summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Revert "crossystem: Updated crossystem to accomodate Android"stabilize-jetstream-7390.62.Bstabilize-jetstream-7390.54.Bstabilize-7390.68.Bstabilize-7390.59.Brelease-R46-7390.BEric Caruso2015-08-221-62/+8
| | | | | | | | | | | | | | This reverts commit 26825b53dc914e4599767ae1e78fe731840027c1. This looks like it breaks ARM systems by causing crossystem to crash freeing stuff. BUG=chromium:523189 Change-Id: Ic1e1594519354e7b80424f5c66dc9bdb2605ec73 Reviewed-on: https://chromium-review.googlesource.com/295215 Reviewed-by: Eric Caruso <ejcaruso@chromium.org> Commit-Queue: Eric Caruso <ejcaruso@chromium.org> Tested-by: Eric Caruso <ejcaruso@chromium.org>
* sign_official_build: support signing 'kernel' image typeDavid Riley2015-08-211-0/+31
| | | | | | | | | | | BRANCH=signer BUG=chrome-os-partner:44227 TEST='sign_official_build.sh kernel boot_devsigned.img keys boot_resigned.img' Change-Id: I805231ef4bd4ed86b35c0d7ca2d3fe1e704caabc Signed-off-by: David Riley <davidriley@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/294954 Reviewed-by: Mike Frysinger <vapier@chromium.org>
* crossystem: Updated crossystem to accomodate AndroidShelley Chen2015-08-201-8/+62
| | | | | | | | | | | | | | | | | | | Previously crossystem assumed that mosys was located in /usr/sbin. In Android mosys is currently located in /system/bin. Using fixed paths as opposed to 'which' to prevent attacks where attacker could insert mosys in PATH. BUG=none BRANCH=none TEST=ran crossystem, crossystem fw_try_count/ fw_try_next, crossystem fw_try_count/fw_try_next=x on link and smaug. Change-Id: I9604f008d457147188dc852c173d5a184163b339 Signed-off-by: Shelley Chen <shchen@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/292314 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* sign_official_build: support signing 'base' image typestabilize-7374.BAmey Deshpande2015-08-181-1/+2
| | | | | | | | | | | | | | | | BRANCH=signer BUG=chromium:512940 TEST=Tested with the following command: $ ./sign_official_build.sh base chromiumos_base_image.bin ../../tests/devkeys \ chromiumos_base_image_signed.bin ../../tests/devkeys/key.versions Change-Id: Ife2284a6ca82f4306ca26278159859928c0ff2b5 Reviewed-on: https://chromium-review.googlesource.com/293636 Reviewed-by: Bill Richardson <wfrichar@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org> Tested-by: Amey Deshpande <ameyd@google.com> Commit-Queue: Amey Deshpande <ameyd@google.com>
* Add "tpmc pcrextend" command to extend a PCRstabilize-7356.BKevin Cernekee2015-08-101-0/+37
| | | | | | | | | | | | | | | | | | | | | | | This is useful for testing different configurations without repeatedly reflashing the firmware, e.g. # stop tcsd # tpmc pcr 0 0000000000000000000000000000000000000000 # tpmc pcrextend 0 c42ac1c46f1d4e211c735cc7dfad4ff8391110e9 # tpmc pcr 0 865aedd337518e56f648440b81b4cbd9359fdff3 <reboot and try another value> BUG=none BRANCH=none TEST=manual Change-Id: Ie5814ca2a3a5cf5a0eaf0ffee0385315db09bf25 Signed-off-by: Kevin Cernekee <cernekee@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/289009 Reviewed-by: Luigi Semenzato <semenzato@chromium.org> Reviewed-by: Kees Cook <keescook@chromium.org>
* VbNvStorage: Add flags for misc settingsFurquan Shaikh2015-08-018-15/+42
| | | | | | | | | | | | | | | | | | | | 1. Change offset 8 to hold all misc settings (fastboot, boot_on_ac detect) instead of only fastboot settings. 2. Add flag to hold state of boot_on_ac_detect (If set to 1, AP should start booting as soon as AC is connected in off-state). BUG=chrome-os-partner:41680 BRANCH=None TEST=Compiles successfully. make runtests successful. Change-Id: I64b3fc69bd52cbcaf5899c953ccafa2e81b5b8a5 Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/289900 Trybot-Ready: Furquan Shaikh <furquan@chromium.org> Tested-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Vincent Palatin <vpalatin@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org> Commit-Queue: Furquan Shaikh <furquan@chromium.org>
* futility: Compute / verify root key hashRandall Spangler2015-07-215-2/+226
