vboot.git
4 years agobdb: Replace sha functions with vb2 library
Daisuke Nojiri [Tue, 3 May 2016 23:23:53 +0000 (16:23 -0700)]
bdb: Replace sha functions with vb2 library

BDB has its own implementation of SHA256. This patch replaces it with
the one implemented in vb2 library.

BUG=chrome-os-partner:51908
BRANCH=tot
TEST=build runtests

Change-Id: Ida19dd49153a038fc2b2ce481cedf828818aaeaa
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/342121
Reviewed-by: Randall Spangler <rspangler@chromium.org>
4 years agobdb: Integrate bdb_test
Daisuke Nojiri [Tue, 3 May 2016 20:24:10 +0000 (13:24 -0700)]
bdb: Integrate bdb_test

This patch integrate bdb_test with the root Makefile.

BUG=chrome-os-partner:51908
BRANCH=tot
TEST=make runtests

Change-Id: I6266199d8f3068d2e9349110e8351f20d027ab35
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/342091
Reviewed-by: Randall Spangler <rspangler@chromium.org>
4 years agobdb: Copy files from bdb to firmware/bdb
Daisuke Nojiri [Tue, 3 May 2016 16:29:16 +0000 (09:29 -0700)]
bdb: Copy files from bdb to firmware/bdb

Test files are copied to tests/ and the rest are copied to firmware/bdb/.

BUG=chrome-os-partner:51908
BRANCH=tot
TEST=make runtests

Change-Id: I19f66c398e69037f00812a789854340a9690fef5
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/342090
Reviewed-by: Randall Spangler <rspangler@chromium.org>
4 years agoRevert "image_signing: use sparse partition extraction [reland]"
Amey Deshpande [Wed, 27 Apr 2016 07:30:54 +0000 (00:30 -0700)]
Revert "image_signing: use sparse partition extraction [reland]"

This reverts commit f482470b72086d5ba672513434f3da5d62599538.

The original change is the suspected root cause of chromium:606738.

TEST=signing_unittests.py in cros-signing passes (with updated
vboot_stable_hash).
BUG=chromium:606738
BRANCH=None

Change-Id: I21ea027bbda123ee26c6deb4437b07d2fc6e8575
Reviewed-on: https://chromium-review.googlesource.com/340895
Commit-Ready: Amey Deshpande <ameyd@google.com>
Tested-by: Amey Deshpande <ameyd@google.com>
Reviewed-by: Amey Deshpande <ameyd@google.com>
4 years agocgpt: Add cgpt legacy parameter to set primary GPT signature to IGNOREME
Julius Werner [Wed, 20 Apr 2016 20:05:53 +0000 (13:05 -0700)]
cgpt: Add cgpt legacy parameter to set primary GPT signature to IGNOREME

Now that we have support for the IGNOREME signature in cgpt, we need a
way to set it on an existing disk. The easiest option is to shoehorn
this into the cgpt legacy command, because that's already made to modify
GPT header signatures (really, it would be nice to rename it to cgpt
signature or something, but let's not break existing uses for now).

BRANCH=None
BUG=chrome-os-partner:52595
TEST=unit tests

Change-Id: If2835fec28a9c39373abd050e2e057f73e5ec700
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/340073
Reviewed-by: Nam Nguyen <namnguyen@google.com>
4 years agocgptlib: Add support for IGNOREME GPT signature
Julius Werner [Tue, 19 Apr 2016 23:55:36 +0000 (16:55 -0700)]
cgptlib: Add support for IGNOREME GPT signature

This patch makes cgpt aware of a special "IGNOREME" GPT header signature
string that may appear in either the primary or the secondary GPT and
cause cgpt (and other cgptlib clients) to completely ignore that GPT. It
will continue to function correctly for all other purposes (using the
data from the non-ignored GPT), but never write any data back to the
ignored GPT.

BRANCH=None
BUG=chrome-os-partner:52595
TEST=unit tests

Change-Id: I7e53542385ae9d8d24dc25b75e91f4ff4917f66f
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/340072
Reviewed-by: Nam Nguyen <namnguyen@google.com>
4 years agocgpt: Fully write out primary GPT before starting to write secondary
Julius Werner [Tue, 19 Apr 2016 20:20:52 +0000 (13:20 -0700)]
cgpt: Fully write out primary GPT before starting to write secondary

The point of having two GPTs is to always have a known good one if one
of them gets corrupted. One of the most obvious ways that could happen
is if the write stopped half-way through (e.g. due to a crash or random
power loss).

Unfortunately, the way we currently save modified GPTs can leave both
copies invalid if we stop writing at just the wrong time. Since a GPT
header contains a checksum over the GPT entries, we need to write both
the header and entries for one GPT (and make sure they're synced to
disk) before we start writing the other.

BRANCH=None
BUG=chrome-os-partner:52595
TEST=None

Change-Id: I2d4b56bcfba9a94395af5896f274ebade9e39081
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/340071
Reviewed-by: Nam Nguyen <namnguyen@google.com>
4 years agovboot: Save last screen ID
Daisuke Nojiri [Thu, 21 Apr 2016 21:54:45 +0000 (14:54 -0700)]
vboot: Save last screen ID

This patch makes VbDisplayScreen remember the last successfully displayed
screen and skip rendering if the same screen is requested.

When locale is changed, VbCheckDisplayKey calls VbDisplayScreen with force=1,
which makes VbDisplayScreen render the requested screen regardless of the
saved screen ID.

BUG=chromium:602793
BRANCH=tot
TEST=emerge-veyron_jerry vboot_reference chromeos-bootimage

Change-Id: I31c4dde4ff060081f14224a93d57e9b76fcac1db
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/340264
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
4 years agosign_official_build: retain /boot for EFI devices
Amey Deshpande [Tue, 29 Mar 2016 21:31:54 +0000 (14:31 -0700)]
sign_official_build: retain /boot for EFI devices

TEST=Ran sign_official_build locally on image w/ cros_efi and checked
the signed image had /boot in rootfs.
BUG=chromium:604967
BRANCH=None

Change-Id: Id6e1a6409e07fa37a5c116c66ac937dd9aec1481
Reviewed-on: https://chromium-review.googlesource.com/335469
Commit-Ready: Amey Deshpande <ameyd@google.com>
Tested-by: Amey Deshpande <ameyd@google.com>
Reviewed-by: Don Garrett <dgarrett@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
4 years agoinclude sys/sysmacros.h for major()
Mike Frysinger [Tue, 19 Apr 2016 17:58:49 +0000 (13:58 -0400)]
include sys/sysmacros.h for major()

The major() func is defined in the sys/sysmacros.h header, so include it
explicitly for the prototype.  Upstream C libs are moving away from having
sys/types.h include it all the time implicitly.

BUG=None
TEST=precq passes
BRANCH=None

Change-Id: I56b84138f08ded2376193403f9c9db22c5f24f71
Reviewed-on: https://chromium-review.googlesource.com/339680
Commit-Ready: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@google.com>
4 years agoSupport doing battery cut-off in firmware stage.
Hung-Te Lin [Thu, 7 Apr 2016 04:21:03 +0000 (12:21 +0800)]
Support doing battery cut-off in firmware stage.

Add a new crossystem value "battery_cutoff_request" to indicate that
next reboot should cut-off battery and shutdown during firmware stage.

This request is primarily for factories to ship devices in an safe
state. Previously we have done same thing by running "ectool battery-cutoff"
but that creates a problem which "ectool" (and the one to request for
cut-off) must live in developer mode while  the device must be shipped
in normal mode. The mode transition was solved by setting
"disable_dev_request=1", but that flag is may get lost on x86 systems
(having NV storage in CMOS) when the battery is cut-off .

From the experience from Ryu, such settings (dev mode transition and
battery cut-off) should be done together inside firmware execution so we
can create a new flag, battery_cutoff_request, to finalize device
properly.

BRANCH=none
BUG=chromium:601705
TEST=emerge-chell depthcharge vboot_reference chromeos-bootimage
     crossystem battery_cutoff_request=1
     # Unplug AC adapter
     reboot
     # See device rebooted and then shutdown immediately.
     # Press power button and system won't boot.
     # Attach AC adapter and now system boots.
CQ-DEPEND=CL:337596,CL:338193

Change-Id: I73ccae15b337cd65786106646546c67c155b8fa6
Reviewed-on: https://chromium-review.googlesource.com/337602
Commit-Ready: Hung-Te Lin <hungte@chromium.org>
Tested-by: Hung-Te Lin <hungte@chromium.org>
Reviewed-by: Duncan Laurie <dlaurie@chromium.org>
4 years agocrossystem: x86: Write VbNv with mosys if using vboot2
Duncan Laurie [Wed, 30 Mar 2016 16:38:54 +0000 (09:38 -0700)]
crossystem: x86: Write VbNv with mosys if using vboot2

If this is an x86 system using vboot2 then write VbNv data
to CMOS and also use mosys to write it directly to flash.

BUG=chrome-os-partner:51846
BRANCH=none
TEST=emerge-chell vboot_reference; emerge-oak vboot_reference
verify on chell that "crossystem dev_disable_request=1" is
written to both CMOS and flash.

Change-Id: Ifd5dcee4d401f8de36801c5c0a7db3255e618e28
Signed-off-by: Duncan Laurie <dlaurie@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/336311
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
4 years agocrossystem: Move mosys based VbNv functions to shared code
Duncan Laurie [Wed, 30 Mar 2016 16:35:20 +0000 (09:35 -0700)]
crossystem: Move mosys based VbNv functions to shared code

The code to read/write vbnv with mosys was implemented in the
ARM specific code so move it to the generic crosystem code
so it can be used on x86.

No functional changes in this commit.

