December 2021 - coreboot-gerrit

Change in coreboot[master]: mb/var/gimble: Set PsysPmax to 143 W
by Tim Wawrzynczak (Code Review) Dec. 3, 2021

Dec. 3, 2021

Attention is currently required from: Chia-Ling Hou, Paul Menzel. Tim Wawrzynczak has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59797 ) Change subject: mb/var/gimble: Set PsysPmax to 143 W ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://review.coreboot.org/c/coreboot/+/59797 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Id6a203f05ecfcc1020a422850d35fa3fa64e01d0 Gerrit-Change-Number: 59797 Gerrit-PatchSet: 2 Gerrit-Owner: Chia-Ling Hou <chia-ling.hou(a)intel.corp-partner.google.com> Gerrit-Reviewer: Ryan Lin <ryan.lin(a)intel.com> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Anfernee Chen <anfernee_chen(a)wistron.corp-partner.google.com> Gerrit-CC: Mark Hsieh <mark_hsieh(a)wistron.corp-partner.google.com> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Chia-Ling Hou <chia-ling.hou(a)intel.corp-partner.google.com> Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Comment-Date: Fri, 03 Dec 2021 21:29:12 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

Change in coreboot[master]: [WIP] drivers/intel/fsp2_0: Add support for FSP_NON_VOLATILE_STORAGE_...
by Tim Wawrzynczak (Code Review) Dec. 3, 2021

Dec. 3, 2021

Attention is currently required from: Anil Kumar K, Paul Menzel, Andrey Petrov, Patrick Rudolph. Tim Wawrzynczak has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59638 ) Change subject: [WIP] drivers/intel/fsp2_0: Add support for FSP_NON_VOLATILE_STORAGE_HOB2 ...................................................................... Patch Set 17: (1 comment) File src/drivers/intel/fsp2_0/hand_off_block.c: https://review.coreboot.org/c/coreboot/+/59638/comment/3c81995b_ff5bd49c PS17, Line 326: } BTW, this won't compile right now if you enable the Kconfig, because in this path, if hob_walker.hob is NULL, then it doesn't have a return path. -- To view, visit https://review.coreboot.org/c/coreboot/+/59638 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I27647e9ac1a4902256b3f1c34b60e1f0b787a06e Gerrit-Change-Number: 59638 Gerrit-PatchSet: 17 Gerrit-Owner: Anil Kumar K <anil.kumar.k(a)intel.com> Gerrit-Reviewer: Andrey Petrov <andrey.petrov(a)gmail.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: Subrata Banik <subrata.banik(a)intel.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Bora Guvendik <bora.guvendik(a)intel.com> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-CC: Selma Bensaid <selma.bensaid(a)intel.com> Gerrit-CC: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Attention: Anil Kumar K <anil.kumar.k(a)intel.com> Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Andrey Petrov <andrey.petrov(a)gmail.com> Gerrit-Attention: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Comment-Date: Fri, 03 Dec 2021 21:28:53 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

Change in coreboot[master]: [WIP] drivers/intel/fsp2_0: Add support for FSP_NON_VOLATILE_STORAGE_...
by Tim Wawrzynczak (Code Review) Dec. 3, 2021

