scottk/OpenCellular
1
0
Fork 0
mirror of https://github.com/Telecominfraproject/OpenCellular.git synced 2025-11-24 02:05:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add VbSharedData field parsing

Browse Source 
R=reinauer@chromium.org
BUG=chrome-os-partner:2578
TEST=manual

crossystem vdat_timers
should show 'LFS=0,0 LF=number1,number2 LK=number3,number4'
where number1 < number2 < number3 < number4

crossystem vdat_lfdebug
run from a dev mode console, should show
'check=12,0 index=0x00 tpmver=(hex number) lowestver=(hex number)'

crossystem vdat_flags
run from a dev mode console, flags should be 0x04.

Review URL: http://codereview.chromium.org/6685068

Change-Id: Id7b958ae300d10cdcdc1b17a1bb17b7e5069166f
This commit is contained in:
Randall Spangler
2011-03-17 16:10:21 -07:00
parent 83c3714ed3
commit f4ba19d81d
8 changed files with 227 additions and 98 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
firmware/lib/vboot_firmware.c
View File

@@ -109,6 +109,8 @@ int LoadFirmware(LoadFirmwareParams* params) {
/* Parse flags */
is_dev = (params->boot_flags & BOOT_FLAG_DEVELOPER ? 1 : 0);
if (is_dev)
shared->flags |= VBSD_LF_DEV_SWITCH_ON;
/* Initialize the TPM and read rollback indices. */
VBPERFSTART("VB_TPMI");
@@ -122,12 +124,15 @@ int LoadFirmware(LoadFirmwareParams* params) {
recovery = VBNV_RECOVERY_RO_TPM_ERROR;
goto LoadFirmwareExit;
}
shared->fw_version_tpm_start = tpm_version;
VBPERFEND("VB_TPMI");
/* Read try-b count and decrement if necessary */
VbNvGet(vnc, VBNV_TRY_B_COUNT, &try_b_count);
if (0 != try_b_count)
if (0 != try_b_count) {
VbNvSet(vnc, VBNV_TRY_B_COUNT, try_b_count - 1);
shared->flags |= VBSD_FWB_TRIED;
}
VbNvSet(vnc, VBNV_TRIED_FIRMWARE_B, try_b_count ? 1 : 0);
/* Allocate our internal data */
@@ -146,15 +151,18 @@ int LoadFirmware(LoadFirmwareParams* params) {
uint64_t key_version;
uint64_t combined_version;
uint8_t* body_digest;
uint8_t* check_result;
/* If try B count is non-zero try firmware B first */
index = (try_b_count ? 1 - i : i);
if (0 == index) {
key_block = (VbKeyBlockHeader*)params->verification_block_0;
vblock_size = params->verification_size_0;
check_result = &shared->check_fw_a_result;
} else {
key_block = (VbKeyBlockHeader*)params->verification_block_1;
vblock_size = params->verification_size_1;
check_result = &shared->check_fw_b_result;
}
/* Check the key block flags against the current boot mode. Do this
@@ -164,11 +172,13 @@ int LoadFirmware(LoadFirmwareParams* params) {
(is_dev ? KEY_BLOCK_FLAG_DEVELOPER_1 :
KEY_BLOCK_FLAG_DEVELOPER_0))) {
VBDEBUG(("Developer flag mismatch.\n"));
*check_result = VBSD_LF_CHECK_DEV_MISMATCH;
continue;
}
/* RW firmware never runs in recovery mode. */
if (!(key_block->key_block_flags & KEY_BLOCK_FLAG_RECOVERY_0)) {
VBDEBUG(("Recovery flag mismatch.\n"));
*check_result = VBSD_LF_CHECK_REC_MISMATCH;
continue;
}
@@ -176,6 +186,7 @@ int LoadFirmware(LoadFirmwareParams* params) {
VBPERFSTART("VB_VKB");
if ((0 != KeyBlockVerify(key_block, vblock_size, root_key, 0))) {
VBDEBUG(("Key block verification failed.\n"));
*check_result = VBSD_LF_CHECK_VERIFY_KEYBLOCK;
VBPERFEND("VB_VKB");
continue;
