Attention is currently required from: Jason Glenesk, Raul Rangel, Marshall Dawson, Rob Barnes, Felix Held.
Nico Huber has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/60024 )
Change subject: mb/google/guybrush: Add PSP_S0I3_RESUME_VERSTAGE Kconfig option
......................................................................
Patch Set 2:
(1 comment)
Patchset:
PS2:
> bootblock is not running during s0i3 resume, just verstage.
I meant generally we wouldn't do such init in verstage because the
bootblock would run first (generally in coreboot, i.e. not AMD Zen).
>
> On AMD, S0i3 is only entered after explicit request from Kernel. The kernel needs to send a shutdown command to the TPM before reset is asserted so the TPM state can be preserved and restored.
Quite interesting. I had a quick look at the TPM spec and, OMG, they
really like to make things look creepy. Now I wonder how it's ensured
that the PCR values are _not_ restored on a normal boot. But that's
nothing I intended to bug you with.
Thanks for the answers :)
--
To view, visit https://review.coreboot.org/c/coreboot/+/60024
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I2c185f787c1e77bd09f6cbbb1f47deb665ed0c79
Gerrit-Change-Number: 60024
Gerrit-PatchSet: 2
Gerrit-Owner: Rob Barnes <robbarnes(a)google.com>
Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de>
Gerrit-Reviewer: Jason Glenesk <jason.glenesk(a)gmail.com>
Gerrit-Reviewer: Marshall Dawson <marshalldawson3rd(a)gmail.com>
Gerrit-Reviewer: Raul Rangel <rrangel(a)chromium.org>
Gerrit-CC: Nico Huber <nico.h(a)gmx.de>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-CC: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Jason Glenesk <jason.glenesk(a)gmail.com>
Gerrit-Attention: Raul Rangel <rrangel(a)chromium.org>
Gerrit-Attention: Marshall Dawson <marshalldawson3rd(a)gmail.com>
Gerrit-Attention: Rob Barnes <robbarnes(a)google.com>
Gerrit-Attention: Felix Held <felix-coreboot(a)felixheld.de>
Gerrit-Comment-Date: Mon, 13 Dec 2021 15:28:03 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Nico Huber <nico.h(a)gmx.de>
Comment-In-Reply-To: Rob Barnes <robbarnes(a)google.com>
Gerrit-MessageType: comment
Attention is currently required from: Erik van den Bogaert, Felix Singer, Michał Żygowski, Paul Menzel, Julius Werner, Arthur Heymans, Wim Vervoorn.
Frans Hendriks has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/52025 )
Change subject: vc/eltan/security/verified_boot/vboot_check.c: Add cbfs_map_compressed()
......................................................................
Patch Set 4:
(1 comment)
Commit Message:
https://review.coreboot.org/c/coreboot/+/52025/comment/7652bce3_e18cc103
PS3, Line 9: CB:49334
> Additionally, please add the git commit hash and summary.
Done
--
To view, visit https://review.coreboot.org/c/coreboot/+/52025
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Idc799f49ee198100deab1ecf66336831d9aed415
Gerrit-Change-Number: 52025
Gerrit-PatchSet: 4
Gerrit-Owner: Frans Hendriks <fhendriks(a)eltan.com>
Gerrit-Reviewer: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Erik van den Bogaert <ebogaert(a)eltan.com>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-Reviewer: Wim Vervoorn <wvervoorn(a)eltan.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Erik van den Bogaert <ebogaert(a)eltan.com>
Gerrit-Attention: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Julius Werner <jwerner(a)chromium.org>
Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Attention: Wim Vervoorn <wvervoorn(a)eltan.com>
Gerrit-Comment-Date: Mon, 13 Dec 2021 14:33:38 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-MessageType: comment
Attention is currently required from: Felix Singer, Michał Żygowski, Frans Hendriks, Julius Werner, Arthur Heymans, Wim Vervoorn.
Hello Felix Singer, build bot (Jenkins), Michał Żygowski, Julius Werner, Angel Pons, Arthur Heymans, Wim Vervoorn,
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/52025
to look at the new patch set (#4).
Change subject: vc/eltan/security/verified_boot/vboot_check.c: Add cbfs_map_compressed()
......................................................................
vc/eltan/security/verified_boot/vboot_check.c: Add cbfs_map_compressed()
CB:49334 (commit:7778cf2 Add cbfs_alloc() primitive and combine
cbfs_load() and cbfs_map()) removes possibility to use cbfs_map() for
retrieving CBFS map info of compressed files.
cbfs_map() will return a NULL pointer for compressed files.