Dec. 3, 2021

Attention is currently required from: Anil Kumar K, Paul Menzel, Andrey Petrov, Patrick Rudolph. Tim Wawrzynczak has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59638 ) Change subject: [WIP] drivers/intel/fsp2_0: Add support for FSP_NON_VOLATILE_STORAGE_HOB2 ...................................................................... Patch Set 17: (1 comment) File src/drivers/intel/fsp2_0/hand_off_block.c: https://review.coreboot.org/c/coreboot/+/59638/comment/0d9d5817_71d1839b PS17, Line 316: if (CONFIG(PLATFORM_USES_FSP2_3)) { : union { : const struct fsp_nvs_hob2_data_region_header *hob; : const void *hob_descr; : } hob_walker; : hob_walker.hob = (const struct fsp_nvs_hob2_data_region_header *) : fsp_find_extension_hob_by_guid(fsp_nv_storage_guid_2, size); : if (hob_walker.hob != NULL) { : *size = hob_walker.hob->nvs_data_length; : return hob_walker.hob_descr; : } : } else { : return fsp_find_extension_hob_by_guid(fsp_nv_storage_guid, size); : } I might return early just to avoid an extra indent, e.g.: ``` if (!CONFIG(PLATFORM_USES_FSP2_3)) return fsp_find_extension_hob_by_guid(fsp_nv_storage_guid, size); union { const struct fsp_nvs_hob2_data_region_header *hob; const void *hob_descr; } hob_walker; hob_walker.hob = (const struct fsp_nvs_hob2_data_region_header *) fsp_find_extension_hob_by_guid(fsp_nv_storage_guid_2, size); if (hob_walker.hob != NULL) { *size = hob_walker.hob->nvs_data_length; return hob_walker.hob_descr; } return NULL; ``` -- To view, visit https://review.coreboot.org/c/coreboot/+/59638 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I27647e9ac1a4902256b3f1c34b60e1f0b787a06e Gerrit-Change-Number: 59638 Gerrit-PatchSet: 17 Gerrit-Owner: Anil Kumar K <anil.kumar.k(a)intel.com> Gerrit-Reviewer: Andrey Petrov <andrey.petrov(a)gmail.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: Subrata Banik <subrata.banik(a)intel.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Bora Guvendik <bora.guvendik(a)intel.com> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-CC: Selma Bensaid <selma.bensaid(a)intel.com> Gerrit-CC: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Attention: Anil Kumar K <anil.kumar.k(a)intel.com> Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Andrey Petrov <andrey.petrov(a)gmail.com> Gerrit-Attention: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Comment-Date: Fri, 03 Dec 2021 21:28:21 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

Change in coreboot[master]: soc/intel/alderlake: Implement function to map physical port to EC port
by Tim Wawrzynczak (Code Review) Dec. 3, 2021

Dec. 3, 2021

Attention is currently required from: Maulik V Vaghela, Subrata Banik, Patrick Rudolph. Tim Wawrzynczak has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59666 ) Change subject: soc/intel/alderlake: Implement function to map physical port to EC port ...................................................................... Patch Set 12: Code-Review+1 (1 comment) File src/soc/intel/alderlake/retimer.c: https://review.coreboot.org/c/coreboot/+/59666/comment/d37a447d_14353142 PS12, Line 8: uint8_t so then maybe this should have a different return type -- To view, visit https://review.coreboot.org/c/coreboot/+/59666 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I3735b7c7794b46123aba3beac8c0268ce72d658c Gerrit-Change-Number: 59666 Gerrit-PatchSet: 12 Gerrit-Owner: Maulik V Vaghela <maulik.v.vaghela(a)intel.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: Subrata Banik <subrata.banik(a)intel.com> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Maulik V Vaghela <maulik.v.vaghela(a)intel.com> Gerrit-Attention: Subrata Banik <subrata.banik(a)intel.com> Gerrit-Attention: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Comment-Date: Fri, 03 Dec 2021 21:26:22 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

Change in coreboot[master]: soc/intel/alderlake: Implement function to map physical port to EC port
by Tim Wawrzynczak (Code Review) Dec. 3, 2021

Dec. 3, 2021

Attention is currently required from: Maulik V Vaghela, Subrata Banik, Patrick Rudolph. Tim Wawrzynczak has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59666 ) Change subject: soc/intel/alderlake: Implement function to map physical port to EC port ...................................................................... Patch Set 12: (1 comment) File src/soc/intel/alderlake/retimer.c: https://review.coreboot.org/c/coreboot/+/59666/comment/446678fb_3aca6607 PS9, Line 30: die("Couldn't find correct port mapping or Invalid input port\n"); I don't think we need to call die() here, returning some kind of error code is probably better (and then printing an error message at the caller). -- To view, visit https://review.coreboot.org/c/coreboot/+/59666 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I3735b7c7794b46123aba3beac8c0268ce72d658c Gerrit-Change-Number: 59666 Gerrit-PatchSet: 12 Gerrit-Owner: Maulik V Vaghela <maulik.v.vaghela(a)intel.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: Subrata Banik <subrata.banik(a)intel.com> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Maulik V Vaghela <maulik.v.vaghela(a)intel.com> Gerrit-Attention: Subrata Banik <subrata.banik(a)intel.com> Gerrit-Attention: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Comment-Date: Fri, 03 Dec 2021 21:25:43 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

