coreboot-gerrit February 2018

coreboot-gerrit@coreboot.org

1 participants
1573 discussions

Change in coreboot[master]: drivers/i2c: Add i2c TPM support for different stages
by build bot (Jenkins) (Code Review) 14 Feb '18

14 Feb '18

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/23759 ) Change subject: drivers/i2c: Add i2c TPM support for different stages ...................................................................... Patch Set 1: Verified+1 Build Successful https://qa.coreboot.org/job/coreboot-gerrit/67466/ : SUCCESS https://qa.coreboot.org/job/coreboot-checkpatch/22003/ : SUCCESS -- To view, visit https://review.coreboot.org/23759 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ib0839933f8b59f0c87cdda4e5374828bd6f1099f Gerrit-Change-Number: 23759 Gerrit-PatchSet: 1 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Wed, 14 Feb 2018 16:01:53 +0000 Gerrit-HasComments: No Gerrit-HasLabels: Yes

1 0

Change in coreboot[master]: soc/intel/denverton_ns: Add UART legacy mode with FSP traces
by build bot (Jenkins) (Code Review) 14 Feb '18

14 Feb '18

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/23623 ) Change subject: soc/intel/denverton_ns: Add UART legacy mode with FSP traces ...................................................................... Patch Set 3: Verified+1 Build Successful https://qa.coreboot.org/job/coreboot-gerrit/67465/ : SUCCESS https://qa.coreboot.org/job/coreboot-checkpatch/22002/ : SUCCESS -- To view, visit https://review.coreboot.org/23623 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Id8801e178ffd8eeee78ece07da7bd6b8dbd88538 Gerrit-Change-Number: 23623 Gerrit-PatchSet: 3 Gerrit-Owner: Julien Viard de Galbert <jviarddegalbert(a)online.net> Gerrit-Reviewer: FEI WANG <wangfei.jimei(a)gmail.com> Gerrit-Reviewer: Julien Viard de Galbert <jviarddegalbert(a)online.net> Gerrit-Reviewer: Paul Menzel <paulepanter(a)users.sourceforge.net> Gerrit-Reviewer: Shine Liu <shine.liu(a)intel.com> Gerrit-Reviewer: Vanny E <vanessa.f.eusebio(a)intel.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Wed, 14 Feb 2018 15:52:09 +0000 Gerrit-HasComments: No Gerrit-HasLabels: Yes

1 0

Change in coreboot[master]: drivers/i2c: Add i2c TPM support for different stages
by Philipp Deppenwiese (Code Review) 14 Feb '18

