coreboot-gerrit March 2019

coreboot-gerrit@coreboot.org

1 participants
1542 discussions

Change in ...coreboot[master]: device/root_device: Consolidate common _scan_bus() functions
by Nico Huber (Code Review) 08 Oct '19

08 Oct '19

Nico Huber has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/31901 Change subject: device/root_device: Consolidate common _scan_bus() functions ...................................................................... device/root_device: Consolidate common _scan_bus() functions scan_usb_bus() and root_dev_scan_bus() had the very same implementation. So rename the latter to scan_static_bus() and use that for both cases. Change-Id: If0aba9c690b23e3716f2d47ff7a8c3e8f6d82679 Signed-off-by: Nico Huber <nico.huber(a)secunet.com> --- M src/device/root_device.c M src/drivers/usb/acpi/usb_acpi.c M src/include/device/device.h M src/soc/amd/stoneyridge/usb.c M src/soc/intel/common/block/xhci/xhci.c 5 files changed, 6 insertions(+), 28 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/01/31901/1 diff --git a/src/device/root_device.c b/src/device/root_device.c index 8f2d446..2fae5c3 100644 --- a/src/device/root_device.c +++ b/src/device/root_device.c @@ -72,21 +72,6 @@ printk(BIOS_SPEW, "%s for %s done\n", __func__, dev_path(bus)); } -void scan_usb_bus(struct device *bus) -{ - struct bus *link; - - printk(BIOS_SPEW, "%s for %s\n", __func__, dev_path(bus)); - - enable_static_devices(bus); - - /* Scan bridges in case this device is a hub */ - for (link = bus->link_list; link; link = link->next) - scan_bridges(link); - - printk(BIOS_SPEW, "%s for %s done\n", __func__, dev_path(bus)); -} - void scan_generic_bus(struct device *bus) { struct device *child; @@ -123,14 +108,7 @@ scan_generic_bus(bus); } -/** - * Scan root bus for generic systems. - * - * This function is the default scan_bus() method of the root device. - * - * @param root The root device structure. - */ -static void root_dev_scan_bus(struct device *bus) +void scan_static_bus(struct device *bus) { struct bus *link; @@ -169,7 +147,7 @@ .set_resources = DEVICE_NOOP, .enable_resources = DEVICE_NOOP, .init = DEVICE_NOOP, - .scan_bus = root_dev_scan_bus, + .scan_bus = scan_static_bus, .reset_bus = root_dev_reset, #if CONFIG(HAVE_ACPI_TABLES) .acpi_name = root_dev_acpi_name, diff --git a/src/drivers/usb/acpi/usb_acpi.c b/src/drivers/usb/acpi/usb_acpi.c index 8c63d2a..e026eeb 100644 --- a/src/drivers/usb/acpi/usb_acpi.c +++ b/src/drivers/usb/acpi/usb_acpi.c @@ -86,7 +86,7 @@ .read_resources = DEVICE_NOOP, .set_resources = DEVICE_NOOP, .enable_resources = DEVICE_NOOP, - .scan_bus = scan_usb_bus, + .scan_bus = scan_static_bus, .acpi_fill_ssdt_generator = usb_acpi_fill_ssdt_generator, }; diff --git a/src/include/device/device.h b/src/include/device/device.h index cbee197..02fb072 100644 --- a/src/include/device/device.h +++ b/src/include/device/device.h @@ -282,7 +282,7 @@ void scan_smbus(struct device *bus); void scan_generic_bus(struct device *bus); void scan_lpc_bus(struct device *bus); -void scan_usb_bus(struct device *bus); +void scan_static_bus(struct device *bus); #endif /* !defined(__ROMCC__) */ diff --git a/src/soc/amd/stoneyridge/usb.c b/src/soc/amd/stoneyridge/usb.c index f2fa3ba..2eedd97 100644 --- a/src/soc/amd/stoneyridge/usb.c +++ b/src/soc/amd/stoneyridge/usb.c @@ -63,7 +63,7 @@ .set_resources = pci_dev_set_resources, .enable_resources = pci_dev_enable_resources, .init = set_usb_over_current, - .scan_bus = scan_usb_bus, + .scan_bus = scan_static_bus, .acpi_name = soc_acpi_name, .ops_pci = &lops_pci, }; diff --git a/src/soc/intel/common/block/xhci/xhci.c b/src/soc/intel/common/block/xhci/xhci.c index c429e7d..95315b2 100644 --- a/src/soc/intel/common/block/xhci/xhci.c +++ b/src/soc/intel/common/block/xhci/xhci.c @@ -28,7 +28,7 @@ .enable_resources = pci_dev_enable_resources, .init = soc_xhci_init, .ops_pci = &pci_dev_ops_pci, - .scan_bus = scan_usb_bus, + .scan_bus = scan_static_bus, #if CONFIG(HAVE_ACPI_TABLES) .acpi_name = soc_acpi_name, #endif -- To view, visit https://review.coreboot.org/c/coreboot/+/31901 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: If0aba9c690b23e3716f2d47ff7a8c3e8f6d82679 Gerrit-Change-Number: 31901 Gerrit-PatchSet: 1 Gerrit-Owner: Nico Huber <nico.h(a)gmx.de> Gerrit-MessageType: newchange

5 15

Change in ...coreboot[master]: device: Rename scan_static_bus() -> enable_static_devices()
by Nico Huber (Code Review) 07 Oct '19

07 Oct '19

Nico Huber has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/31900 Change subject: device: Rename scan_static_bus() -> enable_static_devices() ...................................................................... device: Rename scan_static_bus() -> enable_static_devices() The new name should reflect better what this function does, as that is only one specific step of the scanning. Change-Id: I9c9dc437b6117112bb28550855a2c38044dfbfa5 Signed-off-by: Nico Huber <nico.huber(a)secunet.com> --- M src/device/root_device.c M src/include/device/device.h M src/soc/intel/common/block/dsp/dsp.c M src/soc/intel/common/block/hda/hda.c 4 files changed, 8 insertions(+), 8 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/00/31900/1 diff --git a/src/device/root_device.c b/src/device/root_device.c index f8e2907..8f2d446 100644 --- a/src/device/root_device.c +++ b/src/device/root_device.c @@ -26,7 +26,7 @@ const char mainboard_name[] = CONFIG_MAINBOARD_VENDOR " " CONFIG_MAINBOARD_PART_NUMBER; /** - * Scan devices on static buses. + * Enable devices on static buses. * * The enumeration of certain buses is purely static. The existence of * devices on those buses can be completely determined at compile time @@ -43,7 +43,7 @@ * @param bus Pointer to the device to which the static buses are attached to. */ -void scan_static_bus(struct device *bus) +void enable_static_devices(struct device *bus) { struct device *child; struct bus *link; @@ -67,7 +67,7 @@ { printk(BIOS_SPEW, "%s for %s\n", __func__, dev_path(bus)); - scan_static_bus(bus); + enable_static_devices(bus); printk(BIOS_SPEW, "%s for %s done\n", __func__, dev_path(bus)); } @@ -78,7 +78,7 @@ printk(BIOS_SPEW, "%s for %s\n", __func__, dev_path(bus)); - scan_static_bus(bus); + enable_static_devices(bus); /* Scan bridges in case this device is a hub */ for (link = bus->link_list; link; link = link->next) @@ -136,7 +136,7 @@ printk(BIOS_SPEW, "%s for %s\n", __func__, dev_path(bus)); - scan_static_bus(bus); + enable_static_devices(bus); for (link = bus->link_list; link; link = link->next) scan_bridges(link); diff --git a/src/include/device/device.h b/src/include/device/device.h index 2e2cda9..cbee197 100644 --- a/src/include/device/device.h +++ b/src/include/device/device.h @@ -278,9 +278,9 @@ DEVTREE_CONST struct device *pcidev_path_on_root(pci_devfn_t devfn); DEVTREE_CONST struct device *pcidev_on_root(uint8_t dev, uint8_t fn); +void enable_static_devices(struct device *bus); void scan_smbus(struct device *bus); void scan_generic_bus(struct device *bus); -void scan_static_bus(struct device *bus); void scan_lpc_bus(struct device *bus); void scan_usb_bus(struct device *bus); diff --git a/src/soc/intel/common/block/dsp/dsp.c b/src/soc/intel/common/block/dsp/dsp.c index 2bd6599..7f7eb90 100644 --- a/src/soc/intel/common/block/dsp/dsp.c +++ b/src/soc/intel/common/block/dsp/dsp.c @@ -23,7 +23,7 @@ .set_resources = pci_dev_set_resources, .enable_resources = pci_dev_enable_resources, .ops_pci = &pci_dev_ops_pci, - .scan_bus = scan_static_bus, + .scan_bus = enable_static_devices, }; static const unsigned short pci_device_ids[] = { diff --git a/src/soc/intel/common/block/hda/hda.c b/src/soc/intel/common/block/hda/hda.c index 8ab835e..c1426e0 100644 --- a/src/soc/intel/common/block/hda/hda.c +++ b/src/soc/intel/common/block/hda/hda.c @@ -69,7 +69,7 @@ .init = hda_init, #endif .ops_pci = &pci_dev_ops_pci, - .scan_bus = scan_static_bus, + .scan_bus = enable_static_devices, }; static const unsigned short pci_device_ids[] = { -- To view, visit https://review.coreboot.org/c/coreboot/+/31900 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I9c9dc437b6117112bb28550855a2c38044dfbfa5 Gerrit-Change-Number: 31900 Gerrit-PatchSet: 1 Gerrit-Owner: Nico Huber <nico.h(a)gmx.de> Gerrit-MessageType: newchange

6 15

Change in ...coreboot[master]: vendorcode/eltan/security/verified_boot: Add verified boot support.
by Frans Hendriks (Code Review) 04 Oct '19

