This is a repost of a series of patches providing TPM support to SeaBIOS.
As an addition, this patch series now works on the Acer C720 Chromebook
with limitations (S3 not getting invoked; no logging into TCPA table).
The patch series cleanly applies to a checkout of a1ac8861.
The following set of patches add TPM and Trusted Computing support to SeaBIOS.
In particular the patches add:
- a TPM driver for the Qemu's TPM TIS emulation
- Support for initialzation of the TPM
- init of TCPA logging table
- Support for the TCG BIOS extensions (1ah handler [ah = 0xbb])
(used by trusted grub; http://trousers.sourceforge.net/grub.html)
- Static Root of Trusted for Measurement (SRTM) support
- Support for S3 resume (sends command to TPM upon resume)
- Support for sending control messages from the OS to the BIOS
and have the BIOS control certain life-cycle aspects of the TPM
following those messages
- TPM-specific menu for controlling aspects of the TPM
All implementations necessarily follow specifications.
When all patches are applied the following services are available
- SSDT ACPI table for TPM support
- initialization of the TPM upon VM start and S3 resume
- Static root of trust for measurements (SRTM) that measures (some) data
of SeaBIOS in TCPA ACPI table
- 1ah interrupt handler offering APIs for measuring and sending commands to
the TPM (trusted grub uses them)
- With an extensions to QEMU's TPM SSDT: The root user in Linux (for example)
can send the above mentioned control messages to the BIOS and have the
BIOS act upon them
- User menu for controlling aspects of the state of the TPM
Stefan Berger (6):
Add an implementation of a TPM TIS driver
Implementation of the TCG BIOS extensions
Support for BIOS interrupt handler
Add 'measurement' code to the BIOS
Support for TPM Physical Presence Interface
Add a menu for TPM control
Makefile | 5 +-
src/Kconfig | 7 +
src/boot.c | 28 +-
src/cdrom.c | 11 +
src/clock.c | 12 +
src/config.h | 1 +
src/hw/tpm_drivers.c | 291 +++++++
src/hw/tpm_drivers.h | 90 +++
src/optionroms.c | 4 +
src/post.c | 12 +
src/resume.c | 2 +
src/sha1.c | 145 ++++
src/sha1.h | 8 +
src/std/acpi.h | 20 +
src/tcgbios.c | 2181 ++++++++++++++++++++++++++++++++++++++++++++++++++
src/tcgbios.h | 456 +++++++++++
src/util.h | 2 +
src/x86.h | 7 +
18 files changed, 3277 insertions(+), 5 deletions(-)
create mode 100644 src/hw/tpm_drivers.c
create mode 100644 src/hw/tpm_drivers.h
create mode 100644 src/sha1.c
create mode 100644 src/sha1.h
create mode 100644 src/tcgbios.c
create mode 100644 src/tcgbios.h
--
1.9.3
Hello,
I've compiled SeaBIOS on FreeBSD with gcc48, and although the build
process succeeds, the resulting binary doesn't fully work. Most
functions seem to work fine but there are some int15h functions that
don't work properly (ie: they return invalid values).
I've compiled SeaBIOS with CONFIG_DEBUG_LEVEL=10 and got the following
output (this is from the Xen console):
[...]
(d4) enter handle_1a:
(d4) a=00000200 b=00000000 c=00001725 d=00003400 ds=4cf0 es=9eb8 ss=dd00
(d4) si=00000004 di=00000000 bp=00000000 sp=0000fe66 cs=0000 ip=9336 f=0242
(d4) enter handle_1a:
(d4) a=00000200 b=00000000 c=00001725 d=00003400 ds=4cf0 es=9eb8 ss=dd00
(d4) si=00000004 di=00000000 bp=00000000 sp=0000fe66 cs=0000 ip=9336 f=0242
(d4) enter handle_1a:
(d4) a=00000200 b=00000000 c=00001725 d=00003400 ds=4cf0 es=9eb8 (XEN) irq.c:386: Dom4 callback via changed to Direct Vector 0x93
(XEN) irq.c:276: Dom4 PCI link 0 changed 5 -> 0
(XEN) irq.c:276: Dom4 PCI link 1 changed 10 -> 0
(XEN) irq.c:276: Dom4 PCI link 2 changed 11 -> 0
(XEN) irq.c:276: Dom4 PCI link 3 changed 5 -> 0
(d4) enter handle_15:
And that's all, there's no line containing the register values. I'm
quite lost at figuring what's going on, so any help about how to
proceed in order to debug this is highly appreciated.
