coreboot-gerrit November 2018

coreboot-gerrit@coreboot.org

1 participants
1699 discussions

Change in coreboot[master]: include/program_loading: Add POSTCAR prog type
by Patrick Georgi (Code Review) 08 Nov '18

08 Nov '18

Patrick Georgi has posted comments on this change. ( https://review.coreboot.org/29545 ) Change subject: include/program_loading: Add POSTCAR prog type ...................................................................... Patch Set 2: (1 comment) https://review.coreboot.org/#/c/29545/2/src/include/program_loading.h File src/include/program_loading.h: https://review.coreboot.org/#/c/29545/2/src/include/program_loading.h@35 PS2, Line 35: PROG_POSTCAR, not sure if it's safe to renumber items -- To view, visit https://review.coreboot.org/29545 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ifa6af9cf20aad27ca87a86817e6ad0a0d1de17c8 Gerrit-Change-Number: 29545 Gerrit-PatchSet: 2 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com> Gerrit-Reviewer: Patrick Rudolph <patrick.rudolph(a)9elements.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Thu, 08 Nov 2018 11:24:49 +0000 Gerrit-HasComments: Yes Gerrit-HasLabels: No

1 0

Change in coreboot[master]: drivers/*/tpm: Add postcar target
by Patrick Georgi (Code Review) 08 Nov '18

08 Nov '18

Patrick Georgi has posted comments on this change. ( https://review.coreboot.org/29546 ) Change subject: drivers/*/tpm: Add postcar target ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://review.coreboot.org/29546 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I758185daf3941a29883c2256b900360e112275e1 Gerrit-Change-Number: 29546 Gerrit-PatchSet: 1 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com> Gerrit-Reviewer: Patrick Rudolph <patrick.rudolph(a)9elements.com> Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Thu, 08 Nov 2018 11:24:13 +0000 Gerrit-HasComments: No Gerrit-HasLabels: Yes

1 0

Change in coreboot[master]: siemens/mc_apl3: Set Full Reset Bit into Reset Control Register
by Mario Scheithauer (Code Review) 08 Nov '18

08 Nov '18

Mario Scheithauer has posted comments on this change. ( https://review.coreboot.org/29530 ) Change subject: siemens/mc_apl3: Set Full Reset Bit into Reset Control Register ...................................................................... Patch Set 2: (1 comment) https://review.coreboot.org/#/c/29530/1/src/mainboard/siemens/mc_apl1/varia… File src/mainboard/siemens/mc_apl1/variants/mc_apl3/mainboard.c: https://review.coreboot.org/#/c/29530/1/src/mainboard/siemens/mc_apl1/varia… PS1, Line 68: reset b > drive Okay. That's clearer. Thanks! -- To view, visit https://review.coreboot.org/29530 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ib842f15b6ba14851d7f9b1b97c83389adc61f50b Gerrit-Change-Number: 29530 Gerrit-PatchSet: 2 Gerrit-Owner: Mario Scheithauer <mario.scheithauer(a)siemens.com> Gerrit-Reviewer: Mario Scheithauer <mario.scheithauer(a)siemens.com> Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Thu, 08 Nov 2018 11:11:19 +0000 Gerrit-HasComments: Yes Gerrit-HasLabels: No

1 0

Change in coreboot[master]: siemens/mc_apl3: Set Full Reset Bit into Reset Control Register
by Mario Scheithauer (Code Review) 08 Nov '18