BUG=chrome-os-partner:51846
BRANCH=none
TEST=emerge-chell vboot_reference; emerge-oak vboot_reference

Change-Id: I3fe18fadb924094e710427208976328caf12a009
Signed-off-by: Duncan Laurie <dlaurie@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/336310
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
4 years agocgpt: Update behavior of GptUpdateKernelWithEntry
Furquan Shaikh [Fri, 2 Oct 2015 02:22:31 +0000 (19:22 -0700)]
cgpt: Update behavior of GptUpdateKernelWithEntry

In order to support slots, we need to update behavior of
GptUpdateKernelWithEntry so that:
1. Invalid - Marks kernel entry as invalid
2. Active - Marks kernel entry as active

CQ-DEPEND=CL:336906
BUG=chrome-os-partner:51807
BRANCH=None
TEST=Compiles successfully "sudo emerge vboot_reference" "emerge-smaug
vboot_reference". "make -j runtests" successful.

Change-Id: If248b3c6bdd23d03cb1dd24f4e21cacef5cc3f26
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/335942
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
4 years agoimage_signing: use sparse partition extraction [reland]
Mike Frysinger [Thu, 10 Sep 2015 20:18:03 +0000 (16:18 -0400)]
image_signing: use sparse partition extraction [reland]

Often the partitions we extract have extra space in them, but the dd
utility will still write out the excess zeros.  That can mean we write
out hundreds of megs of data which could otherwise be skipped.  We thus
waste a good amount of I/O and storage.

For now, only use this flag when extracting a partition to a new file
as this should be safe (there's no pre-existing data to clobber/merge).

Now that the signers have been upgraded to Trusty, we can land this.

BUG=chromium:530730
TEST=`./signing_unittests.py` passes
BRANCH=None

Change-Id: I275973ebfc028c15a8d1ef33dd9b3dcf6ca726a2
Reviewed-on: https://chromium-review.googlesource.com/306420
Commit-Ready: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: Amey Deshpande <ameyd@google.com>
4 years agosigner: improve error handling in update_legacy_bootloader()
Amey Deshpande [Tue, 8 Mar 2016 20:05:53 +0000 (12:05 -0800)]
signer: improve error handling in update_legacy_bootloader()

BRANCH=None
BUG=chromium:590933
TEST=Ran sign_official_build.sh locally and booted the image on kvm
(using BIOS).

$ ./sign_official_build.sh base chromiumos_base_image.bin \
  ../../tests/devkeys chromiumos_base_image_signed.bin

Change-Id: I2e1aad6e2073dea8e92d6ee25ac6972a5d555d71
Reviewed-on: https://chromium-review.googlesource.com/331661
Commit-Ready: Amey Deshpande <ameyd@google.com>
Tested-by: Amey Deshpande <ameyd@google.com>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
4 years agovb2: Modify phase2 behavior for S3 resume case
Duncan Laurie [Sat, 20 Feb 2016 04:20:10 +0000 (20:20 -0800)]
vb2: Modify phase2 behavior for S3 resume case

If a platform does verification of memory init then it must be careful
to use the same slot for resume that it booted from.  This is
accomplished by adding a context flag to indicate this is an S3 resume
and that vboot should treat it differently than a normal boot.

When this flag is set then the same slot that was booted is read from
VBNV and re-used for the resume path, without adjusting any try flags.
If this slot is B then the related context flag is set.

This will allow the firmware updater to update the other (non-booted)
slot and set flags indicating that on the next boot the updated slot
should be tried, while still allowing suspend/resume to work with the
existing firmware slot.

This assumes that the last tried slot was successfully booted, which
should be a safe assumption since the system was able to boot and then
suspend.  It isn't reliable to check last_fw_result for "success"
status because that status is only set some time after boot when
chromeos-setgoodkernel calls chromeos-firmwareupdate --mode=bootok
and so it may still report a status of "trying" on resume depending
on how soon after boot the suspend happened.

It also avoids setting the vboot flag indicating that a slot choice
was made in order to avoid altering the try counter on failure since
this is explicitly not attempting to boot the new slot.

BUG=chromium:577269
BRANCH=glados
TEST=manually tested on chell:
1) ensure that booting from slot A resumes from slot A.
2) ensure that booting from slot B resumes from slot B.
3) do RW update while booted from slot A (so the flags are set to try
slot B) and ensure that suspend/resume still functions properly using
current slot A.
4) do RW update while booted from slot B (so the flags are set to try
slot A) and ensure that suspend/resume still functions properly using
current slot B.

Change-Id: I500faef2b5d19a02f32839976354abf6d551c9f6
Signed-off-by: Duncan Laurie <dlaurie@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/328812
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
4 years agosign_nv_cbootimage: Update signing scripts for nv bootloader and lp0
Furquan Shaikh [Wed, 13 Jan 2016 22:49:03 +0000 (14:49 -0800)]
sign_nv_cbootimage: Update signing scripts for nv bootloader and lp0

Currently, nvidia tools do not provide the support to perform signing
of bootloader or lp0 image. Thus, the signing script is updated to
support this. Once, we have the required tools, this script can be
simplified again.

CQ-DEPEND=CL:*244234
BUG=chrome-os-partner:43018
BRANCH=none
TEST=Verified that signed bootloader and lp0 work fine on dev-PKC
fused devices.

Reference:
https://code.google.com/p/chrome-os-partner/issues/attachmentText?id=43018&aid=430180067000&name=sign-lp0.sh&token=ABZ6GAcjz4b2mEk55WqREzwTnWWpEyE_7A%3A1452631308268
https://code.google.com/p/chrome-os-partner/issues/attachmentText?id=43018&aid=430180060000&name=sign.sh&token=ABZ6GAcRky67XrzMOgKZfkJxr70qm-tTAg%3A1452631308240

Change-Id: Icb024a1d9a61714df6e52d94c96cf43481cac869
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/321459
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
4 years agovboot_display: Keep track of displayed screen stable
Duncan Laurie [Fri, 29 Jan 2016 17:45:51 +0000 (09:45 -0800)]
vboot_display: Keep track of displayed screen

Vboot needs to track the currently displayed screen so when it needs to
change the locale or display the debug overlay it knows which screen to
redraw.  Currently only the legacy path is doing this so change the new
path to update the current screen if it is successfully drawn.

BUG=chrome-os-partner:49766
BRANCH=glados
TEST=boot on glados in dev mode, hit tab and ensure screen does not go black

Change-Id: I4a2bf028275db57b2d0469fc1cb574e871820713
Signed-off-by: Duncan Laurie <dlaurie@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/324549
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
4 years agovb20: add vb2api_check_hash_get_digest() for retrieving hash result
Aaron Durbin [Fri, 22 Jan 2016 21:06:05 +0000 (15:06 -0600)]
vb20: add vb2api_check_hash_get_digest() for retrieving hash result

For x86 systems, which resume through the boot reset vector, to
implement vboot verification of the memory init code one needs
check that the slot chosen on the resume path is the same as
the original boot path. That check is done by storing the
resulting hash of the slot. However, vb2api doesn't export
the resulting hash from vb2api_check_hash(). Thus, provide
a variant which saves the resulting digest in the supplied
buffer.

BUG=chrome-os-partner:46049
BRANCH=glados
TEST=Suspended and resumed on chell. Also, tested with an EC build
     which returns a bad hash to ensure that is properly caught.

Change-Id: Ic20be2024afedabc2d8bc767f1b794376348523c
Signed-off-by: Aaron Durbin <adurbin@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/323460
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Duncan Laurie <dlaurie@chromium.org>
4 years agoPipe the custom_music use flag to the define
Alexandru M Stan [Tue, 12 Jan 2016 19:45:29 +0000 (11:45 -0800)]
Pipe the custom_music use flag to the define

This will allow the definition of CUSTOM_MUSIC from
the individual board ebuilds.

TEST=Define use flag and extra functions on a board, enjoy the custom tunes
BUG=chrome-os-partner:48657
BRANCH=master

Change-Id: I974f9cc51f9b25fb3dff063926e6ea01cf1e031b
Signed-off-by: Alexandru M Stan <amstan@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/323833
Commit-Ready: Alexandru Stan <amstan@chromium.org>
Tested-by: Alexandru Stan <amstan@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
4 years agoIncrease MAX_CUSTOM_DELAY to 5 minutes
Alexandru M Stan [Fri, 18 Dec 2015 23:28:32 +0000 (15:28 -0800)]
Increase MAX_CUSTOM_DELAY to 5 minutes

Rialto will soon need a longer dev mode delay, this variable would prevent it.

BUG=chrome-os-partner:48657
TEST=See follow up CLs
BRANCH=master

Change-Id: Ie5ada9c5441b5b042bd0801d66559ab715fbbf47
Signed-off-by: Alexandru M Stan <amstan@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/323832
Commit-Ready: Alexandru Stan <amstan@chromium.org>
Tested-by: Alexandru Stan <amstan@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
5 years agovboot: Disable VBNV_OPROM_NEEDED after successful update
Duncan Laurie [Wed, 20 Jan 2016 20:53:15 +0000 (12:53 -0800)]
vboot: Disable VBNV_OPROM_NEEDED after successful update

The VBOOT_OPROM_NEEDED flag is used for EC software sync when the
VBSD_EC_SLOW_UPDATE flag is set.

After a successful EC software sync vboot requests a reboot to disable
graphics but it is not clearing the VBNV flag first.  With vboot1 this
was getting cleared as a side effect of calling VbInit in normal mode.

BUG=chrome-os-partner:49560
BRANCH=glados
TEST=Enable EC_SLOW_UPDATE on chell and test EC software sync in normal
mode and ensure that it reboots and does not do graphics init if the
update is successful.

