static void recovery_tests(void) { /* No recovery */ reset_common_data(); vb2_check_recovery(&cc); TEST_EQ(sd->recovery_reason, 0, "No recovery reason"); TEST_EQ(sd->flags & VB2_SD_FLAG_MANUAL_RECOVERY, 0, "Not manual recovery"); TEST_EQ(cc.flags & VB2_CONTEXT_RECOVERY_MODE, 0, "Not recovery mode"); /* From request */ reset_common_data(); vb2_nv_set(&cc, VB2_NV_RECOVERY_REQUEST, 3); vb2_check_recovery(&cc); TEST_EQ(sd->recovery_reason, 3, "Recovery reason from request"); TEST_EQ(vb2_nv_get(&cc, VB2_NV_RECOVERY_REQUEST), 0, "NV cleared"); TEST_EQ(sd->flags & VB2_SD_FLAG_MANUAL_RECOVERY, 0, "Not manual recovery"); TEST_NEQ(cc.flags & VB2_CONTEXT_RECOVERY_MODE, 0, "Recovery mode"); /* From request, but already failed */ reset_common_data(); vb2_nv_set(&cc, VB2_NV_RECOVERY_REQUEST, 4); sd->recovery_reason = 5; vb2_check_recovery(&cc); TEST_EQ(sd->recovery_reason, 5, "Recovery reason already failed"); TEST_EQ(vb2_nv_get(&cc, VB2_NV_RECOVERY_REQUEST), 0, "NV still cleared"); /* Override */ reset_common_data(); sd->recovery_reason = 6; cc.flags |= VB2_CONTEXT_FORCE_RECOVERY_MODE; vb2_check_recovery(&cc); TEST_EQ(sd->recovery_reason, VB2_RECOVERY_RO_MANUAL, "Recovery reason forced"); TEST_NEQ(sd->flags & VB2_SD_FLAG_MANUAL_RECOVERY, 0, "SD flag set"); }
int vb2api_fw_phase1(struct vb2_context *ctx) { int rv; /* Initialize the vboot context if it hasn't been yet */ vb2_init_context(ctx); /* Initialize NV context */ vb2_nv_init(ctx); /* Initialize secure data */ rv = vb2_secdata_init(ctx); if (rv) vb2_fail(ctx, VB2_RECOVERY_SECDATA_INIT, rv); /* Load and parse the GBB header */ rv = vb2_fw_parse_gbb(ctx); if (rv) vb2_fail(ctx, VB2_RECOVERY_GBB_HEADER, rv); /* Check for dev switch */ rv = vb2_check_dev_switch(ctx); if (rv) vb2_fail(ctx, VB2_RECOVERY_DEV_SWITCH, rv); /* * Check for recovery. Note that this function returns void, since * any errors result in requesting recovery. */ vb2_check_recovery(ctx); /* Return error if recovery is needed */ if (ctx->flags & VB2_CONTEXT_RECOVERY_MODE) { /* Always clear RAM when entering recovery mode */ ctx->flags |= VB2_CONTEXT_CLEAR_RAM; return VB2_ERROR_API_PHASE1_RECOVERY; } return VB2_SUCCESS; }
int vb2api_fw_phase1(struct vb2_context *ctx) { int rv; struct vb2_shared_data *sd; /* Initialize the vboot context if it hasn't been yet */ vb2_init_context(ctx); sd = vb2_get_sd(ctx); /* Initialize NV context */ vb2_nv_init(ctx); /* * Handle caller-requested reboot due to secdata. Do this before we * even look at secdata. If we fail because of a reboot loop we'll be * the first failure so will get to set the recovery reason. */ if (!(ctx->flags & VB2_CONTEXT_SECDATA_WANTS_REBOOT)) { /* No reboot requested */ vb2_nv_set(ctx, VB2_NV_TPM_REQUESTED_REBOOT, 0); } else if (vb2_nv_get(ctx, VB2_NV_TPM_REQUESTED_REBOOT)) { /* * Reboot requested... again. Fool me once, shame on you. * Fool me twice, shame on me. Fail into recovery to avoid * a reboot loop. */ vb2_fail(ctx, VB2_RECOVERY_RO_TPM_REBOOT, 0); } else { /* Reboot requested for the first time */ vb2_nv_set(ctx, VB2_NV_TPM_REQUESTED_REBOOT, 1); return VB2_ERROR_API_PHASE1_SECDATA_REBOOT; } /* Initialize secure data */ rv = vb2_secdata_init(ctx); if (rv) vb2_fail(ctx, VB2_RECOVERY_SECDATA_INIT, rv); /* Load and parse the GBB header */ rv = vb2_fw_parse_gbb(ctx); if (rv) vb2_fail(ctx, VB2_RECOVERY_GBB_HEADER, rv); /* * Check for recovery. Note that this function returns void, since any * errors result in requesting recovery. That's also why we don't * return error from failures in the preceding two steps; those * failures simply cause us to detect recovery mode here. */ vb2_check_recovery(ctx); /* Check for dev switch */ rv = vb2_check_dev_switch(ctx); if (rv && !(ctx->flags & VB2_CONTEXT_RECOVERY_MODE)) { /* * Error in dev switch processing, and we weren't already * headed for recovery mode. Reboot into recovery mode, since * it's too late to handle those errors this boot, and we need * to take a different path through the dev switch checking * code in that case. */ vb2_fail(ctx, VB2_RECOVERY_DEV_SWITCH, rv); return rv; } /* * Check for possible reasons to ask the firmware to make display * available. sd->recovery_reason may have been set above by * vb2_check_recovery. VB2_SD_FLAG_DEV_MODE_ENABLED may have been set * above by vb2_check_dev_switch. */ if (!(ctx->flags & VB2_CONTEXT_DISPLAY_INIT) && (vb2_nv_get(ctx, VB2_NV_OPROM_NEEDED) || sd->flags & VB2_SD_FLAG_DEV_MODE_ENABLED || sd->recovery_reason)) ctx->flags |= VB2_CONTEXT_DISPLAY_INIT; /* Mark display as available for downstream vboot and vboot callers. */ if (ctx->flags & VB2_CONTEXT_DISPLAY_INIT) sd->flags |= VB2_SD_FLAG_DISPLAY_AVAILABLE; /* Return error if recovery is needed */ if (ctx->flags & VB2_CONTEXT_RECOVERY_MODE) { /* Always clear RAM when entering recovery mode */ ctx->flags |= VB2_CONTEXT_CLEAR_RAM; return VB2_ERROR_API_PHASE1_RECOVERY; } return VB2_SUCCESS; }