Attention is currently required from: Jakub Czapiga, Paul Fagerburg, Jan Dabros.
Hello build bot (Jenkins), Paul Fagerburg, Julius Werner, Jan Dabros,
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/52937
to look at the new patch set (#2).
Change subject: tests: Enable config override for tests
......................................................................
tests: Enable config override for tests
Some tests require to change kconfig symbols values to cover the code.
This patch enables one to set these vaues using <test-name>-config
variable.
Example for integer values.
timestamp-test-config += CONFIG_HAVE_MONOTONIC_TIMER=1
Example for string values. Notice escaped quotes.
spd_cache-test-config += CONFIG_SPD_CACHE_FMAP_NAME=\"SPD_CACHE_FMAP_NAME\"
Signed-off-by: Jakub Czapiga <jacz(a)semihalf.com>
Change-Id: I1aeb78362c2609fbefbfd91c0f58ec19ed258ee1
---
M tests/Makefile.inc
1 file changed, 18 insertions(+), 4 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/37/52937/2
--
To view, visit https://review.coreboot.org/c/coreboot/+/52937
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I1aeb78362c2609fbefbfd91c0f58ec19ed258ee1
Gerrit-Change-Number: 52937
Gerrit-PatchSet: 2
Gerrit-Owner: Jakub Czapiga <jacz(a)semihalf.com>
Gerrit-Reviewer: Jan Dabros <jsd(a)semihalf.com>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Paul Fagerburg <pfagerburg(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Jakub Czapiga <jacz(a)semihalf.com>
Gerrit-Attention: Paul Fagerburg <pfagerburg(a)chromium.org>
Gerrit-Attention: Jan Dabros <jsd(a)semihalf.com>
Gerrit-MessageType: newpatchset
Arthur Heymans has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/52969 )
Change subject: security/intel/txt: Set up TPM in bootblock if using measured boot
......................................................................
security/intel/txt: Set up TPM in bootblock if using measured boot
Change-Id: I1225757dbc4c6fb5a30d1aa12987661a0a6eb538
Signed-off-by: Arthur Heymans <arthur(a)aheymans.xyz>
---
M src/security/intel/txt/Kconfig
1 file changed, 1 insertion(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/69/52969/1
diff --git a/src/security/intel/txt/Kconfig b/src/security/intel/txt/Kconfig
index c1442c8..14b4f6a 100644
--- a/src/security/intel/txt/Kconfig
+++ b/src/security/intel/txt/Kconfig
@@ -6,6 +6,7 @@
select MRC_SETTINGS_PROTECT if CACHE_MRC_SETTINGS
select ENABLE_VMX if CPU_INTEL_COMMON
select AP_IN_SIPI_WAIT
+ select TPM_MEASURED_BOOT_INIT_BOOTBLOCK if TPM_MEASURED_BOOT
depends on (TPM1 || TPM2)
depends on CPU_INTEL_FIRMWARE_INTERFACE_TABLE
depends on PLATFORM_HAS_DRAM_CLEAR
--
To view, visit https://review.coreboot.org/c/coreboot/+/52969
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I1225757dbc4c6fb5a30d1aa12987661a0a6eb538
Gerrit-Change-Number: 52969
Gerrit-PatchSet: 1
Gerrit-Owner: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-MessageType: newchange
Arthur Heymans has submitted this change. ( https://review.coreboot.org/c/coreboot/+/51923 )
Change subject: security/tpm: Add option to init TPM in bootblock
......................................................................
security/tpm: Add option to init TPM in bootblock
When using a hardware assisted root of trust measurement, like Intel
TXT/CBnT, the TPM init needs to happen inside the bootblock to form a
proper chain of trust.