Change-Id: I2aa0c4c3b1ad357a5b8ddc14539e264a1f5b76b2
Signed-off-by: Duncan Laurie <dlaurie@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/322731
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
5 years agoModify EC software sync to update RO if necessary
Mary Ruthven [Wed, 6 Jan 2016 19:30:55 +0000 (11:30 -0800)]
Modify EC software sync to update RO if necessary

Allow the AP to sync and verify the EC read only image after updating
the rewritable image.

BUG=chrome-os-partner:48703
BRANCH=none
TEST=manual

1. Update EC to a new version
2. rebuild EC code
3. Update AP firmware
4. Reboot and check that the RO image is updated after the RW image is
updated.

CQ-DEPEND=CL:319213

Change-Id: I774ef25320103f20d8c7d1c180a220dd0819c04d
Signed-off-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/320614
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agoUpdate a utility to support the new tpm sysfs class directory
Bryan Freed [Thu, 7 Jan 2016 17:11:58 +0000 (09:11 -0800)]
Update a utility to support the new tpm sysfs class directory

Kernel TPM patches from 4.x moved /sys/class/misc/tpm0 to /sys/class/tpm/tpm0.
Support both paths in this utility.

BUG=chromium:573368
BRANCH=none
TEST=untested, not sure if this utility is still used.

Change-Id: Ib81476eee4c9de921502a3a47f6990b9e6b1968b
Reviewed-on: https://chromium-review.googlesource.com/320892
Commit-Ready: Bryan Freed <bfreed@chromium.org>
Tested-by: Bryan Freed <bfreed@chromium.org>
Reviewed-by: Duncan Laurie <dlaurie@chromium.org>
5 years agoPort to musl: musl doesn't have execinfo.h.
Doug Evans [Thu, 19 Nov 2015 23:57:23 +0000 (15:57 -0800)]
Port to musl: musl doesn't have execinfo.h.

Change-Id: Idc2f18880581d3a2e67185becee8b77cfa5cdf04
Reviewed-on: https://chromium-review.googlesource.com/313388
Commit-Ready: Doug Evans <dje@google.com>
Tested-by: Doug Evans <dje@google.com>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agovboot: Change VbExEc implementations to support RO update
Mary Ruthven [Fri, 18 Dec 2015 19:16:02 +0000 (11:16 -0800)]
vboot: Change VbExEc implementations to support RO update

This change will be used to support EC-RO software sync by allowing for
access to the readonly region of firmware. Currently only the writable
section is accessed by vboot using VB_SELECT_FIRMWARE_A and B.

BUG=chrome-os-partner:48703
BRANCH=none
TEST=built on jerry and check that the RO hash can be read and the image
can be updated.
CQ-DEPEND=CL:319185,CL:320425,CL:320598

Change-Id: Ic3942d86b65da3123798cfd11a78056f5dab6699
Signed-off-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/319213
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agoInclude <fcntl.h> instead of <sys/fcntl.h>.
Doug Evans [Thu, 19 Nov 2015 23:05:45 +0000 (15:05 -0800)]
Include <fcntl.h> instead of <sys/fcntl.h>.

Musl complains about using sys/fcntl.h, and with -Werror that
gives a compilation failure. Every other file includes <fcntl.h>
so just use that.

Change-Id: Ibc743bbe335e9e9b91da7e4eacc01cc80cd8b35a
Reviewed-on: https://chromium-review.googlesource.com/313419
Commit-Ready: Doug Evans <dje@google.com>
Tested-by: Doug Evans <dje@google.com>
Reviewed-by: Nam Nguyen <namnguyen@chromium.org>
5 years agoUse ${WERROR} consistently.
Doug Evans [Thu, 19 Nov 2015 22:58:25 +0000 (14:58 -0800)]
Use ${WERROR} consistently.

Change-Id: I37b414b030cc69fab2b4feec70b55297dcd5fdb7
Reviewed-on: https://chromium-review.googlesource.com/313198
Commit-Ready: Doug Evans <dje@google.com>
Tested-by: Doug Evans <dje@google.com>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agovboot2: Add try RO software sync flag
Mary Ruthven [Tue, 5 Jan 2016 22:59:05 +0000 (14:59 -0800)]
vboot2: Add try RO software sync flag

This flag will be used by the firmware updater to indicate that RO
software sync should be attempted.

BUG=chrome-os-partner:48703
BRANCH=None
TEST=make runtests

Change-Id: I42090ac47da45c724e66334648ab447ad3c21178
Signed-off-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/320621
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agoMove default target up so it's really the default.
Doug Evans [Thu, 19 Nov 2015 22:14:18 +0000 (14:14 -0800)]
Move default target up so it's really the default.

The line
${FUTIL_BIN}: ${UTILLIB21}
was changing the default.

Change-Id: I7988af498c9a9a1981cf2485e4f9d3496412f133
Reviewed-on: https://chromium-review.googlesource.com/313245
Commit-Ready: Bill Richardson <wfrichar@chromium.org>
Tested-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agoTest sha-256 with multiple odd-length updates
Randall Spangler [Tue, 15 Dec 2015 19:39:21 +0000 (11:39 -0800)]
Test sha-256 with multiple odd-length updates

This verifies that the VB2 sha-256 library can handle odd-length
updates.

The expected digest  was generated from:
  echo -n 'test1test2test3' | sha256sum

BUG=None
BRANCH=None
TEST=make runtests

Change-Id: Ia7d57322a1a4b10e718c47f1dae38ed244cf8ebc
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/318363
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
5 years agoAdd BDB library
Randall Spangler [Thu, 10 Dec 2015 23:03:22 +0000 (15:03 -0800)]
Add BDB library

This is a standalone library for verifying the BDB structures in the
common boot flow document, and a bdb_create utility to create test BDB
structures.  Eventually, creating these structures will be rolled into
futility.

BUG=chrome-os-partner:48448
BRANCH=none
TEST=cd bdb && make runtests

Change-Id: Ic57c26ca84137205da3b6c7d532f5324c93b4285
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/317275
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
5 years agoadd error code for screen drawing failure
Daisuke Nojiri [Wed, 2 Dec 2015 20:05:41 +0000 (12:05 -0800)]
add error code for screen drawing failure

This patch adds error code for screen drawing failure.

BUG=none
BRANCH=tot
TEST=Tested on Glados

Change-Id: I04b349fd2c0bc539338b7ee27b8fa9544c85c873
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/315257
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
5 years agoFix error message for VbGbbReadBmpHeader
Daisuke Nojiri [Wed, 18 Nov 2015 01:44:46 +0000 (17:44 -0800)]
Fix error message for VbGbbReadBmpHeader

BUG=none
BRANCH=tot
TEST=Tested on Jerry

Change-Id: I1ecfd28b4c694e4aa531ed0e77219b2160509bd0
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/313744
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
5 years agosign_official_build: add a fallback key for standalone accessories
Vincent Palatin [Tue, 17 Nov 2015 19:18:19 +0000 (11:18 -0800)]
sign_official_build: add a fallback key for standalone accessories

The standalone accessories are using a key name like this:
key_<product>.pem or key_<product>.vbprik2
when it doesn't exist, fallback using key.pem or key.vbprik2.

BRANCH=none
BUG=chrome-os-partner:47557
TEST=manual:
./scripts/image_signing/sign_official_build.sh accessory_usbpd ../ec/build/zinger/ec.bin tests/devkeys-acc /tmp/ec-zinger.TEST.SIGNED.bin
./scripts/image_signing/sign_official_build.sh accessory_rwsig ../ec/private/build/hadoken/keyboard_app.bin tests/devkeys-acc /tmp/ec-hadoken.TEST.SIGNED.bin
./scripts/image_signing/sign_official_build.sh accessory_rwsig ../ec/private/build/hadoken/keyboard_app.bin /tmp /tmp/ec-hadoken.TEST.SIGNED.bin

Change-Id: I68863664bdb9da1695e91b1986f3a0148af7da26
Reviewed-on: https://chromium-review.googlesource.com/312836
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
5 years agoGive more screen control to vboot_draw_screen
Daisuke Nojiri [Mon, 16 Nov 2015 19:47:28 +0000 (11:47 -0800)]
Give more screen control to vboot_draw_screen

New devices have Depthcharge render vboot screens by calling
vboot_draw_screen. Thus, display initialization and backlight control should
not be duplicated. This patch prevents VbDisplayScreen from initializing
display and controlling backlight when vboot is rendering screens using GBB.

BUG=chrome-os-partner:43706,chromium:502066
BRANCH=tot
TEST=Tested on Glados

Change-Id: I50cd2decb7065af96779601b12f0fbf2554ff6ed
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/312749
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
5 years agocrossystem: Remove savedmem_base and savedmem_size fields
Julius Werner [Fri, 6 Nov 2015 22:28:44 +0000 (14:28 -0800)]
crossystem: Remove savedmem_base and savedmem_size fields

I don't even know what this is. It seems to have marked some kind of
debug buffer provided by H2C BIOS on pre-Daisy Chromebooks and has not
been touched since it was copied in here when crossystem was first
added. I can't find any references in our codebase so I doubt anybody
would miss it. Let's remove it so the '(error)' fields returned there on
any modern Chromebook stop confusing our vendors.

BRANCH=None
BUG=chromium:551715
TEST=Built for Falco and Jerry.

Change-Id: Ie2baec536b50bb192eb4cd3e48df212cce53561a
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/311346
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Bernie Thompson <bhthompson@chromium.org>
5 years agocrossystem: Remove platform_family field
Julius Werner [Fri, 6 Nov 2015 22:22:32 +0000 (14:22 -0800)]
crossystem: Remove platform_family field

This field doesn't seem to be used for anyone and it keeps adding work
for people trying to bring up new platforms. If we ever needed something
like this again, we'd probably prefer to have it in mosys now anyway.
Let's get rid of it.

