coreboot-gerrit March 2024

coreboot-gerrit@coreboot.org

1 participants
3667 discussions

[S] Change in coreboot[main]: cpu/x86: Link page tables in stage if possible
by Martin L Roth (Code Review) 28 Mar '24

28 Mar '24

Martin L Roth has submitted this change. ( https://review.coreboot.org/c/coreboot/+/80337?usp=email ) ( 18 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. )Change subject: cpu/x86: Link page tables in stage if possible ...................................................................... cpu/x86: Link page tables in stage if possible When switching back and forth between 32 to 64 bit mode, for example to call a 32-bits FSP or to call the payload, new page tables in the respective stage will be linked. The advantages of this approach are: - No need to determine a good place for page tables in CBFS that does not overlap. - Works with non memory mapped flash (however all coreboot targets currently do support this) - If later stages can use their own page tables which fits better with the vboot RO/RW flow A disadvantage is that it increases the stage size. This could be improved upon by using 1G pages and generating the pages at runtime. Note: qemu cannot have the page tables in the RO boot medium and needs to relocate them at runtime. This is why keeping the existing code with page tables in CBFS is done for now. TEST: Booted to payload on google/vilbox and qemu/q35 Signed-off-by: Arthur Heymans <arthur(a)aheymans.xyz> Change-Id: Ied54b66b930187cba5fbc578a81ed5859a616562 Reviewed-on: https://review.coreboot.org/c/coreboot/+/80337 Reviewed-by: Patrick Rudolph <patrick.rudolph(a)9elements.com> Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> --- M src/arch/x86/Kconfig M src/cpu/intel/car/core2/cache_as_ram.S M src/cpu/intel/car/non-evict/cache_as_ram.S M src/cpu/intel/car/p4-netburst/cache_as_ram.S M src/cpu/x86/64bit/Makefile.mk M src/cpu/x86/64bit/entry64.inc M src/cpu/x86/64bit/mode_switch.S M src/cpu/x86/64bit/mode_switch2.S M src/cpu/x86/64bit/pt.S M src/mainboard/emulation/qemu-i440fx/Kconfig M src/mainboard/emulation/qemu-q35/Kconfig M src/soc/amd/common/block/cpu/noncar/pre_c.S M src/soc/intel/common/block/cpu/car/cache_as_ram.S 13 files changed, 28 insertions(+), 10 deletions(-) Approvals: Patrick Rudolph: Looks good to me, approved build bot (Jenkins): Verified diff --git a/src/arch/x86/Kconfig b/src/arch/x86/Kconfig index 610321f..3f97644 100644 --- a/src/arch/x86/Kconfig +++ b/src/arch/x86/Kconfig @@ -83,9 +83,13 @@ is an experimental option: do not enable unless one wants to test it and has the means to recover a system when coreboot fails to boot. +config PAGE_TABLES_IN_CBFS + bool + default n + config ARCH_X86_64_PGTBL_LOC hex "x86_64 page table location in CBFS" - depends on ARCH_BOOTBLOCK_X86_64 + depends on ARCH_BOOTBLOCK_X86_64 && PAGE_TABLES_IN_CBFS default 0xfffe9000 help The position where to place pagetables. Needs to be known at diff --git a/src/cpu/intel/car/core2/cache_as_ram.S b/src/cpu/intel/car/core2/cache_as_ram.S index 2e4d9c8..227ddf4 100644 --- a/src/cpu/intel/car/core2/cache_as_ram.S +++ b/src/cpu/intel/car/core2/cache_as_ram.S @@ -163,7 +163,7 @@ subl $4, %esp #if ENV_X86_64 - setup_longmode $(CONFIG_ARCH_X86_64_PGTBL_LOC) + setup_longmode $PM4LE movd %mm2, %rdi shlq $32, %rdi diff --git a/src/cpu/intel/car/non-evict/cache_as_ram.S b/src/cpu/intel/car/non-evict/cache_as_ram.S index 578bf03..9485cd4 100644 --- a/src/cpu/intel/car/non-evict/cache_as_ram.S +++ b/src/cpu/intel/car/non-evict/cache_as_ram.S @@ -214,7 +214,7 @@ andl $0xfffffff0, %esp #if ENV_X86_64 - setup_longmode $(CONFIG_ARCH_X86_64_PGTBL_LOC) + setup_longmode $PM4LE movd %mm2, %rdi shlq $32, %rdi diff --git a/src/cpu/intel/car/p4-netburst/cache_as_ram.S b/src/cpu/intel/car/p4-netburst/cache_as_ram.S index 32fddd6..1cb422d 100644 --- a/src/cpu/intel/car/p4-netburst/cache_as_ram.S +++ b/src/cpu/intel/car/p4-netburst/cache_as_ram.S @@ -363,7 +363,7 @@ subl $4, %esp #if ENV_X86_64 - setup_longmode $(CONFIG_ARCH_X86_64_PGTBL_LOC) + setup_longmode $PM4LE movd %mm2, %rdi shlq $32, %rdi /* BIST */ diff --git a/src/cpu/x86/64bit/Makefile.mk b/src/cpu/x86/64bit/Makefile.mk index a8dc1a2..b24e4d7 100644 --- a/src/cpu/x86/64bit/Makefile.mk +++ b/src/cpu/x86/64bit/Makefile.mk @@ -9,13 +9,15 @@ PAGETABLE_SRC := pt.S endif +all_x86-y += $(PAGETABLE_SRC) + # Add --defsym=_start=0 to suppress a linker warning. $(objcbfs)/pt: $(dir)/$(PAGETABLE_SRC) $(obj)/config.h $(CC_bootblock) $(CFLAGS_bootblock) $(CPPFLAGS_bootblock) -o $@.tmp $< -Wl,--section-start=.rodata=$(CONFIG_ARCH_X86_64_PGTBL_LOC),--defsym=_start=0 $(OBJCOPY_ramstage) -Obinary -j .rodata $@.tmp $@ rm $@.tmp -cbfs-files-y += pagetables +cbfs-files-$(CONFIG_PAGE_TABLES_IN_CBFS) += pagetables pagetables-file := $(objcbfs)/pt pagetables-type := raw pagetables-compression := none diff --git a/src/cpu/x86/64bit/entry64.inc b/src/cpu/x86/64bit/entry64.inc index 878f310..52da603 100644 --- a/src/cpu/x86/64bit/entry64.inc +++ b/src/cpu/x86/64bit/entry64.inc @@ -11,9 +11,11 @@ #if ENV_X86_64 .code32 +#if CONFIG(PAGE_TABLES_IN_CBFS) #if (CONFIG_ARCH_X86_64_PGTBL_LOC & 0xfff) > 0 #error pagetables must be 4KiB aligned! #endif +#endif #include <cpu/x86/msr.h> #if defined(__RAMSTAGE__) diff --git a/src/cpu/x86/64bit/mode_switch.S b/src/cpu/x86/64bit/mode_switch.S index 01fe003..9555cef 100644 --- a/src/cpu/x86/64bit/mode_switch.S +++ b/src/cpu/x86/64bit/mode_switch.S @@ -44,7 +44,7 @@ movl %eax, %ebx /* Preserves ebx */ - setup_longmode $(CONFIG_ARCH_X86_64_PGTBL_LOC) + setup_longmode $PM4LE /* Place return value in rax */ movl %ebx, %eax diff --git a/src/cpu/x86/64bit/mode_switch2.S b/src/cpu/x86/64bit/mode_switch2.S index 1807d2e..18c6425 100644 --- a/src/cpu/x86/64bit/mode_switch2.S +++ b/src/cpu/x86/64bit/mode_switch2.S @@ -21,7 +21,7 @@ mov %esp, %ebp /* Enter long mode, preserves ebx */ - setup_longmode $(CONFIG_ARCH_X86_64_PGTBL_LOC) + setup_longmode $PM4LE /* Align stack */ movabs $0xfffffffffffffff0, %rax diff --git a/src/cpu/x86/64bit/pt.S b/src/cpu/x86/64bit/pt.S index b105528..67e4b1b 100644 --- a/src/cpu/x86/64bit/pt.S +++ b/src/cpu/x86/64bit/pt.S @@ -18,7 +18,7 @@ #define _GEN_PAGE(a) (_PRES + _RW + _US + _PS + _A + _D + (a)) .global PM4LE -.align 32 +.align 4096 PM4LE: .quad _GEN_DIR(PDPE_table) diff --git a/src/mainboard/emulation/qemu-i440fx/Kconfig b/src/mainboard/emulation/qemu-i440fx/Kconfig index cec6f97..24dfa7a2 100644 --- a/src/mainboard/emulation/qemu-i440fx/Kconfig +++ b/src/mainboard/emulation/qemu-i440fx/Kconfig @@ -30,6 +30,11 @@ select GBB_FLAG_DISABLE_FWMP if ARCH_BOOTBLOCK_X86_64 + +config PAGE_TABLES_IN_CBFS + bool + default y + # Need to install page tables in DRAM as the virtual MMU has problems translating paging # request when the page table resides in emulated ROM. This causes undefined behaviour # when handling data requests, as well as fetching and decoding instructions diff --git a/src/mainboard/emulation/qemu-q35/Kconfig b/src/mainboard/emulation/qemu-q35/Kconfig index d68a546..11ea750 100644 --- a/src/mainboard/emulation/qemu-q35/Kconfig +++ b/src/mainboard/emulation/qemu-q35/Kconfig @@ -32,6 +32,11 @@ default "src/mainboard/\$(CONFIG_MAINBOARD_DIR)/vboot-rwab-16M.fmd" if VBOOT_SLOTS_RW_AB if ARCH_BOOTBLOCK_X86_64 + +config PAGE_TABLES_IN_CBFS + bool + default y + # Need to install page tables in DRAM as the virtual MMU has problems translating paging # request when the page table resides in emulated ROM. This causes undefined behaviour # when handling data requests, as well as fetching and decoding instructions diff --git a/src/soc/amd/common/block/cpu/noncar/pre_c.S b/src/soc/amd/common/block/cpu/noncar/pre_c.S index bb2203b..0e0be52 100644 --- a/src/soc/amd/common/block/cpu/noncar/pre_c.S +++ b/src/soc/amd/common/block/cpu/noncar/pre_c.S @@ -28,7 +28,7 @@ post_code(POSTCODE_BOOTBLOCK_PRE_C_ENTRY) #if ENV_X86_64 - setup_longmode $(CONFIG_ARCH_X86_64_PGTBL_LOC) + setup_longmode $PM4LE #endif /* Clear .bss section */ diff --git a/src/soc/intel/common/block/cpu/car/cache_as_ram.S b/src/soc/intel/common/block/cpu/car/cache_as_ram.S index c22e7d9..ba98f1b 100644 --- a/src/soc/intel/common/block/cpu/car/cache_as_ram.S +++ b/src/soc/intel/common/block/cpu/car/cache_as_ram.S @@ -280,7 +280,7 @@ andl $0xfffffff0, %esp #if ENV_X86_64 - setup_longmode $(CONFIG_ARCH_X86_64_PGTBL_LOC) + setup_longmode $PM4LE movd %mm2, %rdi shlq $32, %rdi -- To view, visit https://review.coreboot.org/c/coreboot/+/80337?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: Ied54b66b930187cba5fbc578a81ed5859a616562 Gerrit-Change-Number: 80337 Gerrit-PatchSet: 22 Gerrit-Owner: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Reviewer: Fred Reitberger <reitbergerfred(a)gmail.com> Gerrit-Reviewer: Jason Glenesk <jason.glenesk(a)gmail.com> Gerrit-Reviewer: Jérémy Compostella <jeremy.compostella(a)intel.com> Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com> Gerrit-Reviewer: Matt DeVillier <matt.devillier(a)amd.corp-partner.google.com> Gerrit-Reviewer: Patrick Rudolph <patrick.rudolph(a)9elements.com> Gerrit-Reviewer: Shuo Liu <shuo.liu(a)intel.com> Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-MessageType: merged

1 0

[S] Change in coreboot[main]: soc/amd/noncar: Increase bootblock size from 64K to 128K
by Martin L Roth (Code Review) 28 Mar '24

28 Mar '24

Martin L Roth has submitted this change. ( https://review.coreboot.org/c/coreboot/+/80348?usp=email ) ( 10 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. )Change subject: soc/amd/noncar: Increase bootblock size from 64K to 128K ...................................................................... soc/amd/noncar: Increase bootblock size from 64K to 128K When linking in page tables more place is needed. Size the bootblock is top aligned, this has no impact the final size for existing setups. Signed-off-by: Arthur Heymans <arthur(a)aheymans.xyz> Change-Id: I23f176d63d3c303b13331a77ad5ac6c7a19073d3 Reviewed-on: https://review.coreboot.org/c/coreboot/+/80348 Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> Reviewed-by: Martin L Roth <gaumless(a)gmail.com> --- M src/soc/amd/cezanne/Kconfig M src/soc/amd/genoa_poc/Kconfig M src/soc/amd/glinda/Kconfig M src/soc/amd/mendocino/Kconfig M src/soc/amd/phoenix/Kconfig M src/soc/amd/picasso/Kconfig 6 files changed, 18 insertions(+), 18 deletions(-) Approvals: Martin L Roth: Looks good to me, approved build bot (Jenkins): Verified diff --git a/src/soc/amd/cezanne/Kconfig b/src/soc/amd/cezanne/Kconfig index 2ebf6bc..abeaece 100644 --- a/src/soc/amd/cezanne/Kconfig +++ b/src/soc/amd/cezanne/Kconfig @@ -175,7 +175,7 @@ config C_ENV_BOOTBLOCK_SIZE hex - default 0x10000 + default 0x20000 help Sets the size of the bootblock stage that should be loaded in DRAM. This variable controls the DRAM allocation size in linker script @@ -183,13 +183,13 @@ config ROMSTAGE_ADDR hex - default 0x2040000 + default 0x2050000 help Sets the address in DRAM where romstage should be loaded. config ROMSTAGE_SIZE hex - default 0x80000 + default 0x70000 help Sets the size of DRAM allocation for romstage in linker script. diff --git a/src/soc/amd/genoa_poc/Kconfig b/src/soc/amd/genoa_poc/Kconfig index 2460323..05590f5 100644 --- a/src/soc/amd/genoa_poc/Kconfig +++ b/src/soc/amd/genoa_poc/Kconfig @@ -98,7 +98,7 @@ config C_ENV_BOOTBLOCK_SIZE hex - default 0x10000 + default 0x20000 help Sets the size of the bootblock stage that should be loaded in DRAM. This variable controls the DRAM allocation size in linker script @@ -106,13 +106,13 @@ config ROMSTAGE_ADDR hex - default 0x7040000 + default 0x7050000 help Sets the address in DRAM where romstage should be loaded. config ROMSTAGE_SIZE hex - default 0x80000 + default 0x70000 help Sets the size of DRAM allocation for romstage in linker script. diff --git a/src/soc/amd/glinda/Kconfig b/src/soc/amd/glinda/Kconfig index d529002..68a1b6f 100644 --- a/src/soc/amd/glinda/Kconfig +++ b/src/soc/amd/glinda/Kconfig @@ -162,7 +162,7 @@ config C_ENV_BOOTBLOCK_SIZE hex - default 0x10000 + default 0x20000 help Sets the size of the bootblock stage that should be loaded in DRAM. This variable controls the DRAM allocation size in linker script @@ -170,13 +170,13 @@ config ROMSTAGE_ADDR hex - default 0x2040000 + default 0x2050000 help Sets the address in DRAM where romstage should be loaded. config ROMSTAGE_SIZE hex - default 0x80000 + default 0x70000 help Sets the size of DRAM allocation for romstage in linker script. diff --git a/src/soc/amd/mendocino/Kconfig b/src/soc/amd/mendocino/Kconfig index f6305ee..ee6c968 100644 --- a/src/soc/amd/mendocino/Kconfig +++ b/src/soc/amd/mendocino/Kconfig @@ -195,7 +195,7 @@ config C_ENV_BOOTBLOCK_SIZE hex - default 0x10000 + default 0x20000 help Sets the size of the bootblock stage that should be loaded in DRAM. This variable controls the DRAM allocation size in linker script @@ -203,13 +203,13 @@ config ROMSTAGE_ADDR hex - default 0x2040000 + default 0x2050000 help Sets the address in DRAM where romstage should be loaded. config ROMSTAGE_SIZE hex - default 0x80000 + default 0x70000 help Sets the size of DRAM allocation for romstage in linker script. diff --git a/src/soc/amd/phoenix/Kconfig b/src/soc/amd/phoenix/Kconfig index 75777dc..9a2424e 100644 --- a/src/soc/amd/phoenix/Kconfig +++ b/src/soc/amd/phoenix/Kconfig @@ -175,7 +175,7 @@ config C_ENV_BOOTBLOCK_SIZE hex - default 0x10000 + default 0x20000 help Sets the size of the bootblock stage that should be loaded in DRAM. This variable controls the DRAM allocation size in linker script @@ -183,13 +183,13 @@ config ROMSTAGE_ADDR hex - default 0x2060000 + default 0x2070000 help Sets the address in DRAM where romstage should be loaded. config ROMSTAGE_SIZE hex - default 0x80000 + default 0x70000 help Sets the size of DRAM allocation for romstage in linker script. diff --git a/src/soc/amd/picasso/Kconfig b/src/soc/amd/picasso/Kconfig index 0bb6f40..864643f 100644 --- a/src/soc/amd/picasso/Kconfig +++ b/src/soc/amd/picasso/Kconfig @@ -165,7 +165,7 @@ config C_ENV_BOOTBLOCK_SIZE hex - default 0x10000 + default 0x20000 help Sets the size of the bootblock stage that should be loaded in DRAM. This variable controls the DRAM allocation size in linker script @@ -173,13 +173,13 @@ config ROMSTAGE_ADDR hex - default 0x2040000 + default 0x2050000 help Sets the address in DRAM where romstage should be loaded. config ROMSTAGE_SIZE hex - default 0x80000 + default 0x70000 help Sets the size of DRAM allocation for romstage in linker script. -- To view, visit https://review.coreboot.org/c/coreboot/+/80348?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I23f176d63d3c303b13331a77ad5ac6c7a19073d3 Gerrit-Change-Number: 80348 Gerrit-PatchSet: 13 Gerrit-Owner: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Reviewer: Fred Reitberger <reitbergerfred(a)gmail.com> Gerrit-Reviewer: Jason Glenesk <jason.glenesk(a)gmail.com> Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com> Gerrit-Reviewer: Matt DeVillier <matt.devillier(a)amd.corp-partner.google.com> Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-MessageType: merged

1 0

[S] Change in coreboot[main]: soc/amd/non_car/memlayout_x86.ld: Top align the code
by Martin L Roth (Code Review) 28 Mar '24

28 Mar '24

Martin L Roth has submitted this change. ( https://review.coreboot.org/c/coreboot/+/81433?usp=email ) Change subject: soc/amd/non_car/memlayout_x86.ld: Top align the code ...................................................................... soc/amd/non_car/memlayout_x86.ld: Top align the code This does the following: - Top align the bootblock so that the only the memory needed gets used. This might slightly reduce the time the PSP needs to decompress the bootblock in memory - Use a memory directive to assert that the 16bit code is inside the top 64K segment - Use the program counter less. While the BDF linker is happy about running the program counter backwards, LLD is not. There is no downside to this. - Use a symbol rather that the program counter for sections. LLD gets confused when (.) is used along with '<': it places the section at the start of the memory region, rather than at the program counter. Using a variable name works around this. - Use a 'last_byte' section to make sure the first instruction is at 0xfff0. Both the BDF and the LLD linkers seems to work well with this code TEST: Both BFD and LLD are able to link the bootblock Change-Id: I18bdf262f9c358aa01795b11efcb863686edc79c Signed-off-by: Arthur Heymans <arthur(a)aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/81433 Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> Reviewed-by: Martin L Roth <gaumless(a)gmail.com> --- M src/soc/amd/common/block/cpu/noncar/memlayout_x86.ld 1 file changed, 22 insertions(+), 12 deletions(-) Approvals: build bot (Jenkins): Verified Martin L Roth: Looks good to me, approved diff --git a/src/soc/amd/common/block/cpu/noncar/memlayout_x86.ld b/src/soc/amd/common/block/cpu/noncar/memlayout_x86.ld index 9eb9d21..3c596f4 100644 --- a/src/soc/amd/common/block/cpu/noncar/memlayout_x86.ld +++ b/src/soc/amd/common/block/cpu/noncar/memlayout_x86.ld @@ -95,7 +95,6 @@ PSP_SHAREDMEM_DRAM_END(CONFIG_PSP_SHAREDMEM_BASE + CONFIG_PSP_SHAREDMEM_SIZE) #endif _ = ASSERT(BOOTBLOCK_END == ((BOOTBLOCK_END + 0xFFFF) & 0xFFFF0000), "Bootblock end must be 16 bit aligned"); - BOOTBLOCK(BOOTBLOCK_ADDR, CONFIG_C_ENV_BOOTBLOCK_SIZE) ROMSTAGE(CONFIG_ROMSTAGE_ADDR, CONFIG_ROMSTAGE_SIZE) #if CONFIG(PLATFORM_USES_FSP2_0) @@ -124,19 +123,29 @@ gdtptr_offset = gdtptr & 0xffff; nullidt_offset = nullidt & 0xffff; +MEMORY +{ + /* Make sure all the 16bit code is in the same 64K segment as the reset vector */ + resetsection (rwx) : ORIGIN = BOOTBLOCK_END - 64K, LENGTH = 64K +} + SECTIONS { - /* Trigger an error if I have an unusable start address */ - _TOO_LOW = _X86_RESET_VECTOR - 0xfff0; - _bogus = ASSERT(_start16bit >= _TOO_LOW, "_start16bit too low. Please report."); + /* Page tables need to be at a 4K boundary so align the bootblock downwards */ + . = (BOOTBLOCK_TOP - PROGRAM_SZ) & ~(4096 - 1); + _bootblock = .; + + INCLUDE "bootblock/lib/program.ld" + + PROGRAM_SZ = SIZEOF(.text) + SIZEOF(.bss) + SIZEOF(.data); . = _X86_RESET_VECTOR - EARLYASM_SZ; . = ALIGN(16); BOOTBLOCK_TOP = .; - .init (.) : { + .init BOOTBLOCK_TOP : { *(.init._start); *(.init); *(.init.*); - } + } >resetsection /* * Allocation reserves extra space here. Alignment requirements @@ -145,13 +154,14 @@ */ EARLYASM_SZ = SIZEOF(.init) + 16; - . = BOOTBLOCK_END - 0x10; - _X86_RESET_VECTOR = .; + _X86_RESET_VECTOR = BOOTBLOCK_END - 0x10; _bogus = ASSERT((_X86_RESET_VECTOR & 0xffff) == 0xfff0, "IP needs to be 0xfff0"); - .reset . : { + .reset (_X86_RESET_VECTOR) : { *(.reset); - . = 15; - BYTE(0x00); - } + } >resetsection + .last_byte (BOOTBLOCK_END - 1) : { + BYTE(0xff); + } >resetsection + _ebootblock = BOOTBLOCK_END; } #endif /* ENV_BOOTBLOCK */ -- To view, visit https://review.coreboot.org/c/coreboot/+/81433?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I18bdf262f9c358aa01795b11efcb863686edc79c Gerrit-Change-Number: 81433 Gerrit-PatchSet: 3 Gerrit-Owner: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Reviewer: Fred Reitberger <reitbergerfred(a)gmail.com> Gerrit-Reviewer: Jason Glenesk <jason.glenesk(a)gmail.com> Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com> Gerrit-Reviewer: Martin Roth <martin.roth(a)amd.corp-partner.google.com> Gerrit-Reviewer: Matt DeVillier <matt.devillier(a)amd.corp-partner.google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-MessageType: merged

