ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2024-12-18 20:47:55 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add TRACE function tracing function to output on console when enabled

Browse Source 
- Add TRACE function tracing output under etc/functions, depending on CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT enabled in board configs
- Replace current DEBUG to TRACE calls in code, reserving DEBUG calls for more verbose debugging later on (output of variables etc)
- add 'export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=y' in qemu-coreboot(fb)whiptail-tpm1(-hotp) boards to see it in action
This commit is contained in:
Thierry Laurion 2023-02-20 11:01:17 -05:00
parent 5fbbbbc3f7
commit 8259d3ca1e
No known key found for this signature in database
GPG Key ID: E7B4A71658E36A93
41 changed files with 88 additions and 77 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
boards/qemu-coreboot-fbwhiptail-tpm1-hotp/qemu-coreboot-fbwhiptail-tpm1-hotp.config
View File

@ -10,6 +10,7 @@ export CONFIG_LINUX_VERSION=5.10.5
#Enable DEBUG output #Enable DEBUG output
export CONFIG_DEBUG_OUTPUT=y export CONFIG_DEBUG_OUTPUT=y
export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=y
CONFIG_COREBOOT_CONFIG=config/coreboot-qemu-tpm1.config CONFIG_COREBOOT_CONFIG=config/coreboot-qemu-tpm1.config
CONFIG_LINUX_CONFIG=config/linux-qemu.config CONFIG_LINUX_CONFIG=config/linux-qemu.config

1
boards/qemu-coreboot-fbwhiptail-tpm1/qemu-coreboot-fbwhiptail-tpm1.config
View File

@ -8,6 +8,7 @@ export CONFIG_LINUX_VERSION=5.10.5
#Enable DEBUG output #Enable DEBUG output
export CONFIG_DEBUG_OUTPUT=y export CONFIG_DEBUG_OUTPUT=y
export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=y
CONFIG_COREBOOT_CONFIG=config/coreboot-qemu-tpm1.config CONFIG_COREBOOT_CONFIG=config/coreboot-qemu-tpm1.config
CONFIG_LINUX_CONFIG=config/linux-qemu.config CONFIG_LINUX_CONFIG=config/linux-qemu.config

1
boards/qemu-coreboot-whiptail-tpm1-hotp/qemu-coreboot-whiptail-tpm1-hotp.config
View File

@ -10,6 +10,7 @@ export CONFIG_LINUX_VERSION=5.10.5
#Enable DEBUG output #Enable DEBUG output
export CONFIG_DEBUG_OUTPUT=y export CONFIG_DEBUG_OUTPUT=y
export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=y
CONFIG_COREBOOT_CONFIG=config/coreboot-qemu-tpm1.config CONFIG_COREBOOT_CONFIG=config/coreboot-qemu-tpm1.config
CONFIG_LINUX_CONFIG=config/linux-qemu.config CONFIG_LINUX_CONFIG=config/linux-qemu.config

1
boards/qemu-coreboot-whiptail-tpm1/qemu-coreboot-whiptail-tpm1.config
View File

@ -8,6 +8,7 @@ export CONFIG_LINUX_VERSION=5.10.5
#Enable DEBUG output #Enable DEBUG output
export CONFIG_DEBUG_OUTPUT=y export CONFIG_DEBUG_OUTPUT=y
export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=y
CONFIG_COREBOOT_CONFIG=config/coreboot-qemu-tpm1.config CONFIG_COREBOOT_CONFIG=config/coreboot-qemu-tpm1.config
CONFIG_LINUX_CONFIG=config/linux-qemu.config CONFIG_LINUX_CONFIG=config/linux-qemu.config

2
initrd/bin/cbfs-init
View File

@ -2,7 +2,7 @@
set -e -o pipefail set -e -o pipefail
. /etc/functions . /etc/functions
DEBUG "Under /bin/cbfs-init" TRACE "Under /bin/cbfs-init"
# Update initrd with CBFS files # Update initrd with CBFS files
if [ -z "$CONFIG_PCR" ]; then if [ -z "$CONFIG_PCR" ]; then

2
initrd/bin/cbfs.sh
View File

@ -3,7 +3,7 @@ set -e -o pipefail
. /etc/functions . /etc/functions
. /tmp/config . /tmp/config
DEBUG "Under /bin/cbfs.sh" TRACE "Under /bin/cbfs.sh"
if pnor "$2" -r HBI > /tmp/pnor.part 2>/dev/null; then if pnor "$2" -r HBI > /tmp/pnor.part 2>/dev/null; then
cbfs "$@" -o /tmp/pnor.part && pnor "$2" -w HBI < /tmp/pnor.part cbfs "$@" -o /tmp/pnor.part && pnor "$2" -w HBI < /tmp/pnor.part

2
initrd/bin/config-gui.sh
View File

@ -5,7 +5,7 @@ set -e -o pipefail
. /etc/gui_functions . /etc/gui_functions
. /tmp/config . /tmp/config
DEBUG "Under /bin/config-gui.sh" TRACE "Under /bin/config-gui.sh"
param=$1 param=$1

