Attention is currently required from: Hung-Te Lin, Julius Werner, Arthur Heymans, ron minnich.
Arthur Heymans has uploaded a new patch set (#2) to the change originally created by Arthur Heymans. ( https://review.coreboot.org/c/coreboot/+/68767 )
Change subject: coreboot_tables: Drop uart PCI addr
......................................................................
coreboot_tables: Drop uart PCI addr
This field is unused by all payloads.
Only edk2 used this to fill in a different struct but even there the
entries goes unused, so removing this struct element from coreboot has
no side effects.
Change-Id: Iadd2678c4e01d30471eac43017392d256adda341
Signed-off-by: Arthur Heymans <arthur(a)aheymans.xyz>
---
M payloads/libpayload/include/coreboot_tables.h
M src/commonlib/include/commonlib/coreboot_tables.h
M src/drivers/uart/Kconfig
M src/drivers/uart/pl011.c
M src/drivers/uart/uart8250io.c
M src/drivers/uart/uart8250mem.c
M src/lib/coreboot_table.c
M src/mainboard/emulation/qemu-power8/uart.c
M src/soc/intel/quark/Kconfig
M src/soc/mediatek/common/uart.c
M src/soc/nvidia/tegra124/uart.c
M src/soc/nvidia/tegra210/uart.c
M src/soc/qualcomm/ipq40xx/uart.c
M src/soc/qualcomm/qcs405/uart.c
M src/soc/samsung/exynos5250/uart.c
M src/soc/samsung/exynos5420/uart.c
M src/soc/ti/am335x/uart.c
M tests/lib/coreboot_table-test.c
18 files changed, 15 insertions(+), 51 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/67/68767/2
--
To view, visit https://review.coreboot.org/c/coreboot/+/68767
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Iadd2678c4e01d30471eac43017392d256adda341
Gerrit-Change-Number: 68767
Gerrit-PatchSet: 2
Gerrit-Owner: Arthur Heymans <arthur.heymans(a)9elements.com>
Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Hung-Te Lin <hungte(a)chromium.org>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: ron minnich <rminnich(a)gmail.com>
Gerrit-CC: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Hung-Te Lin <hungte(a)chromium.org>
Gerrit-Attention: Julius Werner <jwerner(a)chromium.org>
Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Attention: ron minnich <rminnich(a)gmail.com>
Gerrit-MessageType: newpatchset
Attention is currently required from: Grace Kao, Tim Wawrzynczak, Nick Vaccaro, Curtis Chen, Lawrence Chang.
Kane Chen has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/68565 )
Change subject: soc/intel/alderlake: Add Raptor Lake device IDs
......................................................................
Patch Set 7: Code-Review+2
--
To view, visit https://review.coreboot.org/c/coreboot/+/68565
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I6fd51d9915aa59d012c73abc2477531643655e54
Gerrit-Change-Number: 68565
Gerrit-PatchSet: 7
Gerrit-Owner: Lawrence Chang <lawrence.chang(a)intel.corp-partner.google.com>
Gerrit-Reviewer: Curtis Chen <curtis.chen(a)intel.com>
Gerrit-Reviewer: Curtis Chen <curtis.chen(a)intel.corp-partner.google.com>
Gerrit-Reviewer: Grace Kao <grace.kao(a)intel.com>
Gerrit-Reviewer: Grace Kao <grace.kao(a)intel.corp-partner.google.com>
Gerrit-Reviewer: Kane Chen <kane.chen(a)intel.com>
Gerrit-Reviewer: Kane Chen <kane.chen(a)intel.corp-partner.google.com>
Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)google.com>
Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com>
Gerrit-Reviewer: Tim Wawrzynczak <inforichland(a)gmail.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Grace Kao <grace.kao(a)intel.corp-partner.google.com>
Gerrit-Attention: Grace Kao <grace.kao(a)intel.com>
Gerrit-Attention: Tim Wawrzynczak <inforichland(a)gmail.com>
Gerrit-Attention: Nick Vaccaro <nvaccaro(a)google.com>
Gerrit-Attention: Curtis Chen <curtis.chen(a)intel.com>
Gerrit-Attention: Lawrence Chang <lawrence.chang(a)intel.corp-partner.google.com>
Gerrit-Attention: Curtis Chen <curtis.chen(a)intel.corp-partner.google.com>
Gerrit-Comment-Date: Mon, 24 Oct 2022 12:55:42 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
Attention is currently required from: Subrata Banik, Kangheui Won, Reka Norman, Tim Wawrzynczak, Nick Vaccaro, Meera Ravindranath.