1 0

[XS] Change in coreboot[main]: mb/google/brox: Enable SAGv
by Paul Menzel (Code Review) 28 Mar '24

28 Mar '24

Attention is currently required from: Ashish Kumar Mishra, Shelley Chen. Paul Menzel has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/81556?usp=email ) Change subject: mb/google/brox: Enable SAGv ...................................................................... Patch Set 1: (1 comment) Commit Message: https://review.coreboot.org/c/coreboot/+/81556/comment/1d2fb03b_2a03a769 : PS1, Line 13: TEST=Boot brox with SAGv enabled What changed? How do you check that enabling was successful? -- To view, visit https://review.coreboot.org/c/coreboot/+/81556?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I80c44e7df1d75732c6982b27e44ecd6060b1b3f1 Gerrit-Change-Number: 81556 Gerrit-PatchSet: 1 Gerrit-Owner: Ashish Kumar Mishra <ashish.k.mishra(a)intel.com> Gerrit-Reviewer: Shelley Chen <shchen(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Shelley Chen <shchen(a)google.com> Gerrit-Attention: Ashish Kumar Mishra <ashish.k.mishra(a)intel.com> Gerrit-Comment-Date: Thu, 28 Mar 2024 15:20:15 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

[XL] Change in coreboot[main]: security/vboot: extract secdata_tpm{1,2}.c
by Martin L Roth (Code Review) 28 Mar '24

