summaryrefslogtreecommitdiff
path: root/firmware/lib/rollback_index.c
Commit message (Collapse)AuthorAgeFilesLines
* vboot/secdata: fix up macros in rollback_index.cJoel Kitching2019-09-051-10/+6
| | | | | | | | | | | | | | | | Remove the unnecessary offsetof declaration in rollback_index.c, and fix some macro formatting. BUG=b:124141368, chromium:972956 TEST=make clean && make runtests BRANCH=none Change-Id: I156a0561070e03f978fff307d3dbfafde09e0adf Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1773093 Commit-Queue: Joel Kitching <kitching@chromium.org> Tested-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
* vboot/secdata: rename secdata and secdatakJoel Kitching2019-08-311-10/+10
| | | | | | | | | | | | | | | | | | | | | | | For clarity's sake, rename: secdata -> secdata_firmware secdatak -> secdata_kernel secdata is now the general term to refer to any secure data spaces: firmware, kernel, and FWMP. Once coreboot code has been updated, the sections in 2api.h and 2constants.h may be removed. BUG=b:124141368, chromium:972956 TEST=make clean && make runtests BRANCH=none Change-Id: I376acee552e8be37c75c340626a95462f81e198b Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1773079 Reviewed-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org> Tested-by: Joel Kitching <kitching@chromium.org>
* vboot/secdata: remove DISABLE_ROLLBACK_TPM constantJoel Kitching2019-08-281-48/+0
| | | | | | | | | | | | | | | | | | | | | | | | | This constant triggered different implementations of the two functions RollbackFwmpRead and RollbackKernelLock, whose overridden implementation would then be relied on in various tests. Instead, directly override these functions within the tests where they are required. The overridden implementations were also used in utilities/load_kernel_test.c, but this utility is currently broken and not in active use. If we would like to get it working again, simply override these two functions directly in the C file, just as is done for unit tests. (See b:139839429.) BUG=b:124141368, chromium:972956 TEST=make clean && make runtests BRANCH=none Change-Id: I0a4d24ea4ae4182b7f4f258860de6f712dae1555 Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1765169 Tested-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org>
* vboot: fix up some headers, includes, comments, spacingJoel Kitching2019-08-281-1/+1
| | | | | | | | | | | | | BUG=b:124141368 TEST=make clean && make runtests BRANCH=none Change-Id: Id97f544da845f7070555e5e8cc6e782b2d45c300 Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1758151 Tested-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org>
* vboot/secdata: remove VbUnlockDevice functionJoel Kitching2019-08-281-0/+4
| | | | | | | | | | | | | | | | VbUnlockDevice is only used in fastboot. Currently fastboot "unlocking" is disabled (see CL:1757973). BUG=b:124141368, chromium:972956 TEST=make clean && make runtests BRANCH=none Change-Id: I0de44c2bb8d8150dafb0b73e7a0be6e63564a26b Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1758150 Tested-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org>
* vboot/secdata: move permissions and uid check to ReadSpaceKernelJoel Kitching2019-08-211-24/+19
| | | | | | | | | | | | | | | | | | Relocate permissions and uid check from RollbackKernelRead to ReadSpaceKernel. Restructure test code to set default values in ResetMocks. BUG=b:124141368, chromium:972956 TEST=make clean && make runtests BRANCH=none Change-Id: I72c536042b89684c6db5099412344678e3d9d920 Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1758146 Reviewed-by: Julius Werner <jwerner@chromium.org> Tested-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org>
* vboot/secdata: print secdata/secdatak on reads and writesJoel Kitching2019-08-211-0/+12
| | | | | | | | | | | | | | | | This makes it clear exactly when reads/writes are occurring, with what values. BUG=b:124141368, chromium:972956 TEST=make clean && make runtests BRANCH=none Change-Id: I614204cc19d2c90d2ac5799f136daf251a45e251 Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1728299 Tested-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
* vboot/secdata: fix up error reporting in rollback_index.cJoel Kitching2019-08-211-16/+42
| | | | | | | | | | | | | | | Every failure case should output some debug information. BUG=b:124141368, chromium:972956 TEST=make clean && make runtests BRANCH=none Change-Id: I0f178fa72f7e227b3abc22ac1b0d2df5ed4a6dc8 Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1738348 Reviewed-by: Joel Kitching <kitching@chromium.org> Tested-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org>
* vboot/secdata: remove legacy version checks on rollback spacesJoel Kitching2019-08-211-30/+4