Thanks, Roger.
On Mon, Mar 30, 2015 at 05:09:47AM +0000, Xu, Quan wrote:
> > From: Stefan Berger [mailto:stefanb@linux.vnet.ibm.com]
> > On 03/27/2015 03:58 AM, Xu, Quan wrote:
> > >> From: Xu, Quan
> > >>> From: Stefan Berger [mailto:stefanb@linux.vnet.ibm.com]
> > >>> On 03/26/2015 07:01 AM, Xu, Quan wrote:
> > >>>>> From: Stefan Berger [mailto:stefanb@linux.vnet.ibm.com]
> > >>>>> On 03/25/2015 06:42 PM, Kevin O'Connor wrote:
> > >>>>>> On Tue, Mar 24, 2015 at 11:10:03AM -0400, Stefan Berger wrote:
> > >>>>>>> On 03/23/2015 08:13 PM, Kevin O'Connor wrote:
> > >>>>>>>> Because of the mixed 16bit/32bit code in SeaBIOS, all assembler
> > >>>>>>>> must use size suffixes - so the above should be "roll" instead of "rol".
> > >>>>>>> Ok, fixed.
> > >>>>>>>
> > >>>>>>>> As before - both issues are minor and can be addressed after
> > >>>>>>>> merge (as long as there is agreement that the sha1.c file can
> > >>>>>>>> be licensed as LGPLv3).
> > >>>>>>> It can have that license. I can post v11 or you can modify it,
> > >>>>>>> either way is fine.
> > >>>>>> Thanks. I pushed the first three patches into a test branch at:
> > >>>>>>
> > >>>>>> https://github.com/KevinOConnor/seabios/tree/tcg-testing
> > >>>>>>
> > >>>>>> I'd like to get confirmation that this works for the Xen
> > >>>>>> requirements before merging.
> > >>>>> I don't use Xen. I hope that Quan will provide feedback.
> > >>>>>
> > >>>>> Stefan
> > >>>> Sure, I am glad to help you test it :):) Try to
> > >>>> https://github.com/KevinOConnor/seabios/tree/tcg-testing ??
> > >>> Yes.
[...]
> I will go through all of these seabios patch, and try to make it compatible for Xen vTPM.
>
What's the status of this? Is it safe to push forward parts of
Stefan's patches, or does that represent a regression for Xen?
-Kevin
=================================================================
KVM Forum 2015: Call For Participation
August 19-21, 2015 - Sheraton Seattle - Seattle, WA
(All submissions must be received before midnight May 1, 2015)
=================================================================
KVM is an industry leading open source hypervisor that provides an ideal
platform for datacenter virtualization, virtual desktop infrastructure,
and cloud computing. Once again, it's time to bring together the
community of developers and users that define the KVM ecosystem for
our annual technical conference. We will discuss the current state of
affairs and plan for the future of KVM, its surrounding infrastructure,
and management tools. Mark your calendar and join us in advancing KVM.
http://events.linuxfoundation.org/events/kvm-forum/
This year, the KVM Forum is moving back to North America. We will be
colocated with the Linux Foundation's LinuxCon North America, CloudOpen
North America, ContainerCon and Linux Plumbers Conference events.
Attendees of KVM Forum will also be able to attend a shared hackathon
event with Xen Project Developer Summit on August 18, 2015.
We invite you to lead part of the discussion by submitting a speaking
proposal for KVM Forum 2015.
http://events.linuxfoundation.org/cfp
Suggested topics:
KVM/Kernel
* Scaling and optimizations
* Nested virtualization
* Linux kernel performance improvements
* Resource management (CPU, I/O, memory)
* Hardening and security
* VFIO: SR-IOV, GPU, platform device assignment
* Architecture ports
QEMU
* Management interfaces: QOM and QMP
* New devices, new boards, new architectures
* Scaling and optimizations
* Desktop virtualization and SPICE
* Virtual GPU
* virtio and vhost, including non-Linux or non-virtualized uses
* Hardening and security
* New storage features
* Live migration and fault tolerance
* High availability and continuous backup
* Real-time guest support
* Emulation and TCG
* Firmware: ACPI, UEFI, coreboot, u-Boot, etc.