28 Mar '24

Martin L Roth has submitted this change. ( https://review.coreboot.org/c/coreboot/+/81415?usp=email ) Change subject: security/vboot: extract secdata_tpm{1,2}.c ...................................................................... security/vboot: extract secdata_tpm{1,2}.c Most of the original secdata_tpm.c was TPM2-specific implementation. Just moving the code around, with trivial tweaks: - drop now unnecessary #ifdef directives from _factory_initialize_tpm() - drop leading underscore from _factory_initialize_tpm{1,2}() (external identifiers should not start with an underscore in C) - drop unused <security/vboot/tpm_common.h> include and sub-includes of tss.h which should be considered its part (so this isn't an indirect inclusion) - fixed formatting of RETURN_ON_FAILURE() which didn't have slashes aligned no matter what tab width was used Change-Id: I0090b748d7d3b2d76a941b87b5885682fd81c4fc Signed-off-by: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/81415 Reviewed-by: Julius Werner <jwerner(a)chromium.org> Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> --- M src/security/vboot/Makefile.mk M src/security/vboot/secdata_tpm.c A src/security/vboot/secdata_tpm1.c A src/security/vboot/secdata_tpm2.c A src/security/vboot/secdata_tpm_private.h 5 files changed, 572 insertions(+), 549 deletions(-) Approvals: build bot (Jenkins): Verified Julius Werner: Looks good to me, approved diff --git a/src/security/vboot/Makefile.mk b/src/security/vboot/Makefile.mk index 23271ea..48a6c9d 100644 --- a/src/security/vboot/Makefile.mk +++ b/src/security/vboot/Makefile.mk @@ -118,6 +118,14 @@ verstage-y += secdata_tpm.c romstage-y += secdata_tpm.c ramstage-y += secdata_tpm.c + +verstage-$(CONFIG_TPM1) += secdata_tpm1.c +romstage-$(CONFIG_TPM1) += secdata_tpm1.c +ramstage-$(CONFIG_TPM1) += secdata_tpm1.c + +verstage-$(CONFIG_TPM2) += secdata_tpm2.c +romstage-$(CONFIG_TPM2) += secdata_tpm2.c +ramstage-$(CONFIG_TPM2) += secdata_tpm2.c endif verstage-$(CONFIG_TPM) += tpm_common.c diff --git a/src/security/vboot/secdata_tpm.c b/src/security/vboot/secdata_tpm.c index f60a5e2..8714dd8 100644 --- a/src/security/vboot/secdata_tpm.c +++ b/src/security/vboot/secdata_tpm.c @@ -5,28 +5,12 @@ * stored in the TPM NVRAM. */ -#include <security/vboot/antirollback.h> -#include <security/vboot/tpm_common.h> -#include <security/tpm/tspi.h> -#include <security/tpm/tss.h> -#include <security/tpm/tss/tcg-1.2/tss_structures.h> -#include <security/tpm/tss/tcg-2.0/tss_structures.h> -#include <vb2_api.h> #include <console/console.h> +#include <security/tpm/tspi.h> +#include <security/vboot/antirollback.h> +#include <vb2_api.h> -#define VBDEBUG(format, args...) \ - printk(BIOS_INFO, "%s():%d: " format, __func__, __LINE__, ## args) - -#define RETURN_ON_FAILURE(tpm_cmd) do { \ - tpm_result_t rc_; \ - if ((rc_ = (tpm_cmd)) != TPM_SUCCESS) { \ - VBDEBUG("Antirollback: %08x returned by " #tpm_cmd \ - "\n", (tpm_result_t)rc_); \ - return rc_; \ - } \ - } while (0) - -static tpm_result_t safe_write(uint32_t index, const void *data, uint32_t length); +#include "secdata_tpm_private.h" tpm_result_t antirollback_read_space_kernel(struct vb2_context *ctx) { @@ -69,529 +53,7 @@ return TPM_SUCCESS; } -#if CONFIG(TPM2) - -static tpm_result_t read_space_mrc_hash(uint32_t index, uint8_t *data) -{ - RETURN_ON_FAILURE(tlcl_read(index, data, - HASH_NV_SIZE)); - return TPM_SUCCESS; -} - -/* - * This is used to initialize the TPM space for recovery hash after defining - * it. Since there is no data available to calculate hash at the point where TPM - * space is defined, initialize it to all 0s. - */ -static const uint8_t mrc_hash_data[HASH_NV_SIZE] = { }; - -/* - * Different sets of NVRAM space attributes apply to the "ro" spaces, - * i.e. those which should not be possible to delete or modify once - * the RO exits, and the rest of the NVRAM spaces. - */ -static const TPMA_NV ro_space_attributes = { - .TPMA_NV_PPWRITE = 1, - .TPMA_NV_AUTHREAD = 1, - .TPMA_NV_PPREAD = 1, - .TPMA_NV_PLATFORMCREATE = 1, - .TPMA_NV_WRITE_STCLEAR = 1, - .TPMA_NV_POLICY_DELETE = 1, -}; - -static const TPMA_NV rw_space_attributes = { - .TPMA_NV_PPWRITE = 1, - .TPMA_NV_AUTHREAD = 1, - .TPMA_NV_PPREAD = 1, - .TPMA_NV_PLATFORMCREATE = 1, - .TPMA_NV_WRITE_STCLEAR = 1, -}; - -static const TPMA_NV rw_auth_space_attributes = { - .TPMA_NV_AUTHWRITE = 1, - .TPMA_NV_AUTHREAD = 1, - .TPMA_NV_NO_DA = 1, - .TPMA_NV_PPREAD = 1, - .TPMA_NV_PPWRITE = 1, - .TPMA_NV_PLATFORMCREATE = 1, - .TPMA_NV_WRITE_STCLEAR = 1, - .TPMA_NV_POLICY_DELETE = 1, -}; - -static const TPMA_NV fwmp_attr = { - .TPMA_NV_PLATFORMCREATE = 1, - .TPMA_NV_OWNERWRITE = 1, - .TPMA_NV_AUTHREAD = 1, - .TPMA_NV_PPREAD = 1, - .TPMA_NV_PPWRITE = 1, -}; - -/* Attributes for spaces that enable zero-touch enrollment (ZTE) */ -static const TPMA_NV zte_attr = { - .TPMA_NV_PLATFORMCREATE = 1, - .TPMA_NV_WRITEDEFINE = 1, - .TPMA_NV_AUTHWRITE = 1, - .TPMA_NV_AUTHREAD = 1, - .TPMA_NV_PPWRITE = 1, - .TPMA_NV_PPREAD = 1, - .TPMA_NV_NO_DA = 1, - .TPMA_NV_POLICY_DELETE = 1, -}; - -static const TPMA_NV zte_rma_bytes_attr = { - .TPMA_NV_PLATFORMCREATE = 1, - .TPMA_NV_BITS = 1, - .TPMA_NV_AUTHWRITE = 1, - .TPMA_NV_AUTHREAD = 1, - .TPMA_NV_PPWRITE = 1, - .TPMA_NV_PPREAD = 1, - .TPMA_NV_NO_DA = 1, - .TPMA_NV_POLICY_DELETE = 1, -}; - -static const TPMA_NV rw_orderly_counter_attributes = { - .TPMA_NV_COUNTER = 1, - .TPMA_NV_ORDERLY = 1, - .TPMA_NV_AUTHREAD = 1, - .TPMA_NV_AUTHWRITE = 1, - .TPMA_NV_PLATFORMCREATE = 1, - .TPMA_NV_WRITE_STCLEAR = 1, - .TPMA_NV_PPREAD = 1, - .TPMA_NV_PPWRITE = 1, - .TPMA_NV_NO_DA = 1, -}; - -/* - * This policy digest was obtained using TPM2_PolicyOR on 3 digests - * corresponding to a sequence of - * -) TPM2_PolicyCommandCode(TPM_CC_NV_UndefineSpaceSpecial), - * -) TPM2_PolicyPCR(PCR0, <extended_value>). - * where <extended value> is - * 1) all zeros = initial, unextended state: - * - Value to extend to initial PCR0: - * <none> - * - Resulting PCR0: - * 0000000000000000000000000000000000000000000000000000000000000000 - * - Policy digest for PolicyCommandCode + PolicyPCR: - * 4B44FC4192DB5AD7167E0135708FD374890A06BFB56317DF01F24F2226542A3F - * 2) result of extending (SHA1(0x00|0x01|0x00) | 00s to SHA256 size) - * - Value to extend to initial PCR0: - * 62571891215b4efc1ceab744ce59dd0b66ea6f73000000000000000000000000 - * - Resulting PCR0: - * 9F9EA866D3F34FE3A3112AE9CB1FBABC6FFE8CD261D42493BC6842A9E4F93B3D - * - Policy digest for PolicyCommandCode + PolicyPCR: - * CB5C8014E27A5F7586AAE42DB4F9776A977BCBC952CA61E33609DA2B2C329418 - * 3) result of extending (SHA1(0x01|0x01|0x00) | 00s to SHA256 size) - * - Value to extend to initial PCR0: - * 47ec8d98366433dc002e7721c9e37d5067547937000000000000000000000000 - * - Resulting PCR0: - * 2A7580E5DA289546F4D2E0509CC6DE155EA131818954D36D49E027FD42B8C8F8 - * - Policy digest for PolicyCommandCode + PolicyPCR: - * E6EF4F0296AC3EF0F53906480985B1BE8058E0E517E5F74A5B8A415EFE339D87 - * Values #2 and #3 correspond to two forms of recovery mode as extended by - * vb2api_get_pcr_digest(). - * As a result, the digest allows deleting the space with UndefineSpaceSpecial - * at early RO stages (before extending PCR0) or from recovery mode. - */ -static const uint8_t pcr0_allowed_policy[] = { - 0x44, 0x44, 0x79, 0x00, 0xCB, 0xB8, 0x3F, 0x5B, 0x15, 0x76, 0x56, - 0x50, 0xEF, 0x96, 0x98, 0x0A, 0x2B, 0x96, 0x6E, 0xA9, 0x09, 0x04, - 0x4A, 0x01, 0xB8, 0x5F, 0xA5, 0x4A, 0x96, 0xFC, 0x59, 0x84}; - -static const uint8_t unsatisfiable_policy[VB2_SHA256_DIGEST_SIZE] = - "hmwhat if RBR beat merc in 2021"; - -static uint32_t define_space(const char *name, uint32_t index, uint32_t length, - const TPMA_NV nv_attributes, - const uint8_t *nv_policy, size_t nv_policy_size) -{ - tpm_result_t rc; - - rc = tlcl2_define_space(index, length, nv_attributes, nv_policy, nv_policy_size); - if (rc == TPM_CB_NV_DEFINED) { - /* - * Continue with writing: it may be defined, but not written - * to. In that case a subsequent tlcl_read() would still return - * TPM_BADINDEX on TPM 2.0. The cases when some non-firmware - * space is defined while the firmware space is not there - * should be rare (interrupted initialization), so no big harm - * in writing once again even if it was written already. - */ - VBDEBUG("%s: %s space already exists\n", __func__, name); - rc = TPM_SUCCESS; - } - - return rc; -} - -static tpm_result_t setup_space(const char *name, uint32_t index, const void *data, - uint32_t length, const TPMA_NV nv_attributes, - const uint8_t *nv_policy, size_t nv_policy_size) -{ - tpm_result_t rc; - - rc = define_space(name, index, length, nv_attributes, nv_policy, - nv_policy_size); - if (rc != TPM_SUCCESS) - return rc; - - return safe_write(index, data, length); -} - -static tpm_result_t setup_firmware_space(struct vb2_context *ctx) -{ - uint32_t firmware_space_size = vb2api_secdata_firmware_create(ctx); - - return setup_space("firmware", FIRMWARE_NV_INDEX, - ctx->secdata_firmware, firmware_space_size, - ro_space_attributes, pcr0_allowed_policy, - sizeof(pcr0_allowed_policy)); -} - -static tpm_result_t setup_fwmp_space(struct vb2_context *ctx) -{ - uint32_t fwmp_space_size = vb2api_secdata_fwmp_create(ctx); - - return setup_space("FWMP", FWMP_NV_INDEX, ctx->secdata_fwmp, fwmp_space_size, - fwmp_attr, NULL, 0); -} - -static tpm_result_t setup_kernel_space(struct vb2_context *ctx) -{ - uint32_t kernel_space_size = vb2api_secdata_kernel_create(ctx); - - return setup_space("kernel", KERNEL_NV_INDEX, ctx->secdata_kernel, - kernel_space_size, rw_space_attributes, NULL, 0); -} - -static tpm_result_t set_mrc_hash_space(uint32_t index, const uint8_t *data) -{ - if (index == MRC_REC_HASH_NV_INDEX) { - return setup_space("RO MRC Hash", index, data, HASH_NV_SIZE, - ro_space_attributes, pcr0_allowed_policy, - sizeof(pcr0_allowed_policy)); - } else { - return setup_space("RW MRC Hash", index, data, HASH_NV_SIZE, - rw_space_attributes, NULL, 0); - } -} - -/** - * Set up the Zero-Touch Enrollment(ZTE) related spaces. - * - * These spaces are not used by firmware, but we do need to initialize them. - */ -static tpm_result_t setup_zte_spaces(void) -{ - tpm_result_t rc; - uint64_t rma_bytes_counter_default = 0; - uint8_t rma_sn_bits_default[16]; - uint8_t board_id_default[12]; - - /* Initialize defaults: Board ID and RMA+SN Bits must be initialized - to all 0xFFs. */ - memset(rma_sn_bits_default, 0xFF, ARRAY_SIZE(rma_sn_bits_default)); - memset(board_id_default, 0xFF, ARRAY_SIZE(board_id_default)); - - /* Set up RMA + SN Bits */ - rc = setup_space("RMA + SN Bits", ZTE_RMA_SN_BITS_INDEX, - rma_sn_bits_default, sizeof(rma_sn_bits_default), - zte_attr, - unsatisfiable_policy, sizeof(unsatisfiable_policy)); - if (rc != TPM_SUCCESS) { - VBDEBUG("%s: Failed to set up RMA + SN Bits space with error %#x\n", __func__, rc); - return rc; - } - - rc = setup_space("Board ID", ZTE_BOARD_ID_NV_INDEX, - board_id_default, sizeof(board_id_default), - zte_attr, - unsatisfiable_policy, sizeof(unsatisfiable_policy)); - if (rc != TPM_SUCCESS) { - VBDEBUG("%s: Failed to set up Board ID space with error %#x\n", __func__, rc); - return rc; - } - - /* Set up RMA Bytes counter */ - rc = define_space("RMA Bytes Counter", ZTE_RMA_BYTES_COUNTER_INDEX, - sizeof(rma_bytes_counter_default), - zte_rma_bytes_attr, - unsatisfiable_policy, sizeof(unsatisfiable_policy)); - if (rc != TPM_SUCCESS) { - VBDEBUG("%s: Failed to define RMA Bytes space with error %#x\n", __func__, rc); - return rc; - } - - /* - * Since the RMA counter has the BITS attribute, we need to call - * TPM2_NV_SetBits() in order to initialize it. - */ - rc = tlcl2_set_bits(ZTE_RMA_BYTES_COUNTER_INDEX, rma_bytes_counter_default); - if (rc != TPM_SUCCESS) { - VBDEBUG("%s: Failed to init RMA Bytes counter space wit error %#x\n", - __func__, rc); - return rc; - } - - return rc; -} - -/* - * Set up enterprise rollback space. - * - * This space is not used by firmware but needs to survive owner clear. Thus, it - * needs to be created here. - */ -static tpm_result_t enterprise_rollback_create_space(void) -{ - uint8_t rollback_space_default[32] = {0}; - - return setup_space("Enterprise Rollback Space", - ENT_ROLLBACK_SPACE_INDEX, rollback_space_default, - sizeof(rollback_space_default), rw_auth_space_attributes, - unsatisfiable_policy, sizeof(unsatisfiable_policy)); -} - -static tpm_result_t setup_widevine_counter_spaces(void) -{ - uint32_t index; - tpm_result_t rc; - - for (index = 0; index < NUM_WIDEVINE_COUNTERS; index++) { - rc = define_space(WIDEVINE_COUNTER_NAME, - WIDEVINE_COUNTER_NV_INDEX(index), - WIDEVINE_COUNTER_SIZE, - rw_orderly_counter_attributes, - NULL, - 0); - if (rc != TPM_SUCCESS) - return rc; - } - return rc; -} - -static tpm_result_t _factory_initialize_tpm2(struct vb2_context *ctx) -{ - RETURN_ON_FAILURE(tlcl_force_clear()); - - /* - * Of all NVRAM spaces defined by this function the firmware space - * must be defined last, because its existence is considered an - * indication that TPM factory initialization was successfully - * completed. - */ - RETURN_ON_FAILURE(setup_kernel_space(ctx)); - - /* - * Define and set rec hash space, if available. No need to - * create the RW hash space because we will definitely boot - * once in normal mode before shipping, meaning that the space - * will get created with correct permissions while still in - * our hands. - */ - if (CONFIG(VBOOT_HAS_REC_HASH_SPACE)) - RETURN_ON_FAILURE(set_mrc_hash_space(MRC_REC_HASH_NV_INDEX, mrc_hash_data)); - - /* Define and write firmware management parameters space. */ - RETURN_ON_FAILURE(setup_fwmp_space(ctx)); - - /* - * Define and write zero-touch enrollment (ZTE) spaces. For ChromeOS devices with - * Google TPM, these are set up elsewhere via TPM vendor commands. - */ - if (CONFIG(CHROMEOS) && !(CONFIG(TPM_GOOGLE))) - RETURN_ON_FAILURE(setup_zte_spaces()); - - /* - * On TPM 2.0, create a space that survives TPM clear. This allows to - * securely lock data during enterprise rollback by binding to this - * space's value. - */ - if (CONFIG(CHROMEOS)) - RETURN_ON_FAILURE(enterprise_rollback_create_space()); - - /* Define widevine counter space. No need to increment/write to the secure counters - and are expected to be incremented during the first use. */ - if (CONFIG(VBOOT_DEFINE_WIDEVINE_COUNTERS)) - RETURN_ON_FAILURE(setup_widevine_counter_spaces()); - - RETURN_ON_FAILURE(setup_firmware_space(ctx)); - - return TPM_SUCCESS; -} - -tpm_result_t antirollback_read_space_mrc_hash(uint32_t index, uint8_t *data, uint32_t size) -{ - if (size != HASH_NV_SIZE) { - VBDEBUG("TPM: Incorrect buffer size for hash idx %#x. " - "(Expected=%#x Actual=%#x).\n", index, HASH_NV_SIZE, - size); - return TPM_CB_READ_FAILURE; - } - return read_space_mrc_hash(index, data); -} - -tpm_result_t antirollback_write_space_mrc_hash(uint32_t index, const uint8_t *data, uint32_t size) -{ - uint8_t spc_data[HASH_NV_SIZE]; - tpm_result_t rc; - - if (size != HASH_NV_SIZE) { - VBDEBUG("TPM: Incorrect buffer size for hash idx %#x. " - "(Expected=%#x Actual=%#x).\n", index, HASH_NV_SIZE, - size); - return TPM_CB_WRITE_FAILURE; - } - - rc = read_space_mrc_hash(index, spc_data); - if (rc == TPM_BADINDEX) { - /* - * If space is not defined already for hash, define - * new space. - */ - VBDEBUG("TPM: Initializing hash space.\n"); - return set_mrc_hash_space(index, data); - } - - if (rc != TPM_SUCCESS) - return rc; - - return safe_write(index, data, size); -} - -tpm_result_t antirollback_lock_space_mrc_hash(uint32_t index) -{ - return tlcl2_lock_nv_write(index); -} - -static tpm_result_t read_space_vbios_hash(uint8_t *data) -{ - RETURN_ON_FAILURE(tlcl_read(VBIOS_CACHE_NV_INDEX, data, HASH_NV_SIZE)); - return TPM_SUCCESS; -} - -tpm_result_t antirollback_read_space_vbios_hash(uint8_t *data, uint32_t size) -{ - if (size != HASH_NV_SIZE) { - VBDEBUG("TPM: Incorrect buffer size for hash idx %#x. " - "(Expected=%#x Actual=%#x).\n", VBIOS_CACHE_NV_INDEX, HASH_NV_SIZE, - size); - return TPM_CB_READ_FAILURE; - } - return read_space_vbios_hash(data); -} - -tpm_result_t antirollback_write_space_vbios_hash(const uint8_t *data, uint32_t size) -{ - uint8_t spc_data[HASH_NV_SIZE]; - tpm_result_t rc; - - if (size != HASH_NV_SIZE) { - VBDEBUG("TPM: Incorrect buffer size for hash idx %#x. " - "(Expected=%#x Actual=%#x).\n", VBIOS_CACHE_NV_INDEX, HASH_NV_SIZE, - size); - return TPM_CB_WRITE_FAILURE; - } - - rc = read_space_vbios_hash(spc_data); - if (rc == TPM_BADINDEX) { - /* - * If space is not defined already for hash, define - * new space. - */ - VBDEBUG("TPM: Initializing hash space.