| | | | | | | | | | | | | | | | | The code to deal with version < 2 rollback spaces has been around since 2013. Legacy devices will not be updating to this code, thus we can remove the legacy silent upgrade. BUG=b:124141368, chromium:972956 TEST=make clean && make runtests BRANCH=none Change-Id: I8ce22c37418ddc56cb74cc792540b54b3ee7bbd7 Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1727949 Reviewed-by: Joel Kitching <kitching@chromium.org> Tested-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org>
* vboot/secdata: rename identifier in RollbackFwmpRead for clarityJoel Kitching2019-08-141-12/+12
| | | | | | | | | | | | | | | | | | A union is used with a buffer and a pointer to the RollbackSpaceFwmp object in question. Rename `bf` to `fwmp` to reduce confusion between the two identifiers which are presumably both abbreviations for "buffer". BUG=b:124141368, chromium:972956 TEST=make clean && make runtests BRANCH=none Change-Id: I0cdd8fed77087ff36cc4ca74ec847e65398f8a6b Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1751062 Reviewed-by: Julius Werner <jwerner@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org> Tested-by: Joel Kitching <kitching@chromium.org>
* vboot/secdata: remove retries from rollback functionsJoel Kitching2019-08-131-156/+84
| | | | | | | | | | | | | | | | Assume that transport-layer communication to Cr50 is reliable. No need for retries on reads/writes, or verification after write. BUG=b:124141368, chromium:972956 TEST=make clean && make runtests BRANCH=none Change-Id: Ie57d1eeaa44c338bca289e371c516540aacf9437 Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1729713 Tested-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org>
* vboot: replace VBERROR_SUCCESS with VB2_SUCCESSJoel Kitching2019-08-131-1/+1
| | | | | | | | | | | | | | | | | Replace vboot1-style VBERROR_SUCCESS with VB2_SUCCESS (trivial change since both are equal values). BUG=b:124141368, chromium:988410 TEST=make clean && make runtests BRANCH=none Change-Id: I46e02471a031e9f36ec869d11d0b957d1c1b5769 Signed-off-by: Joel Kitching <kitching@google.com> Cq-Depend: chromium:1728114 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1722915 Commit-Queue: Joel Kitching <kitching@chromium.org> Tested-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
* vboot: update vboot2 functions to use new vb2_error_tJoel Kitching2019-08-131-1/+1
| | | | | | | | | | | | | | | | | | To make explicit when vboot2 error codes should be returned, use the new vb2_error_t type on all functions which return VB2_ERROR_* constants. BUG=b:124141368, chromium:988410 TEST=make clean && make runtests BRANCH=none Change-Id: Idd3ee8afe8c78347783ce5fa829cb78f1e5719e2 Signed-off-by: Joel Kitching <kitching@google.com> Cq-Depend: chromium:1728113, chromium:1728499 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1728292 Reviewed-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org> Tested-by: Joel Kitching <kitching@chromium.org>
* rollback_index: add newline to VB2_DEBUG callfirmware-kalista-11343.BJoel Kitching2018-12-031-1/+1
| | | | | | | | | | | BUG=None TEST=None Change-Id: I789caf6fd4410820b9a0c9ef4ed39ad4f4568737 Reviewed-on: https://chromium-review.googlesource.com/1354144 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Tested-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
* 2lib: add VB2_DEBUG_RAW() to print without function nameRandall Spangler2017-01-201-15/+14
| | | | | | | | | | | | | | | | | | | | | | | | Currently, VB2_DEBUG() will print the function name as a prefix to the debug output. Add VB2_DEBUG_RAW() to print without that, so that it's possible to print little bits of debug output. Use this in ec_sync to hex dump the hashes. And then clean up all of the debug calls which explicitly did things like: VB2_DEBUG("%s: foo", __func__); to just: VB2_DEBUG("foo"); so they don't double-print the function name BUG=chromium:683391 BRANCH=none TEST=build_packages --board=reef chromeos-firmware && DEBUG=1 make -j runtests CQ-DEPEND=CL:430978,CL:431111 Change-Id: I0c35519d2e670d55d65d01eaa60d61f3e3edf419 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/431171 Reviewed-by: Julius Werner <jwerner@chromium.org>
* firmware: replace VBDEBUG(()) macro with VB2_DEBUG()Randall Spangler2017-01-121-25/+27
| | | | | | | | | | | | | | | | The original VBDEBUG macro used doubly-nested parens to work with MSVC, which didn't support varargs in macros. We now only use more modern compilers, so replace it with the VB2_DEBUG macro and get rid of the ugly and fragile double parens. BUG=chromium:611535 BRANCH=none TEST=make runtests; build_packages --board=reef chromeos-firmware Change-Id: Ifc0cb0733b14daaa1fde095fab7da4215a538c77 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/425133 Reviewed-by: Shelley Chen <shchen@chromium.org>
* vboot: use vb2_crc8 instead of Crc8Randall Spangler2016-10-231-6/+7
