rk3399 systems need terminations on the SPI signals in S3 and all other
low power states. Add support for enabling the pulldowns and pullups on
the correct pins.
With this change, if BOARD_NEEDS_S3_TERM is set in the board properties,
cr50 will enable a pulldown on the AP TX Cr50 RX signal and a pulldown
on all of the SPS signals. To keep the pulldowns from interfering with
the sps peripheral, s3_term will also disable the input for those
signals.
BUG=b:62200096
BRANCH=cr50
TEST=Flash onto bob. Make sure cr50 enables and disables terminations
when the AP suspends/resumes. Flash onto reef. Make sure it doesn't do
anything.
Change-Id: I4adaf6d66160bab1eb3cf3d343d4a79524ccf883
Signed-off-by: Mary Ruthven <mruthven@google.com>
Reviewed-on: https://chromium-review.googlesource.com/991338
Commit-Ready: Mary Ruthven <mruthven@chromium.org>
Tested-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
(cherry picked from commit cfcac78e62)
Reviewed-on: https://chromium-review.googlesource.com/1015618
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
The ISO7816-4 standard for APDU format says the APDU header minimum size
is 4 bytes (CLA, INS, P1, P2). The Lc field is absent if the command has
no data.
Update the size check to accept short APDU (the actual APDU
len was already computed properly for this case).
Signed-off-by: Vincent Palatin <vpalatin@chromium.org>
BRANCH=cr50
BUG=b:72788497
TEST=adhoc
Change-Id: Ic60fa51bd4746b04016c488a38fe3ae7585e9942
Reviewed-on: https://chromium-review.googlesource.com/1005345
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
(cherry picked from commit 209f47b692)
Reviewed-on: https://chromium-review.googlesource.com/1015617
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
The Cheza EC requires EC_RX_H1_TX be held low while the EC is being
reset to enter gang mode. This change adds another programming mode to
ec usb spi programming to do that.
BUG=b:74388083
BRANCH=cr50
TEST=The cheza boards aren't in, so I just tested EC_TX_CR50_RX_OUT
gpioset EC_TX_OUT 0 and 1 setup EC_TX_CR50_RX_OUT correctly as an
output when asserted and an input when deasserted.
Change-Id: I7fc9cba954f2af5a841f00ce5bf8a27251b33bbe
Signed-off-by: Mary Ruthven <mruthven@google.com>
Reviewed-on: https://chromium-review.googlesource.com/1003529
Commit-Ready: Mary Ruthven <mruthven@chromium.org>
Tested-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
(cherry picked from commit b0f79a7044)
Reviewed-on: https://chromium-review.googlesource.com/1015616
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
It is important for the OS to be able to find out the state of CCD and
current capabilities settings of the device.
This patch defines a structure to use to report information about CCD
state from Cr50 to the host and adds a CCD vendor subcommand to allow
to retrieve the information from Cr50.
Some structure and variable definitions had to be moved into the .h
file to make it possible to share them between Cr50 and gsctool.
BRANCH=cr50, cr50-mp
BUG=b:72718383
TEST=with the following patch applied verified that CCD info is
properly reported. Also verified that other CCD subcommands still
work as advertised.
Change-Id: I4a783e6817ed364b9e64522ebbe968d4a657a84c
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/999825
Reviewed-by: Randall Spangler <rspangler@chromium.org>
(cherry picked from commit c3077e63e5)
Reviewed-on: https://chromium-review.googlesource.com/1015615
The upcoming cr50-codesigner change will allow to use it for swapping
arbitrary blobs in the Cr50 image before signing.
Let's use this feature to replace test RMA public key with the prod
one.
BRANCH=cr50, cr50-mp
BUG=b:73296144
TEST=with the rest of the patches in place verified that invoking make
with CR50_SWAP_RMA_KEYS=1 causes swapping the RMA public key in
the generated image.
Change-Id: I4c9994c1a542f456b24d2066ecada9f92f1bfaf3
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/996514
Reviewed-by: Randall Spangler <rspangler@chromium.org>
(cherry picked from commit 03cc82b93b)
Reviewed-on: https://chromium-review.googlesource.com/1015614
Swapping binary blobs in the image post compilation/linking is not
working quite as expected, because some of the const data values seem
to be inlined by the compiler, the values are not looked up at run
time.
This happens to the RMA public key ID field, which is just one byte in
size. Marking the field 'volatile' seems to be fixing the issue.