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ryu will store a hash of the GBB root key in a struct inside its boot block. Add a vb2_ryu_root_key_hash struct for that. If 'futility gbb_utility' is used to set the root key, also look for a root key hash struct and fill it in. No error if not found, because this needs to work on other platforms where the struct is not present. This way, we don't need to change the signing scripts. Added a --roothash option which can be used to check if the root key hash is found, and if so, whether it's empty, valid, or invalid. BUG=chromium:511405 BRANCH=ryu TEST=manual Take any existing image.bin. cp image.bin image.orig gbb_utility --roothash image.bin - ryu root hash not found Extract the root key gbb_utility -k rootkey.bin image.bin - exported root_key to file: rootkey.bin Now, append a blank ryu root hash struct to it echo '0000000: 5274 4b79 4861 7368 0100 0000 3000 0000' | xxd -r >> image.bin echo '0000000: 0000 0000 0000 0000 0000 0000 0000 0000' | xxd -r >> image.bin echo '0000000: 0000 0000 0000 0000 0000 0000 0000 0000' | xxd -r >> image.bin Nothing is set yet gbb_utility --roothash image.bin - ryu root hash is unset Setting the root key also sets the root hash gbb_utility -s -k rootkey.bin image.bin - import root_key from rootkey.bin: success - calculate ryu root hash: success successfully saved new image to: image.bin See, it verifies gbb_utility --roothash image.bin - ryu root hash verified Now, append a bad ryu root hash struct to it cp image.orig image.bin echo '0000000: 5274 4b79 4861 7368 0100 0000 3000 0000' | xxd -r >> image.bin echo '0000000: 0001 0000 0000 0000 0000 0000 0000 0000' | xxd -r >> image.bin echo '0000000: 0000 0000 0000 0000 0000 0000 0000 0000' | xxd -r >> image.bin See, it fails gbb_utility --roothash image.bin - ryu root hash does not verify Make sure the library doesn't contain the magic string strings `which futility` | grep RtKyHash (should be no output) Change-Id: Ib46f93cac0f2b532bada4b187ae48efcf4926702 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/286237 Reviewed-by: Furquan Shaikh <furquan@chromium.org>
* crossystem: Add Skylake PCH GPIO controller IDfirmware-ultima-7287.131.Bfirmware-terra-7287.154.Bfirmware-setzer-7287.360.Bfirmware-reks-7287.133.Bfirmware-edgar-7287.167.Bfirmware-cyan-7287.57.Bfirmware-celes-7287.92.BDuncan Laurie2015-07-211-0/+1
| | | | | | | | | | | | | | | Add the GPIO controller ID that is used in the Skylake PCH so it can properly export and use GPIOs that are exported in VBNV for write protect. BUG=chrome-os-partner:42560 BRANCH=none TEST=verify crossystem output with and without WP enabled Change-Id: Ic85c202bd0ca15c154c10481926ef18bafe3fac5 Signed-off-by: Duncan Laurie <dlaurie@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/286827 Reviewed-by: Aaron Durbin <adurbin@chromium.org>
* image_signing: Add more description to set_gbb_flags.Hung-Te Lin2015-07-211-12/+15
| | | | | | | | | | | | | | There are two new GBB flags added (lid/fastboot) and we should update the description in set_gbb_flags. BRANCH=none BUG=none TEST=emerge-link vboot_reference Change-Id: I0d16df03e9427ec1c8780fbb6be10c31eed9bf9e Signed-off-by: Hung-Te Lin <hungte@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/286052 Reviewed-by: Bill Richardson <wfrichar@chromium.org>
* crossystem: Add skylake platform IDsDuncan Laurie2015-07-211-0/+2
| | | | | | | | | | | | | | Add the skylake-u and skylake-y vendor/device IDs so it can be reported by crossystem. BUG=chrome-os-partner:42560 BRANCH=none TEST=run "crossystem platform_family" on glados Change-Id: I5f9b92d404166e56d77cf8b0cd627a3a0b63bedf Signed-off-by: Duncan Laurie <dlaurie@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/286921 Reviewed-by: Aaron Durbin <adurbin@chromium.org>
* crossytem:Fix the write protect line gpio valuefactory-smaug-7265.BJohn Zhao2015-07-141-24/+72
| | | | | | | | | | | | | | | | | | | | For crossystem to work correctly on Strago/Cyan, add Braswell string and correct GPIO offset calculations. In Braswell, write protect line is MF_ISH_GPIO_4 as encoded as 0x10016 where the GPEAST offset (COMMUNITY_OFFSET_GPEAT) is 0x10000 BUG=chrome-os-partner:40835 BRANCH=None TEST=test_that -b <strago/cyan> <IP> platform_Crossystem Change-Id: I365f3d6ca9f3ac7ef50abb9b2ba13f184d39c100 Signed-off-by: John Zhao <john.zhao@intel.com> Signed-off-by: Arindam Roy <arindam.roy@intel.com> Reviewed-on: https://chromium-review.googlesource.com/274841 Reviewed-by: Aaron Durbin <adurbin@chromium.org> Commit-Queue: Bernie Thompson <bhthompson@chromium.org>
* crossystem: Revise description of sw_wpsw_boot.release-R45-7262.BHung-Te Lin2015-07-091-1/+1
| | | | | | | | | | | | | | | | The sw_wpsw_boot was made for some feature that was almost never completed, and only makes sense on Baytrail platforms. To prevent confusion we should address that in the crossystem description. BRANCH=none BUG=chromium:508269 TEST=make test Change-Id: I1fbc7a0e9e8c1f8503ae8ae9dfb6e80c8da892e3 Reviewed-on: https://chromium-review.googlesource.com/284425 Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Bill Richardson <wfrichar@chromium.org> Commit-Queue: Hung-Te Lin <hungte@chromium.org>