08 Nov '18

Hello Werner Zeh, build bot (Jenkins), I'd like you to reexamine a change. Please visit https://review.coreboot.org/29530 to look at the new patch set (#2). Change subject: siemens/mc_apl3: Set Full Reset Bit into Reset Control Register ...................................................................... siemens/mc_apl3: Set Full Reset Bit into Reset Control Register This mainboard provides customer hardware reset button. A feature of this button is that it holds the APL in reset state as long as the reset button is pressed. After releasing the reset button the APL should restart again without the need for a power cycle. When Bit 3 in Reset Control Register (I/O port CF9h) is set to 1 and then the reset button is pressed the PCH will drive SLP_S3 active (low). Change-Id: Ib842f15b6ba14851d7f9b1b97c83389adc61f50b Signed-off-by: Mario Scheithauer <mario.scheithauer(a)siemens.com> --- M src/mainboard/siemens/mc_apl1/variants/mc_apl3/mainboard.c 1 file changed, 8 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/30/29530/2 -- To view, visit https://review.coreboot.org/29530 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: newpatchset Gerrit-Change-Id: Ib842f15b6ba14851d7f9b1b97c83389adc61f50b Gerrit-Change-Number: 29530 Gerrit-PatchSet: 2 Gerrit-Owner: Mario Scheithauer <mario.scheithauer(a)siemens.com> Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>

1 0

Change in coreboot[master]: drivers/spi: Return error in failure case
by Philipp Deppenwiese (Code Review) 08 Nov '18

08 Nov '18

Philipp Deppenwiese has submitted this change and it was merged. ( https://review.coreboot.org/29531 ) Change subject: drivers/spi: Return error in failure case ...................................................................... drivers/spi: Return error in failure case In case the function pointer isn't set return an error. Change-Id: I9de300f651ac93889dafa7377c876bf5ae2c50cc Signed-off-by: Patrick Rudolph <patrick.rudolph(a)9elements.com> Reviewed-on: https://review.coreboot.org/29531 Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> Reviewed-by: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> --- M src/drivers/spi/spi_flash.c 1 file changed, 2 insertions(+), 2 deletions(-) Approvals: build bot (Jenkins): Verified Philipp Deppenwiese: Looks good to me, approved diff --git a/src/drivers/spi/spi_flash.c b/src/drivers/spi/spi_flash.c index cc21ccb..b0b5899 100644 --- a/src/drivers/spi/spi_flash.c +++ b/src/drivers/spi/spi_flash.c @@ -448,7 +448,7 @@ if (!flash->ops->get_write_protection) { printk(BIOS_WARNING, "SPI: Write-protection gathering not " "implemented for this vendor.\n"); - return 0; + return -1; } return flash->ops->get_write_protection(flash, region); @@ -473,7 +473,7 @@ if (!flash->ops->set_write_protection) { printk(BIOS_WARNING, "SPI: Setting write-protection is not " "implemented for this vendor.\n"); - return 0; + return -1; } ret = flash->ops->set_write_protection(flash, region, non_volatile, -- To view, visit https://review.coreboot.org/29531 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: merged Gerrit-Change-Id: I9de300f651ac93889dafa7377c876bf5ae2c50cc Gerrit-Change-Number: 29531 Gerrit-PatchSet: 2 Gerrit-Owner: Patrick Rudolph <patrick.rudolph(a)9elements.com> Gerrit-Reviewer: David Hendricks <david.hendricks(a)gmail.com> Gerrit-Reviewer: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>

1 0

Change in coreboot[master]: include/program_loading: Add POSTCAR prog type
by Patrick Rudolph (Code Review) 08 Nov '18

08 Nov '18

Patrick Rudolph has posted comments on this change. ( https://review.coreboot.org/29545 ) Change subject: include/program_loading: Add POSTCAR prog type ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://review.coreboot.org/29545 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ifa6af9cf20aad27ca87a86817e6ad0a0d1de17c8 Gerrit-Change-Number: 29545 Gerrit-PatchSet: 2 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com> Gerrit-Reviewer: Patrick Rudolph <patrick.rudolph(a)9elements.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Thu, 08 Nov 2018 10:52:29 +0000 Gerrit-HasComments: No Gerrit-HasLabels: Yes

1 0

Change in coreboot[master]: security/vboot: Add measured boot mode
by Patrick Rudolph (Code Review) 08 Nov '18

