summaryrefslogtreecommitdiff
path: root/src/security/vboot/Kconfig
AgeCommit message (Collapse)Author
2019-04-04vboot: remove Kconfig option VBOOT_PHYSICAL_REC_SWITCHJoel Kitching
This option is duplicated in depthcharge: https://crrev.com/c/1545144 BUG=b:124141368, b:124192753, chromium:943150 TEST=make clean && make test-abuild CQ-DEPEND=CL:1545144 BRANCH=none Change-Id: I48e20ad21cdcb948a23387d3e5fcf142723b0c82 Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/32135 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Simon Glass <sjg@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
2019-04-01vboot: Select CONFIG_VBOOT_OPROM_MATTERS in more casesJulius Werner
This patch enables CONFIG_VBOOT_OPROM_MATTERS in a few more cases where I think(?) it should be. Haswell, Broadwell and Baytrail Chromebooks have this enabled in their old depthcharge firmware branches -- we presumably just forgot to move it over when vboot2 migrated the option to coreboot. Braswell didn't, but it seems like this requirement was added when it was migrated to FSP 1.1...? (Not very sure about that one, but it does call load_vbt() right now which executes things based on display_init_required().) Additionally, it seems to make sense to enable it whenever the user explicitly selects VGA_ROM_RUN in menuconfig (like one of the Intel defconfigs does). Once we have all this, one could take a step back and ask whether this option still makes sense at all anymore. It's enabled for almost all devices (that work with vboot at all), it will presumably be enabled for all future devices, and it seems that most devices that don't enable it use libgfxinit, which as far as I can tell isn't gated on display_init_required() but probably should be. Realistically, whatever kind of display init a board needs to do (native or option ROM), it's probably expensive enough that it's worth skipping on a normal mode vboot boot, and we'd want to have this enabled by default on everything except boards that actually don't have a display. So maybe we should flip it around to CONFIG_VBOOT_OPROM_DOESNT_MATTER, but doing that would probably lead to nobody ever selecting it at all. Not sure what the best solution there is yet, but I think this patch at least moves things in the more correct direction. Change-Id: Id96a88296ddb9cfbb58ea67d93e1638d95570e2c Signed-off-by: Julius Werner <jwerner@chromium.org> Reviewed-on: https://review.coreboot.org/c/coreboot/+/32114 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net> Reviewed-by: Patrick Georgi <pgeorgi@google.com>
2019-03-27vboot: deprecate physical dev switchJoel Kitching
Currently only two devices make use of physical dev switch: stumpy, lumpy Deprecate this switch. If these devices are flashed to ToT, they may still make use of virtual dev switch, activated via recovery screen. BUG=b:124141368, b:124192753, chromium:942901 TEST=util/lint/checkpatch.pl -g origin/master..HEAD TEST=util/abuild/abuild -B -e -y -c 50 -p none -x TEST=make clean && make test-abuild BRANCH=none Change-Id: I87ec0db6148c1727b95475d94e3e3f6e7ec83193 Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/31943 Reviewed-by: Simon Glass <sjg@chromium.org> Reviewed-by: Kyösti Mälkki <kyosti.malkki@gmail.com> Reviewed-by: Julius Werner <jwerner@chromium.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2019-03-26vboot: remove VBOOT_EC_SOFTWARE_SYNC Kconfig optionJoel Kitching
This option is duplicated in depthcharge: https://crrev.com/c/1524811 BUG=b:124141368, b:124192753, b:128737909 TEST=Build and deploy to eve TEST=util/lint/checkpatch.pl -g origin/master..HEAD TEST=util/abuild/abuild -B -e -y -c 50 -p none -x TEST=make clean && make test-abuild CQ-DEPEND=CL:1524811 BRANCH=none Change-Id: Id8c207ec4ad5a476e24eee1ceb9e40f24d55e725 Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/31926 Reviewed-by: Simon Glass <sjg@chromium.org> Reviewed-by: Furquan Shaikh <furquan@google.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2019-03-25vboot: remove VBOOT_EC_SLOW_UPDATE Kconfig optionJoel Kitching