Tarun Tuli has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/68309 )
Change subject: soc/intel/{adl, cmn}: Allow config to select the OCP W/A
......................................................................
Patch Set 2: Code-Review+2
--
To view, visit https://review.coreboot.org/c/coreboot/+/68309
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ia2364d2de9725256dfa2269f2feb3d892c52086a
Gerrit-Change-Number: 68309
Gerrit-PatchSet: 2
Gerrit-Owner: Subrata Banik <subratabanik(a)google.com>
Gerrit-Reviewer: Frans Hendriks <fhendriks(a)eltan.com>
Gerrit-Reviewer: Kangheui Won <khwon(a)chromium.org>
Gerrit-Reviewer: Meera Ravindranath <meera.ravindranath(a)intel.com>
Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)chromium.org>
Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)google.com>
Gerrit-Reviewer: Reka Norman <rekanorman(a)chromium.org>
Gerrit-Reviewer: Tarun Tuli <taruntuli(a)google.com>
Gerrit-Reviewer: Tim Wawrzynczak <inforichland(a)gmail.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Subrata Banik <subratabanik(a)google.com>
Gerrit-Attention: Kangheui Won <khwon(a)chromium.org>
Gerrit-Attention: Reka Norman <rekanorman(a)chromium.org>
Gerrit-Attention: Tim Wawrzynczak <inforichland(a)gmail.com>
Gerrit-Attention: Nick Vaccaro <nvaccaro(a)chromium.org>
Gerrit-Attention: Meera Ravindranath <meera.ravindranath(a)intel.com>
Gerrit-Attention: Nick Vaccaro <nvaccaro(a)google.com>
Gerrit-Comment-Date: Mon, 24 Oct 2022 12:48:51 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
Attention is currently required from: Hung-Te Lin, Julius Werner, ron minnich.
build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/68768 )
Change subject: lib/coreboot_table: Simplify API to set up lb_serial
......................................................................
Patch Set 1:
(1 comment)
File src/lib/coreboot_table.c:
Robot Comment from checkpatch (run ID jenkins-coreboot-checkpatch-161156):
https://review.coreboot.org/c/coreboot/+/68768/comment/848cf52b_3656e26c
PS1, Line 114: lb_add_console(LB_TAG_CONSOLE_SERIAL8250MEM, header);;
Statements terminations use 1 semicolon
--
To view, visit https://review.coreboot.org/c/coreboot/+/68768
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I6c08a88fb5fc035eb28d0becf19471c709c8043d
Gerrit-Change-Number: 68768
Gerrit-PatchSet: 1
Gerrit-Owner: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Hung-Te Lin <hungte(a)chromium.org>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: ron minnich <rminnich(a)gmail.com>
Gerrit-CC: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Hung-Te Lin <hungte(a)chromium.org>
Gerrit-Attention: Julius Werner <jwerner(a)chromium.org>
Gerrit-Attention: ron minnich <rminnich(a)gmail.com>
Gerrit-Comment-Date: Mon, 24 Oct 2022 12:45:18 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Attention is currently required from: Michał Żygowski, Maciej Pijanowski, Krystian Hebel.
Hello Michał Żygowski, Maciej Pijanowski, Krystian Hebel,
I'd like you to do a code review.
Please visit
https://review.coreboot.org/c/coreboot/+/68752
to review the following change.
Change subject: [WIP] Documentation/measured_boot.md: document new TPM options
......................................................................
[WIP] Documentation/measured_boot.md: document new TPM options
Change-Id: I6dae8e95c59b440c75e13473eefc4c2cf4fd369b
Ticket: https://ticket.coreboot.org/issues/426
Signed-off-by: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com>
---
M Documentation/security/vboot/measured_boot.md
1 file changed, 95 insertions(+), 30 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/52/68752/1
diff --git a/Documentation/security/vboot/measured_boot.md b/Documentation/security/vboot/measured_boot.md
index 8601bcc..07144d1 100644
--- a/Documentation/security/vboot/measured_boot.md
+++ b/Documentation/security/vboot/measured_boot.md
@@ -49,20 +49,43 @@
[srtm]: srtm.png
### TCPA eventlog
-coreboot makes use of its own TCPA log implementation. Normally the eventlog
-specification can be found via the TCG homepage:
+There are three supported formats of event logs:
+* coreboot-specific format.
+* [TPM1.2 Specification][TPM12] (section 3.3.3).
+* [TPM2.0 Specification][TPM20] (section 3.3.4).
