summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Modify EC software sync to update RO if necessarystabilize-7834.66.Bstabilize-7821.Brelease-R49-7834.BMary Ruthven2016-01-103-188/+361
| | | | | | | | | | | | | | | | | | | | | | Allow the AP to sync and verify the EC read only image after updating the rewritable image. BUG=chrome-os-partner:48703 BRANCH=none TEST=manual 1. Update EC to a new version 2. rebuild EC code 3. Update AP firmware 4. Reboot and check that the RO image is updated after the RW image is updated. CQ-DEPEND=CL:319213 Change-Id: I774ef25320103f20d8c7d1c180a220dd0819c04d Signed-off-by: Mary Ruthven <mruthven@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/320614 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* Update a utility to support the new tpm sysfs class directoryBryan Freed2016-01-071-1/+5
| | | | | | | | | | | | | | | Kernel TPM patches from 4.x moved /sys/class/misc/tpm0 to /sys/class/tpm/tpm0. Support both paths in this utility. BUG=chromium:573368 BRANCH=none TEST=untested, not sure if this utility is still used. Change-Id: Ib81476eee4c9de921502a3a47f6990b9e6b1968b Reviewed-on: https://chromium-review.googlesource.com/320892 Commit-Ready: Bryan Freed <bfreed@chromium.org> Tested-by: Bryan Freed <bfreed@chromium.org> Reviewed-by: Duncan Laurie <dlaurie@chromium.org>
* Port to musl: musl doesn't have execinfo.h.Doug Evans2016-01-072-0/+20
| | | | | | | | Change-Id: Idc2f18880581d3a2e67185becee8b77cfa5cdf04 Reviewed-on: https://chromium-review.googlesource.com/313388 Commit-Ready: Doug Evans <dje@google.com> Tested-by: Doug Evans <dje@google.com> Reviewed-by: Randall Spangler <rspangler@chromium.org>
* vboot: Change VbExEc implementations to support RO updateMary Ruthven2016-01-064-44/+50
| | | | | | | | | | | | | | | | | This change will be used to support EC-RO software sync by allowing for access to the readonly region of firmware. Currently only the writable section is accessed by vboot using VB_SELECT_FIRMWARE_A and B. BUG=chrome-os-partner:48703 BRANCH=none TEST=built on jerry and check that the RO hash can be read and the image can be updated. CQ-DEPEND=CL:319185,CL:320425,CL:320598 Change-Id: Ic3942d86b65da3123798cfd11a78056f5dab6699 Signed-off-by: Mary Ruthven <mruthven@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/319213 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* Include <fcntl.h> instead of <sys/fcntl.h>.Doug Evans2016-01-061-1/+1
| | | | | | | | | | | | Musl complains about using sys/fcntl.h, and with -Werror that gives a compilation failure. Every other file includes <fcntl.h> so just use that. Change-Id: Ibc743bbe335e9e9b91da7e4eacc01cc80cd8b35a Reviewed-on: https://chromium-review.googlesource.com/313419 Commit-Ready: Doug Evans <dje@google.com> Tested-by: Doug Evans <dje@google.com> Reviewed-by: Nam Nguyen <namnguyen@chromium.org>
* Use ${WERROR} consistently.Doug Evans2016-01-061-1/+1
| | | | | | | | Change-Id: I37b414b030cc69fab2b4feec70b55297dcd5fdb7 Reviewed-on: https://chromium-review.googlesource.com/313198 Commit-Ready: Doug Evans <dje@google.com> Tested-by: Doug Evans <dje@google.com> Reviewed-by: Bill Richardson <wfrichar@chromium.org>
* vboot2: Add try RO software sync flagMary Ruthven2016-01-069-1/+32
| | | | | | | | | | | | | | This flag will be used by the firmware updater to indicate that RO software sync should be attempted. BUG=chrome-os-partner:48703 BRANCH=None TEST=make runtests Change-Id: I42090ac47da45c724e66334648ab447ad3c21178 Signed-off-by: Mary Ruthven <mruthven@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/320621 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* Move default target up so it's really the default.stabilize-smaug-7800.Bstabilize-7797.BDoug Evans2015-12-161-7/+10
| | | | | | | | | | | | The line ${FUTIL_BIN}: ${UTILLIB21} was changing the default. Change-Id: I7988af498c9a9a1981cf2485e4f9d3496412f133 Reviewed-on: https://chromium-review.googlesource.com/313245 Commit-Ready: Bill Richardson <wfrichar@chromium.org> Tested-by: Bill Richardson <wfrichar@chromium.org> Reviewed-by: Bill Richardson <wfrichar@chromium.org>
* Test sha-256 with multiple odd-length updatesRandall Spangler2015-12-161-0/+17