2
initrd/bin/flash-gui.sh
View File

@ -5,7 +5,7 @@ set -e -o pipefail
. /etc/gui_functions . /etc/gui_functions
. /tmp/config . /tmp/config
DEBUG "Under /bin/flash-gui.sh" TRACE "Under /bin/flash-gui.sh"
while true; do while true; do
unset menu_choice unset menu_choice

2
initrd/bin/flash.sh
View File

@ -6,7 +6,7 @@ set -e -o pipefail
. /etc/functions . /etc/functions
. /tmp/config . /tmp/config
DEBUG "Under /bin/flash.sh" TRACE "Under /bin/flash.sh"
case "$CONFIG_FLASHROM_OPTIONS" in case "$CONFIG_FLASHROM_OPTIONS" in
-* ) -* )

2
initrd/bin/flashrom-kgpe-d16-openbmc.sh
View File

@ -1,7 +1,7 @@
#!/bin/sh #!/bin/sh
. /etc/functions . /etc/functions
DEBUG "Under /bin/flashrom-kgpe-d16-openbmc.sh" TRACE "Under /bin/flashrom-kgpe-d16-openbmc.sh"
ROM="$1" ROM="$1"
if [ -z "$1" ]; then if [ -z "$1" ]; then

2
initrd/bin/generic-init
View File

@ -6,7 +6,7 @@
mount_boot() mount_boot()
{ {
DEBUG "Under /bin/generic-init:mount_boot" TRACE "Under /bin/generic-init:mount_boot"
# Mount local disk if it is not already mounted # Mount local disk if it is not already mounted
if ! grep -q /boot /proc/mounts ; then if ! grep -q /boot /proc/mounts ; then
mount -o ro /boot \ mount -o ro /boot \

2
initrd/bin/gpg-gui.sh
View File

@ -5,7 +5,7 @@ set -e -o pipefail
. /etc/gui_functions . /etc/gui_functions
. /tmp/config . /tmp/config
DEBUG "Under /bin/gpg-gui.sh" TRACE "Under /bin/gpg-gui.sh"
gpg_flash_rom() { gpg_flash_rom() {
if [ "$1" = "replace" ]; then if [ "$1" = "replace" ]; then

2
initrd/bin/gpgv
View File

@ -2,5 +2,5 @@
# if we are using the full GPG we need a wrapper for the gpgv executable # if we are using the full GPG we need a wrapper for the gpgv executable
. /etc/functions . /etc/functions
DEBUG "Under /bin/gpgv" TRACE "Under /bin/gpgv"
exec gpg --verify "$@" exec gpg --verify "$@"

