scottk/OpenCellular
1
0
Fork 0
mirror of https://github.com/Telecominfraproject/OpenCellular.git synced 2025-11-24 02:05:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Extend HWID digest into PCR1 (GBB v1.2 only)

Browse Source 
GBB header v1.2 adds a digest of the HWID string to the blob (and
maintains it when updated with the current futility/gbb_utility).

This CL causes VbSelectFirmware() to extend PCR1 with that HWID
digest (only for GBB header v1.2 and later, of course).

Tests are updated.

This also adds a "pcr" command to futility to help determine that
the change is working on the hardware (adds 4K bytes or fewer to
the size of the executable).

BUG=chromium:415714
BRANCH=ToT (and maybe others?)
TEST=make runtests, manual install on HW

To test on hardware, build and update a system with this change
(both the disk image and the RO firmware).

NOTE: The BIOS image must be built in a chroot that is using the
current version of futility. You may need to update your chroot
if your BIOS image still produces v1.1 GBB headers. Check with:

  futility show <firmware_image.bin> | grep -B1 'digest:'

Boot the new system with a new test image, then follow these steps:

Read the BIOS:

  # flashrom -r /tmp/bios.bin

Make sure the GBB has a valid digest for the HWID.

  # futility show /tmp/bios.bin | grep -B1 'digest:'
    HWID:                SAMUS TEST 8028
     digest:             4172d24f40bf72cc0ab8...  <valid>
  #

Extract only the sha1sum-sized part of the HWID digest:

  # futility show /tmp/bios.bin | awk '/digest:/ {print $2}' | colrm 41
  4172d24f40bf72cc0ab878b4c589b8fe9cf4405e
  #

Simulate extending that value in a PCR using the futility "pcr"
command:

  # futility pcr 4172d24f40bf72cc0ab878b4c589b8fe9cf4405e
  PCR: 0000000000000000000000000000000000000000
     + 4172d24f40bf72cc0ab878b4c589b8fe9cf4405e
  PCR: b6e5ffd2d898a7b15236ad22ca25f53ac1f40776
  #

Finally, look at the value of PCR1. It should match the last line
of the futility pcr output:

  # head /sys/class/misc/tpm0/device/pcrs | grep PCR-01
  PCR-01: B6 E5 FF D2 D8 98 A7 B1 52 36 AD 22 CA 25 F5 3A C1 F4 07 76
  #

Change-Id: I09cf855f1a24616cc1a9ddb676670edbc76827d2
Signed-off-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/226408
Reviewed-by: Darren Krahn <dkrahn@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
This commit is contained in:
Bill Richardson
2014-10-22 17:42:20 -07:00
committed by chrome-internal-fetch
parent e1486c3234
commit f4f395e1ca
10 changed files with 411 additions and 126 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
firmware/lib/vboot_api_firmware.c
View File

@@ -45,6 +45,15 @@ VbError_t VbSelectFirmware(VbCommonParams *cparams,
*/
VBDEBUG(("VbSelectFirmware() detected recovery request\n"));
/* Best effort to read the GBB */
cparams->gbb = VbExMalloc(sizeof(*cparams->gbb));
retval = VbGbbReadHeader_static(cparams, cparams->gbb);
if (VBERROR_SUCCESS != retval) {
VBDEBUG(("Can't read GBB. Continuing anyway...\n"));
VbExFree(cparams->gbb);
cparams->gbb = NULL;
}
/* Go directly to recovery mode */
fparams->selected_firmware = VB_SELECT_FIRMWARE_RECOVERY;
} else {
@@ -100,7 +109,8 @@ VbError_t VbSelectFirmware(VbCommonParams *cparams,
* boot. Update the TPM with this state information.
*/
tpm_status = SetTPMBootModeState(is_dev, is_rec,
shared->fw_keyblock_flags);
shared->fw_keyblock_flags,
cparams->gbb);
if (0 != tpm_status) {
VBDEBUG(("Can't update the TPM with boot mode information.\n"));
if (!is_rec) {