| | | | | | | | | | | | | No need to have two implementations of this now. BUG=chromium:611535 BRANCH=none TEST=make runtests; emerge-kevin coreboot depthcharge Change-Id: Id3348eae80c5d85451981a44729164ff59f88648 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/399121 Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
* vboot: use standard memcmp, memcpy, memsetRandall Spangler2016-10-231-7/+7
| | | | | | | | | | | | | | Originally, we didn't trust the firmware to provide these functions from a standard library. Now, with coreboot, we do. BUG=chromium:611535 BRANCH=none TEST=make runtests; emerge-kevin coreboot depthcharge Change-Id: I4e624c40085f2b665275a38624340b2f6aabcf11 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/399120 Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
* vboot: Remove vboot1 init and select-firmware APIsRandall Spangler2016-07-261-380/+1
| | | | | | | | | | | | | | | | | | And nuke all the underlying code that is unused once those APIs are gone. These APIs are not used by any project in ToT, having been superseded last year by the vboot2 APIs. No functional changes to live code, just lots of deletes. CQ-DEPEND=CL:347414 BUG=chromium:611535 BRANCH=none TEST=make runtests; build samus Change-Id: I05ac752d74d1343dd03600b1c5e6ed22822e2802 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/347257
* vboot: Fix potential alignment issue reading FWMPRandall Spangler2016-07-221-10/+17
| | | | | | | | | | | | | | | | | | | | | RollbackFwmpRead() assumed that a uint8[] array on the stack would be aligned sufficiently for typecasting to struct RollbackSpaceFwmp and accessing its members. This was true on x86 (where unaligned accesses work fine) and probably harmless on other platforms (since RollbackSpaceFwmp is __attribute__(packed). But it's cleaner to switch to using a union of the buffer and struct, since that will provide the proper alignment. BUG=chromium:601492 BRANCH=baytrail and newer platforms TEST=make -j runtests Change-Id: I97077923ab5809c68510cbd382541bf2827aba6b Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/362087 Commit-Ready: Dan Shi <dshi@google.com> Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
* Stub tlcl implementation for tpm2 caseAndrey Pronin2016-07-151-0/+4
| | | | | | | | | | | | | | | | | | | Build a special version of TPM Lightweight Command Library in libvboot_host for TPM2. Create the framework for implementation, stub functions for now. libvboot_host is used by tpmc and other user-space utilities that talk directly to tpm bypassing trunks/trousers. BRANCH=none BUG=chrome-os-partner:54981 BUG=chrome-os-partner:55210 TEST=Boot on kevin, verify that 'tpmc read' works. Change-Id: I4cc41028041193041defc319687697eb9edb1f3e Reviewed-on: https://chromium-review.googlesource.com/358623 Commit-Ready: Andrey Pronin <apronin@chromium.org> Tested-by: Stephen Barber <smbarber@chromium.org> Tested-by: Andrey Pronin <apronin@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
* fix a compile flag typoVadim Bendebury2016-07-071-1/+1
| | | | | | | | | | | | | | The code guarded by this compilation flag is not supposed to kick in on gru/kevin, this is how the typo went unnoticed. BRANCH=none BUG=none TEST=kevin still boots into chrome os Change-Id: Ic12aacb7ad9b2361666e719a50597d3836d5212a Signed-off-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/358493 Reviewed-by: Julius Werner <jwerner@chromium.org>
* tpm2: simplify rollback checks.Vadim Bendebury2016-07-011-8/+21
| | | | | | | | | | | | | | | | | | | | On the systems using TPM2 this rollback index check will run only for the kernel space. This means that TPM initialization is guaranteed to be completed by the time this code runs. The exact ways of verifying the space settings and locking it are still being designed, this functionality is temporarily excluded in this patch. BRANCH=none BUG=chrome-os-partner:50645 TEST=with the rest of the patches applied kevin/gru boards boot into chrome OS with rollback counters read from/written to TPM2 Change-Id: Ie4e22886493404f538b2b3ae6f8c2bdca5f7ab22 Signed-off-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/356752 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* vboot: Fix FWMP link error if TPM is mockedRandall Spangler2016-05-111-2/+7
| | | | | | | | | | | | | | | | The MOCK_TPM build flag caused link to fail because RollbackFwmpRead() was missing its mock. BUG=chromium:601492 BRANCH=baytrail and newer platforms TEST=make -j runtests Hack makefile to add MOCK_TPM := 1 and make -j; no link errors. Change-Id: I3885d6b6c627bf475f4da33ef67f31aec2159799 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/343920 Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
* vboot: Add firmware management parametersRandall Spangler2016-05-081-1/+70