42
initrd/bin/gui-init
View File

@ -17,7 +17,7 @@ skip_to_menu="false"
mount_boot() mount_boot()
{ {
DEBUG "Under /bin/gui-init:mount_boot" TRACE "Under /bin/gui-init:mount_boot"
# Mount local disk if it is not already mounted # Mount local disk if it is not already mounted
while ! grep -q /boot /proc/mounts ; do while ! grep -q /boot /proc/mounts ; do
# try to mount if CONFIG_BOOT_DEV exists # try to mount if CONFIG_BOOT_DEV exists
@ -63,7 +63,7 @@ mount_boot()
verify_global_hashes() verify_global_hashes()
{ {
DEBUG "Under /bin/gui-init:verify_global_hashes" TRACE "Under /bin/gui-init:verify_global_hashes"
# Check the hashes of all the files, ignoring signatures for now # Check the hashes of all the files, ignoring signatures for now
check_config /boot force check_config /boot force
TMP_HASH_FILE="/tmp/kexec/kexec_hashes.txt" TMP_HASH_FILE="/tmp/kexec/kexec_hashes.txt"
@ -138,7 +138,7 @@ verify_global_hashes()
prompt_update_checksums() prompt_update_checksums()
{ {
DEBUG "Under /bin/gui-init:prompt_update_checksums" TRACE "Under /bin/gui-init:prompt_update_checksums"
if (whiptail $BG_COLOR_WARNING --title 'Update Checksums and sign all files in /boot' \ if (whiptail $BG_COLOR_WARNING --title 'Update Checksums and sign all files in /boot' \
--yesno "You have chosen to update the checksums and sign all of the files in /boot.\n\nThis means that you trust that these files have not been tampered with.\n\nYou will need your GPG key available, and this change will modify your disk.\n\nDo you want to continue?" 0 80) then --yesno "You have chosen to update the checksums and sign all of the files in /boot.\n\nThis means that you trust that these files have not been tampered with.\n\nYou will need your GPG key available, and this change will modify your disk.\n\nDo you want to continue?" 0 80) then
if ! update_checksums ; then if ! update_checksums ; then
@ -150,7 +150,7 @@ prompt_update_checksums()
generate_totp_htop() generate_totp_htop()
{ {
DEBUG "Under /bin/gui-init:generate_totp_htop" TRACE "Under /bin/gui-init:generate_totp_htop"
echo "Scan the QR code to add the new TOTP secret" echo "Scan the QR code to add the new TOTP secret"
if /bin/seal-totp "$BOARD_NAME"; then if /bin/seal-totp "$BOARD_NAME"; then
if [ -x /bin/hotp_verification ]; then if [ -x /bin/hotp_verification ]; then
@ -170,7 +170,7 @@ generate_totp_htop()
update_totp() update_totp()
{ {
DEBUG "Under /bin/gui-init:update_totp" TRACE "Under /bin/gui-init:update_totp"
# update the TOTP code # update the TOTP code
date=`date "+%Y-%m-%d %H:%M:%S %Z"` date=`date "+%Y-%m-%d %H:%M:%S %Z"`
if [ "$CONFIG_TPM" = n ]; then if [ "$CONFIG_TPM" = n ]; then
@ -221,7 +221,7 @@ update_totp()
update_hotp() update_hotp()
{ {
DEBUG "Under /bin/gui-init:update_hotp" TRACE "Under /bin/gui-init:update_hotp"
if [ -x /bin/hotp_verification ]; then if [ -x /bin/hotp_verification ]; then
HOTP=`unseal-hotp` HOTP=`unseal-hotp`
if ! hotp_verification info ; then if ! hotp_verification info ; then
@ -260,7 +260,7 @@ update_hotp()
clean_boot_check() clean_boot_check()
{ {
DEBUG "Under /bin/gui-init:mount_boot" TRACE "Under /bin/gui-init:mount_boot"
# assume /boot mounted # assume /boot mounted
if ! grep -q /boot /proc/mounts ; then if ! grep -q /boot /proc/mounts ; then
return return
@ -289,7 +289,7 @@ clean_boot_check()
check_gpg_key() check_gpg_key()
{ {
DEBUG "Under /bin/gui-init:check_gpg_key" TRACE "Under /bin/gui-init:check_gpg_key"
GPG_KEY_COUNT=`gpg -k 2>/dev/null | wc -l` GPG_KEY_COUNT=`gpg -k 2>/dev/null | wc -l`
if [ $GPG_KEY_COUNT -eq 0 ]; then if [ $GPG_KEY_COUNT -eq 0 ]; then
BG_COLOR_MAIN_MENU=$BG_COLOR_ERROR BG_COLOR_MAIN_MENU=$BG_COLOR_ERROR
@ -326,7 +326,7 @@ check_gpg_key()
prompt_auto_default_boot() prompt_auto_default_boot()
{ {
DEBUG "Under /bin/gui-init:prompt_auto_default_boot" TRACE "Under /bin/gui-init:prompt_auto_default_boot"
# save IFS before changing, restore after read # save IFS before changing, restore after read
IFS_DEF=$IFS IFS_DEF=$IFS
IFS='' IFS=''
@ -343,7 +343,7 @@ prompt_auto_default_boot()
show_main_menu() show_main_menu()
{ {
DEBUG "Under /bin/gui-init:show_main_menu" TRACE "Under /bin/gui-init:show_main_menu"
date=`date "+%Y-%m-%d %H:%M:%S %Z"` date=`date "+%Y-%m-%d %H:%M:%S %Z"`
whiptail $BG_COLOR_MAIN_MENU --title "$MAIN_MENU_TITLE" \ whiptail $BG_COLOR_MAIN_MENU --title "$MAIN_MENU_TITLE" \
--menu "$date\nTOTP: $TOTP | HOTP: $HOTP" 0 80 10 \ --menu "$date\nTOTP: $TOTP | HOTP: $HOTP" 0 80 10 \
@ -377,7 +377,7 @@ show_main_menu()
show_options_menu() show_options_menu()
{ {
DEBUG "Under /bin/gui-init:show_options_menu" TRACE "Under /bin/gui-init:show_options_menu"
whiptail $BG_COLOR_MAIN_MENU --title "HEADS Options" \ whiptail $BG_COLOR_MAIN_MENU --title "HEADS Options" \
--menu "" 0 80 10 \ --menu "" 0 80 10 \
'b' ' Boot Options -->' \ 'b' ' Boot Options -->' \
