Merge commit 'c31013768eb4ed052c54df50c398f70f2d7ef36d' into 14542.0.0
BUG=b/222349736
TEST=local BE run
RELEASE_NOTE=None
Signed-off-by: Rayan Dasoriya <dasoriya@google.com>
Change-Id: Ie0b27e4c165dec7db1bcca809d14e859894babe1
diff --git a/.gitignore b/.gitignore
index 6ac51f7..9edc243 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
/build
/build-au
/build-main
+Cargo.lock
ID
scripts/newbitmaps/default_source/*.bmp
scripts/newbitmaps/images/out_*
@@ -8,3 +9,5 @@
scripts/newbitmaps/strings/font
scripts/newbitmaps/strings/*.png
scripts/newbitmaps/strings/localized_text/*/*.png
+target
+.idea
diff --git a/Makefile b/Makefile
index 82d6a44..6340fb2 100644
--- a/Makefile
+++ b/Makefile
@@ -56,6 +56,7 @@
# US_DIR = shared data directory (for static content like devkeys)
# DF_DIR = utility defaults directory
# VB_DIR = vboot binary directory for dev-mode-only scripts
+# DUT_TEST_DIR = vboot dut tests binary directory
UB_DIR=${DESTDIR}/usr/bin
UL_DIR=${DESTDIR}/usr/${LIBDIR}
ULP_DIR=${UL_DIR}/pkgconfig
@@ -63,6 +64,7 @@
US_DIR=${DESTDIR}/usr/share/vboot
DF_DIR=${DESTDIR}/etc/default
VB_DIR=${US_DIR}/bin
+DUT_TEST_DIR=${US_DIR}/tests
# Where to install the (exportable) executables for testing?
TEST_INSTALL_DIR = ${BUILD}/install_for_test
@@ -71,12 +73,12 @@
SDK_BUILD ?=
# Verbose? Use V=1
-ifeq (${V},)
+ifeq ($(filter-out 0,${V}),)
Q := @
endif
# Quiet? Use QUIET=1
-ifeq (${QUIET},)
+ifeq ($(filter-out 0,${QUIET}),)
PRINTF := printf
else
PRINTF := :
@@ -123,7 +125,7 @@
# Provide default CC and CFLAGS for firmware builds; if you have any -D flags,
# please add them after this point (e.g., -DVBOOT_DEBUG).
-DEBUG_FLAGS := $(if ${DEBUG},-g -Og,-g -Os)
+DEBUG_FLAGS := $(if $(filter-out 0,${DEBUG}),-g -Og,-g -Os)
WERROR := -Werror
FIRMWARE_FLAGS := -nostdinc -ffreestanding -fno-builtin -fno-stack-protector
COMMON_FLAGS := -pipe ${WERROR} -Wall -Wstrict-prototypes -Wtype-limits \
@@ -171,35 +173,28 @@
# Needs -Wl because LD is actually set to CC by default.
LDFLAGS += -Wl,--gc-sections
-ifneq (${DEBUG}$(filter-out 0,${TEST_PRINT}),)
+ifneq ($(filter-out 0,${DEBUG})$(filter-out 0,${TEST_PRINT}),)
CFLAGS += -DVBOOT_DEBUG
endif
-ifeq (${DISABLE_NDEBUG},)
+ifeq ($(filter-out 0,${DISABLE_NDEBUG}),)
CFLAGS += -DNDEBUG
endif
-ifneq (${FORCE_LOGGING_ON},)
+ifneq ($(filter-out 0,${FORCE_LOGGING_ON}),)
CFLAGS += -DFORCE_LOGGING_ON=${FORCE_LOGGING_ON}
endif
-ifneq (${TPM2_MODE},)
+ifneq ($(filter-out 0,${TPM2_MODE}),)
CFLAGS += -DTPM2_MODE
endif
# Support devices with GPT in SPI-NOR (for nand device)
# TODO(b:184812319): Consider removing this code if nobody uses it.
-ifneq (${GPT_SPI_NOR},)
+ifneq ($(filter-out 0,${GPT_SPI_NOR}),)
CFLAGS += -DGPT_SPI_NOR
endif
-# Enable boot from external disk when switching to dev mode
-ifneq ($(filter-out 0,${BOOT_EXTERNAL_ON_DEV}),)
-CFLAGS += -DBOOT_EXTERNAL_ON_DEV=1
-else
-CFLAGS += -DBOOT_EXTERNAL_ON_DEV=0
-endif
-
# Enable EC early firmware selection.
ifneq ($(filter-out 0,${EC_EFS}),)
CFLAGS += -DEC_EFS=1
@@ -208,7 +203,7 @@
endif
# Some tests need to be disabled when using mocked_secdata_tpm.
-ifneq (${MOCK_TPM},)
+ifneq ($(filter-out 0,${MOCK_TPM}),)
CFLAGS += -DMOCK_TPM
endif
@@ -219,29 +214,6 @@
CFLAGS += -DTPM2_SIMULATOR=0
endif
-# VTPM_PROXY indicates whether the TPM driver simulator feature
-# is enable or not.
-# This flag only takes effect when TPM2_SIMULATOR is enabled.
-ifneq ($(filter-out 0,${VTPM_PROXY}),)
-CFLAGS += -DVTPM_PROXY=1
-else
-CFLAGS += -DVTPM_PROXY=0
-endif
-
-# DETACHABLE indicates whether the device is a detachable or not.
-ifneq ($(filter-out 0,${DETACHABLE}),)
-CFLAGS += -DDETACHABLE=1
-else
-CFLAGS += -DDETACHABLE=0
-endif
-
-# Confirm physical presence using keyboard
-ifneq ($(filter-out 0,${PHYSICAL_PRESENCE_KEYBOARD}),)
-CFLAGS += -DPHYSICAL_PRESENCE_KEYBOARD=1
-else
-CFLAGS += -DPHYSICAL_PRESENCE_KEYBOARD=0
-endif
-
# NOTE: We don't use these files but they are useful for other packages to
# query about required compiling/linking flags.
PC_IN_FILES = vboot_host.pc.in
@@ -264,7 +236,7 @@
CFLAGS += $(cflags_use_64bits)
# Code coverage
-ifneq (${COV},)
+ifneq ($(filter-out 0,${COV}),)
COV_FLAGS = -O0 --coverage -DCOVERAGE
CFLAGS += ${COV_FLAGS}
LDFLAGS += ${COV_FLAGS}
@@ -286,7 +258,7 @@
PKG_CONFIG ?= pkg-config
# Static?
-ifneq (${STATIC},)
+ifneq ($(filter-out 0,${STATIC}),)
LDFLAGS += -static
PKG_CONFIG += --static
endif
@@ -298,11 +270,17 @@
# Optional Libraries
LIBZIP_VERSION := $(shell ${PKG_CONFIG} --modversion libzip 2>/dev/null)
HAVE_LIBZIP := $(if ${LIBZIP_VERSION},1)
-ifneq (${HAVE_LIBZIP},)
+ifneq ($(filter-out 0,${HAVE_LIBZIP}),)
CFLAGS += -DHAVE_LIBZIP $(shell ${PKG_CONFIG} --cflags libzip)
LIBZIP_LIBS := $(shell ${PKG_CONFIG} --libs libzip)
endif
+HAVE_CROSID := $(shell ${PKG_CONFIG} --exists crosid && echo 1)
+ifeq ($(HAVE_CROSID),1)
+ CFLAGS += -DHAVE_CROSID $(shell ${PKG_CONFIG} --cflags crosid)
+ CROSID_LIBS := $(shell ${PKG_CONFIG} --libs crosid)
+endif
+
# Determine QEMU architecture needed, if any
ifeq (${ARCH},${HOST_ARCH})
# Same architecture; no need for QEMU
@@ -344,9 +322,9 @@
# Default target.
.PHONY: all
all: fwlib futil utillib hostlib cgpt tlcl \
- $(if ${SDK_BUILD},utils_sdk,utils_board) \
+ $(if ${SDK_BUILD},${UTIL_FILES_SDK},${UTIL_FILES_BOARD}) \
$(if $(filter x86_64,${ARCH}),$(if $(filter clang,${CC}),fuzzers)) \
- $(if ${COV},coverage)
+ $(if $(filter-out 0,${COV}),coverage)
##############################################################################
# Now we need to describe everything we might want or need to build
@@ -416,7 +394,7 @@
firmware/lib20/kernel.c
# TPM lightweight command library
-ifeq (${TPM2_MODE},)
+ifeq ($(filter-out 0,${TPM2_MODE}),)
TLCL_SRCS = \
firmware/lib/tpm_lite/tlcl.c
else
@@ -427,7 +405,7 @@
endif
# Support real TPM unless MOCK_TPM is set
-ifneq (${MOCK_TPM},)
+ifneq ($(filter-out 0,${MOCK_TPM}),)
FWLIB_SRCS += \
firmware/lib/tpm_lite/mocked_tlcl.c
endif
@@ -455,6 +433,19 @@
TLCL_OBJS = ${TLCL_SRCS:%.c=${BUILD}/%.o}
ALL_OBJS += ${FWLIB_OBJS} ${TLCL_OBJS}
+# Maintain behaviour of default on.
+USE_FLASHROM ?= 1
+
+ifneq ($(filter-out 0,${USE_FLASHROM}),)
+$(info building with libflashrom support)
+FLASHROM_LIBS := $(shell ${PKG_CONFIG} --libs flashrom)
+COMMONLIB_SRCS = \
+ host/lib/flashrom.c \
+ host/lib/flashrom_drv.c \
+ host/lib/subprocess.c
+CFLAGS += -DUSE_FLASHROM
+endif
+
# Intermediate library for the vboot_reference utilities to link against.
UTILLIB = ${BUILD}/libvboot_util.a
@@ -473,7 +464,7 @@
host/lib/crossystem.c \
host/lib/crypto.c \
host/lib/file_keys.c \
- host/lib/flashrom.c \
+ $(COMMONLIB_SRCS) \
host/lib/fmap.c \
host/lib/host_common.c \
host/lib/host_key2.c \
@@ -482,7 +473,6 @@
host/lib/host_signature.c \
host/lib/host_signature2.c \
host/lib/signature_digest.c \
- host/lib/subprocess.c \
host/lib/util_misc.c \
host/lib21/host_common.c \
host/lib21/host_key.c \
@@ -533,14 +523,13 @@
host/lib/crossystem.c \
host/lib/crypto.c \
host/lib/extract_vmlinuz.c \
- host/lib/flashrom.c \
+ $(COMMONLIB_SRCS) \
host/lib/fmap.c \
host/lib/host_misc.c \
- host/lib/subprocess.c \
host/lib21/host_misc.c \
${TLCL_SRCS}
-ifneq (${GPT_SPI_NOR},)
+ifneq ($(filter-out 0,${GPT_SPI_NOR}),)
HOSTLIB_SRCS += cgpt/cgpt_nor.c
endif
@@ -574,7 +563,7 @@
cgpt/cmd_repair.c \
cgpt/cmd_show.c
-ifneq (${GPT_SPI_NOR},)
+ifneq ($(filter-out 0,${GPT_SPI_NOR}),)
CGPT_SRCS += cgpt/cgpt_nor.c
endif
@@ -596,27 +585,32 @@
UTIL_DEFAULTS = ${BUILD}/default/vboot_reference
# Scripts to install directly (not compiled)
-UTIL_SCRIPTS_SDK = \
+UTIL_SCRIPT_NAMES_SDK = \
utility/dev_make_keypair \
utility/vbutil_what_keys
-UTIL_SCRIPTS_BOARD = \
+UTIL_SCRIPT_NAMES_BOARD = \
utility/chromeos-tpm-recovery \
utility/dev_debug_vboot \
utility/enable_dev_usb_boot \
utility/tpm-nvsize
-UTIL_NAMES_SDK = \
+UTIL_BIN_NAMES_SDK = \
+ utility/dumpRSAPublicKey \
utility/load_kernel_test \
utility/pad_digest_utility \
utility/signature_digest_utility \
utility/verify_data
-UTIL_NAMES_BOARD = \
+UTIL_BIN_NAMES_BOARD = \
utility/crossystem \
utility/dumpRSAPublicKey \
utility/tpmc
-UTIL_BINS_SDK = $(addprefix ${BUILD}/,${UTIL_NAMES_SDK})
-UTIL_BINS_BOARD = $(addprefix ${BUILD}/,${UTIL_NAMES_BOARD})
+UTIL_SCRIPTS_SDK = $(addprefix ${BUILD}/,${UTIL_SCRIPT_NAMES_SDK})
+UTIL_SCRIPTS_BOARD = $(addprefix ${BUILD}/,${UTIL_SCRIPT_NAMES_BOARD})
+UTIL_BINS_SDK = $(addprefix ${BUILD}/,${UTIL_BIN_NAMES_SDK})
+UTIL_BINS_BOARD = $(addprefix ${BUILD}/,${UTIL_BIN_NAMES_BOARD})
+UTIL_FILES_SDK = ${UTIL_BINS_SDK} ${UTIL_SCRIPTS_SDK}
+UTIL_FILES_BOARD = ${UTIL_BINS_BOARD} ${UTIL_SCRIPTS_BOARD}
ALL_OBJS += $(addsuffix .o,${UTIL_BINS_SDK})
ALL_OBJS += $(addsuffix .o,${UTIL_BINS_BOARD})
@@ -654,6 +648,7 @@
futility/cmd_dump_fmap.c \
futility/cmd_dump_kernel_config.c \
futility/cmd_gbb_utility.c \
+ futility/cmd_gscvd.c \
futility/cmd_load_fmap.c \
futility/cmd_pcr.c \
futility/cmd_show.c \
@@ -663,20 +658,24 @@
futility/cmd_vbutil_firmware.c \
futility/cmd_vbutil_firmware.c \
futility/cmd_vbutil_kernel.c \
+ futility/cmd_vbutil_key.c \
futility/cmd_vbutil_keyblock.c \
- futility/cmd_vbutil_key.c \
- futility/cmd_vbutil_key.c \
futility/file_type_bios.c \
futility/file_type.c \
futility/file_type_rwsig.c \
futility/file_type_usbpd1.c \
futility/misc.c \
- futility/updater.c \
+ futility/vb1_helper.c \
+ futility/vb2_helper.c
+
+ifneq ($(filter-out 0,${USE_FLASHROM}),)
+FUTIL_SRCS += host/lib/flashrom_drv.c \
+ futility/flashrom_wp_drv.c \
futility/updater_archive.c \
futility/updater_quirks.c \
futility/updater_utils.c \
- futility/vb1_helper.c \
- futility/vb2_helper.c
+ futility/updater.c
+endif
# List of commands built in futility.
FUTIL_CMD_LIST = ${BUILD}/gen/futility_cmds.c
@@ -713,7 +712,7 @@
tests/vboot_kernel2_tests \
tests/verify_kernel
-ifeq (${MOCK_TPM}${TPM2_MODE},)
+ifeq ($(filter-out 0,${MOCK_TPM})$(filter-out 0,${TPM2_MODE}),)
# tlcl_tests only works when MOCK_TPM is disabled
# TODO(apronin): tests for TPM2 case?
TEST_NAMES += \
@@ -768,13 +767,15 @@
TEST_NAMES += ${TEST2X_NAMES} ${TEST20_NAMES} ${TEST21_NAMES}
-# This is build-only test since we can't run this without
-# sha-ni extension on x86. To run this test, you have to
-# manually copy executable into compatible machine and run it.
-TEST_NAMES += tests/vb2_sha256_x86_tests
+# Tests which should be run on dut
+ifeq (${ARCH}, x86_64)
+DUT_TEST_NAMES += tests/vb2_sha256_x86_tests
+endif
+
+TEST_NAMES += ${DUT_TEST_NAMES}
# And a few more...
-ifeq (${TPM2_MODE},)
+ifeq ($(filter-out 0,${TPM2_MODE}),)
TLCL_TEST_NAMES = \
tests/tpm_lite/tpmtest_earlyextend \
tests/tpm_lite/tpmtest_earlynvram \
@@ -832,7 +833,9 @@
.PHONY: install
install: cgpt_install signing_install futil_install pc_files_install \
- lib_install $(if ${SDK_BUILD},utils_install_sdk,utils_install_board)
+ lib_install $(if ${SDK_BUILD},,util_install_defaults) \
+ $(foreach f,$(if ${SDK_BUILD},${UTIL_FILES_SDK},${UTIL_FILES_BOARD}), \
+ util_install-$(patsubst ${BUILD}/%,%,${f}))
.PHONY: install_dev
install_dev: devkeys_install headers_install
@@ -842,8 +845,9 @@
.PHONY: install_for_test
install_for_test: override DESTDIR = ${TEST_INSTALL_DIR}
-install_for_test: test_setup
-install_for_test: install utils_install_sdk utils_install_board
+install_for_test: test_setup install \
+ $(foreach f,${UTIL_FILES_SDK} ${UTIL_FILES_BOARD}, \
+ util_install-$(patsubst ${BUILD}/%,%,${f}))
# Don't delete intermediate object files
.SECONDARY:
@@ -963,7 +967,7 @@
${Q}${LD} -o ${CGPT_WRAPPER} ${LDFLAGS} $^ ${LDLIBS}
.PHONY: cgpt
-cgpt: ${CGPT} $(if ${GPT_SPI_NOR},cgpt_wrapper)
+cgpt: ${CGPT} $(if $(filter-out 0,${GPT_SPI_NOR}),cgpt_wrapper)
# on FreeBSD: install misc/e2fsprogs-libuuid from ports,
# or e2fsprogs-libuuid from its binary package system.
@@ -1001,27 +1005,23 @@
${UTIL_BINS_BOARD}: ${UTILLIB}
${UTIL_BINS_BOARD}: LIBS = ${UTILLIB}
-.PHONY: utils_sdk
-utils_sdk: ${UTIL_BINS_SDK} ${UTIL_SCRIPTS_SDK}
- ${Q}cp -f ${UTIL_SCRIPTS_SDK} ${BUILD}/utility
- ${Q}chmod a+rx $(patsubst %,${BUILD}/%,${UTIL_SCRIPTS_SDK})
+${UTIL_SCRIPTS_SDK} ${UTIL_SCRIPTS_BOARD}: ${BUILD}/%: %
+ ${Q}cp -f $< $@
+ ${Q}chmod a+rx $@
-.PHONY: utils_board
-utils_board: ${UTIL_BINS_BOARD} ${UTIL_SCRIPTS_BOARD}
- ${Q}cp -f ${UTIL_SCRIPTS_BOARD} ${BUILD}/utility
- ${Q}chmod a+rx $(patsubst %,${BUILD}/%,${UTIL_SCRIPTS_BOARD})
+define UTIL_INSTALL_template
+.PHONY: util_install-$(1)
+util_install-$(1): $$(addprefix $${BUILD}/,$(1))
+ @${PRINTF} " INSTALL $(1)\n"
+ ${Q}mkdir -p $${UB_DIR}
+ ${Q}${INSTALL} -t $${UB_DIR} $$<
+endef
-.PHONY: utils_install_sdk
-utils_install_sdk: utils_sdk
- @${PRINTF} " INSTALL UTILS\n"
- ${Q}mkdir -p ${UB_DIR}
- ${Q}${INSTALL} -t ${UB_DIR} ${UTIL_BINS_SDK} ${UTIL_SCRIPTS_SDK}
+$(foreach f, $(sort ${UTIL_FILES_SDK} ${UTIL_FILES_BOARD}), \
+ $(eval $(call UTIL_INSTALL_template,$(patsubst ${BUILD}/%,%,${f}))))
-.PHONY: utils_install_board
-utils_install_board: utils_board ${UTIL_DEFAULTS}
- @${PRINTF} " INSTALL UTILS\n"
- ${Q}mkdir -p ${UB_DIR}
- ${Q}${INSTALL} -t ${UB_DIR} ${UTIL_BINS_BOARD} ${UTIL_SCRIPTS_BOARD}
+.PHONY: util_install_defaults
+util_install_defaults: ${UTIL_DEFAULTS}
${Q}mkdir -p ${DF_DIR}
${Q}${INSTALL} -t ${DF_DIR} -m 'u=rw,go=r,a-s' ${UTIL_DEFAULTS}
@@ -1040,7 +1040,7 @@
futil: ${FUTIL_BIN}
# FUTIL_LIBS is shared by FUTIL_BIN and TEST_FUTIL_BINS.
-FUTIL_LIBS = ${CRYPTO_LIBS} ${LIBZIP_LIBS}
+FUTIL_LIBS = ${CROSID_LIBS} ${CRYPTO_LIBS} ${LIBZIP_LIBS} ${FLASHROM_LIBS}
${FUTIL_BIN}: LDLIBS += ${FUTIL_LIBS}
${FUTIL_BIN}: ${FUTIL_OBJS} ${UTILLIB} ${FWLIB}
@@ -1094,17 +1094,28 @@
${TEST20_BINS}: LIBS += ${FWLIB}
${TEST20_BINS}: LDLIBS += ${CRYPTO_LIBS}
-# Special build for sha256_x86 test
-X86_SHA256_TEST = ${BUILD_RUN}/tests/vb2_sha256_x86_tests
-${X86_SHA256_TEST}: ${BUILD}/firmware/2lib/2sha256_x86.o
-${X86_SHA256_TEST}: LIBS += ${BUILD}/firmware/2lib/2sha256_x86.o
-
${TESTLIB}: ${TESTLIB_OBJS}
@${PRINTF} " RM $(subst ${BUILD}/,,$@)\n"
${Q}rm -f $@
@${PRINTF} " AR $(subst ${BUILD}/,,$@)\n"
${Q}ar qc $@ $^
+DUT_TEST_BINS = $(addprefix ${BUILD}/,${DUT_TEST_NAMES})
+
+# Special build for sha256_x86 test
+${BUILD}/tests/vb2_sha256_x86_tests: \
+ ${BUILD}/firmware/2lib/2sha256_x86.o
+${BUILD}/tests/vb2_sha256_x86_tests: \
+ LIBS += ${BUILD}/firmware/2lib/2sha256_x86.o
+
+.PHONY: install_dut_test
+install_dut_test: ${DUT_TEST_BINS}
+ifneq ($(strip ${DUT_TEST_BINS}),)
+ @${PRINTF} " INSTALL DUT TESTS\n"
+ ${Q}mkdir -p ${DUT_TEST_DIR}
+ ${Q}${INSTALL} -t ${DUT_TEST_DIR} $^
+endif
+
# ----------------------------------------------------------------------------
# Fuzzers
@@ -1171,7 +1182,7 @@
${BUILD}/tests/%: LDLIBS += -lrt -luuid
${BUILD}/tests/%: LIBS += ${TESTLIB}
-ifeq (${TPM2_MODE},)
+ifeq ($(filter-out 0,${TPM2_MODE}),)
# TODO(apronin): tests for TPM2 case?
TLCL_TEST_BINS = $(addprefix ${BUILD}/,${TLCL_TEST_NAMES})
${TLCL_TEST_BINS}: OBJS += ${BUILD}/tests/tpm_lite/tlcl_tests.o
@@ -1208,7 +1219,7 @@
# Targets that exist just to run tests
.PHONY: test_setup
-test_setup:: cgpt utils_sdk utils_board futil tests
+test_setup:: cgpt ${UTIL_FILES_SDK} ${UTIL_FILES_BOARD} futil tests
# Qemu setup for cross-compiled tests. Need to copy qemu binary into the
# sysroot.
@@ -1261,7 +1272,7 @@
runmisctests: install_for_test
${RUNTEST} ${BUILD_RUN}/tests/gpt_misc_tests
${RUNTEST} ${BUILD_RUN}/tests/subprocess_tests
-ifeq (${MOCK_TPM}${TPM2_MODE},)
+ifeq ($(filter-out 0,${MOCK_TPM})$(filter-out 0,${TPM2_MODE}),)
# tlcl_tests only works when MOCK_TPM is disabled
${RUNTEST} ${BUILD_RUN}/tests/tlcl_tests
endif
@@ -1345,7 +1356,7 @@
-o ${COV_INFO}.firmware
.PHONY: coverage
-ifeq (${COV},)
+ifeq ($(filter-out 0,${COV}),)
coverage:
$(error Build coverage like this: make clean && COV=1 make coverage)
else
diff --git a/OWNERS b/OWNERS
index 74ba71a..21ecb22 100644
--- a/OWNERS
+++ b/OWNERS
@@ -1,5 +1,5 @@
jwerner@chromium.org
yupingso@chromium.org
-furquan@chromium.org
+twawrzynczak@chromium.org
hungte@chromium.org
*
diff --git a/PRESUBMIT.cfg b/PRESUBMIT.cfg
index 54d538d..9f66545 100644
--- a/PRESUBMIT.cfg
+++ b/PRESUBMIT.cfg
@@ -1,5 +1,6 @@
[Hook Overrides]
branch_check: true
+cargo_clippy_check: true
checkpatch_check: true
long_line_check: false
signoff_check: true
@@ -10,3 +11,6 @@
[Hook Overrides Options]
cros_license_check: --exclude_regex=^\.checkpatch\.conf$
+
+cargo_clippy_check:
+ --project=rust/vboot_reference-sys
diff --git a/README b/README
index 04ab0c9..1787d4d 100644
--- a/README
+++ b/README
@@ -48,6 +48,9 @@
Tools and scripts used to generate and use new signing keypairs. These are
typically used only on a secure machine.
+rust/
+
+ Rust bindings for vboot_reference. See rust/README.md for more details.
--------------------
Building and testing
diff --git a/cgpt/cgpt_nor.c b/cgpt/cgpt_nor.c
index 2e43918..1530271 100644
--- a/cgpt/cgpt_nor.c
+++ b/cgpt/cgpt_nor.c
@@ -70,7 +70,7 @@
return status;
}
-int ForkExecL(const char *cwd, const char *cmd, ...) {
+static int ForkExecL(const char *cwd, const char *cmd, ...) {
int argc;
va_list ap;
va_start(ap, cmd);
@@ -199,6 +199,10 @@
return nftw(dir, remove_file_or_dir, 20, FTW_DEPTH | FTW_PHYS);
}
+#define FLASHROM_RW_GPT_PRI "RW_GPT_PRIMARY:rw_gpt_1",
+#define FLASHROM_RW_GPT_SEC "RW_GPT_SECONDARY:rw_gpt_2"
+#define FLASHROM_RW_GPT "RW_GPT:rw_gpt"
+
// Read RW_GPT from NOR flash to "rw_gpt" in a temp dir |temp_dir_template|.
// |temp_dir_template| is passed to mkdtemp() so it must satisfy all
// requirements by mkdtemp.
@@ -225,7 +229,7 @@
Error("Cannot change directory.\n");
goto out_free;
}
- const char *const argv[] = {FLASHROM_PATH, "-i", "RW_GPT:rw_gpt", "-r"};
+ const char *const argv[] = {FLASHROM_PATH, "-i", FLASHROM_RW_GPT, "-r"};
// Redirect stdout to /dev/null so that flashrom does not muck up cgpt's
// output.
if (subprocess_run(argv, &subprocess_null, &subprocess_null, NULL) != 0) {
@@ -266,7 +270,7 @@
Error("Cannot change directory.\n");
goto out_free;
}
- const char *const argv1[] = {FLASHROM_PATH, "-i", "RW_GPT_PRIMARY:rw_gpt_1",
+ const char *const argv1[] = {FLASHROM_PATH, "-i", FLASHROM_RW_GPT_PRI,
"-w", "--noverify-all"};
// Redirect stdout to /dev/null so that flashrom does not muck up cgpt's
// output.
@@ -274,7 +278,7 @@
Warning("Cannot write the 1st half of rw_gpt back with flashrom.\n");
nr_fails++;
}
- const char *const argv2[] = {FLASHROM_PATH, "-i", "RW_GPT_SECONDARY:rw_gpt_2",
+ const char *const argv2[] = {FLASHROM_PATH, "-i", FLASHROM_RW_GPT_SEC,
"-w", "--noverify-all"};
// Redirect stdout to /dev/null so that flashrom does not muck up cgpt's
// output.
diff --git a/firmware/2lib/2api.c b/firmware/2lib/2api.c
index 593a12c..c041d8a 100644
--- a/firmware/2lib/2api.c
+++ b/firmware/2lib/2api.c
@@ -67,8 +67,8 @@
/*
* Check for recovery. Note that this function returns void, since any
* errors result in requesting recovery. That's also why we don't
- * return error from failures in the preceding two steps; those
- * failures simply cause us to detect recovery mode here.
+ * return error from failures in the preceding steps; those failures
+ * simply cause us to detect recovery mode here.
*/
vb2_check_recovery(ctx);
@@ -89,6 +89,9 @@
if (ctx->flags & VB2_CONTEXT_DISPLAY_INIT)
sd->flags |= VB2_SD_FLAG_DISPLAY_AVAILABLE;
+ /* Decide the boot mode */
+ vb2_set_boot_mode(ctx);
+
/* Return error if recovery is needed */
if (ctx->flags & VB2_CONTEXT_RECOVERY_MODE) {
/* Always clear RAM when entering recovery mode */
diff --git a/firmware/2lib/2auxfw_sync.c b/firmware/2lib/2auxfw_sync.c
index da7bc97..eaea1d4 100644
--- a/firmware/2lib/2auxfw_sync.c
+++ b/firmware/2lib/2auxfw_sync.c
@@ -28,40 +28,6 @@
}
/**
- * Update the specified auxfw and verify the update succeeded.
- *
- * @param ctx Vboot2 context
- * @return VB2_SUCCESS, or non-zero error code.
- */
-static vb2_error_t update_auxfw(struct vb2_context *ctx)
-{
- vb2_error_t rv;
-
- VB2_DEBUG("Updating auxfw\n");
-
- /*
- * The underlying platform is expected to know how and where to find the
- * firmware image for all auxfw devices.
- */
- rv = vb2ex_auxfw_update();
- if (rv != VB2_SUCCESS) {
- VB2_DEBUG("vb2ex_auxfw_update() returned %d\n", rv);
-
- /*
- * The device may need a reboot. It may need to unprotect the
- * region before updating, or may need to reboot after updating.
- * Either way, it's not an error requiring recovery mode.
- *
- * If we fail for any other reason, trigger recovery mode.
- */
- if (rv != VB2_REQUEST_REBOOT_EC_TO_RO)
- vb2api_fail(ctx, VB2_RECOVERY_AUXFW_UPDATE, rv);
- }
-
- return rv;
-}
-
-/**
* Decides if auxfw sync is allowed to be performed.
*
* If sync is allowed, invokes the external callback,
@@ -90,7 +56,8 @@
VB2_TRY(auxfw_sync_check_update(ctx, &fw_update));
if (fw_update > VB2_AUXFW_NO_UPDATE) {
- VB2_TRY(update_auxfw(ctx));
+ VB2_DEBUG("Updating auxfw\n");
+ VB2_TRY(vb2ex_auxfw_update(), ctx, VB2_RECOVERY_AUXFW_UPDATE);
/*
* auxfw update is applied successfully. Request EC reboot to
* RO, so that the chips that had FW update get reset to a
diff --git a/firmware/2lib/2ec_sync.c b/firmware/2lib/2ec_sync.c
index 20490e0..e75313b 100644
--- a/firmware/2lib/2ec_sync.c
+++ b/firmware/2lib/2ec_sync.c
@@ -160,10 +160,10 @@
struct vb2_shared_data *sd = vb2_get_sd(ctx);
int in_rw = 0;
/*
- * We don't use vb2ex_ec_trusted, which checks EC_IN_RW. It is
- * controlled by cr50 but on some platforms, cr50 can't know when a EC
- * resets. So, we trust what EC-RW says. If it lies it's in RO, we'll
- * flash RW while it's in RW.
+ * We don't use VB2_CONTEXT_EC_TRUSTED, which checks if not EC_IN_RW.
+ * It is controlled by cr50 but on some platforms, cr50 can't know when
+ * a EC resets. So, we trust what EC-RW says. If it lies it's in RO,
+ * we'll flash RW while it's in RW.