* crossystem: Add check for "mkbp" backDavid Hendricks2015-06-301-2/+4
| | | | | | | | | | | | | | | | | | We may have been over-zealous earlier when trying to eliminate references to mkbp. Since crossystem runs on all ChromeOS devices, this re-adds "mkbp" back to mitigate the risk of encountering problems on systems running newer versions of ChromeOS but with older firmware. BUG=chrome-os-partner:21097 BRANCH=none TEST=Compiled for veyron_brain Change-Id: Ia0086687fbc3a1195b062367ccb6ee5c41acd026 Signed-off-by: David Hendricks <dhendrix@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/282602 Reviewed-by: Randall Spangler <rspangler@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
* crossystem: Check for "cros-ec" instead of "mkbp" for *NvStorageDavid Hendricks2015-06-251-2/+2
| | | | | | | | | | | | | | | | | | | This changes the string we look for in the devicetree on ARM platforms to look for "cros-ec" (DT uses dashes instead of underscores) instead of "mkbp". BUG=chrome-os-partner:21097 CQ-DEPEND=CL:273347 BRANCH=none TEST=with depthcharge patch applied, ran crossystem on newly booted system and saw VBNV-related variables turn out the same. Signed-off-by: David Hendricks <dhendrix@chromium.org> Change-Id: Iac43f5381327eb878a8d0db606b78bb7bdce816f Reviewed-on: https://chromium-review.googlesource.com/273391 Commit-Queue: Stefan Reinauer <reinauer@chromium.org> Tested-by: Stefan Reinauer <reinauer@chromium.org> Reviewed-by: Stefan Reinauer <reinauer@chromium.org>
* recovery: Add recovery reason for fastboot mode requested in fwstabilize-7204.BFurquan Shaikh2015-06-233-0/+7
| | | | | | | | | | | | | | BUG=chrome-os-partner:40196 BRANCH=None TEST=Compiles successfully Change-Id: Ic69834f2e23926e618349b5a56db549a290cd0c2 Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/280922 Trybot-Ready: Furquan Shaikh <furquan@chromium.org> Tested-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org> Commit-Queue: Furquan Shaikh <furquan@chromium.org>
* cgpt repair: fix segfault which occurs when one of the headers is badstabilize-7202.Bstabilize-7199.Bstabilize-7173.BAndrey Ulanov2015-06-134-2/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | When one of GPT headers is invalid the corresponding partition table is not loaded and corresponding pointers in GptData are NULL. GptRepair will try to memcpy one entries table to another which results in SIGSEGV. This change fixes it by freeing and then reallocating bad copy of partition table. This potentially fixes problems which would occur if two tables have different size. Change that initially introduced this problem by not always allocating secondary_entries: https://chromium-review.googlesource.com/223800 TEST="cgpt repair" works where it previously didn't TEST=make runtests BUG=brillo:1203 BRANCH=none Change-Id: Ibb2fcf33faa5ba157b0865d04c90ee3f26eee113 Reviewed-on: https://chromium-review.googlesource.com/276766 Reviewed-by: Randall Spangler <rspangler@chromium.org> Commit-Queue: Andrey Ulanov <andreyu@google.com> Tested-by: Andrey Ulanov <andreyu@google.com>
* vboot_reference: fix unittest when building with clang.Yunlian Jiang2015-06-113-2/+8
| | | | | | | | | | | | | | | | | | | | When linking vboot_api_kernel4_tests, there are two VbBootNormal() available, the gcc chooses the one in vboot_api_kernel4_tests.c and the test passes, the clang chooses the one in vboot_api_kernel.c and make the unittest fail. This CL makes the one in vboot_api_kernel.c a weak symbol so that clang can choose the one in vboot_api_kernel4_tests.c BUG=chromium:498469 BRANCH=none TEST=CC=x86_64-cros-linux-gnu-clang FEATURES='test' emerge-amd64-generic vboot_reference Change-Id: Ibcb78ee055fc9485dbc2bcc1d1cf98144a1a3b64 Reviewed-on: https://chromium-review.googlesource.com/276504 Reviewed-by: Randall Spangler <rspangler@chromium.org> Commit-Queue: Yunlian Jiang <yunlian@chromium.org> Tested-by: Yunlian Jiang <yunlian@chromium.org>
* vboot2: Add 2.0 api layer to verify kernel partitionRandall Spangler2015-06-097-2/+878
| | | | | | | | | | | | | | | | | | | This allows the caller to load the kernel partition and then pass it to vboot for verification, rather than having vboot assume the kernel partitions are all on a block storage device. Next up, APIs for the caller to parse partition information from a GPT (yes, that's cgptlib, but we'll make it more easily callable by depthcharge). BUG=chromium:487699 BRANCH=none TEST=make -j runtests Change-Id: I388085c7023f4c76d416f37df0607019bea844ac Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/275646 Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
* recovery: Add recovery reasons for BCBstabilize-7155.BFurquan Shaikh2015-06-043-0/+14
