summaryrefslogtreecommitdiff
path: root/Documentation/security
AgeCommit message (Collapse)Author
2022-06-22security/vboot: Deprecate VBOOT_VBNV_ECYu-Ping Wu
Boards using VBOOT_VBNV_EC (nyan, daisy, veyron, peach_pit) are all ChromeOS devices and they've reached the end of life since Feb 2022. Therefore, remove VBOOT_VBNV_EC for them, each with different replacement. - nyan (nyan, nyan_big, nyan_blaze): Add RW_NVRAM to their FMAP (by reducing the size of RW_VPD), and replace VBOOT_VBNV_EC with VBOOT_VBNV_FLASH. - veyron: Add RW_NVRAM to their FMAP (by reducing the size of SHARED_DATA), and replace VBOOT_VBNV_EC with VBOOT_VBNV_FLASH. Also enlarge the OVERLAP_VERSTAGE_ROMSTAGE section for rk3288 (by reducing the size of PRERAM_CBMEM_CONSOLE), so that verstage won't exceed its allotted size. - daisy: Because BOOT_DEVICE_SPI_FLASH is not set, which is required for VBOOT_VBNV_FLASH, disable MAINBOARD_HAS_CHROMEOS and VBOOT configs. - peach_pit: As VBOOT is not set, simply remove the unused VBOOT_VBNV_EC option. Remove the VBOOT_VBNV_EC Kconfig option as well as related code, leaving VBOOT_VBNV_FLASH and VBOOT_VBNV_CMOS as the only two backend options for vboot nvdata (VBNV). Also add a check in read_vbnv() and save_vbnv() for VBNV options. BUG=b:178689388 TEST=util/abuild/abuild -t GOOGLE_NYAN -x -a TEST=util/abuild/abuild -t GOOGLE_VEYRON_JAQ -x -a TEST=util/abuild/abuild -t GOOGLE_DAISY -a TEST=util/abuild/abuild -t GOOGLE_PEACH_PIT -a BRANCH=none Change-Id: Ic67d69e694cff3176dbee12d4c6311bc85295863 Signed-off-by: Yu-Ping Wu <yupingso@chromium.org> Reviewed-on: https://review.coreboot.org/c/coreboot/+/65012 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2022-05-12mb/google/deltaur: Remove mainboard from treeTim Wawrzynczak
This board never made it to production, and development on it has long since stopped; it is a maintenance burden, therefore drop it from the tree. Signed-off-by: Tim Wawrzynczak <twawrzynczak@chromium.org> Change-Id: Ieb12a95ff56c3437cb88df8ef3f6ae115ad53446 Reviewed-on: https://review.coreboot.org/c/coreboot/+/64056 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Felix Singer <felixsinger@posteo.net>
2022-03-14mb/google/trogdor: Add variant GelarshieMars Chen
New board introduced to trogdor family. BUG=b:223101874 BRANCH=none TEST=make Signed-off-by: Mars Chen <chenxiangrui@huaqin.corp-partner.google.com> Change-Id: Ie83df3c753d0863841430fe62805250ef8efeae9 Reviewed-on: https://review.coreboot.org/c/coreboot/+/62642 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2022-02-25Documentation/security/vboot: Update 4.16 vboot supported boardsJason Glenesk
Update list of boards that support vboot. Change-Id: I7f372c5b923018bc1b744fd02d5acc976b03742a Signed-off-by: Jason Glenesk <jason.glenesk@amd.corp-partner.google.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/62310 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Martin Roth <martinroth@google.com>
2021-11-09Documentation/security/vboot: Update 4.15 vboot supported boardsJason Glenesk
Update list of boards that support vboot. Change-Id: Id5d4d18202bf85c5ba407efd690eee5cba88a8a7 Signed-off-by: Jason Glenesk <jason.glenesk@amd.corp-partner.google.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/58975 Reviewed-by: Felix Singer <felixsinger@posteo.net> Reviewed-by: Matt DeVillier <matt.devillier@gmail.com> Reviewed-by: Felix Held <felix-coreboot@felixheld.de> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-10-05Documentation: Fix spelling errorsMartin Roth
These issues were found and fixed by codespell, a useful tool for finding spelling errors. Signed-off-by: Martin Roth <martin@coreboot.org> Change-Id: If2a8e97911420c19e9365d5c28810b998f2c2ac8 Reviewed-on: https://review.coreboot.org/c/coreboot/+/58078 Reviewed-by: Felix Held <felix-coreboot@felixheld.de> Reviewed-by: Angel Pons <th3fanbus@gmail.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-10-04mb/google/trogdor: Add new vaviant quackingstickSheng-Liang Pan
