Introduce SAFT TPM testing support.

This CL builds upon previous SAFT enhancements and
introduces support for TPM kernel rollback testing.

The test as introduced checks the following:

- kernels with version below the current TMP version
  do not get booted.

- if there is no kernel with the version equal or exceeding
  the TPM kernel version value - boot in recovery mode.

- if both kernels's versions exceed the current TPM kernel
version value - verify that the BIOS bumps up the TPM kernel
version to the lowest of the two available kernels. (as of
now in this test both kernels have the same version number)

A new module is being introduced to support TPM testing.

There are two TPM NvRam spaces defined for CromeOs devices,
one for the BIOS and another one for the kernel. The spaces,
among other things, contain version numbers to prevent
rollback attempts. 

The new module allows to read the spaces' contents and to
write into them.  Writing into the kernel space requires 
the machine to be booted in recovery mode, writing into the
 BIOS  space (not yet tested) requires the machine to be 
booted in developer mode. 

On top of booting in these special  modes, the TPM lock 
needs to be disabled for the write operation to succeed. 
This requires editing of the TPM  upstart config file 
(done in  tpm_handler:TpmHandler:enable_write_access()),
which in turn requires the root file system to be writable
when booting in recovery mode. Hence the modifications in
runtests.sh which first enable read/write mount of
the USB flash hosted the root file system and then modify
the kernel command line to mount it rw when booting off
the USB device.


Change-Id: I3a44ae51830f3525f51f03611d8b72a7039c9169

BUG=chromium-os:1976
TEST=manual

- build packages and the image as modified
- install the new image on the device and restart it
- place an alternative firmware image in /tmp
- run the SAFT as follows:
  /usr/sbin/firmware/saft/runtests.sh /tmp/<new firmware>.fd
- follow the prompts (unplug and plug the flash device as
  required
- observe SAFT to pass all 17 steps
- look for 'we are done' in /tmp/saft.log after test
  completes
into

Committed: http://chrome-svn/viewvc/chromeos?view=rev&revision=3f200dc

[Randall Spangler, 2010-10-22 22:07:50]

LGTM, just a few comments to fix

http://codereview.chromium.org/3781016/diff/49001/33009
File saft_utility.py (right):

http://codereview.chromium.org/3781016/diff/49001/33009#newcode310
saft_utility.py:310: # On each non flash rooted start confirm that kernel
versions
SSD and USB are both flash.  Do you mean on each boot from SSD?

http://codereview.chromium.org/3781016/diff/49001/33009#newcode396
saft_utility.py:396: '''Add two to the both kernels' versions.
the both -> both

http://codereview.chromium.org/3781016/diff/49001/33011
File tpm_handler.py (right):

http://codereview.chromium.org/3781016/diff/49001/33011#newcode27
tpm_handler.py:27: versions are stored. The total version field size if 4 bytes,
the
if -> is

http://codereview.chromium.org/3781016/diff/49001/33011#newcode32
tpm_handler.py:32: second element is an array of bytes the pattern must to
match.
to match -> match

[vb, 2010-10-22 22:22:18]

http://codereview.chromium.org/3781016/diff/49001/33009
File saft_utility.py (right):

http://codereview.chromium.org/3781016/diff/49001/33009#newcode310
saft_utility.py:310: # On each non flash rooted start confirm that kernel
versions
On 2010/10/22 22:07:50, Randall Spangler wrote:
> SSD and USB are both flash.  Do you mean on each boot from SSD?
> 
It is about USB flash (I still have this mental image of hard drive used as the
main storage :P). Fixed the comment.

http://codereview.chromium.org/3781016/diff/49001/33009#newcode396
saft_utility.py:396: '''Add two to the both kernels' versions.
On 2010/10/22 22:07:50, Randall Spangler wrote:
> the both -> both

Done.

http://codereview.chromium.org/3781016/diff/49001/33011
File tpm_handler.py (right):

http://codereview.chromium.org/3781016/diff/49001/33011#newcode27
tpm_handler.py:27: versions are stored. The total version field size if 4 bytes,
the
On 2010/10/22 22:07:50, Randall Spangler wrote:
> if -> is

Done.

http://codereview.chromium.org/3781016/diff/49001/33011#newcode32
tpm_handler.py:32: second element is an array of bytes the pattern must to
match.
On 2010/10/22 22:07:50, Randall Spangler wrote:
> to match -> match

Done.