@ -434,7 +434,7 @@ show_options_menu()
show_boot_options_menu() show_boot_options_menu()
{ {
DEBUG "Under /bin/gui-init:show_boot_options_menu" TRACE "Under /bin/gui-init:show_boot_options_menu"
whiptail $BG_COLOR_MAIN_MENU --title "Boot Options" \ whiptail $BG_COLOR_MAIN_MENU --title "Boot Options" \
--menu "Select A Boot Option" 0 80 10 \ --menu "Select A Boot Option" 0 80 10 \
'm' ' Show OS boot menu' \ 'm' ' Show OS boot menu' \
@ -462,7 +462,7 @@ show_boot_options_menu()
show_tpm_totp_hotp_options_menu() show_tpm_totp_hotp_options_menu()
{ {
DEBUG "Under /bin/gui-init:show_tpm_totp_hotp_options_menu" TRACE "Under /bin/gui-init:show_tpm_totp_hotp_options_menu"
whiptail $BG_COLOR_MAIN_MENU --title "TPM/TOTP/HOTP Options" \ whiptail $BG_COLOR_MAIN_MENU --title "TPM/TOTP/HOTP Options" \
--menu "Select An Option" 0 80 10 \ --menu "Select An Option" 0 80 10 \
'g' ' Generate new TOTP/HOTP secret' \ 'g' ' Generate new TOTP/HOTP secret' \
@ -489,7 +489,7 @@ show_tpm_totp_hotp_options_menu()
prompt_totp_mismatch() prompt_totp_mismatch()
{ {
DEBUG "Under /bin/gui-init:prompt_totp_mismatch" TRACE "Under /bin/gui-init:prompt_totp_mismatch"
if (whiptail $BG_COLOR_WARNING --title "TOTP/HOTP code mismatched" \ if (whiptail $BG_COLOR_WARNING --title "TOTP/HOTP code mismatched" \
--yesno "TOTP/HOTP code mismatches could indicate either TPM tampering or clock drift:\n\nTo correct clock drift: 'date -s yyyy-MM-DD hh:mm:ss' in UTC timezone\nand save it to the RTC: 'hwclock -w'\nthen reboot and try again.\n\nWould you like to exit to a recovery console?" 0 80) then --yesno "TOTP/HOTP code mismatches could indicate either TPM tampering or clock drift:\n\nTo correct clock drift: 'date -s yyyy-MM-DD hh:mm:ss' in UTC timezone\nand save it to the RTC: 'hwclock -w'\nthen reboot and try again.\n\nWould you like to exit to a recovery console?" 0 80) then
echo "" echo ""
@ -506,7 +506,7 @@ prompt_totp_mismatch()
reset_tpm() reset_tpm()
{ {
DEBUG "Under /bin/gui-init:reset_tpm" TRACE "Under /bin/gui-init:reset_tpm"
if [ "$CONFIG_TPM" = "y" ]; then if [ "$CONFIG_TPM" = "y" ]; then
if (whiptail $BG_COLOR_WARNING --title 'Reset the TPM' \ if (whiptail $BG_COLOR_WARNING --title 'Reset the TPM' \
--yesno "This will clear the TPM and TPM password, replace them with new ones!\n\nDo you want to proceed?" 0 80) then --yesno "This will clear the TPM and TPM password, replace them with new ones!\n\nDo you want to proceed?" 0 80) then
@ -540,7 +540,7 @@ reset_tpm()
show_system_info() show_system_info()
{ {
DEBUG "Under /bin/gui-init:show_system_info" TRACE "Under /bin/gui-init:show_system_info"
battery_charge="$(print_battery_charge)" battery_charge="$(print_battery_charge)"
battery_health="$(print_battery_health)" battery_health="$(print_battery_health)"
if [ -n $battery_charge -a -n $battery_health ];then if [ -n $battery_charge -a -n $battery_health ];then
@ -558,7 +558,7 @@ show_system_info()
select_os_boot_option() select_os_boot_option()
{ {
DEBUG "Under /bin/gui-init:select_os_boot_option" TRACE "Under /bin/gui-init:select_os_boot_option"
mount_boot mount_boot
if verify_global_hashes ; then if verify_global_hashes ; then
kexec-select-boot -m -b /boot -c "grub.cfg" -g kexec-select-boot -m -b /boot -c "grub.cfg" -g
@ -567,7 +567,7 @@ select_os_boot_option()
attempt_default_boot() attempt_default_boot()
{ {
DEBUG "Under /bin/gui-init:attempt_default_boot" TRACE "Under /bin/gui-init:attempt_default_boot"
mount_boot mount_boot
if ! verify_global_hashes; then if ! verify_global_hashes; then
@ -585,7 +585,7 @@ attempt_default_boot()
force_unsafe_boot() force_unsafe_boot()
{ {
DEBUG "Under /bin/gui-init:force_unsafe_boot" TRACE "Under /bin/gui-init:force_unsafe_boot"
# Run the menu selection in "force" mode, bypassing hash checks # Run the menu selection in "force" mode, bypassing hash checks
if (whiptail $BG_COLOR_WARNING --title 'Unsafe Forced Boot Selected!' \ if (whiptail $BG_COLOR_WARNING --title 'Unsafe Forced Boot Selected!' \
--yesno "WARNING: You have chosen to skip all tamper checks and boot anyway.\n\nThis is an unsafe option!\n\nDo you want to proceed?" 0 80) then --yesno "WARNING: You have chosen to skip all tamper checks and boot anyway.\n\nThis is an unsafe option!\n\nDo you want to proceed?" 0 80) then
@ -594,7 +594,7 @@ force_unsafe_boot()
} }
# gui-init start # gui-init start
DEBUG "Under /bin/gui-init, start" TRACE "Under /bin/gui-init, start"
# Use stored HOTP key branding # Use stored HOTP key branding
if [ -r /boot/kexec_hotp_key ]; then if [ -r /boot/kexec_hotp_key ]; then
@ -628,7 +628,7 @@ if [ "$HOTP" = "Success" -a -n "$CONFIG_AUTO_BOOT_TIMEOUT" ]; then
fi fi
while true; do while true; do
DEBUG "Under gui-init:while true loop" TRACE "Under gui-init:while true loop"
skip_to_menu="false" skip_to_menu="false"
show_main_menu show_main_menu
done done