Change-Id: Ifacba5d9ab19b47968b4f2ed5731ded4aac55022
Signed-off-by: Arthur Heymans <arthur(a)aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/51923
Reviewed-by: Christian Walter <christian.walter(a)9elements.com>
Reviewed-by: Angel Pons <th3fanbus(a)gmail.com>
Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org>
---
M src/drivers/pc80/tpm/Makefile.inc
M src/drivers/tpm/Kconfig
M src/lib/bootblock.c
M src/security/intel/cbnt/Kconfig
M src/security/tpm/Kconfig
M src/security/tpm/tspi/tspi.c
6 files changed, 24 insertions(+), 2 deletions(-)
Approvals:
build bot (Jenkins): Verified
Angel Pons: Looks good to me, but someone else must approve
Christian Walter: Looks good to me, approved
diff --git a/src/drivers/pc80/tpm/Makefile.inc b/src/drivers/pc80/tpm/Makefile.inc
index a16f6af..8b2a864 100644
--- a/src/drivers/pc80/tpm/Makefile.inc
+++ b/src/drivers/pc80/tpm/Makefile.inc
@@ -1,3 +1,4 @@
+bootblock-$(CONFIG_MAINBOARD_HAS_LPC_TPM) += tis.c
verstage-$(CONFIG_MAINBOARD_HAS_LPC_TPM) += tis.c
romstage-$(CONFIG_MAINBOARD_HAS_LPC_TPM) += tis.c
ramstage-$(CONFIG_MAINBOARD_HAS_LPC_TPM) += tis.c
diff --git a/src/drivers/tpm/Kconfig b/src/drivers/tpm/Kconfig
index 128f9bf..79b860f 100644
--- a/src/drivers/tpm/Kconfig
+++ b/src/drivers/tpm/Kconfig
@@ -1,7 +1,8 @@
config TPM_INIT_RAMSTAGE
bool
default y if TPM1 || TPM2
- depends on !VBOOT && !VENDORCODE_ELTAN_VBOOT && !VENDORCODE_ELTAN_MBOOT
+ depends on !VBOOT && !VENDORCODE_ELTAN_VBOOT && !VENDORCODE_ELTAN_MBOOT \
+ && !TPM_MEASURED_BOOT_INIT_BOOTBLOCK
help
This driver automatically initializes the TPM if vboot is not used.
The TPM driver init is done during the ramstage chip init phase.
diff --git a/src/lib/bootblock.c b/src/lib/bootblock.c
index 23fb392..5989964 100644
--- a/src/lib/bootblock.c
+++ b/src/lib/bootblock.c
@@ -1,5 +1,6 @@
/* SPDX-License-Identifier: GPL-2.0-only */
+#include <acpi/acpi.h>
#include <arch/exception.h>
#include <bootblock_common.h>
#include <console/console.h>
@@ -8,6 +9,7 @@
#include <option.h>
#include <post.h>
#include <program_loading.h>
+#include <security/tpm/tspi.h>
#include <symbols.h>
#include <timestamp.h>
@@ -56,6 +58,11 @@
bootblock_soc_init();
bootblock_mainboard_init();
+ if (CONFIG(TPM_MEASURED_BOOT_INIT_BOOTBLOCK)) {
+ int s3resume = acpi_is_wakeup_s3();
+ tpm_setup(s3resume);
+ }
+
timestamp_add_now(TS_END_BOOTBLOCK);
run_romstage();
diff --git a/src/security/intel/cbnt/Kconfig b/src/security/intel/cbnt/Kconfig
index 415092b..9208ab4 100644
--- a/src/security/intel/cbnt/Kconfig
+++ b/src/security/intel/cbnt/Kconfig
@@ -8,6 +8,7 @@
select INTEL_TXT
# With CBnT the bootblock is set up as a CBnT IBB and needs a fixed size
select FIXED_BOOTBLOCK_SIZE
+ select TPM_MEASURED_BOOT_INIT_BOOTBLOCK if TPM_MEASURED_BOOT
help
Enables Intel Converged Bootguard and Trusted Execution Technology
Support. This will enable one to add a Key Manifest (KM) and a Boot
diff --git a/src/security/tpm/Kconfig b/src/security/tpm/Kconfig
index e1255d1..13bef06 100644
--- a/src/security/tpm/Kconfig
+++ b/src/security/tpm/Kconfig
@@ -106,6 +106,14 @@
help
Enables measured boot (experimental)
+config TPM_MEASURED_BOOT_INIT_BOOTBLOCK
+ bool
+ depends on TPM_MEASURED_BOOT && !VBOOT
+ help
+ Initialize TPM inside the bootblock instead of ramstage. This is
+ useful with some form of hardware assisted root of trust
+ measurement like Intel TXT/CBnT.