14 Feb '18

Philipp Deppenwiese has uploaded this change for review. ( https://review.coreboot.org/23759 Change subject: drivers/i2c: Add i2c TPM support for different stages ...................................................................... drivers/i2c: Add i2c TPM support for different stages Change-Id: Ib0839933f8b59f0c87cdda4e5374828bd6f1099f Signed-off-by: Philipp Deppenwiese <zaolin(a)das-labor.org> --- M src/drivers/i2c/designware/Makefile.inc M src/soc/intel/apollolake/Makefile.inc M src/soc/intel/common/Makefile.inc M src/soc/intel/common/block/i2c/Makefile.inc M src/soc/intel/common/block/lpss/Makefile.inc M src/soc/intel/common/block/pmc/Makefile.inc M src/soc/rockchip/rk3288/Makefile.inc M src/soc/rockchip/rk3399/Makefile.inc 8 files changed, 8 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/59/23759/1 diff --git a/src/drivers/i2c/designware/Makefile.inc b/src/drivers/i2c/designware/Makefile.inc index 0e92f05..b960a1c 100644 --- a/src/drivers/i2c/designware/Makefile.inc +++ b/src/drivers/i2c/designware/Makefile.inc @@ -4,5 +4,6 @@ romstage-y += dw_i2c.c verstage-y += dw_i2c.c ramstage-y += dw_i2c.c +postcar-y += dw_i2c.c endif diff --git a/src/soc/intel/apollolake/Makefile.inc b/src/soc/intel/apollolake/Makefile.inc index 68f2947..02a936d 100644 --- a/src/soc/intel/apollolake/Makefile.inc +++ b/src/soc/intel/apollolake/Makefile.inc @@ -67,6 +67,7 @@ postcar-y += memmap.c postcar-y += mmap_boot.c postcar-y += spi.c +postcar-y += i2c.c postcar-$(CONFIG_SOC_UART_DEBUG) += uart.c postcar-$(CONFIG_FSP_CAR) += exit_car_fsp.S diff --git a/src/soc/intel/common/Makefile.inc b/src/soc/intel/common/Makefile.inc index 52d2465..2d3df2a 100644 --- a/src/soc/intel/common/Makefile.inc +++ b/src/soc/intel/common/Makefile.inc @@ -30,6 +30,7 @@ verstage-$(CONFIG_CR50) += tpm_tis.c romstage-$(CONFIG_CR50) += tpm_tis.c ramstage-$(CONFIG_CR50) += tpm_tis.c +postcar-$(CONFIG_CR50) += tpm_tis.c ifeq ($(CONFIG_MMA),y) MMA_BLOBS_PATH = $(call strip_quotes,$(CONFIG_MMA_BLOBS_PATH)) diff --git a/src/soc/intel/common/block/i2c/Makefile.inc b/src/soc/intel/common/block/i2c/Makefile.inc index 58feb5f..464a194 100644 --- a/src/soc/intel/common/block/i2c/Makefile.inc +++ b/src/soc/intel/common/block/i2c/Makefile.inc @@ -3,6 +3,7 @@ bootblock-y += i2c_early.c romstage-y += i2c_early.c verstage-y += i2c_early.c +postcar-y += i2c_early.c ramstage-y += i2c.c endif diff --git a/src/soc/intel/common/block/lpss/Makefile.inc b/src/soc/intel/common/block/lpss/Makefile.inc index 6ed654f..a185492 100644 --- a/src/soc/intel/common/block/lpss/Makefile.inc +++ b/src/soc/intel/common/block/lpss/Makefile.inc @@ -2,4 +2,5 @@ romstage-$(CONFIG_SOC_INTEL_COMMON_BLOCK_LPSS) += lpss.c verstage-$(CONFIG_SOC_INTEL_COMMON_BLOCK_LPSS) += lpss.c ramstage-$(CONFIG_SOC_INTEL_COMMON_BLOCK_LPSS) += lpss.c +postcar-$(CONFIG_SOC_INTEL_COMMON_BLOCK_LPSS) += lpss.c smm-$(CONFIG_SOC_INTEL_COMMON_BLOCK_LPSS) += lpss.c diff --git a/src/soc/intel/common/block/pmc/Makefile.inc b/src/soc/intel/common/block/pmc/Makefile.inc index 2253115..9657217 100644 --- a/src/soc/intel/common/block/pmc/Makefile.inc +++ b/src/soc/intel/common/block/pmc/Makefile.inc @@ -5,4 +5,5 @@ ramstage-y += pmclib.c smm-y += pmclib.c verstage-y += pmclib.c +postcar-y += pmclib.c endif diff --git a/src/soc/rockchip/rk3288/Makefile.inc b/src/soc/rockchip/rk3288/Makefile.inc index 75c2e24..100c00e 100644 --- a/src/soc/rockchip/rk3288/Makefile.inc +++ b/src/soc/rockchip/rk3288/Makefile.inc @@ -54,6 +54,7 @@ romstage-y += ../common/rk808.c romstage-y += ../common/pwm.c romstage-y += tsadc.c +romstage-y += ../common/i2c.c ramstage-y += soc.c ramstage-y += ../common/cbmem.c diff --git a/src/soc/rockchip/rk3399/Makefile.inc b/src/soc/rockchip/rk3399/Makefile.inc index 54c5115..6b399df 100644 --- a/src/soc/rockchip/rk3399/Makefile.inc +++ b/src/soc/rockchip/rk3399/Makefile.inc @@ -56,6 +56,7 @@ romstage-y += gpio.c romstage-y += saradc.c romstage-y += ../common/gpio.c +romstage-y += ../common/i2c.c ################################################################################ -- To view, visit https://review.coreboot.org/23759 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: newchange Gerrit-Change-Id: Ib0839933f8b59f0c87cdda4e5374828bd6f1099f Gerrit-Change-Number: 23759 Gerrit-PatchSet: 1 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com>