BRANCH=cr50, cr50-mp
BUG=b:73296144
TEST=with the rest of the patches applied public key substitution
between test and prod works as expected.
Change-Id: I12d5d1243e7988ab59bf3bba8cdfa46f27116bd2
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/996513
Reviewed-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-by: Andrey Pronin <apronin@chromium.org>
(cherry picked from commit 8f27e60d82)
Reviewed-on: https://chromium-review.googlesource.com/1015613
Use RMA public key definition generated based on the binary blob
containing the key and key ID.
Key generation is controlled by the make file in common/, but actual
key blob comes from the board directory.
The structure holding the key and key ID is being modified to allow
initialization using a flat array.
No more need in defining CONFIG_RMA_AUTH_SERVER_PUBLIC_KEY and
CONFIG_RMA_AUTH_SERVER_KEY_ID.
Conflicts:
common/build.mk
BRANCH=cr50, cr50-mp
BUG=b:73296144, b:74100307
TEST='make buildall' still succeeds.
test RMA server generated authentication codes are accepted when
unlocking RMA.
Change-Id: I8ade94de6eb69b3e49bc5b948dbac20e59962acf
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/990783
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Vincent Palatin <vpalatin@chromium.org>
(cherry picked from commit f2eac533dc)
Reviewed-on: https://chromium-review.googlesource.com/1015612
This patch brings in both prod and test RMA server public keys as two
binary files.
A bash script for converting binary blob into C definition is also
provided.
BRANCH=cr50, cr50-mp
BUG=b:73296144, b:74100307
TEST=none yet
Change-Id: I2edd78164b8c912408ac7eda2e0a3a0262a8e81f
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/990782
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Vincent Palatin <vpalatin@chromium.org>
(cherry picked from commit 44c81deec4)
Reviewed-on: https://chromium-review.googlesource.com/1015611
We want to be able to replace RMA public key and its key ID in the elf
module before signing. Let's make sure they are packed together for
ease of find and replace operation.
BRANCH=cr50, cr50-mp
BUG=b:73296144
TEST=built an image, verified that RMA unlock still works.
Change-Id: I1a8e155391421f32b7422f11ab2a5f53d1ddd0ac
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/990781
Reviewed-by: Randall Spangler <rspangler@chromium.org>
(cherry picked from commit 8131eea9a7)
Reviewed-on: https://chromium-review.googlesource.com/1015609
Use the reset count to determine if there was a rollback in
system_rollback_detected. Before system.c was checking if the inactive
header was newer than active one to determine if the system rolled back.
This wasn't accurate. Cr50 rollback isn't the only reason why a newer
image may be rejected. The image may have been rejected because it
wasn't signed correctly or it's corrupted, so we shouldn't be using the
newer header as a sign that there was a rollback.
The reset count is cleared when the AP boots. This means the rollback
state will be lost the first deep sleep resume after the AP has booted.
BUG=none
BRANCH=cr50
TEST=manual
flash a dbg image with version 4.0 that has two infomap bits
erased.
Check sysinfo to see that it doesn't think cr50 rolledback
flash a dbg image with version 4.4 that has one infomap bit
erased.
Make sure that 4.4 image is rejected and cr50 is still running
4.0
Check sysinfo to see that it doesn't think cr50 rolledback
flash a dbg image with version 4.4 that has two infomap bits
erased.
Make sure cr50 jumps to that image
rollback to the 4.0 image
Make sure sysinfo shows there was a rollback.
Boot the system
Make sure sysinfo shows there was a rollback.
Change-Id: I85f2e001ffed9e2185a276dfa916e9b0a05ff7bf
Signed-off-by: Mary Ruthven <mruthven@google.com>
Reviewed-on: https://chromium-review.googlesource.com/985029
Commit-Ready: Mary Ruthven <mruthven@chromium.org>
Tested-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
(cherry picked from commit 7a756993ea)
Reviewed-on: https://chromium-review.googlesource.com/1015608
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
system_rollback_detected is used to determine if the system rolledback
in the rest of the system code base and it's state is saved longer. This
change switches board.c to use that to determine the sysinfo output
instead of using the reset count.
The reset count is cleared when the system boots. Depending on how fast
the system boots it may be difficult to read sysinfo before the reset
counter is cleared. In these cases it is difficult to tell whether an
image has been rejected entirely or the image caused a rollback.
BUG=b:71804463
BRANCH=cr50
TEST=boot the device. Make sure sysinfo shows there's no rollback.
