535f86b7132a83123c6319eacb217 ("image_signing: sign UEFI binaries") BUG=b:62189155 TEST=See CL:*613656 BRANCH=none Change-Id: Ic01bfbbfe39fbfb85c0f313ab62bbcd3e2fbb9a3 Reviewed-on: https://chromium-review.googlesource.com/1024919 Commit-Ready: Edward Jee <edjee@google.com> Tested-by: Edward Jee <edjee@google.com> Reviewed-by: Mike Frysinger <vapier@chromium.org>
* keygeneration: clean up for UEFI key generation codeEdward Hyunkoo Jee2018-04-256-46/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Follow up the code review comments on CL:995174, which was merged as 7dff0105d66fa597741604cf1652a72c7a8463ac ("keygeneration: add support for UEFI key generation") BUG=b:62189155 TEST=With CL:*613656, set up a local signer and tested key generation and signing. Also, manually ran the scripts like the following. $ export PATH=$(readlink -f ../../../cros-signing/signer/signingtools-bin):$PATH $ cd scripts/keygeneration && ./create_new_keys.sh --uefi --output ./key $ chmod -R u+w key/uefi $ ./uefi/increment_kek_key.sh key/uefi $ ./uefi/increment_kek_key.sh key/uefi $ ./uefi/increment_db_child_key.sh key/uefi $ ./uefi/increment_db_child_key.sh key/uefi $ ./uefi/increment_db_child_key.sh key/uefi $ ./uefi/increment_db_key.sh key/uefi $ ./uefi/increment_db_child_key.sh key/uefi $ ./uefi/increment_db_key.sh key/uefi $ ./uefi/increment_db_child_key.sh key/uefi $ ./uefi/increment_db_child_key.sh key/uefi $ openssl x509 -noout -subject -in key/uefi/db/db.children/db_child.pem BRANCH=none Change-Id: I6c0cd47914a0a77970cd074fe087bba33c16cffc Reviewed-on: https://chromium-review.googlesource.com/1024918 Commit-Ready: Edward Jee <edjee@google.com> Tested-by: Edward Jee <edjee@google.com> Reviewed-by: Mike Frysinger <vapier@chromium.org>
* keygeneration: drop board name from UEFI key generation scriptsEdward Hyunkoo Jee2018-04-257-48/+25
| | | | | | | | | | | | | | | | Follow up the code review comments on CL:995174, which was merged as 7dff0105d66fa597741604cf1652a72c7a8463ac ("keygeneration: add support for UEFI key generation") BUG=b:62189155 TEST=See the following commit. BRANCH=none Change-Id: Id642029010e4eea51ec1f7d23240678f3f07e872 Reviewed-on: https://chromium-review.googlesource.com/1024917 Commit-Ready: Edward Jee <edjee@google.com> Tested-by: Edward Jee <edjee@google.com> Reviewed-by: Mike Frysinger <vapier@chromium.org>
* Update Android signing to support signature scheme v2Victor Hsieh2018-04-231-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | Signature Scheme V2 was introduced in N. TEST=(prepare) 1. Produce A.img by running the original sign_android_image.sh on a test image. 2. Produce B.img by running the new sign_android_image.sh on the same image. TEST=Check Settings.apk with apksigner. Saw only v1 signature exists with A.img, and only v2 exists with B.img, as expected. Certificates on both APKs have the same fingerprint. TEST=Login with A to create a new /data state, then login with B. Platform apps still run. No signature error in logcat. BRANCH=none BUG=b:67942659 Change-Id: Ibabc399563bfdc92836856a377997405cc660483 Reviewed-on: https://chromium-review.googlesource.com/993153 Commit-Ready: Victor Hsieh <victorhsieh@chromium.org> Tested-by: Victor Hsieh <victorhsieh@chromium.org> Reviewed-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org>
* whiskers: Add script to generate keypair for signing FWPatrick Berny2018-04-201-0/+16
