blob: 760d6f86a0ba463c52e3c0e8aff7268f5b016f8a [file] [log] [blame]
#!/bin/sh -ue
# Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
#
# Usage: dev_debug_vboot [ --cleanup | DIRECTORY ]
#
# This extracts some useful debugging information about verified boot. A short
# summary is printed on stdout, more detailed information and working files are
# left in a log directory.
#
##############################################################################
# Clean up PATH for root use. Note that we're assuming [ is always built-in.
[ "${EUID:-0}" = 0 ] && PATH=/bin:/sbin:/usr/bin:/usr/sbin
PUBLOGFILE="/var/log/debug_vboot_noisy.log"
OPT_CLEANUP=
OPT_BIOS=
OPT_IMAGE=
OPT_KERNEL=
OPT_VERBOSE=
FLAG_SAVE_LOG_FILE=yes
LOGFILE=/dev/stdout
TMPDIR=
##############################################################################
usage() {
local prog
prog=${0##*/}
cat <<EOF
Usage: $prog [options] [DIRECTORY]
This logs as much as it can about the verified boot process. With no arguments
it will attempt to read the current BIOS, extract the firmware keys, and use
those keys to validate all the ChromeOS kernel partitions it can find. A
summary output is printed on stdout, and the detailed log is copied to
$PUBLOGFILE afterwards.
If a directory is given, it will attempt to use the components from that
directory and will leave the detailed log in that directory.
Options:
-b FILE, --bios FILE Specify the BIOS image to use
-i FILE, --image FILE Specify the disk image to use
-k FILE, --kernel FILE Specify the kernel partition image to use
-v Spew the detailed log to stdout
-c, --cleanup Delete the DIRECTORY when done
-h, --help Print this help message and exit
EOF
exit 0
}
cleanup() {
if [ -n "${FLAG_SAVE_LOG_FILE}" ]; then
if cp -f "${LOGFILE}" "${PUBLOGFILE}" 2>/dev/null; then
info "Exporting log file as ${PUBLOGFILE}"
fi
fi
if [ -n "${OPT_CLEANUP}" ] && [ -d "${TMPDIR}" ] ; then
cd /
rm -rf "${TMPDIR}"
fi
}
die() {
echo "$*" 1>&2
exit 1
}
info() {
echo "$@"
echo "#" "$@" >> "$LOGFILE"
}
infon() {
echo -n "$@"
echo "#" "$@" >> "$LOGFILE"
}
debug() {
echo "#" "$@" >> "$LOGFILE"
}
log() {
echo "+" "$@" >> "$LOGFILE"
"$@" >> "$LOGFILE" 2>&1
}
loghead() {
echo "+" "$@" "| head" >> "$LOGFILE"
"$@" | head >> "$LOGFILE" 2>&1
}
logdie() {
echo "+ERROR:" "$@" >> "$LOGFILE"
die "$@"
}
result() {
LAST_RESULT=$?
if [ "${LAST_RESULT}" = "0" ]; then
info "OK"
else
info "FAILED"
fi
}
require_utils() {
local missing
missing=
for tool in $* ; do
if ! type "$tool" >/dev/null 2>&1 ; then
missing="$missing $tool"
fi
done
if [ -n "$missing" ]; then
logdie "can't find these programs: $missing"
fi
}
extract_kerns_from_file() {
local start
local size
local part
local rest
debug "Extracting kernel partitions from $1 ..."
cgpt find -v -t kernel "$1" | grep 'Label:' |
while read start size part rest; do
name="part_${part}"
log dd if="$1" bs=512 skip=${start} count=${size} of="${name}" &&
echo "${name}"
done
}
format_as_tpm_version() {
local a
local b
local what
local num
local rest
a='/(Data|Kernel) key version/ {print $1,$4}'
b='/Kernel version/ {print $1, $3}'
awk "$a $b" "$1" | while read what num rest; do
[ "${what}" = "Data" ] && block="${num}"
[ "${what}" = "Kernel" ] && printf '0x%04x%04x' "${block}" "${num}"
done
}
fix_old_names() {
# Convert any old-style names to new-style
[ -f GBB_Area ] && log mv -f GBB_Area GBB
[ -f Firmware_A_Key ] && log mv -f Firmware_A_Key VBLOCK_A
[ -f Firmware_B_Key ] && log mv -f Firmware_B_Key VBLOCK_B
[ -f Firmware_A_Data ] && log mv -f Firmware_A_Data FW_MAIN_A
[ -f Firmware_B_Data ] && log mv -f Firmware_B_Data FW_MAIN_B
true
}
##############################################################################
# Here we go...
umask 022
# Pre-parse args to replace actual args with a sanitized version.
TEMP=$(getopt -o hvb:i:k:c --long help,bios:,image:,kernel:,cleanup \
-n $0 -- "$@")
eval set -- "$TEMP"