*/
/* If we couldn't determine where the EC was, reboot to recovery. */
VB2_TRY(vb2ex_ec_running_rw(&in_rw),
diff --git a/firmware/2lib/2kernel.c b/firmware/2lib/2kernel.c
index 86fb286..5b18cad 100644
--- a/firmware/2lib/2kernel.c
+++ b/firmware/2lib/2kernel.c
@@ -164,7 +164,7 @@
/* Load recovery key from GBB. */
rv = vb2_gbb_read_recovery_key(ctx, &packed_key, NULL, &wb);
if (rv) {
- if (vb2api_allow_recovery(ctx))
+ if (ctx->boot_mode != VB2_BOOT_MODE_BROKEN_SCREEN)
VB2_DIE("GBB read recovery key failed.\n");
else
/*
diff --git a/firmware/2lib/2misc.c b/firmware/2lib/2misc.c
index efa33a8..6e92690 100644
--- a/firmware/2lib/2misc.c
+++ b/firmware/2lib/2misc.c
@@ -154,7 +154,6 @@
else
/* Recovery was forced. Override recovery reason */
sd->recovery_reason = VB2_RECOVERY_RO_MANUAL;
- sd->flags |= VB2_SD_FLAG_MANUAL_RECOVERY;
}
/* If recovery reason is non-zero, tell caller we need recovery mode */
@@ -164,6 +163,8 @@
sd->recovery_reason,
vb2_nv_get(ctx, VB2_NV_RECOVERY_SUBCODE));
}
+
+ sd->status |= VB2_SD_STATUS_RECOVERY_DECIDED;
}
vb2_error_t vb2_fw_init_gbb(struct vb2_context *ctx)
@@ -377,7 +378,7 @@
vb2_error_t vb2api_enable_developer_mode(struct vb2_context *ctx)
{
- if (!vb2api_allow_recovery(ctx)) {
+ if (ctx->boot_mode != VB2_BOOT_MODE_MANUAL_RECOVERY) {
VB2_DEBUG("ERROR: Can only enable developer mode from manual "
"recovery mode\n");
return VB2_ERROR_API_ENABLE_DEV_NOT_ALLOWED;
@@ -391,9 +392,6 @@
flags |= VB2_SECDATA_FIRMWARE_FLAG_DEV_MODE;
vb2_secdata_firmware_set(ctx, VB2_SECDATA_FIRMWARE_FLAGS, flags);
- if (BOOT_EXTERNAL_ON_DEV)
- vb2_nv_set(ctx, VB2_NV_DEV_BOOT_EXTERNAL, 1);
-
VB2_DEBUG("Mode change will take effect on next reboot\n");
return VB2_SUCCESS;
@@ -416,30 +414,6 @@
VB2_DEBUG("Diagnostics requested\n");
}
-test_mockable
-int vb2api_allow_recovery(struct vb2_context *ctx)
-{
- if (ctx->flags & VB2_CONTEXT_NO_BOOT)
- return 0;
-
- /* VB2_GBB_FLAG_FORCE_MANUAL_RECOVERY forces this to always return
- true. */
- if (vb2_get_gbb(ctx)->flags & VB2_GBB_FLAG_FORCE_MANUAL_RECOVERY)
- return 1;
-
- /*
- * If EC is in RW, it implies recovery wasn't manually requested.
- * On some platforms, EC_IN_RW can't be reset by the EC, thus, this may
- * return false (=RW). That's ok because if recovery is manual, we will
- * get the right signal and that's the case we care about.
- */
- if (!(ctx->flags & VB2_CONTEXT_EC_TRUSTED) && !vb2ex_ec_trusted())
- return 0;
-
- /* Now we confidently check the recovery switch state at boot */
- return !!(vb2_get_sd(ctx)->flags & VB2_SD_FLAG_MANUAL_RECOVERY);
-}
-
void vb2_clear_recovery(struct vb2_context *ctx)
{
struct vb2_shared_data *sd = vb2_get_sd(ctx);
@@ -451,13 +425,13 @@
reason, subcode,
vb2_get_recovery_reason_string(reason));
- /* Clear recovery request for both manual and non-manual. */
+ /* Clear recovery request for both the manual recovery and the broken
+ screen. */
vb2_nv_set(ctx, VB2_NV_RECOVERY_REQUEST, VB2_RECOVERY_NOT_REQUESTED);
vb2_nv_set(ctx, VB2_NV_RECOVERY_SUBCODE, 0);
- /* But stow recovery reason as subcode for non-manual recovery. */
- if ((ctx->flags & VB2_CONTEXT_RECOVERY_MODE) &&
- !vb2api_allow_recovery(ctx)) {
+ /* But stow recovery reason as subcode for the broken screen. */
+ if (ctx->boot_mode == VB2_BOOT_MODE_BROKEN_SCREEN) {
VB2_DEBUG("Stow recovery reason as subcode (%#x)\n",
sd->recovery_reason);
vb2_nv_set(ctx, VB2_NV_RECOVERY_SUBCODE, sd->recovery_reason);
@@ -734,3 +708,35 @@
buf[DEBUG_INFO_MAX_LENGTH] = '\0';
return buf;
}
+
+void vb2_set_boot_mode(struct vb2_context *ctx)
+{
+ struct vb2_shared_data *sd = vb2_get_sd(ctx);
+ struct vb2_gbb_header *gbb = vb2_get_gbb(ctx);
+
+ /* Cast boot mode to non-constant and assign */
+ enum vb2_boot_mode *boot_mode = (enum vb2_boot_mode *)&ctx->boot_mode;
+ *boot_mode = VB2_BOOT_MODE_NORMAL;
+
+ /*
+ * The only way to pass this check and proceed to the recovery process
+ * is to physically request a recovery (a.k.a. manual recovery). All
+ * other recovery requests including manual recovery requested by a
+ * (compromised) host will end up with 'broken' screen.
+ */
+ if ((ctx->flags & VB2_CONTEXT_FORCE_RECOVERY_MODE) &&
+ !(ctx->flags & VB2_CONTEXT_NO_BOOT) &&
+ (ctx->flags & VB2_CONTEXT_EC_TRUSTED)) {
+ *boot_mode = VB2_BOOT_MODE_MANUAL_RECOVERY;
+ } else if (sd->recovery_reason) {
+ if (gbb->flags & VB2_GBB_FLAG_FORCE_MANUAL_RECOVERY)
+ *boot_mode = VB2_BOOT_MODE_MANUAL_RECOVERY;
+ else
+ *boot_mode = VB2_BOOT_MODE_BROKEN_SCREEN;
+ } else if (vb2api_diagnostic_ui_enabled(ctx) &&
+ vb2_nv_get(ctx, VB2_NV_DIAG_REQUEST)) {
+ *boot_mode = VB2_BOOT_MODE_DIAGNOSTICS;
+ } else if (ctx->flags & VB2_CONTEXT_DEVELOPER_MODE) {
+ *boot_mode = VB2_BOOT_MODE_DEVELOPER;
+ }
+}
diff --git a/firmware/2lib/2stub.c b/firmware/2lib/2stub.c
index 956b4bb..da754ad 100644
--- a/firmware/2lib/2stub.c
+++ b/firmware/2lib/2stub.c
@@ -75,12 +75,6 @@
/* auxfw and EC-related stubs */
__attribute__((weak))
-int vb2ex_ec_trusted(void)
-{
- return 1;
-}
-
-__attribute__((weak))
vb2_error_t vb2ex_ec_running_rw(int *in_rw)
{
*in_rw = 0;
@@ -180,13 +174,6 @@
}
__attribute__((weak))
-uint32_t vb2ex_prepare_log_screen(enum vb2_screen screen, uint32_t locale_id,
- const char *str)
-{
- return 1;
-}
-
-__attribute__((weak))
vb2_error_t vb2ex_diag_get_storage_health(const char **out)
{
*out = "mock";
diff --git a/firmware/2lib/include/2api.h b/firmware/2lib/include/2api.h
index 1f9d70f..1430111 100644
--- a/firmware/2lib/include/2api.h
+++ b/firmware/2lib/include/2api.h
@@ -259,6 +259,58 @@
VB2_CONTEXT_DEV_BOOT_ALTFW_ALLOWED = (1 << 27),
};
+/* Boot mode decided in vb2api_fw_phase1.
+ *
+ * Boot mode is a constant set by verified boot and may be read (but should not
+ * be set or cleared) by the caller.
+ * The boot modes are mutually exclusive. If a boot fulfill more than one
+ * constraints of the listing boot modes, it will be set to the most important
+ * one. The priority is the same as the listing order.
+ */
+enum vb2_boot_mode {
+ /* Undefined, The boot mode is not set. */
+ VB2_BOOT_MODE_UNDEFINED = 0,
+
+ /*
+ * Manual recovery boot, regardless of dev mode state.
+ *
+ * VB2_CONTEXT_RECOVERY_MODE is set and the recovery is physically
+ * requested (a.k.a. Manual recovery). All other recovery requests
+ * including manual recovery requested by a (compromised) host will end
+ * up with a broken screen.
+ */
+ VB2_BOOT_MODE_MANUAL_RECOVERY = 1,
+
+ /*
+ * Broken screen.
+ *
+ * If a recovery boot is not a manual recovery (a.k.a. not requested
+ * physically), the recovery is not allowed and will end up with
+ * broken screen.
+ */
+ VB2_BOOT_MODE_BROKEN_SCREEN = 2,
+
+ /*
+ * Diagnostic boot.
+ *
+ * If diagnostic boot is enabled (a.k.a. vb2api_diagnostic_ui_enabled)
+ * and the nvdata contains VB2_NV_DIAG_REQUEST from previous boot, it
+ * will boot to diagnostic mode.
+ */
+ VB2_BOOT_MODE_DIAGNOSTICS = 3,
+
+ /*
+ * Developer boot: self-signed kernel okay.
+ *
+ * The developer mode switch is set (a.k.a. VB2_CONTEXT_DEVELOPER_MODE)
+ * and we are in the developer boot mode.
+ */
+ VB2_BOOT_MODE_DEVELOPER = 4,
+
+ /* Normal boot: kernel must be verified. */
+ VB2_BOOT_MODE_NORMAL = 5,
+};
+
/* Helper for aligning fields in vb2_context. */
#define VB2_PAD_STRUCT3(size, align, count) \
uint8_t _pad##count[align - (((size - 1) % align) + 1)]
@@ -333,6 +385,16 @@
*/
uint8_t secdata_fwmp[VB2_SECDATA_FWMP_MAX_SIZE];
VB2_PAD_STRUCT(VB2_SECDATA_FWMP_MAX_SIZE, 8);
+
+ /**********************************************************************
+ * Fields below added in struct version 3.1.
+ */
+
+ /*
+ * Mutually exclusive boot mode.
+ * This constant is initialized after calling vb2api_fw_phase1().
+ */
+ const enum vb2_boot_mode boot_mode;
};
/* Resource index for vb2ex_read_resource() */
@@ -950,19 +1012,6 @@
int vb2api_use_short_dev_screen_delay(struct vb2_context *ctx);
/**
- * Check whether recovery is allowed or not.
- *
- * The only way to pass this check and proceed to the recovery process is to
- * physically request a recovery (a.k.a. manual recovery). All other recovery
- * requests including manual recovery requested by a (compromised) host will
- * end up with 'broken' screen.
- *
- * @param ctx Vboot context
- * @return 1 if recovery is allowed; 0 if no or uncertain.
- */
-int vb2api_allow_recovery(struct vb2_context *ctx);
-
-/**
* Request to enable developer mode.
*
* Enables the developer flag in vb2_context firmware secdata. Note that
@@ -1303,14 +1352,6 @@
vb2_error_t vb2api_ec_sync(struct vb2_context *ctx);
/**
- * This is called only if the system implements a keyboard-based (virtual)
- * developer switch. It must return true only if the system has an embedded
- * controller which is provably running in its RO firmware at the time the
- * function is called.
- */
-int vb2ex_ec_trusted(void);
-
-/**
* Check if the EC is currently running rewritable code.
*
* If the EC is in RO code, sets *in_rw=0.
@@ -1446,113 +1487,6 @@
#define VB2_CLR_BIT(mask, index) ((mask) &= ~((uint32_t)1 << (index)))
#define VB2_GET_BIT(mask, index) ((mask) & ((uint32_t)1 << (index)))
-/* Screens. */
-enum vb2_screen {
- /* Wait screen for EC sync and AUXFW sync */
- VB2_SCREEN_FIRMWARE_SYNC = 0x100,
- /* Broken screen */
- VB2_SCREEN_RECOVERY_BROKEN = 0x110,
- /* Advanced options */
- VB2_SCREEN_ADVANCED_OPTIONS = 0x120,
- /* Language selection screen */
- VB2_SCREEN_LANGUAGE_SELECT = 0x130,
- /* Debug info */
- VB2_SCREEN_DEBUG_INFO = 0x140,
- /* Firmware log */
- VB2_SCREEN_FIRMWARE_LOG = 0x150,
- /* First recovery screen to select recovering from disk or phone */
- VB2_SCREEN_RECOVERY_SELECT = 0x200,
- /* Invalid recovery media inserted */
- VB2_SCREEN_RECOVERY_INVALID = 0x201,
- /* Confirm transition to developer mode */
- VB2_SCREEN_RECOVERY_TO_DEV = 0x202,
- /* Recovery using phone */
- VB2_SCREEN_RECOVERY_PHONE_STEP1 = 0x210,
- VB2_SCREEN_RECOVERY_PHONE_STEP2 = 0x211,
- /* Recovery using disk */
- VB2_SCREEN_RECOVERY_DISK_STEP1 = 0x220,
- VB2_SCREEN_RECOVERY_DISK_STEP2 = 0x221,
- VB2_SCREEN_RECOVERY_DISK_STEP3 = 0x222,
- /* Developer mode screen */
- VB2_SCREEN_DEVELOPER_MODE = 0x300,
- /* Confirm transition to normal mode */
- VB2_SCREEN_DEVELOPER_TO_NORM = 0x310,
- /* Developer boot from external disk */
- VB2_SCREEN_DEVELOPER_BOOT_EXTERNAL = 0x320,
- /* Invalid external disk inserted */
- VB2_SCREEN_DEVELOPER_INVALID_DISK = 0x330,
- /* Select alternate bootloader ("altfw") */
- VB2_SCREEN_DEVELOPER_SELECT_ALTFW = 0x340,
- /* Diagnostic tools */
- VB2_SCREEN_DIAGNOSTICS = 0x400,
- /* Storage diagnostic screen */
- VB2_SCREEN_DIAGNOSTICS_STORAGE_HEALTH = 0x410,
- VB2_SCREEN_DIAGNOSTICS_STORAGE_TEST_SHORT = 0x411,
- VB2_SCREEN_DIAGNOSTICS_STORAGE_TEST_EXTENDED = 0x412,
- /* Memory diagnostic screens */
- VB2_SCREEN_DIAGNOSTICS_MEMORY_QUICK = 0x420,
- VB2_SCREEN_DIAGNOSTICS_MEMORY_FULL = 0x421,
-};
-
-enum vb2_ui_error {
- /* No error */
- VB2_UI_ERROR_NONE = 0,
- /* Dev mode already enabled */
- VB2_UI_ERROR_DEV_MODE_ALREADY_ENABLED,
- /* Untrusted confirmation */
- VB2_UI_ERROR_UNTRUSTED_CONFIRMATION,
- /* To-norm not allowed */
- VB2_UI_ERROR_TO_NORM_NOT_ALLOWED,
- /* Internal boot failed */
- VB2_UI_ERROR_INTERNAL_BOOT_FAILED,
- /* External boot is disabled */
- VB2_UI_ERROR_EXTERNAL_BOOT_DISABLED,
- /* Alternate bootloader is disabled */
- VB2_UI_ERROR_ALTFW_DISABLED,
- /* No alternate bootloader was found */
- VB2_UI_ERROR_ALTFW_EMPTY,
- /* Alternate bootloader failed */
- VB2_UI_ERROR_ALTFW_FAILED,
- /* Debug info screen initialization failed */
- VB2_UI_ERROR_DEBUG_LOG,
- /* Firmware log screen initialization failed */
- VB2_UI_ERROR_FIRMWARE_LOG,
- /* Diagnostics internal failure */
- VB2_UI_ERROR_DIAGNOSTICS,
-};
-
-/**
- * Display UI screen.
- *
- * @param screen Screen to display.
- * @param locale_id Id of current locale.
- * @param selected_item Index of the selected menu item. If the screen
- * doesn't have a menu, this value will be ignored.
- * @param disabled_item_mask Mask for disabled menu items. Bit (1 << idx)
- * indicates whether item 'idx' is disabled.
- * A disabled menu item is visible and selectable,
- * with a different button style.
- * @param hidden_item_mask Mask for hidden menu items. Bit (1 << idx)
- * indicates whether item 'idx' is hidden.
- * A hidden menu item is neither visible nor
- * selectable.
- * @param timer_disabled Whether timer is disabled or not. Some screen
- * descriptions will depend on this value.
- * @param current_page Current page number for a log screen. If the
- * screen doesn't show logs, this value will be
- * ignored.
- * @param error_code Error code if an error occurred.
- * @return VB2_SUCCESS, or error code on error.
- */
-vb2_error_t vb2ex_display_ui(enum vb2_screen screen,
- uint32_t locale_id,
- uint32_t selected_item,
- uint32_t disabled_item_mask,
- uint32_t hidden_item_mask,
- int timer_disabled,
- uint32_t current_page,
- enum vb2_ui_error error_code);
-
/**
* Check that physical presence button is currently pressed by the user.
*
@@ -1645,22 +1579,6 @@
const char *vb2ex_get_firmware_log(int reset);
/**
- * Specify the string to be used for an upcoming log screen display.
- *
- * Before a vb2ex_display_ui() call is made for a screen which displays logs,
- * the log string should be provided via this function. The total number of
- * pages in the log string is returned. If the log string ever changes, this
- * function should be called again before the next vb2ex_display_ui() call.
- *
- * @param screen Screen to display the log.
- * @param locale_id Id of current locale.
- * @param str The log string to display.
- * @return The number of pages after pagination. 0 if none or error.
- */
-uint32_t vb2ex_prepare_log_screen(enum vb2_screen screen, uint32_t locale_id,
- const char *str);
-
-/**
* Get the health info of the storage.
*
* @param out For returning a read-only pointer of full log string which is
diff --git a/firmware/2lib/include/2common.h b/firmware/2lib/include/2common.h
index 695f50d..d43f18a 100644
--- a/firmware/2lib/include/2common.h
+++ b/firmware/2lib/include/2common.h
@@ -10,6 +10,7 @@
#include "2api.h"
#include "2gbb.h"
+#include "2misc.h"
#include "2packed_key.h"
#include "2return_codes.h"
#include "2sha.h"
@@ -66,7 +67,8 @@
#define VB2_REC_OR_DIE(ctx, format, args...) do { \
VB2_DEBUG(format, ## args); \
- if (!(ctx->flags & VB2_CONTEXT_RECOVERY_MODE)) { \
+ if ((vb2_get_sd(ctx)->status & VB2_SD_STATUS_RECOVERY_DECIDED) && \
+ !(ctx->flags & VB2_CONTEXT_RECOVERY_MODE)) { \
vb2ex_abort(); \
for (;;); \
} \
diff --git a/firmware/2lib/include/2misc.h b/firmware/2lib/include/2misc.h
index b36e127..3d29287 100644
--- a/firmware/2lib/include/2misc.h
+++ b/firmware/2lib/include/2misc.h
@@ -191,4 +191,19 @@
*/
void vb2_fill_dev_boot_flags(struct vb2_context *ctx);
+/**
+ * Determine and set a mutually exclusive boot mode in the vboot context.
+ *
+ * Determine the most relevant boot mode for current boot, store into
+ * ctx->boot_mode, which is a ctx field introduced in struct version 3.1.
+ *
+ * This function should be only called by vb2api_fw_phase1.
+ * The vb2api_fw_phase1 should call this function at its end phase once and all
+ * the following steps should directly access ctx->boot_mode to retrieve the
+ * most relevant boot mode.
+ *
+ * @param ctx Vboot context.
+ */
+void vb2_set_boot_mode(struct vb2_context *ctx);
+
#endif /* VBOOT_REFERENCE_2MISC_H_ */
diff --git a/firmware/2lib/include/2return_codes.h b/firmware/2lib/include/2return_codes.h
index 0dc7c44..176c2c6 100644
--- a/firmware/2lib/include/2return_codes.h
+++ b/firmware/2lib/include/2return_codes.h
@@ -29,7 +29,7 @@
*/
VB2_REQUEST = 0x1000,
- /* Calling firmware requested shutdown via VbExIsShutdownRequested() */
+ /* Calling firmware requested shutdown */
VB2_REQUEST_SHUTDOWN = 0x1001,
/* Calling firmware needs to perform a reboot */
diff --git a/firmware/2lib/include/2struct.h b/firmware/2lib/include/2struct.h
index ea193d7..3e2c422 100644
--- a/firmware/2lib/include/2struct.h
+++ b/firmware/2lib/include/2struct.h
@@ -23,8 +23,14 @@
/* Flags for vb2_shared_data.flags */
enum vb2_shared_data_flags {
- /* User has explicitly and physically requested recovery */
- VB2_SD_FLAG_MANUAL_RECOVERY = (1 << 0),
+ /*
+ * VB2_SD_FLAG_MANUAL_RECOVERY (1 << 0) is deprecated. This flag is not
+ * necessary since the introduction of persistent context (CL:1716351).
+ * With introducing vb2_boot_mode and differentiating between manual
+ * recovery and broken screen (CL:3274699), it is suggested to leverage
+ * the vb2_boot_mode instead to determine if the user has physically
+ * requested recovery.
+ */
/* Developer mode is enabled */
VB2_SD_FLAG_DEV_MODE_ENABLED = (1 << 1),
@@ -85,6 +91,8 @@
/* EC Sync completed successfully */
VB2_SD_STATUS_EC_SYNC_COMPLETE = (1 << 6),
+ /* Have checked whether we are booting into recovery mode or not. */
+ VB2_SD_STATUS_RECOVERY_DECIDED = (1 << 7),
};
/* "V2SD" = vb2_shared_data.magic */
@@ -92,7 +100,7 @@
/* Current version of vb2_shared_data struct */
#define VB2_SHARED_DATA_VERSION_MAJOR 3
-#define VB2_SHARED_DATA_VERSION_MINOR 0
+#define VB2_SHARED_DATA_VERSION_MINOR 1
/* MAX_SIZE should not be changed without bumping up DATA_VERSION_MAJOR. */
#define VB2_CONTEXT_MAX_SIZE 384
diff --git a/firmware/include/vboot_api.h b/firmware/include/vboot_api.h
index f19ee74..ce3ac2d 100644
--- a/firmware/include/vboot_api.h
+++ b/firmware/include/vboot_api.h
@@ -89,6 +89,11 @@
*/
vb2_error_t VbTryLoadKernel(struct vb2_context *ctx, uint32_t disk_flags);
+/* miniOS flags */
+
+/* Boot from non-active miniOS partition only */
+#define VB_MINIOS_FLAG_NON_ACTIVE (1 << 0)
+
/**
* Attempt loading a miniOS kernel from internal disk.
*
@@ -100,9 +105,11 @@
* VB2_SUCCESS.
*
* @param ctx Vboot context
+ * @param minios_flags Flags for miniOS
* @return VB2_SUCCESS or the most specific VB2_ERROR_LK error.
*/
-vb2_error_t VbTryLoadMiniOsKernel(struct vb2_context *ctx);
+vb2_error_t VbTryLoadMiniOsKernel(struct vb2_context *ctx,
+ uint32_t minios_flags);
/*****************************************************************************/
/* Disk access (previously in boot_device.h) */
@@ -281,33 +288,6 @@
*/
void VbExStreamClose(VbExStream_t stream);
-/*****************************************************************************/
-/* Misc */
-
-/**
- * Check if the firmware needs to shut down the system.
- *
- * Returns a non-zero VB_SHUTDOWN_REQUEST mask indicating the reason(s) for
- * shutdown if a shutdown is being requested (see VB_SHUTDOWN_REQUEST_*), or 0
- * if a shutdown is not being requested.
- *
- * NOTE: When we're displaying a screen, pressing the power button should shut
- * down the computer. We need a way to break out of our control loop so this
- * can occur cleanly.
- */
-uint32_t VbExIsShutdownRequested(void);
-
-/*
- * Shutdown requested for a reason which is not defined among other
- * VB_SHUTDOWN_REQUEST_* values. This must be defined as 1 for backward
- * compatibility with old versions of the API.
- */
-#define VB_SHUTDOWN_REQUEST_OTHER 0x00000001
-/* Shutdown requested due to a lid switch being closed. */
-#define VB_SHUTDOWN_REQUEST_LID_CLOSED 0x00000002
-/* Shutdown requested due to a power button being pressed. */
-#define VB_SHUTDOWN_REQUEST_POWER_BUTTON 0x00000004
-
#ifdef __cplusplus
}
#endif /* __cplusplus */
diff --git a/firmware/lib/include/load_kernel_fw.h b/firmware/lib/include/load_kernel_fw.h
index af45470..76d2556 100644
--- a/firmware/lib/include/load_kernel_fw.h
+++ b/firmware/lib/include/load_kernel_fw.h
@@ -30,11 +30,12 @@
* @param ctx Vboot context
* @param params Params specific to loading the kernel
* @param disk_info Disk from which to read kernel
+ * @param minios_flags Flags for miniOS
*
* Returns VB2_SUCCESS if successful. If unsuccessful, returns an error code.
*/
vb2_error_t LoadMiniOsKernel(struct vb2_context *ctx,
VbSelectAndLoadKernelParams *params,
- VbDiskInfo *disk_info);
+ VbDiskInfo *disk_info, uint32_t minios_flags);
#endif /* VBOOT_REFERENCE_LOAD_KERNEL_FW_H_ */
diff --git a/firmware/lib/vboot_api_kernel.c b/firmware/lib/vboot_api_kernel.c
index 2abd57e..9e89620 100644
--- a/firmware/lib/vboot_api_kernel.c
+++ b/firmware/lib/vboot_api_kernel.c
@@ -62,7 +62,8 @@
}
static vb2_error_t VbTryLoadKernelImpl(struct vb2_context *ctx,
- uint32_t disk_flags, int minios)
+ uint32_t disk_flags, int minios,
+ uint32_t minios_flags)
{
vb2_error_t rv = VB2_ERROR_LK_NO_DISK_FOUND;
VbDiskInfo* disk_info = NULL;
@@ -96,7 +97,7 @@
if (minios) {
new_rv = LoadMiniOsKernel(ctx, kparams_ptr,
- &disk_info[i]);
+ &disk_info[i], minios_flags);
VB2_DEBUG("LoadMiniOsKernel() = %#x\n", new_rv);
} else {
new_rv = LoadKernel(ctx, kparams_ptr, &disk_info[i]);
@@ -142,13 +143,14 @@
test_mockable
vb2_error_t VbTryLoadKernel(struct vb2_context *ctx, uint32_t disk_flags)
{
- return VbTryLoadKernelImpl(ctx, disk_flags, 0);
+ return VbTryLoadKernelImpl(ctx, disk_flags, 0, 0);
}
test_mockable
-vb2_error_t VbTryLoadMiniOsKernel(struct vb2_context *ctx)
+vb2_error_t VbTryLoadMiniOsKernel(struct vb2_context *ctx,
+ uint32_t minios_flags)
{
- return VbTryLoadKernelImpl(ctx, VB_DISK_FLAG_FIXED, 1);
+ return VbTryLoadKernelImpl(ctx, VB_DISK_FLAG_FIXED, 1, minios_flags);
}
vb2_error_t VbSelectAndLoadKernel(struct vb2_context *ctx,
@@ -180,13 +182,15 @@
}
/*
- * If in non-manual recovery mode, save the recovery reason as subcode.
+ * If in the broken screen, save the recovery reason as subcode.
* Otherwise, clear any leftover recovery requests or subcodes.
*/
vb2_clear_recovery(ctx);
/* Select boot path */
- if (ctx->flags & VB2_CONTEXT_RECOVERY_MODE) {
+ switch (ctx->boot_mode) {
+ case VB2_BOOT_MODE_MANUAL_RECOVERY:
+ case VB2_BOOT_MODE_BROKEN_SCREEN:
/* If we're in recovery mode just to do memory retraining, all
we need to do is reboot. */
if (sd->recovery_reason == VB2_RECOVERY_TRAIN_AND_REBOOT) {
@@ -211,12 +215,12 @@
VB2_DEBUG("NO_BOOT in RECOVERY mode\n");
/* Recovery boot. This has UI. */
- if (vb2api_allow_recovery(ctx))
+ if (ctx->boot_mode == VB2_BOOT_MODE_MANUAL_RECOVERY)
VB2_TRY(vb2ex_manual_recovery_ui(ctx));
else
VB2_TRY(vb2ex_broken_screen_ui(ctx));
- } else if (vb2api_diagnostic_ui_enabled(ctx) &&
- vb2_nv_get(ctx, VB2_NV_DIAG_REQUEST)) {
+ break;
+ case VB2_BOOT_MODE_DIAGNOSTICS:
/*
* Need to clear the request flag and commit nvdata changes
* immediately to avoid booting back into diagnostic tool when a
@@ -232,12 +236,16 @@
* return either of reboot or shutdown.
*/
return VB2_REQUEST_REBOOT;
- } else if (ctx->flags & VB2_CONTEXT_DEVELOPER_MODE) {
+ case VB2_BOOT_MODE_DEVELOPER:
/* Developer boot. This has UI. */
VB2_TRY(vb2ex_developer_ui(ctx));
- } else {
+ break;
+ case VB2_BOOT_MODE_NORMAL:
/* Normal boot */
VB2_TRY(vb2_normal_boot(ctx));
+ break;
+ default:
+ return VB2_ERROR_ESCAPE_NO_BOOT;
}
/*
@@ -245,6 +253,7 @@
* GBB flag disables software sync.
*/
if (!(gbb_flags & VB2_GBB_FLAG_DISABLE_EC_SOFTWARE_SYNC)
+ && (ctx->flags & VB2_CONTEXT_EC_SYNC_SUPPORTED)
&& (ctx->flags & VB2_CONTEXT_NO_BOOT)) {
VB2_DEBUG("Blocking escape from NO_BOOT mode.\n");
vb2api_fail(ctx, VB2_RECOVERY_ESCAPE_NO_BOOT, 0);
diff --git a/firmware/lib/vboot_kernel.c b/firmware/lib/vboot_kernel.c
index 34a8a42..1edf4a5 100644
--- a/firmware/lib/vboot_kernel.c
+++ b/firmware/lib/vboot_kernel.c
@@ -6,6 +6,7 @@
* (Firmware portion)
*/
+#include "2api.h"
#include "2common.h"
#include "2misc.h"
#include "2nvstorage.h"
@@ -31,34 +32,6 @@
#define LOWEST_TPM_VERSION 0xffffffff
-enum vb2_boot_mode {
- /* Normal boot: kernel must be verified. */
- VB2_BOOT_MODE_NORMAL = 0,
-
- /* Recovery boot, regardless of dev mode state. */
- VB2_BOOT_MODE_RECOVERY = 1,
-
- /* Developer boot: self-signed kernel okay. */
- VB2_BOOT_MODE_DEVELOPER = 2,
-};
-
-/**
- * Return the current boot mode (normal, recovery, or dev).
- *
- * @param ctx Vboot context
- * @return Current boot mode (see vb2_boot_mode enum).
- */
-static enum vb2_boot_mode get_boot_mode(struct vb2_context *ctx)
-{
- if (ctx->flags & VB2_CONTEXT_RECOVERY_MODE)
- return VB2_BOOT_MODE_RECOVERY;
-
- if (ctx->flags & VB2_CONTEXT_DEVELOPER_MODE)
- return VB2_BOOT_MODE_DEVELOPER;
-
- return VB2_BOOT_MODE_NORMAL;
-}
-
/**
* Check if a valid keyblock is required.