| | | | | | | | | | | | | | | | | | | BCB is bootloader control block. Add reasons specific to BCB: 1. In case of any error reading/writing BCB (internal FW error) 2. User-mode requested recovery via BCB (user-mode requested) BUG=chrome-os-partner:40960 BRANCH=None TEST=Compiles successfully Change-Id: I0ac362ba7267a08313cb3077be686aa73367e53b Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/275222 Trybot-Ready: Furquan Shaikh <furquan@chromium.org> Tested-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Aaron Durbin <adurbin@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org> Commit-Queue: Furquan Shaikh <furquan@chromium.org>
* vboot2: Add routines to load kernel preambleRandall Spangler2015-06-046-11/+254
| | | | | | | | | | | | | | The kernel data itself will be read and verified by a subsequent change. BUG=chromium:487699 BRANCH=none TEST=make -j runtests Change-Id: Ife4f8250493ec6457f91fda57ae8d4d7bf18ec89 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/274038 Reviewed-by: Bill Richardson <wfrichar@chromium.org>
* cgpt: Add a callback to allow override of GPT entry priorityFurquan Shaikh2015-06-045-0/+105
| | | | | | | | | | | | | | | | | | | | This can be used by implementations that want to request vboot to favor a particular kernel entry for booting without affecting the checks for rollback protection and image verification. CQ-DEPEND=CL:274716, CL:274932, CL:275171 BUG=None BRANCH=None TEST=Compiles successfully. make -j runtests successful. Change-Id: I6a4600020354f5d4118c17f083c353c2585c4181 Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/274558 Reviewed-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Stefan Reinauer <reinauer@chromium.org> Tested-by: Nicolas Boichat <drinkcat@chromium.org> Commit-Queue: Nicolas Boichat <drinkcat@chromium.org> Trybot-Ready: Nicolas Boichat <drinkcat@chromium.org>
* vboot_api_kernel: Do not pre-populate variables inFurquan Shaikh2015-06-021-4/+3
| | | | | | | | | | | | | | | | | | | | VbVerifyMemoryBootImage Do not use values from the header or preamble until it is known to be good. BUG=None BRANCH=None TEST=Compiles successfully and VbVerifyMemoryBootImage returns early for images with bad values in header. Change-Id: Ic026f49292a139e0a04c2556ca9fa62ff277b18f Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/274141 Trybot-Ready: Furquan Shaikh <furquan@chromium.org> Tested-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org> Commit-Queue: Furquan Shaikh <furquan@chromium.org>
* vboot2: secdata: Check struct_version on initializationstabilize-7134.BJulius Werner2015-06-023-2/+10
| | | | | | | | | | | | | | | | | | This patch reintroduces a vb2_secdata->struct_version check similar to the one that was removed in CL:244846. The CRC is not a reliable way to detect zeroed buffers, so this check helps vboot fail earlier and more clearly in certain situations. BRANCH=kitty,smaug,storm,veyron BUG=chrome-os-partner:40778 TEST=make runtests. Rebooted Jerry with 'mem w 0xff7601b0 0xfdb9', saw that recovery reason was now 0x2b (VBNV_RECOVERY_VB2_SECDATA_INIT). Change-Id: Ic4376d127e6d14d4ef9c2f53c83090040ca4cb68 Signed-off-by: Julius Werner <jwerner@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/274138 Reviewed-by: Randall Spangler <rspangler@chromium.org> Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
* fastboot: Add routines for unlock and lock devicestabilize-7131.BFurquan Shaikh2015-05-294-0/+124
| | | | | | | | | | | | | | | | | | | | | | | Add support for functions to request unlock and lock of devices in response to fastboot oem unlock/lock commands. Unlock operation is equivalent to enabling dev mode and lock operation is equivalent to leaving dev mode. It is the responsibility of the caller to ensure that user confirmation is obtained before unlock/lock operations. BUG=chrome-os-partner:40196 BRANCH=None TEST=Compiles successfully and fastboot lock/unlock operations work as expected on smaug. Added tests to ensure lock/unlock operations are covered. Verified using make -j runtests. Change-Id: Ibafe75abdd1202473009208a414f3996d537db4f Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/273182 Reviewed-by: Furquan Shaikh <furquan@chromium.org> Tested-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org> Commit-Queue: Furquan Shaikh <furquan@chromium.org> Trybot-Ready: Furquan Shaikh <furquan@chromium.org>
* fastboot: Add fastboot related flags to vb2Furquan Shaikh2015-05-296-2/+42
| | | | | | | | | | | | | | BUG=chrome-os-partner:40196 BRANCH=None TEST=Compiles successfully. Change-Id: I4305436b2ae46254e4e8b12039ffed95634d62c2 Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/273181 Tested-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org> Commit-Queue: Furquan Shaikh <furquan@chromium.org> Trybot-Ready: Furquan Shaikh <furquan@chromium.org>