# Now look at them.
while true ; do
case "${1:-}" in
-b|--bios)
OPT_BIOS=$(readlink -f "$2")
shift 2
FLAG_SAVE_LOG_FILE=
;;
-i|--image=*)
OPT_IMAGE=$(readlink -f "$2")
shift 2
FLAG_SAVE_LOG_FILE=
;;
-k|--kernel)
OPT_KERNEL=$(readlink -f "$2")
shift 2
FLAG_SAVE_LOG_FILE=
;;
-c|--cleanup)
OPT_CLEANUP=yes
shift
;;
-v)
OPT_VERBOSE=yes
shift
FLAG_SAVE_LOG_FILE=
;;
-h|--help)
usage
break
;;
--)
shift
break
;;
*)
die "Internal error in option parsing"
;;
esac
done
if [ -z "${1:-}" ]; then
TMPDIR=$(mktemp -d /tmp/debug_vboot_XXXXXXXXX)
else
TMPDIR="$1"
[ -d ${TMPDIR} ] || die "$TMPDIR doesn't exist"
FLAG_SAVE_LOG_FILE=
fi
[ -z "${OPT_VERBOSE}" ] && LOGFILE="${TMPDIR}/noisy.log"
[ -d ${TMPDIR} ] || mkdir -p ${TMPDIR} || exit 1
cd ${TMPDIR} || exit 1
echo "Running $0 $*" > "$LOGFILE"
log date
debug "OPT_CLEANUP=($OPT_CLEANUP)"
debug "OPT_BIOS=($OPT_BIOS)"
debug "OPT_IMAGE=($OPT_IMAGE)"
debug "OPT_KERNEL=($OPT_KERNEL)"
debug "FLAG_SAVE_LOG_FILE=($FLAG_SAVE_LOG_FILE)"
echo "Saving verbose log as $LOGFILE"
trap cleanup EXIT
# Make sure we have the programs we need
need="vbutil_key vbutil_keyblock vbutil_kernel vbutil_firmware"
[ -z "${OPT_BIOS}" ] && need="$need flashrom"
[ -z "${OPT_KERNEL}" ] && need="$need cgpt"
require_utils $need
# Assuming we're on a ChromeOS device, see what we know.
set +e
log crossystem --all
log rootdev -s
log ls -aCF /root
log ls -aCF /mnt/stateful_partition
devs=$(awk '/(mmcblk[0-9])$|(sd[a-z])$/ {print "/dev/"$4}' /proc/partitions)
for d in $devs; do
log cgpt show $d
done
log flashrom -V -p internal:bus=spi --wp-status
tpm_fwver=$(crossystem tpm_fwver) || tpm_fwver="UNKNOWN"
tpm_kernver=$(crossystem tpm_kernver) || tpm_kernver="UNKNOWN"
set -e
info "Extracting BIOS components..."
if [ -n "${OPT_BIOS}" ]; then
# If we've already got a file, just extract everything.
log dump_fmap -x "${OPT_BIOS}"
fix_old_names
else
# Read it from the flash
if log flashrom -p internal:bus=spi -r bios.rom ; then
# If we can read the whole BIOS at once, great.
log dump_fmap -x bios.rom
fix_old_names
else
# Otherwise pull just the components we want (implying new-style names)
info " ...individually..."
log flashrom -p internal:bus=spi -r /dev/null \
-i"GBB":GBB \
-i"VBLOCK_A":VBLOCK_A \
-i"VBLOCK_B":VBLOCK_B \
-i"FW_MAIN_A":FW_MAIN_A \
-i"FW_MAIN_B":FW_MAIN_B
fi
fi
info "Pulling root and recovery keys from GBB..."
log gbb_utility -g --rootkey rootkey.vbpubk --recoverykey recoverykey.vbpubk \
"GBB" || logdie "Unable to extract keys from GBB"
log vbutil_key --unpack rootkey.vbpubk
log vbutil_key --unpack recoverykey.vbpubk
vbutil_key --unpack rootkey.vbpubk |
grep -q b11d74edd286c144e1135b49e7f0bc20cf041f10 &&
info " Looks like dev-keys"
# Okay if one of the firmware verifications fails
set +e
for fw in A B; do
infon "Verify firmware ${fw} with root key: "
log vbutil_firmware --verify "VBLOCK_${fw}" --signpubkey rootkey.vbpubk \
--fv "FW_MAIN_${fw}" --kernelkey "kern_subkey_${fw}.vbpubk" ; result
if [ "${LAST_RESULT}" = "0" ]; then
# rerun to get version numbers
vbutil_firmware --verify "VBLOCK_${fw}" --signpubkey rootkey.vbpubk \
--fv "FW_MAIN_${fw}" > tmp.txt
ver=$(format_as_tpm_version tmp.txt)
info " TPM=${tpm_fwver}, this=${ver}"
fi
done
set -e
info "Examining kernels..."
if [ -n "${OPT_KERNEL}" ]; then
kernparts="${OPT_KERNEL}"
elif [ -n "${OPT_IMAGE}" ]; then
if [ -f "${OPT_IMAGE}" ]; then
kernparts=$(extract_kerns_from_file "${OPT_IMAGE}")
else
kernparts=$(cgpt find -t kernel "${OPT_IMAGE}")
fi
else
kernparts=$(cgpt find -t kernel)
fi
[ -n "${kernparts}" ] || logdie "No kernels found"
# Okay if any of the kernel verifications fails
set +e
kc=0
for kname in ${kernparts}; do
if [ -f "${kname}" ]; then
kfile="${kname}"
else
kfile="kern_${kc}"
debug "copying ${kname} to ${kfile}..."
log dd if="${kname}" of="${kfile}"
fi
infon "Kernel ${kname}: "
log vbutil_keyblock --unpack "${kfile}" ; result
if [ "${LAST_RESULT}" != "0" ]; then
loghead od -Ax -tx1 "${kfile}"
else
# Test each kernel with each key
for key in kern_subkey_A.vbpubk kern_subkey_B.vbpubk recoverykey.vbpubk; do
infon " Verify ${kname} with $key: "
log vbutil_kernel --verify "${kfile}" --signpubkey "$key" ; result
if [ "${LAST_RESULT}" = "0" ]; then
# rerun to get version numbers
vbutil_kernel --verify "${kfile}" --signpubkey "$key" > tmp.txt
ver=$(format_as_tpm_version tmp.txt)
info " TPM=${tpm_kernver} this=${ver}"
fi
done
fi
kc=$(expr $kc + 1)
done
exit 0