| | | | | | | | | | | | | | | | | Whiskers decided to leverage the key format of Hammer therefore this script calls Hammer's one to generate a key pair and renames them to key_whiskers*. BUG=b:78254017 TEST=Run this script in the chroot and verify the generated key pair. BRANCH=None Change-Id: Iae7097a3b2da1b134fa1a986c669704bbbaca4e9 Reviewed-on: https://chromium-review.googlesource.com/1018591 Commit-Ready: Patrick Berny <pberny@chromium.org> Tested-by: Patrick Berny <pberny@chromium.org> Reviewed-by: Jason Clinton <jclinton@chromium.org> Reviewed-by: Bob Moragues <moragues@chromium.org>
* image_signing: sign UEFI binariesEdward Hyunkoo Jee2018-04-185-11/+343
| | | | | | | | | | | | BUG=b:62189155 TEST=See CL:*601769 BRANCH=none Change-Id: Id9569616bae0d5f44c1c96e18522ace244a5aae8 Reviewed-on: https://chromium-review.googlesource.com/995175 Commit-Ready: Edward Jee <edjee@google.com> Tested-by: Edward Jee <edjee@google.com> Reviewed-by: Jason Clinton <jclinton@chromium.org>
* devkeys: add test keys for UEFIEdward Hyunkoo Jee2018-04-188-0/+144
| | | | | | | | | | | | | | | | | | Generated with the following commands. $ mkdir tests/devkeys/uefi $ ./scripts/keygeneration/uefi/create_new_uefi_keys.sh tests/devkeys/uefi lakitu $ rm -f tests/devkeys/uefi/{pk,kek,db,dbx}/*.rsa BUG=b:62189155 TEST=See the following commit. BRANCH=none Change-Id: I996081c30fbfa89d07dba9252128dc214530e71f Reviewed-on: https://chromium-review.googlesource.com/994179 Commit-Ready: Edward Jee <edjee@google.com> Tested-by: Edward Jee <edjee@google.com> Reviewed-by: Jason Clinton <jclinton@chromium.org>
* keygeneration: add support for UEFI key generationEdward Hyunkoo Jee2018-04-187-0/+503
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | BUG=b:62189155 TEST=With CL:*601769, set up a local signer and tested key generation and signing. Also, manually ran the scripts like the following. $ export PATH=$(readlink -f ../../../cros-signing/signer/signingtools-bin):$PATH $ cd scripts/keygeneration && ./create_new_keys.sh --uefi --board lakitu --output ./key $ ./uefi/increment_kek_key.sh key/uefi lakitu $ ./uefi/increment_kek_key.sh key/uefi lakitu $ ./uefi/increment_db_child_key.sh key/uefi lakitu $ ./uefi/increment_db_child_key.sh key/uefi lakitu $ ./uefi/increment_db_child_key.sh key/uefi lakitu $ ./uefi/increment_db_key.sh key/uefi lakitu $ ./uefi/increment_db_child_key.sh key/uefi lakitu $ ./uefi/increment_db_key.sh key/uefi lakitu $ ./uefi/increment_db_child_key.sh key/uefi lakitu $ ./uefi/increment_db_child_key.sh key/uefi lakitu $ openssl x509 -noout -subject -in key/uefi/db.children/db_child.pem BRANCH=none Change-Id: I9276269a2a66c57f4e99deafec3b90d6cbf52244 Reviewed-on: https://chromium-review.googlesource.com/995174 Commit-Ready: Edward Jee <edjee@google.com> Tested-by: Edward Jee <edjee@google.com> Reviewed-by: Jason Clinton <jclinton@chromium.org>
* Add new NV and GBB flag to control UDCDuncan Laurie2018-04-177-1/+22
| | | | | | | | | | | | | | | | | | | | | | | | | This change adds a new NV and GBB flag for controlling USB device mode behavior, adding an additional step to enable UDC on systems that support it. Users of this feature will need to first enable developer mode and then enable UDC separately by running "crossystem dev_enable_udc=1". Alternatively those without write protect enabled can set a GBB flag to have UDC enabled by default while in developer mode. This is based on the security reviewed proposal at https://docs.google.com/document/d/1b6avd9xvhvljN_NKtctWrClj4mSYZ_uPmp7MmAnPwqs BUG=b:74339386 BRANCH=poppy TEST=manual testing on Eve device Change-Id: I6f440320f28b033639b53246d3034bc8acc37a33 Signed-off-by: Duncan Laurie <dlaurie@google.com> Reviewed-on: https://chromium-review.googlesource.com/1010769 Reviewed-by: Randall Spangler <rspangler@chromium.org> Reviewed-by: Furquan Shaikh <furquan@chromium.org>
* crossytem:Add GLK GPIO IDShaunak Saha2018-04-161-0/+5