-[UEFI Specification](https://trustedcomputinggroup.org/resource/tcg-efi-platform-…
+[TPM12]: https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementa…
+[TPM20]: https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05…
-[BIOS Specification](https://www.trustedcomputinggroup.org/wp-content/uploads/TCG…
+#### coreboot-specific format
+```c
+struct tcpa_entry {
+ uint32_t pcr; /* PCR number. */
+ char digest_type[10]; /* Hash algorithm name. */
+ uint8_t digest[64]; /* Digest (tail can be unused). */
+ uint32_t digest_length; /* Number of digest bytes used. */
+ char name[50]; /* Description of what was hashed. */
+} __packed;
-Both of them are not representing firmware measurements in a generalized way.
-Therefore we have to implement our own solution.
+struct tcpa_table {
+ uint16_t max_entries;
+ uint16_t num_entries;
+ struct tcpa_entry entries[0];
+} __packed;
+```
-We decided to provide an easy to understand TCPA log which can be read out
-from the operating system and firmware itself.
+Single hash per PCR. No magic number or any other way of recognizing it.
+Endianness isn't specified.
-#### Table Format
+In principle can hold any hash with 512 bits or less. In practice,
+SHA-1 (for TPM1) and SHA-256 (TPM2) are used.
+
+Can be parsed by `cbmem`.
+
+Use NEED_VBOOT_COMPATIBILITY or USE_TPM_LOG_CB kconfig option to select this
+format.
+
+##### Console dump format
The first column describes the PCR index used for measurement.
The second column is the hash of the raw data. The third column contains
the hash algorithm used in the operation. The last column provides
@@ -70,6 +93,42 @@
came from, CBFS or FMAP, then the name used to look up the data
(region or file name).
+#### TPM 1.2 format
+Single hash per PCR (always SHA-1). First entry serves as a header, provides
+ID and version. Always little endian.
+
+Can be parsed by at least `cbmem` and Linux (exports in both text and binary
+forms).
+
+Data in vendor info section of the header:
+```c
+uint16_t max_entries;
+uint16_t num_entries;
+```
+In endianness of the firmware. Not meant to be stable.
+
+Use USE_TPM_LOG_TPM12 kconfig option to select this format.
+
+#### TPM 2.0 format
+One or more hashes per PCR, but implementation is limited to single hash (SHA-1,
+SHA-256, SHA-384 or SHA-512). First entry is overall compatible with TPM 1.2 and
+serves as a header with ID, version and number of hashing algorithms used.
+Always little endian.
+
+Can be parsed by at least `cbmem`, Linux (exports only binary form) and
+[Skiboot][skiboot].
+
+[skiboot]: https://github.com/open-power/skiboot/
+
+Data in vendor info section of the header:
+```c
+uint16_t max_entries;
+uint16_t num_entries;
+```
+In endianness of the firmware. Not meant to be stable.
+
+Use USE_TPM_LOG_TPM2 kconfig option to select this format.
+
#### Example:
```bash
PCR-2 e8f2b57c9ec5ea06d1bbd3240a753974d4c3e7c8cd305c20a8ea26eed906dc89 SHA256 [FMAP: COREBOOT CBFS: bootblock]
@@ -120,28 +179,23 @@
environment is necessary.
## Platform Configuration Register
-Normally PCR 0-7 are reserved for firmware usage. In coreboot we use just 4 PCR
-banks in order to store the measurements. coreboot uses the SHA-1 or SHA-256
-hash algorithm depending on the TPM specification for measurements. PCR-4 to
-PCR-7 are left empty.
+Normally PCR 0-7 are reserved for firmware usage. In coreboot we use just 3 or 4
+PCR banks in order to store the measurements. PCR-4 to PCR-7 are left empty.
-### PCR-0
-_Hash:_ SHA1
+### If NEED_VBOOT_COMPATIBILITY kconfig option is selected by the mainboard
+vboot-specific (non-standard) PCR usage.
-_Description:_ Google vboot GBB flags.
+* PCR-0 - SHA1 of Google vboot GBB flags.
+* PCR-1 - SHA1/SHA256 of Google vboot GBB HWID.
+* PCR-2 - SHA1/SHA256 of Core Root of Trust for Measurement which includes all stages,
+ data and blobs.
+* PCR-3 - SHA1/SHA256 of runtime data like hwinfo.hex or MRC cache.