Rollback and make sure sysinfo shows the system has rolledback
Change-Id: Ic29b105c758d0984e47482b9384cf00fe202b716
Signed-off-by: Mary Ruthven <mruthven@google.com>
Reviewed-on: https://chromium-review.googlesource.com/984393
Commit-Ready: Mary Ruthven <mruthven@chromium.org>
Tested-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
(cherry picked from commit ed13cb82b6)
Reviewed-on: https://chromium-review.googlesource.com/1015607
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
Use the stream signing mechanism to hook outgoing spiflash content.
This is (only?) used by Mn50 during chip production flows.
BUG=None
BRANCH=none
TEST=make buildall -j8
Signed-off-by: mschilder@google.com
Change-Id: Iccfee173865f587f088a31fcbc7b939823884c31
Reviewed-on: https://chromium-review.googlesource.com/981892
Commit-Ready: Marius Schilder <mschilder@chromium.org>
Tested-by: Marius Schilder <mschilder@chromium.org>
Reviewed-by: Marius Schilder <mschilder@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
(cherry picked from commit 62cd2cb56c)
Reviewed-on: https://chromium-review.googlesource.com/1015606
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
Cr50 lacks native instructions for 64-bit integers and an ABI
function can be used by the compiler to take the place of the
needed instructions. This CL adds support for a right bitwise
shift of 64-bit integers.
BRANCH=none
BUG=chromium:794010
TEST=Set CONFIG_LLSR_TEST, build, update cr50, and run llsrtest
on the console.
Change-Id: Iae66c86720c531454ba29f15b3cc6a07959f5ef2
Signed-off-by: Allen Webb <allenwebb@google.com>
Reviewed-on: https://chromium-review.googlesource.com/931932
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
(cherry picked from commit 6719bdf3ed)
Reviewed-on: https://chromium-review.googlesource.com/969632
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
When checking the RMA authentication code the code currently just
verifies the value, but does not act on it.
This patch directs the user input through the same vendor command path
which is used when the RMA operation is controlled using gsctool.
BRANCH=cr50, cr50-mp
BUG=b:74080723
TEST=verified that issuing 'rma_auth <code>' on the Cr50 console now
trigger CCD open and reboot.
Change-Id: Ib3fab131b6a24b65618f0b1f2504638f8df11a4b
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/945311
Reviewed-by: Randall Spangler <rspangler@chromium.org>
(cherry picked from commit f6b72676a0)
Reviewed-on: https://chromium-review.googlesource.com/969631
Set GscFullConsole to Always in RMA open. We need this to be accessible
after rma open, so that we can use RMA open as a ccd open testlab
replacement.
Commands like rddkeepalive and bitbang are needed for testlab use, so
they should be accessible after open.
BUG=b:74019846
BRANCH=cr50, cr50-mp
TEST=build, do rma open, verify commands are not locked out, and do rma
disable
Change-Id: Iaeb89cea94d478dc0eb25c92bb09d488d14cad41
Signed-off-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/942309
Reviewed-by: Randall Spangler <rspangler@chromium.org>
(cherry picked from commit 097f5e6a0b)
Reviewed-on: https://chromium-review.googlesource.com/969630
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
The shmem console command was looping with the wrong iterators,
doing an infinite loop when there was more than one allocated or
free block.
Signed-off-by: Vincent Palatin <vpalatin@chromium.org>
BRANCH=none
BUG=none
TEST=build software with CONFIG_MALLOC and CONFIG_CMD_SHMEM, then run
'shmem' on the console at different time without hitting watchdog reset.
Change-Id: I93a9cff3811669ab895fa8753d1571e90aeb4f33
Reviewed-on: https://chromium-review.googlesource.com/943070
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
(cherry picked from commit f917f447d7)
Reviewed-on: https://chromium-review.googlesource.com/969629
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
This will make sure that Cr50 images built from dev branch can take
over images built from either MP or pre-MP branches.
BRANCH=none
BUG=none
TEST=verified that it is possible to overwrite pre-MP Cr50 version of
0.2.2.
Change-Id: I929cb2be857ea90c544f83160d6820c73e23c69d
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/938946
Reviewed-by: Mary Ruthven <mruthven@chromium.org>
(cherry picked from commit 5bab2ee13d)
Reviewed-on: https://chromium-review.googlesource.com/942483
When running w/ blocking usb console output
(CONFIG_USB_CONSOLE_CRC) and the host is not polling the console,
upgrade will fail.