04 Oct '19

Frans Hendriks has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/30835 Change subject: vendorcode/eltan/security/verified_boot: Add verified boot support. ...................................................................... vendorcode/eltan/security/verified_boot: Add verified boot support. Create verified boot support, which includes verifiication of bootblock. This feature use the vendorcode/eltan/security/lib. Function verified_boot_bootblock_check(), verified_boot_should_run_oprom() and prog_locate_hook() must be called from coreboot (or mainboard). The next lists will be used for verification: bootblock_verify_list[], romstage_verify_list[] ram_stage_additional_list[], ramstage_verify_list[] BUG=N/A TEST=Created binary and verify logging on Facebook FBG-1701 Change-Id: If6c1423b0b4a309cefb7fe7a29d5100ba289e0b4 Signed-off-by: Frans Hendriks <fhendriks(a)eltan.com> --- A src/vendorcode/eltan/security/verified_boot/Kconfig A src/vendorcode/eltan/security/verified_boot/Makefile.inc A src/vendorcode/eltan/security/verified_boot/vboot_check.c A src/vendorcode/eltan/security/verified_boot/vboot_check.h 4 files changed, 605 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/35/30835/1 diff --git a/src/vendorcode/eltan/security/verified_boot/Kconfig b/src/vendorcode/eltan/security/verified_boot/Kconfig new file mode 100644 index 0000000..0670732 --- /dev/null +++ b/src/vendorcode/eltan/security/verified_boot/Kconfig @@ -0,0 +1,61 @@ +## This file is part of the coreboot project. +## +## Copyright (C) 2018 Eltan B.V. +## +## This program is free software; you can redistribute it and/or modify +## it under the terms of the GNU General Public License as published by +## the Free Software Foundation; version 2 of the License. +## +## This program is distributed in the hope that it will be useful, +## but WITHOUT ANY WARRANTY; without even the implied warranty of +## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +## GNU General Public License for more details. +## + +menu "Verified Boot (verified_boot)" + +config VERIFIED_BOOT + bool "Enable Verified Boot" + default n + +config VERIFIED_BOOT_SIGNED_MANIFEST + bool "Enable Signed Manifest" + depends on VERIFIED_BOOT + default n + +config VERIFIED_BOOT_USE_SHA512 + bool "SHA512 hashes" + depends on VERIFIED_BOOT + default n + help + Use SHA512 for the vboot operations, this applies to the digest in + the manifest and the manifest digest. + +config OEM_MANIFEST_LOC + hex "Manifest Location" + default 0xFFFFF840 + +config VERIFIED_BOOT_MANIFEST + string "Verified boot manifest file" + default "mainboard/$(MAINBOARD_DIR)/manifest.h" + +config OEM_MANIFEST_ITEMS + int "Manifest Items" + default 10 + +config OEM_MANIFEST_ITEM_SIZE + int + default 64 if VERIFIED_BOOT_USE_SHA512 + default 32 + +config VERIFIED_BOOT_KEY_LOCATION + hex "Verified boot Key Location" + depends on VERIFIED_BOOT_SIGNED_MANIFEST + default 0xFFFFF500 + +config VERIFIED_BOOT_KEY_SIZE + int + default 554 if VERIFIED_BOOT_USE_SHA512 + default 520 + +endmenu # Verified Boot (verified_boot) diff --git a/src/vendorcode/eltan/security/verified_boot/Makefile.inc b/src/vendorcode/eltan/security/verified_boot/Makefile.inc new file mode 100644 index 0000000..23044b4 --- /dev/null +++ b/src/vendorcode/eltan/security/verified_boot/Makefile.inc @@ -0,0 +1,47 @@ +## +## This file is part of the coreboot project. +## +## Copyright (C) 2018 Eltan B.V. +## +## This program is free software; you can redistribute it and/or modify +## it under the terms of the GNU General Public License as published by +## the Free Software Foundation; version 2 of the License. +## +## This program is distributed in the hope that it will be useful, +## but WITHOUT ANY WARRANTY; without even the implied warranty of +## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +## GNU General Public License for more details. +## + +ifeq ($(CONFIG_VERIFIED_BOOT),y) + +CPPFLAGS_common += -I$(src)/security/verified_boot + +bootblock-$(CONFIG_C_ENVIRONMENT_BOOTBLOCK) += vboot_check.c +romstage-y += vboot_check.c +ramstage-y += vboot_check.c + +cbfs-files-y += oemmanifest.bin +oemmanifest.bin-file := $(obj)/oemmanifest.bin +oemmanifest.bin-position := $(CONFIG_OEM_MANIFEST_LOC) +oemmanifest.bin-type := 0x50 + +$(obj)/oemmanifest.bin: +ifeq ($(CONFIG_VERIFIED_BOOT_SIGNED_MANIFEST),y) + dd if=/dev/zero of=$@ seek=8 bs=$(CONFIG_OEM_MANIFEST_ITEM_SIZE) count=$(CONFIG_OEM_MANIFEST_ITEMS) +else # ($(CONFIG_VERIFIED_BOOT_SIGNED_MANIFEST),y) + dd if=/dev/zero of=$@ bs=$(CONFIG_OEM_MANIFEST_ITEM_SIZE) count=$(CONFIG_OEM_MANIFEST_ITEMS) +endif # ($(CONFIG_VERIFIED_BOOT_SIGNED_MANIFEST),y) + +ifeq ($(CONFIG_VERIFIED_BOOT_SIGNED_MANIFEST),y) +cbfs-files-y += vboot_public_key.bin +vboot_public_key.bin-file := $(obj)/vboot_public_key.bin +vboot_public_key.bin-position := $(CONFIG_VERIFIED_BOOT_KEY_LOCATION) +vboot_public_key.bin-type := 0x50 + +$(obj)/vboot_public_key.bin: + dd if=/dev/zero of=$@ bs=$(CONFIG_VERIFIED_BOOT_KEY_SIZE) count=1 + +endif # ($(CONFIG_VERIFIED_BOOT_SIGNED_MANIFEST),y) + +endif # CONFIG_VERIFIED_BOOT diff --git a/src/vendorcode/eltan/security/verified_boot/vboot_check.c b/src/vendorcode/eltan/security/verified_boot/vboot_check.c new file mode 100644 index 0000000..fb7d1d7 --- /dev/null +++ b/src/vendorcode/eltan/security/verified_boot/vboot_check.c @@ -0,0 +1,414 @@ +/* + * This file is part of the coreboot project. + * + * Copyright (C) 2016 Intel Corp. + * Copyright (C) 2017-2018 Eltan B.V. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; version 2 of the License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ +#include <vboot_check.h> + +#define RSA_PUBLICKEY_FILE_NAME "vboot_public_key.bin" + +#if IS_ENABLED(CONFIG_VERIFIED_BOOT_USE_SHA512) +#define DIGEST_SIZE SHA512_DIGEST_SIZE +#else +#define DIGEST_SIZE SHA256_DIGEST_SIZE +#endif + +int verified_boot_check_manifest(void) +{ + struct vb2_public_key key; + uint8_t digest[DIGEST_SIZE]; + size_t size = 0; + uint8_t *signature = NULL; + uint8_t *buffer; + const struct vb2_workbuf wb; + + cbfs_boot_map_with_leak("oemmanifest.bin", CBFS_TYPE_RAW, &size); + + if (size != (CONFIG_OEM_MANIFEST_ITEMS * DIGEST_SIZE) + 256) { + printk(BIOS_ERR, "ERROR: Incorrect manifest size!\n"); + goto fail; + } + + buffer = cbfs_boot_map_with_leak(RSA_PUBLICKEY_FILE_NAME, + CBFS_TYPE_RAW, &size); + + size = DIGEST_SIZE; + if (!vb2_unpack_key_data(&key, buffer, size)) { + printk(BIOS_ERR, "ERROR: Unable to create RSA Public Key !\n"); + goto fail; + } + + if (IS_ENABLED(CONFIG_VERIFIED_BOOT_USE_SHA512)) + key.hash_alg = VB2_HASH_SHA512; + else + key.sig_alg = VB2_HASH_SHA256; + + + // + // Create a big endian digest + // + if (IS_ENABLED(CONFIG_VERIFIED_BOOT_USE_SHA512)) + cb_sha512_ex((const uint8_t *)CONFIG_OEM_MANIFEST_LOC, + CONFIG_OEM_MANIFEST_ITEMS * DIGEST_SIZE, digest, 1); + else + cb_sha256_ex((const uint8_t *)CONFIG_OEM_MANIFEST_LOC, + CONFIG_OEM_MANIFEST_ITEMS * DIGEST_SIZE, digest, 1); + + signature = (uint8_t *)CONFIG_OEM_MANIFEST_LOC + + CONFIG_OEM_MANIFEST_ITEMS * DIGEST_SIZE; + + if (!vb2_rsa_verify_digest(&key, signature, digest, &wb)) { + printk(BIOS_ERR, "ERROR: Signature verification failed for" + "hash table !!\n"); + goto fail; + } + + printk(BIOS_DEBUG, "%s: Successfully verified hash_table signature.\n", + __func__); + return 0; + +fail: + die("HASH table verification failed!\n"); + return -1; +} + +#ifndef __BOOTBLOCK__ + +/* + * + * measure_item + * + * extends the defined pcr using the hash calculated by the verified boot + * routines. + * + * @param[in] pcr PCR to extend + * @param[in] *hashData Pointer to the hash data + * @param[in] hashDataLen Length of the hash data + * @param[in] *event_msg Message to log or display + * @param[in] eventType Event type to use when logging + + * @retval TPM_SUCCESS Operation completed successfully. + * @retval TPM_E_IOERROR Unexpected device behavior. + */ +static int measure_item(uint32_t pcr, uint8_t *hashData, uint32_t hashDataLen, + int8_t *event_msg, TCG_EVENTTYPE eventType) +{ + int status = TPM_SUCCESS; + EFI_TCG2_EVENT_ALGORITHM_BITMAP ActivePcrs; + TCG_PCR_EVENT2_HDR tcgEventHdr; + + ActivePcrs = tpm2_get_active_pcrs(); + + memset(&tcgEventHdr, 0, sizeof(tcgEventHdr)); + tcgEventHdr.pcrIndex = pcr; + tcgEventHdr.eventType = eventType; + if (event_msg) { + status = mboot_hash_extend_log(ActivePcrs, MBOOT_HASH_PROVIDED, + hashData, hashDataLen, &tcgEventHdr, + (uint8_t *)event_msg, 0); + if (status == TPM_SUCCESS) { + printk(BIOS_DEBUG, "%s: Success! %s measured to pcr" + "%d.\n", __func__, event_msg, pcr); + } else { + printk(BIOS_DEBUG, "%s: Fail! %s can't be measured. " + "ABORTING!!!\n", __func__, event_msg); + return status; + } + } + return status; +} +#endif + +static void verified_boot_check_buffer(const char *name, void *start, + size_t size, uint32_t hash_index, int32_t pcr) +{ + uint8_t digest[DIGEST_SIZE]; +#ifndef __BOOTBLOCK__ + int status; +#endif + printk(BIOS_INFO, "%s: %s HASH verification buffer %p size %d\n", + __func__, name, start, (int) size); + + if (start && size) { + if (IS_ENABLED(CONFIG_VERIFIED_BOOT_USE_SHA512)) + cb_sha512((const uint8_t *)start, size, digest); + else + cb_sha256((const uint8_t*)start, size, digest); + + if (memcmp((void *)((uint8_t *)CONFIG_OEM_MANIFEST_LOC + + sizeof(digest) * hash_index), digest, sizeof(digest))) { + printk(BIOS_INFO, "%s: buffer hash\n", __func__); + hexdump(digest, sizeof(digest)); + printk(BIOS_INFO, "%s: manifest hash\n", __func__); + hexdump((void *)((uint8_t *)CONFIG_OEM_MANIFEST_LOC + + sizeof(digest) * hash_index), sizeof(digest)); + printk(BIOS_EMERG, "%s ", name); + die("HASH verification failed!