-### PCR-1
-_Hash:_ SHA1/SHA256
+### If NEED_VBOOT_COMPATIBILITY kconfig option is NOT selected by the mainboard
+See [TPM1.2 Specification][TPM12] (section 3.3.3) and
+[TPM2.0 Specification][TPM20] (section 3.3.4) for PCR assignment information.
-_Description:_ Google vboot GBB HWID.
-
-### PCR-2
-_Hash:_ SHA1/SHA256
-
-_Description:_ Core Root of Trust for Measurement which includes all stages,
-data and blobs.
-
-### PCR-3
-_Hash:_ SHA1/SHA256
-
-_Description:_ Runtime data like hwinfo.hex or MRC cache.
+* PCR-1 - SHA1 of Google vboot GBB flags, SHA1/SHA256 of Google vboot GBB HWID.
+* PCR-2 - SHA1/SHA256 of Core Root of Trust for Measurement which includes all stages,
+ data and blobs.
+* PCR-3 - SHA1/SHA256 of runtime data like hwinfo.hex or MRC cache.
--
To view, visit https://review.coreboot.org/c/coreboot/+/68752
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I6dae8e95c59b440c75e13473eefc4c2cf4fd369b
Gerrit-Change-Number: 68752
Gerrit-PatchSet: 1
Gerrit-Owner: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com>
Gerrit-Reviewer: Krystian Hebel <krystian.hebel(a)3mdeb.com>
Gerrit-Reviewer: Maciej Pijanowski <maciej.pijanowski(a)3mdeb.com>
Gerrit-Reviewer: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-Attention: Maciej Pijanowski <maciej.pijanowski(a)3mdeb.com>
Gerrit-Attention: Krystian Hebel <krystian.hebel(a)3mdeb.com>
Gerrit-MessageType: newchange
Attention is currently required from: Michał Żygowski, Maciej Pijanowski, Krystian Hebel.
Hello Michał Żygowski, Maciej Pijanowski, Krystian Hebel,
I'd like you to do a code review.
Please visit
https://review.coreboot.org/c/coreboot/+/68751
to review the following change.
Change subject: [WIP] Documentation/measured_boot.md: fix SRTM/DRTM explanations
......................................................................
[WIP] Documentation/measured_boot.md: fix SRTM/DRTM explanations
Change-Id: If224dc0cf3c0515dbd18daca544c22275e96b459
Ticket: https://ticket.coreboot.org/issues/426
Signed-off-by: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com>
---
M Documentation/security/vboot/measured_boot.md
1 file changed, 33 insertions(+), 14 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/51/68751/1
diff --git a/Documentation/security/vboot/measured_boot.md b/Documentation/security/vboot/measured_boot.md
index adfae46..8601bcc 100644
--- a/Documentation/security/vboot/measured_boot.md
+++ b/Documentation/security/vboot/measured_boot.md
@@ -6,8 +6,8 @@
## IBB/CRTM
The "Initial Boot Block" or "Core Root of Trust for Measurement" is the first
-code block loaded at reset vector and measured by a DRTM solution.
-In case SRTM mode is active, the IBB measures itself before measuring the next
+code block loaded at reset vector.
+In case SRTM is active, the IBB measures itself before measuring the next
code block. In coreboot, cbfs files which are part of the IBB are identified
by a metadata tag. This makes it possible to have platform specific IBB
measurements without hardcoding them.
@@ -19,12 +19,19 @@
Also SoCs making use of VBOOT_RETURN_FROM_VERSTAGE are not able to use the
measured boot extension because of platform constraints.
-## SRTM Mode
-The "Static Root of Trust for Measurement" is the easiest way doing measurements
-by measuring code before it is loaded.
+## SRTM
+The "Static Root of Trust for Measurement" start with boot process after
+platform shutdown or restart. It first establishes the root of trust by
+measuring bootblock, then the chain of trust is continued by each stage adding
+measurements of its successor before passing control to it.
+
+The idea is to log everything that has been run up until now and if everything
+is of known origin and wasn't tempered with, assume the environment was not
+compromised. For this to work no stage should escape being measured or change
+in unpredictable way after the measurement while still in use.
### Measurements
-SRTM mode measurements are done starting with the IBB as root of trust.
+SRTM measurements are done starting with the IBB as root of trust.
Only CBFS contents are measured at the moment.
#### CBFS files (stages, blobs)
@@ -102,14 +109,15 @@
cbfstool coreboot.rom read -n SI_ME -f /dev/stdout | sha256sum
```
-## DRTM Mode
-The "Dynamic Root of Trust for Measurement" is realised by platform features
-like Intel TXT or Boot Guard. The features provide a way of loading a signed
-"Authenticated Code Module" aka signed blob. Most of these features are also
-a "Trusted Execution Environment", e.g. Intel TXT.