The mapping and size of compressed items are used for verification and
measuring.
Add cbfs_map_compressed() to return mapping and compressed size
of files.
BUG = N/A
TEST = Boot Facebook FBG1701
Signed-off-by: Frans Hendriks <fhendriks(a)eltan.com>
Change-Id: Idc799f49ee198100deab1ecf66336831d9aed415
---
M src/vendorcode/eltan/security/verified_boot/vboot_check.c
1 file changed, 16 insertions(+), 1 deletion(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/25/52025/4
--
To view, visit https://review.coreboot.org/c/coreboot/+/52025
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Idc799f49ee198100deab1ecf66336831d9aed415
Gerrit-Change-Number: 52025
Gerrit-PatchSet: 4
Gerrit-Owner: Frans Hendriks <fhendriks(a)eltan.com>
Gerrit-Reviewer: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-Reviewer: Wim Vervoorn <wvervoorn(a)eltan.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-Attention: Frans Hendriks <fhendriks(a)eltan.com>
Gerrit-Attention: Julius Werner <jwerner(a)chromium.org>
Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Attention: Wim Vervoorn <wvervoorn(a)eltan.com>
Gerrit-MessageType: newpatchset
Felix Held has submitted this change. ( https://review.coreboot.org/c/coreboot/+/59982 )
Change subject: cbfs: Enable CBFS verification Kconfigs
......................................................................
cbfs: Enable CBFS verification Kconfigs
With the elimination of remaining non-verifying CBFS APIs in CB:59682,
CBFS verification is now ready to be used in its simplest form, so
enable the respective Kconfig options in menuconfig. Add a few more
restrictions to the TOCTOU_SAFETY option for problems that haven't been
solved yet, and transform a comment in cbfs.c into a die() to make sure
we don't accidentally forget implementing it once vboot integration gets
added.
Signed-off-by: Julius Werner <jwerner(a)chromium.org>
Change-Id: Ifeba5c962c943856ab79bc6c4cb90a60c1de4a60
Reviewed-on: https://review.coreboot.org/c/coreboot/+/59982
Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org>
Reviewed-by: Jakub Czapiga <jacz(a)semihalf.com>
---
M src/lib/Kconfig.cbfs_verification
M src/lib/cbfs.c
2 files changed, 33 insertions(+), 19 deletions(-)
Approvals:
build bot (Jenkins): Verified
Jakub Czapiga: Looks good to me, approved
diff --git a/src/lib/Kconfig.cbfs_verification b/src/lib/Kconfig.cbfs_verification
index fa90d9d..33e5458 100644
--- a/src/lib/Kconfig.cbfs_verification
+++ b/src/lib/Kconfig.cbfs_verification
@@ -2,33 +2,41 @@
#
# This file is sourced from src/security/Kconfig for menuconfig convenience.
-#menu "CBFS verification" # TODO: enable once it works
+menu "CBFS verification"
config CBFS_VERIFICATION
- bool # TODO: make user selectable once it works
+ bool "Enable CBFS verification"
depends on !VBOOT_STARTS_BEFORE_BOOTBLOCK # this is gonna get tricky...
select VBOOT_LIB
help
- Work in progress. Do not use (yet).
+ Say yes here to enable code that cryptographically verifies each CBFS
+ file as it gets loaded by chaining it to a trust anchor that is
+ embedded in the bootblock. This only makes sense if you use some
+ out-of-band mechanism to guarantee the integrity of the bootblock
+ itself, such as Intel BootGuard or flash write-protection.
+
+ If a CBFS image was created with this option enabled, cbfstool will
+ automatically update the hash embedded in the bootblock whenever it
+ modifies the CBFS.
+
+if CBFS_VERIFICATION
config TOCTOU_SAFETY
- bool
- depends on CBFS_VERIFICATION
+ bool "Protect against time-of-check vs. time-of-use vulnerabilities"
depends on !NO_FMAP_CACHE
depends on !NO_CBFS_MCACHE
depends on !USE_OPTION_TABLE && !FSP_CAR # Known to access CBFS before CBMEM init
+ depends on !VBOOT # TODO: can only allow this once vboot fully integrated
+ depends on NO_XIP_EARLY_STAGES
help
- Work in progress. Not actually TOCTOU safe yet. Do not use.