BRANCH=None
BUG=chromium:551715
TEST=Built for Falco and Jerry.

Change-Id: I6b96e255968fdd22a345d4a75bfdc1e79d3f5896
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/311345
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Bernie Thompson <bhthompson@chromium.org>
5 years agoUpdate accessories test keys location
Vincent Palatin [Fri, 30 Oct 2015 23:34:37 +0000 (16:34 -0700)]
Update accessories test keys location

Move around the test keys used for standalone accessories signing
unittesting, so they are easier to use.

BRANCH=smaug, samus
BUG=chrome-os-partner:46635
TEST=run cros-signing unittests (./signing_unittests.py)

Change-Id: I02fcf444ec76bf6ebf6eb477e1236869aa877210
Reviewed-on: https://chromium-review.googlesource.com/309967
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
5 years agovboot: Add GBB flag to turn on serial output
Mary Ruthven [Wed, 28 Oct 2015 17:48:59 +0000 (10:48 -0700)]
vboot: Add GBB flag to turn on serial output

Currently this does nothing. This will eventually be used to enable
serial output.

BUG=chromium:210230
BRANCH=none
TEST=none

Change-Id: I5c25fd7406e30b96d12bc4bf8210d3c3f4ae79f1
Signed-off-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/309716
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agovboot_api_kernel: Add new EcVbootDone API
Shawn Nematbakhsh [Wed, 21 Oct 2015 21:31:02 +0000 (14:31 -0700)]
vboot_api_kernel: Add new EcVbootDone API

Add a new post-EC software sync API VbExEcVbootDone() to take actions
which normally need to happen after EC verification / sysjump.

BUG=chromium:537269
TEST=Manual on Glados. Set CHG_MW thresh to 20000, BAT_PCT to 50. Verify
that LIMIT_POWER host event is set until Zinger negotiates to 20V. Also
verify that we do not proceed with boot when Donette is plugged.
BRANCH=None
CQ-DEPEND=CL:307885,CL:309523

Change-Id: I77e6000aa8a44e3aca4fb5982e5b5f5191774989
Signed-off-by: Shawn Nematbakhsh <shawnn@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/307952
Commit-Ready: Shawn N <shawnn@chromium.org>
Tested-by: Shawn N <shawnn@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agosign_official_build: fix support for signing standalone accessories
Vincent Palatin [Wed, 28 Oct 2015 16:21:43 +0000 (09:21 -0700)]
sign_official_build: fix support for signing standalone accessories

My previous patch using futility to re-sign standalone accessory
firmware images had a mistake in the key directory path : fix it.

Also add RSA-2048 'accessory' keys for signer unit testing.

BRANCH=smaug, samus
BUG=chrome-os-partner:46635
TEST=run cros-signing unittests (./signing_unittests.py)

Change-Id: Ia2f641c85337c67f81968be4730643a6ad5f22cf
Reviewed-on: https://chromium-review.googlesource.com/309530
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agoVbVerifyMemoryBootImage: Allow integrity-only check in dev mode with
Furquan Shaikh [Wed, 28 Oct 2015 20:01:27 +0000 (13:01 -0700)]
VbVerifyMemoryBootImage: Allow integrity-only check in dev mode with
FASTBOOT_FULL_CAP set

This change allows developers to boot dev-signed boot images in
unlocked mode if DEV_BOOT_FASTBOOT_FULL_CAP is set in VbNvStorage or
GBB_FLAG_FORCE_DEV_BOOT_FASTBOOT_FULL_CAP is set.

BUG=chrome-os-partner:47002
BRANCH=None
TEST=Compiles successfully. make -j runtests

Change-Id: I56e3879594da1b57051dfe242ff347ac970c96bb
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/309606
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
5 years agosign_official_build: add support for signing standalone accessories
Vincent Palatin [Tue, 20 Oct 2015 00:22:07 +0000 (17:22 -0700)]
sign_official_build: add support for signing standalone accessories

Use futility to re-sign standalone accessory firmware images either the
former "usbpd1" used by USB Power Delivery firmware generated from the
EC codebase or the new "rwsig" format.

BRANCH=smaug, samus
BUG=chrome-os-partner:46635
TEST=manual:
openssl genrsa -F4 -out key_zinger.pem 2048
openssl genrsa -F4 -out key_hadoken.pem 2048
futility create --desc="Hadoken fake MP key" key_hadoken.pem key_hadoken
./scripts/image_signing/sign_official_build.sh accessory_usbpd build/zinger/ec.bin . build/zinger/ec.SIGNED.bin
./scripts/image_signing/sign_official_build.sh accessory_rwsig build/hadoken/keyboard_app.bin . build/hadoken/keyboard_app.SIGNED.bin
and compare the re-signed files with the original files.

Change-Id: I586ba3e4349929782e734af1590f394824e7dd44
Reviewed-on: https://chromium-review.googlesource.com/306795
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agoSave recovery reason before user three-finger-salutes
Daisuke Nojiri [Wed, 21 Oct 2015 01:31:10 +0000 (18:31 -0700)]
Save recovery reason before user three-finger-salutes

When a user hits esc+refresh+power to start recovery, the true recovery
reason will be lost after reboot. (It would always look like
VB2_RECOVERY_RO_MANUAL.) This patch makes VbBootRecovery save
the reason in the subcode area before entering the new 'broken' loop.

BUG=chromium:501060
BRANCH=tot
TEST=test_that -b veyron_jerry suite:faft_bios

Change-Id: Ib536daa0633721bfc975381782d348f122b3d337
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/307586
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agoAdd VbExGetLocalizationCount
Daisuke Nojiri [Wed, 7 Oct 2015 00:03:08 +0000 (17:03 -0700)]
Add VbExGetLocalizationCount

VbExGetLocalizationCount is a callback function which is supposed to
return the number of screen locales supported by VbExDisplayScreen.

After this change, we still try to get the number of locales from GBB
first but when it fails, VbExGetLocalizationCount is called. The error
code from VbGbbReadBmpHeader will be masked, similarly to the error from
VbDislayScreenFromGBB.

BUG=chromium:502066
BRANCH=tot
TEST=Tested on Samus. make runtests

Change-Id: I04ef8bf1ea02b1aaa05e65673b57bcea1932d8b0
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/304376
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
5 years agofutility: add support for .pem with public key
Vincent Palatin [Fri, 16 Oct 2015 00:54:34 +0000 (17:54 -0700)]
futility: add support for .pem with public key

Add support for PEM file containing a RSA Public key in futility "show"
and "create" commands.

When "futility create" is given a PEM file with only a RSA public key,
generate the proper .vbpubk2 rather than failing.

BRANCH=smaug
BUG=none
TEST=make runtests
and run manually
futility show tests/testkeys/key_rsa4096.pub.pem
futility show tests/testkeys/key_rsa4096.pem

Change-Id: I707ceca54c80ba21f53869ad86c86fa23b31e665
Reviewed-on: https://chromium-review.googlesource.com/306683
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agofutility: fix segfault on short files
Vincent Palatin [Fri, 16 Oct 2015 00:46:58 +0000 (17:46 -0700)]
futility: fix segfault on short files

Verify the size of the buffer read from the file before trying to use 1KB of
it for the new rwsig format detection.

Add a new test case with a short file containing only 4 bytes of unknown
data and run "futility show" on it.

BRANCH=smaug
BUG=none
TEST=futility show foobar.pub.pem
where foobar.pub.pem is a 451-byte file.
check that "make runtests" passes with the fix
and fails without it with the following message :
test_file_types.sh ... failed
FAIL: 13 / 14 passed

Change-Id: Ia9d68c6b528c2b3a595ea6791c907374616d051f
Reviewed-on: https://chromium-review.googlesource.com/306682
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agofutility: Revised support for RO+RW firmware
Bill Richardson [Thu, 15 Oct 2015 07:23:18 +0000 (00:23 -0700)]
futility: Revised support for RO+RW firmware

The "rwsig" type is used for independent device firmware (not
Chromebook BIOS) that need to verify themselves instead of using
software sync.

The expected use case is that a RO firmware contains a
vb2_public_key struct along with an FMAP or other pointers to a
slot for RW firmware. The RW firmware slot reserves room for a
vb2_signature struct.

This CL changes the args and behavior of the rwsig type, so that
the RW firmware can be [re]signed independently of the rest of
the image.

BUG=chrome-os-partner:46254
BRANCH=smaug,ToT
TEST=make runtests, manual

Create a keypair:

  futility create --desc "Key One" tests/testkeys/key_rsa2048.pem foo

Sign a RW binary and build a complete image out of the parts:

  futility sign --type rwsig --prikey foo.vbprik2 rw.bin sig.bin

  dd if=/dev/zero bs=65536 count=1 of=image.bin
  dd if=rw.bin of=image.bin conv=notrunc
  dd if=sig.bin bs=$((65536 - 1024)) seek=1 of=image.bin conv=notrunc

Verify both the separate parts and the combined image:

  futility show --type rwsig --pubkey foo.vbpubk2 rw.bin sig.bin
  futility show --type rwsig --pubkey foo.vbpubk2 image.bin

Re-sign the combined image with a different keypair:

  futility create --desc "Key Two" tests/testkeys/key_rsa1024.pem bar

  futility sign --type rwsig --prikey bar.vbprik2 image.bin

Now the first key no longer verifies:

  futility show --type rwsig --pubkey foo.vbpubk2 image.bin

But the second key does:

  futility show --type rwsig --pubkey bar.vbpubk2 image.bin

Change-Id: Ifdddab08f218f506eb1dce28851b153d70140a7b
Signed-off-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/305980
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Vincent Palatin <vpalatin@chromium.org>
5 years agoRevert "image_signing: use sparse partition extraction"
Mike Frysinger [Thu, 15 Oct 2015 22:38:36 +0000 (18:38 -0400)]
Revert "image_signing: use sparse partition extraction"

This reverts commit 82dec09bd5098715ddf9cd7d2e4abe87606d5249.