\n"); + } else { +#ifndef __BOOTBLOCK__ + if (IS_ENABLED(CONFIG_MBOOT)) { + if (pcr != -1) { + printk(BIOS_INFO, "%s: measuring %s\n", + __func__, name); + status = measure_item(pcr, digest, + sizeof(digest), + (int8_t *)name, 0); + } + } +#endif + printk(BIOS_INFO, "%s HASH verification success\n", + name); + } + } else { + printk(BIOS_EMERG, "Invalid buffer "); + die("HASH verification failed!\n"); + } +} + +void verified_boot_check_cbfsfile(const char *name, uint32_t type, + uint32_t hash_index, void **buffer, uint32_t *filesize, + int32_t pcr) +{ + void *start; + size_t size; + + start = cbfs_boot_map_with_leak(name, type & ~VERIFIED_BOOT_COPY_BLOCK, + &size); + if (start && size) { + /* + * Speed up processing by copying the file content to memory + * first + */ +#ifndef __PRE_RAM__ + if ((type & VERIFIED_BOOT_COPY_BLOCK) && (buffer) && + (*buffer) && + ((uint32_t) start > (uint32_t)(~(CONFIG_CBFS_SIZE-1)))) { + printk(BIOS_INFO, "%s: move buffer to " + "memory\n", __func__); + /* Move the file to a memory bufferof which we know it + * doesn't harm + */ + memcpy(*buffer, start, size); + start = *buffer; + printk(BIOS_INFO, "%s: done\n", __func__); + } +#endif // __PRE_RAM__ + verified_boot_check_buffer(name, start, size, hash_index, pcr); + } else { + printk(BIOS_EMERG, "CBFS Failed to get file content for %s\n", + name); + die("HASH verification failed!\n"); + } + if (buffer) + *buffer = start; + if (filesize) + *filesize = size; +} + +void process_verify_list(const verify_item_t list[]) +{ + int i = 0; + + while (list[i].type != VERIFY_TERMINATOR) { + switch (list[i].type) { + case VERIFY_FILE: + verified_boot_check_cbfsfile(list[i].name, + list[i].data.file.cbfs_type, + list[i].hash_index, NULL, NULL, + list[i].pcr); + if (list[i].data.file.related_items) { + printk(BIOS_SPEW, "process related items\n"); + process_verify_list((verify_item_t *) + list[i].data.file.related_items); + } + break; + case VERIFY_BLOCK: + verified_boot_check_buffer(list[i].name, + (void *) list[i].data.block.start, + list[i].data.block.size, + list[i].hash_index, list[i].pcr); + break; + default: + printk(BIOS_EMERG, "INVALID TYPE IN VERIFY" + "LIST 0x%x\n", list[i].type); + die("HASH verification failed!\n"); + } + i++; + } +} +#ifndef __BOOTBLOCK__ + +static void process_named_list(const verify_item_t list[], const char *name, + void **buffer, uint32_t *size) +{ + int i = 0; + + while (list[i].type != VERIFY_TERMINATOR) { + switch (list[i].type) { + case VERIFY_FILE: + if (!strcmp(name, list[i].name)) { + if (list[i].data.file.related_items) { + printk(BIOS_SPEW, "process related" + "items\n"); + process_verify_list((verify_item_t *)list[i].data.file.related_items); + printk(BIOS_SPEW, "process related items done\n"); + } + verified_boot_check_cbfsfile(list[i].name, + list[i].data.file.cbfs_type, + list[i].hash_index, buffer, size, + list[i].pcr); + return; + } + break; + default: + printk(BIOS_EMERG, "INVALID TYPE IN NAMED LIST" + "0x%x\n", list[i].type); + die("HASH verification failed!\n"); + } + i++; + } + printk(BIOS_EMERG, "%s NOT IN LIST\n", name); + die("HASH verification failed!\n"); +} +#endif + +#ifdef __BOOTBLOCK__ +/* + * BOOTBLOCK + */ + +extern verify_item_t bootblock_verify_list[]; + +void verified_boot_bootblock_check(void) +{ + printk(BIOS_SPEW, "%s: processing bootblock items\n", __func__); + + if (IS_ENABLED(CONFIG_VERIFIED_BOOT_SIGNED_MANIFEST)) { + printk(BIOS_SPEW, "%s: check the manifest\n", __func__); + if (verified_boot_check_manifest() != 0) + die("invalid manifest"); + } + printk(BIOS_SPEW, "%s: process bootblock verify list\n", __func__); + process_verify_list(bootblock_verify_list); +} + +#endif //__BOOTBLOCK__ + + +#ifdef __ROMSTAGE__ +/* + * ROMSTAGE + */ + +extern verify_item_t ramstage_verify_list[]; + +int prog_locate_hook(struct prog *prog) +{ + if (prog->type == PROG_RAMSTAGE) { + process_named_list(ramstage_verify_list, prog->name, NULL, + NULL); + } + return 0; +} + +extern verify_item_t romstage_verify_list[]; + +void verified_boot_early_check(void) +{ + printk(BIOS_SPEW, "%s: processing early items\n", __func__); + + if (!IS_ENABLED(CONFIG_C_ENVIRONMENT_BOOTBLOCK) && + IS_ENABLED(CONFIG_VERIFIED_BOOT_SIGNED_MANIFEST)) { + printk(BIOS_SPEW, "%s: check the manifest\n", __func__); + if (verified_boot_check_manifest() != 0) + die("invalid manifest"); + } + printk(BIOS_SPEW, "%s: process early verify list\n", __func__); + process_verify_list(romstage_verify_list); +} +#endif //__ROMSTAGE__ + +#ifdef __RAMSTAGE__ +/* + * RAM STAGE + */ + +static int process_oprom_list(const verify_item_t list[], + struct rom_header *rom_header) +{ + int i = 0; + struct pci_data *rom_data; + uint32_t viddevid = 0; + + if (le32_to_cpu(rom_header->signature) != PCI_ROM_HDR) { + printk(BIOS_ERR, "Incorrect expansion ROM header " + "signature %04x DONT START\n", + le32_to_cpu(rom_header->signature)); + return 0; + } + + rom_data = (((void *)rom_header) + le32_to_cpu(rom_header->data)); + + viddevid |= (rom_data->vendor << 16); + viddevid |= rom_data->device; + + while (list[i].type != VERIFY_TERMINATOR) { + switch (list[i].type) { + case VERIFY_OPROM: + if (viddevid == list[i].data.oprom.viddev) { + verified_boot_check_buffer(list[i].name, + (void *) rom_header, + rom_header->size * 512, + list[i].hash_index, list[i].pcr); + if (list[i].data.oprom.related_items) { + printk(BIOS_SPEW, "%s: process" + " related items\n", __func__); + process_verify_list((verify_item_t *)list[i].data.oprom.related_items); + } + printk(BIOS_SPEW, "%s: option rom can be" + " started\n", __func__); + return 1; + } + break; + default: + printk(BIOS_EMERG, "%s: INVALID TYPE IN OPTION ROM LIST" + "0x%x\n", __func__, list[i].type); + die("HASH verification failed!\n"); + } + i++; + } + printk(BIOS_ERR, "%s: option rom not in list DONT START\n", __func__); + return 0; +} + +extern verify_item_t payload_verify_list[]; + +int prog_locate_hook(struct prog *prog) +{ + if (prog->type == PROG_PAYLOAD) { + void *buffer = (void*) 0x01000000; + printk(BIOS_SPEW, "%s: requesting %s\n", __func__, prog->name); + process_named_list(payload_verify_list, prog->name, &buffer, + NULL); + printk(BIOS_SPEW, "%s: running allowed\n", __func__); + } + return 0; +} + +extern verify_item_t oprom_verify_list[]; + +int verified_boot_should_run_oprom(struct rom_header *rom_header) +{ + return process_oprom_list(oprom_verify_list, rom_header); +} +#endif //__PRE_RAM__ diff --git a/src/vendorcode/eltan/security/verified_boot/vboot_check.h b/src/vendorcode/eltan/security/verified_boot/vboot_check.h new file mode 100644 index 0000000..34186f3 --- /dev/null +++ b/src/vendorcode/eltan/security/verified_boot/vboot_check.h @@ -0,0 +1,83 @@ +/* + * This file is part of the coreboot project. + * + * Copyright (C) 2016 Intel Corp. + * Copyright (C) 2017-2018 Eltan B.V. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; version 2 of the License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#ifndef VBOOT_CHECK_H +#define VBOOT_CHECK_H + +#include <cbfs.h> +#include <device/device.h> +#include <device/pci.h> +#include <lib.h> +#include CONFIG_VERIFIED_BOOT_MANIFEST +#include <console/console.h> +#include <cryptolib.h> +#include <string.h> +#include <program_loading.h> +#if IS_ENABLED(CONFIG_MBOOT) +#include <mboot.h> +#endif + +#define VERIFIED_BOOT_COPY_BLOCK 0x80000000 +/* These method verifies the SHA256 hash over the 'named' CBFS component. + * 'type' denotes the type of CBFS component i.e. stage, payload or fsp. + */ +#ifdef __BOOTBLOCK__ +void verified_boot_bootblock_check(void); +#endif +#ifdef __ROMSTAGE__ +void verified_boot_early_check(void); +#endif + +int verified_boot_check_manifest(void); + +void verified_boot_check_cbfsfile(const char *name, uint32_t type, + uint32_t hash_index, void **buffer, uint32_t *filesize, int32_t pcr); + +typedef enum { + + VERIFY_TERMINATOR = 0, + VERIFY_FILE, + VERIFY_BLOCK, + VERIFY_OPROM + +} verify_type; + +typedef struct { + verify_type type; + const char *name; + union { + struct { + const void *related_items; + uint32_t cbfs_type; + } file; + struct { + const void *start; + uint32_t size; + } block; + struct { + const void *related_items; + uint32_t viddev; + } oprom; + } data; + uint32_t hash_index; +#if IS_ENABLED(CONFIG_MBOOT) + int32_t pcr; +#endif //IS_ENABLED(CONFIG_MBOOT) +} verify_item_t; + +void process_verify_list(const verify_item_t list[]); + +#endif //VBOOT_CHECK_H -- To view, visit https://review.coreboot.org/c/coreboot/+/30835 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: If6c1423b0b4a309cefb7fe7a29d5100ba289e0b4 Gerrit-Change-Number: 30835 Gerrit-PatchSet: 1 Gerrit-Owner: Frans Hendriks <fhendriks(a)eltan.com> Gerrit-MessageType: newchange