| | | | | | | | | | | | | | | | | This verifies that the VB2 sha-256 library can handle odd-length updates. The expected digest was generated from: echo -n 'test1test2test3' | sha256sum BUG=None BRANCH=None TEST=make runtests Change-Id: Ia7d57322a1a4b10e718c47f1dae38ed244cf8ebc Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/318363 Reviewed-by: Aaron Durbin <adurbin@chromium.org>
* Add BDB libraryRandall Spangler2015-12-1624-0/+3195
| | | | | | | | | | | | | | | | This is a standalone library for verifying the BDB structures in the common boot flow document, and a bdb_create utility to create test BDB structures. Eventually, creating these structures will be rolled into futility. BUG=chrome-os-partner:48448 BRANCH=none TEST=cd bdb && make runtests Change-Id: Ic57c26ca84137205da3b6c7d532f5324c93b4285 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/317275 Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
* add error code for screen drawing failurestabilize-smaug-7731.Bstabilize-7729.BDaisuke Nojiri2015-12-031-0/+2
| | | | | | | | | | | | | This patch adds error code for screen drawing failure. BUG=none BRANCH=tot TEST=Tested on Glados Change-Id: I04b349fd2c0bc539338b7ee27b8fa9544c85c873 Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/315257 Reviewed-by: Aaron Durbin <adurbin@chromium.org>
* Fix error message for VbGbbReadBmpHeaderDaisuke Nojiri2015-12-031-1/+1
| | | | | | | | | | | BUG=none BRANCH=tot TEST=Tested on Jerry Change-Id: I1ecfd28b4c694e4aa531ed0e77219b2160509bd0 Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/313744 Reviewed-by: Aaron Durbin <adurbin@chromium.org>
* sign_official_build: add a fallback key for standalone accessoriesfactory-glados-7657.BVincent Palatin2015-11-171-0/+6
| | | | | | | | | | | | | | | | | | | The standalone accessories are using a key name like this: key_<product>.pem or key_<product>.vbprik2 when it doesn't exist, fallback using key.pem or key.vbprik2. BRANCH=none BUG=chrome-os-partner:47557 TEST=manual: ./scripts/image_signing/sign_official_build.sh accessory_usbpd ../ec/build/zinger/ec.bin tests/devkeys-acc /tmp/ec-zinger.TEST.SIGNED.bin ./scripts/image_signing/sign_official_build.sh accessory_rwsig ../ec/private/build/hadoken/keyboard_app.bin tests/devkeys-acc /tmp/ec-hadoken.TEST.SIGNED.bin ./scripts/image_signing/sign_official_build.sh accessory_rwsig ../ec/private/build/hadoken/keyboard_app.bin /tmp /tmp/ec-hadoken.TEST.SIGNED.bin Change-Id: I68863664bdb9da1695e91b1986f3a0148af7da26 Reviewed-on: https://chromium-review.googlesource.com/312836 Commit-Ready: Vincent Palatin <vpalatin@chromium.org> Tested-by: Vincent Palatin <vpalatin@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org>
* Give more screen control to vboot_draw_screenDaisuke Nojiri2015-11-171-6/+23
| | | | | | | | | | | | | | | | New devices have Depthcharge render vboot screens by calling vboot_draw_screen. Thus, display initialization and backlight control should not be duplicated. This patch prevents VbDisplayScreen from initializing display and controlling backlight when vboot is rendering screens using GBB. BUG=chrome-os-partner:43706,chromium:502066 BRANCH=tot TEST=Tested on Glados Change-Id: I50cd2decb7065af96779601b12f0fbf2554ff6ed Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/312749 Reviewed-by: Aaron Durbin <adurbin@chromium.org>
* crossystem: Remove savedmem_base and savedmem_size fieldsstabilize-7647.74.Bstabilize-7647.72.Bstabilize-7647.32.Bstabilize-7628.Brelease-R48-7647.BJulius Werner2015-11-092-18/+0
| | | | | | | | | | | | | | | | | | | I don't even know what this is. It seems to have marked some kind of debug buffer provided by H2C BIOS on pre-Daisy Chromebooks and has not been touched since it was copied in here when crossystem was first added. I can't find any references in our codebase so I doubt anybody would miss it. Let's remove it so the '(error)' fields returned there on any modern Chromebook stop confusing our vendors. BRANCH=None BUG=chromium:551715 TEST=Built for Falco and Jerry. Change-Id: Ie2baec536b50bb192eb4cd3e48df212cce53561a Signed-off-by: Julius Werner <jwerner@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/311346 Reviewed-by: Randall Spangler <rspangler@chromium.org> Reviewed-by: Bernie Thompson <bhthompson@chromium.org>
* crossystem: Remove platform_family fieldJulius Werner2015-11-093-116/+0