This flag doesn't exist on Ubuntu Precise which is what the signers
are running atm.  Until we get them upgraded to Trusty, back this
change out.

BUG=chromium:530730
TEST=`./signing_unittests.py` passes
BRANCH=None

Change-Id: I9ba508c1531dbb169fd020d06ab102f6576b7342
Reviewed-on: https://chromium-review.googlesource.com/306310
Commit-Ready: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: Amey Deshpande <ameyd@google.com>
5 years agoPass locale to VbExDisplayScreen
Daisuke Nojiri [Tue, 6 Oct 2015 23:50:33 +0000 (16:50 -0700)]
Pass locale to VbExDisplayScreen

This change makes VbDisplayScreen read the last saved locale from nvram
and pass it to VbExDisplayScreen so that it can draw locale dependent
screens.

BUG=chromium:502066
BRANCH=tot
TEST=Tested on Samus. make runtests.
CQ-DEPEND=CL:304382,CL:306100,CL:306110

Change-Id: I9782ec5a8a9f8393998aa8a0d64e88ad1809233b
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/304375

5 years agofutility: Support for signing RO+RW firmware
Bill Richardson [Mon, 12 Oct 2015 20:58:12 +0000 (13:58 -0700)]
futility: Support for signing RO+RW firmware

This adds the "rwsig" type, with initial support for RO+RW
firmware images that need to verify themselves instead of using
software sync. This uses our vb2 structs instead of raw binary
blobs. That will help us locate, identify, and verify the keys
and signatures in the signed firmware images.

BUG=chrome-os-partner:46254
BRANCH=smaug,ToT
TEST=make runtests

I also hacked up a test board with the EC-side signature
verification routines from a preliminary CL and tested this
signing scheme with that. It works.

Additional work is needed to make this seamless, but you can try
it out like so:

  futility create ./tests/testkeys/key_rsa2048.pem foo

  futility sign --type rwsig --prikey foo.vbprik2 --pubkey foo.vbpubk2 ec.bin

Change-Id: I876ab312a2b0b36411c5f739fe3252529728d034
Signed-off-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/305394
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agoAdd NV flag to default boot legacy OS
Mary Ruthven [Tue, 6 Oct 2015 17:42:31 +0000 (10:42 -0700)]
Add NV flag to default boot legacy OS

In developer mode, this option will make the system try to boot into
a legacy OS first after the 30 second timeout. This removes the need to
press a key during boot to try legacy mode and the need to remove the
write protect screw to boot legacy as default.

BUG=chromium:310697
BRANCH=none
TEST=make runtests

Change-Id: I9a9f64c14ad015e21d08eec36e8fc187189cd2f2
Signed-off-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/304077
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agoAdd broken screen
Daisuke Nojiri [Thu, 30 Apr 2015 19:41:24 +0000 (12:41 -0700)]
Add broken screen

In the new recovery process, a user will see 'broken' screen
instead of 'remove' screen, where usb stick presence is no longer
detected. A user instead has to hit esc+refresh+power to proceed
to recovery mode.

BUG=chromium:501060
BRANCH=tot
TEST=make runtests

Change-Id: Icd511c1ca892628b96befbb0a34c2c84b881c857
Reviewed-on: https://chromium-review.googlesource.com/304404
Commit-Ready: Daisuke Nojiri <dnojiri@chromium.org>
Tested-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agorecovery: Add recovery reason for fastboot mode requested in
Furquan Shaikh [Wed, 19 Aug 2015 04:19:28 +0000 (21:19 -0700)]
recovery: Add recovery reason for fastboot mode requested in
user-mode.

BUG=chrome-os-partner:42674
BRANCH=None
TEST=Compiles successfully and behavior verified.

Change-Id: I67ec056f28596dd0c0005a54e454abe1b4104cfb
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/294276
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>
(cherry picked from commit 6d9a9a9fdd3bcdadbfc4f44640da4c462803a69d)
Reviewed-on: https://chromium-review.googlesource.com/304673
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agosigner: update legacy bootloader templates after image signing
Amey Deshpande [Thu, 17 Sep 2015 01:16:42 +0000 (18:16 -0700)]
signer: update legacy bootloader templates after image signing

Specifically, this patch updates 'root_hexdigest' in legacy bootloader
templates in EFI system partition to match the signed rootfs.

BRANCH=None
BUG=chromium:512940
TEST=Ran sign_official_build.sh locally and booted the image on kvm
(using BIOS).
TEST=Ran signing_unittests.py by locally changing vboot_stable_hash to
include this patch.

$ ./sign_official_build.sh base chromiumos_base_image.bin \
  ../../tests/devkeys chromiumos_base_image_signed.bin

Change-Id: Ied021c4464b113a64508f5081605069bdcecbc1f
Reviewed-on: https://chromium-review.googlesource.com/301742
Commit-Ready: Amey Deshpande <ameyd@google.com>
Tested-by: Amey Deshpande <ameyd@google.com>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
5 years agofutility: Add show capability for usbpd1 images
Bill Richardson [Thu, 24 Sep 2015 17:59:41 +0000 (10:59 -0700)]
futility: Add show capability for usbpd1 images

The firmware for the USB Type-C power adapters uses raw binary
blobs for the public keys and signatures instead of
readily-identifiable structs. We've been able to sign these
firmware images for some time, but verifying the result generally
required testing them on hardware.

This CL adds some futilty support for recognizing and verifying
those images too. It just tries various sig and hash algorithms,
until it finds a combination for which the image is
self-consistent (where the pubkey blob verifies the signature
blob).

BUG=none
BRANCH=none
TEST=make runtests

This change also adds additional tests for usbpd1 images. We
ensure that we correctly recognize and verify an MP-signed
firmware, plus test signing and verifying usbpd1 images using
multiple signature and hash algorithms.

Change-Id: I4fbe8b37a694992f635d5469ae1c2449b1610dfd
Signed-off-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/302415
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agovboot: Move GPT entry operator functions to gpt_misc
Furquan Shaikh [Tue, 22 Sep 2015 16:09:27 +0000 (09:09 -0700)]
vboot: Move GPT entry operator functions to gpt_misc

This is to allow external entities using vboot library
(e.g. depthcharge) to utilize these operator functions to perform get
/ set operations on GPT entry.

BUG=chrome-os-partner:45670
BRANCH=None
TEST=Compiles successfully "sudo emerge vboot_reference" "emerge-smaug
vboot_reference". "make -j runtests" successful.

Change-Id: I9e34a2a7afeae6293a78424794797d5755950888
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/301475
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agovboot2: tpm error doesn't block gbb dev flag
Randall Spangler [Thu, 17 Sep 2015 22:50:48 +0000 (15:50 -0700)]
vboot2: tpm error doesn't block gbb dev flag

In recovery mode, the TPM may be bad / corrupt.  This prevents access to
the soft developer switch stored in secdata.  But it should not prevent
setting dev mode via GBB or context flags.  Those flags may be set
during manufacturing or testing, and override the contents of secdata
anyway.

BUG=chrome-os-partner:45511
BRANCH=ryu
TEST=make runtests

Change-Id: I242714528203cc7cf78a714c660b7f8bbd0e04d0
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/300621
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Furquan Shaikh <furquan@chromium.org>
5 years agosign_official_build: support signing 'recovery_kernel' image type
Furquan Shaikh [Fri, 11 Sep 2015 23:05:37 +0000 (16:05 -0700)]
sign_official_build: support signing 'recovery_kernel' image type

BRANCH=None
BUG=chrome-os-partner:44227
TEST='sign_official_build.sh recovery_kernel boot.img keys
boot.img.recovery-signed' works fine and able to boot in locked recovery mode
using fastboot boot.

Change-Id: Iabde28bb2068b8294fc3d03f2f771c63368ecbb5
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/300250
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: David Riley <davidriley@chromium.org>
5 years agovboot2: Support reboot requested by secdata
Randall Spangler [Thu, 17 Sep 2015 19:54:51 +0000 (12:54 -0700)]
vboot2: Support reboot requested by secdata

When a TPM goes from the disabled state to the enabled state, it must
reboot after being enabled, before it can be initialized.  In vboot1,
TLCL was part of vboot and this was handled internally.  In vboot2, the
caller must set a context flag, so that vboot can decide whether to
allow the reboot, or whether to go directly to recovery mode.  This
check is necessary to handle the following cases:

1) The device is booting normally, but the TPM needs a reboot.  This
should simply reboot, without going to recovery mode.

2) The device is booting in recovery mode, but the TPM needs a reboot.
If this is the first time it asked us, allow the reboot.

3) The TPM asked for a reboot last time, so we did.  And it's still
asking.  Don't reboot, because that runs the risk that whatever is wrong
won't be fixed next boot either, and we'll get stuck in a reboot loop
that will prevent recovery.  Boot into recovery mode.

Add a new NvStorage bit to track whether the TPM requested a reboot on
the previous boot.  That's better than what we did in vboot1, where we
used a special recovery request.  Vboot1 couldn't track getting stuck in
a reboot loop in normal mode, only in recovery mode.  The new code can
catch both.