3 17

Change in ...coreboot[master]: vendorcode/eltan/security/mboot: Add measured boot support.
by Frans Hendriks (Code Review) 04 Oct '19

04 Oct '19

Frans Hendriks has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/30833 Change subject: vendorcode/eltan/security/mboot: Add measured boot support. ...................................................................... vendorcode/eltan/security/mboot: Add measured boot support. Create measured boot. This feature uses the vendorcode/eltan/security/lib. The function mb_measure() is starting point for the support. BUG=N/A TEST=Created binary and verify logging on Facebook FBG-1701 Change-Id: I7f880a17e240515dd42d57383b5ddddf576985b0 Signed-off-by: Frans Hendriks <fhendriks(a)eltan.com> --- A src/vendorcode/eltan/security/mboot/Kconfig A src/vendorcode/eltan/security/mboot/Makefile.inc A src/vendorcode/eltan/security/mboot/mboot.c A src/vendorcode/eltan/security/mboot/mboot.h A src/vendorcode/eltan/security/mboot/mboot_func.c 5 files changed, 813 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/33/30833/1 diff --git a/src/vendorcode/eltan/security/mboot/Kconfig b/src/vendorcode/eltan/security/mboot/Kconfig new file mode 100644 index 0000000..b262f6d --- /dev/null +++ b/src/vendorcode/eltan/security/mboot/Kconfig @@ -0,0 +1,43 @@ +## This file is part of the coreboot project. +## +## Copyright (C) 2018 Eltan B.V. +## +## This program is free software; you can redistribute it and/or modify +## it under the terms of the GNU General Public License as published by +## the Free Software Foundation; version 2 of the License. +## +## This program is distributed in the hope that it will be useful, +## but WITHOUT ANY WARRANTY; without even the implied warranty of +## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +## GNU General Public License for more details. +## + +menu "Measured Boot (mboot)" + +config MBOOT + bool "Measure firmware with mboot." + default n + help + Enabling MBOOT will use mboot to measure the components of the firmware + (stages, payload, etc). + +config CRTM_VERSION_STRING + string "default CRTM version" + default "default CRTM version" + +config MBOOT_UEFI_SUPPORT + bool "Enable mboot UEFI support" + default n + depends on MBOOT + help + Add some specific items for UEFI support (not implemented yet) + +config MBOOT_EVENTLOG + bool "Enable mboot eventlog" + default n + default y if MBOOT_UEFI_SUPPORT + depends on MBOOT + help + Not only extend the PCRS but also log the events (not implemented yet) + +endmenu # Measured Boot (mboot) diff --git a/src/vendorcode/eltan/security/mboot/Makefile.inc b/src/vendorcode/eltan/security/mboot/Makefile.inc new file mode 100644 index 0000000..b586052 --- /dev/null +++ b/src/vendorcode/eltan/security/mboot/Makefile.inc @@ -0,0 +1,25 @@ +## +## This file is part of the coreboot project. +## +## Copyright (C) 2018 Eltan B.V. +## +## This program is free software; you can redistribute it and/or modify +## it under the terms of the GNU General Public License as published by +## the Free Software Foundation; version 2 of the License. +## +## This program is distributed in the hope that it will be useful, +## but WITHOUT ANY WARRANTY; without even the implied warranty of +## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +## GNU General Public License for more details. +## + +ifeq ($(CONFIG_MBOOT),y) + +CPPFLAGS_common += -I$(src)/security/mboot + +ramstage-y += mboot.c +ramstage-y += mboot_func.c + +romstage-y += mboot.c + +endif # CONFIG_MBOOT diff --git a/src/vendorcode/eltan/security/mboot/mboot.c b/src/vendorcode/eltan/security/mboot/mboot.c new file mode 100644 index 0000000..4e7e314 --- /dev/null +++ b/src/vendorcode/eltan/security/mboot/mboot.c @@ -0,0 +1,581 @@ +/* + * This file is part of the coreboot project. + * + * Copyright (C) 2015 Intel Corporation + * Copyright (C) 2018 Eltan B.V. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; version 2 of the License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#include <mboot.h> +#include <assert.h> +#include <build.h> +#include <vb2_api.h> + +/* + * Get the list of currently active PCR banks in TPM. + * + * @retval A map of active PCR banks. + */ +EFI_TCG2_EVENT_ALGORITHM_BITMAP tpm2_get_active_pcrs(void) +{ + int status; + TPML_PCR_SELECTION Pcrs; + EFI_TCG2_EVENT_ALGORITHM_BITMAP tpmHashAlgorithmBitmap = 0; + uint32_t activePcrBanks = 0; + uint32_t index; + + status = tpm2_get_capability_pcrs(&Pcrs); + if (status != TPM_SUCCESS) { + tpmHashAlgorithmBitmap = EFI_TCG2_BOOT_HASH_ALG_SHA1; + activePcrBanks = EFI_TCG2_BOOT_HASH_ALG_SHA1; + } else { + for (index = 0; index < Pcrs.count; index++) { + switch (Pcrs.pcrSelections[index].hash) { + case TPM_ALG_SHA1: + tpmHashAlgorithmBitmap |= + EFI_TCG2_BOOT_HASH_ALG_SHA1; + if (!is_zero_buffer(Pcrs.pcrSelections[index].pcrSelect, + Pcrs.pcrSelections[index].sizeofSelect)) + activePcrBanks |= + EFI_TCG2_BOOT_HASH_ALG_SHA1; + break; + case TPM_ALG_SHA256: + tpmHashAlgorithmBitmap |= + EFI_TCG2_BOOT_HASH_ALG_SHA256; + if (!is_zero_buffer(Pcrs.pcrSelections[index].pcrSelect, + Pcrs.pcrSelections[index].sizeofSelect)) + activePcrBanks |= + EFI_TCG2_BOOT_HASH_ALG_SHA256; + break; + case TPM_ALG_SHA384: + case TPM_ALG_SHA512: + case TPM_ALG_SM3_256: + default: + printk(BIOS_DEBUG, "%s: unsupported algorithm " + "reported - 0x%x\n", __func__, + Pcrs.pcrSelections[index].hash); + break; + } + } + } + printk(BIOS_DEBUG, "Tcg2 Capability values from TPM\n"); + printk(BIOS_DEBUG, "tpmHashAlgorithmBitmap - 0x%08x\n", + tpmHashAlgorithmBitmap); + printk(BIOS_DEBUG, "activePcrBanks - 0x%08x\n", + activePcrBanks); + + return activePcrBanks; +} + +/* + * tpm2_get_capability_pcrs + * + * Return the TPM PCR information. + * + * This function parses the data got from tlcl_getcapability and returns the + * PcrSelection. + * + * @param[out] Pcrs The Pcr Selection + * + * @retval TPM_SUCCESS Operation completed successfully. + * @retval TPM_E_IOERROR The command was unsuccessful. + */ +int tpm2_get_capability_pcrs(TPML_PCR_SELECTION *Pcrs) +{ + TPMS_CAPABILITY_DATA TpmCap; + TPMI_YES_NO MoreData; + int status; + int index; + + status = tlcl_getcapability(TPM_CAP_PCRS, 0, 1, &MoreData, &TpmCap); + if (status == TPM_SUCCESS) { + Pcrs->count = TpmCap.data.assignedPCR.count; + printk(BIOS_DEBUG, "Pcrs->count = %d\n", Pcrs->count); + for (index = 0; index < Pcrs->count; index++) { + Pcrs->pcrSelections[index].hash = + swab16(TpmCap.data.assignedPCR.pcrSelections[index].hash); + printk(BIOS_DEBUG, "Pcrs->pcrSelections[index].hash =" + "0x%x\n", Pcrs->pcrSelections[index].hash); + Pcrs->pcrSelections[index].sizeofSelect = + TpmCap.data.assignedPCR.pcrSelections[index].sizeofSelect; + memcpy(Pcrs->pcrSelections[index].pcrSelect, + TpmCap.data.assignedPCR.pcrSelections[index].pcrSelect, + Pcrs->pcrSelections[index].sizeofSelect); + } + } + return status; +} + +/* + * mboot_hash_extend_log + * + * Calculates the hash over the data and extends it in active PCR banks and + * then logs them in the event log. + * + * @param[in] activePcr bitmap of active PCR banks in TPM. + * @param[in] flags flags associated with hash data. Currently + * unused. + * @param[in] hashData data to be hashed. + * @param[in] hashDataLen length of the data to be hashed. + * @param[in] newEventHdr event header in TCG_PCR_EVENT2 format. + * @param[in] eventLog description of the event. + * @param[in] invalid invalidate the pcr + * + * @retval TPM_SUCCESS Operation completed successfully. + * @retval TPM_E_IOERROR Unexpected device behavior. + */ +int mboot_hash_extend_log(EFI_TCG2_EVENT_ALGORITHM_BITMAP activePcr, + uint64_t flags, uint8_t *hashData, uint32_t hashDataLen, + TCG_PCR_EVENT2_HDR *newEventHdr, uint8_t *eventLog, uint8_t invalid) +{ + int status; + TPMT_HA *digest = NULL; + int digest_num = 0; + + printk(BIOS_DEBUG, "%s: Hash Data Length: %zu bytes\n", __func__, + (size_t)hashDataLen); + + if (invalid) { + digest = &(newEventHdr->digest.digests[digest_num]); + digest->digest.invalidate_pcrs = 1; + digest->hashAlg = TPM_ALG_ERROR; + digest_num++; + } else { + /* + * Generate SHA1 hash if SHA1 PCR bank is active in TPM + * currently + */ + if (activePcr & EFI_TCG2_BOOT_HASH_ALG_SHA1) { + digest = &(newEventHdr->digest.digests[digest_num]); + if (flags & MBOOT_HASH_PROVIDED) { + /* The hash