This option has been relocated to depthcharge: https://crrev.com/c/1524806 BUG=b:124141368, b:124192753 TEST=Build and deploy to eve TEST=util/lint/checkpatch.pl -g origin/master..HEAD TEST=util/abuild/abuild -B -e -y -c 50 -p none -x TEST=make clean && make test-abuild CQ-DEPEND=CL:1524806 BRANCH=none Change-Id: Ib4a83af2ba143577a064fc0d72c9bc318db56adc Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/31909 Reviewed-by: Julius Werner <jwerner@chromium.org> Reviewed-by: Furquan Shaikh <furquan@google.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2019-03-21vboot: remove VBOOT_EC_EFS Kconfig optionJoel Kitching
This option has been relocated to depthcharge: https://crrev.com/c/1523248 BUG=b:124141368, b:124192753, chromium:943511 TEST=Build and deploy to eve TEST=util/lint/checkpatch.pl -g origin/master..HEAD TEST=util/abuild/abuild -B -e -y -c 50 -p none -x TEST=make clean && make test-abuild CQ-DEPEND=CL:1523248, CL:1525647 BRANCH=none Change-Id: I8b3740c8301f9a193f4fce2c6492d9382730faa1 Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/31897 Reviewed-by: Julius Werner <jwerner@chromium.org> Reviewed-by: Furquan Shaikh <furquan@google.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2019-03-14vboot: copy data structures to CBMEM for downstream useJoel Kitching
For platforms that do not employ VBOOT_STARTS_IN_ROMSTAGE, vboot verification occurs before CBMEM is brought online. In order to make vboot data structures available downstream, copy vb2_working_data from CAR/SRAM into CBMEM when CBMEM comes online. Create VBOOT_MIGRATE_WORKING_DATA config option to toggle this functionality. BUG=b:124141368, b:124192753 TEST=Built and deployed on eve with STARTS_IN_BOOTBLOCK TEST=Built and deployed on eve with STARTS_IN_ROMSTAGE TEST=util/lint/checkpatch.pl -g origin/master..HEAD TEST=util/abuild/abuild -B -e -y -c 50 -p none -x BRANCH=none Change-Id: I62c11268a83927bc00ae9bd93b1b31363b38e8cf Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/31329 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2019-02-25security/vboot: Add measured boot modePhilipp Deppenwiese
* Introduce a measured boot mode into vboot. * Add hook for stage measurements in prog_loader and cbfs. * Implement and hook-up CRTM in vboot and check for suspend. Change-Id: I339a2f1051e44f36aba9f99828f130592a09355e Signed-off-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com> Signed-off-by: Werner Zeh <werner.zeh@siemens.com> Reviewed-on: https://review.coreboot.org/c/29547 Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2018-11-08security/vboot: Add selection for firmware slots used by VBOOTPhilipp Deppenwiese
Make the firmware slot configuration in VBOOT selectable. The following three modes are available: -RO only -RO + RW_A -RO + RW_A + RW_B The mode "RO only" is the lowest mode with no safety during update. You can select either RW_A or RW_AB via Kconfig which will add the selected parttions to the final image. Change-Id: I278fc060522b13048b00090b8e5261c14496f56e Signed-off-by: Philipp Deppenwiese <zaolin@das-labor.org> Signed-off-by: Werner Zeh <werner.zeh@siemens.com> Reviewed-on: https://review.coreboot.org/27714 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Aaron Durbin <adurbin@chromium.org> Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
2018-10-31reset: Finalize move to new APINico Huber
Move soft_reset() to `southbridge/amd/common/` it's only used for amdfam10 now. Drop hard_reset() for good. Change-Id: Ifdc5791160653c5578007f6c1b96015efe2b3e1e Signed-off-by: Nico Huber <nico.h@gmx.de> Reviewed-on: https://review.coreboot.org/29059 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Aaron Durbin <adurbin@chromium.org>