| | | | | | | | | | | | BUG=b:78009842 Change-Id: I50de5d69309a25411c907425675eace330de7615 Signed-off-by: Shaunak Saha <shaunak.saha@intel.com> Signed-off-by: Hannah Williams <hannah.williams@intel.com> Reviewed-on: https://chromium-review.googlesource.com/742490 Commit-Ready: Aaron Durbin <adurbin@chromium.org> Tested-by: Hannah Williams <hannah.williams@intel.corp-partner.google.com> Reviewed-by: Furquan Shaikh <furquan@chromium.org>
* tpm_lite: tpmc command to check owner authMattias Nissler2018-04-132-1/+23
| | | | | | | | | | | | | | | | | | | | | Add a command that checks whether the well-known secret (SHA1 hash of 20 zero bytes) works for owner authentication. This is accomplished by sending a DefineSpace command for TPM_NV_INDEX_TRIAL, which will trigger auth checks but not actually allocate an NVRAM space. Successful command execution thus indicates that authorization was successful. tpmc exposes the status via its exit status. This will be used in the tpm-firmware-updater driver script to verify that the TPM is in upgradable state. BRANCH=None BUG=chromium:788719 TEST=compiles Change-Id: I630831127e0e01186650412a92643c2153fbe2ee Reviewed-on: https://chromium-review.googlesource.com/978171 Trybot-Ready: Mattias Nissler <mnissler@chromium.org> Tested-by: Mattias Nissler <mnissler@chromium.org> Reviewed-by: Andrey Pronin <apronin@chromium.org>
* tpm_lite: Add TlclGetSpaceInfoMattias Nissler2018-04-136-26/+218
| | | | | | | | | | | | | | | | The new TlclGetSpaceInfo function returns more detailed information about a defined NVRAM space. The existing TlclGetPermissions function is now using TlclGetSpaceInfo behind the scenes. BRANCH=None BUG=chromium:788719 TEST=New unit tests. Change-Id: I6c4f490d575788b696fd742a69e81e2767ec50f1 Reviewed-on: https://chromium-review.googlesource.com/937705 Trybot-Ready: Mattias Nissler <mnissler@chromium.org> Tested-by: Mattias Nissler <mnissler@chromium.org> Reviewed-by: Andrey Pronin <apronin@chromium.org>
* tpm_lite: Add missing NVRAM attribute constants.Mattias Nissler2018-04-132-7/+32
| | | | | | | | | | | | | | | | | Add the remaining constants for NVRAM space attributes. The code previously only declared the ones required in vboot_reference, but that led to other code growing its own ad-hoc declarations for missing constants. Just declare them all to simplify things. BRANCH=None BUG=chromium:788719 TEST=compiles Change-Id: I749ae5e4dc1b2ba56121fe42fd136b505d8cae80 Reviewed-on: https://chromium-review.googlesource.com/937704 Trybot-Ready: Mattias Nissler <mnissler@chromium.org> Tested-by: Mattias Nissler <mnissler@chromium.org> Reviewed-by: Mattias Nissler <mnissler@chromium.org>
* tpm_lite: Support delegation family functionality.Mattias Nissler2018-04-136-21/+223
| | | | | | | | | | | | | | | | | | | Adds two new functions and their corresponding TPM commands to create delegation families and list the delegation family table, respectively. This isn't sufficient to meaningfully manage delegation families, but good enough for the (ab)use case of storing flags in delegation family labels, which we are going to do in order to strengthen encrypted stateful to guarantee recreation of the encrypted file system after TPM clear.. BRANCH=None BUG=chromium:788719 TEST=new unit tests Change-Id: I31beb662784a8fff450b485c7cabc553944d7772 Reviewed-on: https://chromium-review.googlesource.com/817199 Trybot-Ready: Mattias Nissler <mnissler@chromium.org> Tested-by: Mattias Nissler <mnissler@chromium.org> Reviewed-by: Andrey Pronin <apronin@chromium.org>
* tpm_lite: Add more general DefineSpaceEx functionMattias Nissler2018-04-138-34/+494