Change in coreboot[master]: drivers/intel/usb4/retimer: Add function to correct EC port mapping
by Tim Wawrzynczak (Code Review) Dec. 3, 2021

Dec. 3, 2021

Attention is currently required from: Maulik V Vaghela, Sugnan Prabhu S, Subrata Banik, Patrick Rudolph. Tim Wawrzynczak has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59665 ) Change subject: drivers/intel/usb4/retimer: Add function to correct EC port mapping ...................................................................... Patch Set 8: Code-Review+2 -- To view, visit https://review.coreboot.org/c/coreboot/+/59665 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ia7a5e63838e6529196bd211516e4d665b084f79e Gerrit-Change-Number: 59665 Gerrit-PatchSet: 8 Gerrit-Owner: Maulik V Vaghela <maulik.v.vaghela(a)intel.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: Subrata Banik <subrata.banik(a)intel.com> Gerrit-Reviewer: Sugnan Prabhu S <sugnan.prabhu.s(a)intel.com> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Maulik V Vaghela <maulik.v.vaghela(a)intel.com> Gerrit-Attention: Sugnan Prabhu S <sugnan.prabhu.s(a)intel.com> Gerrit-Attention: Subrata Banik <subrata.banik(a)intel.com> Gerrit-Attention: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Comment-Date: Fri, 03 Dec 2021 21:25:22 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

Change in coreboot[master]: soc/intel/alderlake: Add support for ADL-N CPU Type
by Tim Wawrzynczak (Code Review) Dec. 3, 2021

Dec. 3, 2021

Attention is currently required from: Maulik V Vaghela, Paul Menzel, Reka Norman, Rizwan Qureshi, Subrata Banik, Sridhar Siricilla, Krishna P Bhat D, Usha P, Patrick Rudolph. Tim Wawrzynczak has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59836 ) Change subject: soc/intel/alderlake: Add support for ADL-N CPU Type ...................................................................... Patch Set 3: Code-Review+1 (1 comment) File src/soc/intel/alderlake/cpu.c: PS3: For another patch: do we still need this function? Or should we rely on the Kconfigs, e.g. SOC_INTEL_ALDERLAKE_PCH_M / PCH_N / PCH_M, etc. ? -- To view, visit https://review.coreboot.org/c/coreboot/+/59836 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: If2917ac356fd80f84bcaf70ed710d329e77f7a6d Gerrit-Change-Number: 59836 Gerrit-PatchSet: 3 Gerrit-Owner: Usha P <usha.p(a)intel.com> Gerrit-Reviewer: Kangheui Won <khwon(a)chromium.org> Gerrit-Reviewer: Krishna P Bhat D <krishna.p.bhat.d(a)intel.com> Gerrit-Reviewer: Maulik V Vaghela <maulik.v.vaghela(a)intel.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: Reka Norman <rekanorman(a)chromium.org> Gerrit-Reviewer: Rizwan Qureshi <rizwan.qureshi(a)intel.com> Gerrit-Reviewer: Sridhar Siricilla <sridhar.siricilla(a)intel.com> Gerrit-Reviewer: Subrata Banik <subrata.banik(a)intel.com> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Maulik V Vaghela <maulik.v.vaghela(a)intel.com> Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Reka Norman <rekanorman(a)chromium.org> Gerrit-Attention: Rizwan Qureshi <rizwan.qureshi(a)intel.com> Gerrit-Attention: Subrata Banik <subrata.banik(a)intel.com> Gerrit-Attention: Sridhar Siricilla <sridhar.siricilla(a)intel.com> Gerrit-Attention: Krishna P Bhat D <krishna.p.bhat.d(a)intel.com> Gerrit-Attention: Usha P <usha.p(a)intel.com> Gerrit-Attention: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Comment-Date: Fri, 03 Dec 2021 21:24:17 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