* fastboot: Add fastboot related flags to nvstorageFurquan Shaikh2015-05-297-0/+38
| | | | | | | | | | | | | | | | Use unused offset 8 for fastboot related flags. BUG=chrome-os-partner:40196 BRANCH=None TEST=Compiles successfully. Change-Id: I6df0985924ba80cdcb68bb6b7658bf962f01287f Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/273180 Tested-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org> Commit-Queue: Furquan Shaikh <furquan@chromium.org> Trybot-Ready: Furquan Shaikh <furquan@chromium.org>
* Provide a way to disable counting failed bootsPatrick Georgi2015-05-289-6/+79
| | | | | | | | | | | | | | | | | | | | | | | When the lid is closed and external power is applied the system may boot and shut down faster than required for the OS to determine that things were alright. In timed charging setups this led to systems ending up to consider the current version broken because it "failed" repeatedly. Remain generic about the reason for not counting boots since there may be more situations in which we want to handle the situation optimistically. BRANCH=none BUG=chromium:446945 TEST=none Change-Id: Iea350e3c98d5c00156da682e52c90a882ba017c0 Signed-off-by: Patrick Georgi <pgeorgi@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/249150 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* fastboot: Add routine for verifying kernel image loaded in memoryFurquan Shaikh2015-05-274-0/+440
| | | | | | | | | | | | | | | | | | | | | | | | | | This API allows fastboot boot from memory command to verify that the image loaded in memory is signed properly using recovery keys. Thus, only officially signed recovery images can be booted using fastboot boot command in recovery mode. However, if GBB_FLAG_FORCE_DEV_BOOT_FASTBOOT_FULL_CAP is set, then this routine will not perform any check and return okay for any image sent by fastboot boot. BUG=chrome-os-partner:40196 BRANCH=None TEST=Compiles successfully. With GBB override for FASTBOOT_FULL_CAP set any signed image is allowed to boot. With FASTBOOT_FULL_CAP not set, then only officially signed image is allowed to boot. (make -j runtests successful) Change-Id: I78028853bd1ad09d3c610a687f327560557d5681 Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/272696 Reviewed-by: Randall Spangler <rspangler@chromium.org> Commit-Queue: Furquan Shaikh <furquan@chromium.org> Trybot-Ready: Furquan Shaikh <furquan@chromium.org> Tested-by: Furquan Shaikh <furquan@chromium.org>
* sign_official_build: preserve /boot for legacy BIOSAmey Deshpande2015-05-221-1/+7
| | | | | | | | | | | | | | | | | | | | | This patch checks for 'cros_legacy' in the kernel config, and skips running strip_boot_from_image.sh if present. This is because 'cros_installer postinst' on legacy BIOS relies on presence of /boot in rootfs. BRANCH=signer BUG=b:20947354 TEST=Ran the script with devkeys, and checked presence of /boot in the signed .bin file by mounting locally $ ./sign_official_build.sh ssd chromiumos_image.bin ../../tests/devkeys \ chromiumos_image_signed.bin ../../tests/devkeys/key.versions Change-Id: Ieb919067b353839019bc1c561d7bb66bebac1040 Reviewed-on: https://chromium-review.googlesource.com/272742 Tested-by: Amey Deshpande <ameyd@google.com> Reviewed-by: Mike Frysinger <vapier@chromium.org> Commit-Queue: Amey Deshpande <ameyd@google.com>
* vboot2: Add routines to load and verify kernel keyblockRandall Spangler2015-05-228-3/+717
| | | | | | | | | | | | | | These are slightly more complex than the firmware versions, because they need to deal with developer-signed keyblocks and keyblock flags. BUG=chromium:487699 BRANCH=none TEST=make -j runtests Change-Id: I682c14ddfe729984f2629dfbe66750e5cd5ab75e Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/272541 Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
* vboot2: Split keyblock checking and signature validationRandall Spangler2015-05-227-71/+176
| | | | | | | | | | | | | | | | | | | | | This is necessary for the next change, which adds keyblock hash checking. Also clean up some other assorted comments, and move the diagnostic check of root key to see if it's the checked-in one earlier in firmware preamble validation so it's closer to where the root key is loaded. No functional or higher-level API changes; just shuffling around code under the covers. BUG=chromium:487699 BRANCH=none TEST=make -j runtests Change-Id: Ibc3960a4d882dc2ad8684e235db4b9d066eac080 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/272223 Reviewed-by: Bill Richardson <wfrichar@chromium.org>