*
@@ -69,7 +42,7 @@
static int need_valid_keyblock(struct vb2_context *ctx)
{
/* Normal and recovery modes always require official OS */
- if (get_boot_mode(ctx) != VB2_BOOT_MODE_DEVELOPER)
+ if (ctx->boot_mode != VB2_BOOT_MODE_DEVELOPER)
return 1;
/* FWMP can require developer mode to use signed kernels */
@@ -264,9 +237,8 @@
}
/* Check for rollback of key version except in recovery mode. */
- enum vb2_boot_mode boot_mode = get_boot_mode(ctx);
uint32_t key_version = keyblock->data_key.key_version;
- if (boot_mode != VB2_BOOT_MODE_RECOVERY) {
+ if (ctx->boot_mode != VB2_BOOT_MODE_MANUAL_RECOVERY) {
if (key_version < (sd->kernel_version_secdata >> 16)) {
keyblock_valid = 0;
if (need_keyblock_valid) {
@@ -288,7 +260,7 @@
}
/* If in developer mode and using key hash, check it. */
- if (boot_mode == VB2_BOOT_MODE_DEVELOPER &&
+ if (ctx->boot_mode == VB2_BOOT_MODE_DEVELOPER &&
vb2_secdata_fwmp_get_flag(ctx, VB2_SECDATA_FWMP_DEV_USE_KEY_HASH)) {
VB2_TRY(vb2_verify_kernel_dev_key_hash(ctx, keyblock));
}
@@ -356,7 +328,7 @@
/* If not in recovery mode, check for rollback of the kernel version. */
if (need_keyblock_valid &&
- boot_mode != VB2_BOOT_MODE_RECOVERY &&
+ ctx->boot_mode != VB2_BOOT_MODE_MANUAL_RECOVERY &&
sd->kernel_version < sd->kernel_version_secdata) {
VB2_DEBUG("Kernel version too low.\n");
return VB2_ERROR_KERNEL_PREAMBLE_VERSION_ROLLBACK;
@@ -607,12 +579,17 @@
*/
vb2_error_t LoadMiniOsKernel(struct vb2_context *ctx,
VbSelectAndLoadKernelParams *params,
- VbDiskInfo *disk_info)
+ VbDiskInfo *disk_info, uint32_t minios_flags)
{
vb2_error_t rv;
int end_region_first = vb2_nv_get(ctx, VB2_NV_MINIOS_PRIORITY);
- rv = try_minios_sector_region(ctx, params, disk_info, end_region_first);
+ if (minios_flags & VB_MINIOS_FLAG_NON_ACTIVE)
+ rv = VB2_ERROR_UNKNOWN; /* Ignore active partition */
+ else
+ rv = try_minios_sector_region(ctx, params, disk_info,
+ end_region_first);
+
if (rv)
rv = try_minios_sector_region(ctx, params, disk_info,
!end_region_first);
@@ -739,7 +716,7 @@
* non-officially-signed kernel, there's no rollback
* protection, so we can stop at the first valid kernel.
*/
- if (get_boot_mode(ctx) == VB2_BOOT_MODE_RECOVERY ||
+ if (ctx->boot_mode == VB2_BOOT_MODE_MANUAL_RECOVERY ||
!keyblock_valid) {
VB2_DEBUG("In recovery mode or dev-signed kernel\n");
break;
diff --git a/firmware/stub/vboot_api_stub.c b/firmware/stub/vboot_api_stub.c
index 5e08556..9335c8b 100644
--- a/firmware/stub/vboot_api_stub.c
+++ b/firmware/stub/vboot_api_stub.c
@@ -19,12 +19,6 @@
#include "vboot_test.h"
__attribute__((weak))
-uint32_t VbExIsShutdownRequested(void)
-{
- return 0;
-}
-
-__attribute__((weak))
vb2_error_t vb2ex_run_altfw(uint32_t altfw_id)
{
return VB2_SUCCESS;
diff --git a/futility/cmd_gscvd.c b/futility/cmd_gscvd.c
new file mode 100644
index 0000000..7fff293
--- /dev/null
+++ b/futility/cmd_gscvd.c
@@ -0,0 +1,1050 @@
+/*
+ * Copyright 2021 The Chromium OS Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ */
+
+#include <errno.h>
+#include <fcntl.h>
+#include <getopt.h>
+#include <openssl/bn.h>
+#include <openssl/pem.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include "fmap.h"
+#include "futility.h"
+#include "gsc_ro.h"
+#include "host_key21.h"
+#include "host_keyblock.h"
+#include "host_signature.h"
+
+/*
+ * for testing purposes let's use
+ * - tests/devkeys/arv_root.vbprivk as the root private key
+ * - tests/devkeys/arv_root.vbpubk as the root public key
+ * used for signing of the platform public key
+ * - tests/devkeys/arv_platform.vbprivk signing platform key
+ * - tests/devkeys/arv_platform.vbpubk - public key used for signature
+ * verification
+ *------------
+ * Command to create the signed public key block in ~/tmp/packed:
+ *
+ ./build/futility/futility vbutil_keyblock --pack ~/tmp/packed \
+ --datapubkey tests/devkeys/arv_platform.vbpubk \
+ --signprivate tests/devkeys/arv_root.vbprivk
+ *------------
+ * Command to fill RO_GSCVD FMAP area in an AP firmware file. The input AP
+ * firmware file is ~/tmp/image-guybrush.serial.bin, the output signed
+ * AP firmware file is ~/tmp/guybrush-signed:
+ *
+ ./build/futility/futility gscvd --outfile ~/tmp/guybrush-signed \
+ -R 818100:10000,f00000:100,f80000:2000,f8c000:1000,0x00804000:0x00000800 \
+ -k ~/tmp/packed -p tests/devkeys/arv_platform.vbprivk -b 5a5a4352 \
+ -r tests/devkeys/arv_root.vbpubk ~/tmp/image-guybrush.serial.bin
+ *------------
+ * Command to validate a previously signed AP firmware file. The hash is the
+ * sha256sum of tests/devkeys/kernel_subkey.vbpubk:
+ *
+ build/futility/futility gscvd ~/tmp/guybrush-signed \
+ 3d74429f35be8d34bcb425d4397e2218e6961afed456a78ce30047f5b54ed158
+ */
+
+/* Command line options processing support. */
+enum no_short_opts {
+ OPT_OUTFILE = 1000,
+};
+
+static const struct option long_opts[] = {
+ /* name hasarg *flag val */
+ {"outfile", 1, NULL, OPT_OUTFILE},
+ {"ranges", 1, NULL, 'R'},
+ {"board_id", 1, NULL, 'b'},
+ {"root_pub_key", 1, NULL, 'r'},
+ {"keyblock", 1, NULL, 'k'},
+ {"platform_priv", 1, NULL, 'p'},
+ {"help", 0, NULL, 'h'},
+ {}
+};
+
+static const char *short_opts = "R:b:hk:p:r:";
+
+static const char usage[] =
+ "\n"
+ "This utility creates an RO verification space in the Chrome OS AP\n"
+ "firmware image or allows to validate a previously prepared image\n"
+ "containing the RO verification space.\n\n"
+ "Usage: " MYNAME " gscvd PARAMS <AP FIRMWARE FILE> [<root key hash>]\n"
+ "\n\nCreation of RO Verification space:\n\n"
+ "Required PARAMS:\n"
+ " -R|--ranges STRING Comma separated colon delimited\n"
+ " hex tuples <offset>:<size>, the\n"
+ " areas of the RO covered by the\n"
+ " signature\n"
+ " -b|--board_id <hex value> The Board ID of the board for which\n"
+ " the image is being signed\n"
+ " -r|--root_pub_key <file> The main public key, in .vbpubk\n"
+ " format, used to verify platform\n"
+ " key\n"
+ " -k|--keyblock <file> Signed platform public key in\n"
+ " .keyblock format, used for run\n"
+ " time RO verifcation\n"
+ " -p|--platform_priv <file> Private platform key in .vbprivk\n"
+ " format, used for signing RO\n"
+ " verification data\n"
+ "Optional PARAMS:\n"
+ " [--outfile] OUTFILE Output firmware image containing\n"
+ " RO verification information\n"
+ "\n\n"
+ "Validation of RO Verification space:\n\n"
+ " The only required parameter is <AP FIRMWARE FILE>, if optional\n"
+ " <root key hash> is given, it is compared to the hash\n"
+ " of the root key found in <AP_FIRMWARE_FILE>.\n"
+ "\n\n"
+ " -h|--help Print this message\n\n";
+
+/* Structure helping to keep track of the file mapped into memory. */
+struct file_buf {
+ uint32_t len;
+ uint8_t *data;
+ int fd;
+ FmapAreaHeader *ro_gscvd;
+};
+
+/*
+ * Max number of RO ranges to cover. 32 is more than enough, this must be kept
+ * in sync with APRO_MAX_NUM_RANGES declaration in
+ * common/ap_ro_integrity_check.c in the Cr50 tree.
+ */
+#define MAX_RANGES 32
+
+/*
+ * Container keeping track of the set of ranges to include in hash
+ * calculation.
+ */
+struct gscvd_ro_ranges {
+ size_t range_count;
+ struct gscvd_ro_range ranges[MAX_RANGES];
+};
+
+/**
+ * Load the AP firmware file into memory.
+ *
+ * Map the requested file into memory, find RO_GSCVD area in the file, and
+ * cache the information in the passed in file_buf structure.
+ *
+ * @param file_name name of the AP firmware file
+ * @param file_buf pointer to the helper structure keeping information about
+ * the file
+ *
+ * @return 0 on success 1 on failure.
+ */
+static int load_ap_firmware(const char *file_name, struct file_buf *file)
+{
+ int fd;
+ int rv;
+
+ fd = open(file_name, O_RDWR);
+ if (fd < 0) {
+ ERROR("Can't open %s: %s\n", file_name,
+ strerror(errno));
+ return 1;
+ }
+
+ file->fd = fd;
+ do {
+ rv = 1;
+
+ if (futil_map_file(fd, MAP_RW, &file->data, &file->len)) {
+ file->data = NULL;
+ break;
+ }
+
+ if (!fmap_find_by_name(file->data, file->len, NULL, "RO_GSCVD",
+ &file->ro_gscvd)) {
+ ERROR("Could not find RO_GSCVD in the FMAP\n");
+ break;
+ }
+ rv = 0;
+ } while (false);
+
+ return rv;
+}
+
+/**
+ * Check if the passed in offset falls into the passed in FMAP area.
+ */
+static bool in_range(uint32_t offset, const FmapAreaHeader *ah)
+{
+ return (offset >= ah->area_offset) &&
+ (offset <= (ah->area_offset + ah->area_size));
+}
+
+/**
+ * Check if the passed in range fits into the passed in FMAP area.
+ */
+static bool range_fits(const struct gscvd_ro_range *range,
+ const FmapAreaHeader *ah)
+{
+ if (in_range(range->offset, ah) &&
+ in_range(range->offset + range->size, ah))
+ return true;
+
+ ERROR("Range %#x..+%#x does not fit in %s\n", range->offset,
+ range->size, ah->area_name);
+
+ return false;
+}
+
+/**
+ * Check if the passed in range overlaps with the area.
+ *
+ * @param range pointer to the range to check
+ * @param offset offset of the area to check against
+ * @param size size of the area to check against
+ *
+ * @return true if range overlaps with the area, false otherwise.
+ */
+static bool range_overlaps(const struct gscvd_ro_range *range, uint32_t offset,
+ size_t size)
+{
+ if (((range->offset + range->size) <= offset) ||
+ (offset + size) <= range->offset)
+ return false;
+
+ ERROR("Range %x..+%x overlaps with %x..+%zx\n", range->offset,
+ range->size, offset, size);
+
+ return true;
+}
+
+/*
+ * Check validity of the passed in ranges.
+ *
+ * All ranges must
+ * - fit into the WP_RO FMAP area
+ * - not overlap with the RO_GSCVD FMAP area
+ * - not overlap with each other
+ *
+ * @param ranges - pointer to the container of ranges to check
+ * @param file - pointer to the file layout descriptor
+ *
+ * @return zero on success, -1 on failures
+ */
+static int verify_ranges(const struct gscvd_ro_ranges *ranges,
+ const struct file_buf *file)
+{
+ size_t i;
+ FmapAreaHeader *wp_ro;
+ int errorcount;
+
+ if (!fmap_find_by_name(file->data, file->len, NULL, "WP_RO", &wp_ro)) {
+ ERROR("Could not find WP_RO in the FMAP\n");
+ return 1;
+ }
+
+ errorcount = 0;
+ for (i = 0; i < ranges->range_count; i++) {
+ size_t j;
+
+ /* Must fit into WP_RO. */
+ if (!range_fits(ranges->ranges + i, wp_ro))
+ errorcount++;
+
+ /* Must not overlap with RO_GSCVD. */
+ if (range_overlaps(ranges->ranges + i,
+ file->ro_gscvd->area_offset,
+ file->ro_gscvd->area_size))
+ errorcount++;
+
+ /* The last range is nothing to compare against. */
+ if (i == ranges->range_count - 1)
+ break;
+
+ /* Must not overlap with all following ranges. */
+ for (j = i + 1; j < ranges->range_count; j++)
+ if (range_overlaps(ranges->ranges + i,
+ ranges->ranges[j].offset,
+ ranges->ranges[j].size))
+ errorcount++;
+ }
+
+ return errorcount ? -1 : 0;
+}
+
+/**
+ * Parse range specification supplied by the user.
+ *
+ * The input is a string of the following format:
+ * <hex base>:<hex size>[,<hex base>:<hex size>[,...]]
+ *
+ * @param input user input, part of the command line
+ * @param output pointer to the ranges container
+ *
+ * @return zero on success, -1 on failure
+ */
+static int parse_ranges(const char *input, struct gscvd_ro_ranges *output)
+{
+ char *cursor;
+ char *delim;
+ char *str = strdup(input);
+ int rv = 0;
+
+ if (!str) {
+ ERROR("Failed to allocate memory for ranges string copy!\n");
+ return -1;
+ }
+
+ output->range_count = 0;
+ cursor = str;
+ do {
+ char *colon;
+ char *e;
+
+ if (output->range_count >= ARRAY_SIZE(output->ranges)) {
+ ERROR("Too many ranges!\n");
+ rv = -1;
+ break;
+ }
+
+ delim = strchr(cursor, ',');
+ if (delim)
+ *delim = '\0';
+ colon = strchr(cursor, ':');
+ if (!colon) {
+ rv = -1;
+ break;
+ }
+ *colon = '\0';
+
+ errno = 0;
+ output->ranges[output->range_count].offset =
+ strtol(cursor, &e, 16);
+ if (errno || *e) {
+ rv = -1;
+ break;
+ }
+
+ output->ranges[output->range_count].size =
+ strtol(colon + 1, &e, 16);
+ if (errno || *e) {
+ rv = -1;
+ break;
+ }
+
+ output->range_count++;
+ cursor = delim + 1;
+ /* Iterate until there is no more commas. */
+ } while (delim);
+
+ free(str);
+ if (rv)
+ ERROR("Misformatted ranges string\n");
+
+ return rv;
+}
+
+/**
+ * Calculate hash of the RO ranges.
+ *
+ * @param ap_firmware_file pointer to the AP firmware file layout descriptor
+ * @param ranges pointer to the container of ranges to include in hash
+ * calculation
+ * @param hash_alg algorithm to use for hashing
+ * @param digest memory to copy the calculated hash to
+ * @param digest_ size requested size of the digest, padded with zeros if the
+ * SHA digest size is smaller than digest_size
+ *
+ * @return zero on success, -1 on failure.
+ */
+static int calculate_ranges_digest(const struct file_buf *ap_firmware_file,
+ const struct gscvd_ro_ranges *ranges,
+ enum vb2_hash_algorithm hash_alg,
+ void *digest, size_t digest_size)
+{
+ struct vb2_digest_context dc;
+ size_t i;
+
+ /* Calculate the ranges digest. */
+ if (vb2_digest_init(&dc, hash_alg) != VB2_SUCCESS) {
+ ERROR("Failed to init digest!\n");
+ return 1;
+ }
+
+ for (i = 0; i < ranges->range_count; i++) {
+ if (vb2_digest_extend(&dc,
+ ap_firmware_file->data +
+ ranges->ranges[i].offset,
+ ranges->ranges[i].size) != VB2_SUCCESS) {
+ ERROR("Failed to extend digest!\n");
+ return -1;
+ }
+ }
+
+ memset(digest, 0, digest_size);
+ if (vb2_digest_finalize(&dc, digest, digest_size) != VB2_SUCCESS) {
+ ERROR("Failed to finalize digest!\n");
+ return -1;
+ }
+
+ return 0;
+}
+
+/**
+ * Build GSC verification data.
+ *
+ * Calculate size of the structure including the signature and the root key,
+ * allocate memory, fill up the structure, calculate AP RO ranges digest and
+ * then the GVD signature.
+ *
+ * @param ap_firmware_file pointer to the AP firmware file layout descriptor
+ * @param ranges pointer to the container of ranges to include in verification
+ * @param root_pubk pointer to the root pubk container
+ * @param privk pointer to the private key to use for signing
+ * @param board_id Board ID value to use.
+ *
+ * @return pointer to the created GVD (to be freed by the caller) on success,
+ * NULL on failure.
+ */
+static
+struct gsc_verification_data *create_gvd(struct file_buf *ap_firmware_file,
+ struct gscvd_ro_ranges *ranges,
+ const struct vb2_packed_key *root_pubk,
+ const struct vb2_private_key *privk,
+ uint32_t board_id)
+{
+ struct gsc_verification_data *gvd;
+ size_t total_size;
+ size_t sig_size;
+ size_t ranges_size;
+ struct vb2_signature *sig;
+ const FmapHeader *fmh;
+
+ sig_size = vb2_rsa_sig_size(privk->sig_alg);
+ ranges_size = ranges->range_count * sizeof(struct gscvd_ro_range);
+ total_size = sizeof(struct gsc_verification_data) +
+ root_pubk->key_size + sig_size + ranges_size;
+
+ gvd = calloc(total_size, 1);
+
+ if (!gvd) {
+ ERROR("Failed to allocate %zd bytes for gvd\n", total_size);
+ return NULL;
+ }
+
+ gvd->gv_magic = GSC_VD_MAGIC;
+ gvd->size = total_size;
+ gvd->gsc_board_id = board_id;
+ gvd->rollback_counter = GSC_VD_ROLLBACK_COUNTER;
+
+ /* Guaranteed to succeed. */
+ fmh = fmap_find(ap_firmware_file->data, ap_firmware_file->len);
+
+ gvd->fmap_location = (uintptr_t)fmh - (uintptr_t)ap_firmware_file->data;
+
+ gvd->hash_alg = VB2_HASH_SHA256;
+
+ if (calculate_ranges_digest(ap_firmware_file, ranges, gvd->hash_alg,
+ gvd->ranges_digest,
+ sizeof(gvd->ranges_digest))) {
+ free(gvd);
+ return NULL;
+ }
+
+ /* Prepare signature header. */
+ vb2_init_signature(&gvd->sig_header,
+ (uint8_t *)(gvd + 1) + ranges_size,
+ sig_size,
+ sizeof(struct gsc_verification_data) + ranges_size);
+
+ /* Copy root key into the structure. */
+ vb2_init_packed_key(&gvd->root_key_header,
+ (uint8_t *)(gvd + 1) + ranges_size + sig_size,
+ root_pubk->key_size);
+ vb2_copy_packed_key(&gvd->root_key_header, root_pubk);
+
+ /* Copy ranges into the ranges section. */
+ gvd->range_count = ranges->range_count;
+ memcpy(gvd->ranges, ranges->ranges, ranges_size);
+
+ sig = vb2_calculate_signature((uint8_t *)gvd,
+ sizeof(struct gsc_verification_data) +
+ ranges_size, privk);
+ if (!sig) {
+ ERROR("Failed to calculate signature\n");
+ free(gvd);
+ return NULL;
+ }
+
+ /* Copy signature body into GVD after some basic checks. */
+ if ((sig_size == sig->sig_size) &&
+ (gvd->sig_header.data_size == sig->data_size)) {
+ vb2_copy_signature(&gvd->sig_header, sig);
+ } else {
+ ERROR("Inconsistent signature headers\n");
+ free(sig);
+ free(gvd);
+ return NULL;
+ }
+
+ free(sig);
+
+ return gvd;
+}
+
+/**
+ * Fill RO_GSCVD FMAP area.
+ *
+ * All trust chain components have been verified, AP RO sections digest
+ * calculated, and GVD signature created; put it all together in the dedicated
+ * FMAP area.
+ *
+ * @param ap_firmware_file pointer to the AP firmware file layout descriptor
+ * @param gvd pointer to the GVD header
+ * @param keyblock pointer to the keyblock container
+ *
+ * @return zero on success, -1 on failure
+ */
+static int fill_gvd_area(struct file_buf *ap_firmware_file,
+ struct gsc_verification_data *gvd,
+ struct vb2_keyblock *keyblock)
+{
+ size_t total;
+ uint8_t *cursor;
+
+ /* How much room is needed for the whole thing? */
+ total = gvd->size + keyblock->keyblock_size;
+
+ if (total > ap_firmware_file->ro_gscvd->area_size) {
+ ERROR("GVD section does not fit, %zd > %d\n",
+ total, ap_firmware_file->ro_gscvd->area_size);
+ return -1;
+ }
+
+ cursor = ap_firmware_file->data +
+ ap_firmware_file->ro_gscvd->area_offset;
+
+ /* Copy GSC verification data */
+ memcpy(cursor, gvd, gvd->size);
+ cursor += gvd->size;
+
+ /* Keyblock, size includes everything. */
+ memcpy(cursor, keyblock, keyblock->keyblock_size);
+
+ return 0;
+}
+
+/**
+ * Initialize a work buffer structure.
+ *
+ * Embedded vboot reference code does not use malloc/free, it uses the so
+ * called work buffer structure to provide a poor man's memory management
+ * tool. This program uses some of the embedded library functions, let's
+ * implement work buffer support to keep the embedded code happy.
+ *
+ * @param wb pointer to the workubffer structure to initialize
+ * @param size size of the buffer to allocate
+ *
+ * @return pointer to the allocated buffer on success, NULL on failure.
+ */
+static void *init_wb(struct vb2_workbuf *wb, size_t size)
+{
+ void *buf = malloc(size);
+
+ if (!buf)
+ ERROR("Failed to allocate workblock of %zd\n", size);
+ else
+ vb2_workbuf_init(wb, buf, size);
+
+ return buf;
+}
+
+/**
+ * Validate that platform key keyblock was signed by the root key.
+ *
+ * This function performs the same step the GSC is supposed to perform:
+ * validate the platform key keyblock signature using the root public key.
+ *
+ * @param root_pubk pointer to the root public key container
+ * @param kblock pointer to the platform public key keyblock
+ *
+ * @return 0 on success, -1 on failure
+ */
+static int validate_pubk_signature(const struct vb2_packed_key *root_pubk,
+ struct vb2_keyblock *kblock)
+{
+ struct vb2_public_key pubk;
+ struct vb2_workbuf wb;
+ uint32_t kbsize;
+ int rv;
+ void *buf;
+
+ if (vb2_unpack_key(&pubk, root_pubk) != VB2_SUCCESS) {
+ ERROR("Failed to unpack public key\n");
+ return -1;
+ }
+
+ /* Let's create an ample sized work buffer. */
+ buf = init_wb(&wb, 8192);
+ if (!buf)
+ return -1;
+
+ rv = -1;
+ do {
+ void *work;
+
+ kbsize = kblock->keyblock_size;
+ work = vb2_workbuf_alloc(&wb, kbsize);
+ if (!work) {
+ ERROR("Failed to allocate workblock space %d\n",
+ kbsize);
+ break;
+ }
+
+ memcpy(work, kblock, kbsize);
+
+ if (vb2_verify_keyblock(work, kbsize, &pubk, &wb) !=
+ VB2_SUCCESS) {
+ ERROR("Root and keyblock mismatch\n");
+ break;
+ }
+
+ rv = 0;
+ } while (false);
+
+ free(buf);
+
+ return rv;
+}
+
+/**
+ * Validate that private and public parts of the platform key match.
+ *
+ * This is a fairly routine validation, the N components of the private and
+ * public RSA keys are compared.
+ *
+ * @param keyblock pointer to the keyblock containing the public key
+ * @param plat_privk pointer to the matching private key
+ *
+ * @return 0 on success, nonzero on failure
+ */
+static int validate_privk(struct vb2_keyblock *kblock,
+ struct vb2_private_key *plat_privk)
+{
+ const BIGNUM *privn;
+ BIGNUM *pubn;
+ struct vb2_public_key pubk;
+ int rv;
+
+ privn = pubn = NULL;
+
+ RSA_get0_key(plat_privk->rsa_private_key, &privn, NULL, NULL);
+
+ if (vb2_unpack_key(&pubk, &kblock->data_key) != VB2_SUCCESS) {
+ ERROR("Failed to unpack public key\n");
+ return -1;
+ }
+
+ pubn = BN_new();
+ pubn = BN_lebin2bn((uint8_t *)pubk.n, vb2_rsa_sig_size(pubk.sig_alg),
+ pubn);
+ rv = BN_cmp(pubn, privn);
+ if (rv)
+ ERROR("Public/private key N mismatch!\n");
+
+ BN_free(pubn);
+ return rv;
+}
+
+/**
+ * Copy ranges from AP firmware file into gscvd_ro_ranges container
+ *
+ * While copying the ranges verify that they do not overlap.
+ *
+ * @param ap_firmware_file pointer to the AP firmware file layout descriptor
+ * @param gvd pointer to the GVD header followed by the ranges
+ * @param ranges pointer to the ranges container to copy ranges to
+ *
+ * @return 0 on successful copy nonzero on errors.
+ */
+static int copy_ranges(const struct file_buf *ap_firmware_file,
+ const struct gsc_verification_data *gvd,
+ struct gscvd_ro_ranges *ranges)
+{
+ ranges->range_count = gvd->range_count;
+ memcpy(ranges->ranges, gvd->ranges,
+ sizeof(ranges->ranges[0]) * ranges->range_count);
+
+ return verify_ranges(ranges, ap_firmware_file);
+}
+
+/**
+ * Basic validation of GVD included in a AP firmware file.
+ *
+ * This is not a cryptographic verification, just a check that the structure
+ * makes sense and the expected values are found in certain fields.
+ *
+ * @param gvd pointer to the GVD header followed by the ranges
+ * @param ap_firmware_file pointer to the AP firmware file layout descriptor
+ *
+ * @return zero on success, -1 on failure.
+ */
+static int validate_gvd(const struct gsc_verification_data *gvd,
+ const struct file_buf *ap_firmware_file)
+{
+ const FmapHeader *fmh;
+
+ if (gvd->gv_magic != GSC_VD_MAGIC) {
+ ERROR("Incorrect gscvd magic %x\n", gvd->gv_magic);
+ return -1;
+ }
+
+ if (!gvd->range_count || (gvd->range_count > MAX_RANGES)) {
+ ERROR("Incorrect gscvd range count %d\n", gvd->range_count);
+ return -1;
+ }
+
+ /* Guaranteed to succeed. */
+ fmh = fmap_find(ap_firmware_file->data, ap_firmware_file->len);
+
+ if (gvd->fmap_location !=
+ ((uintptr_t)fmh - (uintptr_t)ap_firmware_file->data)) {
+ ERROR("Incorrect gscvd fmap offset %x\n", gvd->fmap_location);
+ return -1;
+ }
+
+ /* Make sure signature and root key fit. */
+ if (vb2_verify_signature_inside(gvd, gvd->size, &gvd->sig_header) !=
+ VB2_SUCCESS) {
+ ERROR("Corrupted signature header in GVD\n");
+ return -1;
+ }
+
+ if (vb2_verify_packed_key_inside(gvd, gvd->size,
+ &gvd->root_key_header) !=
+ VB2_SUCCESS) {
+ ERROR("Corrupted root key header in GVD\n");
+ return -1;
+ }
+
+ return 0;
+}
+
+/**
+ * Validate GVD signature.
+ *
+ * Given the entire GVD space (header plus ranges array), the signature and
+ * the public key, verify that the signature matches.
+ *
+ * @param gvd pointer to gsc_verification_data followed by the ranges array
+ * @param gvd_signature pointer to the vb2 signature container
+ * @param packedk pointer to the keyblock containing the public key
+ *
+ * @return zero on success, non-zero on failure
+ */
+static int validate_gvd_signature(struct gsc_verification_data *gvd,
+ const struct vb2_packed_key *packedk)
+{
+ struct vb2_workbuf wb;
+ void *buf;
+ int rv;
+ struct vb2_public_key pubk;
+ size_t signed_size;
+
+ /* Extract public key from the public key keyblock. */
+ if (vb2_unpack_key(&pubk, packedk) != VB2_SUCCESS) {
+ ERROR("Failed to unpack public key\n");
+ return -1;
+ }
+
+ /* Let's create an ample sized work buffer. */
+ buf = init_wb(&wb, 8192);
+ if (!buf)
+ return -1;
+
+ signed_size = sizeof(struct gsc_verification_data) +
+ gvd->range_count * sizeof(gvd->ranges[0]);
+
+ rv = vb2_verify_data((const uint8_t *)gvd, signed_size,
+ &gvd->sig_header,
+ &pubk, &wb);
+
+ free(buf);
+ return rv;
+}
+
+/*
+ * Validate GVD of the passed in AP firmware file and possibly the root key hash
+ *
+ * The input parameters are the subset of the command line, the first argv
+ * string is the AP firmware file name, the second string, if present, is the
+ * hash of the root public key included in the RO_GSCVD area of the AP
+ * firmware file.
+ *
+ * @return zero on success, -1 on failure.
+ */
+static int validate_gscvd(int argc, char *argv[])
+{
+ struct file_buf ap_firmware_file;
+ int rv;
+ struct gscvd_ro_ranges ranges;
+ struct gsc_verification_data *gvd;
+ const char *file_name;
+ uint8_t digest[sizeof(gvd->ranges_digest)];
+ struct vb2_hash root_key_digest = { .algo = VB2_HASH_SHA256 };
+
+ /* Guaranteed to be available. */
+ file_name = argv[0];
+
+ if (argc > 1)
+ parse_digest_or_die(root_key_digest.sha256,
+ sizeof(root_key_digest.sha256),
+ argv[1]);
+
+ do {
+ struct vb2_keyblock *kblock;
+
+ rv = -1; /* Speculative, will be cleared on success. */
+
+ if (load_ap_firmware(file_name, &ap_firmware_file))
+ break;
+
+ /* Copy ranges from gscvd to local structure. */
+ gvd = (struct gsc_verification_data
+ *)(ap_firmware_file.data +
+ ap_firmware_file.ro_gscvd->area_offset);
+
+ if (validate_gvd(gvd, &ap_firmware_file))
+ break;
+
+ if (copy_ranges(&ap_firmware_file, gvd, &ranges))
+ break;
+
+ if (calculate_ranges_digest(&ap_firmware_file, &ranges,
+ gvd->hash_alg, digest,
+ sizeof(digest)))
+ break;
+
+ if (memcmp(digest, gvd->ranges_digest, sizeof(digest))) {
+ ERROR("Ranges digest mismatch\n");
+ break;
+ }
+
+ /* Find the keyblock. */
+ kblock = (struct vb2_keyblock *)((uintptr_t)gvd + gvd->size);
+
+ if ((argc > 1) && (vb2_hash_verify
+ (vb2_packed_key_data(&gvd->root_key_header),
+ gvd->root_key_header.key_size,
+ &root_key_digest) != VB2_SUCCESS)) {
+ ERROR("Sha256 mismatch\n");
+ break;
+ }
+
+ if (validate_pubk_signature(&gvd->root_key_header,
+ kblock))
+ break;
+
+ if (validate_gvd_signature(gvd, &kblock->data_key))
+ break;
+
+ rv = 0;
+ } while (false);
+
+ return rv;
+}
+
+/**
+ * Calculate and report sha256 hash of the public key body.
+ *
+ * The hash will be incorporated into GVC firmware to allow it to validate the
+ * root key.
+ *
+ * @param pubk pointer to the public key to process.
+ */
+static void dump_pubk_hash(const struct vb2_packed_key *pubk)
+{
+ struct vb2_hash hash;
+ size_t i;
+
+ vb2_hash_calculate(vb2_packed_key_data(pubk), pubk->key_size,
+ VB2_HASH_SHA256, &hash);
+
+ printf("Root key body sha256 hash:\n");
+
+ for (i = 0; i < sizeof(hash.sha256); i++)
+ printf("%02x", hash.sha256[i]);
+
+ printf("\n");
+}
+
+/**
+ * The main function of this futilty option.