BUG=chrome-os-partner:45462
BRANCH=ryu
TEST=make runtests

Change-Id: I2ee54af107275ccf64a6cb41132b7a0fc02bb983
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/300572
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
5 years agocrossystem: Updated crossystem to accomodate Android
Shelley Chen [Mon, 14 Sep 2015 22:39:29 +0000 (15:39 -0700)]
crossystem: Updated crossystem to accomodate Android
(resubmit)

Previously crossystem assumed that mosys was located
in /usr/sbin.  In Android mosys is currently located
in /system/bin.  Using fixed paths as opposed to
'which' to prevent attacks where attacker could insert
mosys in PATH.

difference from previous commit:
  Removed the allocation of duplicate arrays.  Kept
  with simplicity of original version, just returning
  correct constant depending on detected platform.

BUG=chromium:527484
BRANCH=none
TEST=ran crossystem, crossystem fw_try_count/
fw_try_next, crossystem fw_try_count/fw_try_next=x
on smaug and daisy.

Change-Id: I923206db1411a9a35c9c8e3f9ede5016f49b5f26
Signed-off-by: Shelley Chen <shchen@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/299801
Reviewed-by: danny chan <dchan@chromium.org>
5 years agoimage_signing: use sparse partition extraction
Mike Frysinger [Thu, 10 Sep 2015 20:18:03 +0000 (16:18 -0400)]
image_signing: use sparse partition extraction

Often the partitions we extract have extra space in them, but the dd
utility will still write out the excess zeros.  That can mean we write
out hundreds of megs of data which could otherwise be skipped.  We thus
waste a good amount of I/O and storage.

For now, only use this flag when extracting a partition to a new file
as this should be safe (there's no pre-existing data to clobber/merge).

BUG=chromium:530730
TEST=`./signing_unittests.py` passes
BRANCH=None

Change-Id: Ic32665cf7c38fc0a5efc3f8b227fa8ff408ca9e3
Reviewed-on: https://chromium-review.googlesource.com/299450
Commit-Ready: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: David Riley <davidriley@chromium.org>
5 years agoimage_signing: use sparse copying when creating the signed image
Mike Frysinger [Wed, 9 Sep 2015 21:00:57 +0000 (17:00 -0400)]
image_signing: use sparse copying when creating the signed image

This should speed up the copies significantly by using less disk
storage & I/O when the unpacked file is not sparse already.  This
option has been in cp for a long time, and works in Ubuntu Precise
(coreutils-8.13) & Trusty (coreutils-8.21).

BUG=chromium:530730
TEST=`./signing_unittests.py` passes
BRANCH=None

Change-Id: I82192455a623eabf96abf4f25296f3dc0c129ca2
Reviewed-on: https://chromium-review.googlesource.com/299440
Commit-Ready: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: David Riley <davidriley@chromium.org>
Reviewed-by: Amey Deshpande <ameyd@google.com>
5 years agoimage_signing: do not delete output when signing loem firmware
Mike Frysinger [Thu, 10 Sep 2015 20:29:34 +0000 (16:29 -0400)]
image_signing: do not delete output when signing loem firmware

Rather than use the existence of the output as a marker for running the
gbb step, key off the loem index.  We want to run it the first time and
not bother after that.

BUG=chrome-os-partner:44227
BRANCH=None
TEST=signer can still sign loem keysets

Change-Id: I26e9ccaf1333f769d6993a8e0d84c63644bb2597
Reviewed-on: https://chromium-review.googlesource.com/298980
Reviewed-by: David Riley <davidriley@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
5 years agosigner: create devkeys with and without pkc
David Riley [Tue, 8 Sep 2015 20:05:56 +0000 (13:05 -0700)]
signer: create devkeys with and without pkc

Signing test of firmware for non-t210 targets fails when PKC
keys are present so separate devkeys into two keysets where only
one has the PKC key.

BUG=chrome-os-partner:44227
TEST=sign_official_build.sh nv_lp0_firmware tegra_lp0_resume.fw tests/devkeys-pkc tegra_lp0_resume.fw.signed versions.default
BRANCH=signer

Change-Id: Ie0670638d30d17692f1113b5a9f0309ea610d72a
Signed-off-by: David Riley <davidriley@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/298091
Reviewed-by: Mike Frysinger <vapier@chromium.org>
5 years agokeygeneration: fix some portability aspects
Mike Frysinger [Wed, 8 Apr 2015 17:43:01 +0000 (13:43 -0400)]
keygeneration: fix some portability aspects

The "function" keyword is not portable -- use the normal function style.

The awk command uses a non-portable regex (the word anchor \>).  Rework
it to avoid regexes entirely.

BUG=chromium:475101
TEST=keyset_version_check.sh works on a POSIX system
BRANCH=None

Change-Id: I5446f63aa9181d06da1898aafb8fab17f5042989
Reviewed-on: https://chromium-review.googlesource.com/296562
Commit-Ready: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: David Riley <davidriley@chromium.org>
5 years agosigner: Add signing support for nvidia lp0 firmware from signer
David Riley [Fri, 4 Sep 2015 23:05:06 +0000 (16:05 -0700)]
signer: Add signing support for nvidia lp0 firmware from signer

Signer was calling sign_official_build.sh in a manner that wasn't
being accepted correctly.  Also add test keys from firmware branch.

BUG=chrome-os-partner:44227
TEST=sign_official_build.sh nv_lp0_firmware tegra_lp0_resume.fw tests/devkeys tegra_lp0_resume.fw.signed versions.default
BRANCH=signer

Change-Id: Icd298ac75e3da746220826dc2fb9cc2466e41f1d
Signed-off-by: David Riley <davidriley@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/297802
Reviewed-by: Furquan Shaikh <furquan@chromium.org>
5 years agoimage_signing: rework input/output files and firmware signing
Mike Frysinger [Fri, 4 Sep 2015 23:37:12 +0000 (19:37 -0400)]
image_signing: rework input/output files and firmware signing

The new nvidia logic expects to have the "real" output filename and not
yet another temp path.  Since sign_firmware.sh supports being passed in
the input as the output and doing in-place signing, just document it and
update the callers.

BUG=chrome-os-partner:44227
BRANCH=None
TEST=signer outputs pubkey.sha to the same location as the output firmware

Change-Id: Iadc5dc5aaace6be9e22ff2c55bfbc58b7e1b3ef0
Reviewed-on: https://chromium-review.googlesource.com/296574
Commit-Ready: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: David Riley <davidriley@chromium.org>
5 years agosigner: Add signing support for nvidia lp0 firmware
Furquan Shaikh [Tue, 1 Sep 2015 07:11:35 +0000 (00:11 -0700)]
signer: Add signing support for nvidia lp0 firmware

BUG=chrome-os-partner:44227
BRANCH=None
TEST=unittests run fine.

Change-Id: I7d623a22d73a1749ebebd323fe09cbbeb8cbd61e
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/296429
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
5 years agosign_firmware: Add nv_pkc_signing step if required
Furquan Shaikh [Mon, 31 Aug 2015 18:30:42 +0000 (11:30 -0700)]
sign_firmware: Add nv_pkc_signing step if required

If nv_pkc.pem file is present for a device, use nv_pkc_signing for
adding PKC signature in the firmware image.

BUG=chrome-os-partner:44227
BRANCH=None
TEST=unittests run fine. verified image boots on fused system.

Change-Id: I9b2f48da55137a0e4a75f23d16d3779be1aa94c8
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/296452
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
5 years agoVBOOT2: Add work buffer too small error message
Lee Leahy [Wed, 26 Aug 2015 22:56:05 +0000 (15:56 -0700)]
VBOOT2: Add work buffer too small error message

Update VBOOT2 to add work buffer too small error message.

BRANCH=none
BUG=None
TEST=Build and run on kunimitsu

Change-Id: Icb4b873e0c350a5667948e106c111356acab6a82
Signed-off-by: Lee Leahy <Leroy.P.Leahy@intel.com>
Reviewed-on: https://chromium-review.googlesource.com/295753
Commit-Ready: Leroy P Leahy <leroy.p.leahy@intel.com>
Tested-by: Leroy P Leahy <leroy.p.leahy@intel.com>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
5 years agoRevert "crossystem: Updated crossystem to accomodate Android"
Eric Caruso [Sat, 22 Aug 2015 00:22:29 +0000 (00:22 +0000)]
Revert "crossystem: Updated crossystem to accomodate Android"

This reverts commit 26825b53dc914e4599767ae1e78fe731840027c1.

This looks like it breaks ARM systems by causing crossystem to crash freeing stuff.

BUG=chromium:523189

Change-Id: Ic1e1594519354e7b80424f5c66dc9bdb2605ec73
Reviewed-on: https://chromium-review.googlesource.com/295215
Reviewed-by: Eric Caruso <ejcaruso@chromium.org>
Commit-Queue: Eric Caruso <ejcaruso@chromium.org>
Tested-by: Eric Caruso <ejcaruso@chromium.org>
5 years agosign_official_build: support signing 'kernel' image type
David Riley [Fri, 21 Aug 2015 07:57:38 +0000 (00:57 -0700)]
sign_official_build: support signing 'kernel' image type

BRANCH=signer
BUG=chrome-os-partner:44227
TEST='sign_official_build.sh kernel boot_devsigned.img keys boot_resigned.img'

Change-Id: I805231ef4bd4ed86b35c0d7ca2d3fe1e704caabc
Signed-off-by: David Riley <davidriley@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/294954
Reviewed-by: Mike Frysinger <vapier@chromium.org>
5 years agocrossystem: Updated crossystem to accomodate Android
Shelley Chen [Mon, 10 Aug 2015 18:24:36 +0000 (11:24 -0700)]
crossystem: Updated crossystem to accomodate Android

Previously crossystem assumed that mosys was located
in /usr/sbin.  In Android mosys is currently located
in /system/bin.  Using fixed paths as opposed to
'which' to prevent attacks where attacker could insert
mosys in PATH.