| | | | | | | | | | | | | | | | This adds RW firmware support for the optional firmware management parameters TPM space. System-level tests require CL:339262 to add cryptohome support. BUG=chromium:601492 BRANCH=baytrail and newer platforms TEST=make -j runtests Or better, COV=1 make, and then make sure all new code is covered. Change-Id: Ifaf644c80809552d5961615be6017c2a332a034b Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/339234
* vboot1: Lock TPM physical presence (kernel rollback) on legacy bootJulius Werner2015-05-121-3/+9
| | | | | | | | | | | | | | | | | | | Even though legacy boot is an unsafe mode that has to be manually initiated by the user, we should still lock the kernel TPM space to be consistent with existing developer mode practice. BRANCH=tbd BUG=chrome-os-partner:39999 TEST=Spent over an hour unsuccessfully trying to get SeaBIOS to boot a Chromium test image on my Falco. Decided that's not worth it an just tested the firmware side of this (pressing CTRL+L when legacy mode is enabled and disabled, multiple times, with and without GBB flag DEFAULT_DEV_BOOT_LEGACY). Change-Id: I3b02b59a9055431d222c0c7446de2cd7d2e0bb82 Signed-off-by: Julius Werner <jwerner@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/270181 Reviewed-by: Duncan Laurie <dlaurie@chromium.org>
* Use the TPM to back up some of the nvram fieldsBill Richardson2014-06-051-1/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We use a few bytes of battery-backed nvram to save some flags across reboots. However if the battery discharges completely, these flags are lost. There aren't any security issues with that since they reset to safe values, but some of the flags are used to configure how the system boots in dev-mode. If a dev-mode user has completely replaced ChromeOS with some other OS, then she often needs to set the dev_boot_usb and/or dev_boot_legacy flags as well in order to boot it using Ctrl-U or Ctrl-L. If the battery dies, then those flags are cleared, and the only way to make the Chromebook boot again is by going through recovery, which wipes the disk. This change uses a new NV space in the TPM to back up some of the nvram flags. These nvram fields will be backed up: block_devmode dev_boot_legacy dev_boot_signed_only dev_boot_usb fwupdate_tries loc_idx Because writing to the TPM space is slow and limited to an unspecified but finite number of cycles, we only back up the fields when specifically requested by the new backup_nvram_request flag. This flag will be set by crossystem whenever it is used to change any of the fields listed above. The backup will be attempted at the NEXT boot (because the TPM is locked after booting), and the backup_nvram_request flag will be cleared if the backup was successfull. Note that this CL is for Top of Trunk only. The firmware will create the required TPM spaces on systems that have never been booted, but we don't yet have a secure or reliable method to update existing systems. FYI, on Link, determining that the TPM's backup NV space doesn't exist adds about 6ms to the boot time. If it does exist, the backup_nvram_request flag is cleared automatically so it won't check until it's set again. BUG=chromium:362105 BRANCH=ToT (only!) TEST=manual Testing this is a long and involved process. Read on... First, there are host-side tests for it. In the chroot: cd src/platform/ec make runtests Second, to test on a completely NEW system that was first booted with a BIOS that contains this CL, do this: Enter dev-mode Use crossystem to set values for the fields listed above Confirm that "backup_nvram_request" is set to 1 Reboot Use crossystem to confirm that "backup_nvram_request" is now 0 Remove the battery and the AC Reattach either battery or AC so it will boot again Use crossystem to confirm that the backed up fields are still good, while the others have been reset to default values Switch to normal mode Remove the battery and the AC Reattach either battery or AC so it will boot again Look at the bios info in chrome://system to see what crossystem says Confirm that the dev_boot_* flags are all 0, while the others are restored Third, to set things up to test this on an existing system (I used Link), you have update the BIOS, delete both the Kernel and Firmware NV spaces in the TPM, then reboot so that the BIOS will create the Backup, Kernel, and Firmware spaces. It will only do that if they're all missing. Open it up, disable write-protect, attach a servo, etc. Switch to dev-mode, log in. Run make_dev_firmware.sh Reboot in recovery mode, and insert a USB stick with a test image on it. NOTE: In order to fiddle with the TPM, we'll *always* have to boot in recovery mode, since that's the only time the TPM is left unlocked. That's NOT the same as pressing Ctrl-U at the scary boot screen. The rest of these steps assume you've booted in recovery mode and are running from the test image on the USB stick. Run make_dev_ssd.sh --remove_rootfs_verification --recovery_key Reboot (recovery mode) Run mv /etc/init/tcsd.conf /etc/init/tcsd.conf.disabled