+ Say yes here to eliminate time-of-check vs. time-of-use vulnerabilities
+ for CBFS verification. This means that data from flash must be verified
+ every time it is loaded (not just the first time), which requires a bit
+ more overhead and is incompatible with certain configurations.
- Design idea here is that mcache overflows in this mode are only legal
- for the RW CBFS, because it's relatively easy to retrieve the RW
- metadata hash from persistent vboot context at any time, but the RO
- metadata hash is lost after the bootblock is unloaded. This avoids the
- need to carry yet another piece forward through the stages. Mcache
- overflows are mostly a concern for RW updates (if an update adds more
- files than originally planned for), for the RO section it should
- always be possible to dimension the mcache correctly beforehand, so
- this should be an acceptable limitation.
+ Using this option only makes sense when the mechanism securing the
+ bootblock is also safe against these vulnerabilities (i.e. there's no
+ point in enabling this when you just rely on flash write-protection).
config CBFS_HASH_ALGO
int
@@ -37,9 +45,13 @@
default 3 if CBFS_HASH_SHA512
choice
- prompt "--> hash type"
- depends on CBFS_VERIFICATION
+ prompt "Hash algorithm"
default CBFS_HASH_SHA256
+ help
+ Select the hash algorithm used in CBFS verification. Note that SHA-1 is
+ generally considered insecure today and should not be used without good
+ reason. When using CBFS verification together with measured boot, using
+ the same hash algorithm (usually SHA-256) for both is more efficient.
config CBFS_HASH_SHA1
bool "SHA-1"
@@ -52,4 +64,6 @@
endchoice
-#endmenu
+endif
+
+endmenu
diff --git a/src/lib/cbfs.c b/src/lib/cbfs.c
index 991c9fe..3a044f7 100644
--- a/src/lib/cbfs.c
+++ b/src/lib/cbfs.c
@@ -57,7 +57,7 @@
RO CBFS would have been caught when building the mcache in cbfs_get
boot_device(). (Note that TOCTOU_SAFETY implies !NO_CBFS_MCACHE.) */
assert(cbd == vboot_get_cbfs_boot_device());
- /* TODO: set metadata_hash to RW metadata hash here. */
+ die("TODO: set metadata_hash to RW metadata hash here.\n");
}
err = cbfs_lookup(&cbd->rdev, name, mdata, &data_offset, metadata_hash);
}
--
To view, visit https://review.coreboot.org/c/coreboot/+/59982
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ifeba5c962c943856ab79bc6c4cb90a60c1de4a60
Gerrit-Change-Number: 59982
Gerrit-PatchSet: 2
Gerrit-Owner: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de>
Gerrit-Reviewer: Jakub Czapiga <jacz(a)semihalf.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-MessageType: merged
Felix Held has submitted this change. ( https://review.coreboot.org/c/coreboot/+/60018 )
Change subject: cbfstool: Do host space address conversion earlier when adding files
......................................................................
cbfstool: Do host space address conversion earlier when adding files
In cbfs_add_component(), the |offset| variable confusingly jumps back
and forth between host address space and flash address space in some
cases. This patch tries to clean that logic up a bit by converting it
to flash address space very early in the function, and then keeping it
that way afterwards. convert() implementations that need the host
address space value should store it in a different variable to reduce
the risk of confusion. This should also fix a tiny issue where
--gen-attribute might have previously encoded the base address as given
in CBFS -- it probably makes more sense to always have it store a
consistent format (i.e. always flash address).
Also revert the unnecessary check for --base-address in
add_topswap_bootblock() that was added in CB:59877. On closer
inspection, the function actually doesn't use the passed in *offset at
all and uses it purely as an out-parameter. So while our current
Makefile does pass --base-address when adding the bootblock, it actually
has no effect and is redundant for the topswap case.