Signed-off-by: mschilder@google.com
TEST=buildall -j8; gsctool update succeeds on mn50
BRANCH=none
BUG=none
Change-Id: I5c09694c146ba0fbf7562b86ab0fad0d578bc5ff
Reviewed-on: https://chromium-review.googlesource.com/938392
Commit-Ready: Marius Schilder <mschilder@chromium.org>
Tested-by: Marius Schilder <mschilder@chromium.org>
Reviewed-by: Marius Schilder <mschilder@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
(cherry picked from commit ab706d65fd)
Reviewed-on: https://chromium-review.googlesource.com/942482
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
This field allows multiple product families to be independently versioned
and released, without risk of having one product family's image flashed
to another product family's chip.
BUG=b:73728151
BRANCH=none
TEST=make buildall -J
Change-Id: I53f5e5b1e9ac7ea19997f8d1228a568e66c43d39
Reviewed-on: https://chromium-review.googlesource.com/935759
Commit-Ready: Jeff Andersen <jeffandersen@google.com>
Tested-by: Jeff Andersen <jeffandersen@google.com>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-by: Nadim Taha <ntaha@google.com>
(cherry picked from commit 3b2fec7700)
Reviewed-on: https://chromium-review.googlesource.com/942481
Reviewed-by: Jeff Andersen <jeffandersen@google.com>
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
This option will cause usb console output to block and
also compute a crc32.
Signed-off-by: mschilder@google.com
TEST=make buildall -j
BRANCH=none
BUG=none
Change-Id: Icf66d5ddbea52008a9c97094e7c83194caa7db79
Reviewed-on: https://chromium-review.googlesource.com/936281
Commit-Ready: Marius Schilder <mschilder@chromium.org>
Tested-by: Marius Schilder <mschilder@chromium.org>
Reviewed-by: Marius Schilder <mschilder@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
(cherry picked from commit e5e1b7ea5d)
Reviewed-on: https://chromium-review.googlesource.com/942120
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
CONFIG_IGNORE_G_UPDATE_CHECKS currently drops all upgrade checks.
Now with CONFIG_BOARD_ID_SUPPORT only check for board_id match.
CR50_DEV still retains full no check behavior.
TEST=buildall -j8
BRANCH=none
BUG=none
Change-Id: I0d085a26c814cd0f35450f0a0db06fe8525ab896
Reviewed-on: https://chromium-review.googlesource.com/933589
Commit-Ready: Marius Schilder <mschilder@chromium.org>
Tested-by: Marius Schilder <mschilder@chromium.org>
Reviewed-by: Marius Schilder <mschilder@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
(cherry picked from commit 25e8bc3efd)
Reviewed-on: https://chromium-review.googlesource.com/942118
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
When running the spihash command using gsctool (as opposed to the
running it from the Cr50 console), the operator needs to be prompted
when the PP button needs to be pressed.
This patch extends spihash command implementation by adding a new
subcommand for polling physical presence.
BRANCH=cr50, cr50-mp
BUG=b:73668125
TEST=with the appropriate gsctool changes the user is periodically
prompted to press the physical presence button, and eventually it
is possible to set up spi hash access to AP and EC.
Change-Id: I96aed1619d364c80a2f35ca8dc41241f1a444103
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/930568
Reviewed-by: Randall Spangler <rspangler@chromium.org>
(cherry picked from commit d015bc937c)
Reviewed-on: https://chromium-review.googlesource.com/942117
Various parts of Cr50 code and Cr50 related utilities duplicate
definition of __packed available in include/common.h. Let's use the
same definition everywhere.
BRANCH=cr50, cr50-mp
BUG=none
TEST=make buildall succeeds
verified that linker generated map files for Cr50 RW are the same
before and after this change.
built and used gsctoo and rma_reset
Change-Id: Ib91f9bbad1f6822b347f32b393630f592df80d60
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/931929
Reviewed-by: Randall Spangler <rspangler@chromium.org>
(cherry picked from commit 58759f5fbb)
Reviewed-on: https://chromium-review.googlesource.com/942116
Execution of this command requires physical presence on the DUT, this
is why it is save to allow it over USB.
