b64f097891e697eaf3b2794baae934f8b4d82d14 |
|
29-May-2014 |
Bill Richardson <wfrichar@chromium.org> |
Use the TPM to back up some of the nvram fields We use a few bytes of battery-backed nvram to save some flags across reboots. However if the battery discharges completely, these flags are lost. There aren't any security issues with that since they reset to safe values, but some of the flags are used to configure how the system boots in dev-mode. If a dev-mode user has completely replaced ChromeOS with some other OS, then she often needs to set the dev_boot_usb and/or dev_boot_legacy flags as well in order to boot it using Ctrl-U or Ctrl-L. If the battery dies, then those flags are cleared, and the only way to make the Chromebook boot again is by going through recovery, which wipes the disk. This change uses a new NV space in the TPM to back up some of the nvram flags. These nvram fields will be backed up: block_devmode dev_boot_legacy dev_boot_signed_only dev_boot_usb fwupdate_tries loc_idx Because writing to the TPM space is slow and limited to an unspecified but finite number of cycles, we only back up the fields when specifically requested by the new backup_nvram_request flag. This flag will be set by crossystem whenever it is used to change any of the fields listed above. The backup will be attempted at the NEXT boot (because the TPM is locked after booting), and the backup_nvram_request flag will be cleared if the backup was successfull. Note that this CL is for Top of Trunk only. The firmware will create the required TPM spaces on systems that have never been booted, but we don't yet have a secure or reliable method to update existing systems. FYI, on Link, determining that the TPM's backup NV space doesn't exist adds about 6ms to the boot time. If it does exist, the backup_nvram_request flag is cleared automatically so it won't check until it's set again. BUG=chromium:362105 BRANCH=ToT (only!) TEST=manual Testing this is a long and involved process. Read on... First, there are host-side tests for it. In the chroot: cd src/platform/ec make runtests Second, to test on a completely NEW system that was first booted with a BIOS that contains this CL, do this: Enter dev-mode Use crossystem to set values for the fields listed above Confirm that "backup_nvram_request" is set to 1 Reboot Use crossystem to confirm that "backup_nvram_request" is now 0 Remove the battery and the AC Reattach either battery or AC so it will boot again Use crossystem to confirm that the backed up fields are still good, while the others have been reset to default values Switch to normal mode Remove the battery and the AC Reattach either battery or AC so it will boot again Look at the bios info in chrome://system to see what crossystem says Confirm that the dev_boot_* flags are all 0, while the others are restored Third, to set things up to test this on an existing system (I used Link), you have update the BIOS, delete both the Kernel and Firmware NV spaces in the TPM, then reboot so that the BIOS will create the Backup, Kernel, and Firmware spaces. It will only do that if they're all missing. Open it up, disable write-protect, attach a servo, etc. Switch to dev-mode, log in. Run make_dev_firmware.sh Reboot in recovery mode, and insert a USB stick with a test image on it. NOTE: In order to fiddle with the TPM, we'll *always* have to boot in recovery mode, since that's the only time the TPM is left unlocked. That's NOT the same as pressing Ctrl-U at the scary boot screen. The rest of these steps assume you've booted in recovery mode and are running from the test image on the USB stick. Run make_dev_ssd.sh --remove_rootfs_verification --recovery_key Reboot (recovery mode) Run mv /etc/init/tcsd.conf /etc/init/tcsd.conf.disabled Reboot (recovery mode). Run "tpmc getvf". It should say deactivated 0 disableForceClear 0 physicalPresence 1 physicalPresenceLock 0 bGlobalLock 0 Run "tpmc geto". It should say Owned: no Now you'll need to build the "tpm-nvtool" utility. In the chroot: cd src/third_party/tpm/nvtool make Copy that to the DUT, in /usr/local/bin. Now