+
config TPM_MEASURED_BOOT_RUNTIME_DATA
string "Runtime data whitelist"
default ""
diff --git a/src/security/tpm/tspi/tspi.c b/src/security/tpm/tspi/tspi.c
index 6ef0138..7a8e2be 100644
--- a/src/security/tpm/tspi/tspi.c
+++ b/src/security/tpm/tspi/tspi.c
@@ -1,5 +1,6 @@
/* SPDX-License-Identifier: GPL-2.0-only */
+#include <rules.h>
#include <console/cbmem_console.h>
#include <console/console.h>
#include <security/tpm/tspi/crtm.h>
@@ -104,6 +105,9 @@
return vboot_logic_executed();
}
+ if (CONFIG(TPM_MEASURED_BOOT_INIT_BOOTBLOCK))
+ return ENV_BOOTBLOCK ? tpm_is_setup : 1;
+
if (ENV_RAMSTAGE)
return tpm_is_setup;
@@ -180,7 +184,7 @@
#if CONFIG(TPM1)
result = tpm1_invoke_state_machine();
#endif
- if (CONFIG(TPM_MEASURED_BOOT))
+ if (CONFIG(TPM_MEASURED_BOOT) && !CONFIG(TPM_MEASURED_BOOT_INIT_BOOTBLOCK))
result = tspi_measure_cache_to_pcr();
tpm_is_setup = 1;
--
To view, visit https://review.coreboot.org/c/coreboot/+/51923
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ifacba5d9ab19b47968b4f2ed5731ded4aac55022
Gerrit-Change-Number: 51923
Gerrit-PatchSet: 7
Gerrit-Owner: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Christian Walter <christian.walter(a)9elements.com>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Martin Roth <martinroth(a)google.com>
Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com>
Gerrit-Reviewer: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-MessageType: merged
Chen Wisley has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/52880 )
Change subject: mb/google/volteer/var/elemi: Add spd for K4AAG165WB-BCWE
......................................................................
Patch Set 2:
(1 comment)
Patchset:
PS1:
> Is there a reason this is still marked as WIP? LGTM.
Just wait to update bug number in comment message
Thanks.
--
To view, visit https://review.coreboot.org/c/coreboot/+/52880
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I839447a9e7c7b6558b2d0877c67dc9cf89ee792a
Gerrit-Change-Number: 52880
Gerrit-PatchSet: 2
Gerrit-Owner: Chen Wisley <wisley.chen(a)quantatw.com>
Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)google.com>
Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
Gerrit-Reviewer: Wisley Chen <wisley.chen(a)quanta.corp-partner.google.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Comment-Date: Thu, 06 May 2021 08:18:20 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Nick Vaccaro <nvaccaro(a)google.com>
Gerrit-MessageType: comment
Chen Wisley has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/52880 )
Change subject: mb/google/volteer/var/elemi: Add spd for K4AAG165WB-BCWE
......................................................................
Patch Set 2:
This change is ready for review.
--
To view, visit https://review.coreboot.org/c/coreboot/+/52880
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I839447a9e7c7b6558b2d0877c67dc9cf89ee792a
Gerrit-Change-Number: 52880
Gerrit-PatchSet: 2
Gerrit-Owner: Chen Wisley <wisley.chen(a)quantatw.com>
Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)google.com>
Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
Gerrit-Reviewer: Wisley Chen <wisley.chen(a)quanta.corp-partner.google.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Comment-Date: Thu, 06 May 2021 08:16:17 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Attention is currently required from: Paul2 Huang, Kirk Wang.
Alex1 Kao has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/52936 )
Change subject: mb/google/dedede: Update pirika device tree
......................................................................
Patch Set 2:
This change is ready for review.