1 0

Change in coreboot[master]: security/vboot: Add boot mode selection
by build bot (Jenkins) (Code Review) 14 Feb '18

14 Feb '18

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/23756 ) Change subject: security/vboot: Add boot mode selection ...................................................................... Patch Set 2: Verified-1 Build Unstable https://qa.coreboot.org/job/coreboot-gerrit/67464/ : UNSTABLE https://qa.coreboot.org/job/coreboot-checkpatch/22001/ : SUCCESS -- To view, visit https://review.coreboot.org/23756 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I43d233d5a8766af2dd7f07cc0b64293a80d5d7d2 Gerrit-Change-Number: 23756 Gerrit-PatchSet: 2 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Wed, 14 Feb 2018 15:37:22 +0000 Gerrit-HasComments: No Gerrit-HasLabels: Yes

1 0

Change in coreboot[master]: security/vboot: Add boot mode selection
by Philipp Deppenwiese (Code Review) 14 Feb '18

14 Feb '18

Hello build bot (Jenkins), I'd like you to reexamine a change. Please visit https://review.coreboot.org/23756 to look at the new patch set (#2). Change subject: security/vboot: Add boot mode selection ...................................................................... security/vboot: Add boot mode selection * Add Measured Boot mode. Change-Id: I43d233d5a8766af2dd7f07cc0b64293a80d5d7d2 Signed-off-by: Philipp Deppenwiese <zaolin(a)das-labor.org> --- M src/arch/x86/postcar_loader.c M src/drivers/i2c/tpm/Makefile.inc M src/drivers/pc80/tpm/Makefile.inc M src/drivers/spi/tpm/Makefile.inc M src/include/program_loading.h M src/lib/prog_ops.c M src/mainboard/google/poppy/Kconfig M src/mainboard/google/rotor/Kconfig M src/mainboard/intel/cannonlake_rvp/Kconfig M src/mainboard/intel/kblrvp/Kconfig M src/security/tpm/tspi.h M src/security/vboot/Kconfig M src/security/vboot/antirollback.h M src/security/vboot/secdata_mock.c M src/security/vboot/secdata_tpm.c M src/security/vboot/vboot_common.c M src/security/vboot/vboot_logic.c 17 files changed, 188 insertions(+), 43 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/56/23756/2 -- To view, visit https://review.coreboot.org/23756 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: newpatchset Gerrit-Change-Id: I43d233d5a8766af2dd7f07cc0b64293a80d5d7d2 Gerrit-Change-Number: 23756 Gerrit-PatchSet: 2 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>

1 0

Change in coreboot[master]: mb/google/soraka: Set psys_max to 45W
by Nicolas Boichat (Code Review) 14 Feb '18

14 Feb '18

Nicolas Boichat has posted comments on this change. ( https://review.coreboot.org/23757 ) Change subject: mb/google/soraka: Set psys_max to 45W ...................................................................... Patch Set 4: This should apply to all poppy derivatives, not just soraka. Otherwise LGTM if the PSYS value matches values from the battery. -- To view, visit https://review.coreboot.org/23757 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: If6f624733830b462329b5f539c20e2aea664143e Gerrit-Change-Number: 23757 Gerrit-PatchSet: 4 Gerrit-Owner: Naresh Solanki <naresh.solanki(a)intel.com> Gerrit-Reviewer: Furquan Shaikh <furquan(a)google.com> Gerrit-Reviewer: Nicolas Boichat <drinkcat(a)chromium.org> Gerrit-Reviewer: Nicolas Boichat <drinkcat(a)google.com> Gerrit-Reviewer: Rizwan Qureshi <rizwan.qureshi(a)intel.com> Gerrit-Comment-Date: Wed, 14 Feb 2018 15:24:27 +0000 Gerrit-HasComments: No Gerrit-HasLabels: No

1 0

Change in coreboot[master]: siemens/mc_bdx1: Show mainboard hardware version on console
by build bot (Jenkins) (Code Review) 14 Feb '18