BUG=none
BRANCH=none
TEST=ran crossystem, crossystem fw_try_count/
fw_try_next, crossystem fw_try_count/fw_try_next=x
on link and smaug.

Change-Id: I9604f008d457147188dc852c173d5a184163b339
Signed-off-by: Shelley Chen <shchen@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/292314
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agosign_official_build: support signing 'base' image type
Amey Deshpande [Fri, 14 Aug 2015 21:51:21 +0000 (14:51 -0700)]
sign_official_build: support signing 'base' image type

BRANCH=signer
BUG=chromium:512940
TEST=Tested with the following command:

$ ./sign_official_build.sh base chromiumos_base_image.bin ../../tests/devkeys \
    chromiumos_base_image_signed.bin ../../tests/devkeys/key.versions

Change-Id: Ife2284a6ca82f4306ca26278159859928c0ff2b5
Reviewed-on: https://chromium-review.googlesource.com/293636
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
Tested-by: Amey Deshpande <ameyd@google.com>
Commit-Queue: Amey Deshpande <ameyd@google.com>

5 years agoAdd "tpmc pcrextend" command to extend a PCR
Kevin Cernekee [Wed, 29 Jul 2015 00:25:04 +0000 (17:25 -0700)]
Add "tpmc pcrextend" command to extend a PCR

This is useful for testing different configurations without repeatedly
reflashing the firmware, e.g.

    # stop tcsd
    # tpmc pcr 0
    0000000000000000000000000000000000000000
    # tpmc pcrextend 0 c42ac1c46f1d4e211c735cc7dfad4ff8391110e9
    # tpmc pcr 0
    865aedd337518e56f648440b81b4cbd9359fdff3
    <reboot and try another value>

BUG=none
BRANCH=none
TEST=manual

Change-Id: Ie5814ca2a3a5cf5a0eaf0ffee0385315db09bf25
Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/289009
Reviewed-by: Luigi Semenzato <semenzato@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
5 years agoVbNvStorage: Add flags for misc settings
Furquan Shaikh [Thu, 30 Jul 2015 20:38:24 +0000 (13:38 -0700)]
VbNvStorage: Add flags for misc settings

1. Change offset 8 to hold all misc settings (fastboot, boot_on_ac
detect) instead of only fastboot settings.
2. Add flag to hold state of boot_on_ac_detect (If set to 1, AP should
start booting as soon as AC is connected in off-state).

BUG=chrome-os-partner:41680
BRANCH=None
TEST=Compiles successfully. make runtests successful.

Change-Id: I64b3fc69bd52cbcaf5899c953ccafa2e81b5b8a5
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/289900
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>

5 years agofutility: Compute / verify root key hash
Randall Spangler [Fri, 17 Jul 2015 16:44:29 +0000 (09:44 -0700)]
futility: Compute / verify root key hash

Ryu will store a hash of the GBB root key in a struct inside its boot
block.  Add a vb2_ryu_root_key_hash struct for that.

If 'futility gbb_utility' is used to set the root key, also look for a
root key hash struct and fill it in.  No error if not found, because
this needs to work on other platforms where the struct is not present.
This way, we don't need to change the signing scripts.

Added a --roothash option which can be used to check if the root key
hash is found, and if so, whether it's empty, valid, or invalid.

BUG=chromium:511405
BRANCH=ryu
TEST=manual

    Take any existing image.bin.
    cp image.bin image.orig

    gbb_utility --roothash image.bin
    - ryu root hash not found

    Extract the root key
    gbb_utility -k rootkey.bin image.bin
    - exported root_key to file: rootkey.bin

    Now, append a blank ryu root hash struct to it
    echo '0000000: 5274 4b79 4861 7368 0100 0000 3000 0000' | xxd -r >> image.bin
    echo '0000000: 0000 0000 0000 0000 0000 0000 0000 0000' | xxd -r >> image.bin
    echo '0000000: 0000 0000 0000 0000 0000 0000 0000 0000' | xxd -r >> image.bin

    Nothing is set yet
    gbb_utility --roothash image.bin
    - ryu root hash is unset

    Setting the root key also sets the root hash
    gbb_utility -s -k rootkey.bin image.bin
    - import root_key from rootkey.bin: success
    - calculate ryu root hash: success
    successfully saved new image to: image.bin

    See, it verifies
    gbb_utility --roothash image.bin
    - ryu root hash verified

    Now, append a bad ryu root hash struct to it
    cp image.orig image.bin
    echo '0000000: 5274 4b79 4861 7368 0100 0000 3000 0000' | xxd -r >> image.bin
    echo '0000000: 0001 0000 0000 0000 0000 0000 0000 0000' | xxd -r >> image.bin
    echo '0000000: 0000 0000 0000 0000 0000 0000 0000 0000' | xxd -r >> image.bin

    See, it fails
    gbb_utility --roothash image.bin
    - ryu root hash does not verify

    Make sure the library doesn't contain the magic string
    strings `which futility` | grep RtKyHash
    (should be no output)

Change-Id: Ib46f93cac0f2b532bada4b187ae48efcf4926702
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/286237
Reviewed-by: Furquan Shaikh <furquan@chromium.org>
5 years agocrossystem: Add Skylake PCH GPIO controller ID
Duncan Laurie [Tue, 21 Jul 2015 03:01:34 +0000 (20:01 -0700)]
crossystem: Add Skylake PCH GPIO controller ID

Add the GPIO controller ID that is used in the Skylake PCH
so it can properly export and use GPIOs that are exported
in VBNV for write protect.

BUG=chrome-os-partner:42560
BRANCH=none
TEST=verify crossystem output with and without WP enabled

Change-Id: Ic85c202bd0ca15c154c10481926ef18bafe3fac5
Signed-off-by: Duncan Laurie <dlaurie@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/286827
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
5 years agoimage_signing: Add more description to set_gbb_flags.
Hung-Te Lin [Thu, 16 Jul 2015 10:04:00 +0000 (18:04 +0800)]
image_signing: Add more description to set_gbb_flags.

There are two new GBB flags added (lid/fastboot) and we should update the
description in set_gbb_flags.

BRANCH=none
BUG=none
TEST=emerge-link vboot_reference

Change-Id: I0d16df03e9427ec1c8780fbb6be10c31eed9bf9e
Signed-off-by: Hung-Te Lin <hungte@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/286052
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agocrossystem: Add skylake platform IDs
Duncan Laurie [Tue, 21 Jul 2015 00:05:52 +0000 (17:05 -0700)]
crossystem: Add skylake platform IDs

Add the skylake-u and skylake-y vendor/device IDs so it can be
reported by crossystem.

BUG=chrome-os-partner:42560
BRANCH=none
TEST=run "crossystem platform_family" on glados

Change-Id: I5f9b92d404166e56d77cf8b0cd627a3a0b63bedf
Signed-off-by: Duncan Laurie <dlaurie@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/286921
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
5 years agocrossytem:Fix the write protect line gpio value
John Zhao [Thu, 2 Apr 2015 17:24:51 +0000 (10:24 -0700)]
crossytem:Fix the write protect line gpio value

For crossystem to work correctly on Strago/Cyan,
add Braswell string and correct GPIO offset
calculations.
In Braswell, write protect line is MF_ISH_GPIO_4
as encoded as 0x10016 where the GPEAST offset
(COMMUNITY_OFFSET_GPEAT) is 0x10000

BUG=chrome-os-partner:40835
BRANCH=None
TEST=test_that -b <strago/cyan> <IP> platform_Crossystem

Change-Id: I365f3d6ca9f3ac7ef50abb9b2ba13f184d39c100
Signed-off-by: John Zhao <john.zhao@intel.com>
Signed-off-by: Arindam Roy <arindam.roy@intel.com>
Reviewed-on: https://chromium-review.googlesource.com/274841
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Commit-Queue: Bernie Thompson <bhthompson@chromium.org>

5 years agocrossystem: Revise description of sw_wpsw_boot.
Hung-Te Lin [Thu, 9 Jul 2015 06:53:33 +0000 (14:53 +0800)]
crossystem: Revise description of sw_wpsw_boot.

The sw_wpsw_boot was made for some feature that was almost never completed, and
only makes sense on Baytrail platforms. To prevent confusion we should address
that in the crossystem description.

BRANCH=none
BUG=chromium:508269
TEST=make test

Change-Id: I1fbc7a0e9e8c1f8503ae8ae9dfb6e80c8da892e3
Reviewed-on: https://chromium-review.googlesource.com/284425
Tested-by: Hung-Te Lin <hungte@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
Commit-Queue: Hung-Te Lin <hungte@chromium.org>

5 years agocrossystem: Add check for "mkbp" back
David Hendricks [Mon, 29 Jun 2015 22:05:58 +0000 (15:05 -0700)]
crossystem: Add check for "mkbp" back

We may have been over-zealous earlier when trying to eliminate
references to mkbp. Since crossystem runs on all ChromeOS devices,
this re-adds "mkbp" back to mitigate the risk of encountering
problems on systems running newer versions of ChromeOS but with
older firmware.

BUG=chrome-os-partner:21097
BRANCH=none
TEST=Compiled for veyron_brain

Change-Id: Ia0086687fbc3a1195b062367ccb6ee5c41acd026
Signed-off-by: David Hendricks <dhendrix@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/282602
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
5 years agocrossystem: Check for "cros-ec" instead of "mkbp" for *NvStorage
David Hendricks [Tue, 26 May 2015 23:48:39 +0000 (16:48 -0700)]
crossystem: Check for "cros-ec" instead of "mkbp" for *NvStorage

This changes the string we look for in the devicetree on ARM
platforms to look for "cros-ec" (DT uses dashes instead of
underscores) instead of "mkbp".