* Testing
Management and infrastructure
* Managing KVM: Libvirt, OpenStack, oVirt, etc.
* Storage: glusterfs, Ceph, etc.
* Software defined networking: Open vSwitch, OpenDaylight, etc.
* Network Function Virtualization
* Security
* Provisioning
* Performance tuning
===============
SUBMITTING YOUR PROPOSAL
===============
Abstracts due: May 1, 2015
Please submit a short abstract (~150 words) describing your presentation
proposal. Slots vary in length up to 45 minutes. Also include in your
proposal
the proposal type -- one of:
- technical talk
- end-user talk
Submit your proposal here:
http://events.linuxfoundation.org/cfp
Please only use the categories "presentation" and "panel discussion"
You will receive a notification whether or not your presentation proposal
was accepted by May 29, 2015.
Speakers will receive a complimentary pass for the event. In the instance
that your submission has multiple presenters, only the primary speaker for a
proposal will receive a complementary event pass. For panel
discussions, all
panelists will receive a complimentary event pass.
TECHNICAL TALKS
A good technical talk should not just report on what has happened over
the last year; it should present a concrete problem and how it impacts
the user and/or developer community. Whenever applicable, focus on
work that needs to be done, difficulties that haven't yet been solved,
and on decisions that other developers should be aware of. Summarizing
recent developments is okay but it should not be more than a small
portion of the overall talk.
END-USER TALKS
One of the big challenges as developers is to know what, where and how
people actually use our software. We will reserve a few slots for end
users talking about their deployment challenges and achievements.
If you are using KVM in production you are encouraged submit a speaking
proposal. Simply mark it as an end-user talk. As an end user, this is a
unique opportunity to get your input to developers.
HANDS-ON / BOF SESSIONS
We will reserve some time for people to get together and discuss
strategic decisions as well as other topics that are best solved within
smaller groups.
These sessions will be announced during the event. If you are interested
in organizing such a session, please add it to the list at
http://www.linux-kvm.org/page/KVM_Forum_2015_BOF
Let people you think might be interested know about it, and encourage
them to add their names to the wiki page as well. Please try to
add your ideas to the list before KVM Forum starts.
PANEL DISCUSSIONS
If you are proposing a panel discussion, please make sure that you list
all of your potential panelists in your abstract. We will request full
biographies if a panel is accepted.
===============
HOTEL / TRAVEL
===============
KVM Forum 2015 will be taking place at the Sheraton Seattle Hotel. We
are pleased to offer attendees a discounted room rate of US$199/night
(plus applicable taxes) which includes wifi in your guest room.
http://events.linuxfoundation.org/events/kvm-forum/attend/hotel-and-travel
includes further information on the Sheraton Seattle and the discounted
room rate, as well as on transportation and parking options for the hotel.
===============
IMPORTANT DATES
===============
Notification: May 29, 2015
Schedule announced: June 3, 2015
Event dates: August 19-21, 2015
Thank you for your interest in KVM. We're looking forward to your
submissions and seeing you at the KVM Forum 2015 in August!
-your KVM Forum 2015 Program Committee
Please contact us with any questions or comments.
Dear SeaBIOS folks,
my goal is to build SeaBIOS with the “fast memory error detector”
AddressSanitizer (ASan) [1].
As I did not find a way to override `CFLAGS` for building SeaBIOS, as
they are defined with `:=` in `Makefile`, I added `-fsanitize=address`
directly to `COMMONCFLAGS`.
$ git diff
diff --git a/Makefile b/Makefile
index a4d945c..9a7897c 100644
--- a/Makefile
+++ b/Makefile
@@ -58,7 +58,7 @@ COMMONCFLAGS := -I$(OUT) -Isrc -Os -MD -g \
-m32 -march=i386 -mregparm=3 -mpreferred-stack-boundary=2 \
-minline-all-stringops -fomit-frame-pointer \
-freg-struct-return -ffreestanding -fno-delete-null-pointer-checks \
- -ffunction-sections -fdata-sections -fno-common -fno-merge-constants
+ -ffunction-sections -fdata-sections -fno-common -fno-merge-constants -fsanitize=address
COMMONCFLAGS += $(call cc-option,$(CC),-nopie,)
COMMONCFLAGS += $(call cc-option,$(CC),-fno-stack-protector,)
COMMONCFLAGS += $(call cc-option,$(CC),-fno-stack-protector-all,)
But, buidling SeaBIOS as a coreboot payload fails with a syntax error.