run tcsd tpm-nvtool --list | grep Index You may see a number of spaces, but you should at least see these: # NV Index 0x00001007 # NV Index 0x00001008 Run tpm_takeownership It will prompt you for two passwords (and confirm each one). Respond with something you can remember like "google". Run tpm-nvtool --release --index 0x1007 --owner_password "google" tpm-nvtool --release --index 0x1008 --owner_password "google" Verify that it worked with tpm-nvtool --list | grep Index Power off. Using servo, flash the new BIOS that has this CL in it. Power on, normally this time (not recovery mode). If all goes well, it should create the correct NV spaces and boot into the SSD. Copy tpm-nvtool into this image too, and run tpm-nvtool --list | grep Index You should now see at least these spaces: # NV Index 0x00001007 # NV Index 0x00001008 # NV Index 0x00001009 Now you're ready to test the backup/recover feature. Change-Id: I00031fa0774720147327e2ae0f37e26b34b86341 Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/202138 Reviewed-by: Luigi Semenzato <semenzato@chromium.org>
/external/vboot_reference/firmware/lib/mocked_rollback_index.c
|
53710471b5e4fcfa83ccb628604819078b630a99 |
|
09-Aug-2013 |
Duncan Laurie <dlaurie@chromium.org> |
vboot: fix mocked TPM build These function prototypes changed recently and the mocked driver is not building any longer. BUG=none BRANCH=none TEST=successful build with MOCK_TPM=1 Change-Id: Iaaf2d2c2883add7a478d7ee887b06e45c65e1bb2 Signed-off-by: Duncan Laurie <dlaurie@chromium.org> Reviewed-on: https://gerrit.chromium.org/gerrit/65338 Reviewed-by: Stefan Reinauer <reinauer@google.com> Reviewed-by: Bill Richardson <wfrichar@chromium.org>
/external/vboot_reference/firmware/lib/mocked_rollback_index.c
|
472d93c146403c0f95b656e182b972e15ff11835 |
|
23-Jul-2013 |
Shawn Nematbakhsh <shawnn@chromium.org> |
rollback_index: Remove recovery_mode parameter to SetupTPM. SetupTPM no longer uses recovery_mode parameter for anything other than a debug print. This change moves the debug print to a caller function, then removes recovery_mode from SetupTPM and some caller functions that no longer have a use for it. BUG=chrome-os-partner:20913. TEST=Manual. Boot factory install shim in recovery mode and verify TPM clear operations succeed. Boot in dev mode and verify "Lock physical presence" print on UART. BRANCH=None. Signed-off-by: Shawn Nematbakhsh <shawnn@chromium.org> Change-Id: I2f671f6680a6e67cf722855e659e99752bc0783c Reviewed-on: https://gerrit.chromium.org/gerrit/62916 Reviewed-by: Randall Spangler <rspangler@chromium.org>
/external/vboot_reference/firmware/lib/mocked_rollback_index.c
|
964144bf2f3befe8c8a010000439cb5e5dccf00d |
|
22-Jul-2013 |
Shawn Nematbakhsh <shawnn@chromium.org> |
rollback_index: Add recovery parameter to RollbackKernelLock. RollbackKernelLock previously checked a global to determine recovery mode state. Since we have two copies of vboot_reference in firmware (in coreboot and depthcharge), this creates a problem with synchronization. Remove the global entirely and instead pass the recovery state to RollbackKernelLock. BUG=chrome-os-partner:20913. TEST=Manual. Boot factory install shim in recovery mode and verify TPM clear operations succeed. Boot in dev mode and verify "Lock physical presence" print on UART. BRANCH=FalcoPeppy. Signed-off-by: Shawn Nematbakhsh <shawnn@chromium.org> Change-Id: I4e751d4a9ca60cd57c5c662ce86eba595fb22ba2 Reviewed-on: https://gerrit.chromium.org/gerrit/62874 Reviewed-by: Aaron Durbin <adurbin@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
/external/vboot_reference/firmware/lib/mocked_rollback_index.c
|
0c3ba249abb1dc60f5ebabccf84ff13206440b83 |
|
29-Mar-2013 |
Bill Richardson <wfrichar@chromium.org> |
Massive refactoring of external header files. This reduces the number of exported header files to the minimum needed by the existing userspace utilities and firmware implementations. BUG=chromium:221544 BRANCH=none TEST=manual, trybots CQ-DEPEND=CL:47019,CL:47022,CL:47023 sudo FEATURES=test emerge vboot_reference FEATURES=test emerge-$BOARD \ vboot_reference \ chromeos-cryptohome \ chromeos-installer \ chromeos-u-boot \ peach-u-boot \ depthcharge Change-Id: I2946cc2dbaf5459a6c5eca92ca57d546498e6d85 Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://gerrit.chromium.org/gerrit/47021 Reviewed-by: Randall Spangler <rspangler@chromium.org>