BUG=chrome-os-partner:21097
CQ-DEPEND=CL:273347
BRANCH=none
TEST=with depthcharge patch applied, ran crossystem on newly
booted system and saw VBNV-related variables turn out the same.

Signed-off-by: David Hendricks <dhendrix@chromium.org>
Change-Id: Iac43f5381327eb878a8d0db606b78bb7bdce816f
Reviewed-on: https://chromium-review.googlesource.com/273391
Commit-Queue: Stefan Reinauer <reinauer@chromium.org>
Tested-by: Stefan Reinauer <reinauer@chromium.org>
Reviewed-by: Stefan Reinauer <reinauer@chromium.org>
5 years agorecovery: Add recovery reason for fastboot mode requested in fw
Furquan Shaikh [Sat, 20 Jun 2015 21:17:42 +0000 (14:17 -0700)]
recovery: Add recovery reason for fastboot mode requested in fw

BUG=chrome-os-partner:40196
BRANCH=None
TEST=Compiles successfully

Change-Id: Ic69834f2e23926e618349b5a56db549a290cd0c2
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/280922
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>

5 years agocgpt repair: fix segfault which occurs when one of the headers is bad
Andrey Ulanov [Thu, 11 Jun 2015 03:02:06 +0000 (20:02 -0700)]
cgpt repair: fix segfault which occurs when one of the headers is bad

When one of GPT headers is invalid the corresponding partition table
is not loaded and corresponding pointers in GptData are NULL.
GptRepair will try to memcpy one entries table to another which
results in SIGSEGV.

This change fixes it by freeing and then reallocating bad copy of
partition table. This potentially fixes problems which would occur
if two tables have different size.

Change that initially introduced this problem by not always allocating
secondary_entries:
https://chromium-review.googlesource.com/223800

TEST="cgpt repair" works where it previously didn't
TEST=make runtests
BUG=brillo:1203
BRANCH=none

Change-Id: Ibb2fcf33faa5ba157b0865d04c90ee3f26eee113
Reviewed-on: https://chromium-review.googlesource.com/276766
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Andrey Ulanov <andreyu@google.com>
Tested-by: Andrey Ulanov <andreyu@google.com>
5 years agovboot_reference: fix unittest when building with clang.
Yunlian Jiang [Tue, 9 Jun 2015 23:21:56 +0000 (16:21 -0700)]
vboot_reference: fix unittest when building with clang.

When linking vboot_api_kernel4_tests, there are two VbBootNormal()
available, the gcc chooses the one in vboot_api_kernel4_tests.c and
the test passes, the clang chooses the one in vboot_api_kernel.c and
make the unittest fail. This CL makes the one in vboot_api_kernel.c
a weak symbol so that clang can choose the one in
vboot_api_kernel4_tests.c

BUG=chromium:498469
BRANCH=none
TEST=CC=x86_64-cros-linux-gnu-clang  FEATURES='test'
     emerge-amd64-generic vboot_reference

Change-Id: Ibcb78ee055fc9485dbc2bcc1d1cf98144a1a3b64
Reviewed-on: https://chromium-review.googlesource.com/276504
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Yunlian Jiang <yunlian@chromium.org>
Tested-by: Yunlian Jiang <yunlian@chromium.org>
5 years agovboot2: Add 2.0 api layer to verify kernel partition
Randall Spangler [Tue, 19 May 2015 20:41:09 +0000 (13:41 -0700)]
vboot2: Add 2.0 api layer to verify kernel partition

This allows the caller to load the kernel partition and then pass it
to vboot for verification, rather than having vboot assume the kernel
partitions are all on a block storage device.

Next up, APIs for the caller to parse partition information from a GPT
(yes, that's cgptlib, but we'll make it more easily callable by
depthcharge).

BUG=chromium:487699
BRANCH=none
TEST=make -j runtests

Change-Id: I388085c7023f4c76d416f37df0607019bea844ac
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/275646
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
5 years agorecovery: Add recovery reasons for BCB
Furquan Shaikh [Thu, 4 Jun 2015 16:07:49 +0000 (09:07 -0700)]
recovery: Add recovery reasons for BCB

BCB is bootloader control block. Add reasons specific to BCB:
1. In case of any error reading/writing BCB (internal FW error)
2. User-mode requested recovery via BCB (user-mode requested)

BUG=chrome-os-partner:40960
BRANCH=None
TEST=Compiles successfully

Change-Id: I0ac362ba7267a08313cb3077be686aa73367e53b
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/275222
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>

5 years agovboot2: Add routines to load kernel preamble
Randall Spangler [Fri, 29 May 2015 17:53:11 +0000 (10:53 -0700)]
vboot2: Add routines to load kernel preamble

The kernel data itself will be read and verified by a subsequent
change.

BUG=chromium:487699
BRANCH=none
TEST=make -j runtests

Change-Id: Ife4f8250493ec6457f91fda57ae8d4d7bf18ec89
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/274038
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agocgpt: Add a callback to allow override of GPT entry priority
Furquan Shaikh [Tue, 2 Jun 2015 17:32:52 +0000 (10:32 -0700)]
cgpt: Add a callback to allow override of GPT entry priority

This can be used by implementations that want to request vboot to
favor a particular kernel entry for booting without affecting the
checks for rollback protection and image verification.

CQ-DEPEND=CL:274716, CL:274932, CL:275171
BUG=None
BRANCH=None
TEST=Compiles successfully. make -j runtests successful.

Change-Id: I6a4600020354f5d4118c17f083c353c2585c4181
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/274558
Reviewed-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Stefan Reinauer <reinauer@chromium.org>
Tested-by: Nicolas Boichat <drinkcat@chromium.org>
Commit-Queue: Nicolas Boichat <drinkcat@chromium.org>
Trybot-Ready: Nicolas Boichat <drinkcat@chromium.org>

5 years agovboot_api_kernel: Do not pre-populate variables in
Furquan Shaikh [Sat, 30 May 2015 01:00:46 +0000 (18:00 -0700)]
vboot_api_kernel: Do not pre-populate variables in
VbVerifyMemoryBootImage

Do not use values from the header or preamble until it is known to be
good.

BUG=None
BRANCH=None
TEST=Compiles successfully and VbVerifyMemoryBootImage returns early
for images with bad values in header.

Change-Id: Ic026f49292a139e0a04c2556ca9fa62ff277b18f
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/274141
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>

5 years agovboot2: secdata: Check struct_version on initialization
Julius Werner [Fri, 29 May 2015 23:56:20 +0000 (16:56 -0700)]
vboot2: secdata: Check struct_version on initialization

This patch reintroduces a vb2_secdata->struct_version check similar to
the one that was removed in CL:244846. The CRC is not a reliable way to
detect zeroed buffers, so this check helps vboot fail earlier and more
clearly in certain situations.

BRANCH=kitty,smaug,storm,veyron
BUG=chrome-os-partner:40778
TEST=make runtests. Rebooted Jerry with 'mem w 0xff7601b0 0xfdb9', saw
that recovery reason was now 0x2b (VBNV_RECOVERY_VB2_SECDATA_INIT).

Change-Id: Ic4376d127e6d14d4ef9c2f53c83090040ca4cb68
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/274138
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
5 years agofastboot: Add routines for unlock and lock device
Furquan Shaikh [Tue, 26 May 2015 04:49:11 +0000 (21:49 -0700)]
fastboot: Add routines for unlock and lock device

Add support for functions to request unlock and lock of devices in
response to fastboot oem unlock/lock commands. Unlock operation is
equivalent to enabling dev mode and lock operation is equivalent to
leaving dev mode. It is the responsibility of the caller to ensure
that user confirmation is obtained before unlock/lock operations.

BUG=chrome-os-partner:40196
BRANCH=None
TEST=Compiles successfully and fastboot lock/unlock operations work as
expected on smaug. Added tests to ensure lock/unlock operations are
covered. Verified using make -j runtests.

Change-Id: Ibafe75abdd1202473009208a414f3996d537db4f
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/273182
Reviewed-by: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>

5 years agofastboot: Add fastboot related flags to vb2
Furquan Shaikh [Tue, 26 May 2015 04:48:02 +0000 (21:48 -0700)]
fastboot: Add fastboot related flags to vb2

BUG=chrome-os-partner:40196
BRANCH=None
TEST=Compiles successfully.

Change-Id: I4305436b2ae46254e4e8b12039ffed95634d62c2
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/273181
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>

5 years agofastboot: Add fastboot related flags to nvstorage
Furquan Shaikh [Tue, 26 May 2015 04:46:10 +0000 (21:46 -0700)]
fastboot: Add fastboot related flags to nvstorage

Use unused offset 8 for fastboot related flags.

BUG=chrome-os-partner:40196
BRANCH=None
TEST=Compiles successfully.

Change-Id: I6df0985924ba80cdcb68bb6b7658bf962f01287f
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/273180
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>

5 years agoProvide a way to disable counting failed boots
Patrick Georgi [Tue, 10 Feb 2015 13:58:28 +0000 (14:58 +0100)]
Provide a way to disable counting failed boots

When the lid is closed and external power is applied
the system may boot and shut down faster than required
for the OS to determine that things were alright.

In timed charging setups this led to systems ending up
to consider the current version broken because it "failed"
repeatedly.

Remain generic about the reason for not counting boots
since there may be more situations in which we want to
handle the situation optimistically.

BRANCH=none
BUG=chromium:446945
TEST=none

Change-Id: Iea350e3c98d5c00156da682e52c90a882ba017c0
Signed-off-by: Patrick Georgi <pgeorgi@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/249150
Reviewed-by: Randall Spangler <rspangler@chromium.org>