Reboot (recovery mode). Run "tpmc getvf". It should say deactivated 0 disableForceClear 0 physicalPresence 1 physicalPresenceLock 0 bGlobalLock 0 Run "tpmc geto". It should say Owned: no Now you'll need to build the "tpm-nvtool" utility. In the chroot: cd src/third_party/tpm/nvtool make Copy that to the DUT, in /usr/local/bin. Now run tcsd tpm-nvtool --list | grep Index You may see a number of spaces, but you should at least see these: # NV Index 0x00001007 # NV Index 0x00001008 Run tpm_takeownership It will prompt you for two passwords (and confirm each one). Respond with something you can remember like "google". Run tpm-nvtool --release --index 0x1007 --owner_password "google" tpm-nvtool --release --index 0x1008 --owner_password "google" Verify that it worked with tpm-nvtool --list | grep Index Power off. Using servo, flash the new BIOS that has this CL in it. Power on, normally this time (not recovery mode). If all goes well, it should create the correct NV spaces and boot into the SSD. Copy tpm-nvtool into this image too, and run tpm-nvtool --list | grep Index You should now see at least these spaces: # NV Index 0x00001007 # NV Index 0x00001008 # NV Index 0x00001009 Now you're ready to test the backup/recover feature. Change-Id: I00031fa0774720147327e2ae0f37e26b34b86341 Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/202138 Reviewed-by: Luigi Semenzato <semenzato@chromium.org>
* rollback_index: Remove recovery_mode parameter to SetupTPM.Shawn Nematbakhsh2013-07-231-9/+5
| | | | | | | | | | | | | | | | | | SetupTPM no longer uses recovery_mode parameter for anything other than a debug print. This change moves the debug print to a caller function, then removes recovery_mode from SetupTPM and some caller functions that no longer have a use for it. BUG=chrome-os-partner:20913. TEST=Manual. Boot factory install shim in recovery mode and verify TPM clear operations succeed. Boot in dev mode and verify "Lock physical presence" print on UART. BRANCH=None. Signed-off-by: Shawn Nematbakhsh <shawnn@chromium.org> Change-Id: I2f671f6680a6e67cf722855e659e99752bc0783c Reviewed-on: https://gerrit.chromium.org/gerrit/62916 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* rollback_index: Add recovery parameter to RollbackKernelLock.stabilize-4443.BShawn Nematbakhsh2013-07-221-9/+3
| | | | | | | | | | | | | | | | | | | | RollbackKernelLock previously checked a global to determine recovery mode state. Since we have two copies of vboot_reference in firmware (in coreboot and depthcharge), this creates a problem with synchronization. Remove the global entirely and instead pass the recovery state to RollbackKernelLock. BUG=chrome-os-partner:20913. TEST=Manual. Boot factory install shim in recovery mode and verify TPM clear operations succeed. Boot in dev mode and verify "Lock physical presence" print on UART. BRANCH=FalcoPeppy. Signed-off-by: Shawn Nematbakhsh <shawnn@chromium.org> Change-Id: I4e751d4a9ca60cd57c5c662ce86eba595fb22ba2 Reviewed-on: https://gerrit.chromium.org/gerrit/62874 Reviewed-by: Aaron Durbin <adurbin@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
* Massive refactoring of external header files.Bill Richardson2013-04-021-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | This reduces the number of exported header files to the minimum needed by the existing userspace utilities and firmware implementations. BUG=chromium:221544 BRANCH=none TEST=manual, trybots CQ-DEPEND=CL:47019,CL:47022,CL:47023 sudo FEATURES=test emerge vboot_reference FEATURES=test emerge-$BOARD \ vboot_reference \ chromeos-cryptohome \ chromeos-installer \ chromeos-u-boot \ peach-u-boot \ depthcharge Change-Id: I2946cc2dbaf5459a6c5eca92ca57d546498e6d85 Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://gerrit.chromium.org/gerrit/47021 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* Get rid of some crufty macros.Gabe Black2013-03-191-6/+0
| | | | | | | | | | | | | | | | | | | | | | | These were macros that were never used, or that were only set to one thing and could be substituted up front. I left in code guarded by the HAVE_ENDIAN_H and HAVE_LITTLE_ENDIAN macros even though those are never defined because they guard a reportedly significantly faster implementation of some functionality, at least according to a comment in the source. It would be a good idea to enable that code path and see if it really does make a big difference before removing it entirely. BUG=None TEST=Built for Link, Daisy, and the host with FEATURES=test. Built depthcharge for Link and booted in normal mode. BRANCH=None Change-Id: I934a4dd0da169ac018ba07350d56924ab88b1acc Signed-off-by: Gabe Black <gabeblack@google.com> Reviewed-on: https://gerrit.chromium.org/gerrit/45687 Reviewed-by: Randall Spangler <rspangler@chromium.org> Commit-Queue: Gabe Black <gabeblack@chromium.org> Tested-by: Gabe Black <gabeblack@chromium.org>