Signed-off-by: Julius Werner <jwerner(a)chromium.org>
Change-Id: Idf4721c5b0700789ddb81c1618d740b3e7f486cb
Reviewed-on: https://review.coreboot.org/c/coreboot/+/60018
Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org>
Reviewed-by: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
Reviewed-by: Raul Rangel <rrangel(a)chromium.org>
Reviewed-by: Paul Menzel <paulepanter(a)mailbox.org>
---
M util/cbfstool/cbfstool.c
1 file changed, 16 insertions(+), 24 deletions(-)
Approvals:
build bot (Jenkins): Verified
Paul Menzel: Looks good to me, but someone else must approve
Raul Rangel: Looks good to me, approved
Tim Wawrzynczak: Looks good to me, approved
diff --git a/util/cbfstool/cbfstool.c b/util/cbfstool/cbfstool.c
index 87dcbb4..77460d1 100644
--- a/util/cbfstool/cbfstool.c
+++ b/util/cbfstool/cbfstool.c
@@ -779,11 +779,6 @@
{
size_t bb_buf_size = buffer_size(buffer);
- if (!param.baseaddress_assigned) {
- ERROR("--topswap-size must also have --base-address\n");
- return 1;
- }
-
if (bb_buf_size > param.topswap_size) {
ERROR("Bootblock bigger than the topswap boundary\n");
ERROR("size = %zd, ts = %d\n", bb_buf_size,
@@ -826,7 +821,9 @@
/*
* The steps used to determine the final placement offset in CBFS, in order:
*
- * 1. If --base-address was passed, that value is used.
+ * 1. If --base-address was passed, that value is used. If it was passed in the host
+ * address space, convert it to flash address space. (After that, |*offset| is always
+ * in the flash address space.)
*
* 2. The convert() function may write a location back to |offset|, usually by calling
* do_cbfs_locate(). In this case, it needs to ensure that the location found can fit
@@ -909,6 +906,10 @@
if (add_topswap_bootblock(&buffer, &offset))
goto error;
+ /* With --base-address we allow host space addresses -- if so, convert it here. */
+ if (IS_HOST_SPACE_ADDRESS(offset))
+ offset = convert_addr_space(param.image_region, offset);
+
if (convert && convert(&buffer, &offset, header) != 0) {
ERROR("Failed to parse file '%s'.\n", filename);
goto error;
@@ -975,9 +976,6 @@
goto error;
}
- if (IS_HOST_SPACE_ADDRESS(offset))
- offset = convert_addr_space(param.image_region, offset);
-
if (cbfs_add_entry(&image, &buffer, offset, header, len_align) != 0) {
ERROR("Failed to add '%s' into ROM image.\n", filename);
goto error;
@@ -1060,10 +1058,12 @@
* There are 4 different cases here:
*
* 1. --xip and --base-address: we need to place the binary at the given base address
- * in the CBFS image and relocate it to that address. *offset was already filled in.
+ * in the CBFS image and relocate it to that address. *offset was already filled in,
+ * but we need to convert it to the host address space for relocation.
*
* 2. --xip but no --base-address: we implicitly force a 4K minimum alignment so that
* relocation can occur. Call do_cbfs_locate() here to find an appropriate *offset.
+ * This also needs to be converted to the host address space for relocation.
*
* 3. No --xip but a --base-address: special case where --base-address does not have its
* normal meaning, instead we use it as the relocation target address. We explicitly
@@ -1079,10 +1079,8 @@
if (do_cbfs_locate(offset, 0))
return -1;
}
- if (!IS_HOST_SPACE_ADDRESS(*offset))
- address = convert_addr_space(param.image_region, *offset);
- else
- address = *offset;
+ assert(!IS_HOST_SPACE_ADDRESS(*offset));
+ address = convert_addr_space(param.image_region, *offset);
} else {
if (param.baseaddress_assigned == 0) {
INFO("Honoring pre-linked FSP module, no relocation.\n");
@@ -1143,16 +1141,10 @@
return -1;
if (param.stage_xip) {
- /*
- * Ensure the address is a memory mapped one. This assumes
- * x86 semantics about the boot media being directly mapped
- * below 4GiB in the CPU address space.
- **/
- *offset = convert_addr_space(param.image_region, *offset);
-
- ret = parse_elf_to_xip_stage(buffer, &output, *offset,
- param.ignore_section,
- stageheader);
+ uint32_t host_space_address = convert_addr_space(param.image_region, *offset);
+ assert(IS_HOST_SPACE_ADDRESS(host_space_address));
+ ret = parse_elf_to_xip_stage(buffer, &output, host_space_address,
+ param.ignore_section, stageheader);
} else {
ret = parse_elf_to_stage(buffer, &output, param.ignore_section,
stageheader);
--
To view, visit https://review.coreboot.org/c/coreboot/+/60018
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Idf4721c5b0700789ddb81c1618d740b3e7f486cb
Gerrit-Change-Number: 60018
Gerrit-PatchSet: 5
Gerrit-Owner: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de>
Gerrit-Reviewer: Patrick Georgi <patrick(a)coreboot.org>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Reviewer: Raul Rangel <rrangel(a)chromium.org>
Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-MessageType: merged