2
initrd/bin/kexec-boot
View File

@ -4,7 +4,7 @@ set -e -o pipefail
. /tmp/config . /tmp/config
. /etc/functions . /etc/functions
DEBUG "Under /bin/kexec-boot" TRACE "Under /bin/kexec-boot"
dryrun="n" dryrun="n"
printfiles="n" printfiles="n"

2
initrd/bin/kexec-insert-key
View File

@ -3,7 +3,7 @@
set -e -o pipefail set -e -o pipefail
. /etc/functions . /etc/functions
DEBUG "Under /bin/kexec-insert-key" TRACE "Under /bin/kexec-insert-key"
TMP_KEY_DEVICES="/tmp/kexec/kexec_key_devices.txt" TMP_KEY_DEVICES="/tmp/kexec/kexec_key_devices.txt"
TMP_KEY_LVM="/tmp/kexec/kexec_key_lvm.txt" TMP_KEY_LVM="/tmp/kexec/kexec_key_lvm.txt"

2
initrd/bin/kexec-iso-init
View File

@ -4,7 +4,7 @@ set -e -o pipefail
. /etc/functions . /etc/functions
. /tmp/config . /tmp/config
DEBUG "Under /bin/kexec-iso-init" TRACE "Under /bin/kexec-iso-init"
MOUNTED_ISO_PATH="$1" MOUNTED_ISO_PATH="$1"
ISO_PATH="$2" ISO_PATH="$2"

2
initrd/bin/kexec-parse-bls
View File

@ -1,7 +1,7 @@
#!/bin/sh #!/bin/sh
set -e -o pipefail set -e -o pipefail
. /etc/functions . /etc/functions
DEBUG "Under /bin/kexec-parse-bls" TRACE "Under /bin/kexec-parse-bls"
bootdir="$1" bootdir="$1"
file="$2" file="$2"

2
initrd/bin/kexec-parse-boot
View File

@ -2,7 +2,7 @@
set -e -o pipefail set -e -o pipefail
. /etc/functions . /etc/functions
DEBUG "Under /bin/kexec-parse-boot" TRACE "Under /bin/kexec-parse-boot"
bootdir="$1" bootdir="$1"
file="$2" file="$2"

2
initrd/bin/kexec-save-default
View File

@ -4,7 +4,7 @@ set -e -o pipefail
. /tmp/config . /tmp/config
. /etc/functions . /etc/functions
DEBUG "Under /bin/kexec-save-default" TRACE "Under /bin/kexec-save-default"
while getopts "b:d:p:i:" arg; do while getopts "b:d:p:i:" arg; do
case $arg in case $arg in

2
initrd/bin/kexec-select-boot
View File

@ -4,7 +4,7 @@ set -e -o pipefail
. /tmp/config . /tmp/config
. /etc/functions . /etc/functions
DEBUG "Under /bin/kexec-select-boot" TRACE "Under /bin/kexec-select-boot"
add="" add=""
remove="" remove=""

2
initrd/bin/kexec-sign-config
View File

@ -4,7 +4,7 @@ set -e -o pipefail
. /tmp/config . /tmp/config
. /etc/functions . /etc/functions
DEBUG "Under /bin/kexec-sign-config" TRACE "Under /bin/kexec-sign-config"
rollback="n" rollback="n"
update="n" update="n"

2
initrd/bin/key-init
View File

@ -2,7 +2,7 @@
set -e -o pipefail set -e -o pipefail
. /etc/functions . /etc/functions
DEBUG "Under /bin/key-init" TRACE "Under /bin/key-init"
# Post processing of keys # Post processing of keys

2
initrd/bin/media-scan
View File

@ -5,7 +5,7 @@ set -e -o pipefail
. /etc/gui_functions . /etc/gui_functions
. /tmp/config . /tmp/config
DEBUG "Under /bin/media-scan" TRACE "Under /bin/media-scan"
# Unmount any previous boot device # Unmount any previous boot device
if grep -q /boot /proc/mounts ; then if grep -q /boot /proc/mounts ; then

2
initrd/bin/mount-usb
View File

@ -2,7 +2,7 @@
# Mount a USB device # Mount a USB device
. /etc/functions . /etc/functions
DEBUG "Under /bin/mount-usb" TRACE "Under /bin/mount-usb"
enable_usb enable_usb

2
initrd/bin/network-init-recovery
View File

@ -2,7 +2,7 @@
. /etc/functions . /etc/functions
DEBUG "Under /bin/network-init-recovery" TRACE "Under /bin/network-init-recovery"
# bring up the ethernet; maybe should do DHCP? # bring up the ethernet; maybe should do DHCP?
ifconfig lo 127.0.0.1 ifconfig lo 127.0.0.1

2
initrd/bin/oem-factory-reset
View File

@ -1,7 +1,7 @@
#!/bin/sh #!/bin/sh
# Automated setup of TPM, GPG keys, and disk # Automated setup of TPM, GPG keys, and disk
DEBUG "Under /bin/oem-factory-reset" TRACE "Under /bin/oem-factory-reset"
set -o pipefail set -o pipefail
. /etc/functions . /etc/functions