[…]
Compiling (16bit) out/romlayout.o
Building ld scripts
Version:
rel-1.8.0-24-g0b2165d-dirty-20150426_091353-myasrocke350m1
Fixed space: 0xe05b-0x10000 total: 8101 slack: 12 Percent
slack: 0.1%
16bit size: 89760
32bit segmented size: 9184
32bit flat size: 65456
32bit flat init size: 126720
Lowmem size: 2176
f-segment var size: 1200
Linking out/rom16.o
/usr/bin/ld.bfd.real:out/romlayout16.lds:8: syntax error
Makefile:171: recipe for target 'out/rom16.o' failed
make: *** [out/rom16.o] Error 1
The same happens when building SeaBIOS for QEMU/KVM.
[…]
Building ld scripts
Version: rel-1.8.0-24-g0b2165d-dirty-20150426_092029-myasrocke350m1
Fixed space: 0xe05b-0x10000 total: 8101 slack: 12 Percent slack: 0.1%
16bit size: 92640
32bit segmented size: 9728
32bit flat size: 82384
32bit flat init size: 200864
Lowmem size: 2176
f-segment var size: 1200
Linking out/rom16.o
/usr/bin/ld.bfd.real:out/romlayout16.lds:9: syntax error
Makefile:171: recipe for target 'out/rom16.o' failed
make: *** [out/rom16.o] Error 1
Could you please suggest a way to build SeaBIOS with AddressSanitizer?
Also I’m still curious how possible warnings/messages from
AddressSanitzer will be shown to the user.
Thanks,
Paul
[1] https://code.google.com/p/address-sanitizer/
On Wed, Apr 22, 2015 at 02:20:51PM +0800, eJim Lee wrote:
> Hi kevin:
> If you want to repeat the bug, you can try:
> 1. Go to "Control panel->Regional and Language
> Options->Advanced->Language for non-Unicode programs" and select
> "Chinese (PRC)".
> 2. reboot
> 3. run wbc
>
> I also tried the program on vmware and looked nice. But something
> different with qemu about cursor:
> On qemu with WinXP English: cursor is on screen but not on vmware.
>
> Hope these information can help you.
>
> Thanks!
> eJim Lee
>
> 2015-04-21 23:41 GMT+08:00 eJim Lee <lyjforjob(a)gmail.com>:
> > I have tried it without kvm and bug repeated:
> > ./build/x86_64-softmmu/qemu-system-x86_64 -chardev stdio,id=seabios
> > -device isa-debugcon,iobase=0x402,chardev=seabios -m 512 -hda
> > tmp/xp.append -hdb tmp/data.append
This issue doesn't seem like a vgabios issue. It doesn't appear that
the program calls the vgabios and the program seems to function
correctly when changing non-vgabios settings. So, it appears that
something unknown is the root cause of the intermittent screen
corruption.
-Kevin
On Tue, Apr 21, 2015 at 07:26:27PM -0500, Charles Howell wrote:
> (Apologies if this is the wrong list, but I'm not sure where else to post.)
>
> I'm attempting to boot FreeBSD 10.1 (amd64) on a new Chromebook Pixel (via
> a USB CD) and it hangs as soon as the kernel is loaded into memory.
>
> I'd just assume it's a FreeBSD problem but I've also tried the latest
> versions of OpenBSD and NetBSD with the same results. In all three cases,
> the bootloader loads and I can interact with it, toggle options, read
> machine memory layout, enable safe mode, etc. but as soon as the kernel is
> loaded into memory and it tries to execute, the machine hangs hard and I
> have to hold down power for a few seconds to shut it off.
>
> This leads me to believe it's a problem with SeaBIOS and/or its support for
> this machine since I've booted BSDs on the Acer C720 with SeaBIOS just fine.
>
> I've also tried with a USB key with an installed OS already in case it was
> related to reading the CD, but with the same results. The bootloader comes
> up but no kernels will boot.