BRANCH=cr50, cr50-mp
BUG=chromium:812880
TEST=using modified gsctool verified that the command goes through and
physical presence indication is requested
Change-Id: I0aa371d8aaa5a480cc12d5d16edad8497142f4b4
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/927796
Reviewed-by: Mary Ruthven <mruthven@chromium.org>
(cherry picked from commit 53ca6cfbdf)
Reviewed-on: https://chromium-review.googlesource.com/942115
Cr50 cannot override the state of the power button. It was possible with
dev cr50 chips, but the capability was removed in prod chips. Change the
console command, so it is only used to get the state of the power
button.
Remove all of the commands used to override the power button.
BUG=b:73557298
BRANCH=none
TEST=none
Change-Id: I99cb5e8a18dd972fba460c434364702f06a26305
Signed-off-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/926964
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
(cherry picked from commit 64a4e6b704)
Reviewed-on: https://chromium-review.googlesource.com/942114
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
A typical CCD use case is when the DUT is not fully functional, or
even completely dead, including corrupted AP/EC firmware.
We still want to be able to enable CCD in this case, but routing CCD
commands through TPM task context (necessary to ensure the large stack
size some CCD commands require) is blocked if TPM was not reset after
startup.
Let's allow both reset requests and alternative commands when AP is
held in reset after reboot. The only situation when the alternative
command arrives would be the CCD use case of the system not generating
TPM reset pulse at startup and the operator is trying to execute a CCD
or RMA reset command.
BRANCH=cr50, cr50-mp
BUG=b:73292631
TEST=on a reef device: destroyed AP firmware and observed that the
'ccd open' command indeed results in the hung Cr50 console after
Cr50 is reset in this state.
Loaded the new Cr50 image, (which caused another Cr50 reset),
successfully took it through the 'ccd open' sequence resulting in
enabling AP flash write access, restored the AP flash and
observed the DUT boot into Chrome OS.
Change-Id: I4413bc200f5b2be563ba666ff80dd2d889ae5790
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/920924
Reviewed-by: Mary Ruthven <mruthven@chromium.org>
(cherry picked from commit f495e27ce6)
Reviewed-on: https://chromium-review.googlesource.com/927705
The console command now calls the vendor command to do the work.
Otherwise, the same as before.
BUG=chromium:804507
BRANCH=cr50 release (after testing)
TEST=manual:
# Sample sequence
spihash ap -> requires physical presence; tap power button
spihash 0 1024 -> gives a hash; compare with first 1KB of image.bin
spihash dump 0 128 -> dumps first 128 bytes; compare with image.bin
spihash 128 128 -> offset works
spihash 0 0x100000 -> gives a hash; doesn't watchdog reset
spihdev ec
spihash 0 1024 -> compare with ec.bin
spihash disable
# Test timeout
spihash ap
# Wait 30 seconds
spihash 0 1024 -> still works
# Wait 60 seconds; goes back disabled automatically
spihash 0 1024 -> fails because spihash is disabled
# Presence not required when CCD opened
ccd open
spihash ap -> no PP required
spihash 0 1024 -> works
spihash disable
# Possible for owner to disable via CCD config
ccd -> HashFlash is "Always"
ccd set HashFlash IfOpened
ccd lock
spihash ap -> access denied
# Cleanup
ccd open
ccd reset
ccd lock
Change-Id: Ife9335a1e402a7596d99bf515ec89ff94e8a0044
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/910083
Reviewed-by: Aseda Aboagye <aaboagye@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
(cherry picked from commit f49e1c3b42)
Reviewed-on: https://chromium-review.googlesource.com/923124
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
This will prevent earlier released images from running on the device
unless Info1 is erased.
BRANCH=cr50, cr50-mp
BUG=b:70891959
TEST=verified that two bits in the rollback mask have been erased now:
> sysinfo
Reset flags: 0x00000800 (hard)
[...]
Rollback: 2/2/128
Change-Id: Ic345c79010fbe0e075e14e652ea1eba263226ab1
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/916737
Reviewed-by: Mary Ruthven <mruthven@chromium.org>
(cherry picked from commit c07cbae93c)
Reviewed-on: https://chromium-review.googlesource.com/923123
The new key ID is set to zero.
BRANCH=cr50, cr50-eve
BUG=b:70891959
TEST=verified that prod server properly responds to the challenge
generated by a CR50 running on Robo device.
Change-Id: I1e0da4a2cebca7f985c5f2a6da509c850924a874
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/915503
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Michael Tang <ntang@chromium.org>
(cherry picked from commit 7b44ce57a3)
Reviewed-on: https://chromium-review.googlesource.com/923122
This allows hashing or dumping SPI flash from the Cr50 console even on
a locked device, so you can verify the RO Firmware on a system via CCD.