14 Feb '18

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/23750 ) Change subject: siemens/mc_bdx1: Show mainboard hardware version on console ...................................................................... Patch Set 4: Verified+1 Build Successful https://qa.coreboot.org/job/coreboot-gerrit/67462/ : SUCCESS https://qa.coreboot.org/job/coreboot-checkpatch/21999/ : SUCCESS -- To view, visit https://review.coreboot.org/23750 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I33bae8b340fce13c0cbe525521828929038b069a Gerrit-Change-Number: 23750 Gerrit-PatchSet: 4 Gerrit-Owner: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-Reviewer: Aaron Durbin <adurbin(a)gmail.com> Gerrit-Reviewer: Alex Thiessen <alex.thiessen.de+coreboot(a)gmail.com> Gerrit-Reviewer: Kyösti Mälkki <kyosti.malkki(a)gmail.com> Gerrit-Reviewer: Paul Menzel <paulepanter(a)users.sourceforge.net> Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Wed, 14 Feb 2018 15:24:14 +0000 Gerrit-HasComments: No Gerrit-HasLabels: Yes

1 0

Change in coreboot[master]: security/vboot: Add boot mode selection
by build bot (Jenkins) (Code Review) 14 Feb '18

14 Feb '18

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/23756 ) Change subject: security/vboot: Add boot mode selection ...................................................................... Patch Set 1: Verified-1 Build Unstable https://qa.coreboot.org/job/coreboot-gerrit/67461/ : UNSTABLE https://qa.coreboot.org/job/coreboot-checkpatch/21998/ : SUCCESS -- To view, visit https://review.coreboot.org/23756 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I43d233d5a8766af2dd7f07cc0b64293a80d5d7d2 Gerrit-Change-Number: 23756 Gerrit-PatchSet: 1 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Wed, 14 Feb 2018 15:14:17 +0000 Gerrit-HasComments: No Gerrit-HasLabels: Yes

1 0

Change in coreboot[master]: security/vboot: Add boot mode selection
by Philipp Deppenwiese (Code Review) 14 Feb '18