--
To view, visit https://review.coreboot.org/c/coreboot/+/52936
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I15b9cb0d0276b5e2dd06694530cc35e5643efb9d
Gerrit-Change-Number: 52936
Gerrit-PatchSet: 2
Gerrit-Owner: Alex1 Kao <alex1_kao(a)pegatron.corp-partner.google.com>
Gerrit-Reviewer: Kirk Wang <kirk_wang(a)pegatron.corp-partner.google.com>
Gerrit-Reviewer: Paul2 Huang <paul2_huang(a)pegatron.corp-partner.google.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Ariel Chang <ariel_chang(a)pegatron.corp-partner.google.com>
Gerrit-CC: Hao Chou <hao_chou(a)pegatron.corp-partner.google.com>
Gerrit-CC: Wayne3 Wang <wayne3_wang(a)pegatron.corp-partner.google.com>
Gerrit-Attention: Paul2 Huang <paul2_huang(a)pegatron.corp-partner.google.com>
Gerrit-Attention: Kirk Wang <kirk_wang(a)pegatron.corp-partner.google.com>
Gerrit-Comment-Date: Thu, 06 May 2021 07:48:26 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Attention is currently required from: Christian Walter, Julius Werner.
Hello Christian Walter, Julius Werner,
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/52968
to look at the new patch set (#2).
Change subject: security/tpm/tspi/crtm: Fix FMAP TPM PCR
......................................................................
security/tpm/tspi/crtm: Fix FMAP TPM PCR
TPM_RUNTIME_DATA_PCR is for "for measuring data which changes during
runtime e.g. CMOS, NVRAM..." according to comments. FMAP does not
change during runtime.
Change-Id: I23e61a2dc25cd1c1343fb438febaf8771d1c0621
Signed-off-by: Arthur Heymans <arthur(a)aheymans.xyz>
---
M src/security/tpm/tspi/crtm.c
M src/security/tpm/tspi/crtm.h
2 files changed, 2 insertions(+), 1 deletion(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/68/52968/2
--
To view, visit https://review.coreboot.org/c/coreboot/+/52968
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I23e61a2dc25cd1c1343fb438febaf8771d1c0621
Gerrit-Change-Number: 52968
Gerrit-PatchSet: 2
Gerrit-Owner: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Christian Walter <christian.walter(a)9elements.com>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-CC: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Christian Walter <christian.walter(a)9elements.com>
Gerrit-Attention: Julius Werner <jwerner(a)chromium.org>
Gerrit-MessageType: newpatchset
Arthur Heymans has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/52753 )
Change subject: security/tpm/crtm: Measure FMAP into TPM
......................................................................
Patch Set 4:
(1 comment)
File src/security/tpm/tspi/crtm.c:
https://review.coreboot.org/c/coreboot/+/52753/comment/199c7a63_4590e92c
PS2, Line 64: TPM_CRTM_PCR
> > So why is it runtime? (Sorry, I expected someone else would answer this and it wouldn't go in so quickly...) Isn't "runtime" for data that is somewhat variable and can change between units or boots or something, whereas "CRTM" is for the core code and data components that are fundamental to the security of the system? If so I would definitely expect the FMAP layout to count to CRTM just like all the code stages in CBFS. CBFS is anchored in the FMAP, after all.
>
> Hmm I should have read the comments defining those constants...
Fixed in https://review.coreboot.org/c/coreboot/+/52968
--
To view, visit https://review.coreboot.org/c/coreboot/+/52753
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ic424a094e7f790cce45c5a98b8bc6d46a8dcca1b
Gerrit-Change-Number: 52753
Gerrit-PatchSet: 4
Gerrit-Owner: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Christian Walter <christian.walter(a)9elements.com>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-Reviewer: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: 9elements QA <hardwaretestrobot(a)gmail.com>
Gerrit-CC: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Comment-Date: Thu, 06 May 2021 07:37:24 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Comment-In-Reply-To: Julius Werner <jwerner(a)chromium.org>
Comment-In-Reply-To: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-MessageType: comment