New boards introduced to trogdor family. BUG=b:201263032 BRANCH=none TEST=make Signed-off-by: Sheng-Liang Pan <sheng-liang.pan@quanta.corp-partner.google.com> Change-Id: I8299ddda14eb82103f17f8464a14992aa757afa6 Reviewed-on: https://review.coreboot.org/c/coreboot/+/58033 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2021-09-15google/trogdor: add new variant kingoftownKevin Chiu
This patch adds a new variant called kingoftown. it's clamshell only, no FPR, eDP panel. BUG=b:198365759 BRANCH=master TEST=make Signed-off-by: Kevin Chiu <kevin.chiu@quantatw.com> Change-Id: I648664c50dfad11530a854f574f39264158b44e0 Reviewed-on: https://review.coreboot.org/c/coreboot/+/57433 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Bob Moragues <moragues@google.com> Reviewed-by: Douglas Anderson <dianders@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2021-08-12mb/google/trogdor: Add new variant WormdinglerZanxi Chen
New board introduced to trogdor family. BUG=b:193870279 BRANCH=none TEST=make Change-Id: If3d9662e8725e30e1308d77b05545efbee29f846 Signed-off-by: Zanxi Chen <chenzanxi@huaqin.corp-partner.google.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/56384 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2021-06-24mb/google/trogdor: Add new vaviant mrblandZanxi Chen
New boards introduced to trogdor family. BUG=b:191800434 BRANCH=none TEST=make Change-Id: I93b74e79188bd0cc36c8b48e552230ae0d6f593a Signed-off-by: Zanxi Chen <chenzanxi@huaqin.corp-partner.google.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/55782 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2021-06-08google/trogdor: Add new variant PazquelYunlong Jia
This patch adds a new variant called Pazquel that is identical to Lazor for now. BUG=b:187232137 TEST=make Signed-off-by: Yunlong Jia <yunlong.jia@ecs.corp-partner.google.com> Change-Id: Ib531ea5df19fe91e619f23baada73842554538ad Reviewed-on: https://review.coreboot.org/c/coreboot/+/55268 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2021-05-12Documentation: Update vboot support listPatrick Georgi
Created by util/vboot_list/vboot_list.sh Change-Id: I49536c26540c0fd1940a32f588fa49afb55b108a Signed-off-by: Patrick Georgi <pgeorgi@google.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/54029 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
2021-03-20google/trogdor: Add new variant MarzipanKevin Chiu
This patch adds a new variant called Marzipan that is identical to Lazor for now. BUG=b:182181519,b:182018606 BRANCH=master TEST=make Change-Id: I92b667c63b0a06255d1e9511d7486293d8b4426a Signed-off-by: Kevin Chiu <kevin.chiu@quantatw.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/51618 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2021-03-15mb/supermicro/x11-lga1151-series: add support of X11SSH-LN4F to X11SSH-FAlexander Couzens
The X11SSH-LN4F and X11SSH-F are very similiar. They both use the same PCB and use the same Supermicro BIOS ID. The X11SSH-LN4F has 4 NICs in difference to the X11SSH-F which only has 2 NICs. The two additional NICs aren't populated on the X11SSH-F. Enable the PCIe root ports connected to the two additional Intel NICs. Signed-off-by: Alexander Couzens <lynxis@fe80.eu> Change-Id: Id4e66be47ceef75905ba760b8d5a14284e130f63 Reviewed-on: https://review.coreboot.org/c/coreboot/+/51330 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Michael Niewöhner <foss@mniewoehner.de>
2021-02-26mb/google/trogdor: Add new configs homestarxuxinxiong
New boards introduced to trogodor family. BUG=b:180668002 BRANCH=none TEST=make Signed-off-by: xuxinxiong <xuxinxiong@huaqin.corp-partner.google.com> Change-Id: If0f9b6c89198a882acae7191d08b166eb8c1dd71 Reviewed-on: https://review.coreboot.org/c/coreboot/+/51004 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2021-02-17treewide: Remove trailing whitespaceMartin Roth
Remove trailing whitespace in files that aren't typically checked. Signed-off-by: Martin Roth <martin@coreboot.org> Change-Id: I8dfffbdeaadfa694fef0404719643803df601065 Reviewed-on: https://review.coreboot.org/c/coreboot/+/50704 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2020-11-20Documentation/releases: Update for 4.13Angel Pons