08 Nov '18

Patrick Rudolph has posted comments on this change. ( https://review.coreboot.org/29547 ) Change subject: security/vboot: Add measured boot mode ...................................................................... Patch Set 3: (5 comments) https://review.coreboot.org/#/c/29547/3/src/lib/prog_ops.c File src/lib/prog_ops.c: https://review.coreboot.org/#/c/29547/3/src/lib/prog_ops.c@40 PS3, Line 40: vboot_prog_run(prog); if (IS_ENABLED(CONFIG_VBOOT_MEASURED_BOOT)) .... https://review.coreboot.org/#/c/29547/3/src/lib/prog_ops.c@50 PS3, Line 50: void __weak vboot_prog_run(struct prog *prog) no need for weak https://review.coreboot.org/#/c/29547/3/src/security/vboot/vboot_crtm.c File src/security/vboot/vboot_crtm.c: https://review.coreboot.org/#/c/29547/3/src/security/vboot/vboot_crtm.c@63 PS3, Line 63: == 0) { strange code formating https://review.coreboot.org/#/c/29547/3/src/security/vboot/vboot_crtm.c@105 PS3, Line 105: void vboot_prog_run(struct prog *prog) vboot_measure() ? https://review.coreboot.org/#/c/29547/3/src/security/vboot/vboot_crtm.c@107 PS3, Line 107: switch (prog->type) { map PROG_* to TPM_*_PCR instead, makes it more readable. -- To view, visit https://review.coreboot.org/29547 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I339a2f1051e44f36aba9f99828f130592a09355e Gerrit-Change-Number: 29547 Gerrit-PatchSet: 3 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com> Gerrit-Reviewer: Patrick Rudolph <patrick.rudolph(a)9elements.com> Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Comment-Date: Thu, 08 Nov 2018 10:51:54 +0000 Gerrit-HasComments: Yes Gerrit-HasLabels: No

1 0

Change in coreboot[master]: security/vboot: Add measured boot mode
by Philipp Deppenwiese (Code Review) 08 Nov '18

08 Nov '18

Hello Werner Zeh, Patrick Rudolph, build bot (Jenkins), Patrick Georgi, I'd like you to reexamine a change. Please visit https://review.coreboot.org/29547 to look at the new patch set (#3). Change subject: security/vboot: Add measured boot mode ...................................................................... security/vboot: Add measured boot mode * Introduce a measured boot mode into vboot. * Add hook for stage measurements in prog_ops. * Implement and hook-up CRTM in vboot. Change-Id: I339a2f1051e44f36aba9f99828f130592a09355e Signed-off-by: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> --- M src/include/program_loading.h M src/lib/prog_ops.c M src/security/vboot/Kconfig M src/security/vboot/Makefile.inc A src/security/vboot/vboot_crtm.c A src/security/vboot/vboot_crtm.h M src/security/vboot/vboot_logic.c 7 files changed, 227 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/47/29547/3 -- To view, visit https://review.coreboot.org/29547 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: newpatchset Gerrit-Change-Id: I339a2f1051e44f36aba9f99828f130592a09355e Gerrit-Change-Number: 29547 Gerrit-PatchSet: 3 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com> Gerrit-Reviewer: Patrick Rudolph <patrick.rudolph(a)9elements.com> Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>

1 0

Change in coreboot[master]: security/vboot: Add measured boot mode
by Philipp Deppenwiese (Code Review) 08 Nov '18

08 Nov '18

Hello build bot (Jenkins), I'd like you to reexamine a change. Please visit https://review.coreboot.org/29547 to look at the new patch set (#2). Change subject: security/vboot: Add measured boot mode ...................................................................... security/vboot: Add measured boot mode * Introduce a measured boot mode into vboot. * Add hook for stage measurements in prog_ops. * Implement and hook-up CRTM in vboot. Change-Id: I339a2f1051e44f36aba9f99828f130592a09355e Signed-off-by: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> --- M src/include/program_loading.h M src/lib/prog_ops.c M src/security/vboot/Kconfig M src/security/vboot/Makefile.inc A src/security/vboot/vboot_crtm.c A src/security/vboot/vboot_crtm.h M src/security/vboot/vboot_logic.c 7 files changed, 228 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/47/29547/2 -- To view, visit https://review.coreboot.org/29547 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: newpatchset Gerrit-Change-Id: I339a2f1051e44f36aba9f99828f130592a09355e Gerrit-Change-Number: 29547 Gerrit-PatchSet: 2 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>