2018-10-22reset: Provide new single-function reset APINico Huber
board_reset() replaces the existing common reset API. There is no common distinction between reset types across platforms, hence, common code could never decide which one to call. Currently only hard_reset() is used by common code. We replace these calls and provide a fall-back to the current hard_reset() implemen- tation. The fall-back will be removed along with hard_reset() after the transition of all boards. Change-Id: I274a8cee9cb38226b5a0bdff6a847c74ef0b3128 Signed-off-by: Nico Huber <nico.h@gmx.de> Reviewed-on: https://review.coreboot.org/29047 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Reviewed-by: Aaron Durbin <adurbin@chromium.org>
2018-06-04security/tpm: Unify the coreboot TPM software stackPhilipp Deppenwiese
* Remove 2nd software stack in pc80 drivers directory. * Create TSPI interface for common usage. * Refactor TSS / TIS code base. * Add vendor tss (Cr50) directory. * Change kconfig options for TPM to TPM1. * Add user / board configuration with: * MAINBOARD_HAS_*_TPM # * BUS driver * MAINBOARD_HAS_TPM1 or MAINBOARD_HAS_TPM2 * Add kconfig TPM user selection (e.g. pluggable TPMs) * Fix existing headers and function calls. * Fix vboot for interface usage and antirollback mode. Change-Id: I7ec277e82a3c20c62a0548a1a2b013e6ce8f5b3f Signed-off-by: Philipp Deppenwiese <zaolin@das-labor.org> Reviewed-on: https://review.coreboot.org/24903 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Aaron Durbin <adurbin@chromium.org>
2018-05-03security/vboot: make vboot starts in bootblock depend on c envAaron Durbin
coreboot on skylake originally did ship with romcc bootblock and verstage running after it. However, that configuration makes boot flows very complicated. No platform in the current code base uses this combination. Make VBOOT_STARTS_IN_BOOTBLOCK depend on C_ENVIRONMENT_BOOTBLOCK. BUG=b:78656686 Change-Id: Ia9446f209521f71c91b83d579b9e2d89744292bc Signed-off-by: Aaron Durbin <adurbin@chromium.org> Reviewed-on: https://review.coreboot.org/25984 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Furquan Shaikh <furquan@google.com> Reviewed-by: Subrata Banik <subrata.banik@intel.com> Reviewed-by: Justin TerAvest <teravest@chromium.org> Reviewed-by: Hannah Williams <hannah.williams@intel.com>
2018-03-26vboot: Update to most recent GBB flag usageJulius Werner
This patch changes the GBB flag configuration to the latest usage in upstream vboot (as of https://chromium-review.googlesource.com/976660). Change-Id: I585d662d7de34b4964d028e3d06b4df5665fbe9e Signed-off-by: Julius Werner <jwerner@chromium.org> Reviewed-on: https://review.coreboot.org/25346 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Aaron Durbin <adurbin@chromium.org>
2018-01-17security/vboot: Add two weak methods for vboot2Philipp Deppenwiese
In order to make VBOOT2 independent from the CHROMEOS kconfig option a weak method for get_write_protect_state and get_recovery_mode_switch() is required. Introduce a kconfig option for controlling this behaviour. This is a temporary fix and will be removed afterwards. Change-Id: I3b1555bd93e1605e04d5c3ea6a752eb1459e426e Signed-off-by: Philipp Deppenwiese <zaolin@das-labor.org> Reviewed-on: https://review.coreboot.org/22102 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Martin Roth <martinroth@google.com>
2017-10-22security/vboot: Move vboot2 to security kconfig sectionPhilipp Deppenwiese
This commit just moves the vboot sources into the security directory and fixes kconfig/makefile paths. Fix vboot2 headers Change-Id: Icd87f95640186f7a625242a3937e1dd13347eb60 Signed-off-by: Philipp Deppenwiese <zaolin@das-labor.org> Reviewed-on: https://review.coreboot.org/22074 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Martin Roth <martinroth@google.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 20:13:25 +0000