-
-DRTM gives you the ability of measuring the IBB from a higher Root of Trust
-instead of doing it yourself without any hardware support.
+## DRTM
+The "Dynamic Root of Trust for Measurement" avoids the need to verify
+everything that happened since boot by relying on hardware means like Intel
+TXT or Boot Guard. Instead of starting the chain at boot and building from
+there, DRTM ensures trust by isolating measured code from anything that can
+modify. This is done by starting DRTM early in a boot process when all
+hardware is in a well known state. Once DRTM is up, it remains resident in
+memory and can be interacted with through an API when a safe computation
+environment is necessary.
## Platform Configuration Register
Normally PCR 0-7 are reserved for firmware usage. In coreboot we use just 4 PCR
--
To view, visit https://review.coreboot.org/c/coreboot/+/68751
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: If224dc0cf3c0515dbd18daca544c22275e96b459
Gerrit-Change-Number: 68751
Gerrit-PatchSet: 1
Gerrit-Owner: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com>
Gerrit-Reviewer: Krystian Hebel <krystian.hebel(a)3mdeb.com>
Gerrit-Reviewer: Maciej Pijanowski <maciej.pijanowski(a)3mdeb.com>
Gerrit-Reviewer: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-Attention: Maciej Pijanowski <maciej.pijanowski(a)3mdeb.com>
Gerrit-Attention: Krystian Hebel <krystian.hebel(a)3mdeb.com>
Gerrit-MessageType: newchange
Attention is currently required from: Michał Żygowski, Maciej Pijanowski, Christian Walter, Julius Werner, Krystian Hebel, Yu-Ping Wu.
Hello Michał Żygowski, Maciej Pijanowski, Krystian Hebel,
I'd like you to do a code review.
Please visit
https://review.coreboot.org/c/coreboot/+/68750
to review the following change.
Change subject: [WIP] security/tpm: make use of PCRs configurable via Kconfig
......................................................................
[WIP] security/tpm: make use of PCRs configurable via Kconfig
At this moment, only GBB flags are moved from PCR-0 to PCR-1 when
vboot-compatibility is not enabled.
Change-Id: Ib3a192d902072f6f8d415c2952a36522b5bf09f9
Ticket: https://ticket.coreboot.org/issues/424
Signed-off-by: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com>
---
M src/security/tpm/Kconfig
M src/security/tpm/tspi/crtm.c
M src/security/tpm/tspi/crtm.h
M src/security/vboot/vboot_logic.c
4 files changed, 39 insertions(+), 17 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/50/68750/1
diff --git a/src/security/tpm/Kconfig b/src/security/tpm/Kconfig
index 81506b4..d3bf1ff 100644
--- a/src/security/tpm/Kconfig
+++ b/src/security/tpm/Kconfig
@@ -166,4 +166,20 @@
Runtime data whitelist of cbfs filenames. Needs to be a
space delimited list
+config PCR_BOOT_MODE
+ int
+ default 0 if NEED_VBOOT_COMPATIBILITY
+ default 1
+config PCR_HWID
+ int
+ default 1
+config PCR_CRTM
+ int
+ default 2
+# PCR for measuring data which changes during runtime
+# e.g. CMOS, NVRAM...