14 Feb '18

Philipp Deppenwiese has uploaded this change for review. ( https://review.coreboot.org/23756 Change subject: security/vboot: Add boot mode selection ...................................................................... security/vboot: Add boot mode selection * Add Measured Boot mode. Change-Id: I43d233d5a8766af2dd7f07cc0b64293a80d5d7d2 Signed-off-by: Philipp Deppenwiese <zaolin(a)das-labor.org> --- M src/arch/x86/postcar_loader.c M src/include/program_loading.h M src/lib/prog_ops.c M src/mainboard/google/poppy/Kconfig M src/mainboard/google/rotor/Kconfig M src/mainboard/intel/cannonlake_rvp/Kconfig M src/mainboard/intel/kblrvp/Kconfig M src/security/tpm/tspi.h M src/security/vboot/Kconfig M src/security/vboot/antirollback.h M src/security/vboot/secdata_mock.c M src/security/vboot/secdata_tpm.c M src/security/vboot/vboot_common.c M src/security/vboot/vboot_logic.c 14 files changed, 180 insertions(+), 34 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/56/23756/1 diff --git a/src/arch/x86/postcar_loader.c b/src/arch/x86/postcar_loader.c index 5523238..a1c2fc7 100644 --- a/src/arch/x86/postcar_loader.c +++ b/src/arch/x86/postcar_loader.c @@ -160,7 +160,7 @@ void run_postcar_phase(struct postcar_frame *pcf) { struct prog prog = - PROG_INIT(PROG_UNKNOWN, CONFIG_CBFS_PREFIX "/postcar"); + PROG_INIT(PROG_POSTCAR, CONFIG_CBFS_PREFIX "/postcar"); postcar_commit_mtrrs(pcf); diff --git a/src/include/program_loading.h b/src/include/program_loading.h index 416e2e9..428427b 100644 --- a/src/include/program_loading.h +++ b/src/include/program_loading.h @@ -35,6 +35,7 @@ PROG_PAYLOAD, PROG_BL31, PROG_BL32, + PROG_POSTCAR, }; /* @@ -141,6 +142,10 @@ * special that needs to be done by the platform similar to the architecture * code it needs to that as well. */ void platform_prog_run(struct prog *prog); +/* + * Measured Boot specific + */ +void measured_prog_run(struct prog *prog); struct prog_loader_ops { const char *name; diff --git a/src/lib/prog_ops.c b/src/lib/prog_ops.c index 44a32d1..a0f2a54 100644 --- a/src/lib/prog_ops.c +++ b/src/lib/prog_ops.c @@ -37,6 +37,7 @@ void prog_run(struct prog *prog) { + measured_prog_run(prog); platform_prog_run(prog); arch_prog_run(prog); } @@ -45,3 +46,8 @@ { /* do nothing */ } + +void __attribute__((weak)) measured_prog_run(struct prog *prog) +{ + /* do nothing */ +} diff --git a/src/mainboard/google/poppy/Kconfig b/src/mainboard/google/poppy/Kconfig index 9315d96..ee0b25d 100644 --- a/src/mainboard/google/poppy/Kconfig +++ b/src/mainboard/google/poppy/Kconfig @@ -120,7 +120,7 @@ select DRIVERS_I2C_MAX98927 select NO_FADT_8042 select VARIANT_HAS_CAMERA_ACPI - select VARIANT_HAS_I2C_TPM if !VBOOT_MOCK_SECDATA + select VARIANT_HAS_I2C_TPM config VARIANT_SPECIFIC_OPTIONS_NAMI def_bool n @@ -129,21 +129,21 @@ select DRIVERS_PS2_KEYBOARD select DRIVERS_SPI_ACPI select EXCLUDE_NATIVE_SD_INTERFACE - select VARIANT_HAS_SPI_TPM if !VBOOT_MOCK_SECDATA + select VARIANT_HAS_SPI_TPM config VARIANT_SPECIFIC_OPTIONS_NAUTILUS def_bool n select DRIVERS_GENERIC_MAX98357A select DRIVERS_I2C_DA7219 select DRIVERS_PS2_KEYBOARD - select VARIANT_HAS_I2C_TPM if !VBOOT_MOCK_SECDATA + select VARIANT_HAS_I2C_TPM config VARIANT_SPECIFIC_OPTIONS_SORAKA def_bool n select DRIVERS_I2C_MAX98927 select NO_FADT_8042 select VARIANT_HAS_CAMERA_ACPI - select VARIANT_HAS_I2C_TPM if !VBOOT_MOCK_SECDATA + select VARIANT_HAS_I2C_TPM config VBOOT select EC_GOOGLE_CHROMEEC_SWITCHES diff --git a/src/mainboard/google/rotor/Kconfig b/src/mainboard/google/rotor/Kconfig index 437fa02..6b5319e 100644 --- a/src/mainboard/google/rotor/Kconfig +++ b/src/mainboard/google/rotor/Kconfig @@ -21,9 +21,6 @@ select MAINBOARD_HAS_CHROMEOS select BOARD_ROMSIZE_KB_4096 -config VBOOT - select VBOOT_MOCK_SECDATA - config MAINBOARD_DIR string default google/rotor diff --git a/src/mainboard/intel/cannonlake_rvp/Kconfig b/src/mainboard/intel/cannonlake_rvp/Kconfig index b69a5e9..511603b 100644 --- a/src/mainboard/intel/cannonlake_rvp/Kconfig +++ b/src/mainboard/intel/cannonlake_rvp/Kconfig @@ -61,5 +61,4 @@ config VBOOT select VBOOT_LID_SWITCH - select VBOOT_MOCK_SECDATA endif diff --git a/src/mainboard/intel/kblrvp/Kconfig b/src/mainboard/intel/kblrvp/Kconfig index f483063..e5d4fec 100644 --- a/src/mainboard/intel/kblrvp/Kconfig +++ b/src/mainboard/intel/kblrvp/Kconfig @@ -26,7 +26,6 @@ config KBLRVP_NO_TPM bool "No TPM" - select VBOOT_MOCK_SECDATA if VBOOT config KBLRVP_TPM1_2 bool "TPM 1.1" diff --git a/src/security/tpm/tspi.h b/src/security/tpm/tspi.h index bf2b7ae..775311e 100644 --- a/src/security/tpm/tspi.h +++ b/src/security/tpm/tspi.h @@ -21,6 +21,34 @@ #define TPM_PCR_MAX_LENGTH 64 +// PCR Registers used by coreboot +#define TPM_BOOTBLOCK_PCR 0 +#define TPM_STAGE_VERSTAGE_PCR 0 +#define TPM_STAGE_ROMSTAGE_PCR 1 +#define TPM_STAGE_POSTCAR_PCR 2 +#define TPM_STAGE_RAMSTAGE_PCR 2 +#define TPM_PAYLOAD_PCR 3 +#define TPM_FW_MAIN 1 + +// Vendor / Platform specific +#define TPM_INTEL_FSP_PCR 1 +#define TPM_INTEL_FSPM_PCR 1 +#define TPM_INTEL_FSPS_PCR 1 +#define TPM_INTEL_NHLT_PCR 1 +#define TPM_ARM_BL31_PCR 2 +#define TPM_ARM_BL32_PCR 2 +#define TPM_VGA_OPTION_ROM_PCR 2 +#define TPM_SPD_DATA_PCR 1 +#define TPM_AMD_PSP_PCR 1 +#define TPM_AMD_AGESA_PCR 1 +#define TPM_NVIDIA_MTC_PCR 1 +#define TPM_VBT_PCR 2 +#define TPM_MICROCODE_PCR 1 + +// special +#define TPM_UNKNOWN_PCR 4 + + /** * TPM measurement with acpi log functionality based on binary data. */ diff --git a/src/security/vboot/Kconfig b/src/security/vboot/Kconfig index ed613b6..6901ab8 100644 --- a/src/security/vboot/Kconfig +++ b/src/security/vboot/Kconfig @@ -26,6 +26,31 @@ if VBOOT +choice + +prompt "Boot mode" + default VBOOT_MODE_VERIFIED_BOOT + help + Select the boot mode in which VBOOT should run. + +config VBOOT_MODE_VERIFIED_BOOT + bool "Verified Boot" + depends on TPM1 || TPM2 + +config VBOOT_MODE_VERIFIED_BOOT_NO_ROLLBACK_PROTECTION + bool "Verified Boot (no TPM)" + select VBOOT_MOCK_SECDATA + +config VBOOT_MODE_MEASURED_BOOT + bool "Measured Boot" + depends on TPM1 || TPM2 + +config VBOOT_MODE_VERIFIED_AND_MEASURED_BOOT + bool "Verified & Measured Boot" + depends on TPM1 || TPM2 + +endchoice + config VBOOT_VBNV_CMOS bool default n @@ -80,7 +105,7 @@ allocated in CBMEM. config VBOOT_MOCK_SECDATA - bool "Mock secdata for firmware verification" + bool "Disable antirollback protection" default n help Enabling VBOOT_MOCK_SECDATA will mock secdata for the firmware diff --git a/src/security/vboot/antirollback.h b/src/security/vboot/antirollback.h index ae2d665..a784026 100644 --- a/src/security/vboot/antirollback.h +++ b/src/security/vboot/antirollback.h @@ -66,4 +66,7 @@ uint32_t vboot_extend_pcr(struct vb2_context *ctx, int pcr, enum vb2_pcr_digest which_digest); +/* Measure boot mode requiredment. Measures bootblock and verstage */ +uint32_t vboot_measure_self(void); + #endif /* ANTIROLLBACK_H_ */ diff --git a/src/security/vboot/secdata_mock.c b/src/security/vboot/secdata_mock.c index 3075d33..184c4ae 100644 --- a/src/security/vboot/secdata_mock.c +++ b/src/security/vboot/secdata_mock.c @@ -79,3 +79,8 @@ { return VB2_SUCCESS; } + +uint32_t vboot_measure_self(void) +{ + return VB2_SUCCESS; +} diff --git a/src/security/vboot/secdata_tpm.c b/src/security/vboot/secdata_tpm.c index 9dff2ff..3d3d590 100644 --- a/src/security/vboot/secdata_tpm.c +++ b/src/security/vboot/secdata_tpm.c @@ -37,6 +37,8 @@ #include <security/tpm/tspi.h> #include <vb2_api.h> #include <console/console.h> +#include <security/tpm/tspi.h> +#include <cbfs.h> #include "antirollback.h" @@ -445,10 +447,6 @@ { uint32_t rv; - rv = vboot_setup_tpm(ctx); - if (rv) - return rv; - /* Read the firmware space. */ rv = read_space_firmware(ctx); if (rv == TPM_E_BADINDEX) { @@ -521,3 +519,30 @@ return VB2_ERROR_EX_TPM_CLEAR_OWNER; return VB2_SUCCESS; } + +uint32_t vboot_measure_self(void) +{ + struct cbfsf file1, file2; + struct prog bootblock = PROG_INIT(PROG_UNKNOWN, "bootblock"); + + struct prog verstage = + PROG_INIT(PROG_VERSTAGE, CONFIG_CBFS_PREFIX "/verstage"); + + /* load verstage from RO */ + if (cbfs_boot_locate(&file1, prog_name(&bootblock), NULL)) + return VB2_ERROR_UNKNOWN; + + cbfs_file_data(prog_rdev(&bootblock), &file1); + + if (cbfs_boot_locate(&file2, prog_name(&verstage), NULL)) + return VB2_ERROR_UNKNOWN; + + cbfs_file_data(prog_rdev(&verstage), &file2); + + tpm_measure_region(TPM_BOOTBLOCK_PCR, prog_rdev(&bootblock), + "bootblock"); + tpm_measure_region(TPM_STAGE_VERSTAGE_PCR, prog_rdev(&verstage), + CONFIG_CBFS_PREFIX "/verstage"); + + return VB2_SUCCESS; +} diff --git a/src/security/vboot/vboot_common.c b/src/security/vboot/vboot_common.c index 3ef9070..5dbf77e 100644 --- a/src/security/vboot/vboot_common.c +++ b/src/security/vboot/vboot_common.c @@ -18,12 +18,14 @@ #include <cbmem.h> #include <console/cbmem_console.h> #include <console/console.h> +#include <program_loading.h> #include <fmap.h> #include <reset.h> #include <rules.h> #include <stddef.h> #include <string.h> #include <security/vboot/vboot_common.h> +#include <security/tpm/tspi.h> int vboot_named_region_device(const char *name, struct region_device *rdev) { @@ -100,6 +102,55 @@ return sd->recovery_reason; } +#if !ENV_BOOTBLOCK +void measured_prog_run(struct prog *prog) +{ + switch (prog->type) { + case PROG_VERSTAGE: + tpm_measure_region(TPM_STAGE_VERSTAGE_PCR, prog_rdev(prog), + prog->name); + break; + case PROG_ROMSTAGE: + tpm_measure_region(TPM_STAGE_ROMSTAGE_PCR, prog_rdev(prog), + prog->name); + break; + case PROG_RAMSTAGE: + tpm_measure_region(TPM_STAGE_RAMSTAGE_PCR, prog_rdev(prog), + prog->name); + break; + case PROG_BL32: + tpm_measure_region(TPM_ARM_BL32_PCR, prog_rdev(prog), + prog->name); + break; + case PROG_BL31: + tpm_measure_region(TPM_ARM_BL31_PCR, prog_rdev(prog), + prog->name); + break; + case PROG_PAYLOAD: + tpm_measure_region(TPM_PAYLOAD_PCR, prog_rdev(prog), + prog->name); + break; + case PROG_REFCODE: + tpm_measure_region(TPM_INTEL_FSP_PCR, prog_rdev(prog), + prog->name); + break; + case PROG_POSTCAR: + tpm_measure_region(TPM_STAGE_POSTCAR_PCR, prog_rdev(prog), + prog->name); + break; + case PROG_UNKNOWN: + if (prog->name) { + tpm_measure_region(TPM_UNKNOWN_PCR, prog_rdev(prog), + prog->name); + } else { + die("Can't execute program if measured boot is active " + "and no program name given."); + } + break; + } +} +#endif + /* ============================ VBOOT REBOOT ============================== */ void __attribute__((weak)) vboot_platform_prepare_reboot(void) { diff --git a/src/security/vboot/vboot_logic.c b/src/security/vboot/vboot_logic.c index 3651a27..6067f6c 100644 --- a/src/security/vboot/vboot_logic.c +++ b/src/security/vboot/vboot_logic.c @@ -9,7 +9,7 @@ * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See themeasure_self * GNU General Public License for more details. */ @@ -19,11 +19,11 @@ #include <console/console.h> #include <console/vtxprintf.h> #include <delay.h> +#include <security/vboot/misc.h> +#include <security/vboot/vbnv.h> #include <string.h> #include <timestamp.h> #include <vb2_api.h> -#include <security/vboot/misc.h> -#include <security/vboot/vbnv.h> #include "antirollback.h" @@ -53,11 +53,8 @@ return; } -int vb2ex_read_resource(struct vb2_context *ctx, - enum vb2_resource_index index, - uint32_t offset, - void *buf, - uint32_t size) +int vb2ex_read_resource(struct vb2_context *ctx, enum vb2_resource_index index, + uint32_t offset, void *buf, uint32_t size) { struct region_device rdev; const char *name; @@ -86,24 +83,21 @@ } /* No-op stubs that can be overridden by SoCs with hardware crypto support. */ -__attribute__((weak)) -int vb2ex_hwcrypto_digest_init(enum vb2_hash_algorithm hash_alg, - uint32_t data_size) +__attribute__((weak)) int +vb2ex_hwcrypto_digest_init(enum vb2_hash_algorithm hash_alg, uint32_t data_size) { return VB2_ERROR_EX_HWCRYPTO_UNSUPPORTED; } -__attribute__((weak)) -int vb2ex_hwcrypto_digest_extend(const uint8_t *buf, uint32_t size) +__attribute__((weak)) int vb2ex_hwcrypto_digest_extend(const uint8_t *buf, + uint32_t size) { - BUG(); /* Should never get called if init() returned an error. */ return VB2_ERROR_UNKNOWN; } -__attribute__((weak)) -int vb2ex_hwcrypto_digest_finalize(uint8_t *digest, uint32_t digest_size) +__attribute__((weak)) int vb2ex_hwcrypto_digest_finalize(uint8_t *digest, + uint32_t digest_size) { - BUG(); /* Should never get called if init() returned an error. */ return VB2_ERROR_UNKNOWN; } @@ -249,7 +243,7 @@ } static int locate_firmware(struct vb2_context *ctx, - struct region_device *fw_main) + struct region_device *fw_main) { const char *name; @@ -313,6 +307,15 @@ vboot_platform_is_resuming()) ctx.flags |= VB2_CONTEXT_S3_RESUME; + /* setup tpm */ + vboot_setup_tpm(&ctx); + + /* Enable measured boot mode */ +#if IS_ENABLED(CONFIG_VBOOT_MODE_MEASURED_BOOT) + if (vboot_measure_self() != VB2_SUCCESS) + die("Initializing measured boot mode failed!"); +#endif + /* Read secdata from TPM. Initialize TPM if secdata not found. We don't * check the return value here because vb2api_fw_phase1 will catch * invalid secdata and tell us what to do (=reboot). */ @@ -351,7 +354,7 @@ if (rv == VB2_ERROR_API_PHASE1_RECOVERY) { printk(BIOS_INFO, "Recovery requested (%x)\n", rv); save_if_needed(&ctx); - extend_pcrs(&ctx); /* ignore failures */ + extend_pcrs(&ctx); /* ignore failures */ timestamp_add_now(TS_END_VBOOT); return; } -- To view, visit https://review.coreboot.org/23756 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: newchange Gerrit-Change-Id: I43d233d5a8766af2dd7f07cc0b64293a80d5d7d2 Gerrit-Change-Number: 23756 Gerrit-PatchSet: 1 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com>

1 0

Change in coreboot[master]: soc/cavium: Only enable CAR if DRAM PLL isn't running
by build bot (Jenkins) (Code Review) 14 Feb '18

14 Feb '18

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/23754 ) Change subject: soc/cavium: Only enable CAR if DRAM PLL isn't running ...................................................................... Patch Set 1: Verified-1 Build Failed https://qa.coreboot.org/job/coreboot-gerrit/67459/ : FAILURE https://qa.coreboot.org/job/coreboot-checkpatch/21997/ : SUCCESS -- To view, visit https://review.coreboot.org/23754 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I76f1a44c215f933af74f4d659de59013f2677dad Gerrit-Change-Number: 23754 Gerrit-PatchSet: 1 Gerrit-Owner: Patrick Rudolph <patrick.rudolph(a)9elements.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Wed, 14 Feb 2018 14:30:41 +0000 Gerrit-HasComments: No Gerrit-HasLabels: Yes

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

coreboot-gerrit February 2018