2
initrd/bin/oem-system-info-xx30
View File

@ -9,7 +9,7 @@ export BG_COLOR_MAIN_MENU=""
. /etc/luks-functions . /etc/luks-functions
. /tmp/config . /tmp/config
DEBUG "Under /bin/oem-system-info-xx30" TRACE "Under /bin/oem-system-info-xx30"
battery_charge="$(print_battery_charge)" battery_charge="$(print_battery_charge)"
battery_health="$(print_battery_health)" battery_health="$(print_battery_health)"

2
initrd/bin/poweroff
View File

@ -1,7 +1,7 @@
#!/bin/sh #!/bin/sh
. /etc/functions . /etc/functions
DEBUG "Under /bin/poweroff" TRACE "Under /bin/poweroff"
# Sync all mounted filesystems # Sync all mounted filesystems
echo s > /proc/sysrq-trigger echo s > /proc/sysrq-trigger

2
initrd/bin/qubes-measure-luks
View File

@ -3,7 +3,7 @@
# a PCR so that we can detect disk swap attacks. # a PCR so that we can detect disk swap attacks.
. /etc/functions . /etc/functions
DEBUG "Under /bin/qubes-measure-luks" TRACE "Under /bin/qubes-measure-luks"
die() { echo >&2 "$@"; exit 1; } die() { echo >&2 "$@"; exit 1; }

2
initrd/bin/reboot
View File

@ -1,7 +1,7 @@
#!/bin/sh #!/bin/sh
. /etc/functions . /etc/functions
DEBUG "Under /bin/reboot" TRACE "Under /bin/reboot"
# Sync all mounted filesystems # Sync all mounted filesystems
echo s > /proc/sysrq-trigger echo s > /proc/sysrq-trigger

4
initrd/bin/seal-hotpkey
View File

@ -10,7 +10,7 @@ HOTP_KEY="/boot/kexec_hotp_key"
mount_boot() mount_boot()
{ {
DEBUG "Under /bin/seal-htopkey:mount_boot" TRACE "Under /bin/seal-htopkey:mount_boot"
# Mount local disk if it is not already mounted # Mount local disk if it is not already mounted
if ! grep -q /boot /proc/mounts ; then if ! grep -q /boot /proc/mounts ; then
mount -o ro /boot \ mount -o ro /boot \
@ -18,7 +18,7 @@ mount_boot()
fi fi
} }
DEBUG "Under /bin/seal-hotpkey" TRACE "Under /bin/seal-hotpkey"
# Use stored HOTP key branding (this might be useful after OEM reset) # Use stored HOTP key branding (this might be useful after OEM reset)
if [ -r /boot/kexec_hotp_key ]; then if [ -r /boot/kexec_hotp_key ]; then

2
initrd/bin/seal-totp
View File

@ -7,7 +7,7 @@
. /etc/functions . /etc/functions
DEBUG "Under /bin/seal-totp" TRACE "Under /bin/seal-totp"
TPM_NVRAM_SPACE=4d47 TPM_NVRAM_SPACE=4d47

4
initrd/bin/unseal-hotp
View File

@ -9,7 +9,7 @@ HOTP_COUNTER="/boot/kexec_hotp_counter"
mount_boot_or_die() mount_boot_or_die()
{ {
DEBUG "Under /bin/unseal-hotp:mount_boot_or_die" TRACE "Under /bin/unseal-hotp:mount_boot_or_die"
# Mount local disk if it is not already mounted # Mount local disk if it is not already mounted
if ! grep -q /boot /proc/mounts ; then if ! grep -q /boot /proc/mounts ; then
mount -o ro /boot \ mount -o ro /boot \
@ -17,7 +17,7 @@ mount_boot_or_die()
fi fi
} }
DEBUG "Under /bin/unseal-hotp" TRACE "Under /bin/unseal-hotp"
# Store counter in file instead of TPM for now, as it conflicts with Heads # Store counter in file instead of TPM for now, as it conflicts with Heads
# config TPM counter as TPM 1.2 can only increment one counter between reboots # config TPM counter as TPM 1.2 can only increment one counter between reboots

2
initrd/bin/unseal-totp
View File

@ -6,7 +6,7 @@
TOTP_SEALED="/tmp/secret/totp.sealed" TOTP_SEALED="/tmp/secret/totp.sealed"
TOTP_SECRET="/tmp/secret/totp.key" TOTP_SECRET="/tmp/secret/totp.key"
DEBUG "Under /bin/unseal-totp" TRACE "Under /bin/unseal-totp"
tpm nv_readvalue \ tpm nv_readvalue \
-in 4d47 \ -in 4d47 \

2
initrd/bin/usb-init
View File

@ -4,7 +4,7 @@
. /etc/functions . /etc/functions
. /tmp/config . /tmp/config
DEBUG "Under /bin/usb-init" TRACE "Under /bin/usb-init"
if [ "$CONFIG_TPM" = "y" ]; then if [ "$CONFIG_TPM" = "y" ]; then
# Extend PCR4 as soon as possible # Extend PCR4 as soon as possible