+ *
+ * See the usage string for input details.
+ *
+ * @return zero on success, nonzero on failure.
+ */
+static int do_gscvd(int argc, char *argv[])
+{
+ int i;
+ int longindex;
+ char *infile = NULL;
+ char *outfile = NULL;
+ char *work_file = NULL;
+ struct gscvd_ro_ranges ranges;
+ int errorcount = 0;
+ struct vb2_packed_key *root_pubk = NULL;
+ struct vb2_keyblock *kblock = NULL;
+ struct vb2_private_key *plat_privk = NULL;
+ struct gsc_verification_data *gvd = NULL;
+ struct file_buf ap_firmware_file = { .fd = -1 };
+ uint32_t board_id = UINT32_MAX;
+ int rv = 0;
+
+ ranges.range_count = 0;
+
+ while ((i = getopt_long(argc, argv, short_opts, long_opts,
+ &longindex)) != -1) {
+ switch (i) {
+ case OPT_OUTFILE:
+ outfile = optarg;
+ break;
+ case 'R':
+ if (parse_ranges(optarg, &ranges)) {
+ ERROR("Could not parse ranges\n");
+ /* Error message has been already printed. */
+ errorcount++;
+ }
+ break;
+ case 'b': {
+ char *e;
+ long long bid;
+
+ bid = strtoull(optarg, &e, 16);
+ if (*e || (bid >= UINT32_MAX)) {
+ ERROR("Board ID value '%s' is invalid\n",
+ optarg);
+ errorcount++;
+ } else {
+ board_id = (uint32_t)bid;
+ }
+ break;
+ }
+ case 'r':
+ root_pubk = vb2_read_packed_key(optarg);
+ if (!root_pubk) {
+ ERROR("Could not read %s\n", optarg);
+ errorcount++;
+ }
+ break;
+ case 'k':
+ kblock = vb2_read_keyblock(optarg);
+ if (!kblock) {
+ ERROR("Could not read %s\n", optarg);
+ errorcount++;
+ }
+ break;
+ case 'p':
+ plat_privk = vb2_read_private_key(optarg);
+ if (!plat_privk) {
+ ERROR("Could not read %s\n", optarg);
+ errorcount++;
+ }
+ break;
+ case 'h':
+ printf("%s", usage);
+ return 0;
+ case '?':
+ if (optopt)
+ ERROR("Unrecognized option: -%c\n", optopt);
+ else
+ ERROR("Unrecognized option: %s\n",
+ argv[optind - 1]);
+ errorcount++;
+ break;
+ case ':':
+ ERROR("Missing argument to -%c\n", optopt);
+ errorcount++;
+ break;
+ case 0: /* handled option */
+ break;
+ default:
+ FATAL("Unrecognized getopt output: %d\n", i);
+ }
+ }
+
+ if ((optind == 1) && (argc > 1))
+ /* This must be a validation request. */
+ return validate_gscvd(argc - 1, argv + 1);
+
+ if (optind != (argc - 1)) {
+ ERROR("Misformatted command line\n%s\n", usage);
+ return 1;
+ }
+
+ if (errorcount || !ranges.range_count || !root_pubk || !kblock ||
+ !plat_privk || (board_id == UINT32_MAX)) {
+ /* Error message(s) should have been printed by now. */
+ ERROR("%s\n", usage);
+ return 1;
+ }
+
+ infile = argv[optind];
+
+ if (outfile) {
+ futil_copy_file_or_die(infile, outfile);
+ work_file = outfile;
+ } else {
+ work_file = infile;
+ }
+
+ do {
+ rv = 1; /* Speculative, will be cleared on success. */
+
+ if (validate_pubk_signature(root_pubk, kblock))
+ break;
+
+ if (validate_privk(kblock, plat_privk))
+ break;
+
+ if (load_ap_firmware(work_file, &ap_firmware_file))
+ break;
+
+ if (verify_ranges(&ranges, &ap_firmware_file))
+ break;
+
+ gvd = create_gvd(&ap_firmware_file, &ranges,
+ root_pubk, plat_privk, board_id);
+ if (!gvd)
+ break;
+
+ if (fill_gvd_area(&ap_firmware_file, gvd, kblock))
+ break;
+
+ dump_pubk_hash(root_pubk);
+
+ rv = 0;
+ } while (false);
+
+ free(gvd);
+ free(root_pubk);
+ free(kblock);
+ vb2_private_key_free(plat_privk);
+
+ /* Now flush the file. */
+ if (ap_firmware_file.data) {
+ rv |= futil_unmap_file(ap_firmware_file.fd, true,
+ ap_firmware_file.data,
+ ap_firmware_file.len);
+ }
+
+ if (ap_firmware_file.fd != -1)
+ close(ap_firmware_file.fd);
+
+ return rv;
+}
+
+DECLARE_FUTIL_COMMAND(gscvd, do_gscvd, VBOOT_VERSION_2_1,
+ "Create RO verification structure");
diff --git a/futility/cmd_pcr.c b/futility/cmd_pcr.c
index dc4c3ff..e267b24 100644
--- a/futility/cmd_pcr.c
+++ b/futility/cmd_pcr.c
@@ -40,57 +40,6 @@
printf(usage, argv[0], argv[0], argv[0]);
}
-static int parse_hex(uint8_t *val, const char *str)
-{
- uint8_t v = 0;
- char c;
- int digit;
-
- for (digit = 0; digit < 2; digit++) {
- c = *str;
- if (!c)
- return 0;
- if (!isxdigit(c))
- return 0;
- c = tolower(c);
- if (c >= '0' && c <= '9')
- v += c - '0';
- else
- v += 10 + c - 'a';
- if (!digit)
- v <<= 4;
- str++;
- }
-
- *val = v;
- return 1;
-}
-
-static void parse_digest_or_die(uint8_t *buf, int len, const char *str)
-{
- const char *s = str;
- int i;
-
- for (i = 0; i < len; i++) {
- /* skip whitespace */
- while (*s && isspace(*s))
- s++;
- if (!*s)
- break;
- if (!parse_hex(buf, s))
- break;
-
- /* on to the next byte */
- s += 2;
- buf++;
- }
-
- if (i != len) {
- fprintf(stderr, "Invalid DIGEST \"%s\"\n", str);
- exit(1);
- }
-}
-
static void print_digest(const uint8_t *buf, int len)
{
int i;
diff --git a/futility/cmd_update.c b/futility/cmd_update.c
index 57fa083..e4b3765 100644
--- a/futility/cmd_update.c
+++ b/futility/cmd_update.c
@@ -13,6 +13,8 @@
#include "futility.h"
#include "updater.h"
+#ifdef USE_FLASHROM
+
enum {
OPT_DUMMY = 0x100,
@@ -358,6 +360,17 @@
updater_delete_config(cfg);
return !!errorcnt;
}
+#define CMD_HELP_STR "Update system firmware"
-DECLARE_FUTIL_COMMAND(update, do_update, VBOOT_VERSION_ALL,
- "Update system firmware");
+#else /* USE_FLASHROM */
+
+static int do_update(int argc, char *argv[])
+{
+ FATAL(MYNAME " was built without flashrom support, `update` command unavailable!\n");
+ return -1;
+}
+#define CMD_HELP_STR "Update system firmware (unavailable in this build)"
+
+#endif /* !USE_FLASHROM */
+
+DECLARE_FUTIL_COMMAND(update, do_update, VBOOT_VERSION_ALL, CMD_HELP_STR);
diff --git a/futility/flashrom_wp_drv.c b/futility/flashrom_wp_drv.c
new file mode 100644
index 0000000..ff7a821
--- /dev/null
+++ b/futility/flashrom_wp_drv.c
@@ -0,0 +1,50 @@
+/* Copyright 2021 The Chromium OS Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ *
+ * The utility functions for firmware updater.
+ */
+
+#include <libflashrom.h>
+
+#include "updater.h"
+
+#define FLASHROM_OUTPUT_WP_PATTERN "write protect is "
+
+/* System environment values. */
+static const char * const FLASHROM_OUTPUT_WP_ENABLED =
+ FLASHROM_OUTPUT_WP_PATTERN "enabled",
+ * const FLASHROM_OUTPUT_WP_DISABLED =
+ FLASHROM_OUTPUT_WP_PATTERN "disabled";
+
+
+/* Helper function to return write protection status via given programmer. */
+enum wp_state flashrom_get_wp(const char *programmer)
+{
+ char *command, *result;
+ const char *postfix;
+ int r;
+
+ /* grep is needed because host_shell only returns 1 line. */
+ postfix = " 2>/dev/null | grep \"" FLASHROM_OUTPUT_WP_PATTERN "\"";
+
+
+ /* TODO(b/203715651): link with flashrom directly. */
+ ASPRINTF(&command, "flashrom --wp-status -p %s %s", programmer, postfix);
+
+ /* invokes flashrom(8) with non-zero result if error. */
+ result = host_shell(command);
+ strip_string(result, NULL);
+ free(command);
+ VB2_DEBUG("wp-status: %s\n", result);
+
+ if (strstr(result, FLASHROM_OUTPUT_WP_ENABLED))
+ r = WP_ENABLED;
+ else if (strstr(result, FLASHROM_OUTPUT_WP_DISABLED))
+ r = WP_DISABLED;
+ else
+ r = WP_ERROR;
+ free(result);
+
+ return r;
+}
diff --git a/futility/futility.h b/futility/futility.h
index 1f34713..9d40ba7 100644
--- a/futility/futility.h
+++ b/futility/futility.h
@@ -140,6 +140,12 @@
enum futil_file_err futil_unmap_file(int fd, int writeable,
uint8_t *buf, uint32_t len);
+/*
+ * Parse input string as a hex representation of size len, exit with error if
+ * the string is not a valid hex string or is of a wrongs size.
+ */
+void parse_digest_or_die(uint8_t *buf, int len, const char *str);
+
/* The CPU architecture is occasionally important */
enum arch_t {
ARCH_UNSPECIFIED,
diff --git a/futility/misc.c b/futility/misc.c
index f3e7748..76b8ad1 100644
--- a/futility/misc.c
+++ b/futility/misc.c
@@ -352,3 +352,54 @@
return FILE_TYPE_CHROMIUMOS_DISK;
}
+
+static int parse_hex(uint8_t *val, const char *str)
+{
+ uint8_t v = 0;
+ char c;
+ int digit;
+
+ for (digit = 0; digit < 2; digit++) {
+ c = *str;
+ if (!c)
+ return 0;
+ if (!isxdigit(c))
+ return 0;
+ c = tolower(c);
+ if (c >= '0' && c <= '9')
+ v += c - '0';
+ else
+ v += 10 + c - 'a';
+ if (!digit)
+ v <<= 4;
+ str++;
+ }
+
+ *val = v;
+ return 1;
+}
+
+void parse_digest_or_die(uint8_t *buf, int len, const char *str)
+{
+ const char *s = str;
+ int i;
+
+ for (i = 0; i < len; i++) {
+ /* skip whitespace */
+ while (*s && isspace(*s))
+ s++;
+ if (!*s)
+ break;
+ if (!parse_hex(buf, s))
+ break;
+
+ /* on to the next byte */
+ s += 2;
+ buf++;
+ }
+
+ if ((i != len) || *s) {
+ fprintf(stderr, "Invalid DIGEST \"%s\"\n", str);
+ exit(1);
+ }
+}
diff --git a/futility/updater.c b/futility/updater.c
index 87ac6fd..06a696c 100644
--- a/futility/updater.c
+++ b/futility/updater.c
@@ -275,7 +275,7 @@
static int set_try_cookies(struct updater_config *cfg, const char *target,
int has_update, int is_vboot2)
{
- int tries = 6;
+ int tries = 8;
const char *slot;
/* EC Software Sync needs few more reboots. */
@@ -334,6 +334,10 @@
struct firmware_section from, to;
int errorcnt = 0;
+ INFO("(emulation) Writing %s from %s to %s (emu=%s).\n",
+ section_name ? section_name : "the whole image",
+ image->file_name, image->programmer, filename);
+
from.data = image->data;
from.size = image->size;
@@ -384,30 +388,80 @@
}
/*
- * Writes a section from given firmware image to system firmware.
- * If section_name is NULL, write whole image.
+ * Returns the number of retries when reading or writing to flash.
+ */
+static int get_io_retries(struct updater_config *cfg)
+{
+ return 1 + get_config_quirk(QUIRK_EXTRA_RETRIES, cfg);
+}
+
+/*
+ * Returns 1 if the programmers in image1 and image2 are the same.
+ */
+static int is_the_same_programmer(const struct firmware_image *image1,
+ const struct firmware_image *image2)
+{
+ assert(image1 && image2);
+
+ /* Including if both are NULL. */
+ if (image1->programmer == image2->programmer)
+ return 1;
+
+ /* Not the same if either one is NULL. */
+ if (!image1->programmer || !image2->programmer)
+ return 0;
+
+ return strcmp(image1->programmer, image2->programmer) == 0;
+}
+
+/*
+ * Writes multiple sections from the given firmware image to the system.
+ * The 'sections' should be NULL (write the whole image) or a list of section
+ * names to write, and ended with NULL.
+ * Returns 0 if success, non-zero if error.
+ */
+static int write_firmware_sections(struct updater_config *cfg,
+ const struct firmware_image *image,
+ const char * const sections[])
+{
+ int r = 0;
+ struct firmware_image *diff_image = NULL;
+
+ if (cfg->emulation) {
+ int i;
+ if (!sections)
+ return emulate_write_firmware(
+ cfg->emulation, image, NULL);
+ for (i = 0; sections[i] && !r; i++) {
+ r |= emulate_write_firmware(
+ cfg->emulation, image, sections[i]);
+ }
+ return r;
+ }
+
+ if (cfg->use_diff_image && cfg->image_current.data &&
+ is_the_same_programmer(&cfg->image_current, image))
+ diff_image = &cfg->image_current;
+
+ return write_system_firmware(image, diff_image, sections,
+ &cfg->tempfiles, cfg->do_verify,
+ get_io_retries(cfg), cfg->verbosity + 1);
+}
+
+/*
+ * Writes a single section from the given firmware image to the system.
+ * Writes the whole firmware image if the section_name is NULL.
* Returns 0 if success, non-zero if error.
*/
static int write_firmware(struct updater_config *cfg,
const struct firmware_image *image,
const char *section_name)
{
- struct firmware_image *diff_image = NULL;
+ const char *sections[2] = {0};
- if (cfg->emulation) {
- INFO("(emulation) Writing %s from %s to %s (emu=%s).\n",
- section_name ? section_name : "whole image",
- image->file_name, image->programmer, cfg->emulation);
-
- return emulate_write_firmware(
- cfg->emulation, image, section_name);
- }
-
- if (cfg->fast_update && image == &cfg->image && cfg->image_current.data)
- diff_image = &cfg->image_current;
-
- return write_system_firmware(image, diff_image, section_name,
- &cfg->tempfiles, cfg->verbosity + 1);
+ sections[0] = section_name;
+ return write_firmware_sections(cfg, image,
+ section_name ? sections : NULL);
}
/*
@@ -458,7 +512,7 @@
*/
if (check_programmer_wp &&
get_system_property(SYS_PROP_WP_HW, cfg) == WP_ENABLED &&
- host_get_wp(image->programmer) == WP_ENABLED) {
+ flashrom_get_wp(image->programmer) == WP_ENABLED) {
ERROR("Target %s is write protected, skip updating.\n",
image->programmer);
return 0;
@@ -481,19 +535,27 @@
const struct vb2_gbb_header *gbb_from;
struct vb2_gbb_header *gbb_to;
- gbb_from = find_gbb(image_from);
- /* We do want to change GBB contents later. */
+ /* Cast to non-const because we do want to change GBB contents later. */
gbb_to = (struct vb2_gbb_header *)find_gbb(image_to);
- if (!gbb_from || !gbb_to)
+ /*
+ * For all cases, we need a valid gbb_to. Note for 'override GBB flags
+ * on a erased device', we only need gbb_to, not gbb_from.
+ */
+ if (!gbb_to)
return -1;
+ gbb_from = find_gbb(image_from);
+
/* Preserve (for non-factory mode) or override flags. */
if (override_flags)
gbb_to->flags = override_value;
- else if (preserve_flags)
+ else if (preserve_flags && gbb_from)
gbb_to->flags = gbb_from->flags;
+ if (!gbb_from)
+ return -1;
+
/* Preserve HWID. */
return futil_set_gbb_hwid(
gbb_to, (const char *)gbb_from + gbb_from->hwid_offset);
@@ -520,11 +582,16 @@
image_from, image_to, FMAP_SI_DESC);
}
- if (try_apply_quirk(QUIRK_PRESERVE_ME, cfg) > 0) {
- VB2_DEBUG("ME needs to be preserved - preserving %s.\n",
- FMAP_SI_ME);
- return preserve_firmware_section(
- image_from, image_to, FMAP_SI_ME);
+ if (!strcmp(image_from->programmer, PROG_HOST)) {
+ if (try_apply_quirk(QUIRK_PRESERVE_ME, cfg) > 0) {
+ VB2_DEBUG("ME needs to be preserved - preserving %s.\n",
+ FMAP_SI_ME);
+ return preserve_firmware_section(image_from, image_to,
+ FMAP_SI_ME);
+ }
+ } else {
+ VB2_DEBUG("Flashing via non-host programmer %s - no need to "
+ "preserve ME.\n", image_from->programmer);
}
return try_apply_quirk(QUIRK_UNLOCK_ME_FOR_UPDATE, cfg);
@@ -866,16 +933,18 @@
int has_from, has_to;
const char * const tag = "cros_allow_auto_update";
const char *section = FMAP_RW_LEGACY;
- const char *tmp_path;
+ const char *tmp_to, *tmp_from;
VB2_DEBUG("Checking %s contents...\n", FMAP_RW_LEGACY);
- tmp_path = get_firmware_image_temp_file(&cfg->image, &cfg->tempfiles);
- if (!tmp_path)
+ tmp_to = get_firmware_image_temp_file(&cfg->image, &cfg->tempfiles);
+ tmp_from = get_firmware_image_temp_file(&cfg->image_current,
+ &cfg->tempfiles);
+ if (!tmp_from || !tmp_to)
return 0;
- has_to = cbfs_file_exists(tmp_path, section, tag);
- has_from = cbfs_file_exists(tmp_path, section, tag);
+ has_to = cbfs_file_exists(tmp_to, section, tag);
+ has_from = cbfs_file_exists(tmp_from, section, tag);
if (!has_from || !has_to) {
VB2_DEBUG("Current legacy firmware has%s updater tag (%s) and "
@@ -1075,6 +1144,15 @@
struct firmware_image *image_from,
struct firmware_image *image_to)
{
+ int sections_start = 0;
+ static const char * const sections[] = {
+ FMAP_RW_LEGACY,
+ FMAP_RW_SECTION_A,
+ FMAP_RW_SECTION_B,
+ FMAP_RW_SHARED,
+ NULL,
+ };
+
STATUS("RW UPDATE: Updating RW sections (%s, %s, %s, and %s).\n",
FMAP_RW_SECTION_A, FMAP_RW_SECTION_B, FMAP_RW_SHARED,
FMAP_RW_LEGACY);
@@ -1084,14 +1162,18 @@
return UPDATE_ERR_ROOT_KEY;
if (check_compatible_tpm_keys(cfg, image_to))
return UPDATE_ERR_TPM_ROLLBACK;
+
/*
- * TODO(hungte) Speed up by flashing multiple sections in one
- * command, or provide diff file.
+ * We may also consider only updating legacy if legacy_needs_update()
+ * returns true. However, given this is for 'recovery', it is probably
+ * better to restore everything to the default states. We may revisit
+ * this if a new scenario is found.
*/
- if (write_firmware(cfg, image_to, FMAP_RW_SECTION_A) ||
- write_firmware(cfg, image_to, FMAP_RW_SECTION_B) ||
- write_firmware(cfg, image_to, FMAP_RW_SHARED) ||
- write_optional_firmware(cfg, image_to, FMAP_RW_LEGACY, 0, 1))
+ if (!firmware_section_exists(image_from, sections[sections_start]) ||
+ !firmware_section_exists(image_to, sections[sections_start]))
+ sections_start++;
+
+ if (write_firmware_sections(cfg, image_to, §ions[sections_start]))
return UPDATE_ERR_WRITE_FIRMWARE;
return UPDATE_ERR_DONE;
@@ -1187,6 +1269,7 @@
image_to->file_name, image_to->ro_version,
image_to->rw_version_a, image_to->rw_version_b);
+ try_apply_quirk(QUIRK_NO_VERIFY, cfg);
if (try_apply_quirk(QUIRK_MIN_PLATFORM_VERSION, cfg)) {
if (!cfg->force_update) {
ERROR("Add --force to waive checking the version.\n");
@@ -1195,9 +1278,10 @@
}
if (!image_from->data) {
int ret;
+
INFO("Loading current system firmware...\n");
ret = load_system_firmware(image_from, &cfg->tempfiles,
- cfg->verbosity);
+ get_io_retries(cfg), cfg->verbosity);
if (ret == IMAGE_PARSE_FAILURE && cfg->force_update) {
WARN("No compatible firmware in system.\n");
cfg->check_platform = 0;
@@ -1272,6 +1356,7 @@
cfg->pd_image.programmer = PROG_PD;
cfg->check_platform = 1;
+ cfg->do_verify = 1;
init_system_properties(&cfg->system_properties[0],
ARRAY_SIZE(cfg->system_properties));
@@ -1376,17 +1461,15 @@
assert(model->is_white_label);
if (!signature_id) {
- if (cfg->image_current.data) {
- tmp_image = get_firmware_image_temp_file(
- &cfg->image_current, &cfg->tempfiles);
- if (!tmp_image)
- return 1;
- } else {
+ if (!cfg->image_current.data) {
INFO("Loading system firmware for white label...\n");
load_system_firmware(&cfg->image_current,
- &cfg->tempfiles, cfg->verbosity);
- tmp_image = cfg->image_current.file_name;
+ &cfg->tempfiles,
+ get_io_retries(cfg),
+ cfg->verbosity);
}
+ tmp_image = get_firmware_image_temp_file(
+ &cfg->image_current, &cfg->tempfiles);
if (!tmp_image) {
ERROR("Failed to get system current firmware\n");
return 1;
@@ -1475,7 +1558,8 @@
/* Setup values that may change output or decision of other argument. */
cfg->verbosity = arg->verbosity;
- cfg->fast_update = arg->fast_update;
+ cfg->use_diff_image = arg->fast_update;
+ cfg->do_verify = !arg->fast_update;
cfg->factory_update = arg->is_factory;
if (arg->force_update)
cfg->force_update = 1;
@@ -1626,7 +1710,7 @@
errorcnt += !!setup_config_quirks(arg->quirks, cfg);
/* Additional checks. */
- if (check_single_image && (cfg->ec_image.data || cfg->pd_image.data)) {
+ if (check_single_image && !do_output && (cfg->ec_image.data || cfg->pd_image.data)) {
errorcnt++;
ERROR("EC/PD images are not supported in current mode.\n");
}
diff --git a/futility/updater.h b/futility/updater.h
index 69ba5e2..6dda928 100644
--- a/futility/updater.h
+++ b/futility/updater.h
@@ -14,6 +14,7 @@
/* FMAP section names. */
static const char * const FMAP_RO_FRID = "RO_FRID",
* const FMAP_RO_SECTION = "RO_SECTION",
+ * const FMAP_RO_CBFS = "COREBOOT",
* const FMAP_RO_GBB = "GBB",
* const FMAP_RW_VBLOCK_A = "VBLOCK_A",
* const FMAP_RW_VBLOCK_B = "VBLOCK_B",
@@ -46,6 +47,8 @@
QUIRK_OVERRIDE_SIGNATURE_ID,
QUIRK_PRESERVE_ME,
QUIRK_NO_CHECK_PLATFORM,
+ QUIRK_NO_VERIFY,
+ QUIRK_EXTRA_RETRIES,
QUIRK_MAX,
};
@@ -68,7 +71,8 @@
int legacy_update;
int factory_update;
int check_platform;
- int fast_update;
+ int use_diff_image;
+ int do_verify;
int verbosity;
const char *emulation;
int override_gbb_flags;
diff --git a/futility/updater_archive.c b/futility/updater_archive.c
index 4ad5287..9c3a608 100644
--- a/futility/updater_archive.c
+++ b/futility/updater_archive.c
@@ -30,6 +30,10 @@
#include <zip.h>
#endif
+#ifdef HAVE_CROSID
+#include <crosid.h>
+#endif
+
#include "host_misc.h"
#include "updater.h"
#include "util_misc.h"
@@ -815,6 +819,30 @@
return !manifest_add_model(manifest, &model);
}
+/**
+ * get_manifest_key() - Wrapper to get the firmware manifest key from crosid
+ *
+ * @manifest_key_out - Output parameter of the firmware manifest key.
+ *
+ * Returns:
+ * - <0 if libcrosid is unavailable or there was an error reading
+ * device data
+ * - >=0 (the matched device index) success
+ */
+static int get_manifest_key(char **manifest_key_out)
+{
+#ifdef HAVE_CROSID
+ return crosid_get_firmware_manifest_key(manifest_key_out);
+#else
+ ERROR("This version of futility was compiled without libcrosid "
+ "(perhaps compiled outside of the Chrome OS build system?) and "
+ "the update command is not fully supported. Either compile "
+ "from the Chrome OS build, or pass --model to manually specify "
+ "the machine model.\n");
+ return -1;
+#endif
+}
+
/*
* Finds the existing model_config from manifest that best matches current
* system (as defined by model_name).
@@ -823,9 +851,10 @@
const struct model_config *manifest_find_model(const struct manifest *manifest,
const char *model_name)
{
- char *sys_model_name = NULL;
+ char *manifest_key = NULL;
const struct model_config *model = NULL;
int i;
+ int matched_index;
/*
* For manifest with single model defined, we should just return because
@@ -836,9 +865,18 @@
return &manifest->models[0];
if (!model_name) {
- sys_model_name = host_shell("mosys platform model");
- VB2_DEBUG("System model name: '%s'\n", sys_model_name);
- model_name = sys_model_name;
+ matched_index = get_manifest_key(&manifest_key);
+ if (matched_index < 0) {
+ ERROR("Failed to get device identity. "
+ "Run \"crosid -v\" for explanation.\n");
+ return NULL;
+ }
+
+ INFO("Identified the device using libcrosid, "
+ "matched chromeos-config index: %d, "
+ "manifest key (model): %s\n",
+ matched_index, manifest_key);
+ model_name = manifest_key;
}
for (i = 0; !model && i < manifest->num; i++) {
@@ -846,27 +884,27 @@
model = &manifest->models[i];
}
if (!model) {
- if (!*model_name)
- ERROR("Cannot get model name.\n");
- else
- ERROR("Unsupported model: '%s'.\n", model_name);
+ ERROR("Unsupported model: '%s'.\n", model_name);
fprintf(stderr,
- "You are probably running an image for wrong board, or "
- "a device in early stage that 'mosys' command is not "
- "ready, or image from old (or factory) branches that "
- "Unified Build config is not updated yet for 'mosys'.\n"
- "Please check command 'mosys platform model', "
- "which should output one of the supported models below:"
- "\n");
+ "The firmware manifest key '%s' is not present in this "
+ "updater archive. The known keys to this updater "
+ "archive are:\n", model_name);
for (i = 0; i < manifest->num; i++)
fprintf(stderr, " %s", manifest->models[i].name);
- fprintf(stderr, "\n");
+ fprintf(stderr, "\n\n");
+ fprintf(stderr,
+ "Perhaps you are trying to use an updater archive for "
+ "the wrong board, or designed for an older OS version "
+ "before this model was supported.\n");
+ fprintf(stderr,
+ "Hint: Read the FIRMWARE_MANIFEST_KEY from the output "
+ "of the crosid command.\n");
}
- free(sys_model_name);
+ free(manifest_key);
return model;
}
diff --git a/futility/updater_quirks.c b/futility/updater_quirks.c
index 1d1ba62..c8140c1 100644
--- a/futility/updater_quirks.c
+++ b/futility/updater_quirks.c
@@ -21,6 +21,14 @@
const char * const quirks;
};
+/*
+ * The 'match by firmware name' is now deprecated. Please do not add any
+ * new records below. We now support reading quirks from CBFS, which is
+ * easier and more reliable. To do that, create a text file 'updater_quirks'
+ * and install to the CBFS.
+ *
+ * Examples: CL:*3365287, CL:*3351831, CL:*4441527
+ */
static const struct quirks_record quirks_records[] = {
{ .match = "Google_Whirlwind.", .quirks = "enlarge_image" },
{ .match = "Google_Arkham.", .quirks = "enlarge_image" },
@@ -116,10 +124,10 @@
ERROR("EC image has invalid section '%s'.\n", "EC_RO");
return 1;
}
- ec_ro_path = cbfs_extract_file(tmp_path, FMAP_RO_SECTION, "ecro",
+ ec_ro_path = cbfs_extract_file(tmp_path, FMAP_RO_CBFS, "ecro",
&cfg->tempfiles);
if (!ec_ro_path ||
- !cbfs_file_exists(tmp_path, FMAP_RO_SECTION, "ecro.hash")) {
+ !cbfs_file_exists(tmp_path, FMAP_RO_CBFS, "ecro.hash")) {
INFO("No valid EC RO for software sync in AP firmware.\n");
return 1;
}
@@ -331,6 +339,11 @@
* only RO and expect EC software sync to update RW later, or perform EC RO
* software sync.
*
+ * Note: EC RO software sync was not fully tested and may cause problems
+ * (b/218612817, b/187789991).
+ * RO-update (without extra sysjump) needs support from flashrom and is
+ * currently disabled.
+ *
* Returns:
* EC_RECOVERY_FULL to indicate a full recovery is needed.
* EC_RECOVERY_RO to indicate partial update (WP_RO) is needed.
@@ -345,23 +358,10 @@
*/
const char *ec_ro = "WP_RO";
struct firmware_image *ec_image = &cfg->ec_image;
-
int do_partial = get_config_quirk(QUIRK_EC_PARTIAL_RECOVERY, cfg);
- if (do_partial == -1) {
- char arch[VB_MAX_STRING_PROPERTY];
- /*
- * Don't do partial update if can't decide arch (usually implies
- * running outside DUT).
- */
- do_partial = 0;
- if (VbGetSystemPropertyString("arch", arch, sizeof(arch)) > 0) {
- /* By default disabled for x86, otherwise enabled. */
- do_partial = !!strcmp(arch, "x86");
- }
- }
if (!do_partial) {
- return EC_RECOVERY_FULL;
+ /* Need full update. */
} else if (!firmware_section_exists(ec_image, ec_ro)) {
INFO("EC image does not have section '%s'.\n", ec_ro);
/* Need full update. */
@@ -411,6 +411,15 @@
return 0;
}
+ /*
+ * b/213706510: subratabanik@ confirmed CSE may modify itself while we
+ * are doing system update, and currently the 'preserve' is done by
+ * flashing the same (e.g., "previously read") contents to skip erasing
+ * and writing; so we have to use the diff image to prevent contents
+ * being changed when writing.
+ */
+ cfg->use_diff_image = 1;
+
return 1;
}
@@ -425,6 +434,16 @@
}
/*
+ * Disable verifying contents after flashing.
+ */
+static int quirk_no_verify(struct updater_config *cfg)
+{
+ WARN("Disabled verifying flashed contents. You are on your own.\n");
+ cfg->do_verify = 0;
+ return 0;
+}
+
+/*
* Registers known quirks to a updater_config object.