| | | | | | | | | | | | | | | | | This field doesn't seem to be used for anyone and it keeps adding work for people trying to bring up new platforms. If we ever needed something like this again, we'd probably prefer to have it in mosys now anyway. Let's get rid of it. BRANCH=None BUG=chromium:551715 TEST=Built for Falco and Jerry. Change-Id: I6b96e255968fdd22a345d4a75bfdc1e79d3f5896 Signed-off-by: Julius Werner <jwerner@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/311345 Reviewed-by: Randall Spangler <rspangler@chromium.org> Reviewed-by: Bernie Thompson <bhthompson@chromium.org>
* Update accessories test keys locationVincent Palatin2015-11-034-0/+4
| | | | | | | | | | | | | | | Move around the test keys used for standalone accessories signing unittesting, so they are easier to use. BRANCH=smaug, samus BUG=chrome-os-partner:46635 TEST=run cros-signing unittests (./signing_unittests.py) Change-Id: I02fcf444ec76bf6ebf6eb477e1236869aa877210 Reviewed-on: https://chromium-review.googlesource.com/309967 Commit-Ready: Vincent Palatin <vpalatin@chromium.org> Tested-by: Vincent Palatin <vpalatin@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org>
* vboot: Add GBB flag to turn on serial outputMary Ruthven2015-11-033-0/+6
| | | | | | | | | | | | | | Currently this does nothing. This will eventually be used to enable serial output. BUG=chromium:210230 BRANCH=none TEST=none Change-Id: I5c25fd7406e30b96d12bc4bf8210d3c3f4ae79f1 Signed-off-by: Mary Ruthven <mruthven@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/309716 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* vboot_api_kernel: Add new EcVbootDone APIShawn Nematbakhsh2015-10-293-0/+23
| | | | | | | | | | | | | | | | | | | Add a new post-EC software sync API VbExEcVbootDone() to take actions which normally need to happen after EC verification / sysjump. BUG=chromium:537269 TEST=Manual on Glados. Set CHG_MW thresh to 20000, BAT_PCT to 50. Verify that LIMIT_POWER host event is set until Zinger negotiates to 20V. Also verify that we do not proceed with boot when Donette is plugged. BRANCH=None CQ-DEPEND=CL:307885,CL:309523 Change-Id: I77e6000aa8a44e3aca4fb5982e5b5f5191774989 Signed-off-by: Shawn Nematbakhsh <shawnn@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/307952 Commit-Ready: Shawn N <shawnn@chromium.org> Tested-by: Shawn N <shawnn@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
* sign_official_build: fix support for signing standalone accessoriesVincent Palatin2015-10-294-2/+29
| | | | | | | | | | | | | | | | | My previous patch using futility to re-sign standalone accessory firmware images had a mistake in the key directory path : fix it. Also add RSA-2048 'accessory' keys for signer unit testing. BRANCH=smaug, samus BUG=chrome-os-partner:46635 TEST=run cros-signing unittests (./signing_unittests.py) Change-Id: Ia2f641c85337c67f81968be4730643a6ad5f22cf Reviewed-on: https://chromium-review.googlesource.com/309530 Commit-Ready: Vincent Palatin <vpalatin@chromium.org> Tested-by: Vincent Palatin <vpalatin@chromium.org> Reviewed-by: Bill Richardson <wfrichar@chromium.org>
* VbVerifyMemoryBootImage: Allow integrity-only check in dev mode withFurquan Shaikh2015-10-282-3/+32
| | | | | | | | | | | | | | | | | | | FASTBOOT_FULL_CAP set This change allows developers to boot dev-signed boot images in unlocked mode if DEV_BOOT_FASTBOOT_FULL_CAP is set in VbNvStorage or GBB_FLAG_FORCE_DEV_BOOT_FASTBOOT_FULL_CAP is set. BUG=chrome-os-partner:47002 BRANCH=None TEST=Compiles successfully. make -j runtests Change-Id: I56e3879594da1b57051dfe242ff347ac970c96bb Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/309606 Commit-Ready: Furquan Shaikh <furquan@chromium.org> Tested-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Aaron Durbin <adurbin@chromium.org>
* sign_official_build: add support for signing standalone accessoriesVincent Palatin2015-10-271-0/+10
| | | | | | | | | | | | | | | | | | | | | | Use futility to re-sign standalone accessory firmware images either the former "usbpd1" used by USB Power Delivery firmware generated from the EC codebase or the new "rwsig" format. BRANCH=smaug, samus BUG=chrome-os-partner:46635 TEST=manual: openssl genrsa -F4 -out key_zinger.pem 2048 openssl genrsa -F4 -out key_hadoken.pem 2048 futility create --desc="Hadoken fake MP key" key_hadoken.pem key_hadoken ./scripts/image_signing/sign_official_build.sh accessory_usbpd build/zinger/ec.bin . build/zinger/ec.SIGNED.bin ./scripts/image_signing/sign_official_build.sh accessory_rwsig build/hadoken/keyboard_app.bin . build/hadoken/keyboard_app.SIGNED.bin and compare the re-signed files with the original files. Change-Id: I586ba3e4349929782e734af1590f394824e7dd44 Reviewed-on: https://chromium-review.googlesource.com/306795 Commit-Ready: Vincent Palatin <vpalatin@chromium.org> Tested-by: Vincent Palatin <vpalatin@chromium.org> Reviewed-by: Bill Richardson <wfrichar@chromium.org>