\n"); - return setup_space("VBIOS Cache Hash", VBIOS_CACHE_NV_INDEX, data, HASH_NV_SIZE, - rw_space_attributes, NULL, 0); - } - - if (rc != TPM_SUCCESS) - return rc; - - return safe_write(VBIOS_CACHE_NV_INDEX, data, size); -} - -#endif /* CONFIG(TPM2) */ - -#if CONFIG(TPM1) - -/** - * Similarly to safe_write(), this ensures we don't fail a DefineSpace because - * we hit the TPM write limit. This is even less likely to happen than with - * writes because we only define spaces once at initialization, but we'd - * rather be paranoid about this. - */ -static tpm_result_t safe_define_space(uint32_t index, uint32_t perm, uint32_t size) -{ - tpm_result_t rc = tlcl1_define_space(index, perm, size); - if (rc == TPM_MAXNVWRITES) { - RETURN_ON_FAILURE(tpm_clear_and_reenable()); - return tlcl1_define_space(index, perm, size); - } else { - return rc; - } -} - -static tpm_result_t _factory_initialize_tpm1(struct vb2_context *ctx) -{ - TPM_PERMANENT_FLAGS pflags; - tpm_result_t rc; - - vb2api_secdata_firmware_create(ctx); - vb2api_secdata_kernel_create_v0(ctx); - - rc = tlcl1_get_permanent_flags(&pflags); - if (rc != TPM_SUCCESS) - return rc; - - /* - * TPM may come from the factory without physical presence finalized. - * Fix if necessary. - */ - VBDEBUG("TPM: physicalPresenceLifetimeLock=%d\n", - pflags.physicalPresenceLifetimeLock); - if (!pflags.physicalPresenceLifetimeLock) { - VBDEBUG("TPM: Finalizing physical presence\n"); - RETURN_ON_FAILURE(tlcl_finalize_physical_presence()); - } - - /* - * The TPM will not enforce the NV authorization restrictions until the - * execution of a TPM_NV_DefineSpace with the handle of - * TPM_NV_INDEX_LOCK. Here we create that space if it doesn't already - * exist. */ - VBDEBUG("TPM: nvLocked=%d\n", pflags.nvLocked); - if (!pflags.nvLocked) { - VBDEBUG("TPM: Enabling NV locking\n"); - RETURN_ON_FAILURE(tlcl1_set_nv_locked()); - } - - /* Clear TPM owner, in case the TPM is already owned for some reason. */ - VBDEBUG("TPM: Clearing owner\n"); - RETURN_ON_FAILURE(tpm_clear_and_reenable()); - - /* Define and write secdata_kernel space. */ - RETURN_ON_FAILURE(safe_define_space(KERNEL_NV_INDEX, - TPM_NV_PER_PPWRITE, - VB2_SECDATA_KERNEL_SIZE_V02)); - RETURN_ON_FAILURE(safe_write(KERNEL_NV_INDEX, - ctx->secdata_kernel, - VB2_SECDATA_KERNEL_SIZE_V02)); - - /* Define and write secdata_firmware space. */ - RETURN_ON_FAILURE(safe_define_space(FIRMWARE_NV_INDEX, - TPM_NV_PER_GLOBALLOCK | - TPM_NV_PER_PPWRITE, - VB2_SECDATA_FIRMWARE_SIZE)); - RETURN_ON_FAILURE(safe_write(FIRMWARE_NV_INDEX, - ctx->secdata_firmware, - VB2_SECDATA_FIRMWARE_SIZE)); - - return TPM_SUCCESS; -} - -#endif /* CONFIG(TPM1) */ - -static tpm_result_t safe_write(uint32_t index, const void *data, uint32_t length) +tpm_result_t safe_write(uint32_t index, const void *data, uint32_t length) { tpm_result_t rc = tlcl_write(index, data, length); if (tlcl_get_family() == TPM_1 && rc == TPM_MAXNVWRITES) { @@ -609,14 +71,10 @@ static uint32_t _factory_initialize_tpm(struct vb2_context *ctx) { -#if CONFIG(TPM1) if (tlcl_get_family() == TPM_1) - return _factory_initialize_tpm1(ctx); -#endif -#if CONFIG(TPM2) + return factory_initialize_tpm1(ctx); if (tlcl_get_family() == TPM_2) - return _factory_initialize_tpm2(ctx); -#endif + return factory_initialize_tpm2(ctx); return TPM_CB_CORRUPTED_STATE; } diff --git a/src/security/vboot/secdata_tpm1.c b/src/security/vboot/secdata_tpm1.c new file mode 100644 index 0000000..b66b939 --- /dev/null +++ b/src/security/vboot/secdata_tpm1.c @@ -0,0 +1,83 @@ +/* SPDX-License-Identifier: BSD-3-Clause */ + +#include <security/tpm/tspi.h> +#include <security/tpm/tss.h> +#include <security/vboot/antirollback.h> +#include <vb2_api.h> + +#include "secdata_tpm_private.h" + +/** + * Similarly to safe_write(), this ensures we don't fail a DefineSpace because + * we hit the TPM write limit. This is even less likely to happen than with + * writes because we only define spaces once at initialization, but we'd + * rather be paranoid about this. + */ +static tpm_result_t safe_define_space(uint32_t index, uint32_t perm, uint32_t size) +{ + tpm_result_t rc = tlcl1_define_space(index, perm, size); + if (rc == TPM_MAXNVWRITES) { + RETURN_ON_FAILURE(tpm_clear_and_reenable()); + return tlcl1_define_space(index, perm, size); + } else { + return rc; + } +} + +tpm_result_t factory_initialize_tpm1(struct vb2_context *ctx) +{ + TPM_PERMANENT_FLAGS pflags; + tpm_result_t rc; + + vb2api_secdata_firmware_create(ctx); + vb2api_secdata_kernel_create_v0(ctx); + + rc = tlcl1_get_permanent_flags(&pflags); + if (rc != TPM_SUCCESS) + return rc; + + /* + * TPM may come from the factory without physical presence finalized. + * Fix if necessary. + */ + VBDEBUG("TPM: physicalPresenceLifetimeLock=%d\n", + pflags.physicalPresenceLifetimeLock); + if (!pflags.physicalPresenceLifetimeLock) { + VBDEBUG("TPM: Finalizing physical presence\n"); + RETURN_ON_FAILURE(tlcl_finalize_physical_presence()); + } + + /* + * The TPM will not enforce the NV authorization restrictions until the + * execution of a TPM_NV_DefineSpace with the handle of + * TPM_NV_INDEX_LOCK. Here we create that space if it doesn't already + * exist. */ + VBDEBUG("TPM: nvLocked=%d\n", pflags.nvLocked); + if (!pflags.nvLocked) { + VBDEBUG("TPM: Enabling NV locking\n"); + RETURN_ON_FAILURE(tlcl1_set_nv_locked()); + } + + /* Clear TPM owner, in case the TPM is already owned for some reason. */ + VBDEBUG("TPM: Clearing owner\n"); + RETURN_ON_FAILURE(tpm_clear_and_reenable()); + + /* Define and write secdata_kernel space. */ + RETURN_ON_FAILURE(safe_define_space(KERNEL_NV_INDEX, + TPM_NV_PER_PPWRITE, + VB2_SECDATA_KERNEL_SIZE_V02)); + RETURN_ON_FAILURE(safe_write(KERNEL_NV_INDEX, + ctx->secdata_kernel, + VB2_SECDATA_KERNEL_SIZE_V02)); + + /* Define and write secdata_firmware space. */ + RETURN_ON_FAILURE(safe_define_space(FIRMWARE_NV_INDEX, + TPM_NV_PER_GLOBALLOCK | + TPM_NV_PER_PPWRITE, + VB2_SECDATA_FIRMWARE_SIZE)); + RETURN_ON_FAILURE(safe_write(FIRMWARE_NV_INDEX, + ctx->secdata_firmware, + VB2_SECDATA_FIRMWARE_SIZE)); + + return TPM_SUCCESS; +} diff --git a/src/security/vboot/secdata_tpm2.c b/src/security/vboot/secdata_tpm2.c new file mode 100644 index 0000000..075e481 --- /dev/null +++ b/src/security/vboot/secdata_tpm2.c @@ -0,0 +1,446 @@ +/* SPDX-License-Identifier: BSD-3-Clause */ + +#include <security/vboot/antirollback.h> +#include <security/tpm/tss.h> +#include <vb2_api.h> + +#include "secdata_tpm_private.h" + +static tpm_result_t read_space_mrc_hash(uint32_t index, uint8_t *data) +{ + RETURN_ON_FAILURE(tlcl_read(index, data, + HASH_NV_SIZE)); + return TPM_SUCCESS; +} + +/* + * This is used to initialize the TPM space for recovery hash after defining + * it. Since there is no data available to calculate hash at the point where TPM + * space is defined, initialize it to all 0s. + */ +static const uint8_t mrc_hash_data[HASH_NV_SIZE] = { }; + +/* + * Different sets of NVRAM space attributes apply to the "ro" spaces, + * i.e. those which should not be possible to delete or modify once + * the RO exits, and the rest of the NVRAM spaces. + */ +static const TPMA_NV ro_space_attributes = { + .TPMA_NV_PPWRITE = 1, + .TPMA_NV_AUTHREAD = 1, + .TPMA_NV_PPREAD = 1, + .TPMA_NV_PLATFORMCREATE = 1, + .TPMA_NV_WRITE_STCLEAR = 1, + .TPMA_NV_POLICY_DELETE = 1, +}; + +static const TPMA_NV rw_space_attributes = { + .TPMA_NV_PPWRITE = 1, + .TPMA_NV_AUTHREAD = 1, + .TPMA_NV_PPREAD = 1, + .TPMA_NV_PLATFORMCREATE = 1, + .TPMA_NV_WRITE_STCLEAR = 1, +}; + +static const TPMA_NV rw_auth_space_attributes = { + .TPMA_NV_AUTHWRITE = 1, + .TPMA_NV_AUTHREAD = 1, + .TPMA_NV_NO_DA = 1, + .TPMA_NV_PPREAD = 1, + .TPMA_NV_PPWRITE = 1, + .TPMA_NV_PLATFORMCREATE = 1, + .TPMA_NV_WRITE_STCLEAR = 1, + .TPMA_NV_POLICY_DELETE = 1, +}; + +static const TPMA_NV fwmp_attr = { + .TPMA_NV_PLATFORMCREATE = 1, + .TPMA_NV_OWNERWRITE = 1, + .TPMA_NV_AUTHREAD = 1, + .TPMA_NV_PPREAD = 1, + .TPMA_NV_PPWRITE = 1, +}; + +/* Attributes for spaces that enable zero-touch enrollment (ZTE) */ +static const TPMA_NV zte_attr = { + .TPMA_NV_PLATFORMCREATE = 1, + .TPMA_NV_WRITEDEFINE = 1, + .TPMA_NV_AUTHWRITE = 1, + .TPMA_NV_AUTHREAD = 1, + .TPMA_NV_PPWRITE = 1, + .TPMA_NV_PPREAD = 1, + .TPMA_NV_NO_DA = 1, + .TPMA_NV_POLICY_DELETE = 1, +}; + +static const TPMA_NV zte_rma_bytes_attr = { + .TPMA_NV_PLATFORMCREATE = 1, + .TPMA_NV_BITS = 1, + .TPMA_NV_AUTHWRITE = 1, + .TPMA_NV_AUTHREAD = 1, + .TPMA_NV_PPWRITE = 1, + .TPMA_NV_PPREAD = 1, + .TPMA_NV_NO_DA = 1, + .TPMA_NV_POLICY_DELETE = 1, +}; + +static const TPMA_NV rw_orderly_counter_attributes = { + .TPMA_NV_COUNTER = 1, + .TPMA_NV_ORDERLY = 1, + .TPMA_NV_AUTHREAD = 1, + .TPMA_NV_AUTHWRITE = 1, + .TPMA_NV_PLATFORMCREATE = 1, + .TPMA_NV_WRITE_STCLEAR = 1, + .TPMA_NV_PPREAD = 1, + .TPMA_NV_PPWRITE = 1, + .TPMA_NV_NO_DA = 1, +}; + +/* + * This policy digest was obtained using TPM2_PolicyOR on 3 digests + * corresponding to a sequence of + * -) TPM2_PolicyCommandCode(TPM_CC_NV_UndefineSpaceSpecial), + * -) TPM2_PolicyPCR(PCR0, <extended_value>). + * where <extended value> is + * 1) all zeros = initial, unextended state: + * - Value to extend to initial PCR0: + * <none> + * - Resulting PCR0: + * 0000000000000000000000000000000000000000000000000000000000000000 + * - Policy digest for PolicyCommandCode + PolicyPCR: + * 4B44FC4192DB5AD7167E0135708FD374890A06BFB56317DF01F24F2226542A3F + * 2) result of extending (SHA1(0x00|0x01|0x00) | 00s to SHA256 size) + * - Value to extend to initial PCR0: + * 62571891215b4efc1ceab744ce59dd0b66ea6f73000000000000000000000000 + * - Resulting PCR0: + * 9F9EA866D3F34FE3A3112AE9CB1FBABC6FFE8CD261D42493BC6842A9E4F93B3D + * - Policy digest for PolicyCommandCode + PolicyPCR: + * CB5C8014E27A5F7586AAE42DB4F9776A977BCBC952CA61E33609DA2B2C329418 + * 3) result of extending (SHA1(0x01|0x01|0x00) | 00s to SHA256 size) + * - Value to extend to initial PCR0: + * 47ec8d98366433dc002e7721c9e37d5067547937000000000000000000000000 + * - Resulting PCR0: + * 2A7580E5DA289546F4D2E0509CC6DE155EA131818954D36D49E027FD42B8C8F8 + * - Policy digest for PolicyCommandCode + PolicyPCR: + * E6EF4F0296AC3EF0F53906480985B1BE8058E0E517E5F74A5B8A415EFE339D87 + * Values #2 and #3 correspond to two forms of recovery mode as extended by + * vb2api_get_pcr_digest(). + * As a result, the digest allows deleting the space with UndefineSpaceSpecial + * at early RO stages (before extending PCR0) or from recovery mode. + */ +static const uint8_t pcr0_allowed_policy[] = { + 0x44, 0x44, 0x79, 0x00, 0xCB, 0xB8, 0x3F, 0x5B, 0x15, 0x76, 0x56, + 0x50, 0xEF, 0x96, 0x98, 0x0A, 0x2B, 0x96, 0x6E, 0xA9, 0x09, 0x04, + 0x4A, 0x01, 0xB8, 0x5F, 0xA5, 0x4A, 0x96, 0xFC, 0x59, 0x84}; + +static const uint8_t unsatisfiable_policy[VB2_SHA256_DIGEST_SIZE] = + "hmwhat if RBR beat merc in 2021"; + +static uint32_t define_space(const char *name, uint32_t index, uint32_t length, + const TPMA_NV nv_attributes, + const uint8_t *nv_policy, size_t nv_policy_size) +{ + tpm_result_t rc; + + rc = tlcl2_define_space(index, length, nv_attributes, nv_policy, nv_policy_size); + if (rc == TPM_CB_NV_DEFINED) { + /* + * Continue with writing: it may be defined, but not written + * to. In that case a subsequent tlcl_read() would still return + * TPM_BADINDEX on TPM 2.0. The cases when some non-firmware + * space is defined while the firmware space is not there + * should be rare (interrupted initialization), so no big harm + * in writing once again even if it was written already. + */ + VBDEBUG("%s: %s space already exists\n", __func__, name); + rc = TPM_SUCCESS; + } + + return rc; +} + +static tpm_result_t setup_space(const char *name, uint32_t index, const void *data, + uint32_t length, const TPMA_NV nv_attributes, + const uint8_t *nv_policy, size_t nv_policy_size) +{ + tpm_result_t rc; + + rc = define_space(name, index, length, nv_attributes, nv_policy, + nv_policy_size); + if (rc != TPM_SUCCESS) + return rc; + + return safe_write(index, data, length); +} + +static tpm_result_t setup_firmware_space(struct vb2_context *ctx) +{ + uint32_t firmware_space_size = vb2api_secdata_firmware_create(ctx); + + return setup_space("firmware", FIRMWARE_NV_INDEX, + ctx->secdata_firmware, firmware_space_size, + ro_space_attributes, pcr0_allowed_policy, + sizeof(pcr0_allowed_policy)); +} + +static tpm_result_t setup_fwmp_space(struct vb2_context *ctx) +{ + uint32_t fwmp_space_size = vb2api_secdata_fwmp_create(ctx); + + return setup_space("FWMP", FWMP_NV_INDEX, ctx->secdata_fwmp, fwmp_space_size, + fwmp_attr, NULL, 0); +} + +static tpm_result_t setup_kernel_space(struct vb2_context *ctx) +{ + uint32_t kernel_space_size = vb2api_secdata_kernel_create(ctx); + + return setup_space("kernel", KERNEL_NV_INDEX, ctx->secdata_kernel, + kernel_space_size, rw_space_attributes, NULL, 0); +} + +static tpm_result_t set_mrc_hash_space(uint32_t index, const uint8_t *data) +{ + if (index == MRC_REC_HASH_NV_INDEX) { + return setup_space("RO MRC Hash", index, data, HASH_NV_SIZE, + ro_space_attributes, pcr0_allowed_policy, + sizeof(pcr0_allowed_policy)); + } else { + return setup_space("RW MRC Hash", index, data, HASH_NV_SIZE, + rw_space_attributes, NULL, 0); + } +} + +/** + * Set up the Zero-Touch Enrollment(ZTE) related spaces. + * + * These spaces are not used by firmware, but we do need to initialize them. + */ +static tpm_result_t setup_zte_spaces(void) +{ + tpm_result_t rc; + uint64_t rma_bytes_counter_default = 0; + uint8_t rma_sn_bits_default[16]; + uint8_t board_id_default[12]; + + /* Initialize defaults: Board ID and RMA+SN Bits must be initialized + to all 0xFFs. */ + memset(rma_sn_bits_default, 0xFF, ARRAY_SIZE(rma_sn_bits_default)); + memset(board_id_default, 0xFF, ARRAY_SIZE(board_id_default)); + + /* Set up RMA + SN Bits */ + rc = setup_space("RMA + SN Bits", ZTE_RMA_SN_BITS_INDEX, + rma_sn_bits_default, sizeof(rma_sn_bits_default), + zte_attr, + unsatisfiable_policy, sizeof(unsatisfiable_policy)); + if (rc != TPM_SUCCESS) { + VBDEBUG("%s: Failed to set up RMA + SN Bits space with error %#x\n", __func__, rc); + return rc; + } + + rc = setup_space("Board ID", ZTE_BOARD_ID_NV_INDEX, + board_id_default, sizeof(board_id_default), + zte_attr, + unsatisfiable_policy, sizeof(unsatisfiable_policy)); + if (rc != TPM_SUCCESS) { + VBDEBUG("%s: Failed to set up Board ID space with error %#x\n", __func__, rc); + return rc; + } + + /* Set up RMA Bytes counter */ + rc = define_space("RMA Bytes Counter", ZTE_RMA_BYTES_COUNTER_INDEX, + sizeof(rma_bytes_counter_default), + zte_rma_bytes_attr, + unsatisfiable_policy, sizeof(unsatisfiable_policy)); + if (rc != TPM_SUCCESS) { + VBDEBUG("%s: Failed to define RMA Bytes space with error %#x\n", __func__, rc); + return rc; + } + + /* + * Since the RMA counter has the BITS attribute, we need to call + * TPM2_NV_SetBits() in order to initialize it. + */ + rc = tlcl2_set_bits(ZTE_RMA_BYTES_COUNTER_INDEX, rma_bytes_counter_default); + if (rc != TPM_SUCCESS) { + VBDEBUG("%s: Failed to init RMA Bytes counter space wit error %#x\n", + __func__, rc); + return rc; + } + + return rc; +} + +/* + * Set up enterprise rollback space. + * + * This space is not used by firmware but needs to survive owner clear. Thus, it + * needs to be created here. + */ +static tpm_result_t enterprise_rollback_create_space(void) +{ + uint8_t rollback_space_default[32] = {0}; + + return setup_space("Enterprise Rollback Space", + ENT_ROLLBACK_SPACE_INDEX, rollback_space_default, + sizeof(rollback_space_default), rw_auth_space_attributes, + unsatisfiable_policy, sizeof(unsatisfiable_policy)); +} + +static tpm_result_t setup_widevine_counter_spaces(void) +{ + uint32_t index; + tpm_result_t rc; + + for (index = 0; index < NUM_WIDEVINE_COUNTERS; index++) { + rc = define_space(WIDEVINE_COUNTER_NAME, + WIDEVINE_COUNTER_NV_INDEX(index), + WIDEVINE_COUNTER_SIZE, + rw_orderly_counter_attributes, + NULL, + 0); + if (rc != TPM_SUCCESS) + return rc; + } + return rc; +} + +tpm_result_t factory_initialize_tpm2(struct vb2_context *ctx) +{ + RETURN_ON_FAILURE(tlcl_force_clear()); + + /* + * Of all NVRAM spaces defined by this function the firmware space + * must be defined last, because its existence is considered an + * indication that TPM factory initialization was successfully + * completed. + */ + RETURN_ON_FAILURE(setup_kernel_space(ctx)); + + /* + * Define and set rec hash space, if available. No need to + * create the RW hash space because we will definitely boot + * once in normal mode before shipping, meaning that the space + * will get created with correct permissions while still in + * our hands. + */ + if (CONFIG(VBOOT_HAS_REC_HASH_SPACE)) + RETURN_ON_FAILURE(set_mrc_hash_space(MRC_REC_HASH_NV_INDEX, mrc_hash_data)); + + /* Define and write firmware management parameters space. */ + RETURN_ON_FAILURE(setup_fwmp_space(ctx)); + + /* + * Define and write zero-touch enrollment (ZTE) spaces. For ChromeOS devices with + * Google TPM, these are set up elsewhere via TPM vendor commands. + */ + if (CONFIG(CHROMEOS) && !(CONFIG(TPM_GOOGLE))) + RETURN_ON_FAILURE(setup_zte_spaces()); + + /* + * On TPM 2.0, create a space that survives TPM clear. This allows to + * securely lock data during enterprise rollback by binding to this + * space's value. + */ + if (CONFIG(CHROMEOS)) + RETURN_ON_FAILURE(enterprise_rollback_create_space()); + + /* Define widevine counter space. No need to increment/write to the secure counters + and are expected to be incremented during the first use. */ + if (CONFIG(VBOOT_DEFINE_WIDEVINE_COUNTERS)) + RETURN_ON_FAILURE(setup_widevine_counter_spaces()); + + RETURN_ON_FAILURE(setup_firmware_space(ctx)); + + return TPM_SUCCESS; +} + +tpm_result_t antirollback_read_space_mrc_hash(uint32_t index, uint8_t *data, uint32_t size) +{ + if (size != HASH_NV_SIZE) { + VBDEBUG("TPM: Incorrect buffer size for hash idx %#x. " + "(Expected=%#x Actual=%#x).\n", index, HASH_NV_SIZE, + size); + return TPM_CB_READ_FAILURE; + } + return read_space_mrc_hash(index, data); +} + +tpm_result_t antirollback_write_space_mrc_hash(uint32_t index, const uint8_t *data, uint32_t size) +{ + uint8_t spc_data[HASH_NV_SIZE]; + tpm_result_t rc; + + if (size != HASH_NV_SIZE) { + VBDEBUG("TPM: Incorrect buffer size for hash idx %#x. " + "(Expected=%#x Actual=%#x).\n", index, HASH_NV_SIZE, + size); + return TPM_CB_WRITE_FAILURE; + } + + rc = read_space_mrc_hash(index, spc_data); + if (rc == TPM_BADINDEX) { + /* + * If space is not defined already for hash, define + * new space. + */ + VBDEBUG("TPM: Initializing hash space.\n"); + return set_mrc_hash_space(index, data); + } + + if (rc != TPM_SUCCESS) + return rc; + + return safe_write(index, data, size); +} + +tpm_result_t antirollback_lock_space_mrc_hash(uint32_t index) +{ + return tlcl2_lock_nv_write(index); +} + +static tpm_result_t read_space_vbios_hash(uint8_t *data) +{ + RETURN_ON_FAILURE(tlcl_read(VBIOS_CACHE_NV_INDEX, data, HASH_NV_SIZE)); + return TPM_SUCCESS; +} + +tpm_result_t antirollback_read_space_vbios_hash(uint8_t *data, uint32_t size) +{ + if (size != HASH_NV_SIZE) { + VBDEBUG("TPM: Incorrect buffer size for hash idx %#x. " + "(Expected=%#x Actual=%#x).\n", VBIOS_CACHE_NV_INDEX, HASH_NV_SIZE, + size); + return TPM_CB_READ_FAILURE; + } + return read_space_vbios_hash(data); +} + +tpm_result_t antirollback_write_space_vbios_hash(const uint8_t *data, uint32_t size) +{ + uint8_t spc_data[HASH_NV_SIZE]; + tpm_result_t rc; + + if (size != HASH_NV_SIZE) { + VBDEBUG("TPM: Incorrect buffer size for hash idx %#x. " + "(Expected=%#x Actual=%#x).\n", VBIOS_CACHE_NV_INDEX, HASH_NV_SIZE, + size); + return TPM_CB_WRITE_FAILURE; + } + + rc = read_space_vbios_hash(spc_data); + if (rc == TPM_BADINDEX) { + /* + * If space is not defined already for hash, define + * new space. + */ + VBDEBUG("TPM: Initializing hash space.\n"); + return setup_space("VBIOS Cache Hash", VBIOS_CACHE_NV_INDEX, data, HASH_NV_SIZE, + rw_space_attributes, NULL, 0); + } + + if (rc != TPM_SUCCESS) + return rc; + + return safe_write(VBIOS_CACHE_NV_INDEX, data, size); +} diff --git a/src/security/vboot/secdata_tpm_private.h b/src/security/vboot/secdata_tpm_private.h new file mode 100644 index 0000000..3fce40d --- /dev/null +++ b/src/security/vboot/secdata_tpm_private.h @@ -0,0 +1,28 @@ +/* SPDX-License-Identifier: BSD-3-Clause */ + +#ifndef __VBOOT_SECDATA_TPM_PRIVATE_H__ +#define __VBOOT_SECDATA_TPM_PRIVATE_H__ + +#include <console/console.h> +#include <security/tpm/tis.h> +#include <vb2_api.h> + +#define VBDEBUG(format, args...) \ + printk(BIOS_INFO, "%s():%d: " format, __func__, __LINE__, ## args) + +#define RETURN_ON_FAILURE(tpm_cmd) do { \ + tpm_result_t rc_; \ + if ((rc_ = (tpm_cmd)) != TPM_SUCCESS) { \ + VBDEBUG("Antirollback: %08x returned by " #tpm_cmd "\n", \ + (tpm_result_t)rc_); \ + return rc_; \ + } \ + } while (0) + +tpm_result_t safe_write(uint32_t index, const void *data, uint32_t length); + +tpm_result_t factory_initialize_tpm1(struct vb2_context *ctx); + +tpm_result_t factory_initialize_tpm2(struct vb2_context *ctx); + +#endif /* __VBOOT_SECDATA_TPM_PRIVATE_H__ */ -- To view, visit https://review.coreboot.org/c/coreboot/+/81415?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I0090b748d7d3b2d76a941b87b5885682fd81c4fc Gerrit-Change-Number: 81415 Gerrit-PatchSet: 3 Gerrit-Owner: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com> Gerrit-Reviewer: Yu-Ping Wu <yupingso(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-MessageType: merged