| | | | | | | | | | | | | | | | | Add a TlclDefineSpaceEx function that allows to pass additional parameters when creating NVRAM spaces, i.e. owner authorization as well as PCR bindings. BRANCH=None BUG=chromium:788719 TEST=New unit tests. Change-Id: I73404c05528a89604fea3bcb1f00741fb865ba77 Reviewed-on: https://chromium-review.googlesource.com/814114 Reviewed-by: Andrey Pronin <apronin@chromium.org> Trybot-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Trybot-Ready: Mattias Nissler <mnissler@chromium.org> Tested-by: Mattias Nissler <mnissler@chromium.org>
* tpm_lite: Implement TakeOwnership supportMattias Nissler2018-04-138-3/+488
| | | | | | | | | | | | | | | | | | Add the ability to take TPM ownership. This requires two new commands: TPM_OIAP to start an auth session and TPM_TakeOwnership to establish ownership. TPM_TakeOwnership requires an auth session and proper command authentication to work, which is also added. BRANCH=None BUG=chromium:788719 TEST=new unit tests Change-Id: Ib70144eedb0b1c7c43b26c06529d33ccbaa51a0e Reviewed-on: https://chromium-review.googlesource.com/790414 Reviewed-by: Andrey Pronin <apronin@chromium.org> Tested-by: Mattias Nissler <mnissler@chromium.org> Trybot-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Trybot-Ready: Mattias Nissler <mnissler@chromium.org>
* tpm_lite: Implement ReadPubek command.Mattias Nissler2018-04-1310-6/+364
| | | | | | | | | | | | | | | | Add a TlclReadPubek library function to read the public endorsement key. BRANCH=None BUG=chromium:788719 TEST=New unit tests. Change-Id: I5f23b76b88198d656f4ba5782d2b4f25aaa082b1 Reviewed-on: https://chromium-review.googlesource.com/790413 Reviewed-by: Andrey Pronin <apronin@chromium.org> Tested-by: Mattias Nissler <mnissler@chromium.org> Trybot-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Trybot-Ready: Mattias Nissler <mnissler@chromium.org>
* cgpt: Remove hard coded 512 block size.Sam Hurst2018-04-129-104/+165
| | | | | | | | | | | | | | | | | | | | Remove 512 sector block size restriction so that UFS, with sector block size 4096 or greater, can be used. The sector block size is queried from the kernel with ioctl(BLKSSZGET) or queried from depthcharge with VbExDiskGetInfo(). BUG=b:77540192 BRANCH=none TEST=manual make runtests passed. Tested firmware on Kevin and boot to kernel from disk. Executed cgpt show /dev/mmcblk0 on eve device and verified output was correct. Should be tested on device with sector block size greater than 512. Change-Id: I8165c8ee4da68180eecc8d12b3fb501cc5c60a5d Reviewed-on: https://chromium-review.googlesource.com/1007498 Commit-Ready: Sam Hurst <shurst@google.com> Tested-by: Sam Hurst <shurst@google.com> Reviewed-by: Julius Werner <jwerner@chromium.org>
* tpm_lite: Introduce cursor read helpersstabilize-meowth-10574.Bstabilize-10569.BMattias Nissler2018-04-092-47/+49
| | | | | | | | | | | | | | | | Add helper functions that read a number in TPM byte order and advance the buffer pointer in a single operation. Replace instances of this pattern with call to the helpers. No functional changes. BRANCH=None BUG=None TEST=existing unit tests Change-Id: I96d866893ec875aafc978cbe2a55ea7f9f27542c Reviewed-on: https://chromium-review.googlesource.com/985832 Commit-Ready: Mattias Nissler <mnissler@chromium.org> Tested-by: Mattias Nissler <mnissler@chromium.org> Reviewed-by: Andrey Pronin <apronin@chromium.org>
* tpm_lite: Drop FOR_TEST for tlcl.cMattias Nissler2018-04-093-24/+3