is provided as data */ + memcpy(digest->digest.sha1, (void *)hashData, + SHA1_DIGEST_SIZE); + } else { + cb_sha1((const uint8_t *)hashData, hashDataLen, + digest->digest.sha1); + } + + digest->hashAlg = TPM_ALG_SHA1; + digest_num++; + + printk(BIOS_DEBUG, "%s: SHA1 Hash Digest:\n", __func__); + mboot_print_buffer(digest->digest.sha1, + SHA1_DIGEST_SIZE); + } + + /* + * Generate SHA256 hash if SHA256 PCR bank is active in TPM + * currently + */ + if (activePcr & EFI_TCG2_BOOT_HASH_ALG_SHA256) { + digest = &(newEventHdr->digest.digests[digest_num]); + if (flags & MBOOT_HASH_PROVIDED) { + /* The hash is provided as data */ + memcpy(digest->digest.sha256, + (void *)hashData, hashDataLen); + } else { + cb_sha256(hashData, hashDataLen, + digest->digest.sha256); + } + digest->hashAlg = TPM_ALG_SHA256; + digest_num++; + + printk(BIOS_DEBUG, "%s: SHA256 Hash Digest:\n", + __func__); + mboot_print_buffer(digest->digest.sha256, + SHA256_DIGEST_SIZE); + } + } + + newEventHdr->digest.count = digest_num; + + status = tlcl_extend_ex( + newEventHdr->pcrIndex, + &(newEventHdr->digest) + ); + + if (IS_ENABLED(CONFIG_MBOOT_EVENTLOG)) { + /* Perform the logging of the measurement */ + if (status == TPM_SUCCESS) { + status = log_event_tcg_20_format(newEventHdr, eventLog); + /* + * If SHA1 PCR bank is active, log the event in TCG 1.2 format + * tool + */ + if (activePcr & EFI_TCG2_BOOT_HASH_ALG_SHA1) + status = log_event_tcg_12_format(newEventHdr, + eventLog); + } + } + if (status != TPM_SUCCESS) + printk(BIOS_DEBUG, "%s: returned 0x%x\n", __func__, status); + + return status; +} + +/* + * invalidate_pcrs + * + * Invalidate PCRs 0-7 with extending 1 after tpm failure. + */ +void invalidate_pcrs(void) +{ + int status, pcr; + TCG_PCR_EVENT2_HDR tcgEventHdr; + EFI_TCG2_EVENT_ALGORITHM_BITMAP ActivePcrs; + uint8_t invalidate; + + ActivePcrs = tpm2_get_active_pcrs(); + invalidate = 1; + + for (pcr = 0; pcr < 8; pcr++) { + printk(BIOS_DEBUG, "%s: Invalidating PCR %d\n", __func__, pcr); + memset(&tcgEventHdr, 0, sizeof(tcgEventHdr)); + tcgEventHdr.pcrIndex = pcr; + tcgEventHdr.eventType = EV_NO_ACTION; + tcgEventHdr.eventSize = (uint32_t) sizeof(invalidate); + + status = mboot_hash_extend_log(ActivePcrs, 0, + (uint8_t *)&invalidate, tcgEventHdr.eventSize, + &tcgEventHdr, (uint8_t *)"Invalidate PCR", invalidate); + + if (status != TPM_SUCCESS) + printk(BIOS_DEBUG, "%s: invalidating pcr %d returned" + " 0x%x\n", __func__, pcr, status); + } +} + +/* + * is_zero_buffer + * + * Check if buffer is all zero. + * + * @param[in] buffer Buffer to be checked. + * @param[in] size Size of buffer to be checked. + * + * @retval TRUE buffer is all zero. + * @retval FALSE buffer is not all zero. + */ +int is_zero_buffer(void *buffer, unsigned int size) +{ + uint8_t *ptr; + + ptr = buffer; + while (size--) { + if (*(ptr++) != 0) + return false; + } + return true; +} + +/* + * Prints command or response buffer for debugging purposes. + * + * @param[in] Buffer Buffer to print. + * @param[in] BufferSize Buffer data length. + * + * @retval None + */ +void mboot_print_buffer(uint8_t *buffer, uint32_t bufferSize) +{ + uint32_t index; + + printk(BIOS_DEBUG, "Buffer Address: 0x%08x, Size: 0x%08x, Value:\n", + (unsigned int)*buffer, bufferSize); + for (index = 0; index < bufferSize; index++) { + printk(BIOS_DEBUG, "%02x ", *(buffer + index)); + if ((index+1) % 16 == 0) + printk(BIOS_DEBUG, "\n"); + } + printk(BIOS_DEBUG, "\n"); +} + +/* + * measures and logs the specified cbfs file. + * + * @param[in] activePcr bitmap of active PCR banks in TPM. + * @param[in] name name of the cbfs file to measure + * @param[in] type data type of the cbfs file. + * @param[in] pcr pcr to extend. + * @param[in] evenType tcg event type. + * @param[in] event_msg description of the event. + * + * @retval TPM_SUCCESS Operation completed successfully. + * @retval TPM_E_IOERROR Unexpected device behavior. + */ +int mb_measure_log_worker(EFI_TCG2_EVENT_ALGORITHM_BITMAP activePcr, + const char *name, uint32_t type, uint32_t pcr, + TCG_EVENTTYPE eventType, const char *event_msg) +{ + int status; + TCG_PCR_EVENT2_HDR tcgEventHdr; + uint8_t *base; + size_t size; + + printk(BIOS_DEBUG, "%s: Measure %s\n", __func__, name); + base = cbfs_boot_map_with_leak(name, type, &size); + + if (base == NULL) { + printk(BIOS_DEBUG, "%s: CBFS locate fail: %s\n", __func__, + name); + return VB2_ERROR_READ_FILE_OPEN; + } + + printk(BIOS_DEBUG, "%s: CBFS locate success: %s\n", + __func__, name); + memset(&tcgEventHdr, 0, sizeof(tcgEventHdr)); + tcgEventHdr.pcrIndex = pcr; + tcgEventHdr.eventType = eventType; + if (event_msg) + tcgEventHdr.eventSize = (uint32_t) strlen(event_msg); + + status = mboot_hash_extend_log(activePcr, 0, base, size, &tcgEventHdr, + (uint8_t *)event_msg, 0); + return status; +} + +#ifdef __PRE_RAM__ +/* + * Called from early romstage + * + *mb_entry + * + * initializes measured boot mechanism, initializes the + * tpm library and starts the tpm called by mb_measure + * + * The function can be overridden at the mainboard level my simply creating a + * function with the same name there. + * + * @param[in] wake_from_s3 1 if we are waking from S3, 0 standard boot + * + * @retval TPM_SUCCESS Operation completed successfully. + * @retval TPM_E_IOERROR Unexpected device behavior. +**/ + +int __attribute__((weak)) mb_entry(int wake_from_s3) +{ + int status; + + /* Initialize TPM driver. */ + printk(BIOS_DEBUG, "%s: tlcl_lib_init\n", __func__); + if (tlcl_lib_init() != VB2_SUCCESS) { + printk(BIOS_ERR, "%s: TPM driver initialization failed.\n", + __func__); + return TPM_E_IOERROR; + } + + if (wake_from_s3) { + printk(BIOS_DEBUG, "%s: tlcl_resume\n", __func__); + status = tlcl_resume(); + } else { + printk(BIOS_DEBUG, "%s: tlcl_startup\n", __func__); + status = tlcl_startup(); + } + + if (status) + printk(BIOS_ERR, "%s: StartUp failed 0x%x!\n", __func__, + status); + + return status; +} + +/* + * + * mb_measure + * + * initial call to the measured boot mechanism, initializes the + * tpm library, starts the tpm and performs the measurements defined by + * the coreboot platform. + * + * The pcrs will be invalidated if the measurement fails + * + * The function can be overridden at the mainboard level my simply creating a + * function with the same name there. + * + * @param[in] wake_from_s3 1 if we are waking from S3, 0 standard boot + * + * @retval TPM_SUCCESS Operation completed successfully. + * @retval TPM_E_IOERROR Unexpected device behavior. + */ + +int __attribute__((weak))mb_measure(int wake_from_s3) +{ + uint32_t status; + + status = mb_entry(wake_from_s3); + if (status == TPM_SUCCESS) { + printk(BIOS_DEBUG, "%s: StartUp, successful!\n", __func__); + status = mb_measure_log_start(); + if (status == TPM_SUCCESS) { + printk(BIOS_DEBUG, "%s: Measuring, successful!\n", + __func__); + } else { + invalidate_pcrs(); + printk(BIOS_ERR, "%s: Measuring returned 0x%x " + "unsuccessful! PCRs invalidated.\n", + __func__, status); + } + } else { + invalidate_pcrs(); + printk(BIOS_ERR, "%s: StartUp returned 0x%x, unsuccessful!" + "PCRs invalidated.\n", __func__, status); + } + return status; +} + +/* + * + * mb_measure_log_start + * + * performs the measurements defined by the the board routines. + * + * The logging is defined by the mb_log_list structure and mb_log_list_count. + * + * These items need to be defined in the mainboard part of the mboot + * implementation + * + * The function can be overridden at the mainboard level my simply creating a + * function with the same name there. + * + * @param[in] none + * + * @retval TPM_SUCCESS Operation completed successfully. + * @retval TPM_E_IOERROR Unexpected device behavior. + */ +int __attribute__((weak))mb_measure_log_start(void) +{ + int status; + EFI_TCG2_EVENT_ALGORITHM_BITMAP ActivePcrs; + uint32_t i; + + ActivePcrs = tpm2_get_active_pcrs(); + + if (ActivePcrs == 0x0) { + printk(BIOS_DEBUG, "%s: No Active PCR Bank in TPM.\n", + __func__); + return TPM_E_IOERROR; + } + + if (IS_ENABLED(CONFIG_MBOOT_UEFI_SUPPORT)) { + status = log_efi_specid_event(ActivePcrs); + + if (status != TPM_SUCCESS) { + printk(BIOS_DEBUG, "%s: Fail! Specification ID version" + "event can't be logged. ABORTING!!!\n", __func__); + return status; + } + } + status = mb_crtm(ActivePcrs); + if (status != TPM_SUCCESS) { + printk(BIOS_DEBUG, "%s: Fail! CRTM Version can't be measured." + " ABORTING!!!