* Save recovery reason before user three-finger-salutesDaisuke Nojiri2015-10-262-22/+48
| | | | | | | | | | | | | | | | When a user hits esc+refresh+power to start recovery, the true recovery reason will be lost after reboot. (It would always look like VB2_RECOVERY_RO_MANUAL.) This patch makes VbBootRecovery save the reason in the subcode area before entering the new 'broken' loop. BUG=chromium:501060 BRANCH=tot TEST=test_that -b veyron_jerry suite:faft_bios Change-Id: Ib536daa0633721bfc975381782d348f122b3d337 Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/307586 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* Add VbExGetLocalizationCountDaisuke Nojiri2015-10-203-5/+21
| | | | | | | | | | | | | | | | | | | VbExGetLocalizationCount is a callback function which is supposed to return the number of screen locales supported by VbExDisplayScreen. After this change, we still try to get the number of locales from GBB first but when it fails, VbExGetLocalizationCount is called. The error code from VbGbbReadBmpHeader will be masked, similarly to the error from VbDislayScreenFromGBB. BUG=chromium:502066 BRANCH=tot TEST=Tested on Samus. make runtests Change-Id: I04ef8bf1ea02b1aaa05e65673b57bcea1932d8b0 Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/304376 Reviewed-by: Aaron Durbin <adurbin@chromium.org>
* futility: add support for .pem with public keystabilize-smaug-7566.BVincent Palatin2015-10-178-21/+109
| | | | | | | | | | | | | | | | | | | | | Add support for PEM file containing a RSA Public key in futility "show" and "create" commands. When "futility create" is given a PEM file with only a RSA public key, generate the proper .vbpubk2 rather than failing. BRANCH=smaug BUG=none TEST=make runtests and run manually futility show tests/testkeys/key_rsa4096.pub.pem futility show tests/testkeys/key_rsa4096.pem Change-Id: I707ceca54c80ba21f53869ad86c86fa23b31e665 Reviewed-on: https://chromium-review.googlesource.com/306683 Commit-Ready: Vincent Palatin <vpalatin@chromium.org> Tested-by: Vincent Palatin <vpalatin@chromium.org> Reviewed-by: Bill Richardson <wfrichar@chromium.org>
* futility: fix segfault on short filesVincent Palatin2015-10-173-1/+4
| | | | | | | | | | | | | | | | | | | | | | | Verify the size of the buffer read from the file before trying to use 1KB of it for the new rwsig format detection. Add a new test case with a short file containing only 4 bytes of unknown data and run "futility show" on it. BRANCH=smaug BUG=none TEST=futility show foobar.pub.pem where foobar.pub.pem is a 451-byte file. check that "make runtests" passes with the fix and fails without it with the following message : test_file_types.sh ... failed FAIL: 13 / 14 passed Change-Id: Ia9d68c6b528c2b3a595ea6791c907374616d051f Reviewed-on: https://chromium-review.googlesource.com/306682 Commit-Ready: Vincent Palatin <vpalatin@chromium.org> Tested-by: Vincent Palatin <vpalatin@chromium.org> Reviewed-by: Bill Richardson <wfrichar@chromium.org>
* futility: Revised support for RO+RW firmwareBill Richardson2015-10-156-179/+223
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The "rwsig" type is used for independent device firmware (not Chromebook BIOS) that need to verify themselves instead of using software sync. The expected use case is that a RO firmware contains a vb2_public_key struct along with an FMAP or other pointers to a slot for RW firmware. The RW firmware slot reserves room for a vb2_signature struct. This CL changes the args and behavior of the rwsig type, so that the RW firmware can be [re]signed independently of the rest of the image. BUG=chrome-os-partner:46254 BRANCH=smaug,ToT TEST=make runtests, manual Create a keypair: futility create --desc "Key One" tests/testkeys/key_rsa2048.pem foo Sign a RW binary and build a complete image out of the parts: futility sign --type rwsig --prikey foo.vbprik2 rw.bin sig.bin dd if=/dev/zero bs=65536 count=1 of=image.bin dd if=rw.bin of=image.bin conv=notrunc dd if=sig.bin bs=$((65536 - 1024)) seek=1 of=image.bin conv=notrunc Verify both the separate parts and the combined