1 0

Change in coreboot[master]: security/vboot: Add measured boot mode
by Philipp Deppenwiese (Code Review) 08 Nov '18

08 Nov '18

Philipp Deppenwiese has uploaded this change for review. ( https://review.coreboot.org/29547 Change subject: security/vboot: Add measured boot mode ...................................................................... security/vboot: Add measured boot mode * Introduce a measured boot mode into vboot. * Add hook for stage measurements in prog_ops. * Implement and hook-up CRTM in vboot. Change-Id: I339a2f1051e44f36aba9f99828f130592a09355e Signed-off-by: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> --- M src/include/program_loading.h M src/lib/prog_ops.c M src/security/vboot/Kconfig M src/security/vboot/Makefile.inc A src/security/vboot/vboot_crtm.c A src/security/vboot/vboot_crtm.h M src/security/vboot/vboot_logic.c 7 files changed, 228 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/47/29547/1 diff --git a/src/include/program_loading.h b/src/include/program_loading.h index 26d0295..c902fcc 100644 --- a/src/include/program_loading.h +++ b/src/include/program_loading.h @@ -146,6 +146,8 @@ * special that needs to be done by the platform similar to the architecture * code it needs to that as well. */ void platform_prog_run(struct prog *prog); +/* VBOOT specific hook */ +void measured_prog_run(struct prog *prog); struct prog_loader_ops { const char *name; diff --git a/src/lib/prog_ops.c b/src/lib/prog_ops.c index 2641ac6..e7d44d3 100644 --- a/src/lib/prog_ops.c +++ b/src/lib/prog_ops.c @@ -15,6 +15,7 @@ */ #include <program_loading.h> +#include <security/vboot/vboot_crtm.h> /* For each segment of a program loaded this function is called*/ void prog_segment_loaded(uintptr_t start, size_t size, int flags) @@ -37,6 +38,7 @@ void prog_run(struct prog *prog) { + vboot_prog_run(prog); platform_prog_run(prog); arch_prog_run(prog); } @@ -45,3 +47,8 @@ { /* do nothing */ } + +void __weak vboot_prog_run(struct prog *prog) +{ + /* do nothing */ +} diff --git a/src/security/vboot/Kconfig b/src/security/vboot/Kconfig index 77483d1..e7cb43a 100644 --- a/src/security/vboot/Kconfig +++ b/src/security/vboot/Kconfig @@ -25,6 +25,12 @@ if VBOOT +config VBOOT_MEASURED_BOOT + bool "Enable Measured Boot mode" + default n + help + Enables measured boot mode in vboot + config VBOOT_VBNV_CMOS bool default n diff --git a/src/security/vboot/Makefile.inc b/src/security/vboot/Makefile.inc index f51db80..7e16193 100644 --- a/src/security/vboot/Makefile.inc +++ b/src/security/vboot/Makefile.inc @@ -62,6 +62,16 @@ ramstage-y += vboot_common.c postcar-y += vboot_common.c +ifeq ($(CONFIG_VBOOT_MEASURED_BOOT),y) +ifneq ($(CONFIG_VBOOT_SEPARATE_VERSTAGE),y) +bootblock-$(CONFIG_VBOOT_STARTS_IN_BOOTBLOCK) += vboot_crtm.c +endif +verstage-y += vboot_crtm.c +romstage-y += vboot_crtm.c +ramstage-y += vboot_crtm.c +postcar-y += vboot_crtm.c +endif + bootblock-y += common.c verstage-y += vboot_logic.c verstage-y += common.c