* vboot2: Add routine to verify kernel preambleRandall Spangler2015-05-216-3/+402
| | | | | | | | | | | | | | | | | This also checks that the bootloader and vmlinuz headers, if present, are within the signed part of the kernel blob; the vboot1 routines didn't do that. That wasn't harmful at firmware boot time because the vboot1 routines would only load as much data as was signed, but in vboot2 loading the kernel data is the responsibility of the caller so we need to check. BUG=chromium:487699 BRANCH=none TEST=make -j runtests Change-Id: I73eb4831e5d3d7a642b6cb85cb55857d87fcc0af Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/270797
* GBB: Add missing flag LID_SHUTDOWN to vb2_gbb_flag structurestabilize-7077.134.Bstabilize-7077.123.Bstabilize-7077.122.Bstabilize-7077.111.Brelease-R44-7077.Bfactory-test-7077.114.Bfactory-arkham-7077.113.BFurquan Shaikh2015-05-161-0/+3
| | | | | | | | | | | | | | BUG=None BRANCH=None TEST=Compiles successfully Change-Id: I80a501efc3940ca5657dc143c0ab3c6b020dc1e0 Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/271620 Trybot-Ready: Furquan Shaikh <furquan@chromium.org> Tested-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Aaron Durbin <adurbin@chromium.org> Commit-Queue: Furquan Shaikh <furquan@chromium.org>
* GBB: Add flag for forcing full fastboot capability in firmwareFurquan Shaikh2015-05-162-13/+24
| | | | | | | | | | | | | | | | | This flag is equivalent to FORCE_DEV_BOOT_USB. It allows full fastboot capability in firmware for developer mode. BUG=chrome-os-partner:40196 BRANCH=None TEST=Compiles successfully for smaug. Change-Id: I82a2ebe7a8b3bbf38694ab81ca2678624f77fca1 Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/271410 Reviewed-by: Randall Spangler <rspangler@chromium.org> Commit-Queue: Furquan Shaikh <furquan@chromium.org> Trybot-Ready: Furquan Shaikh <furquan@chromium.org> Tested-by: Furquan Shaikh <furquan@chromium.org>
* nvstorage: Add new flag VBNV_DEV_BOOT_FASTBOOT_FULL_CAPFurquan Shaikh2015-05-168-0/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new flag to nvstorage for controlling fastboot capabilities offered in firmware in dev-mode. By default, value of this flag would be ignored in normal mode. Thus, when fastboot-based recovery is entered from normal mode, only limited capability would be available in firmware. After switching to dev-mode, this flag can be set automatically by user script after performing the wipe or it can be set manually using crossystem. When fastboot-based recovery is entered from dev mode and this flag is set, it will provide full fastboot capability in the firmware. BUG=chrome-os-partner:40196 BRANCH=None TEST=Compiles successfully for smaug. make runalltests successful. Change-Id: I761a9ab304dd90f0b73081acc9ce1f8d9052325f Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/271369 Reviewed-by: Aaron Durbin <adurbin@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org> Commit-Queue: Furquan Shaikh <furquan@chromium.org> Trybot-Ready: Furquan Shaikh <furquan@chromium.org> Tested-by: Furquan Shaikh <furquan@chromium.org>
* chromeos-tpm-recovery: Convert to manual TPM reset script for developersJulius Werner2015-05-161-249/+35
| | | | | | | | | | | | | | | | | | | | | chromeos-tpm-recovery has not been used for anything in forever (see CL:238236), but it is still installed on every image. Resetting the TPM (e.g. to resolve rollback issues when reflashing an MP-signed device to dev firmware) is a common request by developers, and I get tired of always digging out the required tpmc commands manually again. Let's repurpose this script as a simple one-shot tool for developers to reset their TPM, so the next time someone asks we can just tell them 'boot a test image in recovery mode and run chromeos-tpm-recovery'. BRANCH=none BUG=chromium:419942 TEST=Ran on a Jerry, confirmed that TPM spaces were reset. Change-Id: Ia95246cfed3dc9b0c6fdb0481218e3ae14d8318a Signed-off-by: Julius Werner <jwerner@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/271512 Reviewed-by: Bill Richardson <wfrichar@chromium.org> Reviewed-by: Luigi Semenzato <semenzato@chromium.org>
* vboot2: Support VB2_GBB_FLAG_DISABLE_FW_ROLLBACK_CHECKJulius Werner2015-05-165-8/+48
| | | | | | | | | | | | | | | Looks like the DISABLE_FW_ROLLBACK_CHECK GBB flag (0x200) was forgotten in the vboot2 implementation. It's too late for Veyron now, but let's at least fix it for future devices. BRANCH=none BUG=None TEST=make runtests Change-Id: I867f7aada28be3897efda73a6bdc3b0848c23dca Signed-off-by: Julius Werner <jwerner@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/271419 Reviewed-by: Bill Richardson <wfrichar@chromium.org>