1 0

[M] Change in coreboot[main]: security/tpm: replace CONFIG(TPMx) checks with runtime check
by Martin L Roth (Code Review) 28 Mar '24

28 Mar '24

Martin L Roth has submitted this change. ( https://review.coreboot.org/c/coreboot/+/69161?usp=email ) Change subject: security/tpm: replace CONFIG(TPMx) checks with runtime check ...................................................................... security/tpm: replace CONFIG(TPMx) checks with runtime check This prepares the code for enabling both CONFIG_TPM1 and CONFIG_TPM2 during compilation, in which case actual TPM family in use can be determined at runtime. In some places both compile-time and runtime checks are necessary. Yet in places like probe functions runtime state checks don't make sense as runtime state is defined by results of probing. Change-Id: Id9cc25aad8d1d7bfad12b7a92059b1b3641bbfa9 Ticket: https://ticket.coreboot.org/issues/433 Signed-off-by: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/69161 Reviewed-by: Jérémy Compostella <jeremy.compostella(a)intel.com> Reviewed-by: Julius Werner <jwerner(a)chromium.org> Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> --- M src/acpi/acpi.c M src/drivers/crb/tis.c M src/drivers/crb/tpm.c M src/drivers/crb/tpm.h M src/drivers/pc80/tpm/tis.c M src/drivers/tpm/ppi.c M src/security/tpm/tspi/crtm.h M src/security/tpm/tspi/tspi.c M src/security/tpm/tss.h M src/security/vboot/secdata_tpm.c M src/security/vboot/tpm_common.c M src/vendorcode/google/chromeos/cse_board_reset.c M src/vendorcode/google/chromeos/tpm2.c 13 files changed, 153 insertions(+), 70 deletions(-) Approvals: build bot (Jenkins): Verified Jérémy Compostella: Looks good to me, approved Julius Werner: Looks good to me, approved diff --git a/src/acpi/acpi.c b/src/acpi/acpi.c index 98c8ecd..30a07bf 100644 --- a/src/acpi/acpi.c +++ b/src/acpi/acpi.c @@ -25,7 +25,9 @@ #include <device/device.h> #include <device/mmio.h> #include <device/pci.h> +#include <drivers/crb/tpm.h> #include <drivers/uart/pl011.h> +#include <security/tpm/tss.h> #include <string.h> #include <types.h> #include <version.h> @@ -205,7 +207,7 @@ static void acpi_create_tcpa(acpi_header_t *header, void *unused) { - if (!CONFIG(TPM1)) + if (tlcl_get_family() != TPM_1) return; acpi_tcpa_t *tcpa = (acpi_tcpa_t *)header; @@ -251,7 +253,7 @@ static void acpi_create_tpm2(acpi_header_t *header, void *unused) { - if (!CONFIG(TPM2)) + if (tlcl_get_family() != TPM_2) return; acpi_tpm2_t *tpm2 = (acpi_tpm2_t *)header; @@ -271,7 +273,7 @@ /* Hard to detect for coreboot. Just set it to 0 */ tpm2->platform_class = 0; - if (CONFIG(CRB_TPM)) { + if (CONFIG(CRB_TPM) && tpm2_has_crb_active()) { /* Must be set to 7 for CRB Support */ tpm2->control_area = CONFIG_CRB_TPM_BASE_ADDRESS + 0x40; tpm2->start_method = 7; diff --git a/src/drivers/crb/tis.c b/src/drivers/crb/tis.c index 21a7647..04e255a 100644 --- a/src/drivers/crb/tis.c +++ b/src/drivers/crb/tis.c @@ -142,6 +142,9 @@ uint32_t fw_ver1, fw_ver2; uint8_t major_spec_ver, minor_spec_ver; + if (tlcl_get_family() == TPM_1) + return 0; + tpm2_get_info(&info); /* If any of these have invalid values, assume TPM not present or disabled */ diff --git a/src/drivers/crb/tpm.c b/src/drivers/crb/tpm.c index 4e9f6f2..b568dcc 100644 --- a/src/drivers/crb/tpm.c +++ b/src/drivers/crb/tpm.c @@ -320,3 +320,29 @@ tpm2_info->device_id = (interfaceReg >> 32) & 0xFFFF; tpm2_info->revision = (interfaceReg >> 24) & 0xFF; } + +/* + * tpm2_has_crb_active + * + * Checks that CRB interface is available and active. + * + * The body was derived from crb_probe() which unlike this function can also + * write to registers. + */ +bool tpm2_has_crb_active(void) +{ + uint64_t tpmStatus = read64(CRB_REG(0, CRB_REG_INTF_ID)); + printk(BIOS_SPEW, "Interface ID Reg. %llx\n", tpmStatus); + + if ((tpmStatus & CRB_INTF_REG_CAP_CRB) == 0) { + printk(BIOS_DEBUG, "TPM: CRB Interface is not supported.\n"); + return false; + } + + if ((tpmStatus & (0xf)) != 1) { + printk(BIOS_DEBUG, "TPM: CRB Interface is not active.\n"); + return false; + } + + return true; +} diff --git a/src/drivers/crb/tpm.h b/src/drivers/crb/tpm.h index 7b25e78..60020c3 100644 --- a/src/drivers/crb/tpm.h +++ b/src/drivers/crb/tpm.h @@ -64,3 +64,4 @@ void tpm2_get_info(struct tpm2_info *tpm2_info); size_t tpm2_process_command(const void *tpm2_command, size_t command_size, void *tpm2_response, size_t max_response); +bool tpm2_has_crb_active(void); diff --git a/src/drivers/pc80/tpm/tis.c b/src/drivers/pc80/tpm/tis.c index da443d3..568065c6 100644 --- a/src/drivers/pc80/tpm/tis.c +++ b/src/drivers/pc80/tpm/tis.c @@ -809,7 +809,7 @@ acpigen_write_scope(path); acpigen_write_device(acpi_device_name(dev)); - if (CONFIG(TPM2)) { + if (tlcl_get_family() == TPM_2) { acpigen_write_name_string("_HID", "MSFT0101"); acpigen_write_name_string("_CID", "MSFT0101"); } else { diff --git a/src/drivers/tpm/ppi.c b/src/drivers/tpm/ppi.c index 6f12b41..d63b8f8 100644 --- a/src/drivers/tpm/ppi.c +++ b/src/drivers/tpm/ppi.c @@ -5,6 +5,7 @@ #include <acpi/acpi_device.h> #include <cbmem.h> #include <console/console.h> +#include <security/tpm/tss.h> #include "tpm_ppi.h" @@ -35,6 +36,8 @@ /* PPI function is passed in src_op. Converted to Local2. Clobbers Local1 and Local2 */ static void verify_supported_ppi(uint8_t src_op) { + enum tpm_family family = tlcl_get_family(); + /* * Old OSes incorrectly pass a Buffer instead of a Package. * See TCG Physical Presence Interface Specification Chapter 8.1.2 for details. @@ -62,7 +65,7 @@ acpigen_write_store(); acpigen_emit_namestring("^FSUP"); acpigen_emit_byte(LOCAL2_OP); - acpigen_emit_byte(CONFIG(TPM1) ? ONE_OP : ZERO_OP); + acpigen_emit_byte(family == TPM_1 ? ONE_OP : ZERO_OP); acpigen_emit_byte(LOCAL1_OP); acpigen_write_if_lequal_op_int(LOCAL1_OP, 0); @@ -84,7 +87,7 @@ acpigen_write_store(); acpigen_emit_namestring("^FSUP"); acpigen_emit_byte(LOCAL2_OP); - acpigen_emit_byte(CONFIG(TPM1) ? ZERO_OP : ONE_OP); + acpigen_emit_byte(family == TPM_1 ? ZERO_OP : ONE_OP); acpigen_emit_byte(LOCAL1_OP); acpigen_write_if_lequal_op_int(LOCAL1_OP, 1); @@ -114,7 +117,7 @@ */ static void tpm_ppi_func1_cb(void *arg) { - if (CONFIG(TPM2)) + if (tlcl_get_family() == TPM_2) /* Interface version: 1.3 */ acpigen_write_return_string("1.3"); else @@ -400,6 +403,8 @@ */ static void tpm_ppi_func8_cb(void *arg) { + enum tpm_family family = tlcl_get_family(); + acpigen_write_to_integer(ARG1_OP, LOCAL0_OP); /* Revision 1 */ @@ -410,7 +415,7 @@ acpigen_write_store(); acpigen_emit_namestring("^FSUP"); acpigen_emit_byte(LOCAL2_OP); - acpigen_emit_byte(CONFIG(TPM1) ? ONE_OP : ZERO_OP); + acpigen_emit_byte(family == TPM_1 ? ONE_OP : ZERO_OP); acpigen_emit_byte(LOCAL1_OP); acpigen_write_if_lequal_op_int(LOCAL1_OP, 0); acpigen_write_return_byte(0); /* Not implemented */ @@ -418,7 +423,7 @@ // FIXME: Only advertise supported functions - if (CONFIG(TPM1)) { + if (family == TPM_1) { /* * Some functions do not require PP depending on configuration. * Those aren't listed here, so the 'required PP' is always set for those. @@ -434,7 +439,7 @@ acpigen_write_return_integer(PPI8_RET_ALLOWED); acpigen_pop_len(); /* Pop : If */ } - } else if (CONFIG(TPM2)) { + } else if (family == TPM_2) { /* * Some functions do not require PP depending on configuration. * Those aren't listed here, so the 'required PP' is always set for those. @@ -564,6 +569,12 @@ printk(BIOS_DEBUG, "PPI: Pending OS request: 0x%x (0x%x)\n", ppib->pprq, ppib->pprm); printk(BIOS_DEBUG, "PPI: OS response: CMD 0x%x = 0x%x\n", ppib->lppr, ppib->pprp); + enum tpm_family family = tlcl_get_family(); + if (family == TPM_UNKNOWN) { + printk(BIOS_WARN, "PPI: %s: aborting, because no TPM detected\n", __func__); + return; + } + /* Clear unsupported fields */ ppib->next_step = 0; ppib->ppin = 1; // Not used by ACPI. Read by EDK-2, must be 1. @@ -574,7 +585,7 @@ bool found = false; /* Fill in defaults, the TPM command executor may overwrite this list */ memset(ppib->func, 0, sizeof(ppib->func)); - if (CONFIG(TPM1)) { + if (family == TPM_1) { for (size_t i = 0; i < ARRAY_SIZE(tpm1_funcs); i++) { ppib->func[tpm1_funcs[i]] = 1; if (ppib->pprq == tpm1_funcs[i]) @@ -706,17 +717,24 @@ void lb_tpm_ppi(struct lb_header *header) { struct lb_tpm_physical_presence *tpm_ppi; + enum tpm_family family; void *ppib; ppib = cbmem_find(CBMEM_ID_TPM_PPI); if (!ppib) return; + family = tlcl_get_family(); + if (family == TPM_UNKNOWN) { + printk(BIOS_WARN, "PPI: %s: aborting, because no TPM detected\n", __func__); + return; + } + tpm_ppi = (struct lb_tpm_physical_presence *)lb_new_record(header); tpm_ppi->tag = LB_TAG_TPM_PPI_HANDOFF; tpm_ppi->size = sizeof(*tpm_ppi); tpm_ppi->ppi_address = (uintptr_t)ppib; - tpm_ppi->tpm_version = CONFIG(TPM1) ? LB_TPM_VERSION_TPM_VERSION_1_2 : + tpm_ppi->tpm_version = family == TPM_1 ? LB_TPM_VERSION_TPM_VERSION_1_2 : LB_TPM_VERSION_TPM_VERSION_2; tpm_ppi->ppi_version = BCD(1, 3); diff --git a/src/security/tpm/tspi/crtm.h b/src/security/tpm/tspi/crtm.h index 6f5eb2e..69043e2 100644 --- a/src/security/tpm/tspi/crtm.h +++ b/src/security/tpm/tspi/crtm.h @@ -9,10 +9,8 @@ #include <types.h> #include <vb2_sha.h> -#if CONFIG(TPM_LOG_CB) && CONFIG(TPM1) -# define TPM_MEASURE_ALGO VB2_HASH_SHA1 -#elif CONFIG(TPM_LOG_CB) && CONFIG(TPM2) -# define TPM_MEASURE_ALGO VB2_HASH_SHA256 +#if CONFIG(TPM_LOG_CB) +# define TPM_MEASURE_ALGO (tlcl_get_family() == TPM_1 ? VB2_HASH_SHA1 : VB2_HASH_SHA256) #elif CONFIG(TPM_LOG_TPM1) # define TPM_MEASURE_ALGO VB2_HASH_SHA1 #elif CONFIG(TPM_LOG_TPM2) diff --git a/src/security/tpm/tspi/tspi.c b/src/security/tpm/tspi/tspi.c index 1a0f1d5..56b8fa8 100644 --- a/src/security/tpm/tspi/tspi.c +++ b/src/security/tpm/tspi/tspi.c @@ -17,6 +17,9 @@ uint8_t deactivated; tpm_result_t rc = TPM_SUCCESS; + if (tlcl_get_family() != TPM_1) + return rc; + /* Check that the TPM is enabled and activated. */ rc = tlcl1_get_flags(&disabled, &deactivated, NULL); if (rc != TPM_SUCCESS) { @@ -199,19 +202,19 @@ return rc; } -#if CONFIG(TPM1) - rc = tlcl1_set_enable(); - if (rc != TPM_SUCCESS) { - printk(BIOS_ERR, "TPM Error (%#x): Can't set enabled state.\n", rc); - return rc; - } + if (tlcl_get_family() == TPM_1) { + rc = tlcl1_set_enable(); + if (rc != TPM_SUCCESS) { + printk(BIOS_ERR, "TPM Error (%#x): Can't set enabled state.\n", rc); + return rc; + } - rc = tlcl1_set_deactivated(0); - if (rc != TPM_SUCCESS) { - printk(BIOS_ERR, "TPM Error (%#x): Can't set deactivated state.\n", rc); - return rc; + rc = tlcl1_set_deactivated(0); + if (rc != TPM_SUCCESS) { + printk(BIOS_ERR, "TPM Error (%#x): Can't set deactivated state.\n", rc); + return rc; + } } -#endif return TPM_SUCCESS; } diff --git a/src/security/tpm/tss.h b/src/security/tpm/tss.h index 3a019ea..c9aec08 100644 --- a/src/security/tpm/tss.h +++ b/src/security/tpm/tss.h @@ -33,16 +33,31 @@ */ tpm_result_t tlcl_lib_init(void); +/** + * Query active TPM family. Returns TPM_UNKNOWN if uninitialized and TPM_1 or TPM_2 otherwise. + */ +static inline enum tpm_family tlcl_get_family(void) +{ + /* Defined in tss/tss.c */ + extern enum tpm_family tlcl_tpm_family; + + if (CONFIG(TPM1) && CONFIG(TPM2)) + return tlcl_tpm_family; + if (CONFIG(TPM1)) + return TPM_1; + if (CONFIG(TPM2)) + return TPM_2; + return TPM_UNKNOWN; +} + /* Commands */ -extern enum tpm_family tlcl_tpm_family; - -#define TLCL_CALL(name, ...) do { \ - if (CONFIG(TPM1) && (!CONFIG(TPM2) || tlcl_tpm_family == TPM_1)) \ - return tlcl1_##name(__VA_ARGS__); \ - if (CONFIG(TPM2) && (!CONFIG(TPM1) || tlcl_tpm_family == TPM_2)) \ - return tlcl2_##name(__VA_ARGS__); \ - return TPM_CB_INTERNAL_INCONSISTENCY; \ +#define TLCL_CALL(name, ...) do { \ + if (tlcl_get_family() == TPM_1) \ + return tlcl1_##name(__VA_ARGS__); \ + if (tlcl_get_family() == TPM_2) \ + return tlcl2_##name(__VA_ARGS__); \ + return TPM_CB_INTERNAL_INCONSISTENCY; \ } while (0) /** diff --git a/src/security/vboot/secdata_tpm.c b/src/security/vboot/secdata_tpm.c index 21901bb..f60a5e2 100644 --- a/src/security/vboot/secdata_tpm.c +++ b/src/security/vboot/secdata_tpm.c @@ -30,7 +30,7 @@ tpm_result_t antirollback_read_space_kernel(struct vb2_context *ctx) { - if (!CONFIG(TPM2)) { + if (tlcl_get_family() == TPM_1) { /* * Before reading the kernel space, verify its permissions. If * the kernel space has the wrong permission, we give up. This @@ -224,12 +224,6 @@ return rc; } -/* Nothing special in the TPM2 path yet. */ -static tpm_result_t safe_write(uint32_t index, const void *data, uint32_t length) -{ - return tlcl_write(index, data, length); -} - static tpm_result_t setup_space(const char *name, uint32_t index, const void *data, uint32_t length, const TPMA_NV nv_attributes, const uint8_t *nv_policy, size_t nv_policy_size) @@ -376,7 +370,7 @@ return rc; } -static tpm_result_t _factory_initialize_tpm(struct vb2_context *ctx) +static tpm_result_t _factory_initialize_tpm2(struct vb2_context *ctx) { RETURN_ON_FAILURE(tlcl_force_clear()); @@ -426,11 +420,6 @@ return TPM_SUCCESS; } -tpm_result_t antirollback_lock_space_firmware(void) -{ - return tlcl2_lock_nv_write(FIRMWARE_NV_INDEX); -} - tpm_result_t antirollback_read_space_mrc_hash(uint32_t index, uint8_t *data, uint32_t size) { if (size != HASH_NV_SIZE) { @@ -521,25 +510,9 @@ return safe_write(VBIOS_CACHE_NV_INDEX, data, size); } -#else +#endif /* CONFIG(TPM2) */ -/** - * Like tlcl_write(), but checks for write errors due to hitting the 64-write - * limit and clears the TPM when that happens. This can only happen when the - * TPM is unowned, so it is OK to clear it (and we really have no choice). - * This is not expected to happen frequently, but it could happen. - */ - -static tpm_result_t safe_write(uint32_t index, const void *data, uint32_t length) -{ - tpm_result_t rc = tlcl_write(index, data, length); - if (rc == TPM_MAXNVWRITES) { - RETURN_ON_FAILURE(tpm_clear_and_reenable()); - return tlcl_write(index, data, length); - } else { - return rc; - } -} +#if CONFIG(TPM1) /** * Similarly to safe_write(), this ensures we don't fail a DefineSpace because @@ -558,7 +531,7 @@ } } -static tpm_result_t _factory_initialize_tpm(struct vb2_context *ctx) +static tpm_result_t _factory_initialize_tpm1(struct vb2_context *ctx) { TPM_PERMANENT_FLAGS pflags; tpm_result_t rc; @@ -616,12 +589,45 @@ return TPM_SUCCESS; } -tpm_result_t antirollback_lock_space_firmware(void) +#endif /* CONFIG(TPM1) */ + +static tpm_result_t safe_write(uint32_t index, const void *data, uint32_t length) { - return tlcl1_set_global_lock(); + tpm_result_t rc = tlcl_write(index, data, length); + if (tlcl_get_family() == TPM_1 && rc == TPM_MAXNVWRITES) { + /** + * Clear the TPM on write error due to hitting the 64-write + * limit. This can only happen when the TPM is unowned, so it + * is OK to clear it (and we really have no choice). This is + * not expected to happen frequently, but it could happen. + */ + RETURN_ON_FAILURE(tpm_clear_and_reenable()); + rc = tlcl_write(index, data, length); + } + return rc; } +static uint32_t _factory_initialize_tpm(struct vb2_context *ctx) +{ +#if CONFIG(TPM1) + if (tlcl_get_family() == TPM_1) + return _factory_initialize_tpm1(ctx); #endif +#if CONFIG(TPM2) + if (tlcl_get_family() == TPM_2) + return _factory_initialize_tpm2(ctx); +#endif + return TPM_CB_CORRUPTED_STATE; +} + +uint32_t antirollback_lock_space_firmware(void) +{ + if (tlcl_get_family() == TPM_1) + return tlcl1_set_global_lock(); + if (tlcl_get_family() == TPM_2) + return tlcl2_lock_nv_write(FIRMWARE_NV_INDEX); + return TPM_CB_CORRUPTED_STATE; +} /** * Perform one-time initializations. diff --git a/src/security/vboot/tpm_common.c b/src/security/vboot/tpm_common.c index 997c4e9..dedf8df 100644 --- a/src/security/vboot/tpm_common.c +++ b/src/security/vboot/tpm_common.c @@ -1,6 +1,7 @@ /* SPDX-License-Identifier: GPL-2.0-only */ #include <security/tpm/tspi.h> +#include <security/tpm/tss.h> #include <security/vboot/tpm_common.h> #include <security/tpm/tss_errors.h> #include <vb2_api.h> @@ -43,7 +44,8 @@ */ _Static_assert(sizeof(buffer) >= VB2_SHA256_DIGEST_SIZE, "Buffer needs to be able to fit at least a SHA256"); - enum vb2_hash_algorithm algo = CONFIG(TPM1) ? VB2_HASH_SHA1 : VB2_HASH_SHA256; + enum vb2_hash_algorithm algo = tlcl_get_family() == TPM_1 ? + VB2_HASH_SHA1 : VB2_HASH_SHA256; switch (which_digest) { /* SHA1 of (devmode|recmode|keyblock) bits */ diff --git a/src/vendorcode/google/chromeos/cse_board_reset.c b/src/vendorcode/google/chromeos/cse_board_reset.c index e7cb878..f336948 100644 --- a/src/vendorcode/google/chromeos/cse_board_reset.c +++ b/src/vendorcode/google/chromeos/cse_board_reset.c @@ -19,6 +19,11 @@ if (CONFIG(CSE_RESET_CLEAR_EC_AP_IDLE_FLAG)) google_chromeec_clear_ec_ap_idle(); + /* + * Assuming that if particular TPM implementation is enabled at compile + * time, it's the one being used. This isn't generic code, so can + * probably get away with it. + */ if (CONFIG(TPM2) && CONFIG(TPM_GOOGLE_CR50)) { /* Initialize TPM and get the cr50 firmware version. */ rc = tlcl_lib_init(); diff --git a/src/vendorcode/google/chromeos/tpm2.c b/src/vendorcode/google/chromeos/tpm2.c index 31c28c9..8823978d 100644 --- a/src/vendorcode/google/chromeos/tpm2.c +++ b/src/vendorcode/google/chromeos/tpm2.c @@ -22,6 +22,10 @@ return; } + /* In case both families are enabled, but TPM1 is in use. */ + if (tlcl_get_family() != TPM_2) + return; + rc = tlcl2_disable_platform_hierarchy(); if (rc != TPM_SUCCESS) printk(BIOS_ERR, "Platform hierarchy disablement failed: %#x\n", -- To view, visit https://review.coreboot.org/c/coreboot/+/69161?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: Id9cc25aad8d1d7bfad12b7a92059b1b3641bbfa9 Gerrit-Change-Number: 69161 Gerrit-PatchSet: 36 Gerrit-Owner: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> Gerrit-Reviewer: Christian Walter <christian.walter(a)9elements.com> Gerrit-Reviewer: Cliff Huang <cliff.huang(a)intel.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Jérémy Compostella <jeremy.compostella(a)intel.com> Gerrit-Reviewer: Krystian Hebel <krystian.hebel(a)3mdeb.com> Gerrit-Reviewer: Lance Zhao <lance.zhao(a)gmail.com> Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com> Gerrit-Reviewer: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Tim Wawrzynczak <inforichland(a)gmail.com> Gerrit-Reviewer: Yu-Ping Wu <yupingso(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Jan Samek <samekh(a)email.cz> Gerrit-MessageType: merged