+config PCR_RUNTIME_DATA
+ int
+ default 3
+
endmenu # Trusted Platform Module (tpm)
diff --git a/src/security/tpm/tspi/crtm.c b/src/security/tpm/tspi/crtm.c
index 8eefc11..aea0069 100644
--- a/src/security/tpm/tspi/crtm.c
+++ b/src/security/tpm/tspi/crtm.c
@@ -44,7 +44,7 @@
struct region_device fmap;
if (fmap_locate_area_as_rdev("FMAP", &fmap) == 0) {
- if (tpm_measure_region(&fmap, TPM_CRTM_PCR, "FMAP: FMAP")) {
+ if (tpm_measure_region(&fmap, CONFIG_PCR_CRTM, "FMAP: FMAP")) {
printk(BIOS_ERR,
"TSPI: Couldn't measure FMAP into CRTM!\n");
return VB2_ERROR_UNKNOWN;
@@ -58,7 +58,7 @@
struct region_device bootblock_fmap;
if (fmap_locate_area_as_rdev("BOOTBLOCK", &bootblock_fmap) == 0) {
if (tpm_measure_region(&bootblock_fmap,
- TPM_CRTM_PCR,
+ CONFIG_PCR_CRTM,
"FMAP: BOOTBLOCK"))
return VB2_ERROR_UNKNOWN;
}
@@ -77,7 +77,7 @@
/* Since none of the above conditions are met let the SOC code measure the
* bootblock. This accomplishes for cases where the bootblock is treated
* in a special way (e.g. part of IFWI or located in a different CBFS). */
- if (tspi_soc_measure_bootblock(TPM_CRTM_PCR)) {
+ if (tspi_soc_measure_bootblock(CONFIG_PCR_CRTM)) {
printk(BIOS_INFO,
"TSPI: Couldn't measure bootblock into CRTM on SoC level!\n");
return VB2_ERROR_UNKNOWN;
@@ -122,7 +122,7 @@
switch (type) {
case CBFS_TYPE_MRC_CACHE:
- pcr_index = TPM_RUNTIME_DATA_PCR;
+ pcr_index = CONFIG_PCR_RUNTIME_DATA;
break;
/*
* mrc.bin is code executed on CPU, so it
@@ -132,13 +132,13 @@
case CBFS_TYPE_STAGE:
case CBFS_TYPE_SELF:
case CBFS_TYPE_FIT_PAYLOAD:
- pcr_index = TPM_CRTM_PCR;
+ pcr_index = CONFIG_PCR_CRTM;
break;
default:
if (is_runtime_data(name))
- pcr_index = TPM_RUNTIME_DATA_PCR;
+ pcr_index = CONFIG_PCR_RUNTIME_DATA;
else
- pcr_index = TPM_CRTM_PCR;
+ pcr_index = CONFIG_PCR_CRTM;
break;
}
diff --git a/src/security/tpm/tspi/crtm.h b/src/security/tpm/tspi/crtm.h
index 5cdc0e3..7084fc8 100644
--- a/src/security/tpm/tspi/crtm.h
+++ b/src/security/tpm/tspi/crtm.h
@@ -8,14 +8,6 @@
#include <types.h>
#include <vb2_sha.h>
-/* CRTM */
-#define TPM_CRTM_PCR 2
-
-/* PCR for measuring data which changes during runtime
- * e.g. CMOS, NVRAM...
- */
-#define TPM_RUNTIME_DATA_PCR 3
-
#if CONFIG(TPM_LOG_CB) && CONFIG(TPM1)
# define TPM_MEASURE_ALGO VB2_HASH_SHA1
#elif CONFIG(TPM_LOG_CB) && CONFIG(TPM2)
diff --git a/src/security/vboot/vboot_logic.c b/src/security/vboot/vboot_logic.c
index 2230b5ab..1951447 100644
--- a/src/security/vboot/vboot_logic.c
+++ b/src/security/vboot/vboot_logic.c
@@ -187,8 +187,8 @@
static uint32_t extend_pcrs(struct vb2_context *ctx)
{
- return vboot_extend_pcr(ctx, 0, BOOT_MODE_PCR) ||
- vboot_extend_pcr(ctx, 1, HWID_DIGEST_PCR);
+ return vboot_extend_pcr(ctx, CONFIG_PCR_BOOT_MODE, BOOT_MODE_PCR) ||
+ vboot_extend_pcr(ctx, CONFIG_PCR_HWID, HWID_DIGEST_PCR);
}
#define EC_EFS_BOOT_MODE_VERIFIED_RW 0x00
--
To view, visit https://review.coreboot.org/c/coreboot/+/68750
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ib3a192d902072f6f8d415c2952a36522b5bf09f9
Gerrit-Change-Number: 68750
Gerrit-PatchSet: 1
Gerrit-Owner: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com>
Gerrit-Reviewer: Christian Walter <christian.walter(a)9elements.com>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Krystian Hebel <krystian.hebel(a)3mdeb.com>
Gerrit-Reviewer: Maciej Pijanowski <maciej.pijanowski(a)3mdeb.com>
Gerrit-Reviewer: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-Reviewer: Yu-Ping Wu <yupingso(a)google.com>
Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-Attention: Maciej Pijanowski <maciej.pijanowski(a)3mdeb.com>
Gerrit-Attention: Christian Walter <christian.walter(a)9elements.com>
Gerrit-Attention: Julius Werner <jwerner(a)chromium.org>
Gerrit-Attention: Krystian Hebel <krystian.hebel(a)3mdeb.com>
Gerrit-Attention: Yu-Ping Wu <yupingso(a)google.com>
Gerrit-MessageType: newchange