image: futility show --type rwsig --pubkey foo.vbpubk2 rw.bin sig.bin futility show --type rwsig --pubkey foo.vbpubk2 image.bin Re-sign the combined image with a different keypair: futility create --desc "Key Two" tests/testkeys/key_rsa1024.pem bar futility sign --type rwsig --prikey bar.vbprik2 image.bin Now the first key no longer verifies: futility show --type rwsig --pubkey foo.vbpubk2 image.bin But the second key does: futility show --type rwsig --pubkey bar.vbpubk2 image.bin Change-Id: Ifdddab08f218f506eb1dce28851b153d70140a7b Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/305980 Tested-by: Vincent Palatin <vpalatin@chromium.org> Reviewed-by: Vincent Palatin <vpalatin@chromium.org>
* Revert "image_signing: use sparse partition extraction"Mike Frysinger2015-10-151-1/+1
| | | | | | | | | | | | | | | | | | This reverts commit 82dec09bd5098715ddf9cd7d2e4abe87606d5249. This flag doesn't exist on Ubuntu Precise which is what the signers are running atm. Until we get them upgraded to Trusty, back this change out. BUG=chromium:530730 TEST=`./signing_unittests.py` passes BRANCH=None Change-Id: I9ba508c1531dbb169fd020d06ab102f6576b7342 Reviewed-on: https://chromium-review.googlesource.com/306310 Commit-Ready: Mike Frysinger <vapier@chromium.org> Tested-by: Mike Frysinger <vapier@chromium.org> Reviewed-by: Amey Deshpande <ameyd@google.com>
* Pass locale to VbExDisplayScreenDaisuke Nojiri2015-10-155-9/+11
| | | | | | | | | | | | | | | This change makes VbDisplayScreen read the last saved locale from nvram and pass it to VbExDisplayScreen so that it can draw locale dependent screens. BUG=chromium:502066 BRANCH=tot TEST=Tested on Samus. make runtests. CQ-DEPEND=CL:304382,CL:306100,CL:306110 Change-Id: I9782ec5a8a9f8393998aa8a0d64e88ad1809233b Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/304375
* futility: Support for signing RO+RW firmwarestabilize-smaug-7547.BBill Richardson2015-10-137-4/+282
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds the "rwsig" type, with initial support for RO+RW firmware images that need to verify themselves instead of using software sync. This uses our vb2 structs instead of raw binary blobs. That will help us locate, identify, and verify the keys and signatures in the signed firmware images. BUG=chrome-os-partner:46254 BRANCH=smaug,ToT TEST=make runtests I also hacked up a test board with the EC-side signature verification routines from a preliminary CL and tested this signing scheme with that. It works. Additional work is needed to make this seamless, but you can try it out like so: futility create ./tests/testkeys/key_rsa2048.pem foo futility sign --type rwsig --prikey foo.vbprik2 --pubkey foo.vbpubk2 ec.bin Change-Id: I876ab312a2b0b36411c5f739fe3252529728d034 Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/305394 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* Add NV flag to default boot legacy OSMary Ruthven2015-10-1317-22/+205
| | | | | | | | | | | | | | | | In developer mode, this option will make the system try to boot into a legacy OS first after the 30 second timeout. This removes the need to press a key during boot to try legacy mode and the need to remove the write protect screw to boot legacy as default. BUG=chromium:310697 BRANCH=none TEST=make runtests Change-Id: I9a9f64c14ad015e21d08eec36e8fc187189cd2f2 Signed-off-by: Mary Ruthven <mruthven@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/304077 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* Add broken screenDaisuke Nojiri2015-10-126-87/+28
| | | | | | | | | | | | | | | | | In the new recovery process, a user will see 'broken' screen instead of 'remove' screen, where usb stick presence is no longer detected. A user instead has to hit esc+refresh+power to proceed to recovery mode. BUG=chromium:501060 BRANCH=tot TEST=make runtests Change-Id: Icd511c1ca892628b96befbb0a34c2c84b881c857 Reviewed-on: https://chromium-review.googlesource.com/304404 Commit-Ready: Daisuke Nojiri <dnojiri@chromium.org> Tested-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
* recovery: Add recovery reason for fastboot mode requested inFurquan Shaikh2015-10-083-0/+7