1 0

[L] Change in coreboot[main]: security/tpm: resolve conflicts in TSS implementations
by Martin L Roth (Code Review) 28 Mar '24

28 Mar '24

Martin L Roth has submitted this change. ( https://review.coreboot.org/c/coreboot/+/69160?usp=email ) Change subject: security/tpm: resolve conflicts in TSS implementations ...................................................................... security/tpm: resolve conflicts in TSS implementations No functional changes. Refactor code such that there won't be any compiler or linker errors if TSS 1.2 and TSS 2.0 were both compiled in. One might want to support both TPM families for example if TPM is pluggable, while currently one has to reflash firmware along with switching TPM device. Change-Id: Ia0ea5a917c46ada9fc3274f17240e12bca98db6a Ticket: https://ticket.coreboot.org/issues/433 Signed-off-by: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/69160 Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> Reviewed-by: Julius Werner <jwerner(a)chromium.org> --- M src/drivers/crb/tis.c M src/security/tpm/Makefile.mk M src/security/tpm/tspi/tspi.c M src/security/tpm/tss.h M src/security/tpm/tss/tcg-1.2/tss.c M src/security/tpm/tss/tcg-2.0/tss.c M src/security/tpm/tss/tcg-2.0/tss_marshaling.c A src/security/tpm/tss/tss.c M src/security/tpm/tss/vendor/cr50/cr50.c A src/security/tpm/tss1.h A src/security/tpm/tss2.h M src/security/vboot/secdata_tpm.c M src/soc/amd/common/psp_verstage/psp_verstage.c M src/vendorcode/eltan/security/mboot/mboot.c M src/vendorcode/google/chromeos/tpm2.c 15 files changed, 412 insertions(+), 295 deletions(-) Approvals: build bot (Jenkins): Verified Julius Werner: Looks good to me, approved diff --git a/src/drivers/crb/tis.c b/src/drivers/crb/tis.c index 766ee25..21a7647 100644 --- a/src/drivers/crb/tis.c +++ b/src/drivers/crb/tis.c @@ -120,7 +120,7 @@ if (!value) return TPM_CB_INVALID_ARG; - rc = tlcl_get_capability(TPM_CAP_TPM_PROPERTIES, property, 1, &cap_data); + rc = tlcl2_get_capability(TPM_CAP_TPM_PROPERTIES, property, 1, &cap_data); if (rc) return rc; diff --git a/src/security/tpm/Makefile.mk b/src/security/tpm/Makefile.mk index ade9656..fe16192 100644 --- a/src/security/tpm/Makefile.mk +++ b/src/security/tpm/Makefile.mk @@ -12,6 +12,8 @@ verstage-y += tss/tcg-1.2/tss.c postcar-y += tss/tcg-1.2/tss.c +all-y += tss/tss.c + ## TSPI ramstage-y += tspi/tspi.c @@ -26,18 +28,23 @@ ramstage-y += tss/tcg-2.0/tss_marshaling.c ramstage-y += tss/tcg-2.0/tss.c +ramstage-y += tss/tss.c romstage-y += tss/tcg-2.0/tss_marshaling.c romstage-y += tss/tcg-2.0/tss.c +romstage-y += tss/tss.c verstage-$(CONFIG_VBOOT) += tss/tcg-2.0/tss_marshaling.c verstage-$(CONFIG_VBOOT) += tss/tcg-2.0/tss.c +verstage-$(CONFIG_VBOOT) += tss/tss.c postcar-y += tss/tcg-2.0/tss_marshaling.c postcar-y += tss/tcg-2.0/tss.c +postcar-y += tss/tss.c bootblock-y += tss/tcg-2.0/tss_marshaling.c bootblock-y += tss/tcg-2.0/tss.c +bootblock-y += tss/tss.c ## TSPI diff --git a/src/security/tpm/tspi/tspi.c b/src/security/tpm/tspi/tspi.c index 80f33d5..1a0f1d5 100644 --- a/src/security/tpm/tspi/tspi.c +++ b/src/security/tpm/tspi/tspi.c @@ -18,7 +18,7 @@ tpm_result_t rc = TPM_SUCCESS; /* Check that the TPM is enabled and activated. */ - rc = tlcl_get_flags(&disabled, &deactivated, NULL); + rc = tlcl1_get_flags(&disabled, &deactivated, NULL); if (rc != TPM_SUCCESS) { printk(BIOS_ERR, "TPM Error (%#x): Can't read capabilities.\n", rc); return rc; @@ -27,7 +27,7 @@ if (disabled) { printk(BIOS_INFO, "TPM: is disabled. Enabling...\n"); - rc = tlcl_set_enable(); + rc = tlcl1_set_enable(); if (rc != TPM_SUCCESS) { printk(BIOS_ERR, "TPM Error (%#x): Can't set enabled state.\n", rc); return rc; @@ -37,7 +37,7 @@ if (!!deactivated != CONFIG(TPM_DEACTIVATE)) { printk(BIOS_INFO, "TPM: Unexpected TPM deactivated state. Toggling...\n"); - rc = tlcl_set_deactivated(!deactivated); + rc = tlcl1_set_deactivated(!deactivated); if (rc != TPM_SUCCESS) { printk(BIOS_ERR, "TPM Error (%#x): Can't toggle deactivated state.\n", rc); @@ -200,13 +200,13 @@ } #if CONFIG(TPM1) - rc = tlcl_set_enable(); + rc = tlcl1_set_enable(); if (rc != TPM_SUCCESS) { printk(BIOS_ERR, "TPM Error (%#x): Can't set enabled state.\n", rc); return rc; } - rc = tlcl_set_deactivated(0); + rc = tlcl1_set_deactivated(0); if (rc != TPM_SUCCESS) { printk(BIOS_ERR, "TPM Error (%#x): Can't set deactivated state.\n", rc); return rc; diff --git a/src/security/tpm/tss.h b/src/security/tpm/tss.h index 9a5521f..3a019ea 100644 --- a/src/security/tpm/tss.h +++ b/src/security/tpm/tss.h @@ -12,110 +12,66 @@ #include <types.h> #include <vb2_sha.h> +#include <security/tpm/tis.h> #include <security/tpm/tss_errors.h> #include <security/tpm/tss/vendor/cr50/cr50.h> - -#if CONFIG(TPM1) - #include <security/tpm/tss/tcg-1.2/tss_structures.h> - -/** - * Define a space with permission [perm]. [index] is the index for the space, - * [size] the usable data size. The TPM error code is returned. - */ -tpm_result_t tlcl_define_space(uint32_t index, uint32_t perm, uint32_t size); - -/** - * Issue a PhysicalEnable. The TPM error code is returned. - */ -tpm_result_t tlcl_set_enable(void); - -/** - * Issue a SetDeactivated. Pass 0 to activate. Returns result code. - */ -tpm_result_t tlcl_set_deactivated(uint8_t flag); - -/** - * Get flags of interest. Pointers for flags you aren't interested in may - * be NULL. The TPM error code is returned. - */ -tpm_result_t tlcl_get_flags(uint8_t *disable, uint8_t *deactivated, - uint8_t *nvlocked); - -/** - * Get the entire set of permanent flags. - */ -tpm_result_t tlcl_get_permanent_flags(TPM_PERMANENT_FLAGS *pflags); - -#endif - -#if CONFIG(TPM2) - #include <security/tpm/tss/tcg-2.0/tss_structures.h> +#include <security/tpm/tss1.h> +#include <security/tpm/tss2.h> /* - * Define a TPM2 space. The define space command TPM command used by the tlcl - * layer offers the ability to use custom nv attributes and policies. + * Operations that are applicable to both TPM versions have wrappers which + * pick the implementation based on version determined during initialization via + * tlcl_lib_init(). + * + * Other operations are defined in tss1.h and tss2.h. */ -tpm_result_t tlcl_define_space(uint32_t space_index, size_t space_size, - const TPMA_NV nv_attributes, - const uint8_t *nv_policy, size_t nv_policy_size); - -/* - * Issue TPM2_GetCapability command - */ -tpm_result_t tlcl_get_capability(TPM_CAP capability, uint32_t property, - uint32_t property_count, - TPMS_CAPABILITY_DATA *capability_data); - -/* Issue TPM2_NV_SetBits command */ -tpm_result_t tlcl_set_bits(uint32_t index, uint64_t bits); - -/* - * Makes tpm_process_command available for on top implementations of - * custom tpm standards like cr50 - */ -void *tpm_process_command(TPM_CC command, void *command_body); - -/* Return digest size of hash algorithm */ -uint16_t tlcl_get_hash_size_from_algo(TPMI_ALG_HASH hash_algo); - -#endif - -/*****************************************************************************/ -/* Generic Functions implemented in tlcl.c */ /** * Call this first. Returns 0 if success, nonzero if error. */ tpm_result_t tlcl_lib_init(void); -/** - * Perform a raw TPM request/response transaction. - */ -tpm_result_t tlcl_send_receive(const uint8_t *request, uint8_t *response, - int max_length); - /* Commands */ +extern enum tpm_family tlcl_tpm_family; + +#define TLCL_CALL(name, ...) do { \ + if (CONFIG(TPM1) && (!CONFIG(TPM2) || tlcl_tpm_family == TPM_1)) \ + return tlcl1_##name(__VA_ARGS__); \ + if (CONFIG(TPM2) && (!CONFIG(TPM1) || tlcl_tpm_family == TPM_2)) \ + return tlcl2_##name(__VA_ARGS__); \ + return TPM_CB_INTERNAL_INCONSISTENCY; \ + } while (0) + /** * Send a TPM_Startup(ST_CLEAR). The TPM error code is returned (0 for * success). */ -tpm_result_t tlcl_startup(void); +static inline tpm_result_t tlcl_startup(void) +{ + TLCL_CALL(startup); +} /** * Resume by sending a TPM_Startup(ST_STATE). The TPM error code is returned * (0 for success). */ -tpm_result_t tlcl_resume(void); +static inline tpm_result_t tlcl_resume(void) +{ + TLCL_CALL(resume); +} /** * Save TPM state by sending either TPM_SaveState() (TPM1.2) or * TPM_Shutdown(ST_STATE) (TPM2.0). The TPM error code is returned (0 for * success). */ -tpm_result_t tlcl_save_state(void); +static inline tpm_result_t tlcl_save_state(void) +{ + TLCL_CALL(save_state); +} /** * Run the self test. @@ -123,81 +79,71 @@ * Note---this is synchronous. To run this in parallel with other firmware, * use ContinueSelfTest(). The TPM error code is returned. */ -tpm_result_t tlcl_self_test_full(void); - -/** - * Run the self test in the background. - */ -tpm_result_t tlcl_continue_self_test(void); +static inline tpm_result_t tlcl_self_test_full(void) +{ + TLCL_CALL(self_test_full); +} /** * Write [length] bytes of [data] to space at [index]. The TPM error code is * returned. */ -tpm_result_t tlcl_write(uint32_t index, const void *data, uint32_t length); +static inline tpm_result_t tlcl_write(uint32_t index, const void *data, uint32_t length) +{ + TLCL_CALL(write, index, data, length); +} /** * Read [length] bytes from space at [index] into [data]. The TPM error code * is returned. */ -tpm_result_t tlcl_read(uint32_t index, void *data, uint32_t length); +static inline tpm_result_t tlcl_read(uint32_t index, void *data, uint32_t length) +{ + TLCL_CALL(read, index, data, length); +} /** * Assert physical presence in software. The TPM error code is returned. */ -tpm_result_t tlcl_assert_physical_presence(void); +static inline tpm_result_t tlcl_assert_physical_presence(void) +{ + TLCL_CALL(assert_physical_presence); +} /** * Enable the physical presence command. The TPM error code is returned. */ -tpm_result_t tlcl_physical_presence_cmd_enable(void); +static inline tpm_result_t tlcl_physical_presence_cmd_enable(void) +{ + TLCL_CALL(physical_presence_cmd_enable); +} /** * Finalize the physical presence settings: software PP is enabled, hardware PP * is disabled, and the lifetime lock is set. The TPM error code is returned. */ -tpm_result_t tlcl_finalize_physical_presence(void); - -/** - * Set the nvLocked bit. The TPM error code is returned. - */ -tpm_result_t tlcl_set_nv_locked(void); +static inline tpm_result_t tlcl_finalize_physical_presence(void) +{ + TLCL_CALL(finalize_physical_presence); +} /** * Issue a ForceClear. The TPM error code is returned. */ -tpm_result_t tlcl_force_clear(void); - -/** - * Set Clear Control. The TPM error code is returned. - */ -tpm_result_t tlcl_clear_control(bool disable); - -/** - * Set the bGlobalLock flag, which only a reboot can clear. The TPM error - * code is returned. - */ -tpm_result_t tlcl_set_global_lock(void); - -/** - * Make an NV Ram location read_only. The TPM error code is returned. - */ -tpm_result_t tlcl_lock_nv_write(uint32_t index); +static inline tpm_result_t tlcl_force_clear(void) +{ + TLCL_CALL(force_clear); +} /** * Perform a TPM_Extend. */ -tpm_result_t tlcl_extend(int pcr_num, const uint8_t *digest_data, - enum vb2_hash_algorithm digest_algo); +static inline tpm_result_t tlcl_extend(int pcr_num, const uint8_t *digest_data, + enum vb2_hash_algorithm digest_algo) +{ + TLCL_CALL(extend, pcr_num, digest_data, digest_algo); +} -/** - * Disable platform hierarchy. Specific to TPM2. The TPM error code is returned. - */ -tpm_result_t tlcl_disable_platform_hierarchy(void); - -/** - * Get the permission bits for the NVRAM space with |index|. - */ -tpm_result_t tlcl_get_permissions(uint32_t index, uint32_t *permissions); +extern tis_sendrecv_fn tlcl_tis_sendrecv; #endif /* TSS_H_ */ diff --git a/src/security/tpm/tss/tcg-1.2/tss.c b/src/security/tpm/tss/tcg-1.2/tss.c index 913f79b..04a0268 100644 --- a/src/security/tpm/tss/tcg-1.2/tss.c +++ b/src/security/tpm/tss/tcg-1.2/tss.c @@ -24,8 +24,6 @@ #include <console/console.h> #define VBDEBUG(format, args...) printk(BIOS_DEBUG, format, ## args) -static tis_sendrecv_fn tis_sendrecv; - static tpm_result_t tpm_send_receive(const uint8_t *request, uint32_t request_length, uint8_t *response, @@ -34,12 +32,12 @@ size_t len = *response_length; tpm_result_t rc; - if (tis_sendrecv == NULL) { + if (tlcl_tis_sendrecv == NULL) { printk(BIOS_ERR, "Attempted use of uninitialized TSS 1.2 stack\n"); return TPM_FAIL; } - rc = tis_sendrecv(request, request_length, response, &len); + rc = tlcl_tis_sendrecv(request, request_length, response, &len); if (rc) return rc; /* check 64->32bit overflow and (re)check response buffer overflow */ @@ -83,8 +81,8 @@ * Like TlclSendReceive below, but do not retry if NEEDS_SELFTEST or * DOING_SELFTEST errors are returned. */ -static tpm_result_t tlcl_send_receive_no_retry(const uint8_t *request, - uint8_t *response, int max_length) +static tpm_result_t tlcl1_send_receive_no_retry(const uint8_t *request, + uint8_t *response, int max_length) { uint32_t response_length = max_length; tpm_result_t rc; @@ -112,21 +110,18 @@ /* Sends a TPM command and gets a response. Returns 0 if success or the TPM * error code if error. Waits for the self test to complete if needed. */ -tpm_result_t tlcl_send_receive(const uint8_t *request, uint8_t *response, - int max_length) +tpm_result_t tlcl1_send_receive(const uint8_t *request, uint8_t *response, int max_length) { - tpm_result_t rc = tlcl_send_receive_no_retry(request, response, - max_length); + tpm_result_t rc = tlcl1_send_receive_no_retry(request, response, max_length); /* If the command fails because the self test has not completed, try it * again after attempting to ensure that the self test has completed. */ if (rc == TPM_NEEDS_SELFTEST || rc == TPM_DOING_SELFTEST) { - rc = tlcl_continue_self_test(); + rc = tlcl1_continue_self_test(); if (rc != TPM_SUCCESS) return rc; #if defined(TPM_BLOCKING_CONTINUESELFTEST) || defined(VB_RECOVERY_MODE) /* Retry only once */ - rc = tlcl_send_receive_no_retry(request, response, - max_length); + rc = tlcl1_send_receive_no_retry(request, response, max_length); #else /* This needs serious testing. The TPM specification says: "iii. * The caller MUST wait for the actions of TPM_ContinueSelfTest @@ -134,8 +129,7 @@ * ContinueSelfTest is non-blocking, how do we know that the * actions have completed other than trying again? */ do { - rc = tlcl_send_receive_no_retry(request, response, - max_length); + rc = tlcl1_send_receive_no_retry(request, response, max_length); } while (rc == TPM_DOING_SELFTEST); #endif } @@ -146,64 +140,45 @@ static tpm_result_t send(const uint8_t *command) { uint8_t response[TPM_LARGE_ENOUGH_COMMAND_SIZE]; - return tlcl_send_receive(command, response, sizeof(response)); + return tlcl1_send_receive(command, response, sizeof(response)); } /* Exported functions. */ -tpm_result_t tlcl_lib_init(void) -{ - enum tpm_family family; - - if (tis_sendrecv != NULL) - return TPM_SUCCESS; - - tis_sendrecv = tis_probe(&family); - if (tis_sendrecv == NULL) - return TPM_CB_NO_DEVICE; - - if (family != TPM_1) { - tis_sendrecv = NULL; - return TPM_CB_INTERNAL_INCONSISTENCY; - } - - return TPM_SUCCESS; -} - -tpm_result_t tlcl_startup(void) +tpm_result_t tlcl1_startup(void) { VBDEBUG("TPM: Startup\n"); return send(tpm_startup_cmd.buffer); } -tpm_result_t tlcl_resume(void) +tpm_result_t tlcl1_resume(void) { VBDEBUG("TPM: Resume\n"); return send(tpm_resume_cmd.buffer); } -tpm_result_t tlcl_save_state(void) +tpm_result_t tlcl1_save_state(void) { VBDEBUG("TPM: Save state\n"); return send(tpm_savestate_cmd.buffer); } -tpm_result_t tlcl_self_test_full(void) +tpm_result_t tlcl1_self_test_full(void) { VBDEBUG("TPM: Self test full\n"); return send(tpm_selftestfull_cmd.buffer); } -tpm_result_t tlcl_continue_self_test(void) +tpm_result_t tlcl1_continue_self_test(void) { uint8_t response[TPM_LARGE_ENOUGH_COMMAND_SIZE]; VBDEBUG("TPM: Continue self test\n"); /* Call the No Retry version of SendReceive to avoid recursion. */ - return tlcl_send_receive_no_retry(tpm_continueselftest_cmd.buffer, - response, sizeof(response)); + return tlcl1_send_receive_no_retry(tpm_continueselftest_cmd.buffer, + response, sizeof(response)); } -tpm_result_t tlcl_define_space(uint32_t index, uint32_t perm, uint32_t size) +tpm_result_t tlcl1_define_space(uint32_t index, uint32_t perm, uint32_t size) { struct s_tpm_nv_definespace_cmd cmd; VBDEBUG("TPM: TlclDefineSpace(%#x, %#x, %d)\n", index, perm, size); @@ -214,7 +189,7 @@ return send(cmd.buffer); } -tpm_result_t tlcl_write(uint32_t index, const void *data, uint32_t length) +tpm_result_t tlcl1_write(uint32_t index, const void *data, uint32_t length) { struct s_tpm_nv_write_cmd cmd; uint8_t response[TPM_LARGE_ENOUGH_COMMAND_SIZE]; @@ -231,10 +206,10 @@ if (length > 0) memcpy(cmd.buffer + tpm_nv_write_cmd.data, data, length); - return tlcl_send_receive(cmd.buffer, response, sizeof(response)); + return tlcl1_send_receive(cmd.buffer, response, sizeof(response)); } -tpm_result_t tlcl_read(uint32_t index, void *data, uint32_t length) +tpm_result_t tlcl1_read(uint32_t index, void *data, uint32_t length) { struct s_tpm_nv_read_cmd cmd; uint8_t response[TPM_LARGE_ENOUGH_COMMAND_SIZE]; @@ -246,7 +221,7 @@ to_tpm_uint32(cmd.buffer + tpm_nv_read_cmd.index, index); to_tpm_uint32(cmd.buffer + tpm_nv_read_cmd.length, length); - rc = tlcl_send_receive(cmd.buffer, response, sizeof(response)); + rc = tlcl1_send_receive(cmd.buffer, response, sizeof(response)); if (rc == TPM_SUCCESS && length > 0) { uint8_t *nv_read_cursor = response + kTpmResponseHeaderLength; from_tpm_uint32(nv_read_cursor, &result_length); @@ -259,43 +234,43 @@ return rc; } -tpm_result_t tlcl_assert_physical_presence(void) +tpm_result_t tlcl1_assert_physical_presence(void) { VBDEBUG("TPM: Asserting physical presence\n"); return send(tpm_ppassert_cmd.buffer); } -tpm_result_t tlcl_physical_presence_cmd_enable(void) +tpm_result_t tlcl1_physical_presence_cmd_enable(void) { VBDEBUG("TPM: Enable the physical presence command\n"); return send(tpm_ppenable_cmd.buffer); } -tpm_result_t tlcl_finalize_physical_presence(void) +tpm_result_t tlcl1_finalize_physical_presence(void) { VBDEBUG("TPM: Enable PP cmd, disable HW pp, and set lifetime lock\n"); return send(tpm_finalizepp_cmd.buffer); } -tpm_result_t tlcl_set_nv_locked(void) +tpm_result_t tlcl1_set_nv_locked(void) { VBDEBUG("TPM: Set NV locked\n"); - return tlcl_define_space(TPM_NV_INDEX_LOCK, 0, 0); + return tlcl1_define_space(TPM_NV_INDEX_LOCK, 0, 0); } -tpm_result_t tlcl_force_clear(void) +tpm_result_t tlcl1_force_clear(void) { VBDEBUG("TPM: Force clear\n"); return send(tpm_forceclear_cmd.buffer); } -tpm_result_t tlcl_set_enable(void) +tpm_result_t tlcl1_set_enable(void) { VBDEBUG("TPM: Enabling TPM\n"); return send(tpm_physicalenable_cmd.buffer); } -tpm_result_t tlcl_set_deactivated(uint8_t flag) +tpm_result_t tlcl1_set_deactivated(uint8_t flag) { struct s_tpm_physicalsetdeactivated_cmd cmd; VBDEBUG("TPM: SetDeactivated(%d)\n", flag); @@ -304,12 +279,12 @@ return send(cmd.buffer); } -tpm_result_t tlcl_get_permanent_flags(TPM_PERMANENT_FLAGS *pflags) +tpm_result_t tlcl1_get_permanent_flags(TPM_PERMANENT_FLAGS *pflags) { uint8_t response[TPM_LARGE_ENOUGH_COMMAND_SIZE]; uint32_t size; - tpm_result_t rc = tlcl_send_receive(tpm_getflags_cmd.buffer, response, - sizeof(response)); + tpm_result_t rc = + tlcl1_send_receive(tpm_getflags_cmd.buffer, response, sizeof(response)); if (rc != TPM_SUCCESS) return rc; from_tpm_uint32(response + kTpmResponseHeaderLength, &size); @@ -320,11 +295,10 @@ return rc; } -tpm_result_t tlcl_get_flags(uint8_t *disable, uint8_t *deactivated, - uint8_t *nvlocked) +tpm_result_t tlcl1_get_flags(uint8_t *disable, uint8_t *deactivated, uint8_t *nvlocked) { TPM_PERMANENT_FLAGS pflags; - tpm_result_t rc = tlcl_get_permanent_flags(&pflags); + tpm_result_t rc = tlcl1_get_permanent_flags(&pflags); if (rc == TPM_SUCCESS) { if (disable) *disable = pflags.disable; @@ -338,14 +312,14 @@ return rc; } -tpm_result_t tlcl_set_global_lock(void) +tpm_result_t tlcl1_set_global_lock(void) { VBDEBUG("TPM: Set global lock\n"); - return tlcl_write(TPM_NV_INDEX0, NULL, 0); + return tlcl1_write(TPM_NV_INDEX0, NULL, 0); } -tpm_result_t tlcl_extend(int pcr_num, const uint8_t *digest_data, - enum vb2_hash_algorithm digest_algo) +tpm_result_t tlcl1_extend(int pcr_num, const uint8_t *digest_data, + enum vb2_hash_algorithm digest_algo) { struct s_tpm_extend_cmd cmd; uint8_t response[kTpmResponseHeaderLength + kPcrDigestLength]; @@ -357,10 +331,10 @@ to_tpm_uint32(cmd.buffer + tpm_extend_cmd.pcrNum, pcr_num); memcpy(cmd.buffer + cmd.inDigest, digest_data, kPcrDigestLength); - return tlcl_send_receive(cmd.buffer, response, sizeof(response)); + return tlcl1_send_receive(cmd.buffer, response, sizeof(response)); } -tpm_result_t tlcl_get_permissions(uint32_t index, uint32_t *permissions) +tpm_result_t tlcl1_get_permissions(uint32_t index, uint32_t *permissions) { struct s_tpm_getpermissions_cmd cmd; uint8_t response[TPM_LARGE_ENOUGH_COMMAND_SIZE]; @@ -370,7 +344,7 @@ memcpy(&cmd, &tpm_getpermissions_cmd, sizeof(cmd)); to_tpm_uint32(cmd.buffer + tpm_getpermissions_cmd.index, index); - rc = tlcl_send_receive(cmd.buffer, response, sizeof(response)); + rc = tlcl1_send_receive(cmd.buffer, response, sizeof(response)); if (rc != TPM_SUCCESS) return rc; diff --git a/src/security/tpm/tss/tcg-2.0/tss.c b/src/security/tpm/tss/tcg-2.0/tss.c index 27390a7..282845e 100644 --- a/src/security/tpm/tss/tcg-2.0/tss.c +++ b/src/security/tpm/tss/tcg-2.0/tss.c @@ -16,9 +16,7 @@ * TPM2 specification. */ -static tis_sendrecv_fn tis_sendrecv; - -void *tpm_process_command(TPM_CC command, void *command_body) +void *tlcl2_process_command(TPM_CC command, void *command_body) { struct obuf ob; struct ibuf ib; @@ -28,7 +26,7 @@ /* Command/response buffer. */ static uint8_t cr_buffer[TPM_BUFFER_SIZE]; - if (tis_sendrecv == NULL) { + if (tlcl_tis_sendrecv == NULL) { printk(BIOS_ERR, "Attempted use of uninitialized TSS 2.0 stack\n"); return NULL; } @@ -43,7 +41,7 @@ sendb = obuf_contents(&ob, &out_size); in_size = sizeof(cr_buffer); - if (tis_sendrecv(sendb, out_size, cr_buffer, &in_size)) { + if (tlcl_tis_sendrecv(sendb, out_size, cr_buffer, &in_size)) { printk(BIOS_ERR, "tpm transaction failed\n"); return NULL; } @@ -53,13 +51,13 @@ return tpm_unmarshal_response(command, &ib); } -static tpm_result_t tlcl_send_startup(TPM_SU type) +static tpm_result_t tlcl2_send_startup(TPM_SU type) { struct tpm2_startup startup; struct tpm2_response *response; startup.startup_type = type; - response = tpm_process_command(TPM2_Startup, &startup); + response = tlcl2_process_command(TPM2_Startup, &startup); /* IO error, tpm2_response pointer is empty. */ if (!response) { @@ -82,18 +80,18 @@ return TPM_IOERROR; } -tpm_result_t tlcl_resume(void) +tpm_result_t tlcl2_resume(void) { - return tlcl_send_startup(TPM_SU_STATE); + return tlcl2_send_startup(TPM_SU_STATE); } -static tpm_result_t tlcl_send_shutdown(TPM_SU type) +static tpm_result_t tlcl2_send_shutdown(TPM_SU type) { struct tpm2_shutdown shutdown; struct tpm2_response *response; shutdown.shutdown_type = type; - response = tpm_process_command(TPM2_Shutdown, &shutdown); + response = tlcl2_process_command(TPM2_Shutdown, &shutdown); /* IO error, tpm2_response pointer is empty. */ if (!response) { @@ -111,12 +109,12 @@ return TPM_IOERROR; } -tpm_result_t tlcl_save_state(void) +tpm_result_t tlcl2_save_state(void) { - return tlcl_send_shutdown(TPM_SU_STATE); + return tlcl2_send_shutdown(TPM_SU_STATE); } -tpm_result_t tlcl_assert_physical_presence(void) +tpm_result_t tlcl2_assert_physical_presence(void) { /* * Nothing to do on TPM2 for this, use platform hierarchy availability @@ -142,8 +140,12 @@ } } -tpm_result_t tlcl_extend(int pcr_num, const uint8_t *digest_data, - enum vb2_hash_algorithm digest_type) +/* + * The