| | | | | | | | | | | | | | | | | | firmware/lib/tpm_lite.c turned off CHROMEOS_ENVIRONMENT if FOR_TEST is enabled, resulting in a situation where code specific to CHROMEOS_ENVIRONMENT couldn't be tested. Fortunately, AFAICS tlcl_tests does not use FOR_TEST for anything useful any longer, so just drop it. BRANCH=None BUG=None TEST=FEATURES=test emerge-$BOARD -v1 vboot_reference Change-Id: I7f08ef6d2343bc60a6d2982c3cc7bae0507d94d5 Reviewed-on: https://chromium-review.googlesource.com/937703 Commit-Ready: Mattias Nissler <mnissler@chromium.org> Tested-by: Mattias Nissler <mnissler@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
* Add a script to generate a keypair for signing wand firmware.Marco Chen2018-04-021-0/+16
| | | | | | | | | | | | | | | | Wand decided to leverage the key format of Hammer therefore this script calls Hammer's one to generate a key pair and renames them to key_wand*. BUG=b:73799441 TEST=Run this script in the chroot and verify the generated key pair. BRANCH=None Change-Id: Id2749d78e0632bee66c09c4ee7aa1930534157b7 Reviewed-on: https://chromium-review.googlesource.com/991532 Commit-Ready: Marco Chen <marcochen@chromium.org> Tested-by: Marco Chen <marcochen@chromium.org> Reviewed-by: Nicolas Boichat <drinkcat@chromium.org>
* crossystem: Clarify help string for dev_default_bootNicolas Boichat2018-04-021-1/+1
| | | | | | | | | | | | | | The default value is "disk", and should be mentionned as an option. BRANCH=none BUG=none TEST=emerge-poppy -av vboot_reference Change-Id: I9ddfe155f1dbaf019b74c1bab7b5ce5539545e7f Reviewed-on: https://chromium-review.googlesource.com/989375 Commit-Ready: Nicolas Boichat <drinkcat@chromium.org> Tested-by: Nicolas Boichat <drinkcat@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
* ec_sync: Go to recovery on aux fw update failureDuncan Laurie2018-03-304-19/+63
| | | | | | | | | | | | | | | | | | | | | | | | | If an aux firmware update fails enter recovery with a specific reason code so we can identify systems that fail. Also handle the case where the update succeeds and requests a cold reset of the EC, first clearing the oprom flag if necessary in order to prevent a second reset. Unit test was added to check recovery reason for aux firmware update failure. BUG=b:74336712 BRANCH=eve TEST=manual: force update to fail and ensure it goes to recovery mode, and after successful update check that the option rom flag is cleared before the EC reset happens. Unit tests udpated and 'make runtests' passes. Change-Id: I35a93892a0f8bb16eac0925ada5dfbc5c3144f8d Signed-off-by: Duncan Laurie <dlaurie@google.com> Reviewed-on: https://chromium-review.googlesource.com/959671 Reviewed-by: Caveh Jalali <caveh@google.com> Reviewed-by: Furquan Shaikh <furquan@chromium.org>
* ec_sync: Add recovery reason for aux update failureDuncan Laurie2018-03-282-0/+5
| | | | | | | | | | | | | | | | | | Add a distinct recovery reason for aux firmware update failures so we have some visibility into failures in eventlog. This is used in a subsequent commit. BUG=b:74336712 BRANCH=eve TEST=manual: force update failure and ensure device goes to recovery with this reason Change-Id: I4b215444592b7c31cd25d59ad2a52b85d504e3bf Signed-off-by: Duncan Laurie <dlaurie@google.com> Reviewed-on: https://chromium-review.googlesource.com/959669 Reviewed-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: caveh jalali <caveh@chromium.org>
* firmware: tpm2_lite: fix command/response code typeAndrey Pronin2018-03-272-3/+2
| | | | | | | | | | | | | | | | Responses and commands share the same header structure. The tpm_code field corresponds to TPM_CC in one case and TPM_RC in the other. Make it uint32_t (instead of TPM_CC) in the structure to avoid confusion when dealing with responses. BUG=chromium:825894 BRANCH=none TEST=build Change-Id: I07821f35b0f539a863ee97c0a08c141d0533a4de Signed-off-by: Andrey Pronin <apronin@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/981111 Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
