Script to diagnose and fix TPM problems in recovery mode.

Script to diagnose and fix TPM problems in recovery mode.

Change-Id: I750bbc5c87bf824f0450986dd92be0cb8aea5555

BUG=
TEST=

Committed: http://chrome-svn/viewvc/chromeos?view=rev&revision=3e3704f

[Luigi Semenzato, 2010-10-22 21:47:01]

First stab at an all-encompassing TPM fixit script.

First script: chromeos_tpm_recovery

chromeos_tpm_recovery runs in recovery mode with the TPM fully unlocked.  It
checks the state of the TPM with respect to verified boot and if anything
doesn't match expectations it aggressively tries to fix it.

"Aggressively" means no questions asked.  That would be difficult because we
have no UI.  So, for instance, if the kernel space is bad (a simple, stupid
attack) this script will remove the space and try to recreate it.  If it cannot
recreate the space for lack of room on the TPM, it will start removing all TPM
spaces it doesn't recognize until there is enough room. 

Second script: chromeos_tpm_recovery_test

For ease of testing the first script, this script creates fake versions of tpmc,
tpm-nvtool, and tpm_takeownership in a test directory.  It then runs
chromeos_tpm_recovery from various initial states, so the programmer can see
what goes on.

As this script evolves, it should become part of the emerge for this package,
with the addition of code to parse the chromeos_tpm_recovery log and checking
that its content doesn't change.

This ought to provide a few minutes of entertaining bathroom reading.

[Randall Spangler, 2010-10-22 23:20:13]

http://codereview.chromium.org/3838008/diff/6001/7001
File utility/chromeos_tpm_recovery (right):

http://codereview.chromium.org/3838008/diff/6001/7001#newcode20
utility/chromeos_tpm_recovery:20: awk=/usr/bin/awk
$USR_BIN/awk?

http://codereview.chromium.org/3838008/diff/6001/7001#newcode273
utility/chromeos_tpm_recovery:273: ensure_tcsd_is_not_running
This won't work, because tcsd_pid is still 0.  Need to set tcsd_pid first. 
(Might be reasonable to do that up at line 29)

[Luigi Semenzato, 2010-10-23 00:36:10]

Thank you for the comment.  Please keep sending them!

http://codereview.chromium.org/3838008/diff/6001/7001
File utility/chromeos_tpm_recovery (right):

http://codereview.chromium.org/3838008/diff/6001/7001#newcode20
utility/chromeos_tpm_recovery:20: awk=/usr/bin/awk
On 2010/10/22 23:20:13, Randall Spangler wrote:
> $USR_BIN/awk?

Well actually, no.  I don't want to fake awk.  Maybe I shouldn't even use the
full path.

http://codereview.chromium.org/3838008/diff/6001/7001#newcode273
utility/chromeos_tpm_recovery:273: ensure_tcsd_is_not_running
On 2010/10/22 23:20:13, Randall Spangler wrote:
> This won't work, because tcsd_pid is still 0.  Need to set tcsd_pid first. 
> (Might be reasonable to do that up at line 29)

This is just protecting against accidentally running tcsd earlier in the script.
 Maybe I don't need it.  Originally I thought I'd run this in tcsd.conf so I
didn't want to do a "stop tcsd" and possibly kill myself.  Now I know I need to
move this to tpm-probe.conf so I could do a "stop tcsd" but it's not that
useful.  Perhaps I should just remove this line.

[Randall Spangler, 2010-10-25 17:57:51]

LGTM