Change in coreboot[master]: cbfs | tspi: Join hash calculation for verification and measurement
by Felix Held (Code Review) Dec. 3, 2021

Dec. 3, 2021

Felix Held has submitted this change. ( https://review.coreboot.org/c/coreboot/+/59681 ) Change subject: cbfs | tspi: Join hash calculation for verification and measurement ...................................................................... cbfs | tspi: Join hash calculation for verification and measurement This patch moves the CBFS file measurement when CONFIG_TPM_MEASURED_BOOT is enabled from the lookup step into the code where a file is actually loaded or mapped from flash. This has the advantage that CBFS routines which just look up a file to inspect its metadata (e.g. cbfs_get_size()) do not cause the file to be measured twice. It also removes the existing inefficiency that files are loaded twice when measurement is enabled (once to measure and then again when they are used). When CBFS verification is enabled and uses the same hash algorithm as the TPM, we are even able to only hash the file a single time and use the result for both purposes. Signed-off-by: Julius Werner <jwerner(a)chromium.org> Change-Id: I70d7066c6768195077f083c7ffdfa30d9182b2b7 Reviewed-on: https://review.coreboot.org/c/coreboot/+/59681 Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> Reviewed-by: Raul Rangel <rrangel(a)chromium.org> --- M src/lib/cbfs.c M src/security/tpm/tspi.h M src/security/tpm/tspi/crtm.c M src/security/tpm/tspi/crtm.h M src/security/tpm/tspi/tspi.c 5 files changed, 59 insertions(+), 97 deletions(-) Approvals: build bot (Jenkins): Verified Raul Rangel: Looks good to me, approved diff --git a/src/lib/cbfs.c b/src/lib/cbfs.c index b4b6eb1..0b58913 100644 --- a/src/lib/cbfs.c +++ b/src/lib/cbfs.c @@ -81,10 +81,6 @@ if (rdev_chain(rdev, &cbd->rdev, data_offset, be32toh(mdata->h.len))) return CB_ERR; - if (tspi_measure_cbfs_hook(rdev, name, be32toh(mdata->h.type))) { - printk(BIOS_ERR, "CBFS ERROR: error when measuring '%s'\n", name); - } - return CB_SUCCESS; } @@ -134,9 +130,8 @@ type = &dummy_type; ret = cbfs_locate(fh, &rdev, name, type); - if (!ret) - if (tspi_measure_cbfs_hook(&rdev, name, *type)) - LOG("error measuring %s in region %s\n", name, region_name); + /* No more measuring here, this function will be removed next patch. */ + return ret; } @@ -193,19 +188,36 @@ static bool cbfs_file_hash_mismatch(const void *buffer, size_t size, const union cbfs_mdata *mdata, bool skip_verification) { - /* Avoid linking hash functions when verification is disabled. */ - if (!CONFIG(CBFS_VERIFICATION) || skip_verification) + /* Avoid linking hash functions when verification and measurement are disabled. */ + if (!CONFIG(CBFS_VERIFICATION) && !CONFIG(TPM_MEASURED_BOOT)) return false; - const struct vb2_hash *hash = cbfs_file_hash(mdata); - if (!hash) { - ERROR("'%s' does not have a file hash!