* firmware: tpm2_lite: propagate actual errorsAndrey Pronin2018-03-273-158/+132
| | | | | | | | | | | | | | | | | | | | | | | | | | Propagate the actual error - a non-successful response code from the tpm or communication/serializing failure - to the caller of the Tlcl functions in TPM 2.0 case. Currently, the callers only have special processing for the error codes from TCG TPM 1.2 range, which are never returned in case of communication or serialization failures or from the actual TPM 2.0. (The only case of mapping TPM 2.0 error codes to TPM_E_BADINDEX is preserved in this CL.) Thus, changing the actual values returned from the functions won't change any current behavior in the calling layers. This CL is a preparatory work for adding special processing for communication errors in mount-encrypted. BUG=chromium:702724 BRANCH=none TEST=build; test that tpmc getvf, tpmc read still work. Change-Id: I96b20e7285e83f0038abc01e4b7175c938867e7d Signed-off-by: Andrey Pronin <apronin@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/977225 Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
* firmware: move TPM_E constants to tss_constants.hAndrey Pronin2018-03-263-23/+21
| | | | | | | | | | | | | | | | | | | | | | | | The constants from the list defined in tss_constants.h should be the same values regardless of TPM 1.2 vs 2.0 spec version since AP firmware checks for those exact values in certain cases. Stop defining them separately for TPM 1.2 and 2.0 and move to the common tss_constants.h. Before the change, even though TPM_E constants were defined in TPM spec dependent files, they were defined identically. So, no changes to the behavior are caused by this CL. This is a preparatoryy change to fixing error handling for Tlcl and mount-encrypted. BUG=chromium:702724 BRANCH=none TEST=emerge vboot_reference Change-Id: Ib7a5f41ca55579d053ba63ce07f4bed1394e7ae9 Signed-off-by: Andrey Pronin <apronin@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/976871 Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
* Add GBB_FLAG_DISABLE_FWMP documentation to set_gbb_flags.shJulius Werner2018-03-261-0/+1
| | | | | | | | | | | | | | Looks like we forgot to update the help text for set_gbb_flags.sh when adding the DISABLE_FMWP flag. This patch fixes that. BRANCH=None BUG=None TEST=None Change-Id: Iae45e151ae786565f6a1a695a2e3c3d01f8c1d0a Signed-off-by: Julius Werner <jwerner@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/976801 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* Add new GBB_FLAG_FORCE_MANUAL_RECOVERYJulius Werner2018-03-2610-14/+46
| | | | | | | | | | | | | | | | | | | | | | | | It seems like there are some testing use cases where we want the device to boot into the recovery installer but it is impractical to fully simulate a user-triggered recovery. This has become impossible with the recent change to always require manual recovery to boot an image, even when the developer mode switch is enabled (CL:924458). This patch adds a new GBB flag to support this use case. When the flag is set, all recovery mode is manual recovery mode, regardless of wheter the developer mode switch is on or not. Since the GBB_FLAG_ENABLE_SERIAL was killed off before it ever really worked anyway, we can safely reuse the bit reserved for it. BRANCH=None BUG=None TEST=make runtests, manually confirmed on Kevin Change-Id: I4f51dfd20b4ff04c522f53596896dccbceee52dc Signed-off-by: Julius Werner <jwerner@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/976660 Reviewed-by: Randall Spangler <rspangler@chromium.org>
View Lorry Controller Status