See design doc: go/verify-ro-firmware
(more specifically, "Cr50 console commands for option 1")
BUG=chromium:804507
BRANCH=cr50 release (after testing)
TEST=manual:
# Sample sequence
spihash ap -> requires physical presence; tap power button
spihash 0 1024 -> gives a hash; compare with first 1KB of image.bin
spihash 0 128 dump -> dumps first 128 bytes; compare with image.bin
spihash 128 128 -> offset works
spihash 0 0x100000 -> gives a hash; doesn't watchdog reset
spihdev ec
spihash 0 1024 -> compare with ec.bin
spihash disable
# Test timeout
spihash ap
# Wait 30 seconds
spihash 0 1024 -> still works
# Wait 60 seconds; goes back disabled automatically
spihash 0 1024 -> fails because spihash is disabled
# Presence not required when CCD opened
ccd open
spihash ap -> no PP required
spihash 0 1024 -> works
spihash disable
# Possible for owner to disable via CCD config
ccd -> HashFlash is "Always"
ccd set HashFlash IfOpened
ccd lock
spihash ap -> access denied
# Cleanup
ccd open
ccd reset
ccd lock
Change-Id: I27b5054730dea6b27fbad1b1c4aa0a650e3b4f99
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/889725
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
(cherry picked from commit ff4d22819a)
Reviewed-on: https://chromium-review.googlesource.com/923121
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
- Add a vendor command that provides alert counter. Userspace can use
it e.g. for user metric analysis.
- Add 'alerts' debug console command. It provides information about
chip alerts: supported alerts, fuse status, interrupt status, alert
counter.
- Add 'alerts fire [INT]' command to fire a software defined alert
(globalsec/fwN where N is 0,1,2,3).
Signed-off-by: Anatol Pomazau <anatol@google.com>
BUG=b:63523947
TEST=ran the FW at Pyro and checked alerts data sent to host
Change-Id: I7cec0c451ed71076b44dad14a151b147ff1337e8
Reviewed-on: https://chromium-review.googlesource.com/817639
Commit-Ready: Anatol Pomazau <anatol@google.com>
Tested-by: Anatol Pomazau <anatol@google.com>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
(cherry picked from commit 5a910a86be)
Reviewed-on: https://chromium-review.googlesource.com/923100
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
This will allow to make differences between pre-pvt and mp images
better visible.
BRANCH=cr50
BUG=none
TEST=none
Change-Id: I3abf24443a208482167231d93983b8edcace5f55
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/907170
Reviewed-by: Mary Ruthven <mruthven@chromium.org>
(cherry picked from commit 8d1422813e)
Reviewed-on: https://chromium-review.googlesource.com/906980
When RMA procedure is completed WP needs to be enabled back.
BRANCH=cr50, cr50-mp
BUG=b:37952913, b:73075443
TEST=on a Robo device, verified that WP is enabled, took the device
through RMA unlock, verified that WP is disabled, took the device
through RMA disable, verified that WP is enabled again.
Also confirmed that after RMA is disabled WP status follows the
battery.
Change-Id: Iad6af7d16aadcd10d580f709aeb942cf508a8489
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/905926
Reviewed-by: Randall Spangler <rspangler@chromium.org>
(cherry picked from commit 4a673c15ad)
Reviewed-on: https://chromium-review.googlesource.com/906979
The TPM task is running on a higher priority than the hook task
invoking TPM reset for RMA purposes. The waiting task ID value needs
to be set before TPM task is signaled to reset.
BRANCH=cr50, cr50-mp
BUG=b:37952913
TEST=with the corresponding ccd_config.c changes fully verified RMA
process (not just generating and processing the challenge).
Change-Id: Id112d59ae0c3fd31a32e652c6a043fc3fd3bbe07
Signed-off-by: Vadim Bendebury <vbendeb@google.com>
Reviewed-on: https://chromium-review.googlesource.com/905925
Commit-Ready: Vadim Bendebury <vbendeb@chromium.org>
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
(cherry picked from commit 41a308abcb)
Reviewed-on: https://chromium-review.googlesource.com/907872
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
The new release will include bug fixes and new features (line RMA
reset, CCD debug, management, etc.).