caller will provide the digest in a 32 byte buffer, let's consider it a + * sha256 digest. + */ +tpm_result_t tlcl2_extend(int pcr_num, const uint8_t *digest_data, + enum vb2_hash_algorithm digest_type) { struct tpm2_pcr_extend_cmd pcr_ext_cmd; struct tpm2_response *response; @@ -160,7 +162,7 @@ memcpy(pcr_ext_cmd.digests.digests[0].digest.sha512, digest_data, vb2_digest_size(digest_type)); - response = tpm_process_command(TPM2_PCR_Extend, &pcr_ext_cmd); + response = tlcl2_process_command(TPM2_PCR_Extend, &pcr_ext_cmd); printk(BIOS_INFO, "%s: response is %#x\n", __func__, response ? response->hdr.tpm_code : -1); @@ -170,18 +172,18 @@ return TPM_SUCCESS; } -tpm_result_t tlcl_finalize_physical_presence(void) +tpm_result_t tlcl2_finalize_physical_presence(void) { /* Nothing needs to be done with tpm2. */ printk(BIOS_INFO, "%s:%s:%d\n", __FILE__, __func__, __LINE__); return TPM_SUCCESS; } -tpm_result_t tlcl_force_clear(void) +tpm_result_t tlcl2_force_clear(void) { struct tpm2_response *response; - response = tpm_process_command(TPM2_Clear, NULL); + response = tlcl2_process_command(TPM2_Clear, NULL); printk(BIOS_INFO, "%s: response is %#x\n", __func__, response ? response->hdr.tpm_code : -1); @@ -191,16 +193,16 @@ return TPM_SUCCESS; } -tpm_result_t tlcl_clear_control(bool disable) +tpm_result_t tlcl2_clear_control(bool disable) { struct tpm2_response *response; struct tpm2_clear_control_cmd cc = { .disable = 0, }; - response = tpm_process_command(TPM2_ClearControl, &cc); + response = tlcl2_process_command(TPM2_ClearControl, &cc); printk(BIOS_INFO, "%s: response is %#x\n", - __func__, response ? response->hdr.tpm_code : -1); + __func__, response ? response->hdr.tpm_code : -1); if (!response || response->hdr.tpm_code) return TPM_IOERROR; @@ -208,37 +210,13 @@ return TPM_SUCCESS; } -/* This function is called directly by vboot, uses vboot return types. */ -tpm_result_t tlcl_lib_init(void) -{ - enum tpm_family family; - - if (tis_sendrecv != NULL) - return TPM_SUCCESS; - - tis_sendrecv = tis_probe(&family); - if (tis_sendrecv == NULL) { - printk(BIOS_ERR, "%s: tis_probe returned error\n", __func__); - return TPM_CB_NO_DEVICE; - } - - if (family != TPM_2) { - tis_sendrecv = NULL; - printk(BIOS_ERR, "%s: tis_probe returned unsupported TPM family: %d\n", - __func__, family); - return TPM_CB_INTERNAL_INCONSISTENCY; - } - - return TPM_SUCCESS; -} - -tpm_result_t tlcl_physical_presence_cmd_enable(void) +tpm_result_t tlcl2_physical_presence_cmd_enable(void) { printk(BIOS_INFO, "%s:%s:%d\n", __FILE__, __func__, __LINE__); return TPM_SUCCESS; } -tpm_result_t tlcl_read(uint32_t index, void *data, uint32_t length) +tpm_result_t tlcl2_read(uint32_t index, void *data, uint32_t length) { struct tpm2_nv_read_cmd nv_readc; struct tpm2_response *response; @@ -248,7 +226,7 @@ nv_readc.nvIndex = HR_NV_INDEX + index; nv_readc.size = length; - response = tpm_process_command(TPM2_NV_Read, &nv_readc); + response = tlcl2_process_command(TPM2_NV_Read, &nv_readc); /* Need to map tpm error codes into internal values. */ if (!response) @@ -287,20 +265,20 @@ return TPM_SUCCESS; } -tpm_result_t tlcl_self_test_full(void) +tpm_result_t tlcl2_self_test_full(void) { struct tpm2_self_test st; struct tpm2_response *response; st.yes_no = 1; - response = tpm_process_command(TPM2_SelfTest, &st); + response = tlcl2_process_command(TPM2_SelfTest, &st); printk(BIOS_INFO, "%s: response is %#x\n", __func__, response ? response->hdr.tpm_code : -1); return TPM_SUCCESS; } -tpm_result_t tlcl_lock_nv_write(uint32_t index) +tpm_result_t tlcl2_lock_nv_write(uint32_t index) { struct tpm2_response *response; /* TPM Will reject attempts to write at non-defined index. */ @@ -308,7 +286,7 @@ .nvIndex = HR_NV_INDEX + index, }; - response = tpm_process_command(TPM2_NV_WriteLock, &nv_wl); + response = tlcl2_process_command(TPM2_NV_WriteLock, &nv_wl); printk(BIOS_INFO, "%s: response is %#x\n", __func__, response ? response->hdr.tpm_code : -1); @@ -319,12 +297,12 @@ return TPM_SUCCESS; } -tpm_result_t tlcl_startup(void) +tpm_result_t tlcl2_startup(void) { - return tlcl_send_startup(TPM_SU_CLEAR); + return tlcl2_send_startup(TPM_SU_CLEAR); } -tpm_result_t tlcl_write(uint32_t index, const void *data, uint32_t length) +tpm_result_t tlcl2_write(uint32_t index, const void *data, uint32_t length) { struct tpm2_nv_write_cmd nv_writec; struct tpm2_response *response; @@ -335,7 +313,7 @@ nv_writec.data.t.size = length; nv_writec.data.t.buffer = data; - response = tpm_process_command(TPM2_NV_Write, &nv_writec); + response = tlcl2_process_command(TPM2_NV_Write, &nv_writec); printk(BIOS_INFO, "%s: response is %#x\n", __func__, response ? response->hdr.tpm_code : -1); @@ -347,7 +325,7 @@ return TPM_SUCCESS; } -tpm_result_t tlcl_set_bits(uint32_t index, uint64_t bits) +tpm_result_t tlcl2_set_bits(uint32_t index, uint64_t bits) { struct tpm2_nv_setbits_cmd nvsb_cmd; struct tpm2_response *response; @@ -358,7 +336,7 @@ nvsb_cmd.nvIndex = HR_NV_INDEX + index; nvsb_cmd.bits = bits; - response = tpm_process_command(TPM2_NV_SetBits, &nvsb_cmd); + response = tlcl2_process_command(TPM2_NV_SetBits, &nvsb_cmd); printk(BIOS_INFO, "%s: response is %#x\n", __func__, response ? response->hdr.tpm_code : -1); @@ -370,9 +348,9 @@ return TPM_SUCCESS; } -tpm_result_t tlcl_define_space(uint32_t space_index, size_t space_size, - const TPMA_NV nv_attributes, - const uint8_t *nv_policy, size_t nv_policy_size) +tpm_result_t tlcl2_define_space(uint32_t space_index, size_t space_size, + const TPMA_NV nv_attributes, + const uint8_t *nv_policy, size_t nv_policy_size) { struct tpm2_nv_define_space_cmd nvds_cmd; struct tpm2_response *response; @@ -395,7 +373,7 @@ nvds_cmd.publicInfo.authPolicy.t.size = nv_policy_size; } - response = tpm_process_command(TPM2_NV_DefineSpace, &nvds_cmd); + response = tlcl2_process_command(TPM2_NV_DefineSpace, &nvds_cmd); printk(BIOS_INFO, "%s: response is %#x\n", __func__, response ? response->hdr.tpm_code : -1); @@ -413,7 +391,7 @@ } } -uint16_t tlcl_get_hash_size_from_algo(TPMI_ALG_HASH hash_algo) +uint16_t tlcl2_get_hash_size_from_algo(TPMI_ALG_HASH hash_algo) { uint16_t value; @@ -445,7 +423,7 @@ return value; } -tpm_result_t tlcl_disable_platform_hierarchy(void) +tpm_result_t tlcl2_disable_platform_hierarchy(void) { struct tpm2_response *response; struct tpm2_hierarchy_control_cmd hc = { @@ -453,7 +431,7 @@ .state = 0, }; - response = tpm_process_command(TPM2_Hierarchy_Control, &hc); + response = tlcl2_process_command(TPM2_Hierarchy_Control, &hc); if (!response || response->hdr.tpm_code) return TPM_CB_INTERNAL_INCONSISTENCY; @@ -461,9 +439,9 @@ return TPM_SUCCESS; } -tpm_result_t tlcl_get_capability(TPM_CAP capability, uint32_t property, - uint32_t property_count, - TPMS_CAPABILITY_DATA *capability_data) +tpm_result_t tlcl2_get_capability(TPM_CAP capability, uint32_t property, + uint32_t property_count, + TPMS_CAPABILITY_DATA *capability_data) { struct tpm2_get_capability cmd; struct tpm2_response *response; @@ -478,7 +456,7 @@ return TPM_IOERROR; } - response = tpm_process_command(TPM2_GetCapability, &cmd); + response = tlcl2_process_command(TPM2_GetCapability, &cmd); if (!response) { printk(BIOS_ERR, "%s: Command Failed\n", __func__); diff --git a/src/security/tpm/tss/tcg-2.0/tss_marshaling.c b/src/security/tpm/tss/tcg-2.0/tss_marshaling.c index 5ade639..3039a8b 100644 --- a/src/security/tpm/tss/tcg-2.0/tss_marshaling.c +++ b/src/security/tpm/tss/tcg-2.0/tss_marshaling.c @@ -79,23 +79,23 @@ switch (tpmtha->hashAlg) { case TPM_ALG_SHA1: rc |= obuf_write(ob, tpmtha->digest.sha1, - tlcl_get_hash_size_from_algo(tpmtha->hashAlg)); + tlcl2_get_hash_size_from_algo(tpmtha->hashAlg)); break; case TPM_ALG_SHA256: rc |= obuf_write(ob, tpmtha->digest.sha256, - tlcl_get_hash_size_from_algo(tpmtha->hashAlg)); + tlcl2_get_hash_size_from_algo(tpmtha->hashAlg)); break; case TPM_ALG_SM3_256: rc |= obuf_write(ob, tpmtha->digest.sm3_256, - tlcl_get_hash_size_from_algo(tpmtha->hashAlg)); + tlcl2_get_hash_size_from_algo(tpmtha->hashAlg)); break; case TPM_ALG_SHA384: rc |= obuf_write(ob, tpmtha->digest.sha384, - tlcl_get_hash_size_from_algo(tpmtha->hashAlg)); + tlcl2_get_hash_size_from_algo(tpmtha->hashAlg)); break; case TPM_ALG_SHA512: rc |= obuf_write(ob, tpmtha->digest.sha512, - tlcl_get_hash_size_from_algo(tpmtha->hashAlg)); + tlcl2_get_hash_size_from_algo(tpmtha->hashAlg)); break; default: rc = -1; diff --git a/src/security/tpm/tss/tss.c b/src/security/tpm/tss/tss.c new file mode 100644 index 0000000..bd0e985 --- /dev/null +++ b/src/security/tpm/tss/tss.c @@ -0,0 +1,39 @@ +/* SPDX-License-Identifier: BSD-3-Clause */ + +#include <console/console.h> +#include <security/tpm/tis.h> +#include <security/tpm/tss.h> + +/* + * This unit is meant to dispatch to either TPM1.2 or TPM2.0 TSS implementation + * based on TPM family determined on probing during initialization. + */ + +enum tpm_family tlcl_tpm_family = TPM_UNKNOWN; + +tis_sendrecv_fn tlcl_tis_sendrecv; + +/* Probe for TPM device and choose implementation based on the returned TPM family. */ +tpm_result_t tlcl_lib_init(void) +{ + /* Don't probe for TPM more than once per stage. */ + static bool init_done; + if (init_done) + return tlcl_tpm_family == TPM_UNKNOWN ? TPM_CB_NO_DEVICE : TPM_SUCCESS; + + /* Set right away to make recursion impossible. */ + init_done = true; + + tlcl_tis_sendrecv = tis_probe(&tlcl_tpm_family); + + if (tlcl_tis_sendrecv == NULL) { + printk(BIOS_ERR, "%s: tis_probe failed\n", __func__); + tlcl_tpm_family = TPM_UNKNOWN; + } else if (tlcl_tpm_family != TPM_1 && tlcl_tpm_family != TPM_2) { + printk(BIOS_ERR, "%s: tis_probe returned incorrect TPM family: %d\n", __func__, + tlcl_tpm_family); + tlcl_tpm_family = TPM_UNKNOWN; + } + + return tlcl_tpm_family == TPM_UNKNOWN ? TPM_CB_NO_DEVICE : TPM_SUCCESS; +} diff --git a/src/security/tpm/tss/vendor/cr50/cr50.c b/src/security/tpm/tss/vendor/cr50/cr50.c index 31eab2d..b843afa 100644 --- a/src/security/tpm/tss/vendor/cr50/cr50.c +++ b/src/security/tpm/tss/vendor/cr50/cr50.c @@ -16,7 +16,7 @@ printk(BIOS_INFO, "Enabling cr50 nvmem commits\n"); - response = tpm_process_command(TPM2_CR50_VENDOR_COMMAND, &sub_command); + response = tlcl2_process_command(TPM2_CR50_VENDOR_COMMAND, &sub_command); if (!response || (response && response->hdr.tpm_code)) { if (response) @@ -39,7 +39,7 @@ printk(BIOS_INFO, "Checking cr50 for pending updates\n"); - response = tpm_process_command(TPM2_CR50_VENDOR_COMMAND, command_body); + response = tlcl2_process_command(TPM2_CR50_VENDOR_COMMAND, command_body); if (!response || response->hdr.tpm_code) return TPM_IOERROR; @@ -55,7 +55,7 @@ printk(BIOS_INFO, "Checking cr50 for recovery request\n"); - response = tpm_process_command(TPM2_CR50_VENDOR_COMMAND, &sub_command); + response = tlcl2_process_command(TPM2_CR50_VENDOR_COMMAND, &sub_command); if (!response || response->hdr.tpm_code) return TPM_IOERROR; @@ -72,7 +72,7 @@ printk(BIOS_INFO, "Reading cr50 TPM mode\n"); - response = tpm_process_command(TPM2_CR50_VENDOR_COMMAND, &mode_command); + response = tlcl2_process_command(TPM2_CR50_VENDOR_COMMAND, &mode_command); if (!response) return TPM_IOERROR; @@ -112,7 +112,7 @@ printk(BIOS_DEBUG, "Reading cr50 boot mode\n"); - response = tpm_process_command(TPM2_CR50_VENDOR_COMMAND, &mode_command); + response = tlcl2_process_command(TPM2_CR50_VENDOR_COMMAND, &mode_command); if (!response) return TPM_IOERROR; @@ -141,8 +141,7 @@ * Issue an immediate reset to the Cr50. */ printk(BIOS_INFO, "Issuing cr50 reset\n"); - response = tpm_process_command(TPM2_CR50_VENDOR_COMMAND, - &reset_command_body); + response = tlcl2_process_command(TPM2_CR50_VENDOR_COMMAND, &reset_command_body); if (!response) return TPM_IOERROR; @@ -157,7 +156,7 @@ printk(BIOS_DEBUG, "Issuing EC reset\n"); - response = tpm_process_command(TPM2_CR50_VENDOR_COMMAND, &reset_cmd); + response = tlcl2_process_command(TPM2_CR50_VENDOR_COMMAND, &reset_cmd); if (!response) return TPM_IOERROR; @@ -183,7 +182,7 @@ uint16_t factory_config_command = TPM2_CR50_SUB_CMD_GET_FACTORY_CONFIG; *factory_config = 0; - response = tpm_process_command(TPM2_CR50_VENDOR_COMMAND, &factory_config_command); + response = tlcl2_process_command(TPM2_CR50_VENDOR_COMMAND, &factory_config_command); if (!response) return TPM_IOERROR; diff --git a/src/security/tpm/tss1.h b/src/security/tpm/tss1.h new file mode 100644 index 0000000..9894e80 --- /dev/null +++ b/src/security/tpm/tss1.h @@ -0,0 +1,94 @@ +/* SPDX-License-Identifier: BSD-3-Clause */ + +#ifndef TSS1_H_ +#define TSS1_H_ + +#include <types.h> +#include <vb2_sha.h> + +#include <security/tpm/tss/tcg-1.2/tss_structures.h> +#include <security/tpm/tss_errors.h> + +/* + * TPM1.2-specific + * + * Some operations don't have counterparts in standard and are directly exposed + * here. + * + * Other operations are applicable to both TPM versions and have wrappers which + * pick the implementation based on version determined during initialization via + * tlcl_lib_init(). + */ + +/** + * Define a space with permission [perm]. [index] is the index for the space, + * [size] the usable data size. The TPM error code is returned. + */ +tpm_result_t tlcl1_define_space(uint32_t index, uint32_t perm, uint32_t size); + +/** + * Issue a PhysicalEnable. The TPM error code is returned. + */ +tpm_result_t tlcl1_set_enable(void); + +/** + * Issue a SetDeactivated. Pass 0 to activate. Returns result code. + */ +tpm_result_t tlcl1_set_deactivated(uint8_t flag); + +/** + * Get flags of interest. Pointers for flags you aren't interested in may + * be NULL. The TPM error code is returned. + */ +tpm_result_t tlcl1_get_flags(uint8_t *disable, uint8_t *deactivated, uint8_t *nvlocked); + +/** + * Perform a raw TPM request/response transaction. + */ +tpm_result_t tlcl1_send_receive(const uint8_t *request, uint8_t *response, int max_length); + +/** + * Run the self test in the background. + */ +tpm_result_t tlcl1_continue_self_test(void); + +/** + * Set the nvLocked bit. The TPM error code is returned. + */ +tpm_result_t tlcl1_set_nv_locked(void); + +/** + * Get the entire set of permanent flags. + */ +tpm_result_t tlcl1_get_permanent_flags(TPM_PERMANENT_FLAGS *pflags); + +/** + * Set the bGlobalLock flag, which only a reboot can clear. The TPM error + * code is returned. + */ +tpm_result_t tlcl1_set_global_lock(void); + +/** + * Get the permission bits for the NVRAM space with |index|. + */ +tpm_result_t tlcl1_get_permissions(uint32_t index, uint32_t *permissions); + +/* + * Declarations for "private" functions which are dispatched to by tss/tss.c + * based on TPM family. + */ + +tpm_result_t tlcl1_save_state(void); +tpm_result_t tlcl1_resume(void); +tpm_result_t tlcl1_startup(void); +tpm_result_t tlcl1_self_test_full(void); +tpm_result_t tlcl1_read(uint32_t index, void *data, uint32_t length); +tpm_result_t tlcl1_write(uint32_t index, const void *data, uint32_t length); +tpm_result_t tlcl1_assert_physical_presence(void); +tpm_result_t tlcl1_physical_presence_cmd_enable(void); +tpm_result_t tlcl1_finalize_physical_presence(void); +tpm_result_t tlcl1_force_clear(void); +tpm_result_t tlcl1_extend(int pcr_num, const uint8_t *digest_data, + enum vb2_hash_algorithm digest_algo); + +#endif /* TSS1_H_ */ diff --git a/src/security/tpm/tss2.h b/src/security/tpm/tss2.h new file mode 100644 index 0000000..16ccf5d --- /dev/null +++ b/src/security/tpm/tss2.h @@ -0,0 +1,83 @@ +/* SPDX-License-Identifier: BSD-3-Clause */ + +#ifndef TSS2_H_ +#define TSS2_H_ + +#include <types.h> +#include <vb2_sha.h> + +#include <security/tpm/tss/tcg-2.0/tss_structures.h> +#include <security/tpm/tss_errors.h> + +/* + * TPM2-specific + * + * Some operations don't have counterparts in standard and are directly exposed + * here. + * + * Other operations are applicable to both TPM versions and have wrappers which + * pick the implementation based on version determined during initialization via + * tlcl_lib_init(). + */ + +/* + * Define a TPM2 space. The define space command TPM command used by the tlcl + * layer offers the ability to use custom nv attributes and policies. + */ +tpm_result_t tlcl2_define_space(uint32_t space_index, size_t space_size, + const TPMA_NV nv_attributes, + const uint8_t *nv_policy, size_t nv_policy_size); + +/* + * Issue TPM2_GetCapability command + */ +tpm_result_t tlcl2_get_capability(TPM_CAP capability, uint32_t property, + uint32_t property_count, + TPMS_CAPABILITY_DATA *capability_data); + +/* Issue TPM2_NV_SetBits command */ +tpm_result_t tlcl2_set_bits(uint32_t index, uint64_t bits); + +/* + * Makes tlcl2_process_command available for on top implementations of + * custom tpm standards like cr50 + */ +void *tlcl2_process_command(TPM_CC command, void *command_body); + +/* Return digest size of hash algorithm */ +uint16_t tlcl2_get_hash_size_from_algo(TPMI_ALG_HASH hash_algo); + +/** + * Set Clear Control. The TPM error code is returned. + */ +tpm_result_t tlcl2_clear_control(bool disable); + +/** + * Make an NV Ram location read_only. The TPM error code is returned. + */ +tpm_result_t tlcl2_lock_nv_write(uint32_t index); + +/** + * Disable platform hierarchy. Specific to TPM2. The TPM error code is returned. + */ +tpm_result_t tlcl2_disable_platform_hierarchy(void); + +/* + * Declarations for "private" functions which are dispatched to by tss/tss.c + * based on TPM family. + */ + +tpm_result_t tlcl2_save_state(void); +tpm_result_t tlcl2_resume(void); +tpm_result_t tlcl2_startup(void); +tpm_result_t tlcl2_self_test_full(void); +tpm_result_t tlcl2_read(uint32_t index, void *data, uint32_t length); +tpm_result_t tlcl2_write(uint32_t index, const void *data, uint32_t length); +tpm_result_t tlcl2_assert_physical_presence(void); +tpm_result_t tlcl2_physical_presence_cmd_enable(void); +tpm_result_t tlcl2_finalize_physical_presence(void); +tpm_result_t tlcl2_force_clear(void); +tpm_result_t tlcl2_extend(int pcr_num, const uint8_t *digest_data, + enum vb2_hash_algorithm digest_algo); + +#endif /* TSS2_H_ */ diff --git a/src/security/vboot/secdata_tpm.c b/src/security/vboot/secdata_tpm.c index 1204be8..21901bb 100644 --- a/src/security/vboot/secdata_tpm.c +++ b/src/security/vboot/secdata_tpm.c @@ -41,8 +41,7 @@ */ uint32_t perms; - RETURN_ON_FAILURE(tlcl_get_permissions(KERNEL_NV_INDEX, - &perms)); + RETURN_ON_FAILURE(tlcl1_get_permissions(KERNEL_NV_INDEX, &perms)); if (perms != TPM_NV_PER_PPWRITE) { printk(BIOS_ERR, "TPM: invalid secdata_kernel permissions\n"); @@ -208,8 +207,7 @@ { tpm_result_t rc; - rc = tlcl_define_space(index, length, nv_attributes, nv_policy, - nv_policy_size); + rc = tlcl2_define_space(index, length, nv_attributes, nv_policy, nv_policy_size); if (rc == TPM_CB_NV_DEFINED) { /* * Continue with writing: it may be defined, but not written @@ -334,8 +332,7 @@ * Since the RMA counter has the BITS attribute, we need to call * TPM2_NV_SetBits() in order to initialize it. */ - rc = tlcl_set_bits(ZTE_RMA_BYTES_COUNTER_INDEX, - rma_bytes_counter_default); + rc = tlcl2_set_bits(ZTE_RMA_BYTES_COUNTER_INDEX, rma_bytes_counter_default); if (rc != TPM_SUCCESS) { VBDEBUG("%s: Failed to init RMA Bytes counter space wit error %#x\n", __func__, rc); @@ -431,7 +428,7 @@ tpm_result_t antirollback_lock_space_firmware(void) { - return tlcl_lock_nv_write(FIRMWARE_NV_INDEX); + return tlcl2_lock_nv_write(FIRMWARE_NV_INDEX); } tpm_result_t antirollback_read_space_mrc_hash(uint32_t index, uint8_t *data, uint32_t size) @@ -475,7 +472,7 @@ tpm_result_t antirollback_lock_space_mrc_hash(uint32_t index) { - return tlcl_lock_nv_write(index); + return tlcl2_lock_nv_write(index); } static tpm_result_t read_space_vbios_hash(uint8_t *data) @@ -552,10 +549,10 @@ */ static tpm_result_t safe_define_space(uint32_t index, uint32_t perm, uint32_t size) { - tpm_result_t rc = tlcl_define_space(index, perm, size); + tpm_result_t rc = tlcl1_define_space(index, perm, size); if (rc == TPM_MAXNVWRITES) { RETURN_ON_FAILURE(tpm_clear_and_reenable()); - return tlcl_define_space(index, perm, size); + return tlcl1_define_space(index, perm, size); } else { return rc; } @@ -569,7 +566,7 @@ vb2api_secdata_firmware_create(ctx); vb2api_secdata_kernel_create_v0(ctx); - rc = tlcl_get_permanent_flags(&pflags); + rc = tlcl1_get_permanent_flags(&pflags); if (rc != TPM_SUCCESS) return rc; @@ -592,7 +589,7 @@ VBDEBUG("TPM: nvLocked=%d\n", pflags.nvLocked); if (!pflags.nvLocked) { VBDEBUG("TPM: Enabling NV locking\n"); - RETURN_ON_FAILURE(tlcl_set_nv_locked()); + RETURN_ON_FAILURE(tlcl1_set_nv_locked()); } /* Clear TPM owner, in case the TPM is already owned for some reason. */ @@ -621,7 +618,7 @@ tpm_result_t antirollback_lock_space_firmware(void) { - return tlcl_set_global_lock(); + return tlcl1_set_global_lock(); } #endif diff --git a/src/soc/amd/common/psp_verstage/psp_verstage.c b/src/soc/amd/common/psp_verstage/psp_verstage.c index b49acae..0b09c5f 100644 --- a/src/soc/amd/common/psp_verstage/psp_verstage.c +++ b/src/soc/amd/common/psp_verstage/psp_verstage.c @@ -227,9 +227,9 @@ reboot_into_recovery(vboot_get_context(), POSTCODE_INIT_TPM_FAILED); } - rc = tlcl_disable_platform_hierarchy(); + rc = tlcl2_disable_platform_hierarchy(); if (rc != TPM_SUCCESS) { - printk(BIOS_ERR, "tlcl_disable_platform_hierarchy failed rc:%d\n", rc); + printk(BIOS_ERR, "tlcl2_disable_platform_hierarchy failed rc:%d\n", rc); reboot_into_recovery(vboot_get_context(), POSTCODE_INIT_TPM_FAILED); } } diff --git a/src/vendorcode/eltan/security/mboot/mboot.c b/src/vendorcode/eltan/security/mboot/mboot.c index b456d26..9cdd0de 100644 --- a/src/vendorcode/eltan/security/mboot/mboot.c +++ b/src/vendorcode/eltan/security/mboot/mboot.c @@ -67,7 +67,7 @@ * * Return the TPM PCR information. * - * This function parses the data got from tlcl_get_capability and returns the + * This function parses the data got from tlcl2_get_capability and returns the * PcrSelection. * * @param[out] Pcrs The Pcr Selection @@ -81,7 +81,7 @@ tpm_result_t rc; int index; - rc = tlcl_get_capability(TPM_CAP_PCRS, 0, 1, &TpmCap); + rc = tlcl2_get_capability(TPM_CAP_PCRS, 0, 1, &TpmCap); if (rc == TPM_SUCCESS) { Pcrs->count = TpmCap.data.assignedPCR.count; printk(BIOS_DEBUG, "Pcrs->count = %d\n", Pcrs->count); diff --git a/src/vendorcode/google/chromeos/tpm2.c b/src/vendorcode/google/chromeos/tpm2.c index 9a99f7d..31c28c9 100644 --- a/src/vendorcode/google/chromeos/tpm2.c +++ b/src/vendorcode/google/chromeos/tpm2.c @@ -22,7 +22,7 @@ return; } - rc = tlcl_disable_platform_hierarchy(); + rc = tlcl2_disable_platform_hierarchy(); if (rc != TPM_SUCCESS) printk(BIOS_ERR, "Platform hierarchy disablement failed: %#x\n", rc); -- To view, visit https://review.coreboot.org/c/coreboot/+/69160?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: Ia0ea5a917c46ada9fc3274f17240e12bca98db6a Gerrit-Change-Number: 69160 Gerrit-PatchSet: 35 Gerrit-Owner: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> Gerrit-Reviewer: Christian Walter <christian.walter(a)9elements.com> Gerrit-Reviewer: Erik van den Bogaert <ebogaert(a)eltan.com> Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Reviewer: Frans Hendriks <fhendriks(a)eltan.com> Gerrit-Reviewer: Fred Reitberger <reitbergerfred(a)gmail.com> Gerrit-Reviewer: Jason Glenesk <jason.glenesk(a)gmail.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Krystian Hebel <krystian.hebel(a)3mdeb.com> Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com> Gerrit-Reviewer: Matt DeVillier <matt.devillier(a)amd.corp-partner.google.com> Gerrit-Reviewer: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Raul Rangel <rrangel(a)chromium.org> Gerrit-Reviewer: Yu-Ping Wu <yupingso(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-MessageType: merged