diff --git a/src/security/vboot/vboot_crtm.c b/src/security/vboot/vboot_crtm.c new file mode 100644 index 0000000..5b76aa8 --- /dev/null +++ b/src/security/vboot/vboot_crtm.c @@ -0,0 +1,154 @@ +/* + * This file is part of the coreboot project. + * + * Copyright (C) 2018 Facebook Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; version 2 of the License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#include <cbfs.h> +#include <console/console.h> +#include <fmap.h> +#include <security/tpm/tspi.h> +#include <security/vboot/vboot_crtm.h> +#include <program_loading.h> + +uint32_t vboot_init_crtm(void) +{ + struct prog bootblock = PROG_INIT(PROG_BOOTBLOCK, "bootblock"); + struct prog verstage = + PROG_INIT(PROG_VERSTAGE, CONFIG_CBFS_PREFIX "/verstage"); + struct prog romstage = + PROG_INIT(PROG_ROMSTAGE, CONFIG_CBFS_PREFIX "/romstage"); + + /* measure bootblock from RO */ + struct cbfsf bootblock_data; + if (cbfs_boot_locate(&bootblock_data, + prog_name(&bootblock), + NULL) + == 0) { + cbfs_file_data(prog_rdev(&bootblock), &bootblock_data); + + if (tpm_measure_region(prog_rdev(&bootblock), + TPM_BOOTBLOCK_PCR, + "bootblock")) { + return VB2_ERROR_UNKNOWN; + } + } else { + struct region_device fmap; + if (fmap_locate_area_as_rdev("BOOTBLOCK", &fmap) == 0) { + if (tpm_measure_region(&fmap, TPM_BOOTBLOCK_PCR, + "bootblock")) { + return VB2_ERROR_UNKNOWN; + } + } else { + printk(BIOS_INFO, + "VBOOT: Couldn't measure %s into CRTM!", + "bootblock"); + } + } + + if (IS_ENABLED(CONFIG_VBOOT_STARTS_IN_ROMSTAGE)) { + struct cbfsf romstage_data; + /* measure verstage from RO */ + if (cbfs_boot_locate(&romstage_data, prog_name(&romstage), + NULL) + == 0) { + cbfs_file_data(prog_rdev(&romstage), &romstage_data); + + if (tpm_measure_region(prog_rdev(&romstage), + TPM_STAGE_ROMSTAGE_PCR, + CONFIG_CBFS_PREFIX + "/romstage") + != TPM_SUCCESS) { + return VB2_ERROR_UNKNOWN; + } + } else { + printk(BIOS_INFO, + "VBOOT: Couldn't measure %s into CRTM!", + CONFIG_CBFS_PREFIX "/romstage"); + } + } + + if (IS_ENABLED(CONFIG_VBOOT_SEPARATE_VERSTAGE)) { + struct cbfsf verstage_data; + /* measure verstage from RO */ + if (cbfs_boot_locate(&verstage_data, prog_name(&verstage), + NULL) + == 0) { + cbfs_file_data(prog_rdev(&verstage), &verstage_data); + + if (tpm_measure_region(prog_rdev(&verstage), + TPM_STAGE_VERSTAGE_PCR, + CONFIG_CBFS_PREFIX + "/verstage") + != TPM_SUCCESS) { + return VB2_ERROR_UNKNOWN; + } + } else { + printk(BIOS_INFO, + "VBOOT: Couldn't measure %s into CRTM!", + CONFIG_CBFS_PREFIX "/verstage"); + } + } + + return VB2_SUCCESS; +} + +void vboot_prog_run(struct prog *prog) +{ + switch (prog->type) { + case PROG_BOOTBLOCK: + tpm_measure_region(prog_rdev(prog), TPM_BOOTBLOCK_PCR, + prog->name); + break; + case PROG_VERSTAGE: + tpm_measure_region(prog_rdev(prog), TPM_STAGE_VERSTAGE_PCR, + prog->name); + break; + case PROG_ROMSTAGE: + tpm_measure_region(prog_rdev(prog), TPM_STAGE_ROMSTAGE_PCR, + prog->name); + break; + case