Fill in some blanks for 4.13, mark it done, add template for 4.14. Also update the list of vboot supported boards. Change-Id: Ie593efe515136a3b06620db6f0dbe3da00df7e9b Signed-off-by: Angel Pons <th3fanbus@gmail.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/47801 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
2020-11-12Delete mainboard/google/chezaJulius Werner
Work on this mainboard was abandoned and never finished. It's not really usable in its current state, so let's get rid of it. Signed-off-by: Julius Werner <jwerner@chromium.org> Change-Id: I4cd2e2cd0ee69d9846472653a942fa074e2b924d Reviewed-on: https://review.coreboot.org/c/coreboot/+/47427 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2020-09-11strongbad / coachz : Add Initial SupportBob Moragues
BUG=b:162409909 BUG=b:164196066 BRANCH=NONE TEST=Verify build of strongbad target Signed-off-by: Bob Moragues <moragues@chromium.org> Change-Id: If83bd2c8f25fdd3c9625f40121e55c3c922a66fe Reviewed-on: https://review.coreboot.org/c/coreboot/+/45276 Reviewed-by: Julius Werner <jwerner@chromium.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2020-06-17cpu/x86/smm: Add helper functions to verify SMM accessPatrick Rudolph
* Add a function to check if a region overlaps with SMM. * Add a function to check if a pointer points to SMM. * Document functions in Documentation/security/smm To be used to verify data accesses in SMM. Change-Id: Ia525d2bc685377f50ecf3bdcf337a4c885488213 Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Signed-off-by: Christian Walter <christian.walter@9elements.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/41084 Reviewed-by: Angel Pons <th3fanbus@gmail.com> Reviewed-by: Patrick Georgi <pgeorgi@google.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2020-05-12Documentation/releases: Update for 4.12Patrick Georgi
Fill in some blanks for 4.12, mark it done, add template for 4.13. Also update the list of vboot supported boards. Change-Id: Id6b663f13367eb40e66af30aadd33991c8dd635c Signed-off-by: Patrick Georgi <patrick@georgi.software> Reviewed-on: https://review.coreboot.org/c/coreboot/+/41259 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: HAOUAS Elyes <ehaouas@noos.fr> Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
2020-04-28Documentation: Spell vboot all lowercasePatrick Rudolph
Update all occurrences of vboot and spell it lowercase. Change-Id: I432b0db8a3dda43b71844e557a3d89180f25f1c3 Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Signed-off-by: Marcello Sylvester Bauer <sylv@sylv.io> Reviewed-on: https://review.coreboot.org/c/coreboot/+/39799 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Patrick Georgi <pgeorgi@google.com>
2020-04-14Documentation/vboot: Drop deprecated options from exampleArthur Heymans
4K keys are now default. Change-Id: I16599d0e8b874f9e8a56100fea06d6e4f94a5c00 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/37149 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2020-03-23Doc/security/vboot: Add a script generated device listMarcello Sylvester Bauer
Add a script generated list of vboot enabled devices to the documentation. Add a entry to the release checklist. Change-Id: Ibb57d26c5f0cb8efd27ca9a97fd762c25b566f93 Signed-off-by: Marcello Sylvester Bauer <sylv@sylv.io> Reviewed-on: https://review.coreboot.org/c/coreboot/+/39200 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Patrick Rudolph <patrick.rudolph@9elements.com> Reviewed-by: Patrick Georgi <pgeorgi@google.com>
2019-11-07lib/cbfs: Add fallback to RO region to cbfs_boot_locateWim Vervoorn