| | | | | | | | | | | | | | | | | | | | user-mode. BUG=chrome-os-partner:42674 BRANCH=None TEST=Compiles successfully and behavior verified. Change-Id: I67ec056f28596dd0c0005a54e454abe1b4104cfb Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/294276 Trybot-Ready: Furquan Shaikh <furquan@chromium.org> Tested-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Aaron Durbin <adurbin@chromium.org> Commit-Queue: Furquan Shaikh <furquan@chromium.org> (cherry picked from commit 6d9a9a9fdd3bcdadbfc4f44640da4c462803a69d) Reviewed-on: https://chromium-review.googlesource.com/304673 Commit-Ready: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
* signer: update legacy bootloader templates after image signingstabilize-7520.67.Bstabilize-7520.63.Bstabilize-7520.49.Brelease-R47-7520.BAmey Deshpande2015-10-032-11/+81
| | | | | | | | | | | | | | | | | | | | | Specifically, this patch updates 'root_hexdigest' in legacy bootloader templates in EFI system partition to match the signed rootfs. BRANCH=None BUG=chromium:512940 TEST=Ran sign_official_build.sh locally and booted the image on kvm (using BIOS). TEST=Ran signing_unittests.py by locally changing vboot_stable_hash to include this patch. $ ./sign_official_build.sh base chromiumos_base_image.bin \ ../../tests/devkeys chromiumos_base_image_signed.bin Change-Id: Ied021c4464b113a64508f5081605069bdcecbc1f Reviewed-on: https://chromium-review.googlesource.com/301742 Commit-Ready: Amey Deshpande <ameyd@google.com> Tested-by: Amey Deshpande <ameyd@google.com> Reviewed-by: Mike Frysinger <vapier@chromium.org>
* futility: Add show capability for usbpd1 imagesBill Richardson2015-09-256-39/+346
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The firmware for the USB Type-C power adapters uses raw binary blobs for the public keys and signatures instead of readily-identifiable structs. We've been able to sign these firmware images for some time, but verifying the result generally required testing them on hardware. This CL adds some futilty support for recognizing and verifying those images too. It just tries various sig and hash algorithms, until it finds a combination for which the image is self-consistent (where the pubkey blob verifies the signature blob). BUG=none BRANCH=none TEST=make runtests This change also adds additional tests for usbpd1 images. We ensure that we correctly recognize and verify an MP-signed firmware, plus test signing and verifying usbpd1 images using multiple signature and hash algorithms. Change-Id: I4fbe8b37a694992f635d5469ae1c2449b1610dfd Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/302415 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* vboot: Move GPT entry operator functions to gpt_miscFurquan Shaikh2015-09-232-9/+9
| | | | | | | | | | | | | | | | | | This is to allow external entities using vboot library (e.g. depthcharge) to utilize these operator functions to perform get / set operations on GPT entry. BUG=chrome-os-partner:45670 BRANCH=None TEST=Compiles successfully "sudo emerge vboot_reference" "emerge-smaug vboot_reference". "make -j runtests" successful. Change-Id: I9e34a2a7afeae6293a78424794797d5755950888 Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/301475 Commit-Ready: Furquan Shaikh <furquan@chromium.org> Tested-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
* vboot2: tpm error doesn't block gbb dev flagRandall Spangler2015-09-224-64/+153
| | | | | | | | | | | | | | | | | | In recovery mode, the TPM may be bad / corrupt. This prevents access to the soft developer switch stored in secdata. But it should not prevent setting dev mode via GBB or context flags. Those flags may be set during manufacturing or testing, and override the contents of secdata anyway. BUG=chrome-os-partner:45511 BRANCH=ryu TEST=make runtests Change-Id: I242714528203cc7cf78a714c660b7f8bbd0e04d0 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/300621 Commit-Ready: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Furquan Shaikh <furquan@chromium.org>
* sign_official_build: support signing 'recovery_kernel' image typeFurquan Shaikh2015-09-171-0/+31
| | | | | | | | | | | | | | | BRANCH=None BUG=chrome-os-partner:44227 TEST='sign_official_build.sh recovery_kernel boot.img keys boot.img.recovery-signed' works fine and able to boot in locked recovery mode using fastboot boot. Change-Id: Iabde28bb2068b8294fc3d03f2f771c63368ecbb5 Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/300250 Commit-Ready: Furquan Shaikh <furquan@chromium.org> Tested-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: David Riley <davidriley@chromium.org>