/external/vboot_reference/firmware/lib/mocked_rollback_index.c
|
29e8807ea045e119e3adeaec40c5f8421901b6fb |
|
19-Jun-2012 |
Randall Spangler <rspangler@chromium.org> |
Add clear TPM owner request This adds two new flags to crossystem: clear_tpm_owner_request clear_tpm_owner_done The first one requests that the firmware clear the TPM owner on the next boot. When the firmware does this, it will set clear_tpm_owner_request=0, and set clear_tpm_owner_done=1. The OS can use the done-flag as a hint that trusted things guarded by the TPM are no longer trustable. BUG=chromium-os:31974 TEST=manual crossystem // both flags initially 0 crossystem clear_tpm_owner_request=1 crossystem clear_tpm_owner_done=1 // request=1, done=0; done can be cleared but not set by crossystem reboot tpmc getownership // owned=no crossystem // request=0, done=1 crossystem clear_tpm_owner_done=0 crossystem // both flags 0 again Signed-off-by: Randall Spangler <rspangler@chromium.org> Change-Id: I49f83f3c39c3efc3945116c51a241d255c2e42cd Reviewed-on: https://gerrit.chromium.org/gerrit/25646
/external/vboot_reference/firmware/lib/mocked_rollback_index.c
|
71b126ba46c3b2fda3007dc0dd24a9f74adab604 |
|
09-Jun-2012 |
Mike Frysinger <vapier@chromium.org> |
add SetVirtualDevMode stub Fixes build failure seen in u-boot for tegra2 seaboard: .../vboot_fw.a(vboot_api_kernel.o): In function 'VbConfirmChangeDevMode': (.text+0x84): undefined reference to 'SetVirtualDevMode' BUG=None TEST=`emerge-tegra2_seaboard chromeos-u-boot` works again Change-Id: If374a78218fc8a7921ff8dddde163138969e0876 Reviewed-on: https://gerrit.chromium.org/gerrit/24948 Commit-Ready: Mike Frysinger <vapier@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org> Tested-by: Mike Frysinger <vapier@chromium.org>
/external/vboot_reference/firmware/lib/mocked_rollback_index.c
|
1efd9e6539ecc96d7c3904456ef4092599fc8461 |
|
09-Jun-2012 |
Mike Frysinger <vapier@chromium.org> |
add extra param to mocked SetupTPM Previous commit missed this file. BUG=None TEST=None Change-Id: Id29e3291d4843f5ace71c2eedf7f91ee04df62d5 Reviewed-on: https://gerrit.chromium.org/gerrit/24944 Reviewed-by: Bill Richardson <wfrichar@chromium.org> Commit-Ready: Mike Frysinger <vapier@chromium.org> Tested-by: Mike Frysinger <vapier@chromium.org>
/external/vboot_reference/firmware/lib/mocked_rollback_index.c
|
ec8df1628cd9cf236bf912dee7d4365d7977e697 |
|
07-Jun-2012 |
Bill Richardson <wfrichar@chromium.org> |
Support virtual dev-switch (keyboard-based dev-mode) BUG=chrome-os-partner:9706 TEST=manual Currently, Link is the only platform that enables this feature. To enter dev-mode: Boot into recovery mode using the magic key chord. At the Insert screen, press Ctrl-D. You'll be asked if you want to enter developer mode. If you then press ENTER, it will reboot with dev-mode enabled. If you press SPACE or ESC, it will return to the Insert screen. If you enter recovery mode through any other means, or if dev-mode is already enabled, pressing Ctrl-D at the Insert screen will have no effect. To return to normal mode: Reboot. At the Dev screen, press ENTER or SPACE. It will reboot to recovery mode and ask you if you want to return to normal mode. If you press ESC or power off, you'll still be in dev-mode. Press ENTER or SPACE, and it will reboot into normal mode (of course, if you've messed up your images while in dev-mode, you'll just come right back to recovery mode again). You can also request a direct return to normal mode by running crossystem disable_dev_request=1 and rebooting. Change-Id: I435905855a6c39932ee466cc046bdc4c4c860f98 Reviewed-on: https://gerrit.chromium.org/gerrit/24160 Tested-by: Bill Richardson <wfrichar@chromium.org> Reviewed-by: Bill Richardson <wfrichar@chromium.org> Commit-Ready: Bill Richardson <wfrichar@chromium.org>