PROG_RAMSTAGE: + tpm_measure_region(prog_rdev(prog), TPM_STAGE_RAMSTAGE_PCR, + prog->name); + break; + case PROG_BL32: + tpm_measure_region(prog_rdev(prog), TPM_ARM_BL32_PCR, + prog->name); + break; + case PROG_BL31: + tpm_measure_region(prog_rdev(prog), TPM_ARM_BL31_PCR, + prog->name); + break; + case PROG_PAYLOAD: + tpm_measure_region(prog_rdev(prog), TPM_PAYLOAD_PCR, + prog->name); + break; + case PROG_REFCODE: + tpm_measure_region(prog_rdev(prog), TPM_INTEL_FSP_PCR, + prog->name); + break; + case PROG_POSTCAR: + tpm_measure_region(prog_rdev(prog), TPM_STAGE_POSTCAR_PCR, + prog->name); + break; + case PROG_UNKNOWN: + if (prog->name) { + tpm_measure_region(prog_rdev(prog), TPM_UNKNOWN_PCR, + prog->name); + } else { + die("Can't execute program if measured boot is active " + "and no program name given."); + } + break; + } +} diff --git a/src/security/vboot/vboot_crtm.h b/src/security/vboot/vboot_crtm.h new file mode 100644 index 0000000..d05fc14 --- /dev/null +++ b/src/security/vboot/vboot_crtm.h @@ -0,0 +1,42 @@ +/* + * This file is part of the coreboot project. + * + * Copyright (C) 2018 Facebook Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; version 2 of the License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#ifndef __VBOOT_VBOOT_CRTM_H__ +#define __VBOOT_VBOOT_CRTM_H__ + +// CRTM +#define TPM_BOOTBLOCK_PCR 0 +#define TPM_STAGE_VERSTAGE_PCR 0 +#define TPM_STAGE_ROMSTAGE_PCR 0 + +// Soc Init +#define TPM_STAGE_POSTCAR_PCR 1 +#define TPM_STAGE_RAMSTAGE_PCR 1 +#define TPM_INTEL_FSP_PCR 1 + +// Payload +#define TPM_PAYLOAD_PCR 3 +#define TPM_ARM_BL31_PCR 3 +#define TPM_ARM_BL32_PCR 3 + +// Unknown +#define TPM_UNKNOWN_PCR 4 + +//PCR for measuring data which might not be part of the TPM sealing +#define TPM_WHITELISTED_PCR 23 + +uint32_t vboot_init_crtm(void); + +#endif /* __VBOOT_VBOOT_CRTM_H__ */ diff --git a/src/security/vboot/vboot_logic.c b/src/security/vboot/vboot_logic.c index 1b24160..b9ee802 100644 --- a/src/security/vboot/vboot_logic.c +++ b/src/security/vboot/vboot_logic.c @@ -24,6 +24,7 @@ #include <vb2_api.h> #include <security/vboot/misc.h> #include <security/vboot/vbnv.h> +#include <security/vboot/vboot_crtm.h> #include "antirollback.h" @@ -319,6 +320,12 @@ antirollback_read_space_firmware(&ctx); timestamp_add_now(TS_END_TPMINIT); + /* Enable measured boot mode */ + if (IS_ENABLED(CONFIG_VBOOT_MEASURED_BOOT)) { + if (vboot_init_crtm() != VB2_SUCCESS) + die("Initializing measured boot mode failed!"); + } + if (IS_ENABLED(CONFIG_VBOOT_PHYSICAL_DEV_SWITCH) && get_developer_mode_switch()) ctx.flags |= VB2_CONTEXT_FORCE_DEVELOPER_MODE; -- To view, visit https://review.coreboot.org/29547 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: newchange Gerrit-Change-Id: I339a2f1051e44f36aba9f99828f130592a09355e Gerrit-Change-Number: 29547 Gerrit-PatchSet: 1 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com>

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

coreboot-gerrit November 2018