1 0

[M] Change in coreboot[main]: security/tpm: make tis_probe() return tpm_family
by Martin L Roth (Code Review) 28 Mar '24

28 Mar '24

Martin L Roth has submitted this change. ( https://review.coreboot.org/c/coreboot/+/69159?usp=email ) Change subject: security/tpm: make tis_probe() return tpm_family ...................................................................... security/tpm: make tis_probe() return tpm_family Via an out parameter. This is needed to be able to dynamically pick TSS implementation based on the information discovered on probing. Change-Id: I5006e0cdfef76ff79ce9e1cf280fcd5515ae01b0 Ticket: https://ticket.coreboot.org/issues/433 Signed-off-by: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/69159 Reviewed-by: Martin L Roth <gaumless(a)gmail.com> Reviewed-by: Jérémy Compostella <jeremy.compostella(a)intel.com> Reviewed-by: Julius Werner <jwerner(a)chromium.org> Reviewed-by: Christian Walter <christian.walter(a)9elements.com> Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> --- M src/drivers/crb/tis.c M src/drivers/i2c/tpm/cr50.c M src/drivers/i2c/tpm/tis.c M src/drivers/i2c/tpm/tis_atmel.c M src/drivers/i2c/tpm/tpm.c M src/drivers/i2c/tpm/tpm.h M src/drivers/pc80/tpm/tis.c M src/drivers/spi/tpm/tis.c M src/security/tpm/tis.h M src/security/tpm/tss/tcg-1.2/tss.c M src/security/tpm/tss/tcg-2.0/tss.c 11 files changed, 99 insertions(+), 31 deletions(-) Approvals: build bot (Jenkins): Verified Christian Walter: Looks good to me, approved Julius Werner: Looks good to me, approved Martin L Roth: Looks good to me, approved Jérémy Compostella: Looks good to me, but someone else must approve diff --git a/src/drivers/crb/tis.c b/src/drivers/crb/tis.c index a5d7dcc..766ee25 100644 --- a/src/drivers/crb/tis.c +++ b/src/drivers/crb/tis.c @@ -46,7 +46,7 @@ return TPM_SUCCESS; } -tis_sendrecv_fn tis_probe(void) +tis_sendrecv_fn tis_probe(enum tpm_family *family) { struct tpm2_info info; @@ -54,6 +54,10 @@ if (tpm2_init()) return NULL; + /* CRB interface exists only in TPM2 */ + if (family != NULL) + *family = TPM_2; + tpm2_get_info(&info); printk(BIOS_INFO, "Initialized TPM device %s revision %d\n", tis_get_dev_name(&info), diff --git a/src/drivers/i2c/tpm/cr50.c b/src/drivers/i2c/tpm/cr50.c index 8462198..b58fbc8 100644 --- a/src/drivers/i2c/tpm/cr50.c +++ b/src/drivers/i2c/tpm/cr50.c @@ -424,8 +424,11 @@ chip->cancel = &cr50_i2c_tis_ready; } -tpm_result_t tpm_vendor_probe(unsigned int bus, uint32_t addr) +tpm_result_t tpm_vendor_probe(unsigned int bus, uint32_t addr, enum tpm_family *family) { + /* cr50 is TPM2 */ + if (family != NULL) + *family = TPM_2; return TPM_SUCCESS; } diff --git a/src/drivers/i2c/tpm/tis.c b/src/drivers/i2c/tpm/tis.c index 6cb05f0..fd09240 100644 --- a/src/drivers/i2c/tpm/tis.c +++ b/src/drivers/i2c/tpm/tis.c @@ -118,9 +118,9 @@ return TPM_SUCCESS; } -tis_sendrecv_fn tis_probe(void) +tis_sendrecv_fn tis_probe(enum tpm_family *family) { - if (tpm_vendor_probe(CONFIG_DRIVER_TPM_I2C_BUS, CONFIG_DRIVER_TPM_I2C_ADDR)) + if (tpm_vendor_probe(CONFIG_DRIVER_TPM_I2C_BUS, CONFIG_DRIVER_TPM_I2C_ADDR, family)) return NULL; if (tpm_vendor_init(&chip, CONFIG_DRIVER_TPM_I2C_BUS, CONFIG_DRIVER_TPM_I2C_ADDR)) diff --git a/src/drivers/i2c/tpm/tis_atmel.c b/src/drivers/i2c/tpm/tis_atmel.c index 0a29049..a0bbf33 100644 --- a/src/drivers/i2c/tpm/tis_atmel.c +++ b/src/drivers/i2c/tpm/tis_atmel.c @@ -107,7 +107,19 @@ return TPM_SUCCESS; } -tis_sendrecv_fn tis_probe(void) +tis_sendrecv_fn tis_probe(enum tpm_family *family) { + /* + * Can't query version or really anything as the device doesn't support + * much through this interface (can't specify address on accesses). + * + * Hence the assumption is that whatever TPM version is enabled at + * compile-time defines what the device supports. The check is written + * in a way to give TPM 1 preference even if support for both versions + * is compiled in. + */ + if (family != NULL) + *family = CONFIG(TPM1) ? TPM_1 : TPM_2; + return &i2c_tis_sendrecv; } diff --git a/src/drivers/i2c/tpm/tpm.c b/src/drivers/i2c/tpm/tpm.c index 541eb3a..eb27984 100644 --- a/src/drivers/i2c/tpm/tpm.c +++ b/src/drivers/i2c/tpm/tpm.c @@ -451,13 +451,29 @@ /* Initialization of I2C TPM */ -tpm_result_t tpm_vendor_probe(unsigned int bus, uint32_t addr) +tpm_result_t tpm_vendor_probe(unsigned int bus, uint32_t addr, enum tpm_family *family) { struct stopwatch sw; uint8_t buf = 0; int ret; long sw_run_duration = SLEEP_DURATION_PROBE_MS; + /* + * Infineon "I2C Protocol Stack Specification v0.20" is supposedly a + * simple adoption of the LPC TIS Protocol to the I2C Bus, but looking + * at "TCG PC Client Specific TIS" doesn't confirm that and Infineon's + * specification isn't publicly available. + * + * Because it's unknown how to access information about TPM version of + * the device in this case, the assumption is that whatever TPM version + * is enabled at compile-time defines what the device supports. And + * since this driver doesn't appear to be used with TPM 2 devices, the + * check is written in a way to give TPM 1 preference even if support + * for both versions is compiled in. + */ + if (family != NULL) + *family = CONFIG(TPM1) ? TPM_1 : TPM_2; + tpm_dev.chip_type = UNKNOWN; tpm_dev.bus = bus; tpm_dev.addr = addr; diff --git a/src/drivers/i2c/tpm/tpm.h b/src/drivers/i2c/tpm/tpm.h index 628ad4d..46935e24 100644 --- a/src/drivers/i2c/tpm/tpm.h +++ b/src/drivers/i2c/tpm/tpm.h @@ -12,6 +12,7 @@ #ifndef __DRIVERS_TPM_SLB9635_I2C_TPM_H__ #define __DRIVERS_TPM_SLB9635_I2C_TPM_H__ +#include <security/tpm/tis.h> #include <security/tpm/tss_errors.h> #include <stdint.h> @@ -51,7 +52,7 @@ /* ---------- Interface for TPM vendor ------------ */ -tpm_result_t tpm_vendor_probe(unsigned int bus, uint32_t addr); +tpm_result_t tpm_vendor_probe(unsigned int bus, uint32_t addr, enum tpm_family *family); tpm_result_t tpm_vendor_init(struct tpm_chip *chip, unsigned int bus, uint32_t dev_addr); diff --git a/src/drivers/pc80/tpm/tis.c b/src/drivers/pc80/tpm/tis.c index 90fa32e..da443d3 100644 --- a/src/drivers/pc80/tpm/tis.c +++ b/src/drivers/pc80/tpm/tis.c @@ -78,12 +78,6 @@ /* 1 second is plenty for anything TPM does.*/ #define MAX_DELAY_US USECS_PER_SEC -enum tpm_family { - TPM_UNKNOWN = 0, - TPM_1 = 1, - TPM_2 = 2, -}; - /* * Structures defined below allow creating descriptions of TPM vendor/device * ID information for run time discovery. @@ -380,8 +374,10 @@ * Returns TPM_SUCCESS on success (the device is found or was found during * an earlier invocation) or TPM_CB_FAIL if the device is not found. */ -static tpm_result_t pc80_tis_probe(void) +static tpm_result_t pc80_tis_probe(enum tpm_family *family) { + static enum tpm_family tpm_family; + const char *device_name = NULL; const char *vendor_name = NULL; const struct device_name *dev; @@ -389,11 +385,13 @@ u16 vid, did; u8 locality = 0, intf_type; int i; - enum tpm_family family; const char *family_str; - if (vendor_dev_id) + if (vendor_dev_id) { + if (family != NULL) + *family = tpm_family; return TPM_SUCCESS; /* Already probed. */ + } didvid = tpm_read_did_vid(0); if (!didvid || (didvid == 0xffffffff)) { @@ -409,10 +407,10 @@ switch (intf_version) { case 0: case 2: - family = TPM_1; + tpm_family = TPM_1; break; case 3: - family = TPM_2; + tpm_family = TPM_2; break; default: printf("%s: Unexpected TPM interface version: %d\n", __func__, @@ -420,7 +418,7 @@ return TPM_CB_PROBE_FAILURE; } } else if (intf_type == 0) { - family = TPM_2; + tpm_family = TPM_2; } else { printf("%s: Unexpected TPM interface type: %d\n", __func__, intf_type); return TPM_CB_PROBE_FAILURE; @@ -439,7 +437,7 @@ } dev = &vendor_names[i].dev_names[j]; while (dev->dev_id != 0xffff) { - if (dev->dev_id == did && dev->family == family) { + if (dev->dev_id == did && dev->family == tpm_family) { device_name = dev->dev_name; break; } @@ -449,7 +447,7 @@ break; } - family_str = (family == TPM_1 ? "TPM 1.2" : "TPM 2.0"); + family_str = (tpm_family == TPM_1 ? "TPM 1.2" : "TPM 2.0"); if (vendor_name == NULL) { printk(BIOS_INFO, "Found %s 0x%04x by 0x%04x\n", family_str, did, vid); } else if (device_name == NULL) { @@ -460,6 +458,8 @@ device_name, did, vendor_name, vid); } + if (family != NULL) + *family = tpm_family; return TPM_SUCCESS; } @@ -720,12 +720,15 @@ /* * tis_probe() * - * Probe for the TPM device and set it up for use within locality 0. Returns - * pointer to send-receive function on success or NULL on failure. + * Probe for the TPM device and set it up for use within locality 0. + * + * @tpm_family - pointer to tpm_family which is set to TPM family of the device. + * + * Returns pointer to send-receive function on success or NULL on failure. */ -tis_sendrecv_fn tis_probe(void) +tis_sendrecv_fn tis_probe(enum tpm_family *family) { - if (pc80_tis_probe()) + if (pc80_tis_probe(family)) return NULL; if (pc80_tis_open()) diff --git a/src/drivers/spi/tpm/tis.c b/src/drivers/spi/tpm/tis.c index 90d7f59..89ea985 100644 --- a/src/drivers/spi/tpm/tis.c +++ b/src/drivers/spi/tpm/tis.c @@ -40,7 +40,7 @@ return TPM_SUCCESS; } -tis_sendrecv_fn tis_probe(void) +tis_sendrecv_fn tis_probe(enum tpm_family *family) { struct spi_slave spi; struct tpm2_info info; @@ -56,6 +56,10 @@ return NULL; } + /* tpm2_process_command() is used unconditionally in tpm_sendrecv() */ + if (family != NULL) + *family = TPM_2; + tpm2_get_info(&info); printk(BIOS_INFO, "Initialized TPM device %s revision %d\n", diff --git a/src/security/tpm/tis.h b/src/security/tpm/tis.h index ac07bfb..4a8dc14 100644 --- a/src/security/tpm/tis.h +++ b/src/security/tpm/tis.h @@ -32,6 +32,12 @@ TPM_STS_RESPONSE_RETRY = (1 << 1), }; +enum tpm_family { + TPM_UNKNOWN = 0, + TPM_1 = 1, + TPM_2 = 2, +}; + /* * tis_sendrecv() * @@ -50,13 +56,16 @@ /* * tis_probe() * - * Probe for the TPM device and set it up for use within locality 0. Returns - * pointer to send-receive function on success or NULL on failure. + * Probe for the TPM device and set it up for use within locality 0. + * + * @family - pointer which is set to TPM family of the device + * + * Returns pointer to send-receive function on success or NULL on failure. * * Do not call this explicitly, it's meant to be used exclusively by TSS * implementation (tlcl_lib_init() function to be specific). */ -tis_sendrecv_fn tis_probe(void); +tis_sendrecv_fn tis_probe(enum tpm_family *family); /* * tis_vendor_write() diff --git a/src/security/tpm/tss/tcg-1.2/tss.c b/src/security/tpm/tss/tcg-1.2/tss.c index f0d28df..913f79b 100644 --- a/src/security/tpm/tss/tcg-1.2/tss.c +++ b/src/security/tpm/tss/tcg-1.2/tss.c @@ -153,13 +153,20 @@ tpm_result_t tlcl_lib_init(void) { + enum tpm_family family; + if (tis_sendrecv != NULL) return TPM_SUCCESS; - tis_sendrecv = tis_probe(); + tis_sendrecv = tis_probe(&family); if (tis_sendrecv == NULL) return TPM_CB_NO_DEVICE; + if (family != TPM_1) { + tis_sendrecv = NULL; + return TPM_CB_INTERNAL_INCONSISTENCY; + } + return TPM_SUCCESS; } diff --git a/src/security/tpm/tss/tcg-2.0/tss.c b/src/security/tpm/tss/tcg-2.0/tss.c index 135d296..27390a7 100644 --- a/src/security/tpm/tss/tcg-2.0/tss.c +++ b/src/security/tpm/tss/tcg-2.0/tss.c @@ -211,15 +211,24 @@ /* This function is called directly by vboot, uses vboot return types. */ tpm_result_t tlcl_lib_init(void) { + enum tpm_family family; + if (tis_sendrecv != NULL) return TPM_SUCCESS; - tis_sendrecv = tis_probe(); + tis_sendrecv = tis_probe(&family); if (tis_sendrecv == NULL) { printk(BIOS_ERR, "%s: tis_probe returned error\n", __func__); return TPM_CB_NO_DEVICE; } + if (family != TPM_2) { + tis_sendrecv = NULL; + printk(BIOS_ERR, "%s: tis_probe returned unsupported TPM family: %d\n", + __func__, family); + return TPM_CB_INTERNAL_INCONSISTENCY; + } + return TPM_SUCCESS; } -- To view, visit https://review.coreboot.org/c/coreboot/+/69159?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I5006e0cdfef76ff79ce9e1cf280fcd5515ae01b0 Gerrit-Change-Number: 69159 Gerrit-PatchSet: 27 Gerrit-Owner: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> Gerrit-Reviewer: Christian Walter <christian.walter(a)9elements.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Jérémy Compostella <jeremy.compostella(a)intel.com> Gerrit-Reviewer: Krystian Hebel <krystian.hebel(a)3mdeb.com> Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com> Gerrit-Reviewer: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-MessageType: merged

1 0

[M] Change in coreboot[main]: soc/intel/xeon_sp/gnr: Add soc_pci_domain_fill_ssdt
by Shuo Liu (Code Review) 28 Mar '24

28 Mar '24

Attention is currently required from: Arthur Heymans, Christian Walter, Jincheng Li, Johnny Lin, Jonathan Zhang, Lean Sheng Tan, Patrick Rudolph, Tim Chu. Shuo Liu has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/81374?usp=email ) Change subject: soc/intel/xeon_sp/gnr: Add soc_pci_domain_fill_ssdt ...................................................................... Patch Set 16: (1 comment) File src/soc/intel/xeon_sp/gnr/soc_acpi.c: https://review.coreboot.org/c/coreboot/+/81374/comment/5b2c4732_7a1cfc13 : PS16, Line 85: acpigen_emit_eisaid("ACPI0016"); updated to ACPI0016 per CXL spec 3.1 9.18.2 CXL _OSC According to ACPI Specification, _OSC (Operating System Capabilities) is a control method that is used by OSs to communicate to the System Firmware the capabilities supported by the OS and to negotiate ownership of specific capabilities. The _OSC interface defined in this section applies only to “Host Bridge” ACPI devices that originate CXL hierarchies. As specified in Section 9.12, these ACPI devices must have an _HID of (or a _CID that includes) EISAID(“ACPI0016”). CXL _OSC is required for a CXL VH. CXL _OSC is optional for an RCD. A CXL Host Bridge also originates a PCIe hierarchy and will have a _CID of EISAID(“PNP0A08”). As such, a CXL Host Bridge device may expose both CXL _OSC and PCIe _OSC. The _OSC interface for a CXL Host Bridge is identified by the Universal Unique Identifier (UUID) 68f2d50b-c469-4d8a-bd3d-941a103fd3fc. -- To view, visit https://review.coreboot.org/c/coreboot/+/81374?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I28bfdf74d8044235f79f67d832860d8b4306670c Gerrit-Change-Number: 81374 Gerrit-PatchSet: 16 Gerrit-Owner: Shuo Liu <shuo.liu(a)intel.com> Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Christian Walter <christian.walter(a)9elements.com> Gerrit-Reviewer: Jincheng Li <jincheng.li(a)intel.com> Gerrit-Reviewer: Johnny Lin <Johnny_Lin(a)wiwynn.com> Gerrit-Reviewer: Jonathan Zhang <jon.zhixiong.zhang(a)gmail.com> Gerrit-Reviewer: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Reviewer: Patrick Rudolph <patrick.rudolph(a)9elements.com> Gerrit-Reviewer: Tim Chu <Tim.Chu(a)quantatw.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Patrick Rudolph <patrick.rudolph(a)9elements.com> Gerrit-Attention: Jonathan Zhang <jon.zhixiong.zhang(a)gmail.com> Gerrit-Attention: Johnny Lin <Johnny_Lin(a)wiwynn.com> Gerrit-Attention: Christian Walter <christian.walter(a)9elements.com> Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Attention: Jincheng Li <jincheng.li(a)intel.com> Gerrit-Attention: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Attention: Tim Chu <Tim.Chu(a)quantatw.com> Gerrit-Comment-Date: Thu, 28 Mar 2024 15:02:39 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

[M] Change in coreboot[main]: mb/google: Remove blank lines before '}' and after '{'
by Elyes Haouas (Code Review) 28 Mar '24

28 Mar '24

Attention is currently required from: Dinesh Gehlot, Eran Mitrani, Felix Singer, Hung-Te Lin, Jason Nien, Kapil Porwal, Martin Roth, Nick Vaccaro, Subrata Banik, Tarun, Yidi Lin. Elyes Haouas has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/81477?usp=email ) Change subject: mb/google: Remove blank lines before '}' and after '{' ...................................................................... Patch Set 2: (1 comment) Patchset: PS1: > Squash into CB:81463 Acknowledged -- To view, visit https://review.coreboot.org/c/coreboot/+/81477?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: If68303cd59b287c8a5c982063b2ab75fd74898d6 Gerrit-Change-Number: 81477 Gerrit-PatchSet: 2 Gerrit-Owner: Elyes Haouas <ehaouas(a)noos.fr> Gerrit-Reviewer: Dinesh Gehlot <digehlot(a)google.com> Gerrit-Reviewer: Eran Mitrani <mitrani(a)google.com> Gerrit-Reviewer: Eric Lai <ericllai(a)google.com> Gerrit-Reviewer: Hung-Te Lin <hungte(a)chromium.org> Gerrit-Reviewer: Jakub Czapiga <czapiga(a)google.com> Gerrit-Reviewer: Jason Nien <jason.nien(a)amd.corp-partner.google.com> Gerrit-Reviewer: Kapil Porwal <kapilporwal(a)google.com> Gerrit-Reviewer: Martin Roth <martin.roth(a)amd.corp-partner.google.com> Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)chromium.org> Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: Tarun <tstuli(a)gmail.com> Gerrit-Reviewer: Yidi Lin <yidilin(a)google.com> Gerrit-Reviewer: Yu-Ping Wu <yupingso(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Felix Singer <service+coreboot-gerrit(a)felixsinger.de> Gerrit-Attention: Felix Singer <service+coreboot-gerrit(a)felixsinger.de> Gerrit-Attention: Hung-Te Lin <hungte(a)chromium.org> Gerrit-Attention: Eran Mitrani <mitrani(a)google.com> Gerrit-Attention: Jason Nien <jason.nien(a)amd.corp-partner.google.com> Gerrit-Attention: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Dinesh Gehlot <digehlot(a)google.com> Gerrit-Attention: Kapil Porwal <kapilporwal(a)google.com> Gerrit-Attention: Nick Vaccaro <nvaccaro(a)chromium.org> Gerrit-Attention: Martin Roth <martin.roth(a)amd.corp-partner.google.com> Gerrit-Attention: Yidi Lin <yidilin(a)google.com> Gerrit-Attention: Tarun <tstuli(a)gmail.com> Gerrit-Comment-Date: Thu, 28 Mar 2024 14:51:07 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Felix Singer <service+coreboot-gerrit(a)felixsinger.de> Gerrit-MessageType: comment

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

coreboot-gerrit March 2024