*/
void updater_register_quirks(struct updater_config *cfg)
@@ -470,7 +489,6 @@
quirks->name = "ec_partial_recovery";
quirks->help = "chromium/1024401; recover EC by partial RO update.";
quirks->apply = quirk_ec_partial_recovery;
- quirks->value = -1; /* Decide at runtime. */
quirks = &cfg->quirks[QUIRK_OVERRIDE_SIGNATURE_ID];
quirks->name = "override_signature_id";
@@ -488,6 +506,16 @@
quirks->name = "no_check_platform";
quirks->help = "Do not check platform name.";
quirks->apply = quirk_no_check_platform;
+
+ quirks = &cfg->quirks[QUIRK_NO_VERIFY];
+ quirks->name = "no_verify";
+ quirks->help = "Do not verify when flashing.";
+ quirks->apply = quirk_no_verify;
+
+ quirks = &cfg->quirks[QUIRK_EXTRA_RETRIES];
+ quirks->name = "extra_retries";
+ quirks->help = "Extra retries when writing to system firmware.";
+ quirks->apply = NULL; /* Simple config. */
}
/*
diff --git a/futility/updater_utils.c b/futility/updater_utils.c
index 70ed396..18e4000 100644
--- a/futility/updater_utils.c
+++ b/futility/updater_utils.c
@@ -9,6 +9,7 @@
#include <limits.h>
#include <sys/stat.h>
#include <sys/types.h>
+#include <string.h>
#include <unistd.h>
#if defined (__FreeBSD__) || defined(__OpenBSD__)
#include <sys/wait.h>
@@ -21,20 +22,9 @@
#include "updater.h"
#define COMMAND_BUFFER_SIZE 256
-#define FLASHROM_OUTPUT_WP_PATTERN "write protect is "
-
-enum flashrom_ops {
- FLASHROM_READ,
- FLASHROM_WRITE,
- FLASHROM_WP_STATUS,
-};
/* System environment values. */
-static const char * const STR_REV = "rev",
- * const FLASHROM_OUTPUT_WP_ENABLED =
- FLASHROM_OUTPUT_WP_PATTERN "enabled",
- * const FLASHROM_OUTPUT_WP_DISABLED =
- FLASHROM_OUTPUT_WP_PATTERN "disabled";
+static const char * const STR_REV = "rev";
/*
* Strips a string (usually from shell execution output) by removing all the
@@ -172,6 +162,45 @@
return 0;
}
+static int parse_firmware_image(struct firmware_image *image)
+{
+ int ret = IMAGE_LOAD_SUCCESS;
+ const char *section_a = NULL, *section_b = NULL;
+
+ VB2_DEBUG("Image size: %d\n", image->size);
+ assert(image->data);
+
+ image->fmap_header = fmap_find(image->data, image->size);
+
+ if (!image->fmap_header) {
+ ERROR("Invalid image file (missing FMAP): %s\n", image->file_name);
+ ret = IMAGE_PARSE_FAILURE;
+ }
+
+ if (load_firmware_version(image, FMAP_RO_FRID, &image->ro_version))
+ ret = IMAGE_PARSE_FAILURE;
+
+ if (firmware_section_exists(image, FMAP_RW_FWID_A)) {
+ section_a = FMAP_RW_FWID_A;
+ section_b = FMAP_RW_FWID_B;
+ } else if (firmware_section_exists(image, FMAP_RW_FWID)) {
+ section_a = FMAP_RW_FWID;
+ section_b = FMAP_RW_FWID;
+ } else if (!ret) {
+ ERROR("Unsupported VBoot firmware (no RW ID): %s\n", image->file_name);
+ ret = IMAGE_PARSE_FAILURE;
+ }
+
+ /*
+ * Load and initialize both RW A and B sections.
+ * Note some unit tests will create only RW A.
+ */
+ load_firmware_version(image, section_a, &image->rw_version_a);
+ load_firmware_version(image, section_b, &image->rw_version_b);
+
+ return ret;
+}
+
/*
* Loads a firmware image from file.
* If archive is provided and file_name is a relative path, read the file from
@@ -182,9 +211,6 @@
int load_firmware_image(struct firmware_image *image, const char *file_name,
struct archive *archive)
{
- int ret = IMAGE_LOAD_SUCCESS;
- const char *section_a = NULL, *section_b = NULL;
-
if (!file_name) {
ERROR("No file name given\n");
return IMAGE_READ_FAILURE;
@@ -202,38 +228,9 @@
return IMAGE_READ_FAILURE;
}
- VB2_DEBUG("Image size: %d\n", image->size);
- assert(image->data);
image->file_name = strdup(file_name);
- image->fmap_header = fmap_find(image->data, image->size);
- if (!image->fmap_header) {
- ERROR("Invalid image file (missing FMAP): %s\n", file_name);
- ret = IMAGE_PARSE_FAILURE;
- }
-
- if (load_firmware_version(image, FMAP_RO_FRID, &image->ro_version))
- ret = IMAGE_PARSE_FAILURE;
-
- if (firmware_section_exists(image, FMAP_RW_FWID_A)) {
- section_a = FMAP_RW_FWID_A;
- section_b = FMAP_RW_FWID_B;
- } else if (firmware_section_exists(image, FMAP_RW_FWID)) {
- section_a = FMAP_RW_FWID;
- section_b = FMAP_RW_FWID;
- } else if (!ret) {
- ERROR("Unsupported VBoot firmware (no RW ID): %s\n", file_name);
- ret = IMAGE_PARSE_FAILURE;
- }
-
- /*
- * Load and initialize both RW A and B sections.
- * Note some unit tests will create only RW A.
- */
- load_firmware_version(image, section_a, &image->rw_version_a);
- load_firmware_version(image, section_b, &image->rw_version_b);
-
- return ret;
+ return parse_firmware_image(image);
}
/*
@@ -462,6 +459,7 @@
char *host_detect_servo(int *need_prepare_ptr)
{
const char *servo_port = getenv(ENV_SERVOD_PORT);
+ const char *servo_name = getenv(ENV_SERVOD_NAME);
char *servo_type = host_shell("dut-control -o servo_type 2>/dev/null");
const char *programmer = NULL;
char *ret = NULL;
@@ -469,10 +467,11 @@
char *servo_serial = NULL;
/* Get serial name if servo port is provided. */
- if (servo_port && *servo_port) {
+ if ((servo_port && *servo_port) || (servo_name && *servo_name)) {
const char *cmd = "dut-control -o serialname 2>/dev/null";
- VB2_DEBUG("Select servod using port: %s\n", servo_port);
+ VB2_DEBUG("Select servod using port: %s or name: %s\n",
+ servo_port, servo_name);
if (strstr(servo_type, "with_servo_micro"))
cmd = ("dut-control -o servo_micro_serialname"
" 2>/dev/null");
@@ -491,8 +490,9 @@
VB2_DEBUG("Selected Servo Micro.\n");
programmer = "raiden_debug_spi";
need_prepare = 1;
- } else if (strstr(servo_type, "ccd_cr50")) {
- VB2_DEBUG("Selected CCD CR50.\n");
+ } else if (strstr(servo_type, "ccd_cr50") ||
+ strstr(servo_type, "ccd_gsc")) {
+ VB2_DEBUG("Selected CCD.\n");
programmer = "raiden_debug_spi:target=AP";
} else {
VB2_DEBUG("Selected Servo V2.\n");
@@ -519,175 +519,86 @@
}
/*
- * A helper function to invoke flashrom(8) command.
+ * Loads the active system firmware image (usually from SPI flash chip).
* Returns 0 if success, non-zero if error.
*/
-static int host_flashrom(enum flashrom_ops op, const char *image_path,
- const char *programmer, int verbose,
- const char *section_name, const char *extra)
+int load_system_firmware(struct firmware_image *image,
+ struct tempfile *tempfiles,
+ int retries, int verbosity)
{
- char *command, *result;
- const char *op_cmd, *dash_i = "-i", *postfix = "";
- int r;
+ int r, i;
- switch (verbose) {
- case 0:
- postfix = " >/dev/null 2>&1";
- break;
- case 1:
- break;
- case 2:
- postfix = "-V";
- break;
- case 3:
- postfix = "-V -V";
- break;
- default:
- postfix = "-V -V -V";
- break;
+ INFO("flasrhom -r <IMAGE> -p %s%s\n",
+ image->programmer,
+ verbosity ? " -V" : "");
+
+ for (i = 1, r = -1; i <= retries && r != 0; i++) {
+ if (i > 1)
+ WARN("Retry reading firmware (%d/%d)...\n", i, retries);
+ r = flashrom_read_image(image, NULL, verbosity + 1);
}
-
- if (!section_name || !*section_name) {
- dash_i = "";
- section_name = "";
- }
-
- switch (op) {
- case FLASHROM_READ:
- op_cmd = "-r";
- assert(image_path);
- break;
-
- case FLASHROM_WRITE:
- op_cmd = "-w";
- assert(image_path);
- break;
-
- case FLASHROM_WP_STATUS:
- op_cmd = "--wp-status";
- assert(image_path == NULL);
- image_path = "";
- /* grep is needed because host_shell only returns 1 line. */
- postfix = " 2>/dev/null | grep \"" \
- FLASHROM_OUTPUT_WP_PATTERN "\"";
- break;
-
- default:
- assert(0);
- return -1;
- }
-
- if (!extra)
- extra = "";
-
- /* TODO(hungte) In future we should link with flashrom directly. */
- ASPRINTF(&command, "flashrom %s %s -p %s %s %s %s %s", op_cmd,
- image_path, programmer, dash_i, section_name, extra,
- postfix);
-
- if (verbose)
- INFO("Executing: %s\n", command);
-
- if (op != FLASHROM_WP_STATUS) {
- r = system(command);
- free(command);
- if (r)
- ERROR("Error code: %d\n", r);
- return r;
- }
-
- result = host_shell(command);
- strip_string(result, NULL);
- free(command);
- VB2_DEBUG("wp-status: %s\n", result);
-
- if (strstr(result, FLASHROM_OUTPUT_WP_ENABLED))
- r = WP_ENABLED;
- else if (strstr(result, FLASHROM_OUTPUT_WP_DISABLED))
- r = WP_DISABLED;
- else
- r = WP_ERROR;
- free(result);
+ if (!r)
+ r = parse_firmware_image(image);
return r;
}
-/* Helper function to return write protection status via given programmer. */
-enum wp_state host_get_wp(const char *programmer)
+/*
+ * Writes sections from a given firmware image to the system firmware.
+ * Regions should be NULL for writing the whole image, or a list of
+ * FMAP section names (and ended with a NULL).
+ * Returns 0 if success, non-zero if error.
+ */
+int write_system_firmware(const struct firmware_image *image,
+ const struct firmware_image *diff_image,
+ const char * const sections[],
+ struct tempfile *tempfiles,
+ int do_verify, int retries, int verbosity)
{
- return host_flashrom(FLASHROM_WP_STATUS, NULL, programmer, 0, NULL,
- NULL);
+ int r, i, len = 0;
+ char *partial = NULL;
+
+ for (i = 0; sections && sections[i]; i++)
+ len += strlen(sections[i]) + strlen(" -i ");
+ if (len) {
+ partial = (char *)malloc(len + 1);
+ if (!partial) {
+ ERROR("Failed to allocate a string buffer.\n");
+ return -1;
+ }
+ partial[0] = '\0';
+ for (i = 0; sections[i]; i++) {
+ strcat(partial, " -i ");
+ strcat(partial, sections[i]);
+ }
+ assert(strlen(partial) == len);
+ }
+
+ INFO("flashrom -w <IMAGE> -p %s%s%s%s%s\n",
+ image->programmer,
+ diff_image ? " --flash-contents <DIFF_IMAGE>" : "",
+ do_verify ? "" : " --noverify",
+ verbosity > 1 ? " -V" : "",
+ partial ? partial : "");
+ free(partial);
+
+ for (i = 1, r = -1; i <= retries && r != 0; i++) {
+ if (i > 1)
+ WARN("Retry writing firmware (%d/%d)...\n", i, retries);
+ r = flashrom_write_image(image, sections, diff_image, do_verify,
+ verbosity + 1);
+ /*
+ * Force a newline to flush stdout in case if
+ * flashrom_write_image left some messages in the buffer.
+ */
+ fprintf(stdout, "\n");
+ }
+ return r;
}
/* Helper function to return host software write protection status. */
static int host_get_wp_sw(void)
{
- return host_get_wp(PROG_HOST);
-}
-
-/*
- * Loads the active system firmware image (usually from SPI flash chip).
- * Returns 0 if success, non-zero if error.
- */
-int load_system_firmware(struct firmware_image *image,
- struct tempfile *tempfiles, int verbosity)
-{
- int r;
- const char *tmp_path = create_temp_file(tempfiles);
-
- if (!tmp_path)
- return -1;
-
- r = host_flashrom(FLASHROM_READ, tmp_path, image->programmer,
- verbosity, NULL, NULL);
- /*
- * The verbosity for host_flashrom will be translated to
- * (verbosity-1)*'-V', and usually 3*'-V' is enough for debugging.
- */
- const int debug_verbosity = 4;
- if (r && verbosity < debug_verbosity) {
- /* Read again, with verbose messages for debugging. */
- WARN("Failed reading system firmware (%d), try again...\n", r);
- r = host_flashrom(FLASHROM_READ, tmp_path, image->programmer,
- debug_verbosity, NULL, NULL);
- }
- if (!r)
- r = load_firmware_image(image, tmp_path, NULL);
- return r;
-}
-
-/*
- * Writes a section from given firmware image to system firmware.
- * If section_name is NULL, write whole image.
- * Returns 0 if success, non-zero if error.
- */
-int write_system_firmware(const struct firmware_image *image,
- const struct firmware_image *diff_image,
- const char *section_name,
- struct tempfile *tempfiles,
- int verbosity)
-{
- const char *tmp_path = get_firmware_image_temp_file(image, tempfiles);
- const char *tmp_diff = NULL;
-
- const char *programmer = image->programmer;
- char *extra = NULL;
- int r;
-
- if (!tmp_path)
- return -1;
-
- if (diff_image) {
- tmp_diff = get_firmware_image_temp_file(
- diff_image, tempfiles);
- if (!tmp_diff)
- return -1;
- ASPRINTF(&extra, "--noverify --flash-contents=%s", tmp_diff);
- }
-
- r = host_flashrom(FLASHROM_WRITE, tmp_path, programmer, verbosity,
- section_name, extra);
- free(extra);
- return r;
+ return flashrom_get_wp(PROG_HOST);
}
/* Helper function to configure all properties. */
diff --git a/futility/updater_utils.h b/futility/updater_utils.h
index 2531675..3eb1d33 100644
--- a/futility/updater_utils.h
+++ b/futility/updater_utils.h
@@ -54,15 +54,8 @@
*/
void remove_all_temp_files(struct tempfile *head);
-/* Utilities for firmware images and (FMAP) sections */
-struct firmware_image {
- const char *programmer;
- uint32_t size;
- uint8_t *data;
- char *file_name;
- char *ro_version, *rw_version_a, *rw_version_b;
- FmapHeader *fmap_header;
-};
+/* Include definition of 'struct firmware_image;' */
+#include "flashrom.h"
enum {
IMAGE_LOAD_SUCCESS = 0,
@@ -85,7 +78,8 @@
* Returns 0 if success, non-zero if error.
*/
int load_system_firmware(struct firmware_image *image,
- struct tempfile *tempfiles, int verbosity);
+ struct tempfile *tempfiles,
+ int retries, int verbosity);
/* Frees the allocated resource from a firmware image object. */
void free_firmware_image(struct firmware_image *image);
@@ -99,15 +93,16 @@
struct tempfile *tempfiles);
/*
- * Writes a section from given firmware image to system firmware.
- * If section_name is NULL, write whole image.
+ * Writes sections from a given firmware image to the system firmware.
+ * Regions should be NULL for writing the whole image, or a list of
+ * FMAP section names (and ended with a NULL).
* Returns 0 if success, non-zero if error.
*/
int write_system_firmware(const struct firmware_image *image,
const struct firmware_image *diff_image,
- const char *section_name,
+ const char * const sections[],
struct tempfile *tempfiles,
- int verbosity);
+ int do_verify, int retries, int verbosity);
struct firmware_section {
uint8_t *data;
@@ -175,11 +170,14 @@
};
/* Helper function to return write protection status via given programmer. */
-enum wp_state host_get_wp(const char *programmer);
+enum wp_state flashrom_get_wp(const char *programmer);
/* The environment variable name for setting servod port. */
#define ENV_SERVOD_PORT "SERVOD_PORT"
+/* The environment variable name for setting servod name. */
+#define ENV_SERVOD_NAME "SERVOD_NAME"
+
/*
* Helper function to detect type of Servo board attached to host.
* Returns a string as programmer parameter on success, otherwise NULL.
diff --git a/host/arch/x86/lib/crossystem_arch.c b/host/arch/x86/lib/crossystem_arch.c
index e805e2a..d48cf87 100644
--- a/host/arch/x86/lib/crossystem_arch.c
+++ b/host/arch/x86/lib/crossystem_arch.c
@@ -733,6 +733,7 @@
/* INTC105x are for Alderlake */
{ "INTC1055:00", FindGpioChipOffsetByLabel },
{ "INTC1056:00", FindGpioChipOffsetByLabel },
+ { "INTC1057:00", FindGpioChipOffsetByLabel },
/* INT3453 are for GLK */
{ "INT3453:00", FindGpioChipOffsetByLabel },
{ "INT3453:01", FindGpioChipOffsetByLabel },
diff --git a/host/lib/crossystem.c b/host/lib/crossystem.c
index 02443b1..a5427c2 100644
--- a/host/lib/crossystem.c
+++ b/host/lib/crossystem.c
@@ -4,9 +4,11 @@
*/
#include <ctype.h>
+#include <fcntl.h>
#include <stddef.h>
#include <stdio.h>
#include <string.h>
+#include <sys/file.h>
#include <unistd.h>
#include "2api.h"
@@ -22,14 +24,12 @@
#include "subprocess.h"
#include "vboot_struct.h"
+/* Filename for crossystem lock */
+#define CROSSYSTEM_LOCK_PATH "/run/lock/crossystem.lock"
+
/* Filename for kernel command line */
#define KERNEL_CMDLINE_PATH "/proc/cmdline"
-/* Filename for the mount-encrypted key */
-/* TODO(b/174807059): Remove this after we land driver-level TPM simulator on
- * all VM boards */
-#define MOUNT_ENCRYPTED_KEY_PATH "/mnt/stateful_partition/encrypted.key"
-
/* Filename for the TPM simulator NV data */
#define TPM_SIMULATOR_NVCHIP_PATH \
"/mnt/stateful_partition/unencrypted/tpm2-simulator/NVChip"
@@ -92,6 +92,32 @@
return 0 == strncmp(fwid, start, strlen(start));
}
+/* Acquire the lock for crossystem SetSystemProperty call. */
+static int AcquireCrossystemLock(void)
+{
+ int lock_fd;
+
+ lock_fd = open(CROSSYSTEM_LOCK_PATH, O_RDWR | O_CREAT, 0600);
+ if (lock_fd < 0)
+ return -1;
+
+ if (flock(lock_fd, LOCK_EX) < 0)
+ return -1;
+
+ return lock_fd;
+}
+
+/* Release the lock for crossystem SetSystemProperty call. */
+static int ReleaseCrossystemLock(int lock_fd)
+{
+ if (flock(lock_fd, F_UNLCK) < 0)
+ return -1;
+
+ close(lock_fd);
+
+ return 0;
+}
+
static struct vb2_context *get_fake_context(void)
{
static uint8_t fake_workbuf[sizeof(struct vb2_shared_data) + 16]
@@ -381,12 +407,9 @@
} else if (!strcasecmp(name,"disable_dev_request")) {
value = vb2_get_nv_storage(VB2_NV_DISABLE_DEV_REQUEST);
} else if (!strcasecmp(name,"clear_tpm_owner_request")) {
- if (TPM2_SIMULATOR && VTPM_PROXY)
+ if (TPM2_SIMULATOR)
/* Check TPM simulator NVChip status */
value = access(TPM_SIMULATOR_NVCHIP_PATH, F_OK) != 0;
- else if (TPM2_SIMULATOR)
- /* Check mount-encrypted key status */
- value = access(MOUNT_ENCRYPTED_KEY_PATH, F_OK) != 0;
else
value = vb2_get_nv_storage(
VB2_NV_CLEAR_TPM_OWNER_REQUEST);
@@ -488,8 +511,7 @@
return value;
}
-const char *VbGetSystemPropertyString(const char *name, char *dest,
- size_t size)
+const char *VbGetSystemPropertyString(const char *name, char *dest, size_t size)
{
/* Check for HWID override via cros_config */
if (!strcasecmp(name, "hwid")) {
@@ -552,8 +574,7 @@
return NULL;
}
-
-int VbSetSystemPropertyInt(const char *name, int value)
+static int VbSetSystemPropertyIntInternal(const char *name, int value)
{
/* Check architecture-dependent properties first */
@@ -581,13 +602,10 @@
* on simulator */
if (value == 0)
return -1;
- const char *tpm_path =
- VTPM_PROXY ? TPM_SIMULATOR_NVCHIP_PATH
- : MOUNT_ENCRYPTED_KEY_PATH;
/* Check TPM simulator data status */
- if (!access(tpm_path, F_OK)) {
+ if (!access(TPM_SIMULATOR_NVCHIP_PATH, F_OK)) {
/* Remove the TPM2.0 simulator data */
- return remove(tpm_path);
+ return remove(TPM_SIMULATOR_NVCHIP_PATH);
} else {
/* Return success when the file is already
* removed */
@@ -673,7 +691,25 @@
return -1;
}
-int VbSetSystemPropertyString(const char* name, const char* value)
+int VbSetSystemPropertyInt(const char *name, int value)
+{
+ int result = -1;
+ int lock_fd;
+
+ lock_fd = AcquireCrossystemLock();
+ if (lock_fd < 0)
+ return -1;
+
+ result = VbSetSystemPropertyIntInternal(name, value);
+
+ if (ReleaseCrossystemLock(lock_fd) < 0)
+ return -1;
+
+ return result;
+}
+
+static int VbSetSystemPropertyStringInternal(const char *name,
+ const char *value)
{
/* Chain to architecture-dependent properties */
if (0 == VbSetArchPropertyString(name, value))
@@ -725,6 +761,23 @@
return -1;
}
+int VbSetSystemPropertyString(const char *name, const char *value)
+{
+ int result = -1;
+ int lock_fd;
+
+ lock_fd = AcquireCrossystemLock();
+ if (lock_fd < 0)
+ return -1;
+
+ result = VbSetSystemPropertyStringInternal(name, value);
+
+ if (ReleaseCrossystemLock(lock_fd) < 0)
+ return -1;
+
+ return result;
+}
+
/**
* Get index of the last valid VBNV entry in an EEPROM.
*
@@ -768,21 +821,21 @@
{
int index;
int vbnv_size = vb2_nv_get_size(ctx);
- uint8_t *flash_buf;
- uint32_t flash_size;
- if (flashrom_read(FLASHROM_PROGRAMMER_INTERNAL_AP, VBNV_FMAP_REGION,
- &flash_buf, &flash_size))
+ struct firmware_image image = {
+ .programmer = FLASHROM_PROGRAMMER_INTERNAL_AP,
+ };
+ if (flashrom_read(&image, VBNV_FMAP_REGION))
return -1;
- index = vb2_nv_index(flash_buf, flash_size, vbnv_size);
+ index = vb2_nv_index(image.data, image.size, vbnv_size);
if (index < 0) {
- free(flash_buf);
+ free(image.data);
return -1;
}
- memcpy(ctx->nvdata, &flash_buf[index * vbnv_size], vbnv_size);
- free(flash_buf);
+ memcpy(ctx->nvdata, &image.data[index * vbnv_size], vbnv_size);
+ free(image.data);
return 0;
}
@@ -792,34 +845,33 @@
int current_index;
int next_index;
int vbnv_size = vb2_nv_get_size(ctx);
- uint8_t *flash_buf;
- uint32_t flash_size;
- if (flashrom_read(FLASHROM_PROGRAMMER_INTERNAL_AP, VBNV_FMAP_REGION,
- &flash_buf, &flash_size))
+ struct firmware_image image = {
+ .programmer = FLASHROM_PROGRAMMER_INTERNAL_AP,
+ };
+ if (flashrom_read(&image, VBNV_FMAP_REGION))
return -1;
- current_index = vb2_nv_index(flash_buf, flash_size, vbnv_size);
+ current_index = vb2_nv_index(image.data, image.size, vbnv_size);
if (current_index < 0) {
rv = -1;
goto exit;
}
next_index = current_index + 1;
- if (next_index * vbnv_size == flash_size) {
+ if (next_index * vbnv_size == image.size) {
/* VBNV is full. Erase and write at beginning. */
- memset(flash_buf, 0xff, flash_size);
+ memset(image.data, 0xff, image.size);
next_index = 0;
}
- memcpy(&flash_buf[next_index * vbnv_size], ctx->nvdata, vbnv_size);
- if (flashrom_write(FLASHROM_PROGRAMMER_INTERNAL_AP, VBNV_FMAP_REGION,
- flash_buf, flash_size)) {
+ memcpy(&image.data[next_index * vbnv_size], ctx->nvdata, vbnv_size);
+ if (flashrom_write(&image, VBNV_FMAP_REGION)) {
rv = -1;
goto exit;
}
exit:
- free(flash_buf);
+ free(image.data);
return rv;
}
diff --git a/host/lib/flashrom.c b/host/lib/flashrom.c
index e83dfb2..6ee5971 100644
--- a/host/lib/flashrom.c
+++ b/host/lib/flashrom.c
@@ -103,15 +103,14 @@
return VB2_SUCCESS;
}
-vb2_error_t flashrom_read(const char *programmer, const char *region,
- uint8_t **data_out, uint32_t *size_out)
+vb2_error_t flashrom_read(struct firmware_image *image, const char *region)
{
char *tmpfile;
char region_param[PATH_MAX];
vb2_error_t rv;
- *data_out = NULL;
- *size_out = 0;
+ image->data = NULL;
+ image->size = 0;
VB2_TRY(write_temp_file(NULL, 0, &tmpfile));
@@ -122,7 +121,7 @@
const char *const argv[] = {
FLASHROM_EXEC_NAME,
"-p",
- programmer,
+ image->programmer,
"-r",
region ? "-i" : tmpfile,
region ? region_param : NULL,
@@ -131,21 +130,20 @@
rv = run_flashrom(argv);
if (rv == VB2_SUCCESS)
- rv = vb2_read_file(tmpfile, data_out, size_out);
+ rv = vb2_read_file(tmpfile, &image->data, &image->size);
unlink(tmpfile);
free(tmpfile);
return rv;
}
-vb2_error_t flashrom_write(const char *programmer, const char *region,
- uint8_t *data, uint32_t size)
+vb2_error_t flashrom_write(struct firmware_image *image, const char *region)
{
char *tmpfile;
char region_param[PATH_MAX];
vb2_error_t rv;
- VB2_TRY(write_temp_file(data, size, &tmpfile));
+ VB2_TRY(write_temp_file(image->data, image->size, &tmpfile));
if (region)
snprintf(region_param, sizeof(region_param), "%s:%s", region,
@@ -154,7 +152,7 @@
const char *const argv[] = {
FLASHROM_EXEC_NAME,
"-p",
- programmer,
+ image->programmer,
"--noverify-all",
"-w",
region ? "-i" : tmpfile,
diff --git a/host/lib/flashrom_drv.c b/host/lib/flashrom_drv.c
new file mode 100644
index 0000000..1d9e3fd
--- /dev/null
+++ b/host/lib/flashrom_drv.c
@@ -0,0 +1,212 @@
+/* Copyright 2021 The Chromium OS Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ *
+ * The utility functions for firmware updater.
+ */
+
+#include <libflashrom.h>
+
+#include "2common.h"
+#include "crossystem.h"
+#include "host_misc.h"
+#include "util_misc.h"
+//#include "updater.h"
+#include "../../futility/futility.h"
+#include "flashrom.h"
+
+// global to allow verbosity level to be injected into callback.
+static enum flashrom_log_level g_verbose_screen = FLASHROM_MSG_INFO;
+
+static int flashrom_print_cb(enum flashrom_log_level level, const char *fmt,
+ va_list ap)
+{
+ int ret = 0;
+ FILE *output_type = (level < FLASHROM_MSG_INFO) ? stderr : stdout;
+
+ if (level > g_verbose_screen)
+ return ret;
+
+ ret = vfprintf(output_type, fmt, ap);
+ /* msg_*spew often happens inside chip accessors
+ * in possibly time-critical operations.
+ * Don't slow them down by flushing.
+ */
+ if (level != FLASHROM_MSG_SPEW)
+ fflush(output_type);
+
+ return ret;
+}
+
+static char *flashrom_extract_params(const char *str, char **prog, char **params)
+{
+ char *tmp = strdup(str);
+ *prog = strtok(tmp, ":");
+ *params = strtok(NULL, "");
+ return tmp;
+}
+
+int flashrom_read_image(struct firmware_image *image, const char *region,
+ int verbosity)
+{
+ int r = 0;
+ size_t len = 0;
+
+ g_verbose_screen = (verbosity == -1) ? FLASHROM_MSG_INFO : verbosity;
+
+ char *programmer, *params;
+ char *tmp = flashrom_extract_params(image->programmer, &programmer, ¶ms);
+
+ struct flashrom_programmer *prog = NULL;
+ struct flashrom_flashctx *flashctx = NULL;
+ struct flashrom_layout *layout = NULL;
+
+ flashrom_set_log_callback((flashrom_log_callback *)&flashrom_print_cb);
+
+ if (flashrom_init(1)
+ || flashrom_programmer_init(&prog, programmer, params)) {
+ r = -1;
+ goto err_init;
+ }
+ if (flashrom_flash_probe(&flashctx, prog, NULL)) {
+ r = -1;
+ goto err_probe;
+ }
+
+ len = flashrom_flash_getsize(flashctx);
+
+ if (region) {
+ r = flashrom_layout_read_fmap_from_buffer(
+ &layout, flashctx, (const uint8_t *)image->data,
+ image->size);
+ if (r > 0) {
+ WARN("could not read fmap from image, r=%d, "
+ "falling back to read from rom\n", r);
+ r = flashrom_layout_read_fmap_from_rom(
+ &layout, flashctx, 0, len);
+ if (r > 0) {
+ ERROR("could not read fmap from rom, r=%d\n", r);
+ r = -1;
+ goto err_cleanup;
+ }
+ }
+ // empty region causes seg fault in API.
+ r |= flashrom_layout_include_region(layout, region);
+ if (r > 0) {
+ ERROR("could not include region = '%s'\n", region);
+ r = -1;
+ goto err_cleanup;
+ }
+ flashrom_layout_set(flashctx, layout);
+ }
+
+ image->data = calloc(1, len);
+ image->size = len;
+ image->file_name = strdup("<sys-flash>");
+
+ r |= flashrom_image_read(flashctx, image->data, len);
+
+err_cleanup:
+ flashrom_layout_release(layout);
+ flashrom_flash_release(flashctx);
+
+err_probe:
+ r |= flashrom_programmer_shutdown(prog);
+
+err_init:
+ free(tmp);
+ return r;
+}
+
+int flashrom_write_image(const struct firmware_image *image,
+ const char * const regions[],
+ const struct firmware_image *diff_image,
+ int do_verify, int verbosity)
+{
+ int r = 0;
+ size_t len = 0;
+
+ g_verbose_screen = (verbosity == -1) ? FLASHROM_MSG_INFO : verbosity;
+
+ char *programmer, *params;
+ char *tmp = flashrom_extract_params(image->programmer, &programmer, ¶ms);
+
+ struct flashrom_programmer *prog = NULL;
+ struct flashrom_flashctx *flashctx = NULL;
+ struct flashrom_layout *layout = NULL;
+
+ flashrom_set_log_callback((flashrom_log_callback *)&flashrom_print_cb);
+
+ if (flashrom_init(1)
+ || flashrom_programmer_init(&prog, programmer, params)) {
+ r = -1;
+ goto err_init;
+ }
+ if (flashrom_flash_probe(&flashctx, prog, NULL)) {
+ r = -1;
+ goto err_probe;
+ }
+
+ len = flashrom_flash_getsize(flashctx);
+ if (len == 0) {
+ ERROR("zero sized flash detected\n");
+ r = -1;
+ goto err_cleanup;
+ }
+
+ if (diff_image) {
+ if (diff_image->size != image->size) {
+ ERROR("diff_image->size != image->size");
+ r = -1;
+ goto err_cleanup;
+ }
+ }
+
+ if (regions) {
+ int i;
+ r = flashrom_layout_read_fmap_from_buffer(
+ &layout, flashctx, (const uint8_t *)image->data,
+ image->size);
+ if (r > 0) {
+ WARN("could not read fmap from image, r=%d, "
+ "falling back to read from rom\n", r);
+ r = flashrom_layout_read_fmap_from_rom(
+ &layout, flashctx, 0, len);
+ if (r > 0) {
+ ERROR("could not read fmap from rom, r=%d\n", r);
+ r = -1;
+ goto err_cleanup;
+ }
+ }
+ for (i = 0; regions[i]; i++) {
+ // empty region causes seg fault in API.