* vboot2: Support reboot requested by secdataRandall Spangler2015-09-1713-4/+148
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a TPM goes from the disabled state to the enabled state, it must reboot after being enabled, before it can be initialized. In vboot1, TLCL was part of vboot and this was handled internally. In vboot2, the caller must set a context flag, so that vboot can decide whether to allow the reboot, or whether to go directly to recovery mode. This check is necessary to handle the following cases: 1) The device is booting normally, but the TPM needs a reboot. This should simply reboot, without going to recovery mode. 2) The device is booting in recovery mode, but the TPM needs a reboot. If this is the first time it asked us, allow the reboot. 3) The TPM asked for a reboot last time, so we did. And it's still asking. Don't reboot, because that runs the risk that whatever is wrong won't be fixed next boot either, and we'll get stuck in a reboot loop that will prevent recovery. Boot into recovery mode. Add a new NvStorage bit to track whether the TPM requested a reboot on the previous boot. That's better than what we did in vboot1, where we used a special recovery request. Vboot1 couldn't track getting stuck in a reboot loop in normal mode, only in recovery mode. The new code can catch both. BUG=chrome-os-partner:45462 BRANCH=ryu TEST=make runtests Change-Id: I2ee54af107275ccf64a6cb41132b7a0fc02bb983 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/300572 Tested-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
* crossystem: Updated crossystem to accomodate AndroidShelley Chen2015-09-141-4/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | (resubmit) Previously crossystem assumed that mosys was located in /usr/sbin. In Android mosys is currently located in /system/bin. Using fixed paths as opposed to 'which' to prevent attacks where attacker could insert mosys in PATH. difference from previous commit: Removed the allocation of duplicate arrays. Kept with simplicity of original version, just returning correct constant depending on detected platform. BUG=chromium:527484 BRANCH=none TEST=ran crossystem, crossystem fw_try_count/ fw_try_next, crossystem fw_try_count/fw_try_next=x on smaug and daisy. Change-Id: I923206db1411a9a35c9c8e3f9ede5016f49b5f26 Signed-off-by: Shelley Chen <shchen@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/299801 Reviewed-by: danny chan <dchan@chromium.org>
* image_signing: use sparse partition extractionMike Frysinger2015-09-111-1/+1
| | | | | | | | | | | | | | | | | | | | Often the partitions we extract have extra space in them, but the dd utility will still write out the excess zeros. That can mean we write out hundreds of megs of data which could otherwise be skipped. We thus waste a good amount of I/O and storage. For now, only use this flag when extracting a partition to a new file as this should be safe (there's no pre-existing data to clobber/merge). BUG=chromium:530730 TEST=`./signing_unittests.py` passes BRANCH=None Change-Id: Ic32665cf7c38fc0a5efc3f8b227fa8ff408ca9e3 Reviewed-on: https://chromium-review.googlesource.com/299450 Commit-Ready: Mike Frysinger <vapier@chromium.org> Tested-by: Mike Frysinger <vapier@chromium.org> Reviewed-by: David Riley <davidriley@chromium.org>
* image_signing: use sparse copying when creating the signed imageMike Frysinger2015-09-111-1/+1
| | | | | | | | | | | | | | | | | | This should speed up the copies significantly by using less disk storage & I/O when the unpacked file is not sparse already. This option has been in cp for a long time, and works in Ubuntu Precise (coreutils-8.13) & Trusty (coreutils-8.21). BUG=chromium:530730 TEST=`./signing_unittests.py` passes BRANCH=None Change-Id: I82192455a623eabf96abf4f25296f3dc0c129ca2 Reviewed-on: https://chromium-review.googlesource.com/299440 Commit-Ready: Mike Frysinger <vapier@chromium.org> Tested-by: Mike Frysinger <vapier@chromium.org> Reviewed-by: David Riley <davidriley@chromium.org> Reviewed-by: Amey Deshpande <ameyd@google.com>
* image_signing: do not delete output when signing loem firmwareMike Frysinger2015-09-101-2/+1
| | | | | | | | | | | | | | | Rather than use the existence of the output as a marker for running the gbb step, key off the loem index. We want to run it the first time and not bother after that. BUG=chrome-os-partner:44227 BRANCH=None TEST=signer can still sign loem keysets Change-Id: I26e9ccaf1333f769d6993a8e0d84c63644bb2597 Reviewed-on: https://chromium-review.googlesource.com/298980 Reviewed-by: David Riley <davidriley@chromium.org> Tested-by: Mike Frysinger <vapier@chromium.org>