2
initrd/bin/wget-measure.sh
View File

@ -3,7 +3,7 @@
. /etc/functions . /etc/functions
die() { die() {
DEBUG "Under /bin/wget-measure.sh:die" TRACE "Under /bin/wget-measure.sh:die"
echo >&2 "$@" echo >&2 "$@"
exit 1 exit 1
} }

2
initrd/bin/x230-flash.init
View File

@ -5,7 +5,7 @@
. /etc/functions . /etc/functions
. /tmp/config . /tmp/config
DEBUG "Under /bin/x230-flash.init" TRACE "Under /bin/x230-flash.init"
insmod /lib/modules/ehci-hcd.ko insmod /lib/modules/ehci-hcd.ko
insmod /lib/modules/ehci-pci.ko insmod /lib/modules/ehci-pci.ko

43
initrd/etc/functions
View File

@ -18,9 +18,16 @@ DEBUG() {
fi fi
} }
TRACE() {
if [ "$CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT" = "y" ];then
echo >&2 "TRACE: $*";
fi
}
recovery() { recovery() {
DEBUG "Under /etc/functions:recovery" TRACE "Under /etc/functions:recovery"
echo >&2 "!!!!! $*" echo >&2 "!!!!! $*"
# Remove any temporary secret files that might be hanging around # Remove any temporary secret files that might be hanging around
@ -52,7 +59,7 @@ recovery() {
} }
pause_recovery() { pause_recovery() {
DEBUG "Under /etc/functions:pause_recovery" TRACE "Under /etc/functions:pause_recovery"
read -p 'Hit enter to proceed to recovery shell:' read -p 'Hit enter to proceed to recovery shell:'
recovery $* recovery $*
} }
@ -63,7 +70,7 @@ pcrs() {
confirm_totp() confirm_totp()
{ {
DEBUG "Under /etc/functions:confirm_totp" TRACE "Under /etc/functions:confirm_totp"
prompt="$1" prompt="$1"
last_half=X last_half=X
unset totp_confirm unset totp_confirm
@ -103,7 +110,7 @@ confirm_totp()
enable_usb() enable_usb()
{ {
DEBUG "Under /etc/functions:enable_usb" TRACE "Under /etc/functions:enable_usb"
#insmod ehci_hcd prior of uhdc_hcd and ohci_hcd to suppress dmesg warning #insmod ehci_hcd prior of uhdc_hcd and ohci_hcd to suppress dmesg warning
if ! lsmod | grep -q ehci_hcd; then if ! lsmod | grep -q ehci_hcd; then
insmod /lib/modules/ehci-hcd.ko \ insmod /lib/modules/ehci-hcd.ko \
@ -148,7 +155,7 @@ enable_usb()
list_usb_storage() list_usb_storage()
{ {
DEBUG "Under /etc/functions:list_usb_storage" TRACE "Under /etc/functions:list_usb_storage"
stat -c %N /sys/block/sd* 2>/dev/null | grep usb | stat -c %N /sys/block/sd* 2>/dev/null | grep usb |
cut -f1 -d ' ' | cut -f1 -d ' ' |
sed "s/[']//g" | sed "s/[']//g" |
@ -188,7 +195,7 @@ list_usb_storage()
confirm_gpg_card() confirm_gpg_card()
{ {
DEBUG "Under /etc/functions:confirm_gpg_card" TRACE "Under /etc/functions:confirm_gpg_card"
read \ read \
-n 1 \ -n 1 \
-p "Please confirm that your GPG card is inserted [Y/n]: " \ -p "Please confirm that your GPG card is inserted [Y/n]: " \
@ -232,7 +239,7 @@ confirm_gpg_card()
check_tpm_counter() check_tpm_counter()
{ {
DEBUG "Under /etc/functions:check_tpm_counter" TRACE "Under /etc/functions:check_tpm_counter"
LABEL=${2:-3135106223} LABEL=${2:-3135106223}
# if the /boot.hashes file already exists, read the TPM counter ID # if the /boot.hashes file already exists, read the TPM counter ID
# from it. # from it.
@ -258,21 +265,21 @@ check_tpm_counter()
read_tpm_counter() read_tpm_counter()
{ {
DEBUG "Under /etc/functions:read_tpm_counter" TRACE "Under /etc/functions:read_tpm_counter"
tpm counter_read -ix "$1" | tee "/tmp/counter-$1" \ tpm counter_read -ix "$1" | tee "/tmp/counter-$1" \
|| die "Counter read failed" || die "Counter read failed"
} }
increment_tpm_counter() increment_tpm_counter()
{ {
DEBUG "Under /etc/functions:increment_tpm_counter" TRACE "Under /etc/functions:increment_tpm_counter"
tpm counter_increment -ix "$1" -pwdc '' \ tpm counter_increment -ix "$1" -pwdc '' \
| tee /tmp/counter-$1 \ | tee /tmp/counter-$1 \
|| die "Counter increment failed" || die "Counter increment failed"
} }
check_config() { check_config() {
DEBUG "Under /etc/functions:check_config" TRACE "Under /etc/functions:check_config"