+ r |= flashrom_layout_include_region(layout, regions[i]);
+ if (r > 0) {
+ ERROR("could not include region = '%s'\n",
+ regions[i]);
+ r = -1;
+ goto err_cleanup;
+ }
+ }
+ flashrom_layout_set(flashctx, layout);
+ }
+
+ flashrom_flag_set(flashctx, FLASHROM_FLAG_VERIFY_WHOLE_CHIP, true);
+ flashrom_flag_set(flashctx, FLASHROM_FLAG_VERIFY_AFTER_WRITE, true);
+ if (!do_verify)
+ flashrom_flag_set(flashctx, FLASHROM_FLAG_VERIFY_AFTER_WRITE, false);
+
+ r |= flashrom_image_write(flashctx, image->data, image->size,
+ diff_image ? diff_image->data : NULL);
+
+err_cleanup:
+ flashrom_layout_release(layout);
+ flashrom_flash_release(flashctx);
+
+err_probe:
+ r |= flashrom_programmer_shutdown(prog);
+
+err_init:
+ free(tmp);
+ return r;
+}
diff --git a/host/lib/include/flashrom.h b/host/lib/include/flashrom.h
index 560fbb0..6058d64 100644
--- a/host/lib/include/flashrom.h
+++ b/host/lib/include/flashrom.h
@@ -8,43 +8,54 @@
#include <stdint.h>
#include "2return_codes.h"
+#include "fmap.h"
#define FLASHROM_PROGRAMMER_INTERNAL_AP "host"
#define FLASHROM_PROGRAMMER_INTERNAL_EC "ec"
+/* Utilities for firmware images and (FMAP) sections */
+struct firmware_image {
+ /**
+ * programmer The name of the programmer to use. Use either
+ * FLASHROM_PROGRAMMER_INTERNAL_AP or,
+ * FLASHROM_PROGRAMMER_INTERNAL_EC
+ * for the AP and EC respectively.
+ */
+ const char *programmer;
+ uint32_t size; /* buffer size. */
+ uint8_t *data; /* data allocated buffer to read/write with. */
+ char *file_name;
+ char *ro_version, *rw_version_a, *rw_version_b;
+ FmapHeader *fmap_header;
+};
+
/**
* Read using flashrom into an allocated buffer.
*
- * @param programmer The name of the programmer to use. There are
- * named constants FLASHROM_PROGRAMMER_INTERNAL_AP
- * and FLASHROM_PROGRAMMER_INTERNAL_EC available
- * for the AP and EC respectively, or a custom
- * programmer string can be provided.
+ * @param image The parameter that contains the programmer, buffer and
+ * size to use in the read operation.
* @param region The name of the fmap region to read, or NULL to
* read the entire flash chip.
- * @param data_out Output parameter of allocated buffer to read into.
- * The caller should free the buffer.
- * @param size_out Output parameter of buffer size.
*
* @return VB2_SUCCESS on success, or a relevant error.
*/
-vb2_error_t flashrom_read(const char *programmer, const char *region,
- uint8_t **data_out, uint32_t *size_out);
+vb2_error_t flashrom_read(struct firmware_image *image, const char *region);
+int flashrom_read_image(struct firmware_image *image, const char *region,
+ int verbosity);
/**
* Write using flashrom from a buffer.
*
- * @param programmer The name of the programmer to use. There are
- * named constants FLASHROM_PROGRAMMER_INTERNAL_AP
- * and FLASHROM_PROGRAMMER_INTERNAL_EC available
- * for the AP and EC respectively, or a custom
- * programmer string can be provided.
- * @param region The name of the fmap region to write, or NULL to
- * write the entire flash chip.
- * @param data The buffer to write.
- * @param size The size of the buffer to write.
+ * @param image The parameter that contains the programmer, buffer and
+ * size to use in the write operation.
+ * @param regions A list of the names of the fmap regions to write, or
+ * NULL to write the entire flash chip. The list must be
+ * ended with a NULL pointer.
*
* @return VB2_SUCCESS on success, or a relevant error.
*/
-vb2_error_t flashrom_write(const char *programmer, const char *region,
- uint8_t *data, uint32_t size);
+vb2_error_t flashrom_write(struct firmware_image *image, const char *region);
+int flashrom_write_image(const struct firmware_image *image,
+ const char * const regions[],
+ const struct firmware_image *diff_image,
+ int do_verify, int verbosity);
diff --git a/host/lib/include/gsc_ro.h b/host/lib/include/gsc_ro.h
new file mode 100644
index 0000000..00a4011
--- /dev/null
+++ b/host/lib/include/gsc_ro.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright 2021 The Chromium OS Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ */
+
+#ifndef __VBOOT_REFERENCE_HOST_LIB_INCLUDE_GSC_RO_H
+#define __VBOOT_REFERENCE_HOST_LIB_INCLUDE_GSC_RO_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "2sha.h"
+
+struct gscvd_ro_range {
+ uint32_t offset;
+ uint32_t size; /* Use uint32_t as opposed to size_to be portable. */
+};
+
+#define GSC_VD_MAGIC 0x65666135 /* Little endian '5 a f e' */
+#define GSC_VD_ROLLBACK_COUNTER 1
+
+struct gsc_verification_data {
+ uint32_t gv_magic;
+ /*
+ * Size of this structure in bytes, including the ranges array,
+ * signature and root key bodies.
+ */
+ uint16_t size;
+ uint16_t major_version; /* Version of this struct layout. Starts at 0 */
+ uint16_t minor_version;
+ /*
+ * GSC will cache the counter value and will not accept verification
+ * data blobs with a lower value.
+ */
+ uint16_t rollback_counter;
+ uint32_t gsc_board_id; /* Locks blob to certain platform. */
+ uint32_t gsc_flags; /* A field for future enhancements. */
+ /*
+ * The location of fmap that points to this blob. This location must
+ * also be in one of the verified sections, expressed as offset in
+ * flash
+ */
+ uint32_t fmap_location;
+ uint32_t hash_alg; /* one of enum vb2_hash_algorithm alg. */
+ struct vb2_signature sig_header;
+ struct vb2_packed_key root_key_header;
+ /*
+ * SHAxxx(ranges[0].offset..ranges[0].size || ... ||
+ * ranges[n].offset..ranges[n].size)
+ *
+ * Let the digest space allow to accommodate the largest possible one.
+ */
+ uint8_t ranges_digest[VB2_SHA512_DIGEST_SIZE];
+ uint32_t range_count; /* Number of gscvd_ro_range entries. */
+ struct gscvd_ro_range ranges[0];
+};
+
+#endif /* ! __VBOOT_REFERENCE_HOST_LIB_INCLUDE_GSC_RO_H */
diff --git a/rust/OWNERS b/rust/OWNERS
new file mode 100644
index 0000000..fe3921f
--- /dev/null
+++ b/rust/OWNERS
@@ -0,0 +1 @@
+allenwebb@chromium.org
diff --git a/rust/README.md b/rust/README.md
new file mode 100644
index 0000000..3a899ce
--- /dev/null
+++ b/rust/README.md
@@ -0,0 +1,18 @@
+# Rust bindings for vboot_reference
+
+This path contains the vboot_reference-sys crate which uses bindgen to generate
+Rust bindings for the vboot_reference C library.
+
+Each header is included as its own submodule. To use these bindings:
+ * Add `vboot_reference-sys` to your `Cargo.toml` for example:
+```toml
+[dependencies]
+vboot_reference-sys = { path = "../../vboot_reference/rust/vboot_reference-sys" }
+```
+ * Include the symbols you need for example:
+```rust
+use vboot_reference_sys::crossystem::*;
+```
+
+The `build.rs` in `vboot_reference-sys` takes care of adding the necessary
+includes and linker flags for `vboot_host` through the `pkg-config` crate.
diff --git a/rust/vboot_reference-sys/Cargo.toml b/rust/vboot_reference-sys/Cargo.toml
new file mode 100644
index 0000000..59769ee
--- /dev/null
+++ b/rust/vboot_reference-sys/Cargo.toml
@@ -0,0 +1,17 @@
+[package]
+name = "vboot_reference-sys"
+version = "1.0.0"
+description = "Provides raw (unsafe) bindings to the vboot_reference C library."
+authors = ["The Chromium OS Authors"]
+edition = "2018"
+build = "build.rs"
+
+[lib]
+path = "lib.rs"
+
+[dependencies]
+libc = "0.2.44"
+
+[build-dependencies]
+pkg-config = "0.3"
+which = "4.0.0"
diff --git a/rust/vboot_reference-sys/build.rs b/rust/vboot_reference-sys/build.rs
new file mode 100644
index 0000000..523602f
--- /dev/null
+++ b/rust/vboot_reference-sys/build.rs
@@ -0,0 +1,54 @@
+// Copyright 2019 The Chromium OS Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/// Minijail's build script invoked by cargo.
+///
+/// This script prefers linking against a pkg-config provided libminijail, but will fall back to
+/// building libminijail statically.
+use std::env;
+use std::fs::remove_file;
+use std::io;
+use std::path::Path;
+use std::process::Command;
+
+fn bindings_generation() -> io::Result<()> {
+ let bindgen = which::which("bindgen").unwrap();
+
+ let out_dir = env::var("OUT_DIR").unwrap();
+ let gen_file = Path::new(&out_dir).join("./crossystem.rs");
+ if gen_file.exists() {
+ remove_file(&gen_file).expect("Failed to remove generated file.");
+ }
+ let header_dir = Path::new(".");
+ let header_path = header_dir.join("crossystem.h");
+ println!("cargo:rerun-if-changed={}", header_path.display());
+ let status = Command::new(&bindgen)
+ .args(&["--default-enum-style", "rust"])
+ .args(&["--blacklist-type", "__rlim64_t"])
+ .args(&["--raw-line", "pub type __rlim64_t = u64;"])
+ .args(&["--blacklist-type", "__u\\d{1,2}"])
+ .args(&["--raw-line", "pub type __u8 = u8;"])
+ .args(&["--raw-line", "pub type __u16 = u16;"])
+ .args(&["--raw-line", "pub type __u32 = u32;"])
+ .args(&["--blacklist-type", "__uint64_t"])
+ .arg("--no-layout-tests")
+ .arg("--disable-header-comment")
+ .args(&["--output", gen_file.to_str().unwrap()])
+ .arg(header_path.to_str().unwrap())
+ .args(&[
+ "--",
+ "-DUSE_BINDGEN",
+ "-D_FILE_OFFSET_BITS=64",
+ "-D_LARGEFILE_SOURCE",
+ "-D_LARGEFILE64_SOURCE",
+ ])
+ .status()?;
+ assert!(status.success());
+ Ok(())
+}
+
+fn main() -> io::Result<()> {
+ pkg_config::Config::new().probe("vboot_host").unwrap();
+ bindings_generation()
+}
diff --git a/rust/vboot_reference-sys/crossystem.h b/rust/vboot_reference-sys/crossystem.h
new file mode 120000
index 0000000..9672639
--- /dev/null
+++ b/rust/vboot_reference-sys/crossystem.h
@@ -0,0 +1 @@
+../../host/include/crossystem.h
\ No newline at end of file
diff --git a/rust/vboot_reference-sys/lib.rs b/rust/vboot_reference-sys/lib.rs
new file mode 100644
index 0000000..85b6f2a
--- /dev/null
+++ b/rust/vboot_reference-sys/lib.rs
@@ -0,0 +1,15 @@
+// Copyright 2022 The Chromium OS Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/// vboot_reference bindings for Rust.
+
+#[allow(
+ clippy::all,
+ non_camel_case_types,
+ non_snake_case,
+ non_upper_case_globals
+)]
+pub mod crossystem {
+ include!(concat!(env!("OUT_DIR"), "/crossystem.rs"));
+}
diff --git a/scripts/image_signing/gbb_flags_common.sh b/scripts/image_signing/gbb_flags_common.sh
index 63c3f12..ed51f15 100755
--- a/scripts/image_signing/gbb_flags_common.sh
+++ b/scripts/image_signing/gbb_flags_common.sh
@@ -51,9 +51,50 @@
${GBBFLAGS_DESCRIPTION}"
flashrom_read() {
- flashrom -p host -i GBB -r "$@"
+ local file="$1"
+ local programmer="$2"
+ flashrom -p "${programmer}" -i GBB -i FMAP -r "${file}"
}
flashrom_write() {
- flashrom -p host -i GBB --noverify-all -w "$@"
+ local file="$1"
+ local programmer="$2"
+ flashrom -p "${programmer}" -i GBB --noverify-all -w "${file}"
+}
+
+get_programmer_for_servo() {
+ local servo_type
+ local serial
+ local programmer
+ servo_type=$(dut-control -o servo_type 2>/dev/null) || \
+ die "Failed to get servo information. Is servod running?"
+ case "${servo_type}" in
+ *with_servo_micro*)
+ serial=$(dut-control -o servo_micro_serialname 2>/dev/null)
+ ;;
+ *with_c2d2*)
+ serial=$(dut-control -o c2d2_serialname 2>/dev/null)
+ ;;
+ *with_ccd*)
+ serial=$(dut-control -o ccd_serialname 2>/dev/null)
+ ;;
+ *)
+ serial=$(dut-control -o serialname 2>/dev/null)
+ ;;
+ esac
+ case "${servo_type}" in
+ *servo_micro*|*c2d2*)
+ # TODO(sammc): Support servo micro, servo v2 and C2D2. This requires
+ # toggling cpu_fw_spi via dut-control before and after running flashrom.
+ # C2D2 additionally requires a working cpu_fw_spi implementation.
+ die "Unsupported servo type ${servo_type}"
+ ;;
+ *ccd_cr50*|*ccd_gsc*)
+ programmer="raiden_debug_spi:target=AP,serial=${serial}"
+ ;;
+ *)
+ die "Unsupported servo type ${servo_type}"
+ ;;
+ esac
+ echo "${programmer}"
}
diff --git a/scripts/image_signing/get_gbb_flags.sh b/scripts/image_signing/get_gbb_flags.sh
index 2b78af6..1191e9f 100755
--- a/scripts/image_signing/get_gbb_flags.sh
+++ b/scripts/image_signing/get_gbb_flags.sh
@@ -13,6 +13,8 @@
# DEFINE_string name default_value description flag
DEFINE_string file "" "Path to firmware image. Default to system firmware." "f"
DEFINE_boolean explicit ${FLAGS_FALSE} "Print list of what flags are set." "e"
+DEFINE_string programmer "host" "Programmer to use when setting GBB flags" "p"
+DEFINE_boolean servo "${FLAGS_FALSE}" "Determine programmer using servo" ""
set -e
@@ -23,10 +25,14 @@
fi
local image_file="${FLAGS_file}"
+ local programmer="${FLAGS_programmer}"
if [ -z "${FLAGS_file}" ]; then
image_file="$(make_temp_file)"
- flashrom_read "${image_file}"
+ if [ "${FLAGS_servo}" = "${FLAGS_TRUE}" ]; then
+ programmer=$(get_programmer_for_servo)
+ fi
+ flashrom_read "${image_file}" "${programmer}"
fi
# Process file.
diff --git a/scripts/image_signing/make_dev_ssd.sh b/scripts/image_signing/make_dev_ssd.sh
index ed102a6..d9df52a 100755
--- a/scripts/image_signing/make_dev_ssd.sh
+++ b/scripts/image_signing/make_dev_ssd.sh
@@ -35,7 +35,15 @@
DEFINE_string image "$ROOTDEV_DISK" "Path to device or image file" "i"
DEFINE_string keys "$DEFAULT_KEYS_FOLDER" "Path to folder of dev keys" "k"
DEFINE_boolean remove_rootfs_verification \
- $FLAGS_FALSE "Modify kernel boot config to disable rootfs verification" ""
+ "${FLAGS_FALSE}" "Modify kernel boot config to disable rootfs verification" ""
+DEFINE_boolean enable_earlycon "${FLAGS_FALSE}" \
+ "Enable earlycon from stdout-path (ARM/ARM64) or SPCR (x86)." ""
+DEFINE_boolean disable_earlycon "${FLAGS_FALSE}" \
+ "Disable earlycon." ""
+DEFINE_boolean enable_console "${FLAGS_FALSE}" \
+ "Enable serial console." ""
+DEFINE_boolean disable_console "${FLAGS_FALSE}" \
+ "Disable serial console." ""
DEFINE_string backup_dir \
"$DEFAULT_BACKUP_FOLDER" "Path of directory to store kernel backups" ""
DEFINE_string save_config "" \
@@ -98,14 +106,37 @@
debug_msg "Removing rootfs verification for legacy boot configuration."
mount_image_partition "$image" 12 "$mount_point" || return $FLAGS_FALSE
config_file="$mount_point/efi/boot/grub.cfg"
- [ ! -f "$config_file" ] ||
- sudo sed -i 's/^ *set default=2 *$/set default=0/g' "$config_file"
+ [ ! -f "${config_file}" ] ||
+ sudo sed -i -e 's/^ *defaultA=2 *$/defaultA=0/g' \
+ -e 's/^ *defaultB=3 *$/defaultB=1/g' "${config_file}"
config_file="$mount_point/syslinux/default.cfg"
[ ! -f "$config_file" ] ||
sudo sed -i 's/-vusb/-usb/g; s/-vhd/-hd/g' "$config_file"
sudo umount "$mount_point"
}
+# Enable/Disable earlycon or serial console
+insert_parameter() {
+ local cmdline="$1"
+ local param="$2"
+
+ if [ -n "${cmdline##*${param}*}" ]; then
+ cmdline="${param} ${cmdline}"
+ fi
+
+ echo "${cmdline}"
+}
+
+remove_parameter() {
+ local cmdline="$1"
+ local param="$2"
+
+ cmdline=$(echo "${cmdline}" | sed '
+ s/'"${param} "'//g')
+
+ echo "${cmdline}"
+}
+
# Wrapped version of dd
mydd() {
# oflag=sync is safer, but since we need bs=512, syncing every block would be
@@ -244,6 +275,26 @@
remove_legacy_boot_rootfs_verification "$ssd_device"
fi
+ if [ "${FLAGS_enable_earlycon}" = "${FLAGS_TRUE}" ]; then
+ debug_msg "Enabling earlycon"
+ kernel_config="$(insert_parameter "${kernel_config}" "earlycon")"
+ debug_msg "New kernel config: ${kernel_config}"
+ elif [ "${FLAGS_disable_earlycon}" = "${FLAGS_TRUE}" ]; then
+ debug_msg "Disabling earlycon"
+ kernel_config="$(remove_parameter "${kernel_config}" "earlycon")"
+ debug_msg "New kernel config: ${kernel_config}"
+ fi
+
+ if [ "${FLAGS_enable_console}" = "${FLAGS_TRUE}" ]; then
+ debug_msg "Enabling serial console"
+ kernel_config="$(remove_parameter "${kernel_config}" "console=")"
+ debug_msg "New kernel config: ${kernel_config}"
+ elif [ "${FLAGS_disable_console}" = "${FLAGS_TRUE}" ]; then
+ debug_msg "Disabling serial console"
+ kernel_config="$(insert_parameter "${kernel_config}" "console=")"
+ debug_msg "New kernel config: ${kernel_config}"
+ fi
+
local new_kernel_config_file="$(make_temp_file)"
echo -n "$kernel_config" >"$new_kernel_config_file"
diff --git a/scripts/image_signing/set_gbb_flags.sh b/scripts/image_signing/set_gbb_flags.sh
index 7a22b85..3057da5 100755
--- a/scripts/image_signing/set_gbb_flags.sh
+++ b/scripts/image_signing/set_gbb_flags.sh
@@ -13,6 +13,8 @@
# DEFINE_string name default_value description flag
DEFINE_string file "" "Path to firmware image. Default to system firmware." "f"
DEFINE_boolean check_wp ${FLAGS_TRUE} "Check write protection states first." ""
+DEFINE_string programmer "host" "Programmer to use when setting GBB flags" "p"
+DEFINE_boolean servo "${FLAGS_FALSE}" "Determine programmer using servo" ""
set -e
@@ -20,12 +22,13 @@
# ----------------------------------------------------------------------------
check_write_protection() {
local hw_wp="" sw_wp=""
- if ! crossystem "wpsw_cur?0"; then
+ local programmer="$1"
+ if [ "${programmer}" = "host" ] && ! crossystem "wpsw_cur?0"; then
hw_wp="on"
fi
# Keep 'local' declaration split from assignment so return code is checked.
local wp_states
- wp_states="$(flashrom -p host --wp-status 2>/dev/null | grep WP)"
+ wp_states="$(flashrom -p "${programmer}" --wp-status 2>/dev/null | grep WP)"
local wp_disabled="$(echo "${wp_states}" | grep "WP:.*is disabled.")"
local wp_zero_len="$(echo "${wp_states}" | grep "WP:.*, len=0x00000000")"
if [ -z "${wp_disabled}" -a -z "${wp_zero_len}" ]; then
@@ -47,10 +50,15 @@
local value="$(($1))"
local image_file="${FLAGS_file}"
+ local programmer="${FLAGS_programmer}"
if [ -z "${FLAGS_file}" ]; then
image_file="$(make_temp_file)"
- flashrom_read "${image_file}"
+ if [ "${FLAGS_servo}" = "${FLAGS_TRUE}" ]; then
+ programmer=$(get_programmer_for_servo)
+ fi
+
+ flashrom_read "${image_file}" "${programmer}"
fi
# Process file
@@ -62,14 +70,14 @@
if [ -z "${FLAGS_file}" ]; then
if [ "${FLAGS_check_wp}" = "${FLAGS_TRUE}" ]; then
- if ! check_write_protection; then
+ if ! check_write_protection "${programmer}"; then
echo ""
echo "WARNING: System GBB Flags are NOT changed!!!"
echo "ERROR: You must disable write protection before setting flags."
exit 1
fi
fi
- flashrom_write "$image_file"
+ flashrom_write "${image_file}" "${programmer}"
fi
}
diff --git a/scripts/image_signing/sign_android_image.sh b/scripts/image_signing/sign_android_image.sh
index a7d0fc6..5af1aa6 100755
--- a/scripts/image_signing/sign_android_image.sh
+++ b/scripts/image_signing/sign_android_image.sh
@@ -315,7 +315,7 @@
elif [[ "${compression}" == "Compression lz4" ]]; then
compression_flags="-comp lz4 -Xhc -b 256K"
elif [[ "${compression}" == "Compression zstd" ]]; then
- compression_flags="-comp zstd"
+ compression_flags="-comp zstd -b 256K"
else
die "Unexpected compression type: ${compression}"
fi
diff --git a/scripts/image_signing/sign_official_build.sh b/scripts/image_signing/sign_official_build.sh
index 53a9264..98c8610 100755
--- a/scripts/image_signing/sign_official_build.sh
+++ b/scripts/image_signing/sign_official_build.sh
@@ -110,28 +110,30 @@
get_hash_from_config() {
local kernel_config=$1
local dm_config=$(get_dmparams_from_config "${kernel_config}")
- local vroot_dev=$(get_dm_slave "${dm_config}" vroot)
+ local vroot_dev=$(get_dm_device "${dm_config}" vroot)
echo $(get_verity_arg "${vroot_dev}" root_hexdigest)
}
-# Get the slave device and its args
-# get_dm_ags $dm_config [vboot|vroot]
-# Assumes we have only one slave device per device
-get_dm_slave() {
+# Get the mapped device and its args.
+# Usage:
+# get_dm_device $dm_config [vboot|vroot]
+# Assumes we have only one mapped device per device.
+get_dm_device() {
local dm=$1
local device=$2
echo $(echo "${dm}" | sed -nre "s/.*${device}[^,]*,([^,]*).*/\1/p")
}
-# Set the slave device and its args for a device
-# get_dm_ags $dm_config [vboot|vroot] args
-# Assumes we have only one slave device per device
-set_dm_slave() {
+# Set the mapped device and its args for a device.
+# Usage:
+# set_dm_device $dm_config [vboot|vroot] args
+# Assumes we have only one mapped device per device.
+set_dm_device() {
local dm=$1
local device=$2
- local slave=$3
+ local args=$3
echo $(echo "${dm}" |
- sed -nre "s#(.*${device}[^,]*,)([^,]*)(.*)#\1${slave}\3#p")
+ sed -nre "s#(.*${device}[^,]*,)([^,]*)(.*)#\1${args}\3#p")
}
CALCULATED_KERNEL_CONFIG=
@@ -154,7 +156,7 @@
warn "Couldn't grab dm_config. Aborting rootfs hash calculation."
return 1
fi
- local vroot_dev=$(get_dm_slave "${dm_config}" vroot)
+ local vroot_dev=$(get_dm_device "${dm_config}" vroot)
# Extract the key-value parameters from the kernel command line.
local rootfs_sectors=$(get_verity_arg "${vroot_dev}" hashstart)
@@ -169,15 +171,15 @@
fi
# Run the verity tool on the rootfs partition.
- local slave=$(sudo verity mode=create \
+ local table=$(sudo verity mode=create \
alg=${verity_algorithm} \
payload="${rootfs_image}" \
payload_blocks=$((rootfs_sectors / 8)) \
hashtree="${hash_image}" ${salt_arg})
# Reconstruct new kernel config command line and replace placeholders.
- slave="$(echo "${slave}" |
+ table="$(echo "${table}" |
sed -s "s|ROOT_DEV|${root_dev}|g;s|HASH_DEV|${hash_dev}|")"
- CALCULATED_DM_ARGS="$(set_dm_slave "${dm_config}" vroot "${slave}")"
+ CALCULATED_DM_ARGS="$(set_dm_device "${dm_config}" vroot "${table}")"
CALCULATED_KERNEL_CONFIG="$(echo "${kernel_config}" |
sed -e 's#\(.*dm="\)\([^"]*\)\(".*\)'"#\1${CALCULATED_DM_ARGS}\3#g")"
}
@@ -709,6 +711,7 @@
# Args: LOOPDEV
sign_uefi_binaries() {
local loopdev="$1"
+ local efi_glob="*.efi"
if [[ ! -d "${KEY_DIR}/uefi" ]]; then
return 0
@@ -725,13 +728,18 @@
# in the signing repo. This is a temporary fix to unblock reven-release.
if [[ "${KEY_DIR}" != *"Reven"* ]]; then
"${SCRIPT_DIR}/install_gsetup_certs.sh" "${esp_dir}" "${KEY_DIR}/uefi"
+ else
+ # b/205145491: the reven board's boot*.efi files are already signed,
+ # change the glob so that they don't get resigned.
+ efi_glob="grub*.efi"
fi
- "${SCRIPT_DIR}/sign_uefi.sh" "${esp_dir}" "${KEY_DIR}/uefi"
+ "${SCRIPT_DIR}/sign_uefi.sh" "${esp_dir}" "${KEY_DIR}/uefi" "${efi_glob}"
sudo umount "${esp_dir}"
local rootfs_dir="$(make_temp_dir)"
mount_loop_image_partition "${loopdev}" 3 "${rootfs_dir}"
- "${SCRIPT_DIR}/sign_uefi.sh" "${rootfs_dir}/boot" "${KEY_DIR}/uefi"
+ "${SCRIPT_DIR}/sign_uefi.sh" "${rootfs_dir}/boot" "${KEY_DIR}/uefi" \
+ "${efi_glob}"
sudo umount "${rootfs_dir}"
info "Signed UEFI binaries"
@@ -1145,6 +1153,9 @@
--version "${FIRMWARE_VERSION}" "${OUTPUT_IMAGE}"
elif [[ "${TYPE}" == "gsc_firmware" ]]; then
sign_gsc_firmware "${INPUT_IMAGE}" "${KEY_DIR}" "${OUTPUT_IMAGE}"
+elif [[ "${TYPE}" == "hps_firmware" ]]; then
+ hps-sign-rom --input "${INPUT_IMAGE}" --output "${OUTPUT_IMAGE}" \
+ --private-key "${KEY_DIR}/key_hps.priv.pem"
else
die "Invalid type ${TYPE}"
fi
diff --git a/scripts/image_signing/sign_uefi.sh b/scripts/image_signing/sign_uefi.sh
index 14c328e..d0f9e51 100755
--- a/scripts/image_signing/sign_uefi.sh
+++ b/scripts/image_signing/sign_uefi.sh
@@ -130,7 +130,8 @@
local working_dir="$(make_temp_dir)"
local efi_file
- for efi_file in "${bootloader_dir}"/*.efi; do
+ # Leave ${efi_glob} unquoted so that globbing occurs.
+ for efi_file in "${bootloader_dir}"/${efi_glob}; do
if [[ ! -f "${efi_file}" ]]; then
continue
fi
diff --git a/scripts/keygeneration/accessory/common_leverage_hammer.sh b/scripts/keygeneration/accessory/common_leverage_hammer.sh
index 1e0f712..7c51af1 100644
--- a/scripts/keygeneration/accessory/common_leverage_hammer.sh
+++ b/scripts/keygeneration/accessory/common_leverage_hammer.sh
@@ -7,13 +7,27 @@
# Load common constants and functions.
. "$(dirname "$0")/../common.sh"
+: "${HAS_ARG_KEYNAME:=}"
+
usage() {
- cat <<EOF
+ if [[ -n "${HAS_ARG_KEYNAME}" ]]; then
+ cat <<EOF
+Usage: ${PROG} <keyname> [options]
+
+Arguments:
+ keyname: Name of the hammer device (e.g. Staff, Wand).
+
+Options:
+ -o, --output_dir <dir>: Where to write the keys (default is cwd)
+EOF
+ else
+ cat <<EOF
Usage: ${PROG} [options]
Options:
-o, --output_dir <dir>: Where to write the keys (default is cwd)
EOF
+ fi
if [[ $# -ne 0 ]]; then
die "$*"
@@ -40,8 +54,7 @@
# to specific accessory's name.
leverage_hammer_to_create_key() {
local output_dir="${PWD}"
- local key_name="$1"
- shift
+ local key_name=""
while [[ $# -gt 0 ]]; do
case "$1" in
@@ -51,19 +64,26 @@
-o|--output_dir)
output_dir="$2"
if [[ ! -d "${output_dir}" ]]; then
- die "output dir ("${output_dir}") doesn't exist."
+ die "output dir (\"${output_dir}\") doesn't exist."
fi
shift
;;
-*)
- usage "Unknown option: "$1""
+ usage "Unknown option: \"$1\""
;;
*)
- usage "Unknown argument "$1""
+ if [[ -n "${key_name}" ]]; then
+ usage "Unknown argument \"$1\""
+ fi
+ key_name="$1"
;;
esac
shift
done
+ if [[ -z "${key_name}" ]]; then
+ usage "Missing key name"
+ fi
+
generate_rsa3072_exp3_key "${output_dir}" "${key_name}"
}
diff --git a/scripts/keygeneration/accessory/create_new_hammer_like_keys.sh b/scripts/keygeneration/accessory/create_new_hammer_like_keys.sh
index 3d5c96e..96d2da0 100755
--- a/scripts/keygeneration/accessory/create_new_hammer_like_keys.sh
+++ b/scripts/keygeneration/accessory/create_new_hammer_like_keys.sh
@@ -5,12 +5,13 @@
# found in the LICENSE file.
# Load common constants and functions.
+export HAS_ARG_KEYNAME=1
. "$(dirname "$0")/common_leverage_hammer.sh"
main() {
set -e
- leverage_hammer_to_create_key "hammerlike" "$@"
+ leverage_hammer_to_create_key "$@"
}
main "$@"
diff --git a/scripts/keygeneration/accessory/create_new_hps_key.sh b/scripts/keygeneration/accessory/create_new_hps_key.sh
new file mode 100755
index 0000000..6d175c8
--- /dev/null
+++ b/scripts/keygeneration/accessory/create_new_hps_key.sh
@@ -0,0 +1,64 @@
+#!/bin/bash
+
+# Copyright 2022 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Load common constants and functions.