With this change cbfs_boot_locate will check the RO (COREBOOT) region if a file can not be found in the active RW region. By doing so it is not required to duplicate static files that are not intended to be updated to the RW regions. The coreboot image can still be updated by adding the file to the RW region. This change is intended to support VBOOT on systems with a small flash device. BUG=N/A TEST=tested on facebook fbg1701 Change-Id: I81ceaf927280cef9a3f09621c796c451e9115211 Signed-off-by: Wim Vervoorn <wvervoorn@eltan.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/36545 Reviewed-by: Frans Hendriks <fhendriks@eltan.com> Reviewed-by: Aaron Durbin <adurbin@chromium.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2019-09-02security/intel: Add TXT infrastructurePatrick Rudolph
* Add Kconfig to enable TXT * Add possibility to add BIOS and SINIT ACMs * Set default BIOS ACM alignment * Increase FIT space if TXT is enabled The following commits depend on the basic Kconfig infrastructure. Intel TXT isn't supported until all following commits are merged. Change-Id: I5f0f956d2b7ba43d4e7e0062803c6d8ba569a052 Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/34585 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: David Hendricks <david.hendricks@gmail.com>
2019-07-19Documentation: Add Intel TXTPatrick Rudolph
Change-Id: I9e9606d0e4294ad3552ec3b3b44629f9e732d82b Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/33416 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Subrata Banik <subrata.banik@intel.com>
2019-07-02cpu/x86/pae/pgtbl: Add memset with PAEPatrick Rudolph
To clear all DRAM on x86_32, add a new method that uses PAE to access more than 32bit of address space. Add Documentation as well. Required for clearing all system memory as part of security API. Tested on wedge100s: Takes less than 2 seconds to clear 8GiB of DRAM. Tested on P8H61M-Pro: Takes less than 1 second to clear 4GiB of DRAM. Change-Id: I00f7ecf87b5c9227a9d58a0b61eecc38007e1a57 Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/31549 Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2019-06-27security: Add memory subfolderPatrick Rudolph
Add files to introduce a memory clearing framework. Introduce Kconfig PLATFORM_HAS_DRAM_CLEAR that is to be selected by platforms, that are able to clear all DRAM. Introduce Kconfig SECURITY_CLEAR_DRAM_ON_REGULAR_BOOT that is user selectable to always clear DRAM on non S3 boot. The function security_clear_dram_request tells the calling platform when to wipe all DRAM. Will be extended by TEE frameworks. Add Documentation for the new security API. Change-Id: Ifba25bfdd1057049f5cbae8968501bd9be487110 Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/31548 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com> Reviewed-by: Christian Walter <christian.walter@9elements.com>
2019-05-08Documentation: Convert vboot to markdownPatrick Rudolph
Convert the HTML document to markdown and place it under security section. Change-Id: I212c6d0c977fd6772371ff6676478d48cc215d6e Signed-off-by: Patrick Rudolph <siro@das-labor.org> Reviewed-on: https://review.coreboot.org/c/coreboot/+/32610 Reviewed-by: Patrick Georgi <pgeorgi@google.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2019-03-07security/tpm: Fix TCPA log featurePhilipp Deppenwiese
Until now the TCPA log wasn't working correctly. * Refactor TCPA log code. * Add TCPA log dump fucntion. * Make TCPA log available in bootblock. * Fix TCPA log formatting. * Add x86 and Cavium memory for early log. Change-Id: Ic93133531b84318f48940d34bded48cbae739c44 Signed-off-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/29563 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Patrick Rudolph <siro@das-labor.org>
2019-02-25security/vboot: Add measured boot modePhilipp Deppenwiese
* Introduce a measured boot mode into vboot. * Add hook for stage measurements in prog_loader and cbfs. * Implement and hook-up CRTM in vboot and check for suspend. Change-Id: I339a2f1051e44f36aba9f99828f130592a09355e Signed-off-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com> Signed-off-by: Werner Zeh <werner.zeh@siemens.com> Reviewed-on: https://review.coreboot.org/c/29547 Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-27 01:35:23 +0000