* signer: create devkeys with and without pkcstabilze-7441.Bstabilize-7442.BDavid Riley2015-09-0829-0/+4
| | | | | | | | | | | | | | | Signing test of firmware for non-t210 targets fails when PKC keys are present so separate devkeys into two keysets where only one has the PKC key. BUG=chrome-os-partner:44227 TEST=sign_official_build.sh nv_lp0_firmware tegra_lp0_resume.fw tests/devkeys-pkc tegra_lp0_resume.fw.signed versions.default BRANCH=signer Change-Id: Ie0670638d30d17692f1113b5a9f0309ea610d72a Signed-off-by: David Riley <davidriley@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/298091 Reviewed-by: Mike Frysinger <vapier@chromium.org>
* keygeneration: fix some portability aspectsMike Frysinger2015-09-081-3/+5
| | | | | | | | | | | | | | | | | The "function" keyword is not portable -- use the normal function style. The awk command uses a non-portable regex (the word anchor \>). Rework it to avoid regexes entirely. BUG=chromium:475101 TEST=keyset_version_check.sh works on a POSIX system BRANCH=None Change-Id: I5446f63aa9181d06da1898aafb8fab17f5042989 Reviewed-on: https://chromium-review.googlesource.com/296562 Commit-Ready: Mike Frysinger <vapier@chromium.org> Tested-by: Mike Frysinger <vapier@chromium.org> Reviewed-by: David Riley <davidriley@chromium.org>
* signer: Add signing support for nvidia lp0 firmware from signerDavid Riley2015-09-082-5/+34
| | | | | | | | | | | | | | Signer was calling sign_official_build.sh in a manner that wasn't being accepted correctly. Also add test keys from firmware branch. BUG=chrome-os-partner:44227 TEST=sign_official_build.sh nv_lp0_firmware tegra_lp0_resume.fw tests/devkeys tegra_lp0_resume.fw.signed versions.default BRANCH=signer Change-Id: Icd298ac75e3da746220826dc2fb9cc2466e41f1d Signed-off-by: David Riley <davidriley@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/297802 Reviewed-by: Furquan Shaikh <furquan@chromium.org>
* image_signing: rework input/output files and firmware signingMike Frysinger2015-09-042-6/+2
| | | | | | | | | | | | | | | | | The new nvidia logic expects to have the "real" output filename and not yet another temp path. Since sign_firmware.sh supports being passed in the input as the output and doing in-place signing, just document it and update the callers. BUG=chrome-os-partner:44227 BRANCH=None TEST=signer outputs pubkey.sha to the same location as the output firmware Change-Id: Iadc5dc5aaace6be9e22ff2c55bfbc58b7e1b3ef0 Reviewed-on: https://chromium-review.googlesource.com/296574 Commit-Ready: Mike Frysinger <vapier@chromium.org> Tested-by: Mike Frysinger <vapier@chromium.org> Reviewed-by: David Riley <davidriley@chromium.org>
* signer: Add signing support for nvidia lp0 firmwareFurquan Shaikh2015-09-012-0/+32
| | | | | | | | | | | | | BUG=chrome-os-partner:44227 BRANCH=None TEST=unittests run fine. Change-Id: I7d623a22d73a1749ebebd323fe09cbbeb8cbd61e Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/296429 Commit-Ready: Furquan Shaikh <furquan@chromium.org> Tested-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org>
* sign_firmware: Add nv_pkc_signing step if requiredFurquan Shaikh2015-09-012-0/+76
| | | | | | | | | | | | | | | | If nv_pkc.pem file is present for a device, use nv_pkc_signing for adding PKC signature in the firmware image. BUG=chrome-os-partner:44227 BRANCH=None TEST=unittests run fine. verified image boots on fused system. Change-Id: I9b2f48da55137a0e4a75f23d16d3779be1aa94c8 Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/296452 Commit-Ready: Furquan Shaikh <furquan@chromium.org> Tested-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org>
* VBOOT2: Add work buffer too small error messageLee Leahy2015-08-271-1/+3
| | | | | | | | | | | | | | | Update VBOOT2 to add work buffer too small error message. BRANCH=none BUG=None TEST=Build and run on kunimitsu Change-Id: Icb4b873e0c350a5667948e106c111356acab6a82 Signed-off-by: Lee Leahy <Leroy.P.Leahy@intel.com> Reviewed-on: https://chromium-review.googlesource.com/295753 Commit-Ready: Leroy P Leahy <leroy.p.leahy@intel.com> Tested-by: Leroy P Leahy <leroy.p.leahy@intel.com> Reviewed-by: Aaron Durbin <adurbin@chromium.org>
View Lorry Controller Status