\n", __func__); + return status; + } + printk(BIOS_DEBUG, "%s: Success! CRTM Version measured.\n", __func__); + + /* Log the items defined by the mainboard */ + for (i = 0; i < mb_log_list_count; i++) { + status = mb_measure_log_worker( + ActivePcrs, mb_log_list[i].cbfs_name, + mb_log_list[i].cbfs_type, mb_log_list[i].pcr, + mb_log_list[i].eventType, + mb_log_list[i].event_msg); + if (status != TPM_SUCCESS) { + printk(BIOS_DEBUG, "%s: Fail! %s can't be measured." + "ABORTING!!!\n", __func__, + mb_log_list[i].cbfs_name); + return status; + } + printk(BIOS_DEBUG, "%s: Success! %s measured to pcr" + "%d.\n", __func__, mb_log_list[i].cbfs_name, + mb_log_list[i].pcr); + } + return status; +} + +static const uint8_t crtm_version[] = CONFIG_CRTM_VERSION_STRING\ + COREBOOT_VERSION COREBOOT_EXTRA_VERSION " " COREBOOT_BUILD; + +/* + * + * mb_crtm + * + * measures the crtm version. this consists of a string than can be + * defined using make menuconfig and automatically generated version + * information. + * + * The function can be overridden at the mainboard level my simply creating a + * function with the same name there. + * + * @param[in] activePcr bitmap of the support + * + * @retval TPM_SUCCESS Operation completed successfully. + * @retval TPM_E_IOERROR Unexpected device behavior. +**/ +int __attribute__((weak))mb_crtm(EFI_TCG2_EVENT_ALGORITHM_BITMAP activePcr) +{ + int status; + TCG_PCR_EVENT2_HDR tcgEventHdr; + uint8_t hash[SHA256_DIGEST_SIZE]; + uint8_t *msgPtr; + + /* Use FirmwareVersion string to represent CRTM version. */ + printk(BIOS_DEBUG, "%s: Measure CRTM Version\n", __func__); + memset(&tcgEventHdr, 0, sizeof(tcgEventHdr)); + tcgEventHdr.pcrIndex = MBOOT_PCR_INDEX_0; + tcgEventHdr.eventType = EV_S_CRTM_VERSION; + tcgEventHdr.eventSize = sizeof(crtm_version); + printk(BIOS_DEBUG, "%s: EventSize - %u\n", __func__, + tcgEventHdr.eventSize); + + status = mboot_hash_extend_log(activePcr, 0, (uint8_t *)crtm_version, + tcgEventHdr.eventSize, &tcgEventHdr, (uint8_t *)crtm_version, + 0); + if (status) { + printk(BIOS_DEBUG, "Measure CRTM Version returned 0x%x\n", + status); + return status; + } + + status = get_intel_me_hash(hash); + if (status) { + printk(BIOS_DEBUG, "get_intel_me_hash returned 0x%x\n", status); + status = TPM_E_IOERROR; + return status; + } + + /* Add the me hash */ + printk(BIOS_DEBUG, "%s: Add the hash returned by the ME\n", + __func__); + memset(&tcgEventHdr, 0, sizeof(tcgEventHdr)); + tcgEventHdr.pcrIndex = MBOOT_PCR_INDEX_0; + tcgEventHdr.eventType = EV_S_CRTM_CONTENTS; + + if (IS_ENABLED(CONFIG_MBOOT_EVENTLOG)) { + const uint8_t me_message[] = "HASH RETURNED BY ME"; + msgPtr = (uint8_t *)msgPtr; + tcgEventHdr.eventSize = sizeof(me_message); + printk(BIOS_DEBUG, "%s: EventSize - %u\n", __func__, + tcgEventHdr.eventSize); + } else { + msgPtr = NULL; + tcgEventHdr.eventSize = 0; + } + + status = mboot_hash_extend_log(activePcr, MBOOT_HASH_PROVIDED, hash, + sizeof(hash), &tcgEventHdr, msgPtr, 0); + if (status) + printk(BIOS_DEBUG, "Add ME hash returned 0x%x\n", status); + + return status; +} +#endif // __PRE_RAM__ diff --git a/src/vendorcode/eltan/security/mboot/mboot.h b/src/vendorcode/eltan/security/mboot/mboot.h new file mode 100644 index 0000000..45a4732 --- /dev/null +++ b/src/vendorcode/eltan/security/mboot/mboot.h @@ -0,0 +1,136 @@ +/* + * This file is part of the coreboot project. + * + * Copyright (C) 2015 Intel Corporation + * Copyright (C) 2018 Eltan B.V. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; version 2 of the License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#ifndef MBOOT_H +#define MBOOT_H + +#include <arch/io.h> +#include <arch/acpi.h> +#include <string.h> +#include <console/console.h> +#include <cryptolib.h> +#include <cbfs.h> +#include <lib.h> +#include <boot/coreboot_tables.h> +#include <security/tpm/tss/tcg-2.0/tss_structures.h> +#include <security/tpm/tss.h> + +/* TPM2 interface */ +#define EFI_TPM2_ACPI_TABLE_START_METHOD_TIS 6 +#define TPM_SHA1_160_HASH_LEN 0x14 + +/* Part 2, section 5.4: TPM_DIGEST */ +typedef struct tdTPM_DIGEST { + int8_t digest[TPM_SHA1_160_HASH_LEN]; +} TPM_DIGEST; + +/* Index to a PCR register */ +typedef uint32_t TPM_PCRINDEX; +typedef uint32_t TCG_EVENTTYPE; +typedef TPM_PCRINDEX TCG_PCRINDEX; +typedef TPM_DIGEST TCG_DIGEST; + +/* TCG_PCR_EVENT_HDR */ +typedef struct tdTCG_PCR_EVENT_HDR { + TCG_PCRINDEX pcrIndex; + TCG_EVENTTYPE eventType; + TCG_DIGEST digest; + uint32_t eventSize; +} __packed TCG_PCR_EVENT_HDR; + +/* TCG_PCR_EVENT2_HDR */ +typedef struct tdTCG_PCR_EVENT2_HDR { + TCG_PCRINDEX pcrIndex; + TCG_EVENTTYPE eventType; + TPML_DIGEST_VALUES digest; + uint32_t eventSize; +} __packed TCG_PCR_EVENT2_HDR; + +typedef uint32_t EFI_TCG2_EVENT_ALGORITHM_BITMAP; + +#define EFI_TCG2_BOOT_HASH_ALG_SHA1 0x00000001 +#define EFI_TCG2_BOOT_HASH_ALG_SHA256 0x00000002 +#define EFI_TCG2_BOOT_HASH_ALG_SHA384 0x00000004 +#define EFI_TCG2_BOOT_HASH_ALG_SHA512 0x00000008 +#define EFI_TCG2_BOOT_HASH_ALG_SM3_256 0x00000010 + +/* Standard event types */ +#define EV_POST_CODE ((TCG_EVENTTYPE) 0x00000001) +#define EV_NO_ACTION ((TCG_EVENTTYPE) 0x00000003) +#define EV_SEPARATOR ((TCG_EVENTTYPE) 0x00000004) +#define EV_S_CRTM_CONTENTS ((TCG_EVENTTYPE) 0x00000007) +#define EV_S_CRTM_VERSION ((TCG_EVENTTYPE) 0x00000008) +#define EV_CPU_MICROCODE ((TCG_EVENTTYPE) 0x00000009) +#define EV_TABLE_OF_DEVICES ((TCG_EVENTTYPE) 0x0000000B) + +#define MBOOT_PCR_INDEX_0 0x0 +#define MBOOT_PCR_INDEX_1 0x1 +#define MBOOT_PCR_INDEX_2 0x2 +#define MBOOT_PCR_INDEX_3 0x3 +#define MBOOT_PCR_INDEX_4 0x4 +#define MBOOT_PCR_INDEX_5 0x5 +#define MBOOT_PCR_INDEX_6 0x6 +#define MBOOT_PCR_INDEX_7 0x7 + +/* + * used to indicate a hash is provide so there is no need to perform the + * measurement + */ +#define MBOOT_HASH_PROVIDED (0x00000001) + + +int is_zero_buffer(void *buffer, unsigned int size); + +int mboot_hash_extend_log(EFI_TCG2_EVENT_ALGORITHM_BITMAP activePcr, + uint64_t flags, uint8_t *hashData, uint32_t hashDataLen, + TCG_PCR_EVENT2_HDR *newEventHdr, uint8_t *eventLog, uint8_t invalid); + +void mboot_print_buffer(uint8_t *buffer, uint32_t bufferSize); + +int mb_crtm(EFI_TCG2_EVENT_ALGORITHM_BITMAP activePcr); + +typedef struct { + const char *cbfs_name; + uint32_t cbfs_type; + uint32_t pcr; + TCG_EVENTTYPE eventType; + const char *event_msg; +} mboot_measure_item_t; + +int mb_measure_log_worker(EFI_TCG2_EVENT_ALGORITHM_BITMAP activePcr, + const char *name, uint32_t type, uint32_t pcr, + TCG_EVENTTYPE eventType, const char *event_msg); + +int mb_measure_log_start(void); +void invalidate_pcrs(void); + +EFI_TCG2_EVENT_ALGORITHM_BITMAP tpm2_get_active_pcrs(void); + +int tpm2_get_capability_pcrs(TPML_PCR_SELECTION *Pcrs); + +extern const mboot_measure_item_t mb_log_list[]; +extern const uint32_t mb_log_list_count; + +int mb_measure(int wake_from_s3); +int mb_entry(int wake_from_s3); + +int log_efi_specid_event(EFI_TCG2_EVENT_ALGORITHM_BITMAP ActivePcrs); +int log_event_tcg_20_format(TCG_PCR_EVENT2_HDR *EventHdr, uint8_t *EventLog); +int log_event_tcg_12_format(TCG_PCR_EVENT2_HDR *EventHdr, uint8_t *EventLog); + +int get_intel_me_hash(uint8_t *hash); + +#endif /* MBOOT_H */ diff --git a/src/vendorcode/eltan/security/mboot/mboot_func.c b/src/vendorcode/eltan/security/mboot/mboot_func.c new file mode 100644 index 0000000..ec66d34 --- /dev/null +++ b/src/vendorcode/eltan/security/mboot/mboot_func.c @@ -0,0 +1,28 @@ +/* + * This file is part of the coreboot project. + * + * Copyright (C) 2018 Eltan B.V. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; version 2 of the License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#include <mboot.h> + +int log_efi_specid_event(EFI_TCG2_EVENT_ALGORITHM_BITMAP ActivePcrs) { + return TPM_SUCCESS; +} + +int log_event_tcg_12_format(TCG_PCR_EVENT2_HDR *EventHdr, uint8_t *EventLog) { + return TPM_SUCCESS; +} + +int log_event_tcg_20_format(TCG_PCR_EVENT2_HDR *EventHdr, uint8_t *EventLog) { + return TPM_SUCCESS; +} -- To view, visit https://review.coreboot.org/c/coreboot/+/30833 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I7f880a17e240515dd42d57383b5ddddf576985b0 Gerrit-Change-Number: 30833 Gerrit-PatchSet: 1 Gerrit-Owner: Frans Hendriks <fhendriks(a)eltan.com> Gerrit-MessageType: newchange