\n", mdata->h.filename); - return true; + const struct vb2_hash *hash = NULL; + + if (CONFIG(CBFS_VERIFICATION) && !skip_verification) { + hash = cbfs_file_hash(mdata); + if (!hash) { + ERROR("'%s' does not have a file hash!\n", mdata->h.filename); + return true; + } + if (vb2_hash_verify(buffer, size, hash) != VB2_SUCCESS) { + ERROR("'%s' file hash mismatch!\n", mdata->h.filename); + return true; + } } - if (vb2_hash_verify(buffer, size, hash) != VB2_SUCCESS) { - ERROR("'%s' file hash mismatch!\n", mdata->h.filename); - return true; + if (CONFIG(TPM_MEASURED_BOOT) && !ENV_SMM) { + struct vb2_hash calculated_hash; + + /* No need to re-hash file if we already have it from verification. */ + if (!hash || hash->algo != TPM_MEASURE_ALGO) { + vb2_hash_calculate(buffer, size, TPM_MEASURE_ALGO, &calculated_hash); + hash = &calculated_hash; + } + + if (tspi_cbfs_measurement(mdata->h.filename, be32toh(mdata->h.type), hash)) + ERROR("failed to measure '%s' into TCPA log\n", mdata->h.filename); + /* We intentionally continue to boot on measurement errors. */ } return false; @@ -528,9 +540,6 @@ if (rdev_chain(&file_rdev, &area_rdev, data_offset, be32toh(mdata.h.len))) return NULL; - if (tspi_measure_cbfs_hook(&file_rdev, name, be32toh(mdata.h.type))) - ERROR("error measuring '%s' in '%s'\n", name, area); - return do_alloc(&mdata, &file_rdev, allocator, arg, size_out, true); } diff --git a/src/security/tpm/tspi.h b/src/security/tpm/tspi.h index ed642c3..7157b4d 100644 --- a/src/security/tpm/tspi.h +++ b/src/security/tpm/tspi.h @@ -51,7 +51,7 @@ * @return TPM_SUCCESS on success. If not a tpm error is returned */ uint32_t tpm_extend_pcr(int pcr, enum vb2_hash_algorithm digest_algo, - uint8_t *digest, size_t digest_len, + const uint8_t *digest, size_t digest_len, const char *name); /** diff --git a/src/security/tpm/tspi/crtm.c b/src/security/tpm/tspi/crtm.c index b64bbbf..8cd0793 100644 --- a/src/security/tpm/tspi/crtm.c +++ b/src/security/tpm/tspi/crtm.c @@ -6,37 +6,6 @@ #include "crtm.h" #include <string.h> -/* - * This function sets the TCPA log namespace - * for the cbfs file (region) lookup. - */ -static int create_tcpa_metadata(const struct region_device *rdev, - const char *cbfs_name, char log_string[TCPA_PCR_HASH_NAME]) -{ - int i; - struct region_device fmap; - static const char *const fmap_cbfs_names[] = { - "COREBOOT", - "FW_MAIN_A", - "FW_MAIN_B", - "RW_LEGACY" - }; - - for (i = 0; i < ARRAY_SIZE(fmap_cbfs_names); i++) { - if (fmap_locate_area_as_rdev(fmap_cbfs_names[i], &fmap) == 0) { - if (region_is_subregion(region_device_region(&fmap), - region_device_region(rdev))) { - snprintf(log_string, TCPA_PCR_HASH_NAME, - "FMAP: %s CBFS: %s", - fmap_cbfs_names[i], cbfs_name); - return 0; - } - } - } - - return -1; -} - static int tcpa_log_initialized; static inline int tcpa_log_available(void) { @@ -64,8 +33,6 @@ */ static uint32_t tspi_init_crtm(void) { - struct prog bootblock = PROG_INIT(PROG_BOOTBLOCK, "bootblock"); - /* Initialize TCPA PRERAM log. */ if (!tcpa_log_available()) { tcpa_preram_log_clear(); @@ -87,7 +54,6 @@ } /* measure bootblock from RO */ - struct cbfsf bootblock_data; struct region_device bootblock_fmap; if (fmap_locate_area_as_rdev("BOOTBLOCK", &bootblock_fmap) == 0) { if (tpm_measure_region(&bootblock_fmap, @@ -95,16 +61,16 @@ "FMAP: BOOTBLOCK")) return VB2_ERROR_UNKNOWN; } else { - if (cbfs_boot_locate(&bootblock_data, - prog_name(&bootblock), NULL)) { - /* - * measurement is done in - * tspi_measure_cbfs_hook() - */ + /* Mapping measures the file. We know we can safely map here because + bootblock-as-a-file is only used on x86, where we don't need cache to map. */ + enum cbfs_type type = CBFS_TYPE_BOOTBLOCK; + void *mapping = cbfs_ro_type_map("bootblock", NULL, &type); + if (!mapping) { printk(BIOS_INFO, "TSPI: Couldn't measure bootblock into CRTM!\n"); return VB2_ERROR_UNKNOWN; } + cbfs_unmap(mapping); } return VB2_SUCCESS; @@ -129,8 +95,7 @@ return !strcmp(allowlist, name); } -uint32_t tspi_measure_cbfs_hook(const struct region_device *rdev, const char *name, - uint32_t cbfs_type) +uint32_t tspi_cbfs_measurement(const char *name, uint32_t type, const struct vb2_hash *hash) { uint32_t pcr_index; char tcpa_metadata[TCPA_PCR_HASH_NAME]; @@ -144,7 +109,7 @@ printk(BIOS_DEBUG, "CRTM initialized.\n"); } - switch (cbfs_type) { + switch (type) { case CBFS_TYPE_MRC_CACHE: pcr_index = TPM_RUNTIME_DATA_PCR; break; @@ -166,10 +131,10 @@ break; } - if (create_tcpa_metadata(rdev, name, tcpa_metadata) < 0) - return VB2_ERROR_UNKNOWN; + snprintf(tcpa_metadata, TCPA_PCR_HASH_NAME, "CBFS: %s", name); - return tpm_measure_region(rdev, pcr_index, tcpa_metadata); + return tpm_extend_pcr(pcr_index, hash->algo, hash->raw, vb2_digest_size(hash->algo), + tcpa_metadata); } int tspi_measure_cache_to_pcr(void) diff --git a/src/security/tpm/tspi/crtm.h b/src/security/tpm/tspi/crtm.h index 011fa26..8ebb661 100644 --- a/src/security/tpm/tspi/crtm.h +++ b/src/security/tpm/tspi/crtm.h @@ -7,6 +7,7 @@ #include <program_loading.h> #include <security/tpm/tspi.h> #include <types.h> +#include <vb2_sha.h> /* CRTM */ #define TPM_CRTM_PCR 2 @@ -16,21 +17,16 @@ */ #define TPM_RUNTIME_DATA_PCR 3 +#define TPM_MEASURE_ALGO (CONFIG(TPM1) ? VB2_HASH_SHA1 : VB2_HASH_SHA256) + /** * Measure digests cached in TCPA log entries into PCRs */ int tspi_measure_cache_to_pcr(void); -#if !ENV_SMM && CONFIG(TPM_MEASURED_BOOT) -/* - * Measures cbfs data via hook (cbfs) - * rdev covers the file data (not metadata) - * return 0 if successful, else an error +/** + * Extend a measurement hash taken for a CBFS file into the appropriate PCR. */ -uint32_t tspi_measure_cbfs_hook(const struct region_device *rdev, - const char *name, uint32_t cbfs_type); -#else -#define tspi_measure_cbfs_hook(rdev, name, cbfs_type) 0 -#endif +uint32_t tspi_cbfs_measurement(const char *name, uint32_t type, const struct vb2_hash *hash); #endif /* __SECURITY_TSPI_CRTM_H__ */ diff --git a/src/security/tpm/tspi/tspi.c b/src/security/tpm/tspi/tspi.c index b1bea41..e2d6d1e 100644 --- a/src/security/tpm/tspi/tspi.c +++ b/src/security/tpm/tspi/tspi.c @@ -220,7 +220,7 @@ } uint32_t tpm_extend_pcr(int pcr, enum vb2_hash_algorithm digest_algo, - uint8_t *digest, size_t digest_len, const char *name) + const uint8_t *digest, size_t digest_len, const char *name) { uint32_t result; @@ -234,16 +234,22 @@ return result; } - printk(BIOS_DEBUG, "TPM: Extending digest for %s into PCR %d\n", name, pcr); + printk(BIOS_DEBUG, "TPM: Extending digest for `%s` into PCR %d\n", name, pcr); result = tlcl_extend(pcr, digest, NULL); - if (result != TPM_SUCCESS) + if (result != TPM_SUCCESS) { + printk(BIOS_ERR, "TPM: Extending hash for `%s` into PCR %d failed.\n", + name, pcr); return result; + } } if (CONFIG(TPM_MEASURED_BOOT)) tcpa_log_add_table_entry(name, pcr, digest_algo, digest, digest_len); + printk(BIOS_DEBUG, "TPM: Digest of `%s` to PCR %d %s\n", + name, pcr, tspi_tpm_is_setup() ? "measured" : "logged"); + return TPM_SUCCESS; } @@ -253,23 +259,16 @@ { uint8_t digest[TPM_PCR_MAX_LEN], digest_len; uint8_t buf[HASH_DATA_CHUNK_SIZE]; - uint32_t result, offset; + uint32_t offset; size_t len; struct vb2_digest_context ctx; - enum vb2_hash_algorithm hash_alg; if (!rdev || !rname) return TPM_E_INVALID_ARG; - if (CONFIG(TPM1)) { - hash_alg = VB2_HASH_SHA1; - } else { /* CONFIG_TPM2 */ - hash_alg = VB2_HASH_SHA256; - } - - digest_len = vb2_digest_size(hash_alg); + digest_len = vb2_digest_size(TPM_MEASURE_ALGO); assert(digest_len <= sizeof(digest)); - if (vb2_digest_init(&ctx, hash_alg)) { + if (vb2_digest_init(&ctx, TPM_MEASURE_ALGO)) { printk(BIOS_ERR, "TPM: Error initializing hash.\n"); return TPM_E_HASH_ERROR; } @@ -294,13 +293,6 @@ printk(BIOS_ERR, "TPM: Error finalizing hash.\n"); return TPM_E_HASH_ERROR; } - result = tpm_extend_pcr(pcr, hash_alg, digest, digest_len, rname); - if (result != TPM_SUCCESS) { - printk(BIOS_ERR, "TPM: Extending hash into PCR failed.\n"); - return result; - } - printk(BIOS_DEBUG, "TPM: Digest of %s to PCR %d %s\n", - rname, pcr, tspi_tpm_is_setup() ? "measured" : "logged"); - return TPM_SUCCESS; + return tpm_extend_pcr(pcr, TPM_MEASURE_ALGO, digest, digest_len, rname); } #endif /* VBOOT_LIB */ -- To view, visit https://review.coreboot.org/c/coreboot/+/59681 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I70d7066c6768195077f083c7ffdfa30d9182b2b7 Gerrit-Change-Number: 59681 Gerrit-PatchSet: 4 Gerrit-Owner: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Christian Walter <christian.walter(a)9elements.com> Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Reviewer: Jakub Czapiga <jacz(a)semihalf.com> Gerrit-Reviewer: Raul Rangel <rrangel(a)chromium.org> Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-MessageType: merged