+. "$(dirname "$0")/../common.sh"
+
+usage() {
+ cat <<EOF
+Usage: ${PROG} [options]
+
+Options:
+ -o, --output_dir <dir>: Where to write the keys (default is cwd)
+EOF
+
+ if [[ $# -ne 0 ]]; then
+ die "$*"
+ else
+ exit 0
+ fi
+}
+
+generate_ed25519_key() {
+ local output_dir="$1"
+
+ # Generate ed25519 private and public key.
+ openssl genpkey -algorithm Ed25519 -out "${output_dir}/key_hps.priv.pem"
+ openssl pkey -in "${output_dir}/key_hps.priv.pem" -pubout -text_pub \
+ -out "${output_dir}/key_hps.pub.pem"
+}
+
+main() {
+ set -euo pipefail
+
+ local output_dir="${PWD}"
+
+ while [[ $# -gt 0 ]]; do
+ case "$1" in
+ -h|--help)
+ usage
+ ;;
+ -o|--output_dir)
+ output_dir="$2"
+ if [[ ! -d "${output_dir}" ]]; then
+ die "output dir (${output_dir}) doesn't exist."
+ fi
+ shift
+ ;;
+ -*)
+ usage "Unknown option: $1"
+ ;;
+ *)
+ usage "Unknown argument $1"
+ ;;
+ esac
+ shift
+ done
+
+ generate_ed25519_key "${output_dir}"
+}
+
+main "$@"
diff --git a/scripts/keygeneration/common.sh b/scripts/keygeneration/common.sh
index da06f3c..af6cd71 100644
--- a/scripts/keygeneration/common.sh
+++ b/scripts/keygeneration/common.sh
@@ -63,6 +63,10 @@
KERNEL_SUBKEY_ALGOID=${RSA4096_SHA256_ALGOID}
KERNEL_DATAKEY_ALGOID=${RSA2048_SHA256_ALGOID}
+# AP RO Verification.
+ARV_ROOT_ALGOID=${RSA4096_SHA256_ALGOID}
+ARV_PLATFORM_ALGOID=${RSA4096_SHA256_ALGOID}
+
# Keyblock modes determine which boot modes a signing key is valid for use
# in verification.
# !DEV 0x1 DEV 0x2
diff --git a/scripts/keygeneration/create_new_keys.sh b/scripts/keygeneration/create_new_keys.sh
index 11aedc1..2e1fd22 100755
--- a/scripts/keygeneration/create_new_keys.sh
+++ b/scripts/keygeneration/create_new_keys.sh
@@ -169,6 +169,8 @@
make_pair recovery_kernel_data_key ${recovery_kernel_algoid}
make_pair minios_kernel_data_key ${minios_kernel_algoid}
make_pair installer_kernel_data_key ${installer_kernel_algoid}
+ make_pair arv_root ${ARV_ROOT_ALGOID}
+ make_pair arv_platform ${ARV_PLATFORM_ALGOID}
# Create the firmware keyblock for use only in Normal mode. This is redundant,
# since it's never even checked during Recovery mode.
diff --git a/tests/devkeys/arv_platform.vbprivk b/tests/devkeys/arv_platform.vbprivk
new file mode 100644
index 0000000..e0bc670
--- /dev/null
+++ b/tests/devkeys/arv_platform.vbprivk
Binary files differ
diff --git a/tests/devkeys/arv_platform.vbpubk b/tests/devkeys/arv_platform.vbpubk
new file mode 100644
index 0000000..2ac3bde
--- /dev/null
+++ b/tests/devkeys/arv_platform.vbpubk
Binary files differ
diff --git a/tests/devkeys/arv_root.vbprivk b/tests/devkeys/arv_root.vbprivk
new file mode 100644
index 0000000..7747717
--- /dev/null
+++ b/tests/devkeys/arv_root.vbprivk
Binary files differ
diff --git a/tests/devkeys/arv_root.vbpubk b/tests/devkeys/arv_root.vbpubk
new file mode 100644
index 0000000..aebe2a4
--- /dev/null
+++ b/tests/devkeys/arv_root.vbpubk
Binary files differ
diff --git a/tests/futility/test_update.sh b/tests/futility/test_update.sh
index 31f3ecb..25c5543 100755
--- a/tests/futility/test_update.sh
+++ b/tests/futility/test_update.sh
@@ -141,6 +141,9 @@
cp -f "${TMP}.expected.full" "${TMP}.expected.me_unlocked"
patch_file "${TMP}.expected.me_unlocked" SI_DESC 128 \
"\x00\xff\xff\xff\x00\xff\xff\xff\x00\xff\xff\xff"
+cp -f "${TMP}.expected.full" "${TMP}.expected.me_preserved"
+"${FUTILITY}" load_fmap "${TMP}.expected.me_preserved" \
+ "SI_ME:${TMP}.from/SI_ME"
# A special set of images that only RO_VPD is preserved (RW_VPD is wiped) using
# FMAP_AREA_PRESERVE (\010=0x08).
@@ -357,6 +360,17 @@
--quirks no_check_platform \
-i "${TO_IMAGE}" --wp=0 --sys_props 0,0x10001,1
+test_update "Full update (--quirks preserve_me with non-host programmer)" \
+ "${FROM_IMAGE}" "${TMP}.expected.full" \
+ --quirks preserve_me \
+ -i "${TO_IMAGE}" --wp=0 --sys_props 0,0x10001,1 \
+ -p raiden_debug_spi:target=AP
+
+test_update "Full update (--quirks preserve_me)" \
+ "${FROM_IMAGE}" "${TMP}.expected.me_preserved" \
+ --quirks preserve_me \
+ -i "${TO_IMAGE}" --wp=0 --sys_props 0,0x10001,1
+
# Test archive and manifest.
A="${TMP}.archive"
mkdir -p "${A}/bin"
@@ -471,8 +485,8 @@
if type flashrom >/dev/null 2>&1; then
echo "TEST: Full update (dummy programmer)"
cp -f "${FROM_IMAGE}" "${TMP}.emu"
- sudo "${FUTILITY}" update --programmer \
- dummy:emulate=VARIABLE_SIZE,image=${TMP}.emu,size=8388608 \
+ "${FUTILITY}" update --programmer \
+ dummy:emulate=VARIABLE_SIZE,image="${TMP}".emu,size=8388608 \
-i "${TO_IMAGE}" --wp=0 --sys_props 0,0x10001,1,3 >&2
cmp "${TMP}.emu" "${TMP}.expected.full"
fi
diff --git a/tests/vb20_api_kernel_tests.c b/tests/vb20_api_kernel_tests.c
index 893cd4e..b835251 100644
--- a/tests/vb20_api_kernel_tests.c
+++ b/tests/vb20_api_kernel_tests.c
@@ -59,6 +59,7 @@
"vb2api_init failed");
sd = vb2_get_sd(ctx);
+ sd->status |= VB2_SD_STATUS_RECOVERY_DECIDED;
vb2_nv_init(ctx);
vb2api_secdata_kernel_create(ctx);
diff --git a/tests/vb2_api_tests.c b/tests/vb2_api_tests.c
index beab239..15c9bd1 100644
--- a/tests/vb2_api_tests.c
+++ b/tests/vb2_api_tests.c
@@ -374,6 +374,8 @@
0, " secdata firmware initialized");
TEST_NEQ(sd->status & VB2_SD_STATUS_SECDATA_KERNEL_INIT,
0, " secdata kernel initialized");
+ TEST_NEQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, " recovery decided");
reset_common_data(FOR_MISC);
retval_vb2_fw_init_gbb = VB2_ERROR_GBB_MAGIC;
@@ -383,6 +385,8 @@
" recovery reason");
TEST_NEQ(ctx->flags & VB2_CONTEXT_RECOVERY_MODE, 0, " recovery flag");
TEST_NEQ(ctx->flags & VB2_CONTEXT_CLEAR_RAM, 0, " clear ram flag");
+ TEST_NEQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, " recovery decided");
/* Dev switch error proceeds to a recovery boot */
reset_common_data(FOR_MISC);
@@ -398,6 +402,8 @@
0, " display init context flag");
TEST_NEQ(sd->flags & VB2_SD_FLAG_DISPLAY_AVAILABLE,
0, " display available SD flag");
+ TEST_NEQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, " recovery decided");
reset_common_data(FOR_MISC);
ctx->secdata_firmware[0] ^= 0x42;
@@ -407,6 +413,8 @@
" recovery reason");
TEST_NEQ(ctx->flags & VB2_CONTEXT_RECOVERY_MODE, 0, " recovery flag");
TEST_NEQ(ctx->flags & VB2_CONTEXT_CLEAR_RAM, 0, " clear ram flag");
+ TEST_NEQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, " recovery decided");
/* Bad secdata_kernel causes recovery mode */
reset_common_data(FOR_MISC);
@@ -417,6 +425,8 @@
" recovery reason");
TEST_NEQ(ctx->flags & VB2_CONTEXT_RECOVERY_MODE, 0, " recovery flag");
TEST_NEQ(ctx->flags & VB2_CONTEXT_CLEAR_RAM, 0, " clear ram flag");
+ TEST_NEQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, " recovery decided");
/* Test secdata_firmware-requested reboot */
reset_common_data(FOR_MISC);
@@ -428,6 +438,8 @@
1, " tpm reboot request");
TEST_EQ(vb2_nv_get(ctx, VB2_NV_RECOVERY_REQUEST),
0, " recovery request");
+ TEST_EQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, " recovery decided");
reset_common_data(FOR_MISC);
vb2_nv_set(ctx, VB2_NV_TPM_REQUESTED_REBOOT, 1);
@@ -438,6 +450,8 @@
0, " tpm reboot request");
TEST_EQ(vb2_nv_get(ctx, VB2_NV_RECOVERY_REQUEST),
0, " recovery request");
+ TEST_NEQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, " recovery decided");
reset_common_data(FOR_MISC);
ctx->flags |= VB2_CONTEXT_SECDATA_WANTS_REBOOT;
@@ -450,6 +464,8 @@
1, " tpm reboot request");
TEST_EQ(vb2_nv_get(ctx, VB2_NV_RECOVERY_REQUEST),
0, " recovery request");
+ TEST_EQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, " recovery decided");
reset_common_data(FOR_MISC);
ctx->flags |= VB2_CONTEXT_SECDATA_WANTS_REBOOT;
@@ -462,6 +478,8 @@
1, " tpm reboot request");
TEST_EQ(vb2_nv_get(ctx, VB2_NV_RECOVERY_REQUEST),
VB2_RECOVERY_RO_TPM_REBOOT, " recovery request");
+ TEST_NEQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, " recovery decided");
reset_common_data(FOR_MISC);
ctx->flags |= VB2_CONTEXT_SECDATA_WANTS_REBOOT;
@@ -474,6 +492,8 @@
1, " tpm reboot request");
TEST_EQ(vb2_nv_get(ctx, VB2_NV_RECOVERY_REQUEST),
VB2_RECOVERY_RO_UNSPECIFIED, " recovery request");
+ TEST_EQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, " recovery decided");
reset_common_data(FOR_MISC);
vb2_nv_set(ctx, VB2_NV_TPM_REQUESTED_REBOOT, 1);
@@ -486,6 +506,8 @@
0, " tpm reboot request");
TEST_EQ(vb2_nv_get(ctx, VB2_NV_RECOVERY_REQUEST),
VB2_RECOVERY_RO_UNSPECIFIED, " recovery request");
+ TEST_NEQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, " recovery decided");
reset_common_data(FOR_MISC);
ctx->flags |= VB2_CONTEXT_SECDATA_WANTS_REBOOT;
@@ -499,6 +521,8 @@
1, " tpm reboot request");
TEST_EQ(vb2_nv_get(ctx, VB2_NV_RECOVERY_REQUEST),
VB2_RECOVERY_RO_UNSPECIFIED, " recovery request");
+ TEST_NEQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, " recovery decided");
/* Cases for checking DISPLAY_INIT and DISPLAY_AVAILABLE. */
reset_common_data(FOR_MISC);
@@ -508,6 +532,8 @@
0, " display init context flag");
TEST_NEQ(sd->flags & VB2_SD_FLAG_DISPLAY_AVAILABLE,
0, " display available SD flag");
+ TEST_NEQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, " recovery decided");
reset_common_data(FOR_MISC);
vb2_nv_set(ctx, VB2_NV_DISPLAY_REQUEST, 1);
@@ -516,6 +542,8 @@
0, " display init context flag");
TEST_NEQ(sd->flags & VB2_SD_FLAG_DISPLAY_AVAILABLE,
0, " display available SD flag");
+ TEST_NEQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, " recovery decided");
reset_common_data(FOR_MISC);
force_dev_mode = 1;
@@ -524,6 +552,8 @@
0, " display init context flag");
TEST_NEQ(sd->flags & VB2_SD_FLAG_DISPLAY_AVAILABLE,
0, " display available SD flag");
+ TEST_NEQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, " recovery decided");
}
static void phase2_tests(void)
diff --git a/tests/vb2_auxfw_sync_tests.c b/tests/vb2_auxfw_sync_tests.c
index 3987d64..bcdd67a 100644
--- a/tests/vb2_auxfw_sync_tests.c
+++ b/tests/vb2_auxfw_sync_tests.c
@@ -65,14 +65,15 @@
{
*severity = auxfw_mock_severity;
auxfw_update_severity = auxfw_mock_severity;
- if (*severity == VB2_AUXFW_SLOW_UPDATE)
- if (!auxfw_mock_display_available)
- return VB2_REQUEST_REBOOT;
return VB2_SUCCESS;
}
vb2_error_t vb2ex_auxfw_update(void)
{
+ if (auxfw_update_severity == VB2_AUXFW_SLOW_UPDATE)
+ if (!auxfw_mock_display_available)
+ return VB2_REQUEST_REBOOT;
+
if (auxfw_update_severity != VB2_AUXFW_NO_DEVICE &&
auxfw_update_severity != VB2_AUXFW_NO_UPDATE)
auxfw_update_req = 1;
diff --git a/tests/vb2_ec_sync_tests.c b/tests/vb2_ec_sync_tests.c
index 16496e4..f4631b7 100644
--- a/tests/vb2_ec_sync_tests.c
+++ b/tests/vb2_ec_sync_tests.c
@@ -111,21 +111,6 @@
return &gbb;
}
-uint32_t VbExIsShutdownRequested(void)
-{
- if (shutdown_request_calls_left == 0)
- return 1;
- else if (shutdown_request_calls_left > 0)
- shutdown_request_calls_left--;
-
- return 0;
-}
-
-int vb2ex_ec_trusted(void)
-{
- return !ec_run_image;
-}
-
vb2_error_t vb2ex_ec_running_rw(int *in_rw)
{
*in_rw = ec_run_image;
diff --git a/tests/vb2_host_flashrom_tests.c b/tests/vb2_host_flashrom_tests.c
index 8552d0a..815657d 100644
--- a/tests/vb2_host_flashrom_tests.c
+++ b/tests/vb2_host_flashrom_tests.c
@@ -145,10 +145,11 @@
static void test_read_whole_chip(void)
{
- uint8_t *buf;
- uint32_t buf_sz;
+ struct firmware_image image = {
+ .programmer = "someprog",
+ };
- TEST_SUCC(flashrom_read("someprog", NULL, &buf, &buf_sz),
+ TEST_SUCC(flashrom_read(&image, NULL),
"Flashrom read succeeds");
TEST_STR_EQ(captured_programmer, "someprog",
"Using specified programmer");
@@ -158,19 +159,20 @@
TEST_STR_EQ(captured_op_filename, MOCK_TMPFILE_NAME,
"Reading to correct file");
TEST_PTR_EQ(captured_region_param, NULL, "Not operating on a region");
- TEST_EQ(buf_sz, strlen(MOCK_ROM_CONTENTS), "Contents correct size");
- TEST_SUCC(memcmp(buf, MOCK_ROM_CONTENTS, buf_sz),
+ TEST_EQ(image.size, strlen(MOCK_ROM_CONTENTS), "Contents correct size");
+ TEST_SUCC(memcmp(image.data, MOCK_ROM_CONTENTS, image.size),
"Buffer has correct contents");
- free(buf);
+ free(image.data);
}
static void test_read_region(void)
{
- uint8_t *buf;
- uint32_t buf_sz;
+ struct firmware_image image = {
+ .programmer = "someprog",
+ };
- TEST_SUCC(flashrom_read("someprog", "SOME_REGION", &buf, &buf_sz),
+ TEST_SUCC(flashrom_read(&image, "SOME_REGION"),
"Flashrom read succeeds");
TEST_STR_EQ(captured_programmer, "someprog",
"Using specified programmer");
@@ -181,20 +183,21 @@
"Not doing a read of the whole ROM");
TEST_STR_EQ(captured_region_param, "SOME_REGION:" MOCK_TMPFILE_NAME,
"Reading to correct file and from correct region");
- TEST_EQ(buf_sz, strlen(MOCK_ROM_CONTENTS), "Contents correct size");
- TEST_SUCC(memcmp(buf, MOCK_ROM_CONTENTS, buf_sz),
+ TEST_EQ(image.size, strlen(MOCK_ROM_CONTENTS), "Contents correct size");
+ TEST_SUCC(memcmp(image.data, MOCK_ROM_CONTENTS, image.size),
"Buffer has correct contents");
- free(buf);
+ free(image.data);
}
static void test_read_failure(void)
{
- uint8_t *buf;
- uint32_t buf_sz;
+ struct firmware_image image = {
+ .programmer = "someprog",
+ };
flashrom_mock_success = false;
- TEST_NEQ(flashrom_read("someprog", "SOME_REGION", &buf, &buf_sz),
+ TEST_NEQ(flashrom_read(&image, "SOME_REGION"),
VB2_SUCCESS, "Flashrom read fails");
flashrom_mock_success = true;
}
@@ -202,10 +205,15 @@
static void test_write_whole_chip(void)
{
uint8_t buf[sizeof(MOCK_ROM_CONTENTS) - 1];
+ struct firmware_image image = {
+ .programmer = "someprog",
+ .data = buf,
+ .size = sizeof(buf),
+ };
memcpy(buf, MOCK_ROM_CONTENTS, sizeof(buf));
- TEST_SUCC(flashrom_write("someprog", NULL, buf, sizeof(buf)),
+ TEST_SUCC(flashrom_write(&image, NULL),
"Flashrom write succeeds");
TEST_STR_EQ(captured_programmer, "someprog",
"Using specified programmer");
@@ -224,10 +232,15 @@
static void test_write_region(void)
{
uint8_t buf[sizeof(MOCK_ROM_CONTENTS) - 1];
+ struct firmware_image image = {
+ .programmer = "someprog",
+ .data = buf,
+ .size = sizeof(buf),
+ };
memcpy(buf, MOCK_ROM_CONTENTS, sizeof(buf));
- TEST_SUCC(flashrom_write("someprog", "SOME_REGION", buf, sizeof(buf)),
+ TEST_SUCC(flashrom_write(&image, "SOME_REGION"),
"Flashrom write succeeds");
TEST_STR_EQ(captured_programmer, "someprog",
"Using specified programmer");
@@ -247,9 +260,14 @@
static void test_write_failure(void)
{
uint8_t buf[20] = { 0 };
+ struct firmware_image image = {
+ .programmer = "someprog",
+ .data = buf,
+ .size = sizeof(buf),
+ };
flashrom_mock_success = false;
- TEST_NEQ(flashrom_write("someprog", "SOME_REGION", buf, sizeof(buf)),
+ TEST_NEQ(flashrom_write(&image, "SOME_REGION"),
VB2_SUCCESS, "Flashrom write fails");
flashrom_mock_success = true;
}
diff --git a/tests/vb2_host_nvdata_flashrom_tests.c b/tests/vb2_host_nvdata_flashrom_tests.c
index 33b435d..068b23a 100644
--- a/tests/vb2_host_nvdata_flashrom_tests.c
+++ b/tests/vb2_host_nvdata_flashrom_tests.c
@@ -81,35 +81,33 @@
}
/* Mocked flashrom_read for tests. */
-vb2_error_t flashrom_read(const char *programmer, const char *region,
- uint8_t **data_out, uint32_t *size_out)
+vb2_error_t flashrom_read(struct firmware_image *image, const char *region)
{
if (mock_flashrom_fail) {
- *data_out = NULL;
- *size_out = 0;
+ image->data = NULL;
+ image->size = 0;
return VB2_ERROR_FLASHROM;
}
- assert_mock_params(programmer, region);
+ assert_mock_params(image->programmer, region);
- *data_out = malloc(sizeof(fake_flash_region));
- *size_out = sizeof(fake_flash_region);
- memcpy(*data_out, fake_flash_region, sizeof(fake_flash_region));
+ image->data = malloc(sizeof(fake_flash_region));
+ image->size = sizeof(fake_flash_region);
+ memcpy(image->data, fake_flash_region, sizeof(fake_flash_region));
return VB2_SUCCESS;
}
/* Mocked flashrom_write for tests. */
-vb2_error_t flashrom_write(const char *programmer, const char *region,
- uint8_t *data, uint32_t data_size)
+vb2_error_t flashrom_write(struct firmware_image *image, const char *region)
{
if (mock_flashrom_fail)
return VB2_ERROR_FLASHROM;
- assert_mock_params(programmer, region);
+ assert_mock_params(image->programmer, region);
- TEST_EQ(data_size, sizeof(fake_flash_region),
+ TEST_EQ(image->size, sizeof(fake_flash_region),
"The flash size is correct");
- memcpy(fake_flash_region, data, data_size);
+ memcpy(fake_flash_region, image->data, image->size);
return VB2_SUCCESS;
}
diff --git a/tests/vb2_kernel_tests.c b/tests/vb2_kernel_tests.c
index 0dc0e74..0b3e94c 100644
--- a/tests/vb2_kernel_tests.c
+++ b/tests/vb2_kernel_tests.c
@@ -24,6 +24,7 @@
static struct vb2_shared_data *sd;
static struct vb2_fw_preamble *fwpre;
static const char fw_kernel_key_data[36] = "Test kernel key data";
+static enum vb2_boot_mode *boot_mode;
/* Mocked function data */
@@ -82,6 +83,14 @@
mock_gbb.recovery_key.key_offset +
mock_gbb.recovery_key.key_size;
+ /* For boot_mode */
+ boot_mode = (enum vb2_boot_mode *)&ctx->boot_mode;
+ if (t == FOR_PHASE1)
+ *boot_mode = VB2_BOOT_MODE_BROKEN_SCREEN;
+ else if (t == FOR_NORMAL_BOOT)
+ *boot_mode = VB2_BOOT_MODE_NORMAL;
+ else
+ *boot_mode = VB2_BOOT_MODE_UNDEFINED;
if (t == FOR_PHASE1) {
uint8_t *kdata;
@@ -274,6 +283,7 @@
TEST_EQ(sd->kernel_key_offset, 0, " workbuf key offset");
TEST_EQ(sd->kernel_key_size, 0, " workbuf key size");
mock_gbb.h.flags |= VB2_GBB_FLAG_FORCE_MANUAL_RECOVERY;
+ *boot_mode = VB2_BOOT_MODE_MANUAL_RECOVERY;
TEST_ABORT(vb2api_kernel_phase1(ctx), " fatal for manual recovery");
reset_common_data(FOR_PHASE1);
@@ -284,6 +294,7 @@
TEST_EQ(sd->kernel_key_offset, 0, " workbuf key offset");
TEST_EQ(sd->kernel_key_size, 0, " workbuf key size");
mock_gbb.h.flags |= VB2_GBB_FLAG_FORCE_MANUAL_RECOVERY;
+ *boot_mode = VB2_BOOT_MODE_MANUAL_RECOVERY;
mock_read_res_fail_on_call = 1;
TEST_ABORT(vb2api_kernel_phase1(ctx), " fatal for manual recovery");
diff --git a/tests/vb2_misc_tests.c b/tests/vb2_misc_tests.c
index c4b3ce4..99f8bae 100644
--- a/tests/vb2_misc_tests.c
+++ b/tests/vb2_misc_tests.c
@@ -22,6 +22,7 @@
static struct vb2_shared_data *sd;
static struct vb2_gbb_header gbb;
static struct vb2_secdata_fwmp *fwmp;
+static enum vb2_boot_mode *boot_mode;
/* Mocked function data */
static enum vb2_resource_index mock_resource_index;
@@ -29,7 +30,6 @@
static uint32_t mock_resource_size;
static int mock_tpm_clear_called;
static int mock_tpm_clear_retval;
-static int allow_recovery_retval;
static void reset_common_data(void)
{
@@ -40,7 +40,7 @@
"vb2api_init failed");
sd = vb2_get_sd(ctx);
- sd->status = VB2_SD_STATUS_SECDATA_FWMP_INIT;
+ sd->status |= VB2_SD_STATUS_SECDATA_FWMP_INIT;
memset(&gbb, 0, sizeof(gbb));
@@ -53,16 +53,13 @@
mock_tpm_clear_called = 0;
mock_tpm_clear_retval = VB2_SUCCESS;
- allow_recovery_retval = 0;
+
+ boot_mode = (enum vb2_boot_mode *)&ctx->boot_mode;
+ *boot_mode = VB2_BOOT_MODE_NORMAL;
};
/* Mocked functions */
-int vb2api_allow_recovery(struct vb2_context *c)
-{
- return allow_recovery_retval;
-}
-
struct vb2_gbb_header *vb2_get_gbb(struct vb2_context *c)
{
return &gbb;
@@ -268,12 +265,17 @@
"vb_workbuf_from_ctx() size");
reset_common_data();
+ sd->status |= VB2_SD_STATUS_RECOVERY_DECIDED;
TEST_ABORT(VB2_REC_OR_DIE(ctx, "die\n"), "REC_OR_DIE in normal mode");
reset_common_data();
+ sd->status |= VB2_SD_STATUS_RECOVERY_DECIDED;
ctx->flags |= VB2_CONTEXT_RECOVERY_MODE;
VB2_REC_OR_DIE(ctx, "VB2_REC_OR_DIE() test in recovery mode\n");
/* Would exit here if it didn't work as intended. */
+
+ reset_common_data();
+ VB2_REC_OR_DIE(ctx, "VB2_REC_OR_DIE() test in fw_phase1\n");
}
static void gbb_tests(void)
@@ -421,12 +423,14 @@
{
/* No recovery */
reset_common_data();
+ TEST_EQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, "recovery not yet decided before testing check_recovery()");
vb2_check_recovery(ctx);
TEST_EQ(sd->recovery_reason, 0, "No recovery reason");
- TEST_EQ(sd->flags & VB2_SD_FLAG_MANUAL_RECOVERY,
- 0, "Not manual recovery");
TEST_EQ(ctx->flags & VB2_CONTEXT_RECOVERY_MODE,
0, "Not recovery mode");
+ TEST_NEQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, "Recovery decided");
/* From request */
reset_common_data();
@@ -434,10 +438,10 @@
vb2_check_recovery(ctx);
TEST_EQ(sd->recovery_reason, 3, "Recovery reason from request");
TEST_EQ(vb2_nv_get(ctx, VB2_NV_RECOVERY_REQUEST), 3, "NV not cleared");
- TEST_EQ(sd->flags & VB2_SD_FLAG_MANUAL_RECOVERY,
- 0, "Not manual recovery");
TEST_NEQ(ctx->flags & VB2_CONTEXT_RECOVERY_MODE,
0, "Recovery mode");
+ TEST_NEQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, "Recovery decided");
/* From request, but already failed */
reset_common_data();
@@ -447,6 +451,8 @@
TEST_EQ(sd->recovery_reason, 5, "Recovery reason already failed");
TEST_EQ(vb2_nv_get(ctx, VB2_NV_RECOVERY_REQUEST),
4, "NV not cleared");
+ TEST_NEQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, "Recovery decided");
/* Override */
reset_common_data();
@@ -455,8 +461,8 @@
vb2_check_recovery(ctx);
TEST_EQ(sd->recovery_reason, VB2_RECOVERY_RO_MANUAL,
"Recovery reason forced");
- TEST_NEQ(sd->flags & VB2_SD_FLAG_MANUAL_RECOVERY,
- 0, "SD flag set");
+ TEST_NEQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, "Recovery decided");
/* Override subcode TRAIN_AND_REBOOT */
reset_common_data();
@@ -465,8 +471,8 @@
vb2_check_recovery(ctx);
TEST_EQ(sd->recovery_reason, VB2_RECOVERY_RO_MANUAL,
"Recovery reason forced");
- TEST_NEQ(sd->flags & VB2_SD_FLAG_MANUAL_RECOVERY,
- 0, "SD flag set");
+ TEST_NEQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, "Recovery decided");
/* Promote subcode from BROKEN screen*/
reset_common_data();
@@ -475,8 +481,8 @@
vb2_check_recovery(ctx);
TEST_EQ(sd->recovery_reason, VB2_RECOVERY_US_TEST,
"Recovery reason forced from BROKEN");
- TEST_NEQ(sd->flags & VB2_SD_FLAG_MANUAL_RECOVERY,
- 0, "SD flag set");
+ TEST_NEQ(sd->status & VB2_SD_STATUS_RECOVERY_DECIDED,
+ 0, "Recovery decided");
}
static void dev_switch_tests(void)
@@ -589,13 +595,15 @@
/*
* secdata_firmware failure in normal mode fails and shows dev=0 even
- * if dev mode was on in the (inaccessible) secdata_firmware.
+ * if dev mode was on in the (inaccessible) secdata_firmware. Since this
+ * happens in fw_phase1, we do not abort -- we know that when secdata
+ * is uninitialized here, we must be headed for recovery mode.