5 18

Change in ...coreboot[master]: superio/ite/it8613e: add support for ITE IT8613E
by Krystian Hebel (Code Review) 03 Oct '19

03 Oct '19

Krystian Hebel has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/31617 Change subject: superio/ite/it8613e: add support for ITE IT8613E ...................................................................... superio/ite/it8613e: add support for ITE IT8613E This change adds support for the SuperIO chip IT8613E. This chip uses FANs 2-5 and have SmartGuardian always enabled (no ON/OFF control) so it relies on support in common ITE code. LDNs were taken from datasheet. Change-Id: I73c083b7019163c1203a5aabbef7d9d8f5ccb16a Signed-off-by: Krystian Hebel <krystian.hebel(a)3mdeb.com> --- A src/superio/ite/it8613e/Kconfig A src/superio/ite/it8613e/Makefile.inc A src/superio/ite/it8613e/chip.h A src/superio/ite/it8613e/it8613e.h A src/superio/ite/it8613e/superio.c 5 files changed, 189 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/17/31617/1 diff --git a/src/superio/ite/it8613e/Kconfig b/src/superio/ite/it8613e/Kconfig new file mode 100644 index 0000000..f09cac2 --- /dev/null +++ b/src/superio/ite/it8613e/Kconfig @@ -0,0 +1,27 @@ +## +## This file is part of the coreboot project. +## +## Copyright (C) 2009 Ronald G. Minnich +## Copyright (C) 2014 Edward O'Callaghan <eocallaghan(a)alterapraxis.com> +## Copyright (C) 2017 Gergely Kiss <mail.gery(a)gmail.com> +## Copyright (C) 2018 Kevin Cody-Little <kcodyjr(a)gmail.com> +## Copyright (C) 2019 Protectli +## +## This program is free software; you can redistribute it and/or modify +## it under the terms of the GNU General Public License as published by +## the Free Software Foundation; version 2 of the License. +## +## This program is distributed in the hope that it will be useful, +## but WITHOUT ANY WARRANTY; without even the implied warranty of +## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +## GNU General Public License for more details. +## + +config SUPERIO_ITE_IT8613E + bool + select SUPERIO_ITE_COMMON_PRE_RAM + select SUPERIO_ITE_ENV_CTRL + select SUPERIO_ITE_ENV_CTRL_PWM_FREQ2 + select SUPERIO_ITE_ENV_CTRL_8BIT_PWM + select SUPERIO_ITE_ENV_CTRL_5FANS + select SUPERIO_ITE_ENV_CTRL_NO_ONOFF diff --git a/src/superio/ite/it8613e/Makefile.inc b/src/superio/ite/it8613e/Makefile.inc new file mode 100644 index 0000000..75ab26b --- /dev/null +++ b/src/superio/ite/it8613e/Makefile.inc @@ -0,0 +1,19 @@ +## +## This file is part of the coreboot project. +## +## Copyright (C) 2006 Uwe Hermann <uwe(a)hermann-uwe.de> +## Copyright (C) 2017 Gergely Kiss <mail.gery(a)gmail.com> +## Copyright (C) 2019 Protectli +## +## This program is free software; you can redistribute it and/or modify +## it under the terms of the GNU General Public License as published by +## the Free Software Foundation; either version 2 of the License, or +## (at your option) any later version. +## +## This program is distributed in the hope that it will be useful, +## but WITHOUT ANY WARRANTY; without even the implied warranty of +## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +## GNU General Public License for more details. +## + +ramstage-$(CONFIG_SUPERIO_ITE_IT8613E) += superio.c diff --git a/src/superio/ite/it8613e/chip.h b/src/superio/ite/it8613e/chip.h new file mode 100644 index 0000000..65875c8 --- /dev/null +++ b/src/superio/ite/it8613e/chip.h @@ -0,0 +1,27 @@ +/* + * This file is part of the coreboot project. + * + * Copyright (C) 2014 Edward O'Callaghan <eocallaghan(a)alterapraxis.com> + * Copyright (C) 2019 Protectli + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#ifndef SUPERIO_ITE_IT8613E_CHIP_H +#define SUPERIO_ITE_IT8613E_CHIP_H + +#include <superio/ite/common/env_ctrl_chip.h> + +struct superio_ite_it8613e_config { + struct ite_ec_config ec; +}; + +#endif /* SUPERIO_ITE_IT8613E_CHIP_H */ diff --git a/src/superio/ite/it8613e/it8613e.h b/src/superio/ite/it8613e/it8613e.h new file mode 100644 index 0000000..dace936 --- /dev/null +++ b/src/superio/ite/it8613e/it8613e.h @@ -0,0 +1,29 @@ +/* + * This file is part of the coreboot project. + * + * Copyright (C) 2006 Uwe Hermann <uwe(a)hermann-uwe.de> + * Copyright (C) 2017 Gergely Kiss <mail.gery(a)gmail.com> + * Copyright (C) 2019 Protectli + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#ifndef SUPERIO_ITE_IT8613E_H +#define SUPERIO_ITE_IT8613E_H + +#define IT8613E_SP1 0x01 /* Com1 */ +#define IT8613E_EC 0x04 /* Environment controller */ +#define IT8613E_KBCK 0x05 /* PS/2 keyboard */ +#define IT8613E_KBCM 0x06 /* PS/2 mouse */ +#define IT8613E_GPIO 0x07 /* GPIO */ +#define IT8613E_CIR 0x0a /* Consumer Infrared */ + +#endif /* SUPERIO_ITE_IT8613E_H */ diff --git a/src/superio/ite/it8613e/superio.c b/src/superio/ite/it8613e/superio.c new file mode 100644 index 0000000..6bffc16 --- /dev/null +++ b/src/superio/ite/it8613e/superio.c @@ -0,0 +1,87 @@ +/* + * This file is part of the coreboot project. + * + * Copyright (C) 2006 Uwe Hermann <uwe(a)hermann-uwe.de> + * Copyright (C) 2007 Philipp Degler <pdegler(a)rumms.uni-mannheim.de> + * Copyright (C) 2017 Gergely Kiss <mail.gery(a)gmail.com> + * Copyright (C) 2019 Protectli + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#include <device/device.h> +#include <device/pnp.h> +#include <pc80/keyboard.h> +#include <arch/io.h> +#include <stdlib.h> +#include <superio/conf_mode.h> +#include <superio/ite/common/env_ctrl.h> + +#include "chip.h" +#include "it8613e.h" + +static void it8613e_init(struct device *dev) +{ + const struct superio_ite_it8613e_config *conf = dev->chip_info; + const struct resource *res; + + if (!dev->enabled) + return; + + switch (dev->path.pnp.device) { + case IT8613E_EC: + res = find_resource(dev, PNP_IDX_IO0); + if (!conf || !res) + break; + ite_ec_init(res->base, &conf->ec); + break; + case IT8613E_KBCK: + pc_keyboard_init(NO_AUX_DEVICE); + break; + case IT8613E_KBCM: + break; + } +} + +static struct device_operations ops = { + .read_resources = pnp_read_resources, + .set_resources = pnp_set_resources, + .enable_resources = pnp_enable_resources, + .enable = pnp_alt_enable, + .init = it8613e_init, + .ops_pnp_mode = &pnp_conf_mode_870155_aa, +}; + +static struct pnp_info pnp_dev_info[] = { + /* Serial Port 1 */ + { NULL, IT8613E_SP1, PNP_IO0 | PNP_IRQ0 | PNP_MSC0, 0x0ff8, }, + /* Environmental Controller */ + { NULL, IT8613E_EC, PNP_IO0 | PNP_IO1 | PNP_IRQ0, 0x0ff8, 0x0ffc, }, + /* KBC Keyboard */ + { NULL, IT8613E_KBCK, PNP_IO0 | PNP_IO1 | PNP_IRQ0 | PNP_MSC0, + 0x0fff, 0x0fff, }, + /* KBC Mouse */ + { NULL, IT8613E_KBCM, PNP_IRQ0 | PNP_MSC0, }, + /* GPIO */ + { NULL, IT8613E_GPIO, PNP_IO0 | PNP_IO1 | PNP_IRQ0, 0x0ffc, 0x0fff, }, + /* Consumer Infrared */ + { NULL, IT8613E_CIR, PNP_IO0 | PNP_IRQ0 | PNP_MSC0, 0x0ff8, }, +}; + +static void enable_dev(struct device *dev) +{ + pnp_enable_devices(dev, &ops, ARRAY_SIZE(pnp_dev_info), pnp_dev_info); +} + +struct chip_operations superio_ite_it8613e_ops = { + CHIP_NAME("ITE IT8613E Super I/O") + .enable_dev = enable_dev, +}; -- To view, visit https://review.coreboot.org/c/coreboot/+/31617 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I73c083b7019163c1203a5aabbef7d9d8f5ccb16a Gerrit-Change-Number: 31617 Gerrit-PatchSet: 1 Gerrit-Owner: Krystian Hebel <krystian.hebel(a)3mdeb.com> Gerrit-MessageType: newchange

5 15

Change in ...coreboot[master]: mb/lenovo/x131e: enable mSATA slot
by James (Code Review) 28 Sep '19

28 Sep '19

James has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/31364 Change subject: mb/lenovo/x131e: enable mSATA slot ...................................................................... mb/lenovo/x131e: enable mSATA slot Per google/stout. Functionality untested. Change-Id: I7cc9837f572236acac2007e95990e64c25a5d6e2 --- M src/mainboard/lenovo/x131e/devicetree.cb 1 file changed, 2 insertions(+), 2 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/64/31364/1 diff --git a/src/mainboard/lenovo/x131e/devicetree.cb b/src/mainboard/lenovo/x131e/devicetree.cb index 628c4eb..d20abdf 100644 --- a/src/mainboard/lenovo/x131e/devicetree.cb +++ b/src/mainboard/lenovo/x131e/devicetree.cb @@ -49,8 +49,8 @@ register "gpi6_routing" = "2" register "gpi13_routing" = "2" - # Enable SATA ports - register "sata_port_map" = "0x1" + # Enable SATA ports 0 (2.5 inch) and 1 (mSATA) + register "sata_port_map" = "0x3" # Set max SATA speed to 6.0 Gb/s register "sata_interface_speed_support" = "0x3" -- To view, visit https://review.coreboot.org/c/coreboot/+/31364 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I7cc9837f572236acac2007e95990e64c25a5d6e2 Gerrit-Change-Number: 31364 Gerrit-PatchSet: 1 Gerrit-Owner: James <jye836(a)gmail.com> Gerrit-MessageType: newchange

3 9

Change in ...coreboot[master]: mb/lenovo/x131e: correct USB port config
by James (Code Review) 28 Sep '19

28 Sep '19

James has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/31365 Change subject: mb/lenovo/x131e: correct USB port config ...................................................................... mb/lenovo/x131e: correct USB port config Based on schematic and register dumps. Change-Id: I91fc47022988cfe986fb8c1ed21dc073ee7d16bc --- M src/mainboard/lenovo/x131e/romstage.c 1 file changed, 14 insertions(+), 14 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/65/31365/1 diff --git a/src/mainboard/lenovo/x131e/romstage.c b/src/mainboard/lenovo/x131e/romstage.c index 43e0bd7..7e326e7 100644 --- a/src/mainboard/lenovo/x131e/romstage.c +++ b/src/mainboard/lenovo/x131e/romstage.c @@ -38,20 +38,20 @@ } const struct southbridge_usb_port mainboard_usb_ports[] = { - {1, 1, 0}, - {1, 1, 0}, - {0, 1, 1}, - {1, 1, 1}, - {1, 0, 2}, - {1, 0, 2}, - {0, 0, 3}, - {0, 0, 3}, - {0, 1, 4}, - {1, 1, 4}, - {0, 0, 5}, - {0, 0, 5}, - {0, 0, 6}, - {1, 0, 6}, + {1, 1, 0}, /* P0: USB 3.0 1 (OC0) */ + {1, 1, 0}, /* P1: USB 3.0 2 (OC0) */ + {0, 0, 0}, + {1, 1, -1}, /* P3: Camera (no OC) */ + {1, 0, -1}, /* P4: WLAN (no OC) */ + {1, 0, -1}, /* P5: WWAN (no OC) */ + {0, 0, 0}, + {0, 0, 0}, + {0, 0, 0}, + {1, 1, 4}, /* P9: USB 2.0 (AUO4) (OC4) */ + {0, 0, 0}, + {0, 0, 0}, + {0, 0, 0}, + {1, 0, -1}, /* P13: Bluetooth (no OC) */ }; void mainboard_get_spd(spd_raw_data *spd, bool id_only) -- To view, visit https://review.coreboot.org/c/coreboot/+/31365 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I91fc47022988cfe986fb8c1ed21dc073ee7d16bc Gerrit-Change-Number: 31365 Gerrit-PatchSet: 1 Gerrit-Owner: James <jye836(a)gmail.com> Gerrit-MessageType: newchange

3 4

Change in ...coreboot[master]: cpu/intel/common: Extend FSB detection to cover TSC
by Kyösti Mälkki (Code Review) 23 Sep '19