1 0

Change in coreboot[master]: mb/google/brya/var/felwinter: Add WiFi SAR table for felwinter
by Felix Held (Code Review) Dec. 3, 2021

Dec. 3, 2021

Felix Held has submitted this change. ( https://review.coreboot.org/c/coreboot/+/59718 ) Change subject: mb/google/brya/var/felwinter: Add WiFi SAR table for felwinter ...................................................................... mb/google/brya/var/felwinter: Add WiFi SAR table for felwinter Add WiFi SAR table for felwinter. BUG=b:206901900 TEST=emerge-brya chromeos-config chromeos-config-bsp-private coreboot-private-files-baseboard-brya coreboot chromeos-bootimage and checked SAR table can load by WiFi driver. Signed-off-by: Ian Feng <ian_feng(a)compal.corp-partner.google.com> Change-Id: I0de710f4447302ee545a67cbd79373bdd2077637 Reviewed-on: https://review.coreboot.org/c/coreboot/+/59718 Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> Reviewed-by: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Reviewed-by: EricR Lai <ericr_lai(a)compal.corp-partner.google.com> --- M src/mainboard/google/brya/Kconfig.name M src/mainboard/google/brya/variants/felwinter/variant.c 2 files changed, 7 insertions(+), 0 deletions(-) Approvals: build bot (Jenkins): Verified EricR Lai: Looks good to me, approved Tim Wawrzynczak: Looks good to me, approved diff --git a/src/mainboard/google/brya/Kconfig.name b/src/mainboard/google/brya/Kconfig.name index cd00815..ead3348 100644 --- a/src/mainboard/google/brya/Kconfig.name +++ b/src/mainboard/google/brya/Kconfig.name @@ -108,6 +108,7 @@ bool "-> Felwinter" select BOARD_GOOGLE_BASEBOARD_BRYA select DRIVERS_GENERIC_GPIO_KEYS + select CHROMEOS_WIFI_SAR if CHROMEOS config BOARD_GOOGLE_ANAHERA bool "-> Anahera" diff --git a/src/mainboard/google/brya/variants/felwinter/variant.c b/src/mainboard/google/brya/variants/felwinter/variant.c index ee39ef0..8b270de 100644 --- a/src/mainboard/google/brya/variants/felwinter/variant.c +++ b/src/mainboard/google/brya/variants/felwinter/variant.c @@ -3,6 +3,12 @@ #include <chip.h> #include <fw_config.h> #include <baseboard/variants.h> +#include <sar.h> + +const char *get_wifi_sar_cbfs_filename(void) +{ + return "wifi_sar_0.hex"; +} void variant_update_soc_chip_config(struct soc_intel_alderlake_config *config) { -- To view, visit https://review.coreboot.org/c/coreboot/+/59718 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I0de710f4447302ee545a67cbd79373bdd2077637 Gerrit-Change-Number: 59718 Gerrit-PatchSet: 6 Gerrit-Owner: Ian Feng <ian_feng(a)compal.corp-partner.google.com> Gerrit-Reviewer: EricR Lai <ericr_lai(a)compal.corp-partner.google.com> Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Amanda Hwang <amanda_hwang(a)compal.corp-partner.google.com> Gerrit-CC: John Su <john_su(a)compal.corp-partner.google.com> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-CC: Van Chen <van_chen(a)compal.corp-partner.google.com> Gerrit-MessageType: merged

1 0

Change in coreboot[master]: soc/intel/alderlake: Define the helper functions
by Tim Wawrzynczak (Code Review) Dec. 3, 2021

Dec. 3, 2021

Attention is currently required from: Arthur Heymans, Sridhar Siricilla, Patrick Rudolph. Tim Wawrzynczak has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59362 ) Change subject: soc/intel/alderlake: Define the helper functions ...................................................................... Patch Set 7: (5 comments) Commit Message: https://review.coreboot.org/c/coreboot/+/59362/comment/faf1b5e7_195d5e16 PS7, Line 7: the helper functions `Define CPPCv3 hybrid helper functions` https://review.coreboot.org/c/coreboot/+/59362/comment/dff765c5_b70dfc8f PS7, Line 9: defines following `defines the following` https://review.coreboot.org/c/coreboot/+/59362/comment/5dee461c_3ba9ca19 PS7, Line 12: TRUE `true` https://review.coreboot.org/c/coreboot/+/59362/comment/0bd8cbd1_d83956d7 PS7, Line 13: FASLE `false` Patchset: PS7: could possibly be squashed with next patch? -- To view, visit https://review.coreboot.org/c/coreboot/+/59362 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I963690a4fadad322095d202bcc08c92dcd845360 Gerrit-Change-Number: 59362 Gerrit-PatchSet: 7 Gerrit-Owner: Sridhar Siricilla <sridhar.siricilla(a)intel.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Arthur Heymans <arthur.heymans(a)9elements.com> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-CC: Sridhar Siricilla <sridhar.siricilla(a)intel.corp-partner.google.com> Gerrit-Attention: Arthur Heymans <arthur.heymans(a)9elements.com> Gerrit-Attention: Sridhar Siricilla <sridhar.siricilla(a)intel.com> Gerrit-Attention: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Comment-Date: Fri, 03 Dec 2021 21:13:56 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0