>
> These were all tested with SeaBIOS version -20150225_120401-build122-m2 as
> shipped with the device.
>
> Can anyone offer any help?
Unfortunately, it's very difficult to troubleshoot boot issues without
access to the debug log. SeaBIOS currently only supports access to
the debug log via a traditional serial port or via the "cbmem" in
memory log. The cbmem log is only applicable if one can boot the
machine to an OS that can run the cbmem tool.
You could try taking the USB/CD image and running it on QEMU - just to
verify that SeaBIOS doesn't have an issue with the image. (Though
it's unlikely that is the cause.)
Also, some of the more recent chromebooks have been shipping with
SeaVGABIOS instead of the traditional Intel vgabios. This may confuse
some kernels - you may want to verify that the machine has truly hung
(as opposed to the video just hanging).
Another option would be to try booting a Linux image - access to the
cbmem console would be helpful even if booting Linux is not the goal.
-Kevin
Hi
I took some time and developed a serial console over USB (FTDI) for SeaBIOS.
To make it work, I put in a few changes to the core USB module to allow my USB serial port driver to patch itself in to the USB stack.
These changes implement a general mechanism for USB device driver extension that might have other applications, so I thought I would start a dialog on the subject.
Here is a summary of the change (about 5 lines removed and 20 lines added):
1) defined a list structure in usb.h
struct usb_driver_list_s
{
struct usb_driver_list_s *next; /* the list pointer */
int (*driver_detect)(struct usbdevice_s *usbdev, /
struct usb_device_descriptor *dinfo); /* a function pointer */
} ;
2) Added a static list head pointer to usb.c
static struct usb_driver_list_s *usb_driver_list;
3) Added an API function to populate the list with external usb drivers
add_usb_device_handler(struct usb_driver_list_s *add_driver)
3) Modified configure_usb_device() to make it look for external drivers
a) relocated the trap for an unhandled device
b) call the handler init functions in the list until one indicates acceptance
-----Original Message-----
From: Kevin O'Connor [mailto:kevin@koconnor.net]
Sent: Friday, April 03, 2015 10:58 AM
To: Parker, John M
Cc: seabios(a)seabios.org
Subject: Re: [SeaBIOS] USB serial console support?
On Fri, Apr 03, 2015 at 04:54:43PM +0000, Parker, John M wrote:
> Hi
>
> This is a new-user question.
>
> I am working on a platform bring-up, specifically getting a port of
> SeaBIOS sorted out. So far so good, the code has made it all the way
> through to the USB enumeration.
>
> The current task is to bring up the boot menu on a 'serial over USB'
> console. So:
> Is a serial port boot menu supported?
> Is there a serial over USB module in the works?
Unfortunately, this feature isn't currently available. I'm not aware of anyone working on it.
There are two parts to getting the above to work: forwarding keyboard and video over serial, and USB serial support.
In the past, we've used sgabios ( https://code.google.com/p/sgabios/ ) to provide keyboard/video over traditional serial ports. However, sgabios wont work with USB serial ports (or even some PCI serial
adapters) and it's unlikely that support will be added.
Getting USB serial to work is a bit of a pain because there does not appear to be a standard for initializing USB serial adapters. One possibility would be to target only one device (and in particular, a device that something like a Beagle Bone Black could emulate would be very useful).
So, to get the above to work, I think it would require both adding sgabios functionality into SeaBIOS and adding USB serial support into SeaBIOS.
>
> Thanks for your time
> John Parker (john.m.parker(a)intel.com)
-Kevin
PS, please post in plain text only (no html) when sending to the mailing list.
On Tue, Apr 21, 2015 at 7:26 PM, I wrote:
> I'm attempting to boot FreeBSD 10.1 (amd64) on a new Chromebook Pixel (via
> a USB CD) and it hangs as soon as the kernel is loaded into memory.
>
To eliminate the BSDs as the source of the problem, I just tried booting an
ISO of Memtest86 (which boots v4.3 when UEFI is not present) and got the
same results. The bootloader comes up, but as soon as it tries to actually
load the program, the machine locks up ("Loading memtest...ready." and then
lock up).
If it makes any difference, this Pixel 2 has 16Gb of RAM.