23 Sep '19

Kyösti Mälkki has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/31340 Change subject: cpu/intel/common: Extend FSB detection to cover TSC ...................................................................... cpu/intel/common: Extend FSB detection to cover TSC Change-Id: Ib7f1815b3fac7a610f7203720d526eac152a1648 Signed-off-by: Kyösti Mälkki <kyosti.malkki(a)gmail.com> --- M src/cpu/intel/common/fsb.c 1 file changed, 23 insertions(+), 12 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/40/31340/1 diff --git a/src/cpu/intel/common/fsb.c b/src/cpu/intel/common/fsb.c index 83220de..d06739c 100644 --- a/src/cpu/intel/common/fsb.c +++ b/src/cpu/intel/common/fsb.c @@ -18,14 +18,13 @@ #include <console/console.h> #include <commonlib/helpers.h> -static int get_fsb(void) +static int get_fsb_tsc(int *fsb, int *ratio) { struct cpuinfo_x86 c; static const short core_fsb[8] = { -1, 133, -1, 166, -1, 100, -1, -1 }; static const short core2_fsb[8] = { 266, 133, 200, 166, 333, 100, 400, -1 }; static const short f2x_fsb[8] = { 100, 133, 200, 166, 333, -1, -1, -1 }; msr_t msr; - int ret = -2; get_fms(&c, cpuid_eax(1)); switch (c.x86) { @@ -33,49 +32,61 @@ switch (c.x86_model) { case 0xe: /* Core Solo/Duo */ case 0x1c: /* Atom */ - ret = core_fsb[rdmsr(MSR_FSB_FREQ).lo & 7]; + *fsb = core_fsb[rdmsr(MSR_FSB_FREQ).lo & 7]; + *ratio = rdmsr(MSR_EBC_FREQUENCY_ID).lo >> 24; break; case 0xf: /* Core 2 or Xeon */ case 0x17: /* Enhanced Core */ - ret = core2_fsb[rdmsr(MSR_FSB_FREQ).lo & 7]; + *fsb = core2_fsb[rdmsr(MSR_FSB_FREQ).lo & 7]; + *ratio = rdmsr(MSR_EBC_FREQUENCY_ID).lo >> 24; break; case 0x25: /* Nehalem BCLK fixed at 133MHz */ - ret = 133; + *fsb = 133; + *ratio = (rdmsr(MSR_PLATFORM_INFO).lo >> 8) & 0xff; break; case 0x2a: /* SandyBridge BCLK fixed at 100MHz */ case 0x3a: /* IvyBridge BCLK fixed at 100MHz */ case 0x3c: /* Haswell BCLK fixed at 100MHz */ case 0x45: /* Haswell-ULT BCLK fixed at 100MHz */ - ret = 100; + *fsb = 100; + *ratio = (rdmsr(MSR_PLATFORM_INFO).lo >> 8) & 0xff; break; } break; case 0xf: /* Netburst */ msr = rdmsr(MSR_EBC_FREQUENCY_ID); + *ratio = msr.lo >> 24; switch (c.x86_model) { case 0x2: - ret = f2x_fsb[(msr.lo >> 16) & 7]; + *fsb = f2x_fsb[(msr.lo >> 16) & 7]; break; case 0x3: case 0x4: case 0x6: - ret = core2_fsb[(msr.lo >> 16) & 7]; + *fsb = core2_fsb[(msr.lo >> 16) & 7]; break; } + default: + return -2; } - return ret; + if (*fsb > 0) + return 0; + return -1; } int get_ia32_fsb(void) { - int ret; + int ret, fsb, ratio; - ret = get_fsb(); + ret = get_fsb_tsc(&fsb, &ratio); if (ret == -1) printk(BIOS_ERR, "FSB not found\n"); if (ret == -2) printk(BIOS_ERR, "CPU not supported\n"); - return ret; + if (ret < 0) + return ret; + + return fsb; } /** -- To view, visit https://review.coreboot.org/c/coreboot/+/31340 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ib7f1815b3fac7a610f7203720d526eac152a1648 Gerrit-Change-Number: 31340 Gerrit-PatchSet: 1 Gerrit-Owner: Kyösti Mälkki <kyosti.malkki(a)gmail.com> Gerrit-MessageType: newchange

5 17

Change in ...coreboot[master]: cpu/intel/common: Build FSB detection unconditionally
by Kyösti Mälkki (Code Review) 19 Sep '19

19 Sep '19

Kyösti Mälkki has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/31341 Change subject: cpu/intel/common: Build FSB detection unconditionally ...................................................................... cpu/intel/common: Build FSB detection unconditionally Change-Id: I37a34651d9e7d823ad5689d30739294358a97e31 Signed-off-by: Kyösti Mälkki <kyosti.malkki(a)gmail.com> --- M src/cpu/intel/common/Makefile.inc 1 file changed, 7 insertions(+), 4 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/41/31341/1 diff --git a/src/cpu/intel/common/Makefile.inc b/src/cpu/intel/common/Makefile.inc index b67ca85..ef6c0a4 100644 --- a/src/cpu/intel/common/Makefile.inc +++ b/src/cpu/intel/common/Makefile.inc @@ -1,5 +1,8 @@ ramstage-y += common_init.c -romstage-$(CONFIG_UDELAY_LAPIC) += fsb.c -ramstage-$(CONFIG_UDELAY_LAPIC) += fsb.c -postcar-$(CONFIG_UDELAY_LAPIC) += fsb.c -smm-$(CONFIG_HAVE_SMI_HANDLER) += fsb.c + +bootblock-y += fsb.c +verstage-y += fsb.c +romstage-y += fsb.c +postcar-y += fsb.c +ramstage-y += fsb.c +smm-y += fsb.c -- To view, visit https://review.coreboot.org/c/coreboot/+/31341 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I37a34651d9e7d823ad5689d30739294358a97e31 Gerrit-Change-Number: 31341 Gerrit-PatchSet: 1 Gerrit-Owner: Kyösti Mälkki <kyosti.malkki(a)gmail.com> Gerrit-MessageType: newchange

5 5

Change in ...coreboot[master]: cpu/intel/common: Use common tsc_freq_mhz()
by Kyösti Mälkki (Code Review) 18 Sep '19

18 Sep '19

Kyösti Mälkki has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/31342 Change subject: cpu/intel/common: Use common tsc_freq_mhz() ...................................................................... cpu/intel/common: Use common tsc_freq_mhz() Change-Id: I0e7159039751a88d86b6c343be5f085e6e15570a Signed-off-by: Kyösti Mälkki <kyosti.malkki(a)gmail.com> --- M src/cpu/intel/common/fsb.c M src/cpu/intel/haswell/Makefile.inc D src/cpu/intel/haswell/tsc_freq.c M src/cpu/intel/model_2065x/Makefile.inc D src/cpu/intel/model_2065x/tsc_freq.c M src/cpu/intel/model_206ax/Makefile.inc D src/cpu/intel/model_206ax/tsc_freq.c 7 files changed, 12 insertions(+), 90 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/42/31342/1 diff --git a/src/cpu/intel/common/fsb.c b/src/cpu/intel/common/fsb.c index d06739c..f53baa0 100644 --- a/src/cpu/intel/common/fsb.c +++ b/src/cpu/intel/common/fsb.c @@ -13,6 +13,7 @@ #include <cpu/cpu.h> #include <cpu/x86/msr.h> +#include <cpu/x86/tsc.h> #include <cpu/intel/speedstep.h> #include <cpu/intel/fsb.h> #include <console/console.h> @@ -105,3 +106,14 @@ printk(BIOS_ERR, "FSB not supported or not found\n"); return -1; } + +unsigned long tsc_freq_mhz(void) +{ + int ret, fsb, ratio; + + ret = get_fsb_tsc(&fsb, &ratio); + if (ret < 0) + die("TSC frequency not known\n"); + + return 100 * DIV_ROUND_CLOSEST(ratio * fsb, 100); +} diff --git a/src/cpu/intel/haswell/Makefile.inc b/src/cpu/intel/haswell/Makefile.inc index c317c09..87da59b 100644 --- a/src/cpu/intel/haswell/Makefile.inc +++ b/src/cpu/intel/haswell/Makefile.inc @@ -1,7 +1,5 @@ ramstage-y += haswell_init.c -ramstage-y += tsc_freq.c romstage-y += romstage.c -romstage-y += tsc_freq.c romstage-y += ../car/romstage.c ramstage-y += acpi.c @@ -12,7 +10,6 @@ postcar-$(CONFIG_CACHE_RELOCATED_RAMSTAGE_OUTSIDE_CBMEM) += stage_cache.c smm-$(CONFIG_HAVE_SMI_HANDLER) += finalize.c -smm-$(CONFIG_HAVE_SMI_HANDLER) += tsc_freq.c ifneq ($(CONFIG_TSC_MONOTONIC_TIMER),y) ramstage-y += monotonic_timer.c diff --git a/src/cpu/intel/haswell/tsc_freq.c b/src/cpu/intel/haswell/tsc_freq.c deleted file mode 100644 index b05cae5..0000000 --- a/src/cpu/intel/haswell/tsc_freq.c +++ /dev/null @@ -1,27 +0,0 @@ -/* - * This file is part of the coreboot project. - * - * Copyright (C) 2013 Google, Inc. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; version 2 of the License. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - */ - -#include <stdint.h> -#include <cpu/x86/msr.h> -#include <cpu/x86/tsc.h> -#include "cpu/intel/haswell/haswell.h" - -unsigned long tsc_freq_mhz(void) -{ - msr_t platform_info; - - platform_info = rdmsr(MSR_PLATFORM_INFO); - return HASWELL_BCLK * ((platform_info.lo >> 8) & 0xff); -} diff --git a/src/cpu/intel/model_2065x/Makefile.inc b/src/cpu/intel/model_2065x/Makefile.inc index ec8643a..b8e474d 100644 --- a/src/cpu/intel/model_2065x/Makefile.inc +++ b/src/cpu/intel/model_2065x/Makefile.inc @@ -10,9 +10,6 @@ subdirs-y += ../smm/gen1 subdirs-y += ../common -ramstage-y += tsc_freq.c -romstage-y += tsc_freq.c -smm-$(CONFIG_HAVE_SMI_HANDLER) += tsc_freq.c ramstage-y += acpi.c diff --git a/src/cpu/intel/model_2065x/tsc_freq.c b/src/cpu/intel/model_2065x/tsc_freq.c deleted file mode 100644 index 041785b..0000000 --- a/src/cpu/intel/model_2065x/tsc_freq.c +++ /dev/null @@ -1,27 +0,0 @@ -/* - * This file is part of the coreboot project. - * - * Copyright (C) 2013 Google, Inc. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; version 2 of the License. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - */ - -#include <stdint.h> -#include <cpu/x86/msr.h> -#include <cpu/x86/tsc.h> -#include "model_2065x.h" - -unsigned long tsc_freq_mhz(void) -{ - msr_t platform_info; - - platform_info = rdmsr(MSR_PLATFORM_INFO); - return NEHALEM_BCLK * ((platform_info.lo >> 8) & 0xff); -} diff --git a/src/cpu/intel/model_206ax/Makefile.inc b/src/cpu/intel/model_206ax/Makefile.inc index d193e60..6339ba0 100644 --- a/src/cpu/intel/model_206ax/Makefile.inc +++ b/src/cpu/intel/model_206ax/Makefile.inc @@ -17,9 +17,6 @@ romstage-y += common.c smm-$(CONFIG_HAVE_SMI_HANDLER) += common.c -ramstage-y += tsc_freq.c -romstage-y += tsc_freq.c -smm-$(CONFIG_HAVE_SMI_HANDLER) += tsc_freq.c smm-$(CONFIG_HAVE_SMI_HANDLER) += finalize.c diff --git a/src/cpu/intel/model_206ax/tsc_freq.c b/src/cpu/intel/model_206ax/tsc_freq.c deleted file mode 100644 index 545ca5f..0000000 --- a/src/cpu/intel/model_206ax/tsc_freq.c +++ /dev/null @@ -1,27 +0,0 @@ -/* - * This file is part of the coreboot project. - * - * Copyright (C) 2013 Google, Inc. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; version 2 of the License. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - */ - -#include <stdint.h> -#include <cpu/x86/msr.h> -#include <cpu/x86/tsc.h> -#include "model_206ax.h" - -unsigned long tsc_freq_mhz(void) -{ - msr_t platform_info; - - platform_info = rdmsr(MSR_PLATFORM_INFO); - return SANDYBRIDGE_BCLK * ((platform_info.lo >> 8) & 0xff); -} -- To view, visit https://review.coreboot.org/c/coreboot/+/31342 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I0e7159039751a88d86b6c343be5f085e6e15570a Gerrit-Change-Number: 31342 Gerrit-PatchSet: 1 Gerrit-Owner: Kyösti Mälkki <kyosti.malkki(a)gmail.com> Gerrit-MessageType: newchange

3 7

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

coreboot-gerrit March 2019