*/
reset_common_data();
vb2_secdata_firmware_set(ctx, VB2_SECDATA_FIRMWARE_FLAGS,
VB2_SECDATA_FIRMWARE_FLAG_DEV_MODE);
sd->status &= ~VB2_SD_STATUS_SECDATA_FIRMWARE_INIT;
- TEST_ABORT(vb2_check_dev_switch(ctx), "secdata_firmware fail normal");
+ TEST_SUCC(vb2_check_dev_switch(ctx), "secdata_firmware fail normal");
TEST_EQ(sd->flags & VB2_SD_FLAG_DEV_MODE_ENABLED, 0, " sd not in dev");
TEST_EQ(ctx->flags & VB2_CONTEXT_DEVELOPER_MODE, 0, " ctx not in dev");
@@ -640,7 +648,6 @@
static void enable_dev_tests(void)
{
reset_common_data();
- allow_recovery_retval = 0;
TEST_FAIL(vb2api_enable_developer_mode(ctx),
"vb2api_enable_developer_mode - failed");
TEST_EQ(vb2_secdata_firmware_get(ctx, VB2_SECDATA_FIRMWARE_FLAGS) &
@@ -648,19 +655,18 @@
" dev mode flag not set");
reset_common_data();
- allow_recovery_retval = 1;
+ *boot_mode = VB2_BOOT_MODE_MANUAL_RECOVERY;
TEST_SUCC(vb2api_enable_developer_mode(ctx),
"vb2api_enable_developer_mode - success");
TEST_NEQ(vb2_secdata_firmware_get(ctx, VB2_SECDATA_FIRMWARE_FLAGS) &
VB2_SECDATA_FIRMWARE_FLAG_DEV_MODE, 0,
" dev mode flag set");
- TEST_EQ(vb2_nv_get(ctx, VB2_NV_DEV_BOOT_EXTERNAL), BOOT_EXTERNAL_ON_DEV,
- " NV_DEV_BOOT_EXTERNAL set according to compile-time flag");
/* secdata_firmware not initialized, aborts */
reset_common_data();
- allow_recovery_retval = 1;
+ *boot_mode = VB2_BOOT_MODE_MANUAL_RECOVERY;
sd->status &= ~VB2_SD_STATUS_SECDATA_FIRMWARE_INIT;
+ sd->status |= VB2_SD_STATUS_RECOVERY_DECIDED;
TEST_ABORT(vb2api_enable_developer_mode(ctx),
"secdata_firmware no init, enable dev mode aborted");
sd->status |= VB2_SD_STATUS_SECDATA_FIRMWARE_INIT;
@@ -810,7 +816,7 @@
/* Manual recovery */
reset_common_data();
- allow_recovery_retval = 1;
+ *boot_mode = VB2_BOOT_MODE_MANUAL_RECOVERY;
sd->recovery_reason = 4;
ctx->flags |= VB2_CONTEXT_RECOVERY_MODE;
vb2_nv_set(ctx, VB2_NV_RECOVERY_REQUEST, 5);
@@ -821,9 +827,9 @@
TEST_EQ(vb2_nv_get(ctx, VB2_NV_RECOVERY_SUBCODE),
0, " subcode cleared");
- /* BROKEN recovery */
+ /* Broken screen */
reset_common_data();
- allow_recovery_retval = 0;
+ *boot_mode = VB2_BOOT_MODE_BROKEN_SCREEN;
sd->recovery_reason = 4;
ctx->flags |= VB2_CONTEXT_RECOVERY_MODE;
vb2_nv_set(ctx, VB2_NV_RECOVERY_REQUEST, 5);
diff --git a/tests/vb2_secdata_firmware_tests.c b/tests/vb2_secdata_firmware_tests.c
index 387cda3..c1b0a73 100644
--- a/tests/vb2_secdata_firmware_tests.c
+++ b/tests/vb2_secdata_firmware_tests.c
@@ -28,6 +28,9 @@
sd = vb2_get_sd(ctx);
+ /* Most tests assume we have passed fw_phase1() */
+ sd->status |= VB2_SD_STATUS_RECOVERY_DECIDED;
+
sec = (struct vb2_secdata_firmware *)ctx->secdata_firmware;
}
@@ -136,6 +139,25 @@
0x123456ff),
"Set uninitialized");
test_changed(ctx, 0, "Set uninitialized doesn't change data");
+
+ /* Read/write uninitialized in recovery mode */
+ ctx->flags |= VB2_CONTEXT_RECOVERY_MODE;
+ TEST_EQ(vb2_secdata_firmware_get(ctx, VB2_SECDATA_FIRMWARE_VERSIONS), 0,
+ "Get uninitialized (recmode)");
+ test_changed(ctx, 0, "Get uninitialized (recmode) doesn't change data");
+ vb2_secdata_firmware_set(ctx, VB2_SECDATA_FIRMWARE_VERSIONS,
+ 0x123456ff);
+ test_changed(ctx, 0, "Set uninitialized (recmode) doesn't change data");
+
+ /* Read/write early in fw_phase1 */
+ ctx->flags &= ~VB2_CONTEXT_RECOVERY_MODE;
+ sd->status &= ~VB2_SD_STATUS_RECOVERY_DECIDED;
+ TEST_EQ(vb2_secdata_firmware_get(ctx, VB2_SECDATA_FIRMWARE_VERSIONS), 0,
+ "Get uninitialized (phase1)");
+ test_changed(ctx, 0, "Get uninitialized (phase1) doesn't change data");
+ vb2_secdata_firmware_set(ctx, VB2_SECDATA_FIRMWARE_VERSIONS,
+ 0x123456ff);
+ test_changed(ctx, 0, "Set uninitialized (phase1) doesn't change data");
}
int main(int argc, char* argv[])
diff --git a/tests/vb2_secdata_fwmp_tests.c b/tests/vb2_secdata_fwmp_tests.c
index 699f3fa..79b0f55 100644
--- a/tests/vb2_secdata_fwmp_tests.c
+++ b/tests/vb2_secdata_fwmp_tests.c
@@ -25,7 +25,8 @@
"vb2api_init failed");
sd = vb2_get_sd(ctx);
- sd->status = VB2_SD_STATUS_SECDATA_FWMP_INIT;
+ sd->status |= VB2_SD_STATUS_SECDATA_FWMP_INIT;
+ sd->status |= VB2_SD_STATUS_RECOVERY_DECIDED;
memset(&gbb, 0, sizeof(gbb));
@@ -199,6 +200,13 @@
sd->status &= ~VB2_SD_STATUS_SECDATA_FWMP_INIT;
TEST_ABORT(vb2_secdata_fwmp_get_flag(ctx, 0),
"non-init in normal mode triggers abort");
+
+ /* FWMP hasn't been initialized (before recovery decision) */
+ reset_common_data();
+ sd->status &= ~VB2_SD_STATUS_SECDATA_FWMP_INIT;
+ sd->status &= ~VB2_SD_STATUS_RECOVERY_DECIDED;
+ TEST_EQ(vb2_secdata_fwmp_get_flag(ctx, 0), 0,
+ "non-init in fw_phase1 forces default flag value");
}
static void get_dev_key_hash_test(void)
@@ -222,6 +230,13 @@
TEST_ABORT(vb2_secdata_fwmp_get_dev_key_hash(ctx),
"non-init in normal mode triggers abort");
+ /* FWMP hasn't been initialized (before recovery decision) */
+ reset_common_data();
+ sd->status &= ~VB2_SD_STATUS_SECDATA_FWMP_INIT;
+ sd->status &= ~VB2_SD_STATUS_RECOVERY_DECIDED;
+ TEST_TRUE(vb2_secdata_fwmp_get_dev_key_hash(ctx) == NULL,
+ "non-init in fw_phase1 forces NULL pointer");
+
/* Success case */
reset_common_data();
TEST_TRUE(vb2_secdata_fwmp_get_dev_key_hash(ctx) ==
diff --git a/tests/vb2_secdata_kernel_tests.c b/tests/vb2_secdata_kernel_tests.c
index 327018d..dc41f1a 100644
--- a/tests/vb2_secdata_kernel_tests.c
+++ b/tests/vb2_secdata_kernel_tests.c
@@ -30,6 +30,9 @@
sd = vb2_get_sd(ctx);
+ /* Most tests assume we have passed fw_phase1() */
+ sd->status |= VB2_SD_STATUS_RECOVERY_DECIDED;
+
sec02 = (struct vb2_secdata_kernel_v0 *)ctx->secdata_kernel;
sec10 = (struct vb2_secdata_kernel_v1 *)ctx->secdata_kernel;
}
@@ -245,7 +248,27 @@
"Set uninitialized");
test_changed(ctx, 0, "Set uninitialized doesn't change data");
+ /* Read/write uninitialized in recovery mode */
+ ctx->flags |= VB2_CONTEXT_RECOVERY_MODE;
+ TEST_EQ(vb2_secdata_kernel_get(ctx, VB2_SECDATA_KERNEL_VERSIONS), 0,
+ "Get uninitialized (recmode)");
+ test_changed(ctx, 0, "Get uninitialized (recmode) doesn't change data");
+ vb2_secdata_kernel_set(ctx, VB2_SECDATA_KERNEL_VERSIONS,
+ 0x123456ff);
+ test_changed(ctx, 0, "Set uninitialized (recmode) doesn't change data");
+
+ /* Read/write early in fw_phase1 */
+ ctx->flags &= ~VB2_CONTEXT_RECOVERY_MODE;
+ sd->status &= ~VB2_SD_STATUS_RECOVERY_DECIDED;
+ TEST_EQ(vb2_secdata_kernel_get(ctx, VB2_SECDATA_KERNEL_VERSIONS), 0,
+ "Get uninitialized (phase1)");
+ test_changed(ctx, 0, "Get uninitialized (phase1) doesn't change data");
+ vb2_secdata_kernel_set(ctx, VB2_SECDATA_KERNEL_VERSIONS,
+ 0x123456ff);
+ test_changed(ctx, 0, "Set uninitialized (phase1) doesn't change data");
+
/* Test EC hash set */
+ reset_common_data();
vb2api_secdata_kernel_create(ctx);
vb2_secdata_kernel_init(ctx);
memset(ec_hash, 0xaa, sizeof(ec_hash));
diff --git a/tests/vboot_api_kernel4_tests.c b/tests/vboot_api_kernel4_tests.c
index f122eb3..60d87c6 100644
--- a/tests/vboot_api_kernel4_tests.c
+++ b/tests/vboot_api_kernel4_tests.c
@@ -80,6 +80,9 @@
ctx->flags |= VB2_CONTEXT_RECOVERY_MODE;
expected_recovery_reason = recovery_reason;
+ /* The VbSelectAndLoadKernel directly leverages the value at
+ ctx->boot_mode, so we have to call vb2_set_boot_mode first. */
+ vb2_set_boot_mode(ctx);
TEST_EQ(VbSelectAndLoadKernel(ctx, &kparams), retval, desc);
TEST_EQ(vb2_nv_get(ctx, VB2_NV_RECOVERY_REQUEST),
recovery_reason, " recovery reason");
@@ -259,12 +262,14 @@
/* Recovery - VB2_ERROR_ESCAPE_NO_BOOT */
reset_common_data();
ctx->flags |= VB2_CONTEXT_NO_BOOT;
+ ctx->flags |= VB2_CONTEXT_EC_SYNC_SUPPORTED;
test_slk(VB2_ERROR_ESCAPE_NO_BOOT,
VB2_RECOVERY_ESCAPE_NO_BOOT, "Recovery for NO_BOOT escape");
/* Boot normal - VB2_ERROR_ESCAPE_NO_BOOT */
reset_common_data();
ctx->flags |= VB2_CONTEXT_NO_BOOT;
+ ctx->flags |= VB2_CONTEXT_EC_SYNC_SUPPORTED;
gbb.flags |= VB2_GBB_FLAG_DISABLE_EC_SOFTWARE_SYNC;
test_slk(VB2_SUCCESS, 0, "DISABLE_EC_SOFTWARE_SYNC ignores NO_BOOT");
@@ -325,7 +330,7 @@
reset_common_data();
sd->recovery_reason = VB2_RECOVERY_RO_MANUAL;
vb2_nv_set(ctx, VB2_NV_RECOVERY_SUBCODE, 13);
- sd->flags |= VB2_SD_FLAG_MANUAL_RECOVERY;
+ ctx->flags &= VB2_CONTEXT_FORCE_RECOVERY_MODE;
test_slk(0, 0, "Manual recovery");
TEST_TRUE(commit_data_called, " commit data");
}
diff --git a/tests/vboot_api_kernel_tests.c b/tests/vboot_api_kernel_tests.c
index 51f0ddb..b66c432 100644
--- a/tests/vboot_api_kernel_tests.c
+++ b/tests/vboot_api_kernel_tests.c
@@ -563,7 +563,7 @@
vb2_error_t LoadMiniOsKernel(struct vb2_context *c,
VbSelectAndLoadKernelParams *params,
- VbDiskInfo *disk_info)
+ VbDiskInfo *disk_info, uint32_t minios_flags)
{
lk_minios_calls++;
return LoadKernelImpl(c, params, disk_info);
@@ -616,7 +616,7 @@
printf("Test case: %s ...\n", minios_tests[i].name);
ResetMocks(&minios_tests[i]);
ctx->flags = t->ctx_flags;
- TEST_EQ(VbTryLoadMiniOsKernel(ctx),
+ TEST_EQ(VbTryLoadMiniOsKernel(ctx, 0),
t->expected_return_val, " return value");
TEST_EQ(got_recovery_request_val,
t->expected_recovery_request_val, " recovery_request");
diff --git a/tests/vboot_kernel2_tests.c b/tests/vboot_kernel2_tests.c
index 5424e86..5fc66f1 100644
--- a/tests/vboot_kernel2_tests.c
+++ b/tests/vboot_kernel2_tests.c
@@ -47,6 +47,7 @@
static struct vb2_workbuf wb;
static uint8_t workbuf[VB2_KERNEL_WORKBUF_RECOMMENDED_SIZE]
__attribute__((aligned(VB2_WORKBUF_ALIGN)));
+static enum vb2_boot_mode *boot_mode;
static VbSelectAndLoadKernelParams lkp;
static VbDiskInfo disk_info;
@@ -82,6 +83,9 @@
vb2_secdata_kernel_init(ctx);
ctx->flags = VB2_CONTEXT_RECOVERY_MODE;
+ boot_mode = (enum vb2_boot_mode *)&ctx->boot_mode;
+ *boot_mode = VB2_BOOT_MODE_MANUAL_RECOVERY;
+
sd = vb2_get_sd(ctx);
sd->kernel_version_secdata = 0xabcdef | (1 << 24);
@@ -264,7 +268,7 @@
disk_info.bytes_per_lba = KBUF_SIZE;
disk_info.lba_count = 1;
add_mock_kernel(0, VB2_SUCCESS);
- TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info),
+ TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info, 0),
"{valid kernel}");
TEST_EQ(mock_tpm_set_mode_calls, 1,
" TPM disabled");
@@ -272,7 +276,7 @@
reset_common_data();
disk_info.bytes_per_lba = KBUF_SIZE;
disk_info.lba_count = 1;
- TEST_EQ(LoadMiniOsKernel(ctx, &lkp, &disk_info),
+ TEST_EQ(LoadMiniOsKernel(ctx, &lkp, &disk_info, 0),
VB2_ERROR_LK_NO_KERNEL_FOUND, "{no kernel}");
TEST_EQ(mock_tpm_set_mode_calls, 0,
" TPM not disabled");
@@ -281,7 +285,7 @@
disk_info.bytes_per_lba = KBUF_SIZE;
disk_info.lba_count = 2;
add_mock_kernel(1, VB2_SUCCESS);
- TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info),
+ TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info, 0),
"{no kernel, valid kernel}");
TEST_EQ(cur_kernel->sector, 1, " select kernel");
@@ -290,7 +294,7 @@
disk_info.lba_count = 2;
add_mock_kernel(0, VB2_ERROR_MOCK);
add_mock_kernel(1, VB2_SUCCESS);
- TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info),
+ TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info, 0),
"{invalid kernel, valid kernel}");
TEST_EQ(cur_kernel->sector, 1, " select second kernel");
@@ -299,7 +303,7 @@
disk_info.lba_count = 2;
add_mock_kernel(0, VB2_ERROR_MOCK);
add_mock_kernel(1, VB2_ERROR_MOCK);
- TEST_EQ(LoadMiniOsKernel(ctx, &lkp, &disk_info),
+ TEST_EQ(LoadMiniOsKernel(ctx, &lkp, &disk_info, 0),
VB2_ERROR_LK_NO_KERNEL_FOUND,
"{invalid kernel, invalid kernel}");
TEST_EQ(mock_tpm_set_mode_calls, 0,
@@ -310,7 +314,7 @@
disk_info.lba_count = 2;
add_mock_kernel(0, VB2_SUCCESS);
add_mock_kernel(1, VB2_SUCCESS);
- TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info),
+ TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info, 0),
"{valid kernel, valid kernel} minios_priority=0");
TEST_EQ(cur_kernel->sector, 0, " select first kernel");
@@ -320,15 +324,36 @@
add_mock_kernel(0, VB2_SUCCESS);
add_mock_kernel(1, VB2_SUCCESS);
vb2_nv_set(ctx, VB2_NV_MINIOS_PRIORITY, 1);
- TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info),
+ TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info, 0),
"{valid kernel, valid kernel} minios_priority=1");
TEST_EQ(cur_kernel->sector, 1, " select second kernel");
reset_common_data();
+ disk_info.bytes_per_lba = KBUF_SIZE;
+ disk_info.lba_count = 2;
+ add_mock_kernel(0, VB2_SUCCESS);
+ add_mock_kernel(1, VB2_SUCCESS);
+ TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info,
+ VB_MINIOS_FLAG_NON_ACTIVE),
+ "{valid kernel, valid kernel} minios_priority=0 non-active");
+ TEST_EQ(cur_kernel->sector, 1, " select second kernel");
+
+ reset_common_data();
+ disk_info.bytes_per_lba = KBUF_SIZE;
+ disk_info.lba_count = 2;
+ add_mock_kernel(0, VB2_ERROR_MOCK);
+ add_mock_kernel(1, VB2_SUCCESS);
+ vb2_nv_set(ctx, VB2_NV_MINIOS_PRIORITY, 1);
+ TEST_EQ(LoadMiniOsKernel(ctx, &lkp, &disk_info,
+ VB_MINIOS_FLAG_NON_ACTIVE),
+ VB2_ERROR_LK_NO_KERNEL_FOUND,
+ "{invalid kernel, valid kernel} minios_priority=1 non-active");
+
+ reset_common_data();
disk_info.bytes_per_lba = VB2_KEYBLOCK_MAGIC_SIZE;
disk_info.lba_count = 4;
add_mock_kernel(1, VB2_SUCCESS);
- TEST_EQ(LoadMiniOsKernel(ctx, &lkp, &disk_info),
+ TEST_EQ(LoadMiniOsKernel(ctx, &lkp, &disk_info, 0),
VB2_ERROR_LK_NO_KERNEL_FOUND,
"valid kernel header near start of disk (disk too small)");
@@ -336,7 +361,7 @@
disk_info.bytes_per_lba = VB2_KEYBLOCK_MAGIC_SIZE;
disk_info.lba_count = 1000;
add_mock_kernel(999, VB2_SUCCESS);
- TEST_EQ(LoadMiniOsKernel(ctx, &lkp, &disk_info),
+ TEST_EQ(LoadMiniOsKernel(ctx, &lkp, &disk_info, 0),
VB2_ERROR_LK_NO_KERNEL_FOUND,
"valid kernel header near end of disk");
@@ -344,35 +369,35 @@
disk_info.bytes_per_lba = 1024;
disk_info.lba_count = 128;
add_mock_kernel(63, VB2_SUCCESS);
- TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info),
+ TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info, 0),
"start/end overlap assuming >128 MB search range (start)");
reset_common_data();
disk_info.bytes_per_lba = 1024;
disk_info.lba_count = 128;
add_mock_kernel(64, VB2_SUCCESS);
- TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info),
+ TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info, 0),
"start/end overlap assuming >128 MB search range (end)");
reset_common_data();
disk_info.bytes_per_lba = 128;
disk_info.lba_count = 1024;
add_mock_kernel(3, VB2_SUCCESS);
- TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info),
+ TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info, 0),
"kernel at last sector in batch assuming 512 KB batches");
reset_common_data();
disk_info.bytes_per_lba = 256;
disk_info.lba_count = 1024;
add_mock_kernel(3, VB2_SUCCESS);
- TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info),
+ TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info, 0),
"kernel at last sector in batch assuming 1 MB batches");
reset_common_data();
disk_info.bytes_per_lba = 512;
disk_info.lba_count = 1024;
add_mock_kernel(3, VB2_SUCCESS);
- TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info),
+ TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info, 0),
"kernel at last sector in batch assuming 2 MB batches");
reset_common_data();
@@ -382,7 +407,7 @@
disk_info.bytes_per_lba = KBUF_SIZE;
disk_info.lba_count = 2;
add_mock_kernel(0, VB2_SUCCESS);
- TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info),
+ TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info, 0),
"kernel with minios keyblock flag");
reset_common_data();
@@ -392,7 +417,7 @@
disk_info.bytes_per_lba = KBUF_SIZE;
disk_info.lba_count = 2;
add_mock_kernel(0, VB2_SUCCESS);
- TEST_EQ(LoadMiniOsKernel(ctx, &lkp, &disk_info),
+ TEST_EQ(LoadMiniOsKernel(ctx, &lkp, &disk_info, 0),
VB2_ERROR_LK_NO_KERNEL_FOUND,
"kernel with !minios keyblock flag");
@@ -402,7 +427,7 @@
add_mock_kernel(0, VB2_SUCCESS);
sd->kernel_version_secdata = 5 << 24;
kph.kernel_version = 4;
- TEST_EQ(LoadMiniOsKernel(ctx, &lkp, &disk_info),
+ TEST_EQ(LoadMiniOsKernel(ctx, &lkp, &disk_info, 0),
VB2_ERROR_LK_NO_KERNEL_FOUND,
"kernel version too old");
@@ -412,7 +437,7 @@
add_mock_kernel(0, VB2_SUCCESS);
sd->kernel_version_secdata = 5 << 24;
kph.kernel_version = 0x100;
- TEST_EQ(LoadMiniOsKernel(ctx, &lkp, &disk_info),
+ TEST_EQ(LoadMiniOsKernel(ctx, &lkp, &disk_info, 0),
VB2_ERROR_LK_NO_KERNEL_FOUND,
"kernel version greater than 0xff");
@@ -422,7 +447,7 @@
add_mock_kernel(0, VB2_SUCCESS);
sd->kernel_version_secdata = 5 << 24;
kph.kernel_version = 6;
- TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info),
+ TEST_SUCC(LoadMiniOsKernel(ctx, &lkp, &disk_info, 0),
"newer kernel version");
}
diff --git a/tests/vboot_kernel_tests.c b/tests/vboot_kernel_tests.c
index 14e7e1f..1f77cc5 100644
--- a/tests/vboot_kernel_tests.c
+++ b/tests/vboot_kernel_tests.c
@@ -51,6 +51,7 @@
static struct vb2_context *ctx;
static struct vb2_shared_data *sd;
static struct vb2_packed_key mock_key;
+static enum vb2_boot_mode *boot_mode;
/**
* Reset mock data (for use before each test)
@@ -114,6 +115,9 @@
fwmp = (struct vb2_secdata_fwmp *)ctx->secdata_fwmp;
memcpy(&fwmp->dev_key_hash, mock_digest, sizeof(fwmp->dev_key_hash));
+ boot_mode = (enum vb2_boot_mode *)&ctx->boot_mode;
+ *boot_mode = VB2_BOOT_MODE_NORMAL;
+
// TODO: more workbuf fields - flags, secdata_firmware
vb2api_secdata_kernel_create(ctx);
@@ -337,6 +341,7 @@
/* In dev mode, fail if hash is bad too */
ResetMocks();
ctx->flags |= VB2_CONTEXT_DEVELOPER_MODE;
+ *boot_mode = VB2_BOOT_MODE_DEVELOPER;
keyblock_verify_fail = 2;
TestLoadKernel(VB2_ERROR_LK_INVALID_KERNEL_FOUND,
"Fail key block dev hash");
@@ -344,6 +349,7 @@
/* But just bad sig is ok */
ResetMocks();
ctx->flags |= VB2_CONTEXT_DEVELOPER_MODE;
+ *boot_mode = VB2_BOOT_MODE_DEVELOPER;
keyblock_verify_fail = 1;
TestLoadKernel(0, "Succeed keyblock dev sig");
TEST_EQ(sd->flags & VB2_SD_FLAG_KERNEL_SIGNED, 0, " use hash");
@@ -351,6 +357,7 @@
/* In dev mode and requiring signed kernel, fail if sig is bad */
ResetMocks();
ctx->flags |= VB2_CONTEXT_DEVELOPER_MODE;
+ *boot_mode = VB2_BOOT_MODE_DEVELOPER;
vb2_nv_set(ctx, VB2_NV_DEV_BOOT_SIGNED_ONLY, 1);
keyblock_verify_fail = 1;
TestLoadKernel(VB2_ERROR_LK_INVALID_KERNEL_FOUND,
@@ -358,6 +365,7 @@
ResetMocks();
ctx->flags |= VB2_CONTEXT_DEVELOPER_MODE;
+ *boot_mode = VB2_BOOT_MODE_DEVELOPER;
fwmp->flags |= VB2_SECDATA_FWMP_DEV_ENABLE_OFFICIAL_ONLY;
keyblock_verify_fail = 1;
TestLoadKernel(VB2_ERROR_LK_INVALID_KERNEL_FOUND,
@@ -387,6 +395,7 @@
ResetMocks();
ctx->flags |= VB2_CONTEXT_RECOVERY_MODE;
+ *boot_mode = VB2_BOOT_MODE_MANUAL_RECOVERY;
kbh.keyblock_flags = VB2_KEYBLOCK_FLAG_RECOVERY_1
| VB2_KEYBLOCK_FLAG_DEVELOPER_1
| VB2_KEYBLOCK_FLAG_MINIOS_0;
@@ -395,6 +404,7 @@
ResetMocks();
ctx->flags |= VB2_CONTEXT_RECOVERY_MODE;
+ *boot_mode = VB2_BOOT_MODE_MANUAL_RECOVERY;
kbh.keyblock_flags = VB2_KEYBLOCK_FLAG_RECOVERY_1
| VB2_KEYBLOCK_FLAG_DEVELOPER_0
| VB2_KEYBLOCK_FLAG_MINIOS_0;
@@ -402,6 +412,7 @@
ResetMocks();
ctx->flags |= VB2_CONTEXT_RECOVERY_MODE | VB2_CONTEXT_DEVELOPER_MODE;
+ *boot_mode = VB2_BOOT_MODE_MANUAL_RECOVERY;
kbh.keyblock_flags = VB2_KEYBLOCK_FLAG_RECOVERY_1
| VB2_KEYBLOCK_FLAG_DEVELOPER_0
| VB2_KEYBLOCK_FLAG_MINIOS_0;
@@ -410,6 +421,7 @@
ResetMocks();
ctx->flags |= VB2_CONTEXT_RECOVERY_MODE | VB2_CONTEXT_DEVELOPER_MODE;
+ *boot_mode = VB2_BOOT_MODE_MANUAL_RECOVERY;
kbh.keyblock_flags = VB2_KEYBLOCK_FLAG_RECOVERY_1
| VB2_KEYBLOCK_FLAG_DEVELOPER_1
| VB2_KEYBLOCK_FLAG_MINIOS_0;
@@ -418,6 +430,7 @@
/* Check keyblock flags (dev mode + signed kernel required) */
ResetMocks();
ctx->flags |= VB2_CONTEXT_DEVELOPER_MODE;
+ *boot_mode = VB2_BOOT_MODE_DEVELOPER;
vb2_nv_set(ctx, VB2_NV_DEV_BOOT_SIGNED_ONLY, 1);
kbh.keyblock_flags = VB2_KEYBLOCK_FLAG_RECOVERY_1
| VB2_KEYBLOCK_FLAG_DEVELOPER_0
@@ -427,6 +440,7 @@
ResetMocks();
ctx->flags |= VB2_CONTEXT_DEVELOPER_MODE;
+ *boot_mode = VB2_BOOT_MODE_DEVELOPER;
fwmp->flags |= VB2_SECDATA_FWMP_DEV_ENABLE_OFFICIAL_ONLY;
kbh.keyblock_flags = VB2_KEYBLOCK_FLAG_RECOVERY_1
| VB2_KEYBLOCK_FLAG_DEVELOPER_0
@@ -436,6 +450,7 @@
ResetMocks();
ctx->flags |= VB2_CONTEXT_DEVELOPER_MODE;
+ *boot_mode = VB2_BOOT_MODE_DEVELOPER;
fwmp->flags |= VB2_SECDATA_FWMP_DEV_ENABLE_OFFICIAL_ONLY;
kbh.keyblock_flags = VB2_KEYBLOCK_FLAG_RECOVERY_0
| VB2_KEYBLOCK_FLAG_DEVELOPER_0
@@ -445,6 +460,7 @@
ResetMocks();
ctx->flags |= VB2_CONTEXT_DEVELOPER_MODE;
+ *boot_mode = VB2_BOOT_MODE_DEVELOPER;
vb2_nv_set(ctx, VB2_NV_DEV_BOOT_SIGNED_ONLY, 1);
kbh.keyblock_flags = VB2_KEYBLOCK_FLAG_RECOVERY_0
| VB2_KEYBLOCK_FLAG_DEVELOPER_1
@@ -477,12 +493,12 @@
ResetMocks();
kbh.data_key.key_version = 1;
- ctx->flags |= VB2_CONTEXT_DEVELOPER_MODE;
+ *boot_mode = VB2_BOOT_MODE_DEVELOPER;
TestLoadKernel(0, "Key version ignored in dev mode");
ResetMocks();
kbh.data_key.key_version = 1;
- ctx->flags |= VB2_CONTEXT_RECOVERY_MODE;
+ *boot_mode = VB2_BOOT_MODE_MANUAL_RECOVERY;
TestLoadKernel(0, "Key version ignored in rec mode");
ResetMocks();
@@ -500,18 +516,18 @@
ResetMocks();
kph.kernel_version = 0;
- ctx->flags |= VB2_CONTEXT_DEVELOPER_MODE;
+ *boot_mode = VB2_BOOT_MODE_DEVELOPER;
TestLoadKernel(0, "Kernel version ignored in dev mode");
ResetMocks();
kph.kernel_version = 0;
- ctx->flags |= VB2_CONTEXT_RECOVERY_MODE;
+ *boot_mode = VB2_BOOT_MODE_MANUAL_RECOVERY;
TestLoadKernel(0, "Kernel version ignored in rec mode");
/* Check kernel version (dev mode + signed kernel required) */
ResetMocks();
kbh.data_key.key_version = 0;
- ctx->flags |= VB2_CONTEXT_DEVELOPER_MODE;
+ *boot_mode = VB2_BOOT_MODE_DEVELOPER;
vb2_nv_set(ctx, VB2_NV_DEV_BOOT_SIGNED_ONLY, 1);
TestLoadKernel(VB2_ERROR_LK_INVALID_KERNEL_FOUND,
"Keyblock key version checked in dev mode "
@@ -519,7 +535,7 @@
ResetMocks();
kbh.data_key.key_version = 0;
- ctx->flags |= VB2_CONTEXT_DEVELOPER_MODE;
+ *boot_mode = VB2_BOOT_MODE_DEVELOPER;
fwmp->flags |= VB2_SECDATA_FWMP_DEV_ENABLE_OFFICIAL_ONLY;
TestLoadKernel(VB2_ERROR_LK_INVALID_KERNEL_FOUND,
"Keyblock key version checked in dev mode "
@@ -527,7 +543,7 @@
/* Check developer key hash - bad */
ResetMocks();
- ctx->flags |= VB2_CONTEXT_DEVELOPER_MODE;
+ *boot_mode = VB2_BOOT_MODE_DEVELOPER;
fwmp->flags |= VB2_SECDATA_FWMP_DEV_USE_KEY_HASH;
fwmp->dev_key_hash[0]++;
TestLoadKernel(VB2_ERROR_LK_INVALID_KERNEL_FOUND,
@@ -535,15 +551,14 @@
/* Check developer key hash - bad (recovery mode) */
ResetMocks();
- ctx->flags |= VB2_CONTEXT_RECOVERY_MODE;
- ctx->flags |= VB2_CONTEXT_DEVELOPER_MODE;
+ *boot_mode = VB2_BOOT_MODE_MANUAL_RECOVERY;
fwmp->flags |= VB2_SECDATA_FWMP_DEV_USE_KEY_HASH;
fwmp->dev_key_hash[0]++;
TestLoadKernel(0, "Bad keyblock dev fwmp hash ignored in rec mode");
/* Check developer key hash - good */
ResetMocks();
- ctx->flags |= VB2_CONTEXT_DEVELOPER_MODE;
+ *boot_mode = VB2_BOOT_MODE_DEVELOPER;
fwmp->flags |= VB2_SECDATA_FWMP_DEV_USE_KEY_HASH;
TestLoadKernel(0, "Good keyblock dev fwmp hash");
diff --git a/unblocked_terms.txt b/unblocked_terms.txt
index c54d786..e9ad8c2 100644
--- a/unblocked_terms.txt
+++ b/unblocked_terms.txt
@@ -1,3 +1,2 @@
dummy
-master
-slave
\ No newline at end of file
+master
\ No newline at end of file
diff --git a/utility/chromeos-tpm-recovery b/utility/chromeos-tpm-recovery
index ac7dfcc..12616b4 100755
--- a/utility/chromeos-tpm-recovery
+++ b/utility/chromeos-tpm-recovery
@@ -30,9 +30,9 @@
}
use_v0_secdata_kernel() {
- local fwid=$(crossystem ro_fwid)
- local major=$(printf "$fwid" | cut -d. -f2)
- local minor=$(printf "$fwid" | cut -d. -f3)
+ local fwid="$(crossystem ro_fwid)"
+ local major="$(printf "$fwid" | cut -d. -f2)"
+ local minor="$(printf "$fwid" | cut -d. -f3)"
# TPM1 firmware never supports the v1 kernel space format.
if ! tpm2_target; then