* Detect GBB 1.1 also as impcompatible versionDaisuke Nojiri2015-05-142-4/+4
| | | | | | | | | | | | | | | Older GBB headers (e.g. 1.0 and 1.1) do not have hwid_digest. In such cases, PCR1 is currently extended from 0, causing a remote attestation failure. This change makes all GBB headers older than 1.2 incompatible. BUG=none BRANCH=tot TEST=make -j runtests Change-Id: I7a3b19c2da325a3fa4b9c1fe06ed6f43cb51fb9e Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/270796 Reviewed-by: Bill Richardson <wfrichar@chromium.org>
* vboot2: Add support for kernel version secure data spaceRandall Spangler2015-05-137-8/+414
| | | | | | | | | | | | | | Holds kernel rollback information. Will be used by vboot 2.0 kernel verification. BUG=chromium:487699 BRANCH=none TEST=make -j runtests Change-Id: Ib4a70e943ebd79aac06404df09cf4ce62d719201 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/270626 Reviewed-by: Bill Richardson <wfrichar@chromium.org>
* vboot1: Condition default legacy boot on dev_boot_legacystabilize-7060.Bstabilize-7059.BJulius Werner2015-05-122-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes what I think is an inconsistency in the existing legacy boot behavior: when the GBB flag that defaults to legacy boot is set, running out the 30 second timer would still boot legacy mode even if dev_boot_legacy is not actually set (whereas pressing CTRL+L in the same configuration would beep and refuse). This patch makes both legacy boot trgiggers check the same condition before boot. This does not restrict functionality since anyone who sets the DEFAULT_DEV_BOOT_LEGACY GBB flag could simply set FORCE_DEV_BOOT_LEGACY at the same time. It does however open up an interesting new use case of using NVRAM to change back-and-forth between legacy and normal developer mode (after GBB flags are changed once and write-protection is enabled again). If this is updated in the field it might lock existing devices out of legacy mode... however, since by far the most common GBB flag combination recommended on the internet seems to be 0x489 (including FORCE_DEV_BOOT_LEGACY), I doubt this would be a problem in practice. BRANCH=tbd BUG=chrome-os-partner:39999 TEST=Booted with GBB flags 0x4b9 and 0x439, observed difference. Change-Id: If6a6d99ab2cf116db2237fdc3df97fc22a68251c Signed-off-by: Julius Werner <jwerner@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/270182 Reviewed-by: Duncan Laurie <dlaurie@chromium.org>
* vboot1: Lock TPM physical presence (kernel rollback) on legacy bootJulius Werner2015-05-123-28/+32
| | | | | | | | | | | | | | | | | | | Even though legacy boot is an unsafe mode that has to be manually initiated by the user, we should still lock the kernel TPM space to be consistent with existing developer mode practice. BRANCH=tbd BUG=chrome-os-partner:39999 TEST=Spent over an hour unsuccessfully trying to get SeaBIOS to boot a Chromium test image on my Falco. Decided that's not worth it an just tested the firmware side of this (pressing CTRL+L when legacy mode is enabled and disabled, multiple times, with and without GBB flag DEFAULT_DEV_BOOT_LEGACY). Change-Id: I3b02b59a9055431d222c0c7446de2cd7d2e0bb82 Signed-off-by: Julius Werner <jwerner@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/270181 Reviewed-by: Duncan Laurie <dlaurie@chromium.org>
* Make SHA library accessible to calling firmwareRandall Spangler2015-05-074-56/+83
| | | | | | | | | | | | | | | | | | | | | | And add a vb2_digest_buffer() call which produces the hash of a buffer all in a single function call. That function actually already existed, but was in a unit test file rather than in the library itself. It's a small function, so adding it won't increase the size of the library significantly - or at all, on platforms which compile with -ffunction-sections. This allows coreboot to reuse this SHA library for hashing CBFS entries and file data. All it has to do is #define NEED_VB2_SHA_LIBRARY and then #include "vb2_api.h". BUG=chromium:482652 BRANCH=none TEST=make -j runtests Change-Id: Ice2d0929324b58b2665f3989b5b887225f6ef61e Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/269523 Reviewed-by: Julius Werner <jwerner@chromium.org>
* image_signing: use per-board release file blackliststabilize-7039.BAmey Deshpande2015-04-293-17/+28
| | | | | | | | | | | | | | | | | | This patch changes ensure_no_nonrelease_files.sh to use per-board release file blacklist instead of the default one. It also uses this opportunity to make ensure_no_nonrelease_files.sh consistently formatted. BRANCH=none TEST=Ran ./security_test_image on a lakitu image and --vboot_hash pointing to this commit, and verified ensure_no_nonrelease_files.sh passes. BUG=brillo:823 Change-Id: I2cff56192a5ff0b917faba7549e7adafb4757a47 Reviewed-on: https://chromium-review.googlesource.com/267335 Reviewed-by: Mike Frysinger <vapier@chromium.org> Commit-Queue: Amey Deshpande <ameyd@google.com> Tested-by: Amey Deshpande <ameyd@google.com>