/external/vboot_reference/firmware/lib/mocked_rollback_index.c
|
b75d8adcc01f08cf5a6d87b78aeb1d7cdfcd22af |
|
17-May-2012 |
Bill Richardson <wfrichar@chromium.org> |
Use virtual dev-mode switch when told to. If VbInit() is instructed to look at a virtual dev-mode switch, then it will use value contained in the TPM's firmware space instead of a hardware GPIO to determine if developer mode is enabled. This change just makes it look. It doesn't provide a way to actually set the value in the TPM. VbInit() isn't being told to look yet, either. Those changes are coming. BUG=chrome-os-partner:9706 TEST=none The usual sanity-check applies: make make runtests But to actually test that this stuff is working IRL requires special tweaks to other components and monitoring the serial debug output from both EC and CPU. We'll save the hands-on tests for when it's all done. Change-Id: Ie485ad2180224e192238bf2a5dbf95bbcb9130f9 Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://gerrit.chromium.org/gerrit/23067 Reviewed-by: Randall Spangler <rspangler@chromium.org>
/external/vboot_reference/firmware/lib/mocked_rollback_index.c
|
22e7bb2b8e73614d7171cc8d1d51c9bd21f22f54 |
|
22-Jul-2011 |
Randall Spangler <rspangler@chromium.org> |
Refactor TPM calls into vboot wrapper Try #2, now that ARM has the fix from http://gerrit.chromium.org/gerrit/4667 This cleans up the TPM calls inside vboot_reference. * TPM calls share mode code between boot modes. * Better handling for TPM_E_MUST_REBOOT, particularly in recovery mode. * TAB screen shows current TPM versions. No changes required to the wrapper API; these changes are internal to vboot. BUG=chromium-os:18084 TEST=make && make runtests; built for both alex and tegra2-seaboard Original-Change-Id: I2a52066f2889210af83409872b10f9d6380470af (cherry picked from commit da55560cddcf7a1aa8a881cdf52792a21a01e766) Change-Id: I120797145772116f09b8125b9e56fdbb11dc16b3 Reviewed-on: http://gerrit.chromium.org/gerrit/4671 Tested-by: Randall Spangler <rspangler@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
/external/vboot_reference/firmware/lib/mocked_rollback_index.c
|
64b2ba41cc5b9125c78b6372eb7f9ed51f4b65a6 |
|
25-Jul-2011 |
Elly Jones <ellyjones@chromium.org> |
Revert "Refactor TPM calls into vboot wrapper" This reverts commit da55560cddcf7a1aa8a881cdf52792a21a01e766. This commit caused http://build.chromium.org/p/chromiumos/builders/arm%20tegra2%20binary/builds/6301 to fail. Change-Id: Ie132c1e600ab28f97337ecfe0e7cff053987717d Reviewed-on: http://gerrit.chromium.org/gerrit/4661 Reviewed-by: Elly Jones <ellyjones@chromium.org> Tested-by: Elly Jones <ellyjones@chromium.org>
/external/vboot_reference/firmware/lib/mocked_rollback_index.c
|
4bc713d0df70117a6459fb1ac0ca248eef774c66 |
|
22-Jul-2011 |
Randall Spangler <rspangler@chromium.org> |
Refactor TPM calls into vboot wrapper This cleans up the TPM calls inside vboot_reference. * TPM calls share mode code between boot modes. * Better handling for TPM_E_MUST_REBOOT, particularly in recovery mode. * TAB screen shows current TPM versions. No changes required to the wrapper API; these changes are internal to vboot. BUG=chromium-os:18084 TEST=make && make runtests; built for both alex and tegra2-seaboard Change-Id: I2a52066f2889210af83409872b10f9d6380470af Reviewed-on: http://gerrit.chromium.org/gerrit/4611 Reviewed-by: Bill Richardson <wfrichar@chromium.org> Reviewed-by: Gaurav Shah <gauravsh@chromium.org> Tested-by: Randall Spangler <rspangler@chromium.org>
/external/vboot_reference/firmware/lib/mocked_rollback_index.c
|
8511f7891b5eca7ae93a147964201a4b57210ff6 |
|
22-Apr-2011 |
Che-Liang Chiou <clchiou@chromium.org> |
Add option to use mocked TPM driver Some ARM boards, such as Seaboard, have buggy TPM chip that bricks the borad. This commit adds a option to use mocked TPM driver. R=rongchang@chromium.org,rspangler@chromium.org,wad@chromium.org BUG=chromium-os:14239 TEST=Run verified boot on Seaboard Review URL: http://codereview.chromium.org/6883040 Change-Id: Iae6133f081c2e3d9daa4e14bb711550e2658e9df
/external/vboot_reference/firmware/lib/mocked_rollback_index.c
|