BRANCH=cr50
BUG=none
TEST=none
Change-Id: I25c22d00acd734ad0b7557cb9469d8b0f4db131e
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/902423
Reviewed-by: Mary Ruthven <mruthven@chromium.org>
(cherry picked from commit 59fe7c7a58)
Reviewed-on: https://chromium-review.googlesource.com/902438
This change creates a state machine to handle ap uart detection. It
removes all of the ap_uart stuff from ap_state.c and moves it to
ap_uart_state.c. All boards will now use ap_uart to enable/disable ap
uart and tpm_rst_l to detect the ap state.
Separate ap uart detection from ap detection, so we can disable the ap
uart without enabling deep sleep. If the ap is in S3 on ARM devices,
Cr50 wont be in deep sleep, but the AP UART RX signal wont be pulled up.
In this case we need cr50 ap rx to be disabled and deep sleep to be
disabled.
BUG=b:35647982
BRANCH=cr50
TEST=run firmware_Cr50DeviceState on scalet and electro
Change-Id: I81336a9e232df8d44b325eef59327a1c06a80cba
Signed-off-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/884307
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
(cherry picked from commit 4d3c8c1776)
Reviewed-on: https://chromium-review.googlesource.com/900557
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Automated code scanner highlighted a few problems in the recent ode
additions. This patch fixes the problems.
BRANCH=cr50
BUG=none
TEST=none
Change-Id: I1f199eb5d2af992384ab04f3010b4b646464a70f
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/897993
Reviewed-by: Mary Ruthven <mruthven@chromium.org>
(cherry picked from commit 8dba841b4e)
Reviewed-on: https://chromium-review.googlesource.com/900167
Flash operations in do_flash_op() involve waiting polling for the chip
to complete the operation. If a concurrent operation is started while
another operation is in progress, flash gets confused and locks up.
Let's add a mutex to ensure that flash operation runs to completion
before another operation starts.
BRANCH=cr50
BUG=b:67651754
TEST=multiple times ran firmware update while the device was coming up
and saving TPM status in NVMEM. Observed no failures.
Change-Id: I777a38f8a63cf17d60edb11cc3f916a4ea904741
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/894180
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Mary Ruthven <mruthven@chromium.org>
(cherry picked from commit cdd2c95284)
Reviewed-on: https://chromium-review.googlesource.com/896789
Add BOARD_DEEP_SLEEP_DISABLED and BOARD_DETECT_AP_WITH_UART to
BOARD_ALL_PROPERTIES, so they will be updated after cr50 reboots.
BUG=b:35647982
BRANCH=cr50
TEST=test deep sleep on scarlet
Change-Id: I8999ae7c6c1dad6799b5fdb99ebf5d7618a21c2b
Signed-off-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/882343
Reviewed-by: Randall Spangler <rspangler@chromium.org>
(cherry picked from commit a4e1e47630)
Reviewed-on: https://chromium-review.googlesource.com/896787
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
ap_state doesn't disable/enable the detect ap interrupt correctly. This
means cr50 is mostly just polling the AP state. Cr50 may not realize the
AP is up until almost a second after it first turned on. This change
reenables the detect ap on interrupt while debouncing the AP state or if
Cr50 thinks the AP is off, so cr50 can more quickly detect the
transition from off to on.
This issue doesn't affect devices that detect the AP with TPM_RST_L,
because we never disable the TPM_RST_L interrupt and that handler calls
ap_on_deferred directly.
BUG=b:71866206
BRANCH=cr50
TEST=run power_state:rec on Dru and make sure there are no tpm irq
timeouts.
Change-Id: I67388f9dce94fb22efe5755a0de563e5af42f8f5
Signed-off-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/869410
Reviewed-by: Randall Spangler <rspangler@chromium.org>
(cherry picked from commit 7b5b83055c)
Reviewed-on: https://chromium-review.googlesource.com/896786
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
When user is trying to execute 'ccd open' or 'ccd unlock' and password
is set, the return error code does not allow to tell the reason for
the command failure.
Let's add a distinct return code to indicate this condition so that
the user can supply password.
BRANCH=cr50
BUG=b:62537474
TEST=verified along with the accompanying gsctool modifications.
Change-Id: I286f87ab12114cd7dd7ebcdf0e321f7a24723367
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/861208
Reviewed-by: Randall Spangler <rspangler@chromium.org>
(cherry picked from commit d99e680b3c)
Reviewed-on: https://chromium-review.googlesource.com/896785
Vadim Bendebury