* image_signing: emit required_dmparams_regex in case of mismatchAmey Deshpande2015-04-291-1/+2
| | | | | | | | | | | | BRANCH=none TEST=none BUG=none Change-Id: Iece5272622467829050ca50a4842ef771addf7ae Reviewed-on: https://chromium-review.googlesource.com/267739 Reviewed-by: Mike Frysinger <vapier@chromium.org> Commit-Queue: Amey Deshpande <ameyd@google.com> Tested-by: Amey Deshpande <ameyd@google.com>
* vboot_reference: remove dependency on trousersLuigi Semenzato2015-04-293-36/+139
| | | | | | | | | | | | | | | | | | This is done to break a circular DEPENDency as we want to send UMA stats from tcsd. Without this, metrics depends on vboot_reference which depends on trousers which depends on metrics. Technically the vboot_reference dependency on trousers is header-file only, but we can't cope with that. BUG=chromium:481552 TEST=compiled with emerge-<something> vboot_reference BRANCH=none Change-Id: Iea5c0c39bb70977c9d375e63ea607687debe9f9f Reviewed-on: https://chromium-review.googlesource.com/267744 Reviewed-by: Randall Spangler <rspangler@chromium.org> Commit-Queue: Luigi Semenzato <semenzato@chromium.org> Tested-by: Luigi Semenzato <semenzato@chromium.org>
* cgpt: Handle read errors gracefullystabilize-7019.Bstabilize-7018.BDan Ehrenberg2015-04-292-30/+50
| | | | | | | | | | | | | | | | | | | | | | | When a read fails in getting the GPT, just zero the contents of the buffer and carry on. Some testing changes are required for this. When a read of the GPT fails, it is no longer fatal, so tests of that have been adjusted. Tests have been improved to show that the GPT is automatically repaired when a read error occurs. There was one test which checked that a zero-sized disk would fail to load a kernel, but it was surrounded by a number of mocked functions which normally do that error checking, and it amounted to the same test as read failure; that test was deleted. BUG=chrome-os-partner:35440 TEST=vboot tests pass BRANCH=none Change-Id: I0c05813e7492920433733947d3fb74a7e4aa66f2 Signed-off-by: Dan Ehrenberg <dehrenberg@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/266882 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* vboot: Fix indentation in LoadKernel()Gwendal Grignou2015-04-281-10/+10
| | | | | | | | | | | BUG=None BRANCH=none TEST=compile Change-Id: I286ccb2649ee0535d3fb092b4d445488f6385a65 Signed-off-by: Gwendal Grignou <gwendal@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/267462 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* make_dev_ssd: Add '--edit_config' to support in-place editing.Hung-Te Lin2015-04-231-0/+29
| | | | | | | | | | | | | | | | | | | | | | The '--save_config' and '--set_config' are found to be very useful for developers but it's sometimes inconvenient that developer must specify a temporary path and to know the implicit rules of how the files are generated. Since most people just want to do in-place editing, we can add a --edit_config so developers can simply invoke "make_dev_ssd --edit_config --partitions 2" to start changing kernel command line without worrying about where to store the temporary files. BRANCH=none BUG=none TEST=./make_dev_ssd.sh --edit_config --partition 2 Change-Id: Ib8f19115df31f3f250b4378201d0f7ea562fec15 Reviewed-on: https://chromium-review.googlesource.com/266814 Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Bill Richardson <wfrichar@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org> Commit-Queue: Hung-Te Lin <hungte@chromium.org>
* vboot_reference: fix several syntax warnings found by clang.stabilize-6996.BYunlian Jiang2015-04-153-7/+5
| | | | | | | | | | | | BUG=chromium:475949 TEST=CC=x86_64-cros-linux-gnu-clang CXX=x86_64-cros-linux-gnu-clang++ emerge-falco vboot_reference BRANCH=none Change-Id: I3341e840c3f26f8579d35e0bb411566b0ad86164 Reviewed-on: https://chromium-review.googlesource.com/265834 Reviewed-by: Randall Spangler <rspangler@chromium.org> Commit-Queue: Yunlian Jiang <yunlian@chromium.org> Tested-by: Yunlian Jiang <yunlian@chromium.org>
* futility: improve help message for show commandBill Richardson2015-04-151-17/+19
| | | | | | | | | | | | | No functional changes, just tweak the help message a bit. BUG=none BRANCH=none TEST=make runtests Change-Id: I3c9987560924bd6766d4e1a756a587d9aa123bbb Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/265740 Reviewed-by: Randall Spangler <rspangler@chromium.org>
View Lorry Controller Status