* Use Memcpy to avoid unaligned accesses when using RollbackKernelSpace.Gabe Black2013-03-041-6/+9
| | | | | | | | | | | | | | | | | | | | This structure, like RollbackSpaceFirmware in my previous CL, contains members that are inherently unaligned. This breaks when the machine running vboot cares about alignment. Like before, I'm using Memcpy to avoid the direct unaligned accesses. BUG=chrome-os-partner:17340 TEST=Built and booted into depthcharge on Snow. Without this change, there's an unaligned access in RollbackKernelRead. After this change, the unaligned access goes away and vboot gets at the kernel version successfully. BRANCH=None Change-Id: Ifcdcee1ab4bbce74d05e563cb82bef73a1aa9a84 Signed-off-by: Gabe Black <gabeblack@google.com> Reviewed-on: https://gerrit.chromium.org/gerrit/44503 Reviewed-by: Randall Spangler <rspangler@chromium.org> Commit-Queue: Gabe Black <gabeblack@chromium.org> Tested-by: Gabe Black <gabeblack@chromium.org>
* Use Memcpy to access the fw_versions member of RollbackSpaceFirmware.Gabe Black2013-03-041-5/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This structure has two uint8_t members and then fw_versions which is a uint32_t. That means that fw_versions is 32 bits wide but only has 16 bit alignment, and architectures that care about that sort of thing won't be able to access it. ARM generally cares about alignment, but there's a bit which lets you select whether 32 bit accesses can be unaligned. In the past this bit was ignored, and because this is a 32 bit data type the right load happened to be used. To avoid the unaligned access all together, this change makes vboot use Memcpy to access fw_versions. The number of accesses should be very small so the overhead should be minimal. BUG=chrome-os-partner:17340 TEST=Built and booted depthcharge on Snow. Without this change, there was an unaligned exception during SetupTPM when the fw_versions member was accessed as part of a VBDEBUG call. With this change, the exception went away and the TPM was initialized successfully. BRANCH=None Change-Id: I1ed705f2de450c65f986c1c7ba30da15c0150f74 Signed-off-by: Gabe Black <gabeblack@google.com> Reviewed-on: https://gerrit.chromium.org/gerrit/44499 Reviewed-by: Bill Richardson <wfrichar@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org> Commit-Queue: Gabe Black <gabeblack@chromium.org> Tested-by: Gabe Black <gabeblack@chromium.org>
* rollback_index: fix -Wshadow warningsAaron Durbin2013-02-261-4/+4
| | | | | | | | | | | | | | | | | | | | The rollback_index.c file uses a macro RETURN_ON_FAILURE which creates a locally block-scoped variable named 'result'. However, when built with -Wshadow -Werror the compile will break because the 'result' variable will shadow the one function scoped variable. Fix this warning by changing the variable name from 'result' to 'result_' in the RETURN_ON_FAILURE macro. BUG=chrome-os-partner:17695 BRANCH=None TEST=built fwlib with -Werror -Wshadow. Compiles correctly. runtests still passes as well. Change-Id: I9fedef5567411beacdc1c0b8ed182573601f24aa Signed-off-by: Aaron Durbin <adurbin@chromium.org> Reviewed-on: https://gerrit.chromium.org/gerrit/44044 Reviewed-by: Bill Richardson <wfrichar@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
* fwlib: fix errors with -Wmissing-prototypesAaron Durbin2013-02-261-0/+9
| | | | | | | | | | | | | | | | | | | | | When the fwlib is built with -Wmissing-prototypes and -Werror there build breakages that occur. Fix these errors by either including the header file with the correct declaration or provide the declaration at the top of the c files for global symbols that are used by tests. BUG=chrome-os-partner:17695 BRANCH=None TEST=built fwlib library with -Wmissing-prototypes and -Werror. Also 'make runtests' still passes. Change-Id: I992516ee2545509054887173bc65234905381e06 Signed-off-by: Aaron Durbin Reviewed-on: https://gerrit.chromium.org/gerrit/44042 Reviewed-by: Bill Richardson <wfrichar@chromium.org> Commit-Queue: Aaron Durbin <adurbin@chromium.org> Tested-by: Aaron Durbin <adurbin@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
* Reformat to kernel styleRandall Spangler2013-01-311-9/+12
| | | | | | | | | | | | | | No code changes, just reformatting. BUG=none BRANCH=none TEST=make runtests Change-Id: Id690c8334147970784db5ac54933ad1f5a58dcc1 Reviewed-on: https://gerrit.chromium.org/gerrit/42263 Tested-by: Randall Spangler <rspangler@chromium.org> Reviewed-by: Bill Richardson <wfrichar@chromium.org> Commit-Queue: Randall Spangler <rspangler@chromium.org>
* Improve coverage of rollback_index.cRandall Spangler2013-01-231-416/+477
| | | | | | | | | | | BUG=chromium-os:38139 BRANCH=none TEST=make runtests Change-Id: I21b62b5dd3fc6037f54f7c3bac768c2b67a4c12d Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://gerrit.chromium.org/gerrit/41859 Reviewed-by: Bill Richardson <wfrichar@chromium.org>