if [ ! -d /tmp/kexec ]; then if [ ! -d /tmp/kexec ]; then
mkdir /tmp/kexec \ mkdir /tmp/kexec \
|| die 'Failed to make kexec tmp dir' || die 'Failed to make kexec tmp dir'
@ -301,7 +308,7 @@ check_config() {
} }
preserve_rom() { preserve_rom() {
DEBUG "Under /etc/functions:preserve_rom" TRACE "Under /etc/functions:preserve_rom"
new_rom="$1" new_rom="$1"
old_files=`cbfs -t 50 -l 2>/dev/null | grep "^heads/"` old_files=`cbfs -t 50 -l 2>/dev/null | grep "^heads/"`
@ -317,7 +324,7 @@ preserve_rom() {
done done
} }
replace_config() { replace_config() {
DEBUG "Under /etc/functions:replace_config" TRACE "Under /etc/functions:replace_config"
CONFIG_FILE=$1 CONFIG_FILE=$1
CONFIG_OPTION=$2 CONFIG_OPTION=$2
NEW_SETTING=$3 NEW_SETTING=$3
@ -333,13 +340,13 @@ replace_config() {
rm -f ${CONFIG_FILE}.tmp rm -f ${CONFIG_FILE}.tmp
} }
combine_configs() { combine_configs() {
DEBUG "Under /etc/functions:combine_configs" TRACE "Under /etc/functions:combine_configs"
cat /etc/config* > /tmp/config cat /etc/config* > /tmp/config
} }
update_checksums() update_checksums()
{ {
DEBUG "Under /etc/functions:update_checksums" TRACE "Under /etc/functions:update_checksums"
# ensure /boot mounted # ensure /boot mounted
if ! grep -q /boot /proc/mounts ; then if ! grep -q /boot /proc/mounts ; then
mount -o ro /boot \ mount -o ro /boot \
@ -367,7 +374,7 @@ update_checksums()
} }
print_tree() { print_tree() {
DEBUG "Under /etc/functions:print_tree" TRACE "Under /etc/functions:print_tree"
find ./ ! -path './kexec*' -print0 | sort -z find ./ ! -path './kexec*' -print0 | sort -z
} }
@ -435,7 +442,7 @@ escape_zero() {
# due to https://bugs.busybox.net/show_bug.cgi?id=14226. Also, certain characters # due to https://bugs.busybox.net/show_bug.cgi?id=14226. Also, certain characters
# may be intepreted by `whiptail`, `less` et al (e.g. \n, \b, ...). # may be intepreted by `whiptail`, `less` et al (e.g. \n, \b, ...).
assert_signable() { assert_signable() {
DEBUG "Under /etc/functions:assert_signable" TRACE "Under /etc/functions:assert_signable"
# ensure /boot mounted # ensure /boot mounted
if ! grep -q /boot /proc/mounts ; then if ! grep -q /boot /proc/mounts ; then
mount -o ro /boot || die "Unable to mount /boot" mount -o ro /boot || die "Unable to mount /boot"
@ -455,7 +462,7 @@ assert_signable() {
verify_checksums() verify_checksums()
{ {
DEBUG "Under /etc/functions:verify_checksums" TRACE "Under /etc/functions:verify_checksums"
local boot_dir="$1" local boot_dir="$1"
local gui="${2:-y}" local gui="${2:-y}"
@ -489,7 +496,7 @@ verify_checksums()
# mount /boot if successful # mount /boot if successful
detect_boot_device() detect_boot_device()
{ {
DEBUG "Under /etc/functions:detect_boot_device" TRACE "Under /etc/functions:detect_boot_device"
# unmount /boot to be safe # unmount /boot to be safe
cd / && umount /boot 2>/dev/null cd / && umount /boot 2>/dev/null

4
initrd/etc/gui_functions
View File

@ -4,7 +4,7 @@
mount_usb() mount_usb()
{ {
DEBUG "under gui_functions:mount_usb" TRACE "under gui_functions:mount_usb"
# Unmount any previous USB device # Unmount any previous USB device
if grep -q /media /proc/mounts ; then if grep -q /media /proc/mounts ; then
umount /media || die "Unable to unmount /media" umount /media || die "Unable to unmount /media"
@ -25,7 +25,7 @@ mount_usb()
file_selector() file_selector()
{ {
DEBUG "under gui_functions:file_selector" TRACE "under gui_functions:file_selector"
FILE="" FILE=""
FILE_LIST=$1 FILE_LIST=$1
MENU_MSG=${2:-"Choose the file"} MENU_MSG=${2:-"Choose the file"}

2
initrd/init
View File

@ -43,7 +43,7 @@ hwclock -l -s
. /etc/functions . /etc/functions
. /etc/config . /etc/config
DEBUG "Under init" TRACE "Under init"
# set CONFIG_TPM dynamically before init # set CONFIG_TPM dynamically before init
if [ -e /dev/tpm0 ]; then if [ -e /dev/tpm0 ]; then