}
@@ -185,6 +196,7 @@ int LoadFirmware(LoadFirmwareParams* params) {
key_version = key_block->data_key.key_version;
if (key_version < (tpm_version >> 16)) {
VBDEBUG(("Key rollback detected.\n"));
*check_result = VBSD_LF_CHECK_KEY_ROLLBACK;
continue;
}
@@ -192,6 +204,7 @@ int LoadFirmware(LoadFirmwareParams* params) {
data_key = PublicKeyToRSA(&key_block->data_key);
if (!data_key) {
VBDEBUG(("Unable to parse data key.\n"));
*check_result = VBSD_LF_CHECK_DATA_KEY_PARSE;
continue;
}
@@ -203,6 +216,7 @@ int LoadFirmware(LoadFirmwareParams* params) {
vblock_size - key_block->key_block_size,
data_key))) {
VBDEBUG(("Preamble verfication failed.\n"));
*check_result = VBSD_LF_CHECK_VERIFY_PREAMBLE;
RSAPublicKeyFree(data_key);
VBPERFEND("VB_VPB");
continue;
@@ -214,10 +228,14 @@ int LoadFirmware(LoadFirmwareParams* params) {
(preamble->firmware_version & 0xFFFF));
if (combined_version < tpm_version) {
VBDEBUG(("Firmware version rollback detected.\n"));
*check_result = VBSD_LF_CHECK_FW_ROLLBACK;
RSAPublicKeyFree(data_key);
continue;
}
/* Header for this firmware is valid */
*check_result = VBSD_LF_CHECK_HEADER_VALID;
/* Check for lowest key version from a valid header. */
if (lowest_version > combined_version)
lowest_version = combined_version;
@@ -234,6 +252,7 @@ int LoadFirmware(LoadFirmwareParams* params) {
lfi->body_size_accum = 0;
if (0 != GetFirmwareBody(params, index)) {
VBDEBUG(("GetFirmwareBody() failed for index %d\n", index));
*check_result = VBSD_LF_CHECK_GET_FW_BODY;
RSAPublicKeyFree(data_key);
VBPERFEND("VB_RFD");
continue;
@@ -242,6 +261,7 @@ int LoadFirmware(LoadFirmwareParams* params) {
VBDEBUG(("Hash updated %d bytes but expected %d\n",
(int)lfi->body_size_accum,
(int)preamble->body_signature.data_size));
*check_result = VBSD_LF_CHECK_HASH_WRONG_SIZE;
RSAPublicKeyFree(data_key);
VBPERFEND("VB_RFD");
continue;
@@ -253,6 +273,7 @@ int LoadFirmware(LoadFirmwareParams* params) {
body_digest = DigestFinal(&lfi->body_digest_context);
if (0 != VerifyDigest(body_digest, &preamble->body_signature, data_key)) {
VBDEBUG(("Firmware body verification failed.\n"));
*check_result = VBSD_LF_CHECK_VERIFY_BODY;
RSAPublicKeyFree(data_key);
Free(body_digest);
VBPERFEND("VB_VFD");
@@ -266,6 +287,7 @@ int LoadFirmware(LoadFirmwareParams* params) {
/* If we're still here, the firmware is valid. */
VBDEBUG(("Firmware %d is valid.\n", index));
*check_result = VBSD_LF_CHECK_VALID;
if (-1 == good_index) {
/* Save the key we actually used */
if (0 != VbSharedDataSetKernelKey(shared, &preamble->kernel_subkey)) {
@@ -312,6 +334,7 @@ int LoadFirmware(LoadFirmwareParams* params) {
if (good_index >= 0) {
/* Update TPM if necessary */
shared->fw_version_lowest = (uint32_t)lowest_version;
if (lowest_version > tpm_version) {
VBPERFSTART("VB_TPMU");
status = RollbackFirmwareWrite((uint32_t)lowest_version);
@@ -341,6 +364,7 @@ int LoadFirmware(LoadFirmwareParams* params) {
/* Success */
VBDEBUG(("Will boot firmware index %d\n", (int)params->firmware_index));
shared->firmware_index = (uint8_t)params->firmware_index;
retval = LOAD_FIRMWARE_SUCCESS;
} else {
/* No good firmware, so go to recovery mode. */