* Rename files and defines to simplify makefile.Randall Spangler2013-01-111-1/+1
| | | | | | | | | | | | | | BUG=chromium-os:26317 BRANCH=none TEST=manual sudo emerge vboot_reference emerge-link vboot_reference chromeos-u-boot chromeos-installer emerge-daisy vboot_reference chromeos-u-boot chromeos-installer Signed-off-by: Randall Spangler <rspangler@chromium.org> Change-Id: I8c55ca40f3f0cacf08530ab63c886fe351bcee8e Reviewed-on: https://gerrit.chromium.org/gerrit/41152
* Add clear TPM owner requestRandall Spangler2012-08-151-5/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds two new flags to crossystem: clear_tpm_owner_request clear_tpm_owner_done The first one requests that the firmware clear the TPM owner on the next boot. When the firmware does this, it will set clear_tpm_owner_request=0, and set clear_tpm_owner_done=1. The OS can use the done-flag as a hint that trusted things guarded by the TPM are no longer trustable. BUG=chromium-os:31974 TEST=manual crossystem // both flags initially 0 crossystem clear_tpm_owner_request=1 crossystem clear_tpm_owner_done=1 // request=1, done=0; done can be cleared but not set by crossystem reboot tpmc getownership // owned=no crossystem // request=0, done=1 crossystem clear_tpm_owner_done=0 crossystem // both flags 0 again Signed-off-by: Randall Spangler <rspangler@chromium.org> Change-Id: I49f83f3c39c3efc3945116c51a241d255c2e42cd Reviewed-on: https://gerrit.chromium.org/gerrit/25646
* Revert "Expose getter of virtual dev switch value"Che-Liang Chiou2012-07-021-14/+0
| | | | | | | | | | | | | | | | This reverts commit 552ae43be041331147c5d2aa3897db7a1011637d. vboot should set up dev switch value in output flag of VbInit, instead of exposing TPM getter to U-Boot. BUG=chrome-os-partner:10947 TEST=build okay for Snow and Alex Change-Id: Iee884dbf758fef0cacfed6bcbab373ab5ec5aa25 Reviewed-on: https://gerrit.chromium.org/gerrit/26556 Reviewed-by: Tom Wai-Hong Tam <waihong@chromium.org> Commit-Ready: Che-Liang Chiou <clchiou@chromium.org> Tested-by: Che-Liang Chiou <clchiou@chromium.org>
* Expose getter of virtual dev switch valueChe-Liang Chiou2012-06-291-0/+14
| | | | | | | | | | | | | | | | Firmware needs to be able to read virtual dev switch to set up device tree blob which is passed to kernel and eventually read by crossystem. Signed-off-by: Che-Liang Chiou <clchiou@chromium.org> BUG=chrome-os-partner:10947 TEST=With this change, U-Boot can read virtual dev switch. Change-Id: Ifac2ec3d39b8e9c1100031fdef085c28bb8b37c7 Reviewed-on: https://gerrit.chromium.org/gerrit/26394 Reviewed-by: Simon Glass <sjg@chromium.org> Commit-Ready: Che-Liang Chiou <clchiou@chromium.org> Tested-by: Che-Liang Chiou <clchiou@chromium.org>
* Support virtual dev-switch (keyboard-based dev-mode)Bill Richardson2012-06-081-19/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BUG=chrome-os-partner:9706 TEST=manual Currently, Link is the only platform that enables this feature. To enter dev-mode: Boot into recovery mode using the magic key chord. At the Insert screen, press Ctrl-D. You'll be asked if you want to enter developer mode. If you then press ENTER, it will reboot with dev-mode enabled. If you press SPACE or ESC, it will return to the Insert screen. If you enter recovery mode through any other means, or if dev-mode is already enabled, pressing Ctrl-D at the Insert screen will have no effect. To return to normal mode: Reboot. At the Dev screen, press ENTER or SPACE. It will reboot to recovery mode and ask you if you want to return to normal mode. If you press ESC or power off, you'll still be in dev-mode. Press ENTER or SPACE, and it will reboot into normal mode (of course, if you've messed up your images while in dev-mode, you'll just come right back to recovery mode again). You can also request a direct return to normal mode by running crossystem disable_dev_request=1 and rebooting. Change-Id: I435905855a6c39932ee466cc046bdc4c4c860f98 Reviewed-on: https://gerrit.chromium.org/gerrit/24160 Tested-by: Bill Richardson <wfrichar@chromium.org> Reviewed-by: Bill Richardson <wfrichar@chromium.org> Commit-Ready: Bill Richardson <wfrichar@chromium.org>
* Honor both fake_dev and virtual dev switchBill Richardson2012-05-251-4/+3
| | | | | | | | | | | | | | BUG=chrome-os-partner:9706 TEST=none No test yet. The entire boot/dev-mode/recovery flow depends on this working. This is only part of the process, which will eventually be tested through FAFT. Change-Id: Iea6eaf59d4f349590cf9b920e4effb6a2641b2dc Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://gerrit.chromium.org/gerrit/23657 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* Use virtual dev-mode switch when told to.factory-2338.BBill Richardson2012-05-181-5/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | If VbInit() is instructed to look at a virtual dev-mode switch, then it will use value contained in the TPM's firmware space instead of a hardware GPIO to determine if developer mode is enabled. This change just makes it look. It doesn't provide a way to actually set the value in the TPM. VbInit() isn't being told to look yet, either. Those changes are coming. BUG=chrome-os-partner:9706 TEST=none The usual sanity-check applies: make make runtests But to actually test that this stuff is working IRL requires special tweaks to other components and monitoring the serial debug output from both EC and CPU. We'll save the hands-on tests for when it's all done. Change-Id: Ie485ad2180224e192238bf2a5dbf95bbcb9130f9 Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://gerrit.chromium.org/gerrit/23067 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* Add checksum to TPM RollbackSpace regions for FW and kernel.Bill Richardson2012-05-171-12/+120
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BUG=chrome-os-partner:9707 TEST=manual make make runtests You can also test it by clearing the TPM, then manually looking at the TPM regions. In dev-mode, clear the regions and you'll see something like this: localhost ~ # tpmc read 1007 a 1 0 0 0 0 0 0 0 0 0 localhost ~ # tpmc read 1008 d 1 4c 57 52 47 0 0 0 0 0 0 0 0 localhost ~ # Go back to normal mode and reboot, and you'll see something like this: localhost ~ # tpmc read 1007 a 2 0 1 0 1 0 0 0 0 4f localhost ~ # tpmc read 1008 d 2 4c 57 52 47 1 0 1 0 0 0 0 55 localhost ~ # The important things are that the first number is now 2, instead of 1, and the last number is not zero (it's a checksum, so it'll vary depending on the other numbers, which will themselves vary according to the firmware and kernel versions). Change-Id: Ia4040311c2a4b2819792549b883377c8b6b89d48 Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://gerrit.chromium.org/gerrit/22856 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* Remaining unit tests for rollback_index.cRandall Spangler2011-08-291-0/+8
| | | | | | | | | | BUG=chromium-os:17564 TEST=make && make runtests Change-Id: If2fbfb788bc3199603c8646e8f1c9e061199bc6f Reviewed-on: http://gerrit.chromium.org/gerrit/6832 Reviewed-by: Bill Richardson <wfrichar@chromium.org> Tested-by: Randall Spangler <rspangler@chromium.org>
* Partial unit tests for rollback_indexRandall Spangler2011-08-261-18/+5
| | | | | | | | | | | BUG=chromium-os:17564 TEST=make && make runtests Change-Id: I8ea6bcc15f277e10c5b8539f2ea19ad90be34889 Reviewed-on: http://gerrit.chromium.org/gerrit/6770 Reviewed-by: Bill Richardson <wfrichar@chromium.org> Reviewed-by: Stefan Reinauer <reinauer@chromium.org> Tested-by: Randall Spangler <rspangler@chromium.org>
* Refactor TPM calls into vboot wrapperRandall Spangler2011-07-251-46/+10
| | | | | | | | | | | | | | | | | | | | | | Try #2, now that ARM has the fix from http://gerrit.chromium.org/gerrit/4667 This cleans up the TPM calls inside vboot_reference. * TPM calls share mode code between boot modes. * Better handling for TPM_E_MUST_REBOOT, particularly in recovery mode. * TAB screen shows current TPM versions. No changes required to the wrapper API; these changes are internal to vboot. BUG=chromium-os:18084 TEST=make && make runtests; built for both alex and tegra2-seaboard Original-Change-Id: I2a52066f2889210af83409872b10f9d6380470af (cherry picked from commit da55560cddcf7a1aa8a881cdf52792a21a01e766) Change-Id: I120797145772116f09b8125b9e56fdbb11dc16b3 Reviewed-on: http://gerrit.chromium.org/gerrit/4671 Tested-by: Randall Spangler <rspangler@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
* Revert "Refactor TPM calls into vboot wrapper"Elly Jones2011-07-251-10/+46
| | | | | | | | | This reverts commit da55560cddcf7a1aa8a881cdf52792a21a01e766. This commit caused http://build.chromium.org/p/chromiumos/builders/arm%20tegra2%20binary/builds/6301 to fail. Change-Id: Ie132c1e600ab28f97337ecfe0e7cff053987717d Reviewed-on: http://gerrit.chromium.org/gerrit/4661 Reviewed-by: Elly Jones <ellyjones@chromium.org> Tested-by: Elly Jones <ellyjones@chromium.org>
* Refactor TPM calls into vboot wrapperRandall Spangler2011-07-251-46/+10
| | | | | | | | | | | | | | | | | | This cleans up the TPM calls inside vboot_reference. * TPM calls share mode code between boot modes. * Better handling for TPM_E_MUST_REBOOT, particularly in recovery mode. * TAB screen shows current TPM versions. No changes required to the wrapper API; these changes are internal to vboot. BUG=chromium-os:18084 TEST=make && make runtests; built for both alex and tegra2-seaboard Change-Id: I2a52066f2889210af83409872b10f9d6380470af Reviewed-on: http://gerrit.chromium.org/gerrit/4611 Reviewed-by: Bill Richardson <wfrichar@chromium.org> Reviewed-by: Gaurav Shah <gauravsh@chromium.org> Tested-by: Randall Spangler <rspangler@chromium.org>
View Lorry Controller Status